XMMProtocolInterfaces » History » Version 41
Denis 'GNUtoo' Carikli, 01/31/2022 12:20 PM
| 1 | 1 | Denis 'GNUtoo' Carikli | h1. XMMProtocolInterfaces |
|---|---|---|---|
| 2 | |||
| 3 | 5 | Denis 'GNUtoo' Carikli | {{>toc}} |
| 4 | |||
| 5 | 10 | Denis 'GNUtoo' Carikli | h2. usb_sel |
| 6 | 3 | Denis 'GNUtoo' Carikli | |
| 7 | 21 | Denis 'GNUtoo' Carikli | h3. HOWTO enable the modem usb interface |
| 8 | 3 | Denis 'GNUtoo' Carikli | |
| 9 | 21 | Denis 'GNUtoo' Carikli | The modem also has an USB port that can be routed to the smartphone/tablet USB port. |
| 10 | 1 | Denis 'GNUtoo' Carikli | |
| 11 | 21 | Denis 'GNUtoo' Carikli | To do that you first need to get a root shell in the device as the commands need to be executed as root. |
| 12 | |||
| 13 | 10 | Denis 'GNUtoo' Carikli | Once this is done you need to switch the USB connector to the modem USB. This can be done with the following command: |
| 14 | 1 | Denis 'GNUtoo' Carikli | <pre> |
| 15 | 10 | Denis 'GNUtoo' Carikli | echo MODEM > /sys/devices/virtual/sec/switch/usb_sel |
| 16 | 1 | Denis 'GNUtoo' Carikli | </pre> |
| 17 | |||
| 18 | 10 | Denis 'GNUtoo' Carikli | Then nothing will happen, you will still be able to login through adb. |
| 19 | 1 | Denis 'GNUtoo' Carikli | |
| 20 | 10 | Denis 'GNUtoo' Carikli | To make the device switch to the modem USB you then need to unplug and replug the USB cable between your computer and the device. |
| 21 | |||
| 22 | At this point, if the modem was booted, you'll see a new USB device appearing. |
||
| 23 | Some serial ports will also appear. |
||
| 24 | |||
| 25 | Tested on Replicant 6.0 0004 RC3 |
||
| 26 | |||
| 27 | 22 | Denis 'GNUtoo' Carikli | | Device | Distribution | Modem status | USB ids (lsusb from laptop) | tty | |
| 28 | 1 | Denis 'GNUtoo' Carikli | | GT-I9100 | Replicant 6.0 0004 RC3 | Off | None | N/A | |
| 29 | | GT-I9100 | Replicant 6.0 0004 RC3 | Booted | 1519:0020 Comneon HSIC Device | /dev/ttyACM0 -> /dev/ttyACM6 | |
||
| 30 | | GT-I9300 | Replicant 6.0 0004 RC3 | Booted | 1519:0020 Comneon HSIC Device | /dev/ttyACM0 -> /dev/ttyACM6 | |
||
| 31 | 21 | Denis 'GNUtoo' Carikli | |
| 32 | When running lsusb on the SOC on the Replicant 11 kernel on a GT-I9300, we also see @1519:0020 Comneon HSIC Device@ once the modem is booted. Once powered on and before booting, the USB ids seen in lsusb with that kernel are these ones: @058b:0041 Infineon Technologies Flash Loader utility@ instead. |
||
| 33 | |||
| 34 | As the modem isn't visible either when not powered on, we need to look if it's possible to boot the modem from a laptop for instance. |
||
| 35 | 10 | Denis 'GNUtoo' Carikli | |
| 36 | 11 | Denis 'GNUtoo' Carikli | h3. Protocols |
| 37 | 12 | Denis 'GNUtoo' Carikli | |
| 38 | 39 | Denis 'GNUtoo' Carikli | |_. Device |_. State |_. UART |_. Protocol | |
| 39 | | GT-I9100 | modem booted | /dev/ttyACM0 | AT: [[GTI9100ModemTTYACM0]] | |
||
| 40 | | GT-I9100 | modem booted | /dev/ttyACM1 | Compatible with xgoldmon | |
||
| 41 | | GT-I9300 | modem booted | /dev/ttyACM0 | AT: [[GTI9300ModemTTYACM0]] | |
||
| 42 | | GT-I9100 | modem booted | /dev/ttyACM1 | With Replicant 6, Xgoldmon waits for messages but nothing arrives, |
||
| 43 | we have some messages with the stock firmware though | |
||
| 44 | | GT-I9300 | modem booted | /dev/ttyACM3 | AT: [[GTI9300ModemTTYACM0]] | |
||
| 45 | 37 | Denis 'GNUtoo' Carikli | |
| 46 | 19 | Denis 'GNUtoo' Carikli | h3. Xgoldmon |
| 47 | 1 | Denis 'GNUtoo' Carikli | |
| 48 | 23 | Denis 'GNUtoo' Carikli | description: Xgoldmon is a software that can get some cellular protocol traces from some Samsung phones using the samsung-ipc protocol. |
| 49 | git: https://github.com/2b-as/xgoldmon.git |
||
| 50 | |||
| 51 | 40 | Denis 'GNUtoo' Carikli | h4. GT-I9100 |
| 52 | |||
| 53 | 4 | Denis 'GNUtoo' Carikli | Xgoldmon seem to display things on the GT-I9100: |
| 54 | 1 | Denis 'GNUtoo' Carikli | <pre> |
| 55 | # ./xgoldmon -vvvv -i localhost -t s2 -l /dev/ttyACM1 |
||
| 56 | LOG:>>[HIGH]oembatt.c,310,[DISP] Thermistor : measured_value=1630666778<< |
||
| 57 | LOG:>>[HIGH]oembatt.c,137,[DISP] oem_set_batt_level : 4220<< |
||
| 58 | 9 | Denis 'GNUtoo' Carikli | LOG:>>[HIGH]oembatt.c,236,[DISP] BATT : measured_value_mv=4220, AvgBattVal_mv=4007, battery_level=5<< |
| 59 | LOG:>>[LOW]oemdisplay.c,363,no change -> rssi:4, bat:5<< |
||
| 60 | LOG:>>[HIGH]oembatt.c,310,[DISP] Thermistor : measured_value=1630666779<< |
||
| 61 | LOG:>>[HIGH]oembatt.c,137,[DISP] oem_set_batt_level : 4225<< |
||
| 62 | LOG:>>[HIGH]oembatt.c,236,[DISP] BATT : measured_value_mv=4225, AvgBattVal_mv=4026, battery_level=5<< |
||
| 63 | LOG:>>[LOW]oemdisplay.c,363,no change -> rssi:4, bat:5<< |
||
| 64 | 1 | Denis 'GNUtoo' Carikli | LOG:>>[HIGH]oembatt.c,310,[DISP] Thermistor : measured_value=1630666778<< |
| 65 | LOG:>>[HIGH]oembatt.c,137,[DISP] oem_set_batt_level : 4220<< |
||
| 66 | LOG:>>[HIGH]oembatt.c,236,[DISP] BATT : measured_value_mv=4220, AvgBattVal_mv=4055, battery_level=5<< |
||
| 67 | LOG:>>[LOW]oemdisplay.c,363,no change -> rssi:4, bat:5<< |
||
| 68 | </pre> |
||
| 69 | |||
| 70 | And when calling an (inexisting/invalid) number, the frames appear in Wireshark. |
||
| 71 | 19 | Denis 'GNUtoo' Carikli | |
| 72 | However on the GT-I9300 it waits for messages that never arrive. |
||
| 73 | And on the GT-I9100 there seem to be very few messages. |
||
| 74 | |||
| 75 | 26 | Denis 'GNUtoo' Carikli | I did some tests and compared a GT-I9100 with Replicant 6 and one with the stock distribution (rooted) and the one running Replicant outputed very few messages while the one running the stock OS outputed many messages. |
| 76 | |||
| 77 | 29 | Denis 'GNUtoo' Carikli | Both had the same result when running @AT+TRACE?@ on /dev/ttyACM0: |
| 78 | 26 | Denis 'GNUtoo' Carikli | <pre> |
| 79 | at+trace? |
||
| 80 | +TRACE: 1,921600,"ap=1;st=1;db=1;pr=1;bt=1,lt=1;li=1;ga=1;ae=1","DTM",0 |
||
| 81 | </pre> |
||
| 82 | |||
| 83 | For more background on the values: |
||
| 84 | <pre> |
||
| 85 | AT+TRACE=? |
||
| 86 | +TRACE: description START |
||
| 87 | |||
| 88 | |||
| 89 | at+trace=[<mode>],[<speed>],["<unit>=<umode>[,<unit>=<umode>[;...]]]",["<method>"],[PowerSavingCountdown] |
||
| 90 | |||
| 91 | <mode>: |
||
| 92 | ------------------------------------------------------------- |
||
| 93 | 0: sets all units OFF [param <unit> will be ignored !] |
||
| 94 | 1: sets all units ON [param <unit> will be ignored !] |
||
| 95 | no param: 3rd param. <units> configures trace-units |
||
| 96 | -> trace? will then display 128 as <mode> |
||
| 97 | |||
| 98 | <speed>: (115200,230400,460800,921600,1843200,3000000,3250000,6000000) |
||
| 99 | |||
| 100 | |||
| 101 | <units>: |
||
| 102 | ------------- |
||
| 103 | ap: apoxi |
||
| 104 | st: stack |
||
| 105 | db: debug |
||
| 106 | pr: printf |
||
| 107 | bt: bluetooth |
||
| 108 | lt: LLT |
||
| 109 | li: LwIP |
||
| 110 | gt: GATE |
||
| 111 | ae: AENEAS |
||
| 112 | |||
| 113 | <umode>: |
||
| 114 | ----------------- |
||
| 115 | 0: unit-trace OFF |
||
| 116 | 1: unit-trace ON |
||
| 117 | |||
| 118 | |||
| 119 | <method>: |
||
| 120 | -------------------------------- |
||
| 121 | "BTM": byte stuffing trace method |
||
| 122 | "DTM": direct trace method |
||
| 123 | "EBTM": extended byte stuffing trace method |
||
| 124 | |||
| 125 | |||
| 126 | <PowerSavingCountdown in msecs>: (0-30000) |
||
| 127 | |||
| 128 | |||
| 129 | i.e.: |
||
| 130 | -------------------------------------------------- |
||
| 131 | at+trace=0 |
||
| 132 | at+trace=,460800 |
||
| 133 | at+trace=,115200,"st=1,pr=1,bt=1,ap=0,db=1,lt=0,li=0" |
||
| 134 | at+trace=,,"lt=1,db=1,ga=0" |
||
| 135 | at+trace=,,,"EBTM" |
||
| 136 | at+trace=,,,,2000 |
||
| 137 | |||
| 138 | +TRACE: description END |
||
| 139 | |||
| 140 | OK |
||
| 141 | </pre> |
||
| 142 | |||
| 143 | On the stock OS I most followed xmongold procedure: |
||
| 144 | <pre> |
||
| 145 | To enable the logging mode ("diag mode") on the S2, S3 and Note2: |
||
| 146 | - Go to the Phone application, enter *#9900# and set "Debug Level |
||
| 147 | Enabled" to "HIGH". The phone will reboot. |
||
| 148 | - Go to the Phone application again, enter *#7284# and set "USB" to |
||
| 149 | "MODEM" and tap "SAVE and RESET". The phone will reboot again. |
||
| 150 | </pre> |
||
| 151 | But I didn't do the @*#9900@ thing as I didn't see any debug level. |
||
| 152 | |||
| 153 | 27 | Denis 'GNUtoo' Carikli | I only had the following menu: |
| 154 | 26 | Denis 'GNUtoo' Carikli | <pre> |
| 155 | +-------------------------------------------------+ |
||
| 156 | | Run dumpstate/logcat/modem log | |
||
| 157 | +-------------------------------------------------+ |
||
| 158 | | Delete dumpstate/logcat | |
||
| 159 | +-------------------------------------------------+ |
||
| 160 | | run dumpstate/local | |
||
| 161 | +-------------------------------------------------+ |
||
| 162 | | Copy kenrel log to the SD card | |
||
| 163 | +-------------------------------------------------+ |
||
| 164 | | Run modem log | |
||
| 165 | +-------------------------------------------------+ |
||
| 166 | | Copy to sdcard(include CP Ramdump) | |
||
| 167 | +-------------------------------------------------+ |
||
| 168 | | Disable fast dormancy (Current State: Enabled ) | |
||
| 169 | +-------------------------------------------------+ |
||
| 170 | | Ramdump Mode Enable/HIGH | |
||
| 171 | +-------------------------------------------------+ |
||
| 172 | 27 | Denis 'GNUtoo' Carikli | | TCP DUMP START | |
| 173 | 26 | Denis 'GNUtoo' Carikli | +-------------------------------------------------+ |
| 174 | 27 | Denis 'GNUtoo' Carikli | | Enable SecLog (currently disabled) | |
| 175 | +-------------------------------------------------+ |
||
| 176 | | Exit | |
||
| 177 | +-------------------------------------------------+ |
||
| 178 | 26 | Denis 'GNUtoo' Carikli | </pre> |
| 179 | |||
| 180 | 28 | Denis 'GNUtoo' Carikli | When using run modem log it did show the following popup: |
| 181 | 26 | Denis 'GNUtoo' Carikli | <pre> |
| 182 | +----------------------------+ |
||
| 183 | | /!\ Dump Result | |
||
| 184 | +----------------------------+ |
||
| 185 | | GET MODEM LOG SUCCESS! | |
||
| 186 | | Please copy to SDcard with | |
||
| 187 | | other Menu button. | |
||
| 188 | +----------------------------+ |
||
| 189 | | OK | |
||
| 190 | +----------------------------+ |
||
| 191 | </pre> |
||
| 192 | |||
| 193 | 30 | Denis 'GNUtoo' Carikli | As for the following: |
| 194 | <pre> |
||
| 195 | - Go to the Phone application again, enter *#7284# and set "USB" to |
||
| 196 | "MODEM" and tap "SAVE and RESET". The phone will reboot again. |
||
| 197 | </pre> |
||
| 198 | 31 | Denis 'GNUtoo' Carikli | I didn't have any "SAVE and RESET" and I probably didn't need to reboot but I probably needed to disconnect and reconnect the USB cable. |
| 199 | 30 | Denis 'GNUtoo' Carikli | |
| 200 | 26 | Denis 'GNUtoo' Carikli | The setting stay across reboots (I still have @1519:0020 Comneon HSIC Device@) and in the recovery I don't have any USB device (anymore?). |
| 201 | |||
| 202 | 1 | Denis 'GNUtoo' Carikli | In the one running Replicant I did @AT+TRACE=1@. |
| 203 | |||
| 204 | 40 | Denis 'GNUtoo' Carikli | h4. GT-I9300 |
| 205 | 38 | Denis 'GNUtoo' Carikli | |
| 206 | On the GT-I9300, following this part: |
||
| 207 | <pre> |
||
| 208 | - Go to the Phone application again, enter *#7284# and set "USB" to |
||
| 209 | "MODEM" and tap "SAVE and RESET". The phone will reboot again. |
||
| 210 | </pre> |
||
| 211 | results in the "PARAM partition being written to":https://redmine.replicant.us/projects/replicant/wiki/GTI9300PARAM#USB-switch . At the next boot the bootloader will configure the USB switch to connect to the modem USB. And if you install Replicant just after that, you end up with no adb in the recovery or in Replicant, though USB host works fine and heimdall also works fine. |
||
| 212 | |||
| 213 | I've also "written a tool":https://git.replicant.us/contrib/GNUtoo/tools/at-mappers/ to diff the modem settings through AT commands, and it didn't find any difference beside with the @AT+TRACE@ settings. |
||
| 214 | |||
| 215 | The goal was to find some differences after doing that: |
||
| 216 | <pre> |
||
| 217 | - Go to the Phone application, enter *#9900# and set "Debug Level |
||
| 218 | Enabled" to "HIGH". The phone will reboot. |
||
| 219 | </pre> |
||
| 220 | |||
| 221 | Here I captured the settings with @LOW@ and @HIGH@, and the only interesting difference is with AT+TRACE: |
||
| 222 | <pre> |
||
| 223 | $ diff -u GT-I9300-main-stock-low-1.conf GT-I9300-main-stock-high-3.conf |
||
| 224 | |||
| 225 | [...] |
||
| 226 | -at+trace = ['+TRACE: 0,921600,"ap=0;st=0;db=0;pr=0;bt=0;lt=0;li=0;ga=0;ae=0","DTM",0'] |
||
| 227 | +at+trace = ['+TRACE: 1,921600,"ap=1;st=1;db=1;pr=1;bt=1,lt=1;li=1;ga=1;ae=1","DTM",0'] |
||
| 228 | [...] |
||
| 229 | </pre> |
||
| 230 | |||
| 231 | Note that if we have @+TRACE: 0,921600,"ap=0;st=0;db=0;pr=0;bt=0;lt=0;li=0;ga=0;ae=0","DTM",0@, we can simply do AT+TRACE=1 to make it like it should (@+TRACE: 1,921600,"ap=1;st=1;db=1;pr=1;bt=1,lt=1;li=1;ga=1;ae=1","DTM",0@). |
||
| 232 | 24 | Denis 'GNUtoo' Carikli | |
| 233 | 41 | Denis 'GNUtoo' Carikli | It seems that the bootloader is involved again here: |
| 234 | |||
| 235 | If we set the debug level from low to medium we have a difference at @0x700208@: |
||
| 236 | <pre> |
||
| 237 | $ vbindiff low-2/PARAM.img medium-2/PARAM.img |
||
| 238 | low-2/PARAM.img |
||
| 239 | 0070 0208: 4C 4F 00 00 00 00 00 00 00 00 00 00 03 00 00 00 LO...... ........ |
||
| 240 | 0070 0218: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 241 | 0070 0228: 63 6F 6E 73 6F 6C 65 3D 72 61 6D 20 6C 6F 67 6C console= ram logl |
||
| 242 | 0070 0238: 65 76 65 6C 3D 38 00 00 00 00 00 00 00 00 00 00 evel=8.. ........ |
||
| 243 | 0070 0248: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 244 | 0070 0258: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 245 | 0070 0268: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 246 | 0070 0278: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 247 | 0070 0288: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 248 | 0070 0298: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 249 | 0070 02A8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 250 | 0070 02B8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 251 | 0070 02C8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 252 | 0070 02D8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 253 | 0070 02E8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 254 | 0070 02F8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 255 | medium-2/PARAM.img |
||
| 256 | 0070 0208: 4D 49 00 00 00 00 00 00 00 00 00 00 03 00 00 00 MI...... ........ |
||
| 257 | 0070 0218: 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 258 | 0070 0228: 63 6F 6E 73 6F 6C 65 3D 72 61 6D 20 6C 6F 67 6C console= ram logl |
||
| 259 | 0070 0238: 65 76 65 6C 3D 38 00 00 00 00 00 00 00 00 00 00 evel=8.. ........ |
||
| 260 | 0070 0248: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 261 | 0070 0258: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 262 | 0070 0268: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 263 | 0070 0278: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 264 | 0070 0288: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 265 | 0070 0298: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 266 | 0070 02A8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 267 | 0070 02B8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 268 | 0070 02C8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 269 | 0070 02D8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 270 | 0070 02E8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 271 | 0070 02F8: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 272 | ┌──────────────────────────────────────────────────────────────────────────────┐ |
||
| 273 | │Arrow keys move F find RET next difference ESC quit T move top │ |
||
| 274 | │C ASCII/EBCDIC E edit file G goto position Q quit B move bottom │ |
||
| 275 | └──────────────────────────────────────────────────────────────────────────────┘ |
||
| 276 | </pre> |
||
| 277 | |||
| 278 | And here's from medium to high: |
||
| 279 | <pre> |
||
| 280 | $ vbindiff medium-2/PARAM.img high-2/PARAM.img |
||
| 281 | medium-2/PARAM.img |
||
| 282 | 0070 0200: 00 00 00 00 01 00 00 00 4D 49 00 00 00 00 00 00 ........ MI...... |
||
| 283 | 0070 0210: 00 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00 ........ ........ |
||
| 284 | 0070 0220: 00 00 00 00 00 00 00 00 63 6F 6E 73 6F 6C 65 3D ........ console= |
||
| 285 | 0070 0230: 72 61 6D 20 6C 6F 67 6C 65 76 65 6C 3D 38 00 00 ram logl evel=8.. |
||
| 286 | 0070 0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 287 | 0070 0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 288 | 0070 0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 289 | 0070 0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 290 | 0070 0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 291 | 0070 0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 292 | 0070 02A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 293 | 0070 02B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 294 | 0070 02C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 295 | 0070 02D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 296 | 0070 02E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 297 | 0070 02F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 298 | high-1/PARAM.img |
||
| 299 | 0070 0200: 00 00 00 00 01 00 00 00 48 49 00 00 00 00 00 00 ........ HI...... |
||
| 300 | 0070 0210: 00 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00 ........ ........ |
||
| 301 | 0070 0220: 00 00 00 00 00 00 00 00 63 6F 6E 73 6F 6C 65 3D ........ console= |
||
| 302 | 0070 0230: 72 61 6D 20 6C 6F 67 6C 65 76 65 6C 3D 38 00 00 ram logl evel=8.. |
||
| 303 | 0070 0240: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 304 | 0070 0250: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 305 | 0070 0260: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 306 | 0070 0270: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 307 | 0070 0280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 308 | 0070 0290: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 309 | 0070 02A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 310 | 0070 02B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 311 | 0070 02C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 312 | 0070 02D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 313 | 0070 02E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 314 | 0070 02F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ |
||
| 315 | ┌──────────────────────────────────────────────────────────────────────────────┐ |
||
| 316 | │Arrow keys move F find RET next difference ESC quit T move top │ |
||
| 317 | │C ASCII/EBCDIC E edit file G goto position Q quit B move bottom │ |
||
| 318 | └──────────────────────────────────────────────────────────────────────────────┘ |
||
| 319 | </pre> |
||
| 320 | |||
| 321 | To capture that I had to |
||
| 322 | * set the desired setting |
||
| 323 | * then shut down the phone |
||
| 324 | * Then boot into the download mode |
||
| 325 | * Then flash a Replicant recovery with root to @BOOT@ (do not flash it to RECOVERY) |
||
| 326 | * Then to dump the PARAM partition |
||
| 327 | * Then to reboot to the bootloader |
||
| 328 | * Then to flash back the stock OS BOOT |
||
| 329 | |||
| 330 | If for some reason I rebooted to the RECOVERY partition, the setting would be changed back to @LOW@ (this was verified by dialing @*#9900#@ and then looking at the setting value without changing it). |
||
| 331 | |||
| 332 | |||
| 333 | 32 | Denis 'GNUtoo' Carikli | h2. Upstream kernel |
| 334 | |||
| 335 | 36 | Denis 'GNUtoo' Carikli | The upstream driver for the Galaxy SIII (GT-I9300) is in "drivers/extcon/extcon-max77693.c":https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/extcon/extcon-max77693.c |
| 336 | 32 | Denis 'GNUtoo' Carikli | |
| 337 | Once loaded we have: |
||
| 338 | <pre> |
||
| 339 | [root@u-boot-i9300 ~]# uname -r |
||
| 340 | 5.10.0-rc2+ |
||
| 341 | |||
| 342 | [root@u-boot-i9300 ~]# cd /sys/class/extcon/extcon0 |
||
| 343 | [root@u-boot-i9300 extcon0]# ls */ |
||
| 344 | cable.0/: |
||
| 345 | name state |
||
| 346 | |||
| 347 | cable.1/: |
||
| 348 | name state |
||
| 349 | |||
| 350 | cable.2/: |
||
| 351 | name state |
||
| 352 | |||
| 353 | cable.3/: |
||
| 354 | name state |
||
| 355 | |||
| 356 | cable.4/: |
||
| 357 | name state |
||
| 358 | |||
| 359 | cable.5/: |
||
| 360 | name state |
||
| 361 | |||
| 362 | cable.6/: |
||
| 363 | name state |
||
| 364 | |||
| 365 | cable.7/: |
||
| 366 | name state |
||
| 367 | |||
| 368 | cable.8/: |
||
| 369 | name state |
||
| 370 | |||
| 371 | cable.9/: |
||
| 372 | name state |
||
| 373 | |||
| 374 | device/: |
||
| 375 | driver driver_override extcon input modalias power subsystem uevent |
||
| 376 | |||
| 377 | power/: |
||
| 378 | async autosuspend_delay_ms control runtime_active_kids runtime_active_time runtime_enabled runtime_status runtime_suspended_time runtime_usage |
||
| 379 | |||
| 380 | subsystem/: |
||
| 381 | extcon0 |
||
| 382 | [root@u-boot-i9300 extcon0]# grep . */name |
||
| 383 | cable.0/name:USB |
||
| 384 | cable.1/name:USB-HOST |
||
| 385 | cable.2/name:SDP |
||
| 386 | cable.3/name:DCP |
||
| 387 | cable.4/name:FAST-CHARGER |
||
| 388 | cable.5/name:SLOW-CHARGER |
||
| 389 | cable.6/name:CDP |
||
| 390 | cable.7/name:MHL |
||
| 391 | cable.8/name:JIG |
||
| 392 | cable.9/name:DOCK |
||
| 393 | 33 | Denis 'GNUtoo' Carikli | [root@u-boot-i9300 extcon0]# grep . */state |
| 394 | cable.0/state:1 |
||
| 395 | cable.1/state:0 |
||
| 396 | cable.2/state:1 |
||
| 397 | cable.3/state:0 |
||
| 398 | cable.4/state:0 |
||
| 399 | cable.5/state:0 |
||
| 400 | cable.6/state:0 |
||
| 401 | cable.7/state:0 |
||
| 402 | cable.8/state:0 |
||
| 403 | cable.9/state:0 |
||
| 404 | 32 | Denis 'GNUtoo' Carikli | </pre> |
| 405 | |||
| 406 | I'm unsure if switching from userspace is implemented or not. |
||
| 407 | |||
| 408 | 35 | Denis 'GNUtoo' Carikli | Though some part looks unimplemented. |
| 409 | |||
| 410 | In "gpio-rev00-m0.h in the smdk4412 kernel":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/include/mach/gpio-rev00-m0.h#n169 we have: |
||
| 411 | 32 | Denis 'GNUtoo' Carikli | <pre> |
| 412 | #define GPIO_USB_SEL EXYNOS4212_GPJ0(1) |
||
| 413 | </pre> |
||
| 414 | 1 | Denis 'GNUtoo' Carikli | |
| 415 | 35 | Denis 'GNUtoo' Carikli | And the "max77693-muic.c driver":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/drivers/misc/max77693-muic.c seems to use that to do the switch between the modem USB and the SOC USB. |
| 416 | 32 | Denis 'GNUtoo' Carikli | And that seems to be used to switch to the modem USB. |
| 417 | |||
| 418 | 24 | Denis 'GNUtoo' Carikli | h2. Links |
| 419 | |||
| 420 | 25 | Denis 'GNUtoo' Carikli | * https://forum.xda-developers.com/t/info-r-d-i9300-uart-and-nvdata-guide.2928854/ Documentation for some GT-I9300 non-standard AT commands |
| 421 | * https://forum.xda-developers.com/t/a-sgs2-serial-how-to-talk-to-the-modem-with-at-commands.1471241/ Documentation for GT-I9100 tracing commandsh |