[Android Software/Hacking General [Developers Only]] Christian Buchner:
Got the first 3G connection working

Hello!

I've got my first 3G connection working with the ZT-180 using a ZTE modem (Vodafone K3565-Z 3G stick). The stick currently costs 10 Euros in Germany and has no SIM-lock. The stick also holds optional microSD cards which the ZT-180 will mount as /udisk.

The good news is that I can even toggle the connection with the "3G EDVO" switch from the Settings application. What remains are some occasional hickups where the connection sometimes refuses to be established (pppd then reports that the connect script failed, I still need to figure out why), but it usually works when retrying.

Very important: I had to permanently disable the CD drive feature on this stick from a Windows terminal program first or the ZT-180 will not recognize it. This AT command is specific to ZTE modems.

AT+ZCDRUN=8

To disable the PIN check on the SIM card use this command where xxxx is your current PIN code.

AT+CLCK="SC",0,"xxxx"

My modem uses /dev/ttyUSB3 by default, so I had to modify some scripts accordingly. The sample configuration below works with the Vodafone Websessions service in Germany.

My contents of /system/etc/ppp/peers/cdma (and cdma_h). Adjust the given user name if needed. Stick to these file names, otherwise Settings.apk won't be able to control the connection.

file /system/etc/ppp/options-3g
connect '/system/xbin/chat -v -f /system/etc/ppp/chat-3g-connect'
disconnect '/system/xbin/chat -v -f /system/etc/ppp/chat-3g-disconnect'
user Vodafone

My contents of /system/etc/ppp/options-3g. Not sure if all of these options are actually needed as given.

/dev/ttyUSB3
921600
nolock
crtscts
modem
passive
novj
defaultroute
noipdefault
usepeerdns
noauth
hide-password
debug
nodetach
ipcp-accept-local
ipcp-accept-remote

My contents of /system/etc/ppp/chat-3g-connect. Modify the APN as needed. This will only work if the PIN check on your device has been disabled, otherwise you need to insert an AT+CPIN="xxxx" command before setting the APN.

ABORT "BUSY"
ABORT "NO CARRIER"
ABORT "VOICE"
ABORT "NO DIALTONE"
ABORT "NO DIAL TONE"
ABORT "NO ANSWER"
ABORT "DELAYED"
ABORT "ERROR"
REPORT CONNECT
TIMEOUT 10
"" AT
OK AT+CGDCONT=1,"IP","event.vodafone.de"
OK ATDT*99***1#
TIMEOUT 20
CONNECT ""

My contents of /system/etc/ppp/chat-3g-disconnect

ABORT "BUSY"
ABORT "ERROR"
ABORT "NO DIALTONE"
SAY "\nSending break to the modem\n"
"" "\K"
"" "\K"
"" "\K"
"" "\d\d+++\d\dATH"
SAY "\nPDP context detached\n"

Contents of /system/etc/ppp/pap-secrets and /system/etc/ppp/chap-secrets files. Username first, followed by *, and password second. Change this as needed. The username needs to match the one given in the "cdma" script I think.

# client server secret IP addresses
Vodafone * Vodafone

Here is the ppp setup log (as returned by adb logcat)

I/pppd ( 2898): Serial connection established.
D/pppd ( 2898): using channel 1
I/ethernet( 2062): Current is not eth0
I/pppd ( 2898): Using interface ppp0
I/pppd ( 2898): Connect: ppp0 <--> /dev/ttyUSB3
W/pppd ( 2898): Warning - secret file /etc/ppp/pap-secrets has world and/or group access
D/pppd ( 2898): sent [LCP ConfReq id=0x1 <asyncmap 0x0> <magic 0xc1ca1031> <pcomp> <accomp>]
D/pppd ( 2898): rcvd [LCP ConfReq id=0x0 <asyncmap 0x0> <auth chap MD5> <magic 0x13ec306> <pcomp> <accomp>]
D/pppd ( 2898): sent [LCP ConfAck id=0x0 <asyncmap 0x0> <auth chap MD5> <magic 0x13ec306> <pcomp> <accomp>]
D/pppd ( 2898): rcvd [LCP ConfAck id=0x1 <asyncmap 0x0> <magic 0xc1ca1031> <pcomp> <accomp>]
D/pppd ( 2898): rcvd [LCP DiscReq id=0x1 magic=0x13ec306]
D/pppd ( 2898): rcvd [CHAP Challenge id=0x1 <aa2f30ae3c9b89ddc4f12e75f6b6025d>, name = "UMTS_CHAP_SRVR"]
W/pppd ( 2898): Warning - secret file /etc/ppp/chap-secrets has world and/or group access
D/pppd ( 2898): sent [CHAP Response id=0x1 <b128a70cb452f5f1b1c4d2e6428181eb>, name = "Vodafone"]
D/pppd ( 2898): rcvd [CHAP Success id=0x1 ""]
I/pppd ( 2898): CHAP authentication succeeded
D/pppd ( 2898): sent [CCP ConfReq id=0x1 <deflate 15> <deflate(old#) 15> <bsd v1 15>]
D/pppd ( 2898): sent [IPCP ConfReq id=0x1 <addr 0.0.0.0> <ms-dns1 0.0.0.0> <ms-dns3 0.0.0.0>]
D/pppd ( 2898): rcvd [LCP ProtRej id=0x2 80 fd 01 01 00 0f 1a 04 78 00 18 04 78 00 15 03 2f]
D/pppd ( 2898): rcvd [IPCP ConfNak id=0x1 <ms-dns1 10.11.12.13> <ms-dns3 10.11.12.14> <ms-wins 10.11.12.13> <ms-wins 10.11.12.14>]
D/pppd ( 2898): sent [IPCP ConfReq id=0x2 <addr 0.0.0.0> <ms-dns1 10.11.12.13> <ms-dns3 10.11.12.14>]
D/pppd ( 2898): rcvd [IPCP ConfReq id=0x0]
D/pppd ( 2898): sent [IPCP ConfNak id=0x0 <addr 0.0.0.0>]
D/pppd ( 2898): rcvd [IPCP ConfNak id=0x2 <addr 10.249.30.43> <ms-dns1 139.7.30.125> <ms-dns3 139.7.30.126>]
D/pppd ( 2898): sent [IPCP ConfReq id=0x3 <addr 10.249.30.43> <ms-dns1 139.7.30.125> <ms-dns3 139.7.30.126>]
D/pppd ( 2898): rcvd [IPCP ConfReq id=0x1]
D/pppd ( 2898): sent [IPCP ConfAck id=0x1]
D/pppd ( 2898): rcvd [IPCP ConfAck id=0x3 <addr 10.249.30.43> <ms-dns1 139.7.30.125> <ms-dns3 139.7.30.126>]
W/pppd ( 2898): Could not determine remote IP address: defaulting to 10.64.64.64
I/pppd ( 2898): local IP address 10.249.30.43
I/pppd ( 2898): remote IP address 10.64.64.64
I/pppd ( 2898): primary DNS address 139.7.30.125
I/pppd ( 2898): secondary DNS address 139.7.30.126
I/ethernet( 2062): Current is not eth0
I/ethernet( 2062): Current is not eth0
I/ethernet( 2062): Current is not eth0
I/ethernet( 2062): Current is not eth0
I/ethernet( 2062): Current is not eth0
D/pppd ( 2898): Script /etc/ppp/ip-up started (pid 2910)
D/pppd ( 2898): Script /etc/ppp/ip-up finished (pid 2910), status = 0x0

What I find problematic is that as soon as the 3G modem is plugged in, the rild ("radio interface layer daemon") crashes periodically. Crash dump follows. Does this also happen to you guys? It totally clobbers the adb logcat output with useless information.

I/DEBUG ( 2907): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG ( 2907): Build fingerprint: 'p7901a/p7901a/p7901a/:2.1-update1/ERE27/eng.wwang.20100826.112720:eng/test-keys'
I/DEBUG ( 2907): pid: 2912, tid: 2916 >>> /system/bin/rild <<<
I/DEBUG ( 2907): signal 11 (SIGSEGV), fault addr 00000004
I/DEBUG ( 2907): r0 100ffd00 r1 00000000 r2 ae006434 r3 00000000
I/DEBUG ( 2907): r4 00000014 r5 ae006124 r6 00000000 r7 0000c5c0
I/DEBUG ( 2907): r8 00100000 r9 ae405e71 10 10000000 fp 00000000
I/DEBUG ( 2907): ip ae0061c8 sp 100ffcb0 lr afe0f5c0 pc ae00257c cpsr 60000030
I/DEBUG ( 2907): #00 pc 0000257c /system/lib/libreference-ril.so
I/DEBUG ( 2907): #01 pc 00002ca4 /system/lib/libreference-ril.so
I/DEBUG ( 2907): #02 pc 000029aa /system/lib/libril.so
I/DEBUG ( 2907): #03 pc 00005b7e /system/lib/libril.so
I/DEBUG ( 2907): #04 pc 00005bce /system/lib/libril.so
I/DEBUG ( 2907): #05 pc 000061d8 /system/lib/libril.so (_Z14ril_event_loopv)
I/DEBUG ( 2907): #06 pc 00005ee8 /system/lib/libril.so
I/DEBUG ( 2907): #07 pc 000101c8 /system/lib/libc.so (__thread_entry)
I/DEBUG ( 2907): #08 pc 0000fc88 /system/lib/libc.so (pthread_create)
I/DEBUG ( 2907):
I/DEBUG ( 2907): code around pc:
I/DEBUG ( 2907): ae00256c ffb0f001 d0002800 9815e100 a8146883
I/DEBUG ( 2907): ae00257c 9614685e f91ef002 da002800 9a14e0f6
I/DEBUG ( 2907): ae00258c e0032300 d100292c 32013301 29007811
I/DEBUG ( 2907):
I/DEBUG ( 2907): code around lr:
I/DEBUG ( 2907): afe0f5b0 e5974000 e2144903 1a00000a ebfff9d6
I/DEBUG ( 2907): afe0f5c0 e3500001 0a000005 e5874000 e1a00007
I/DEBUG ( 2907): afe0f5d0 e3a01001 ebfff9fc e1a00004 e8bd81f0
I/DEBUG ( 2907):
I/DEBUG ( 2907): stack:
I/DEBUG ( 2907): 100ffc70 00000610
I/DEBUG ( 2907): 100ffc74 00000002
I/DEBUG ( 2907): 100ffc78 ae004edd /system/lib/libreference-ril.so
I/DEBUG ( 2907): 100ffc7c 00000000
I/DEBUG ( 2907): 100ffc80 00000000
I/DEBUG ( 2907): 100ffc84 00000014
I/DEBUG ( 2907): 100ffc88 100ffd04
I/DEBUG ( 2907): 100ffc8c 00000000
I/DEBUG ( 2907): 100ffc90 0000c5c0 [heap]
I/DEBUG ( 2907): 100ffc94 ae0044e5 /system/lib/libreference-ril.so
I/DEBUG ( 2907): 100ffc98 100ffd04
I/DEBUG ( 2907): 100ffc9c 00000014
I/DEBUG ( 2907): 100ffca0 00003bd6
I/DEBUG ( 2907): 100ffca4 00000014
I/DEBUG ( 2907): 100ffca8 ae006124 /system/lib/libreference-ril.so
I/DEBUG ( 2907): 100ffcac ae002571 /system/lib/libreference-ril.so
I/DEBUG ( 2907): #00 100ffcb0 100ffcd8
I/DEBUG ( 2907): 100ffcb4 00008854 /system/bin/rild
I/DEBUG ( 2907): 100ffcb8 100ffcd8
I/DEBUG ( 2907): 100ffcbc afe43cdc
I/DEBUG ( 2907): 100ffcc0 100ffcf4
I/DEBUG ( 2907): 100ffcc4 ae0016b5 /system/lib/libreference-ril.so
I/DEBUG ( 2907): 100ffcc8 100ffd48
I/DEBUG ( 2907): 100ffccc 100ffcfc
I/DEBUG ( 2907): 100ffcd0 100ffcf4
I/DEBUG ( 2907): 100ffcd4 0000c5c0 [heap]
I/DEBUG ( 2907): 100ffcd8 100ffce4
I/DEBUG ( 2907): 100ffcdc 100ffcfc
I/DEBUG ( 2907): 100ffce0 100ffcf4
I/DEBUG ( 2907): 100ffce4 542d4e43
I/DEBUG ( 2907): 100ffce8 ffffffff
I/DEBUG ( 2907): 100ffcec 00000000
I/DEBUG ( 2907): 100ffcf0 00000000
I/DEBUG ( 2907): 100ffcf4 00000000
I/DEBUG ( 2907): 100ffcf8 00000000
I/DEBUG ( 2907): 100ffcfc 312d143d
I/DEBUG ( 2907): 100ffd00 00000000
I/DEBUG ( 2907): 100ffd04 0000c5d8 [heap]
I/DEBUG ( 2907): 100ffd08 00000000
I/DEBUG ( 2907): 100ffd0c 00000014
I/DEBUG ( 2907): 100ffd10 00000000
I/DEBUG ( 2907): 100ffd14 00000000
I/DEBUG ( 2907): 100ffd18 ae006124 /system/lib/libreference-ril.so
I/DEBUG ( 2907): 100ffd1c ae002ca9 /system/lib/libreference-ril.so
I/DEBUG ( 2907): #01 100ffd20 0000a498 [heap]
I/DEBUG ( 2907): 100ffd24 0000a4a8 [heap]
I/DEBUG ( 2907): 100ffd28 0000c5c0 [heap]
I/DEBUG ( 2907): 100ffd2c a9d13fe5 /system/lib/libutils.so
I/DEBUG ( 2907): 100ffd30 0000a448 [heap]
I/DEBUG ( 2907): 100ffd34 100ffd5c
I/DEBUG ( 2907): 100ffd38 afe3cc1c
I/DEBUG ( 2907): 100ffd3c afe0f6a8 /system/lib/libc.so
I/DEBUG ( 2907): 100ffd40 00000000
I/DEBUG ( 2907): 100ffd44 afe0f5c0 /system/lib/libc.so
I/DEBUG ( 2907): 100ffd48 00000003
I/DEBUG ( 2907): 100ffd4c afe3ca64
I/DEBUG ( 2907): 100ffd50 0000c5c0 [heap]
I/DEBUG ( 2907): 100ffd54 c0000000
I/DEBUG ( 2907): 100ffd58 00100000
I/DEBUG ( 2907): 100ffd5c 312d143d
I/DEBUG ( 2907): 100ffd60 00000008
I/DEBUG ( 2907): 100ffd64 312d143d
I/DEBUG ( 2907): 100ffd68 0000c5c0 [heap]
I/DEBUG ( 2907): 100ffd6c ae002b55 /system/lib/libreference-ril.so
I/DEBUG ( 2907): 100ffd70 0000c5c0 [heap]
I/DEBUG ( 2907): 100ffd74 ae409870 /system/lib/libril.so
I/DEBUG ( 2907): 100ffd78 00000003
I/DEBUG ( 2907): 100ffd7c ae4029ad /system/lib/libril.so

Check out this section from /system/build.prop. It defines /dev/ttyS0 as modem interface for the RIL library!

rild.libpath=/system/lib/libreference-ril.so
rild.libargs=-d /dev/ttyS0

rild.libargs needs to be changed to -d /dev/ttyUSB1 with my particular modem, so the current signal strength and other parameters can be pulled from the USB modem's diagnostic interface (regardless whether /dev/ttyUSB3 has an active connection or not...)

I decided to dump the crashing libreference-ril.so by Zenithink and use the one from the Android 2.1 SDK emulator image instead. A quick adb pull from the emulator, followed by an adb push to the ZT-180 did the trick. I've now got signal strength indicator bars for 3G on my home screen!