Internals of the LG GW620 RIL protocol

Hey everyone!

Today I'm gonna talk a bit about my findings with the proprietary RIL implementation in the GW620.
It consists of the files bin/rild, lib/libril.so lib/libril-qc-1.so. The rild daemon has not changend much, so we could use the plain rild from cupcake, but it will enable debugging output, when you
write "1" to /data/nv/QCRilLog_flag.

I have comiled the android framwork from plain cupcake android source, and it works quite well.
I can send SMS, receive SMS, get GPRS and UMTS (but UMTS status is not showed - it looks like GPRS), and I can receive calls (I had to modify the Phone app, because the GW620 has no "call" button to answer the call).

But I can't dial out.
I have tracked the process of Dialing from the PhoneApp/PhoneUtils -> framework/GSMPhone -> framework/CallTracker -> framework/gsm/RIL. It really helped to enable the DBG-flag in all those source files.

So when I dial, the DIAL command is send to the RIL socket /dev/socket/rild and no answer is received. In the radio log, I get the line
E/RILC ( 1002): invalid command block for token 133 request DIAL
from the qc ril implementation, so something of the format changed?
(See my other blog entry to enable verbose logging)

Later on we get a
D/MyRILJ ( 1193): WAKE_LOCK_TIMEOUT mReqPending=0 mRequestList=1
D/MyRILJ ( 1193): 0: [133] DIAL
in the log, because the the framework waits for an answer to our DIAL request, but gets no response.

I actually can dial out, by running the command
radiooptions 8 [numberToCall] from the commandline. This program is part of the android tree and usese /dev/socket/rild-debug to communicate with the rild daemon.

So I will have to look at the source code to figure out, how they changed the formatting of the DIAL request. I'll keep you updated!

EDIT:

To enable HSDPA status:
--- a/telephony/java/com/android/internal/telephony/gsm/ServiceStateTracker.java
+++ b/telephony/java/com/android/internal/telephony/gsm/ServiceStateTracker.java
@@ -78,7 +78,8 @@ final class ServiceStateTracker extends Handler
static final int DATA_ACCESS_GPRS = 1;
static final int DATA_ACCESS_EDGE = 2;
static final int DATA_ACCESS_UMTS = 3;
-
+ static final int DATA_ACCESS_HSDPA = 7;
+
static final int MAX_NUM_DATA_STATE_READS = 15;
static final int DATA_STATE_POLL_SLEEP_MS = 100;

@@ -901,6 +902,9 @@ final class ServiceStateTracker extends Handler
case DATA_ACCESS_UMTS:
ret = "UMTS";
break;
+ case DATA_ACCESS_HSDPA:
+ ret = "HSDPA";
+ break;
}

return ret;

To use menu key to receive calls:
--- a/src/com/android/phone/InCallScreen.java
+++ b/src/com/android/phone/InCallScreen.java
@@ -1233,6 +1233,8 @@ public class InCallScreen extends Activity
enableTouchLock(false);
resetTouchLockTimer();
return true;
+ } else {
+ handleCallKey(); /* we have no call key, so use menu */
}
break;

To enable dialing out we have to add two options to the packet, which we send through /dev/socket/rild. The first is called "whichLine" and the second comes from "isEmergency". Their default in LG's code is zero.
--- a/telephony/java/com/android/internal/telephony/gsm/RIL.java
+++ b/telephony/java/com/android/internal/telephony/gsm/RIL.java
@@ -740,10 +742,12 @@ public final class RIL extends BaseCommands implements CommandsInterface
public void
dial (String address, int clirMode, Message result)
{
RILRequest rr = RILRequest.obtain(RIL_REQUEST_DIAL, result);

rr.mp.writeString(address);
rr.mp.writeInt(clirMode);
+ rr.mp.writeInt(0); /* whichLine */
+ rr.mp.writeInt(0); /* isEmergencyCall */

if (RILJ_LOGD) riljLog(rr.serialString() + "> " + requestToString(rr.mRequest));