Intel / Infineon XMM6260 & X-GOLD 626 Modem Hack-Pack Release!
After several unsuccessful months of trying to get my phone (application) to
talk AT-commands with the baseband processor (BP), I've had to learn a lot of
hardware and internal Android and OEM based tricks and secrets. Although this
have not been enough to make anything of practical use, it is definitely worth
sharing. If not at least some more talented people may be able to continue
where I have left of...
Now, it should be immediately stated that
there is nothing revolutionary
in here, apart the Infineon manual for tuning your GSM modem, using the
AT CLI and GTI sequencer. This is something that could potentially be very
useful for better understanding the advanced features that the modem
platform incorporates. However, it is also a sure way of making a an
expensive brick out of your phone! You have been warned...
Brief Modem Description
The XMM6260 is the "platform" that consists of:
- The X-GOLD 626 baseband processor
- The SMARTi UE2 RF-transceiver DSP
- The 3GPP Release 7 HSPA+ protocol stack with:
Downlink: Category 14, Uplink: Category 7
The X-GOLD 626 baseband processor (labelled "PMB 9811") is communicating
with the DSP RF-tranceiver chip called SMARTi-UE2 (labelled "PBM 5712 A1"),
using a communication interface that corresponds to the MIPI DigRF-3G
(V.3.09) standard. Through this protocol the BP can control some or all
aspects of the RF DSP.
Alternative Names
- Infineon IFX6260
- Intel IMC6260
- Intel XMM626
Some other devices using this platform:
Code:
- Lava XOLO X900 [Phone] FCC ID: ???
- Lenovo K800 [Tablet/Pad] FCC ID: ???
- LG-P920 (LG ?) [Phone] FCC ID: BEJP920
- LG-P925 (LG Optimus 3D?) [Phone] FCC ID: BEJP925
- Huawei E369 (3G Hi-Universe) [USB 3G Modem] FCC ID: QISE369 (Russian distrubutor: Merlion)
- Huawei MU733/MU739 [PC/CE Module] FCC ID: QISMU739
- Samsung Galaxy Nexus (I9200) [Phone] FCC ID: ???
Other devices that may (!?) also contain the X-GOLD 626:
---------------------------------------------------------
- LG Optimus 4X HD [Phone] FCC ID: ???
- HTC One X [Phone] FCC ID: ???
- Huawei Ascend D Quad [Phone] FCC ID: QIS ???
- Huawei E392 (E392u-511) [LTE Multi-mode USB stick] FCC ID: QISE392U-511
- Huawei E353 (E352s-6) [HSPA+ USB stick] FCC ID: QIS ???
Hack-Pack Content
Code:
- Pictures/Diagrams:
- XMM6260 colored pinout map
- XMM6260 mounted in a Samsung Galaxy S2
- SMARTi UE DSP RF-tranceiver chip mounted in the SGS-2
- IPC xxxxxx stuff
- Infineon PhoneTools testing program
- Raw 1byte greyscale PNG of modem.bin from XXKI1
- PDF files/documents:
- ITA-RF-Adjustment-GSM (XMM6260 Specification)
- Infineon MIPI-HSI Product Brief
- X-GOLD 616 Product Brief
- Fairchild FSA9280/88A USB/UART switch/MUX datasheet
- Similar Modem AT sets/documents:
- AT_Command_Set_3GPP-TS-27007-940.pdf
- AT_Command_Set_AMOD_HSPA.pdf
- AT_Command_Set_Gobi.pdf
- AT_Command_Set_Motorola_XM7200S.pdf
- AT_Command_Set_Teltonika_TM3.pdf
- AT_Command_Set_iWOW_TR-900.pdf
- Text Files:
- 3GPP 27.007 AT-list
- XMM6260 official AT-set
- XMM6260 internal AT-set
- XMM6260 homebrew specifications
+ X-GOLD 626 Modem pinouts
+ MUX pinouts
+ AP connections (SGS2)
+ AP relevant info
- Strings of modem.bin (stock firmware image: [B]XXKI1[/B])
- Strings of drexe
- Strings of rild
- Strings of libril.so
- Strings of libsec-ril.so
- GT-I9100 stock (GB 2.3.4) binary files:
(Taken from: PDA:[B]XWKI4[/B], Phone:[B]XXKI1[/B])
- libKiesDataRouter.so
- libril.so
- libsec-ril.so
- libsecril-client.so
- drexe
- rild
- Android hardware hacking binaries (tools):
- dbus-monitor
- dbus-send
- hciconfig
- hcidump
- hcitool
- i2cdetect
- i2cdump
- i2cget
- i2cset
- ipcfilter
- ipcdump
- ipctool
- procmem
- showmap
- showslab
- strace
- tcpdump
- viewmem
+ various other content
The modem firmware referred to and studied can be
-------------------------------------------------------------------------------
DISCLAIMER:
All the material in this collection was found on internet by
appropriate Google-Fu and/or by laborious manual creation.
Nothing is stolen or reversed, so I am not held responsible
for the origin or problems affiliated with the use of these
documents, programs or other binaries.
-------------------------------------------------------------------------------
If you are a developer or other corporate official of Intel or Infineon:
Please contact your superiors and ask them to release the proper
datasheets and documentation of these products to the public.
Why? Because:
- It would significantly increase the sales of your hardware, by promoting
a much more open approach to hardware development. There are currently
more than 10 open-sourced and open-hardware smartphone projects around
the world, who would benefit from the use of a more modern baseband than
what is currently and openly available.
.
- It would significantly promote your hardware in front of your competitors,
as your company would be the first one to open up your documentation to the
public. Thus increasing public technical knowledge of your hardware, which
would ultimately lead to you having an easier time to find qualified
developers that cost you less!
.
- It would significantly reduce the cost and time for firmware development,
while increasing the firmware code-quality and compatibility, as you
would be able to benefit from the large community and knowledge from
other professional developers as well as hardware-hackers.
(Yes, there are several bugs found in your firmware, but since there is
no way to report and discuss these with your developers, they will
continue to cost you money and head-scratching for all developers
having to deal with your platform.)
.
- Your competitive advantage due to 1-3, would promote new and better
future hardware developments, that would not only benefit your
company/business but also society as a whole.
.
- Its simply the right thing to do!
The thread where all this become crisply relevant is this one:
[A][SGS2][Serial] How to talk to the Modem with AT commands
There you will find all documents which I have found to date, which
is essentially none. At least nothing that can be of ANY practical use.
Till you guys figure it out 
