[Sony Xperia S, Acro S, Ion] letama:
Ok, thanks! Log is good.

I believe that the issue is what I said previously, SUB1 is not sent to ril-daemon.

Here is few details:

This is where framework and ril starts to talk to each other:

D/RILC ( 194): **RILD ListenCallback**
E/RILC ( 194): Should not come here !!! buffer red ::
I/RILC ( 194): libril: new connection
I/RILC ( 194): All clients are connected remove listen socket from watch table
I/RILC ( 194): RIL Daemon version: Qualcomm RIL 1.0
D/RILJ ( 649): [UNSL]< UNSOL_RIL_CONNECTED {7}
D/RILJ ( 649): [UNSL]< UNSOL_RESPONSE_RADIO_STATE_CHANGED RADIO_OFF
D/RILB ( 649): Notifying: radio available
D/RILJ ( 649): [0004]> SCREEN_STATE: true
D/RILJ ( 649): [0005]> RADIO_POWER on
D/GSM ( 649): [GsmSST] Poll ServiceState done: oldSS=[1 home null null null Unknown CSS not supported -1 -1 RoamInd=-1 DefRoa
D/GSM ( 649): [SIMRecords] getOperatorNumeric: IMSI == null
D/GSM ( 649): [GsmSST] operatorNumeric is null
D/GSM ( 649): [GsmDCT] handleMessage msg={ what=270337 when=-10ms obj=android.os.AsyncResult@41125180 }
D/GSM ( 649): [GsmDCT] onRadioAvailable
D/GSM ( 649): [GsmDCT] overall state is IDLE
D/RILJ ( 649): [0006]> BASEBAND_VERSION
D/RILJ ( 649): [0007]> GET_IMEI
D/RILJ ( 649): [0008]> GET_IMEISV

This is where telephony in framework starts to send commands:

D/RILJ ( 649): [0006]> BASEBAND_VERSION
D/RILJ ( 649): [0007]> GET_IMEI
D/RILJ ( 649): [0008]> GET_IMEISV

But it doesn't get any answer from ril.

Later on you see that framework receives unsolicited events from ril:

D/RILJ ( 649): [UNSL]< UNSOL_RESPONSE_SIM_STATUS_CHANGED

So it means that communication is going both ways but that ril is ignoring commands coming from framework, it only notifies from internal state (UNSL means unsolicited, meaning that it's not a response to a previous command, it's a notification).

A normal message exchange would look like this:

D/RILJ ( 788): [0002]> BASEBAND_VERSION
D/RILJ ( 788): [0003]> GET_IMEI
D/RILJ ( 788): [0004]> GET_IMEISV
D/RILC ( 131): RIL onRequestComplete: Command channel closed
D/RILJ ( 788): [0002]< BASEBAND_VERSION 8660-AAABQOLYM-314010-35
D/RILC ( 131): RIL onRequestComplete: Command channel closed
D/RILJ ( 788): [0003]< GET_IMEI
D/RILC ( 131): RIL onRequestComplete: Command channel closed
D/RILJ ( 788): [0004]< GET_IMEISV

> means traffic from framework to ril

< means traffic from ril to framework.

Another proof of that, I just checked CM10 source code, you should see:

I/RILJ ( 788): Data sent!!

Not far from:

D/RILC ( 131): **RILD ListenCallback**
I/RILJ ( 788): Connected to 'rild' socket

(PID differs, this is my phone, but messages are similar).

Data sent!! means SUB1 has been sent to ril, we don't see it in your logs.

Code is there in RIL.java:

if (needsOldRilFeature("qcomdsds")) {
String str = "SUB1";
byte[] data = str.getBytes();
try {
mSocket.getOutputStream().write(data);
Log.i(LOG_TAG, "Data sent!!");
} catch (IOException ex) {
Log.e(LOG_TAG, "IOException", ex);
} catch (RuntimeException exc) {
Log.e(LOG_TAG, "Uncaught exception ", exc);
}
}

Now, for the reason why SUB1 is not sent is more difficult to assess. How do you change the framework ? I presume you don't build from source ?

For me, the problem is RIL classes in framework have been replaced and are not good anymore. If you're replacing smali files, make sure that you keep all the framework/com/android/internal/telephony untouched from fxp 233.