yashsingh1/xdaforums huggingface dataset:
[T-Mobile LG G2x] Mazout360:
I updated my github with the radio drivers found by adampk, adapted to our device and with dependencies/GPIO fixed HERE. This really has potential as it already includes dual spi support and is made to work on a tegra platform. If you want to help debugging it feel free to sync.

I also removed star_board_baseband.c as it is totally useless now.

And...quick logcat :

And it keeps looping like this. So...we're stuck with the same issue. Oh well...

EDIT: What are the GPIO names for IFX_RESET_1V8 and IFX_PWRON ? The ones in spi_mdm6600.c are different from those in fota.c. Getting the right GPIO names should be a good start here isn't it ? And changing from TEGRA_GPIO_PV0/PV1 to PV1/PV0 or either PO0/PV1 doesn't seem to change much in the logcat, so they might as well be all wrong.
[T-Mobile LG G2x] apolkosnik:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

TEGRA_GPIO_PV0/PV1 should be the right values.

One crazy thing to try is to try to flash the startablet kernel and see if that changes anything radio related. At least adb should work. Then add the appropriate drivers, and we'll have a nice 3.1.x kernel for G2x.
[T-Mobile LG G2x] plarmann:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

I see true commitment to the cause here. Xda- Where brain meets street

:)
[T-Mobile LG G2x] Core Memory:
Have you tried toggling the radio on/off? Here's something related but is an answer to a different question (partially copied below). And, here's a link to the PM8028 Software Driver Overview document, it is on a Chinese website, it may be useful http://www.rd211.com/docu/38691.html

https://groups.google.com/forum/#!topic/android-ndk/TRMqDEqmmlI

Chris Stratton

Sign in to reply

5/9/11

On Monday, May 9, 2011 1:33:21 PM UTC-4, felixad wrote:

* Toggle radio on and off (for "airplane" mode)

* "data" is int *

* ((int *)data)[0] is > 0 for "Radio On"

* ((int *)data)[0] is == 0 for "Radio Off"

It seems that the RADIO_POWER is here an integer which contains values

which can stand for the transmission power TX.

That looks to me more like it enables/disables the DC supply power to that portion of the chip and perhaps associated outboard amplifiers. It sounds all-or-nothing rather than variable.

felixad

Sign in to reply

5/9/11

> That looks to me more like it enables/disables the DC supply power to that

> portion of the chip and perhaps associated outboard amplifiers. It sounds

> all-or-nothing rather than variable.

Yes. It switch the transmitted power on or off. I also found a GSM

command for this. It is +CFUN (in 3GPP TS 27.007).

Then I looked in the java code. There I can check, if the phone is in

the aiplaine mode or not:

ITelephony phone =

ITelephony.Stub.asInterface(ServiceManager.checkService("phone"));

if (phone != null) {

if (phone.isRadioOn() == true)

....

Here the phone state is always only a boolean. But I thougth in the

ril.h they access to an array of integers.
[T-Mobile LG G2x] Mazout360:
...Or change mach-tegra in the 3.1.x source. I think the GPIOs and power settings are not exactly the same, but that would be a nice project! Actually, we have a linux 2.6.39 kernel but many drivers were backported...I don't know why LG chose that version
[T-Mobile LG G2x] Core Memory:
Here's the LGV909DW G-Slate partition layout:

http://code.google.com/p/lg-v909/wiki/Partitions
[T-Mobile LG G2x] Guntert:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

Same here
[T-Mobile LG G2x] Core Memory:
Here's why Google Apps won't be available for JB 4.2 onwards for anything with the Tegra 2 in it.

http://rootzwiki.com/topic/32322-ro...obile-g-slate-v909/page__st__260#entry1087426
[T-Mobile LG G2x] capncybo:
Wow

Re: No Goggle apps forward...

Perfect ! Being the proud owner of a G2X I've become quite accustom to being !@#$'d by Nvidia & LG but Now Google Too !!!

Awesome... Hat-Trick, or some kinda trick.
[T-Mobile LG G2x] Core Memory:
Mazout360 asked for the service manual for the LG G-Slate so here it is:

http://elektrotanya.com/lg_optimus_pad_v900_lg-v900.pdf/download.html
[T-Mobile LG G2x] apolkosnik:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

So, I tried to flash the rom (after removing asserts from the install script) from g-slate and it actually booted to the spinning CM boot screen... Just need to get the adb enabled.
[T-Mobile LG G2x] Core Memory:
There's more than one type/manufacture of radio/modem in the G-Slate. The service manual only has one page (37), a block diagram, which includes the mdm6200, the rest is for an Infineon radio/modem.
[T-Mobile LG G2x] PaKii94:
:( thats sad news to hear but it happens... the tegra 2 is already 2 gens behind now with tegra 4 coming out.. i would still ahve been satisfied with the g2x if i got ics running on there but without even that it remains a disappointment. thanks to u guys for ur development efforts. I hope u do get cm10 running on the g2x it would bring a good end of life to one of the most underrated most effed over devices...
[T-Mobile LG G2x] ssuds:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

Well I'm sure people will start work on fapps as soon as we have a working CM10... We have an awesome dev community
[T-Mobile LG G2x] capncybo:
Any Progress?

I can't take the silence any-more... did you get ADB to communicate with the different Kernel/Radio, Adam ???

For some reason I feel this approach is our last Hope for a working Radio.

Good Luck, & many Thanks

:good:
[T-Mobile LG G2x] TheEnternal:
I'll go ahead and keep the thread going, although to follow up with more disappointing news. I wasn't able to get any responses from the LG engineers through linkedin. Although like the guys here, I won't give up, maybe ill get lucky and get the info these guys need.
[T-Mobile LG G2x] xp99:
I don't think anyone here has posted this idea, but I do remember there being 3 different basebands for the g2x. They were in the following firmware files in order from oldest to newest:

V21D_00.01.kdz

V21E_00.01.kdz

V21Y_00.kdz

Now I do recall that for the newest baseband, we had to include some precompiled library that was in 21Y firmware to get the radio working properly again in CM 7.2. Did we try with different baseband versions? Not sure what was needed for 21E and 21D basebands to work, but I know it took a bit to get the baseband of 21Y working.
[T-Mobile LG G2x] :
The radio was working fine, there was a popping noise during calls that needed a fix. That has nothing to do with the broken radio, or at least we won't know unless we can make a phone call.
[T-Mobile LG G2x] Mazout360:
Okay I think it's time to make a quick summary of this radio issue. Good news and bad news... Adampk, if you wish, give me your thoughts about this.

After backporting everything from the G-Slate, same issue with the nodes. Doublechecked everything: Power, Clock frequencies, Initialization sequence, drivers, GPIOs...Everything looks all right. So for the good news: with everything I tried, I think the driver works and the modem too. The kernel does support this model (MDM6200/6600) and the chip "seems" powered on properly at boot (can't really confirm this if it's impossible to communicate with it though).

Here's what happens (in GB) :

- The modem gets a power-on signal from IFX_XXXX GPIOs. Clock speeds are set and the prebootloader initializes the radio functions.

- The kernel opens ~32 nodes, via NvRm-based functions (Defined in NVIDIA Blobs!) used in ODM-kit kernels (Deprecated).

- LG RIL blobs calls the modem via node PTS29 (returns an error since the JB kernel doesn't support NvRm functions to open SPI nodes).

- LG RIL blobs attemps to send data to the modem via the other nodes (returns an error again here).

Now for the bad news: I think LG locked their RIL libs to specific phone models, via a version-check or something like that. I tried using the G-Slate libs to change how the OS would communicate with the modem but the rild socket closed. Problem is, the libs for our model depends on how NvRm functions opened the nodes in GB, and these functions are not available in the newer kernel.

Which leads me to some workaround ideas :

- Get the source code for LG RIL librairies and recode them so it works like on the G-Slate and not via ~32 PTS nodes. (Almost impossible)

- Get the source code for NVIDIA NvRm-services.so (I think that's the right one), especially for NvRmSpi functions, to add a new driver in the kernel that would open the nodes just like in GB kernels. (Somewhat impossible)

- Find a workaround code that would work like NvRmSpi functions (Doable, but may be long to do)

- Find a RIL library that is compatible with our device (and modem) (Probably impossible)

I don't want to be pessimistic... but I hope I'm wrong.

Oh...also, don't forget to send some thanks to LG for this!
[T-Mobile LG G2x] apolkosnik:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

Good stuff, just in my understanding, it all happens a bit differently. I'll try to write about it later today.
[T-Mobile LG G2x] apolkosnik:
Good stuff Mazout, I'll just add a few things to what you got there.

G-Slate hardware uses different GPIOs for certain things, some of them are mapped the same, some of them are different. So, when playing with that stuff you got to be aware of that.

PTS29 is used by a piece of code that's called lgcpversion (in /system/bin/... the source code is in device/lge/p999/bbversion/cpversion.c

It simply issues AT%SWOV

write(fd,"AT%SWOV\r",8);

to the baseband, and then uses the result to set the version of the baseband radio through

property_set("gsm.version.baseband", result);

so that it shows up under Baseband version in About phone dialog.

Problem that we have with our kernel is between the Tegra and the baseband chip, it seems. What I've noticed and that also aligns with what Ricardo said, that the RIL tries to send these AT commands to the baseband chip, but they are either not making it there or we are not getting any replies or both.

I can think of a couple of ways to check what's happening, but I guess that requires one to rig some special cables (or do some changes to the MUIC code) or open up the phone and hook up to the baseband's JTAG interface. At this point I'm just trying to make sure that I got the right GPIOs (verifying it with what I can glean from GB code). The next is to play with MUIC, and set it to a few different modes and see what happens if switching it to a mode where the tegra is connected to the baseband does anything or maybe we can get a line to the baseband chip, and "talk" to it through the USB cable directly.

AFAIK, RIL doesn't do any magic stuff other than send some AT commands to the baseband, and that's already documented elsewhere. We can just use the ReferenceRIL, but we can still use other ones. I guess anybody can pipe the RIL through objdump (or whatever you like the most for reversing), and have it disassembled. But an easy way to test it would be to do some experimentation on GB ROM, and try different RILs.
[T-Mobile LG G2x] Core Memory:
How about using QPST and QXDM to monitor the phone while operating in real time?
[T-Mobile LG G2x] apolkosnik:
Yes, that's what messing with MUIC can get you... you can switch it to CP_USB mode and talk to the baseband directly through USB.
[T-Mobile LG G2x] Core Memory:
How about decompiling a relevant RIL as was apparently done here:

http://mjanja.co.ke/2012/11/ril-working-on-huawei-u8185-on-cyanogenmod-9/
[T-Mobile LG G2x] apolkosnik:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

Any volunteers?
[T-Mobile LG G2x] Mazout360:
I changed what I found out to be wrong concerning the G-Slate GPIOs already. We need to confirm these settings though.

This is a good strategy. At least, we know the hardware itself works so it got to be something wrong with how the kernel or the OS itself (maybe?) handles the communication. If you try to send or receive something to/from the baseband chip by USB (we don't have other choices here really..I don't think you'd want to open up the phone to start playing with the chips), I think it would work. Could this issue simply be between the OS and the kernel ? The kernel initializes the baseband chip and opens up the communication, but the OS doesn't "talk" to the right chip (or the kernel itself doesn't link the radio to the right chip) ?
[T-Mobile LG G2x] Core Memory:
http://afewe.wordpress.com/android-...ith-the-radio-layer-interface-ril-in-android/
[T-Mobile LG G2x] Core Memory:
Android RIL Architecture

http://www.e-consystems.com/blog/android/?p=498

http://www.docstoc.com/docs/95010514/2-Architecture-Overview
[T-Mobile LG G2x] Core Memory:
Have you done a radio logcat?

adb logcat -b radio

It will include the AT commands and responses that communicate through the RIL.

What does it return?

Here's something that may be useful, rilspy:

https://github.com/Entropy512/rilspy
[T-Mobile LG G2x] apolkosnik:
The issue is all in kernel, it has nothing to do with Android. Baseband chip uses the baseband firmware to spin up its own little arm chip once the power is on, so we might be not doing something right, like not setting the IRQ to SPI_MRDY or something along these lines. There are a few weird things going on in the GB implementation of the (arch/arm/mach-tegra/board-nvodm.c)
[T-Mobile LG G2x] apolkosnik:
Yes, every time I've tested a build since before Christmas. Either RIL is *****ing about Radio not present or you can see some failed transactions in dmesg output.
[T-Mobile LG G2x] Core Memory:
Post the radio log.

---------- Post added at 01:24 PM ---------- Previous post was at 01:10 PM ----------

The daemon communicates with the vendor baseband which communicates with the mdm6600 that runs its own firmware that interprets the AT commands it receives. There are a lot of reasons that the communications can be prevented, even wrong permission settings will do it. It is important to find exactly where the communication is interrupted to debug the problem. That's what rilspy is useful for, it provides a wrapper for libsec_ril.so that intercepts communication with the radio/modem and logs it. Other tools, such as a RIL decompiler, may have to be found and/or built and/or code added to debug the problem. I am not set up to do any Android or Linux development, my old and too slow computing resources are not up to the job so I can't do it, someone else will have to. Open Source Android is a farce.
[T-Mobile LG G2x] Mazout360:
Be aware that even in GB the radio debug output is packed with errors and failed transactions, and it still works. I'm actually surprised that the logcat with the JB kernel is that clean.
[T-Mobile LG G2x] PaKii94:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

If you need computing power I can try helping. My i7 is just sitting here waiting to be pushed
[T-Mobile LG G2x] Core Memory:
Yes, there are lots of screw-ups and process failures showing in the logcats and there are workarounds that eventually causes everything to continue and the logcat will show the processes continue to success whereas the logcat of a failed process won't show any successful continuation of that process and continue with the next part or, if the problem is serious enough, it will blow up and cause a failed boot, or SOD, etc. The logcat of the JB kernel is fairly clean because it doesn't complete all the processes, the ones related to the radio/modem.

---------- Post added at 02:19 PM ---------- Previous post was at 02:12 PM ----------

Thanks for your offer of help but it isn't a matter of someone else having the computing power, it is the person doing the development having it.
[T-Mobile LG G2x] PaKii94:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

Hmmm we could use team viewer or something idk if anyone things of a useful way I am in to help
[T-Mobile LG G2x] apolkosnik:
Your wish is granted ;)

Also... This is how you can disassemble stuff if you got the build env set up: $ANDROID_TOOLCHAIN/arm-linux-androideabi-objdump -d ~/Downloads/cm-7.2.0-p999/system/lib/lge-ril.so >> ~/Downloads/lge-ril.so.asm

If you know somebody that has IDA Pro with Hex-rays, these things can disassemble and then turn the output into readable C, but that setup costs a pretty penny.

Here's the list of functions there:

00001f90 <.plt>:
000022b0 <lgf_Convert_Hex_FromChar-0x2c>:
000022dc <lgf_Convert_Hex_FromChar>:
00002314 <lgf_DeScramble_Passwd>:
00002338 <lgf_Scremble_Passwd>:
0001922c <RIL_Init>:
0001c178 <at_set_on_timeout>:
0001c188 <at_set_on_reader_closed>:
0001c20c <at_get_cme_error>:
0001c314 <ext_writeline>:
0001c58c <at_response_free>:
0001c91c <at_send_command_multiline_timeout>:
0001c93c <at_send_command_multiline>:
0001c95c <at_send_command_sms_wcdma>:
0001c978 <at_send_command_sms_wcdma_timeout>:
0001c994 <at_send_command_no_resp>:
0001c9b0 <at_send_command_timeout>:
0001c9cc <at_send_command>:
0001c9e8 <at_send_command_sms_timeout>:
0001ca30 <at_send_command_sms>:
0001ca78 <at_send_command_numeric_timeout>:
0001cac4 <at_send_command_numeric>:
0001cb10 <at_send_command_singleline_timeout>:
0001cb60 <at_send_command_singleline>:
0001cbb0 <at_close>:
0001cc44 <at_open>:
0001d2bc <at_handshake>:
0001d370 <strStartsWith>:
0001d398 <skipWhiteSpace>:
0001d3cc <at_tok_skip_next_comma>:
0001d3f8 <at_tok_hasmore>:
0001d468 <at_tok_nextstr>:
0001d4b8 <at_tok_nexthexint>:
0001d4c4 <at_tok_nextint>:
0001d4d0 <at_tok_nextbool>:
0001d4f0 <at_tok_start>:
[T-Mobile LG G2x] n30wav3:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

M thinking abt the same ... but prob is who is gonna disconnect reconnect and take out the battery during testinf if required
[T-Mobile LG G2x] SpaceRanger69:
Being that the majority of that .so is the "scremble" of a password it seems, could our problems lie in the fact that the "lgf_Scremble_Passwd" links to a library that doesn't work in JB?
[T-Mobile LG G2x] Core Memory:
Maybe the password is "Scremble".
[T-Mobile LG G2x] apolkosnik:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

LOL
[T-Mobile LG G2x] Core Memory:
00001f90 <.plt>:

The PLT

The Procedure Linkage Table is a table in which the various entries are made up of code blocks. It's the principal component which allows the dynamic linker to resolve external functions. Here's an example: suppose that you write a program which references a function defined inside a library:

http://www.codeproject.com/Articles/30824/PLT-redirection-through-shared-object-injection-in

The next section I want to mention is the .plt section. This contains the jump table that is used when we call functions in the shared library. By default the .plt entries are all initialized by the linker not to point to the correct target functions, but instead to point to the dynamic loader itself. Thus, the first time you call any given function, the dynamic loader looks up the function and fixes the target of the .plt so that the next time this .plt slot is used we call the correct function. After making this change, the dynamic loader calls the function itself.

http://www.linuxjournal.com/article/1060

http://www.apriorit.com/our-experience/articles/9-sd-articles/181-elf-hook

Look at page 476 onwards of the book "The Ida Pro Book:

The Unofficial Guide to the World's Most Popular Disassembler":

http://books.google.ca/books?id=kOJ...&ved=0CCwQ6AEwAA#v=onepage&q=ida .plt&f=false

000022b0 <lgf_Convert_Hex_FromChar-0x2c>:

000022dc <lgf_Convert_Hex_FromChar>:

Are string conversions and -0x2c is the ASCII comma character which is used as the separator.
[T-Mobile LG G2x] Core Memory:
This is very interesting and potentially useful:

http://0xlab.org/~jserv/discover-android-system.pdf
[T-Mobile LG G2x] apolkosnik:
In the kernel tree there is this little nifty tool:

Documentation/spi/spidev_test.c
[T-Mobile LG G2x] Core Memory:
Have you used it on the G2X/P999?
[T-Mobile LG G2x] apolkosnik:
Got to compile it first.
[T-Mobile LG G2x] Core Memory:
Here's someone who got CM10.1 running on the Motorola Photon 4G which has the the same Tegra2 and Qualcomm mdm6600 hardware:

http://th3bill.com/
[T-Mobile LG G2x] Mazout360:
The MDM6X00 modem in motorola phones is "wired" via USB, which always worked well. It's not a SPI device.
[T-Mobile LG G2x] Core Memory:
Yes, I know. I was thinking it may be possible to communicate with the radio/modem via USB, ditching whatever LG has done. Isn't using the USB method similar to using ADB or a serial terminal program through USB?
[T-Mobile LG G2x] BionicSniper:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

I would assume the Motorola phones and have a USB phy dedicated to the radio though.
[T-Mobile LG G2x] justjackyl:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

!q
[T-Mobile LG G2x] apolkosnik:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

I made a couple of builds with muic switch set to cp_uart and cp_usb, but I don't have the Windows tools handy to check if that allows you to talk to MDM6200 chip over usb.

Another thing to do would be setting up a gingerbread build and adding printk inside the GPIO related routines to make sure we're using the same ones in jb kernel.
[T-Mobile LG G2x] xBIGREDDx:
If you could point me at the particular routines (or even general areas) I've got a gingerbread build setup.

What GPIOs are you looking for?
[T-Mobile LG G2x] apolkosnik:
You can start with tegra_gpio_enable and tegra_gpio_disable.

You can try to add one of the lines from below to the inside of appropriate function (there should be a similar line that throws an error if the GPIO is over TEGRA_NR_GPIOS). With these changes we'll be able to get the raw numbers of the GPIOs called in the GB kernel.

pr_warn("%s : enable gpio ID - %d\n", __func__, gpio);

pr_warn("%s : disable gpio ID - %d\n", __func__, gpio);

Whoops, just realized that they don't use that in GB...

Take a look at arch/arm/mach-tegra/nvodm/nvodm_services.c and try to add debug around the gpio related stuff, and spi.

Thanks for stepping in!
[T-Mobile LG G2x] mansa_noob:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

Hey guys I have no clue about this stuff but was wondering if it is even possible to design an experiment and go through all "legal" possible combinations of the IO pins automatically (using a script maybe) to find the right combination?
[T-Mobile LG G2x] Core Memory:
No, because finding the "legal" possible combinations could damage the phone.
[T-Mobile LG G2x] faratl:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

I'm still not giving up on this phone and still hoping for working jb
[T-Mobile LG G2x] xp99:
Why would anyone design hardware that could physically damage itself through software?
[T-Mobile LG G2x] mansa_noob:
Re: CM10.1 based ROM #7 - Works: Camera, HWA, wifi, sdcard, Broken: radio, batt indic

Actually that is very interesting thought... how many different voltage domains (with different voltage levels) and why wouldn't we write a smart script to avoid forcing high voltage on low voltage IO?

This is how I envisioned legal combinations. It was just a thought to solve this complex problem by sheer brute force approach.

Any other reasons why it won't work?
[T-Mobile LG G2x] Darkknight512:
I think what he means is that you will probably hit an erase pin or the programming interface and destroy it. Yes, what your saying is probably not possible, I ddon' think you can change the voltage on an IO pin, just the voltage of the power supply if such a control was available. What IS possible but takes a lot of effort is to breakout all the pins and read off the values and start reverse engineering, I beleive something like that was initially done on the PSP but I don't think that got anywhere, hacks were found using other less dedperate means. Anyways, I have nothing else to add.