publicsite
commented
1 year ago PROBING AUDIO LINES ON THE i9305 Samsung Galaxy SIII LTE
CC'd here https://redmine.replicant.us/boards/21/topics/15964?r=15971
==About==
I traced the error about dbus not finding org.ofono.QualcommCoreSoundDriver_Beta1 to the file: https://git.replicant.us/contrib/scintill/frameworks_opt_telephony_ril_ofono/tree/src/c/libcsd-client.c?h=replicant-6.0
As ofono does not have that interface, it looks to me like we have to hook up audio routing judging by the arguments in csd_client_start_voice(int rx_dev_id, int tx_dev_id, int keep_previous_handles) function
typically when we route audio, we hook up input to output, source to sync, mic to speaker by the looks of things there is a tx device id and an rx device id
I'm guessing the device ids refer to audio lines on the modem
probably then this means we hook up tx to rx line and rx to tx line (though I may be incorrect on this)
either way, we need to know some information about the i9305's audio capabilities. for this we can use alsa tools to probe for audio lines we can also try initiate a call and record some sound on the device and we can also try initiate a call and play some audio on the device down the phone line to another device we can also check for speaker and microphone lines on the device
==Methodology==
0) Download android-ndk-r8b-linux-x86.tar.bz2 and place in the same directory as the script at the end of this doc 1) Run the script to download the replicant 4.2 toolchain and compile tinyalsa. [The required commands for checking the modem lines were not on the device so need to be compiled.] 2) Plug in the device to the computer, turn on USB debugging 3) Copy the tinyalsa commands to the device using adb shell mkdir /data/local/tinyalsa adb push tinyalsa/utils/tinypcminfo /data/local/tinyalsa/tinypcminfo adb push tinyalsa/examples/pcm-readi /data/local/tinyalsa/pcm-readi adb push tinyalsa/examples/pcm-writei /data/local/tinyalsa/pcm-writei adb push tinyalsa/utils/tinycap /data/local/tinyalsa/tinycap adb push tinyalsa/utils/tinymix /data/local/tinyalsa/tinymix adb push tinyalsa/utils/tinyplay /data/local/tinyalsa/tinyplay 4.1) Connect the device and sudo adb shell (you should allow this and root access via adb in device settings) 4.2) cd to /data/local/tinyalsa and mark each file transferred as executable 4.3) run tinypcminfo on different cards and devices 4.4) run tinycap and tinyplay on different cards and devices
==RESULTS==
I tried running tinycap on some of card 0: Devices 0,1,2 and 3.
I managed to record something WITHOUT dialing in a call on card 0, device 3, however, the recorded audio was unaudiable/static sounding.
I managed to play back the file on card 0, device 3, WITHOUT dialing in a call, however the audio played back was unaudiable/static sounding.
When I dialed a call, nothing changed, ie. I was still UNable to open devices 0,1 and 2 either by using tinyplay or by using tinycap. It simply wouldn't work, additional devices were not opened due to the call being connected.
==DATA==
tinypcminfo CARD 0, DEVICE 0
./tinypcminfo -D 0 -d 0
WARNING: linker: ./tinypcminfo has text relocations. This is wasting memory and prevents security hardening. Please fix. Info for card 0, device 0:PCM out: Access: 0x000009 Format[0]: 0x000044 Format[1]: 00000000 Format Name: S16_LE, S24_LE Subformat: 0x000001 Rate: min=8000Hz max=96000Hz Channels: min=2 max=6 Sample bits: min=16 max=32 Period size: min=43 max=2048 Period count: min=2 max=128
PCM in: cannot open card(0) device (0): Invalid argument Device does not exist.
CARD 0, DEVICE 1
./tinypcminfo -D 0 -d 1
WARNING: linker: ./tinypcminfo has text relocations. This is wasting memory and prevents security hardening. Please fix. Info for card 0, device 1:PCM out: Access: 0x000008 Format[0]: 0x000004 Format[1]: 00000000 Format Name: S16_LE Subformat: 0x000001 Rate: min=8000Hz max=16000Hz Channels: min=1 max=2 Sample bits: min=16 max=16 Period size: min=1024 max=4096 Period count: min=2 max=64
PCM in: Access: 0x000008 Format[0]: 0x000004 Format[1]: 00000000 Format Name: S16_LE Subformat: 0x000001 Rate: min=8000Hz max=16000Hz Channels: min=1 max=2 Sample bits: min=16 max=16 Period size: min=1024 max=4096 Period count: min=2 max=64
CARD 0, DEVICE 2
./tinypcminfo -D 0 -d 2
WARNING: linker: ./tinypcminfo has text relocations. This is wasting memory and prevents security hardening. Please fix. Info for card 0, device 2:PCM out: Access: 0x000008 Format[0]: 0x000004 Format[1]: 00000000 Format Name: S16_LE Subformat: 0x000001 Rate: min=8000Hz max=16000Hz Channels: min=1 max=2 Sample bits: min=16 max=16 Period size: min=1024 max=4096 Period count: min=2 max=64
PCM in: Access: 0x000008 Format[0]: 0x000004 Format[1]: 00000000 Format Name: S16_LE Subformat: 0x000001 Rate: min=8000Hz max=16000Hz Channels: min=1 max=2 Sample bits: min=16 max=16 Period size: min=1024 max=4096 Period count: min=2 max=64
CARD 0, DEVICE 3
./tinypcminfo -D 0 -d 3
WARNING: linker: ./tinypcminfo has text relocations. This is wasting memory and prevents security hardening. Please fix. Info for card 0, device 3:PCM out: Access: 0x000009 Format[0]: 0x000044 Format[1]: 00000000 Format Name: S16_LE, S24_LE Subformat: 0x000001 Rate: min=8000Hz max=96000Hz Channels: min=2 max=6 Sample bits: min=16 max=32 Period size: min=171 max=8192 Period count: min=2 max=128
PCM in: Access: 0x000009 Format[0]: 0x000044 Format[1]: 00000000 Format Name: S16_LE, S24_LE Subformat: 0x000001 Rate: min=8000Hz max=96000Hz Channels: min=1 max=2 Sample bits: min=16 max=32 Period size: min=512 max=16384 Period count: min=2 max=128
#
NON-HITS
#
./tinypcminfo -D 0 -d 4
WARNING: linker: ./tinypcminfo has text relocations. This is wasting memory and prevents security hardening. Please fix. Info for card 0, device 4:PCM out: cannot open card(0) device (4): No such file or directory Device does not exist.
PCM in: cannot open card(0) device (4): No such file or directory Device does not exist.
./tinypcminfo -D 1 -d 0
WARNING: linker: ./tinypcminfo has text relocations. This is wasting memory and prevents security hardening. Please fix. Info for card 1, device 0:PCM out: cannot open card(1) device (0): No such file or directory Device does not exist.
PCM in: cannot open card(1) device (0): No such file or directory Device does not exist.
./tinypcminfo -D 1 -d 2
WARNING: linker: ./tinypcminfo has text relocations. This is wasting memory and prevents security hardening. Please fix. Info for card 1, device 2:PCM out: cannot open card(1) device (2): No such file or directory Device does not exist.
PCM in: cannot open card(1) device (2): No such file or directory Device does not exist.
./tinypcminfo -D 2 -d 1
WARNING: linker: ./tinypcminfo has text relocations. This is wasting memory and prevents security hardening. Please fix. Info for card 2, device 1:PCM out: cannot open card(2) device (1): No such file or directory Device does not exist.
PCM in: cannot open card(2) device (1): No such file or directory Device does not exist.
#
I also tried making a call and running tinypcminfo (on -D 1 -d 0) again (and -D 0 -d 4) and neither got additional hits when call was made
#
#
tinymix controls
#
./tinymix -D 0 controls
WARNING: linker: ./tinymix has text relocations. This is wasting memory and prevents security hardening. Please fix. Number of controls: 257 ctl type num name
0 ENUM 1 AIF1DRC1 Mode
1 ENUM 1 AIF1DRC2 Mode
2 ENUM 1 AIF2DRC Mode
3 INT 1 AIF1DAC1 EQ1 Volume
4 INT 1 AIF1DAC1 EQ2 Volume
5 INT 1 AIF1DAC1 EQ3 Volume
6 INT 1 AIF1DAC1 EQ4 Volume
7 INT 1 AIF1DAC1 EQ5 Volume
8 INT 1 AIF1DAC2 EQ1 Volume
9 INT 1 AIF1DAC2 EQ2 Volume
10 INT 1 AIF1DAC2 EQ3 Volume
11 INT 1 AIF1DAC2 EQ4 Volume
12 INT 1 AIF1DAC2 EQ5 Volume
13 INT 1 AIF2 EQ1 Volume
14 INT 1 AIF2 EQ2 Volume
15 INT 1 AIF2 EQ3 Volume
16 INT 1 AIF2 EQ4 Volume
17 INT 1 AIF2 EQ5 Volume
18 INT 1 IN1L Volume
19 BOOL 1 IN1L Switch
20 BOOL 1 IN1L ZC Switch
21 INT 1 IN1R Volume
22 BOOL 1 IN1R Switch
23 BOOL 1 IN1R ZC Switch
24 INT 1 IN2L Volume
25 BOOL 1 IN2L Switch
26 BOOL 1 IN2L ZC Switch
27 INT 1 IN2R Volume
28 BOOL 1 IN2R Switch
29 BOOL 1 IN2R ZC Switch
30 INT 1 MIXINL IN2L Volume
31 INT 1 MIXINL IN1L Volume
32 INT 1 MIXINL Output Record Volume
33 INT 1 MIXINL IN1LP Volume
34 INT 1 MIXINL Direct Voice Volume
35 INT 1 MIXINR IN2R Volume
36 INT 1 MIXINR IN1R Volume
37 INT 1 MIXINR Output Record Volume
38 INT 1 MIXINR IN1RP Volume
39 INT 1 MIXINR Direct Voice Volume
40 INT 1 Left Output Mixer IN2RN Volume
41 INT 1 Left Output Mixer IN2LN Volume
42 INT 1 Left Output Mixer IN2LP Volume
43 INT 1 Left Output Mixer IN1L Volume
44 INT 1 Left Output Mixer IN1R Volume
45 INT 1 Left Output Mixer Right Input Volume
46 INT 1 Left Output Mixer Left Input Volume
47 INT 1 Left Output Mixer DAC Volume
48 INT 1 Right Output Mixer IN2LN Volume
49 INT 1 Right Output Mixer IN2RN Volume
50 INT 1 Right Output Mixer IN1L Volume
51 INT 1 Right Output Mixer IN1R Volume
52 INT 1 Right Output Mixer IN2RP Volume
53 INT 1 Right Output Mixer Left Input Volume
54 INT 1 Right Output Mixer Right Input Volume
55 INT 1 Right Output Mixer DAC Volume
56 INT 2 Output Volume
57 BOOL 2 Output Switch
58 BOOL 2 Output ZC Switch
59 BOOL 1 Earpiece Switch
60 INT 1 Earpiece Volume
61 INT 1 SPKL Input Volume
62 INT 1 SPKL IN1LP Volume
63 INT 1 SPKL Output Volume
64 INT 1 SPKR Input Volume
65 INT 1 SPKR IN1RP Volume
66 INT 1 SPKR Output Volume
67 INT 2 Speaker Mixer Volume
68 INT 2 Speaker Volume
69 BOOL 2 Speaker Switch
70 BOOL 2 Speaker ZC Switch
71 INT 2 Speaker Boost Volume
72 ENUM 1 Speaker Reference
73 ENUM 1 Speaker Mode
74 INT 2 Headphone Volume
75 BOOL 2 Headphone Switch
76 BOOL 2 Headphone ZC Switch
77 BOOL 1 LINEOUT1N Switch
78 BOOL 1 LINEOUT1P Switch
79 INT 1 LINEOUT1 Volume
80 BOOL 1 LINEOUT2N Switch
81 BOOL 1 LINEOUT2P Switch
82 INT 1 LINEOUT2 Volume
83 INT 2 AIF1ADC1 Volume
84 INT 2 AIF1ADC2 Volume
85 INT 2 AIF2ADC Volume
86 ENUM 1 AIF1ADCL Source
87 ENUM 1 AIF1ADCR Source
88 ENUM 1 AIF2ADCL Source
89 ENUM 1 AIF2ADCR Source
90 ENUM 1 AIF1DACL Source
91 ENUM 1 AIF1DACR Source
92 ENUM 1 AIF2DACL Source
93 ENUM 1 AIF2DACR Source
94 INT 2 AIF1DAC1 Volume
95 INT 2 AIF1DAC2 Volume
96 INT 2 AIF2DAC Volume
97 INT 1 AIF1 Boost Volume
98 INT 1 AIF2 Boost Volume
99 BOOL 1 AIF1DAC1 EQ Switch
100 BOOL 1 AIF1DAC2 EQ Switch
101 BOOL 1 AIF2 EQ Switch
102 BOOL 1 AIF1DAC1 DRC Switch
103 BOOL 1 AIF1ADC1L DRC Switch
104 BOOL 1 AIF1ADC1R DRC Switch
105 BOOL 1 AIF1DAC2 DRC Switch
106 BOOL 1 AIF1ADC2L DRC Switch
107 BOOL 1 AIF1ADC2R DRC Switch
108 BOOL 1 AIF2DAC DRC Switch
109 BOOL 1 AIF2ADCL DRC Switch
110 BOOL 1 AIF2ADCR DRC Switch
111 INT 1 DAC1 Right Sidetone Volume
112 INT 1 DAC1 Left Sidetone Volume
113 INT 1 DAC2 Right Sidetone Volume
114 INT 1 DAC2 Left Sidetone Volume
115 ENUM 1 Sidetone HPF Mux
116 BOOL 1 Sidetone HPF Switch
117 ENUM 1 AIF1ADC1 HPF Mode
118 BOOL 2 AIF1ADC1 HPF Switch
119 ENUM 1 AIF1ADC2 HPF Mode
120 BOOL 2 AIF1ADC2 HPF Switch
121 ENUM 1 AIF2ADC HPF Mode
122 BOOL 2 AIF2ADC HPF Switch
123 ENUM 1 ADC OSR
124 ENUM 1 DAC OSR
125 INT 2 DAC1 Volume
126 BOOL 2 DAC1 Switch
127 INT 2 DAC2 Volume
128 BOOL 2 DAC2 Switch
129 INT 1 SPKL DAC2 Volume
130 INT 1 SPKL DAC1 Volume
131 INT 1 SPKR DAC2 Volume
132 INT 1 SPKR DAC1 Volume
133 INT 1 AIF1DAC1 3D Stereo Volume
134 BOOL 1 AIF1DAC1 3D Stereo Switch
135 INT 1 AIF1DAC2 3D Stereo Volume
136 BOOL 1 AIF1DAC2 3D Stereo Switch
137 INT 1 AIF2DAC 3D Stereo Volume
138 BOOL 1 AIF2DAC 3D Stereo Switch
139 INT 1 AIF3 Boost Volume
140 BOOL 1 AIF1DAC1 Noise Gate Switch
141 ENUM 1 AIF1DAC1 Noise Gate Hold Time
142 INT 1 AIF1DAC1 Noise Gate Threshold Volume
143 BOOL 1 AIF1DAC2 Noise Gate Switch
144 ENUM 1 AIF1DAC2 Noise Gate Hold Time
145 INT 1 AIF1DAC2 Noise Gate Threshold Volume
146 BOOL 1 AIF2DAC Noise Gate Switch
147 ENUM 1 AIF2DAC Noise Gate Hold Time
148 INT 1 AIF2DAC Noise Gate Threshold Volume
149 BOOL 1 AIF2ADCL DAT Invert
150 BOOL 1 AIF2ADCR DAT Invert
151 BOOL 1 HP Switch
152 BOOL 1 SPK Switch
153 BOOL 1 RCV Switch
154 BOOL 1 FM In Switch
155 BOOL 1 LINE Switch
156 BOOL 1 HDMI Switch
157 BOOL 1 Main Mic Switch
158 BOOL 1 Sub Mic Switch
159 BOOL 1 Headset Mic Switch
160 ENUM 1 AIF2 Mode
161 ENUM 1 Input Clamp
162 ENUM 1 LineoutSwitch Mode
163 ENUM 1 ADCR Mux
164 ENUM 1 ADCL Mux
165 ENUM 1 Right Headphone Mux
166 ENUM 1 Left Headphone Mux
167 BOOL 1 SPKR DAC2 Switch
168 BOOL 1 SPKR Input Switch
169 BOOL 1 SPKR IN1RP Switch
170 BOOL 1 SPKR Output Switch
171 BOOL 1 SPKR DAC1 Switch
172 BOOL 1 SPKL DAC2 Switch
173 BOOL 1 SPKL Input Switch
174 BOOL 1 SPKL IN1LP Switch
175 BOOL 1 SPKL Output Switch
176 BOOL 1 SPKL DAC1 Switch
177 ENUM 1 AIF3ADC Mux
178 ENUM 1 AIF2DACR Mux
179 ENUM 1 AIF2DACL Mux
180 ENUM 1 Mono PCM Out Mux
181 ENUM 1 AIF2ADC Mux
182 ENUM 1 AIF2DAC Mux
183 ENUM 1 AIF1DAC Mux
184 BOOL 1 DAC1R Mixer Right Sidetone Switch
185 BOOL 1 DAC1R Mixer Left Sidetone Switch
186 BOOL 1 DAC1R Mixer AIF2 Switch
187 BOOL 1 DAC1R Mixer AIF1.2 Switch
188 BOOL 1 DAC1R Mixer AIF1.1 Switch
189 BOOL 1 DAC1L Mixer Right Sidetone Switch
190 BOOL 1 DAC1L Mixer Left Sidetone Switch
191 BOOL 1 DAC1L Mixer AIF2 Switch
192 BOOL 1 DAC1L Mixer AIF1.2 Switch
193 BOOL 1 DAC1L Mixer AIF1.1 Switch
194 ENUM 1 Right Sidetone
195 ENUM 1 Left Sidetone
196 BOOL 1 AIF2DAC2R Mixer Right Sidetone Switch
197 BOOL 1 AIF2DAC2R Mixer Left Sidetone Switch
198 BOOL 1 AIF2DAC2R Mixer AIF2 Switch
199 BOOL 1 AIF2DAC2R Mixer AIF1.2 Switch
200 BOOL 1 AIF2DAC2R Mixer AIF1.1 Switch
201 BOOL 1 AIF2DAC2L Mixer Right Sidetone Switch
202 BOOL 1 AIF2DAC2L Mixer Left Sidetone Switch
203 BOOL 1 AIF2DAC2L Mixer AIF2 Switch
204 BOOL 1 AIF2DAC2L Mixer AIF1.2 Switch
205 BOOL 1 AIF2DAC2L Mixer AIF1.1 Switch
206 BOOL 1 AIF1ADC2R Mixer DMIC Switch
207 BOOL 1 AIF1ADC2R Mixer AIF2 Switch
208 BOOL 1 AIF1ADC2L Mixer DMIC Switch
209 BOOL 1 AIF1ADC2L Mixer AIF2 Switch
210 BOOL 1 AIF1ADC1R Mixer ADC/DMIC Switch
211 BOOL 1 AIF1ADC1R Mixer AIF2 Switch
212 BOOL 1 AIF1ADC1L Mixer ADC/DMIC Switch
213 BOOL 1 AIF1ADC1L Mixer AIF2 Switch
214 BOOL 1 LINEOUT2P Mixer Right Output Switch
215 BOOL 1 LINEOUT2N Mixer Left Output Switch
216 BOOL 1 LINEOUT2N Mixer Right Output Switch
217 BOOL 1 LINEOUT1P Mixer Left Output Switch
218 BOOL 1 LINEOUT1N Mixer Left Output Switch
219 BOOL 1 LINEOUT1N Mixer Right Output Switch
220 BOOL 1 SPKR Boost Direct Voice Switch
221 BOOL 1 SPKR Boost SPKL Switch
222 BOOL 1 SPKR Boost SPKR Switch
223 BOOL 1 SPKL Boost Direct Voice Switch
224 BOOL 1 SPKL Boost SPKL Switch
225 BOOL 1 SPKL Boost SPKR Switch
226 BOOL 1 Earpiece Mixer Direct Voice Switch
227 BOOL 1 Earpiece Mixer Left Output Switch
228 BOOL 1 Earpiece Mixer Right Output Switch
229 BOOL 1 Right Output Mixer Left Input Switch
230 BOOL 1 Right Output Mixer Right Input Switch
231 BOOL 1 Right Output Mixer IN2LN Switch
232 BOOL 1 Right Output Mixer IN2RN Switch
233 BOOL 1 Right Output Mixer IN1L Switch
234 BOOL 1 Right Output Mixer IN1R Switch
235 BOOL 1 Right Output Mixer IN2RP Switch
236 BOOL 1 Right Output Mixer DAC Switch
237 BOOL 1 Left Output Mixer Right Input Switch
238 BOOL 1 Left Output Mixer Left Input Switch
239 BOOL 1 Left Output Mixer IN2RN Switch
240 BOOL 1 Left Output Mixer IN2LN Switch
241 BOOL 1 Left Output Mixer IN2LP Switch
242 BOOL 1 Left Output Mixer IN1R Switch
243 BOOL 1 Left Output Mixer IN1L Switch
244 BOOL 1 Left Output Mixer DAC Switch
245 BOOL 1 MIXINR IN2R Switch
246 BOOL 1 MIXINR IN1R Switch
247 BOOL 1 MIXINL IN2L Switch
248 BOOL 1 MIXINL IN1L Switch
249 BOOL 1 IN2R PGA IN2RP Switch
250 BOOL 1 IN2R PGA IN2RN Switch
251 BOOL 1 IN2L PGA IN2LP Switch
252 BOOL 1 IN2L PGA IN2LN Switch
253 BOOL 1 IN1R PGA IN1RP Switch
254 BOOL 1 IN1R PGA IN1RN Switch
255 BOOL 1 IN1L PGA IN1LP Switch
256 BOOL 1 IN1L PGA IN1LN Switch
==CONCLUSION==
I had hoped to use a library like libcmtspeechdata to route the audio for the modem as this would have been a good candidate. Unfortunately I could not open any additional audio devices when the call was connected, although I managed to find out that card 0 is the only active card on the phone, with devices 0 to 3 being used somehow.
==SCRIPT TO BUILD TINYALSA TOOLS STARTS HERE==
!/bin/sh
thepwd="${PWD}"
git clone https://github.com/tinyalsa/tinyalsa
wget https://ftp-osl.osuosl.org/pub/replicant/sdk/replicant-4.2/0001/sdk/replicant-sdk_linux-x86.zip
unzip replicant-sdk_linux-x86.zip
tar -xf android-ndk-r8b-linux-x86.tar.bz2
cd tinyalsa
mkdir include/sound
wget "https://raw.githubusercontent.com/broonie/tinyalsa/648e14a421f1795006f770de8c57602366b20c24/include/sound/asound.h" -O include/sound/asound.h
tell src/Makefile to use sysroot
sed -i "s#CC = \$(CROSS_COMPILE)gcc#CC = \$(CROSS_COMPILE)gcc --sysroot=\"${thepwd}/android-ndk-r8b/platforms/android-9/arch-arm/\" -std=c99#g" src/Makefile sed -i "s#LD = \$(CROSS_COMPILE)gcc#LD = \$(CROSS_COMPILE)gcc --sysroot=\"${thepwd}/android-ndk-r8b/platforms/android-9/arch-arm/\"#g" src/Makefile
tell utils/Makefile to use sysroot
sed -i "s#CC = \$(CROSS_COMPILE)gcc#CC = \$(CROSS_COMPILE)gcc --sysroot=\"${thepwd}/android-ndk-r8b/platforms/android-9/arch-arm/\" -std=c99#g" utils/Makefile
tell tinyalsa/examples to use sysroot
sed -i "s#CC = \$(CROSS_COMPILE)gcc#CC = \$(CROSS_COMPILE)gcc --sysroot=\"${thepwd}/android-ndk-r8b/platforms/android-9/arch-arm/\" -std=c99#g" examples/Makefile
export PATH="${thepwd}/android-ndk-r8b/toolchains/arm-linux-androideabi-4.4.3/prebuilt/linux-x86/bin/:$PATH"
CROSS_COMPILE="arm-linux-androideabi-" make
Hi,
Thank you for your work on modem!
I'm not getting audio during voice calls on the i9305.
I ran adb logcat and get the following error:
Any help would be greatly appreciated.