Project

General

Profile

Actions

XMMProtocolInterfaces » History » Revision 23

« Previous | Revision 23/46 (diff) | Next »
Denis 'GNUtoo' Carikli, 01/04/2021 10:18 PM


XMMProtocolInterfaces

usb_sel

HOWTO enable the modem usb interface

The modem also has an USB port that can be routed to the smartphone/tablet USB port.

To do that you first need to get a root shell in the device as the commands need to be executed as root.

Once this is done you need to switch the USB connector to the modem USB. This can be done with the following command:

echo MODEM > /sys/devices/virtual/sec/switch/usb_sel

Then nothing will happen, you will still be able to login through adb.

To make the device switch to the modem USB you then need to unplug and replug the USB cable between your computer and the device.

At this point, if the modem was booted, you'll see a new USB device appearing.
Some serial ports will also appear.

Tested on Replicant 6.0 0004 RC3

Device Distribution Modem status USB ids (lsusb from laptop) tty
GT-I9100 Replicant 6.0 0004 RC3 Off None N/A
GT-I9100 Replicant 6.0 0004 RC3 Booted 1519:0020 Comneon HSIC Device /dev/ttyACM0 -> /dev/ttyACM6
GT-I9300 Replicant 6.0 0004 RC3 Booted 1519:0020 Comneon HSIC Device /dev/ttyACM0 -> /dev/ttyACM6

When running lsusb on the SOC on the Replicant 11 kernel on a GT-I9300, we also see 1519:0020 Comneon HSIC Device once the modem is booted. Once powered on and before booting, the USB ids seen in lsusb with that kernel are these ones: 058b:0041 Infineon Technologies Flash Loader utility instead.

As the modem isn't visible either when not powered on, we need to look if it's possible to boot the modem from a laptop for instance.

Protocols

Device State UART Protocol
GT-I9100 modem booted /dev/ttyACM0 AT: GTI9100ModemTTYACM0
GT-I9100 modem booted /dev/ttyACM1 Compatible with xgoldmon
GT-I9300 modem booted /dev/ttyACM0 AT: GTI9300ModemTTYACM0
GT-I9100 modem booted /dev/ttyACM1 Xgoldmon waits for messages but nothing arrives

Xgoldmon

description: Xgoldmon is a software that can get some cellular protocol traces from some Samsung phones using the samsung-ipc protocol.
git: https://github.com/2b-as/xgoldmon.git

Xgoldmon seem to display things on the GT-I9100:

# ./xgoldmon -vvvv -i localhost -t s2 -l /dev/ttyACM1
LOG:>>[HIGH]oembatt.c,310,[DISP] Thermistor : measured_value=1630666778<<
LOG:>>[HIGH]oembatt.c,137,[DISP] oem_set_batt_level : 4220<<
LOG:>>[HIGH]oembatt.c,236,[DISP] BATT : measured_value_mv=4220, AvgBattVal_mv=4007, battery_level=5<<
LOG:>>[LOW]oemdisplay.c,363,no change -> rssi:4, bat:5<<
LOG:>>[HIGH]oembatt.c,310,[DISP] Thermistor : measured_value=1630666779<<
LOG:>>[HIGH]oembatt.c,137,[DISP] oem_set_batt_level : 4225<<
LOG:>>[HIGH]oembatt.c,236,[DISP] BATT : measured_value_mv=4225, AvgBattVal_mv=4026, battery_level=5<<
LOG:>>[LOW]oemdisplay.c,363,no change -> rssi:4, bat:5<<
LOG:>>[HIGH]oembatt.c,310,[DISP] Thermistor : measured_value=1630666778<<
LOG:>>[HIGH]oembatt.c,137,[DISP] oem_set_batt_level : 4220<<
LOG:>>[HIGH]oembatt.c,236,[DISP] BATT : measured_value_mv=4220, AvgBattVal_mv=4055, battery_level=5<<
LOG:>>[LOW]oemdisplay.c,363,no change -> rssi:4, bat:5<<

And when calling an (inexisting/invalid) number, the frames appear in Wireshark.

However on the GT-I9300 it waits for messages that never arrive.
And on the GT-I9100 there seem to be very few messages.

So maybe AT+TRACE=1 enables tracing but doesn't set the tracing verbosity.

Updated by Denis 'GNUtoo' Carikli about 3 years ago · 23 revisions

Also available in: PDF HTML TXT