Troubles with a GSM modem emulator

[John Floren]

I'm working on a GSM modem "emulator" that I can hook to the serial line of qemu and to simulate sending SMS from within Android-x86. I wrote a program which listens for AT commands on a Unix socket and sends appropriate responses while maintaining some minimal state. When I run the AOSP emulator and point it at the socket for the radio (using the flag "-radio unix:/tmp/phone"), it works fine. For Android x86, I set the rild.libargs property to "-d /dev/ttyS0", then ran qemu with the flag "-serial unix:/tmp/phone".

Unlike the AOSP distribution, Android-x86 does not work properly with my emulator; it attempts to set up and access the radio, then eventually the emulator freezes. I have attached a file detailing all the AT commands my emulator received during a representative run, but the gist is that it seems to be attempting to reset the modem, run typical setup commands, then runs the following commands over and over: (my responses are indented and do not have < in front of them)

< AT+COPS=3,0;+COPS?;+COPS=3,1;+COPS?;+COPS=3,2;+COPS?
    OK
    +COPS: 1,0,"Test Network"
    OK
    OK
    +COPS: 1,1,"TEST"
    OK
    OK
    +COPS: 1,2,"00101"
    OK
< AT+CGREG?
   +CGREG: 1,1,36D,01
    OK
< AT+CREG?
    +CREG: 2,1,36D,01
< AT+COPS?
    +COPS: 1,2,"00101"

I do keep track of the mode and format as set by the COPS= commands. If I go into Settings - About Phone - Status, the Service State item toggles between "In Service", "Out of Service", and "Radio Off" over and over until the emulator freezes.

I'm using reference-ril for both Android-x86 and AOSP. Does anyone know what's going on here? I'm pretty new to GSM stuff so I might be missing something major.


John