Uncategorized

 

 IPWireless P1C Modem Commands

November 19, 2006

The modem, when connected via USB, emulates a Hayes “AT” command set compatible modem. Some of the commands are extensions for 3G devices ratified the “3GPP TS 27.007 AT command set for 3G User Equipment (UE)”

at http://www.3gpp.org/ftp/Specs/html-info/27007.htm.

The IPWireless modem implements a very basic subset of this specification. Here is a list of known commands, and a description of what they do. This list isn’t exhaustive, there are some other commands, for PIN management etc, but I haven’t bothered to document those, as Sentech doesn’t requires SIM cards – hence the PIN functions don’t do anything. Also note that these are brief, generalized descriptions of what they do. For the full spec, read the 3GPP document.

!AT+CGMM – Get model ID

*Function:* Returns the model ID of the equipment.
*Example:*
AT+CGMM?
+CGMM: Phase 1(c)

0
OK

!AT+CGMR – Get firmware version

*Function:* Returns the firmware level of the modem.
*Example:*
AT+CGMR?
+CGMR: 4.2.1.1 / A1 (2.0) / A2 (2.0); 4.2.1.1

0

OK

!AT+CGSN – Get modem IMEI

*Function:* Returns the GSM IMEI unique identifier of the modem.
*Example:*
AT+CGSN?
+CGSN: 351152000146190

0

OK

!AT+CSQ – Get signal strength information

*Function:* Returns the signal strength percentage, RSCP, and ISCP
*Example:*
AT+CSQ
+CSQ: 29,99,-79,-95,5

OK
*Description:*
In this example, 29 is the reported percentage signal strength, 99=unknown fixed value,
-79 is the RSCP, and -95 is the ISCP. It is unclear what the final "5" indicates.

*Alternate example:* Query supported/range of CSQ values
AT+CSQ=?
+CSQ: (0-91,99),99,-116..-25,-116..-25

OK

!AT+COPS – Operator selection and querying.

*Function:* Returns/selects the Network provider
*Example:*
AT+COPS?
+COPS: 1,2,"00000"

OK

*Description:*
In the above example, the list of known operators was requested, returning Sentech's "00000", which
you will see in the dialler.
"2" is the numeric  ID for use in subsequent commands.
"1" is the current status of the provider. The following status codes apply:
"00000" is the alphanumeric operator ID.

:
0	unknown
1	available
2	current
3	forbidden

An operator Sentech is selected in the following fashion:
AT+COPS=~[,
,]

E.g.
AT+COPS=1,2,"00000"

Where "1" (mode) means manual selection, "2" means 'select-by-numeric-id', and "0000" is Sentech's
ID.

Other modes:
0	automatic ( field is ignored)
1	manual ( field shall be present)
2	deregister from network
3	beyond scope of this description...
4	manual/automatic ( field shall be present); if manual selection fails, automatic mode
        (=0) is entered

!AT+CBC – Get battery information

Function: Returns the signal strength percentage, RSCP, and ISCP
*Example:*
AT+CCBC
+CBC: 13,97

OK

*Description:*
In this example, 13 appears to indicate "AC Power". 97 is the battery level, in percentage.

Alternative example: Query supported/range of CBC values
AT+CBC=?
+CBC: (0,1,2,3,4),(1-100)

OK

It is interesting to note, that the modem appears to report values outside of the
range. (13 in the example).

!AT+CGATT – Get/set frequency information

*Function:* Get the frequency, and base station attached to
*Example:*
AT+CGATT?
+CGATT: 2506000, 7.68Mcps, 31, 126

OK
*Description:*
It's unclear what all these numbers mean, but at a guess 2506000 is obviously
the frequency used to talk to the currrently attached tower. 7.68Mcps is
probably the negotiated maximum speed, 31=unknown, and 126 is the base station
number.

*Function:* Clear frequency list
AT+CGATT=0
OK
AT+CGATT=1,0
OK

Description: Clears the modem's internal frequency list.
AT+CGATT? for instance, will report that the modem is not connected to any tower -
"+CGATT: -, -, -, -"

*Function:* Select a set of frequencies
AT+CGATT=1,,...

Freq, can be any of the three Sentech frequencies:

*Example:*
AT+CGATT=0
OK
AT+CGATT=1,0
OK
AT+CGATT=1,2518000,2506000,2530000

The modem will respond, immediately with "OK" if it was able to attach to a tower
using the specified frequency(ies). If not, it will not respond, until another character
is sent. This can be used to check of it's possible to attach to a tower at the specified
frequency, within a specific timeout.

If the modem attached, using the specified frequencie(s), AT+CGATT? will return the tower
details.

It would be nice if this command actually worked as one would expect it to. The modem however
seems to be very insistent on what tower it latches on, regardless of specified frequencies,
so the data in this command appears to be more of a "hint" to the modem than a set instruction.

The modem seems to scan a wide range of frequencies, regardless of this hint.


 

 ProASM releases alternative Sentech MyWireless Dialler

 ProAsm has created a windows dialler application for the Sentech Modem, that replaces the default Sentech dialler, and displays signal strength with a higher frequency, and has some neat other features. http://www.unrealza.co.za/proasm/mywireless.html



 

 IPWireless Win32 driver – debugging and reversing

A series of tweaks for the Win32 USB drivers of the IPWireless modem, and some more tweaks for the “Wireless Broadband Dialler”

Getting rid of the debug overhead in the drivers:

The USB drivers log a lot of useless information about the USB protocol used to communicate with the modem, using the win32 DbgPrint kernel function-call. This causes some serious overhead, and can amount to quite a bit of extra CPU cycles when running at high speeds. This “spam” is quite obvious when you run a tool such as DebugView. (Try it, you’ll note the spam, and remember to ‘Capture Kernel Events (Ctrl+K)’) In addition the kernel has to buffer any DbgPrint data in an internal buffer until it overflows, or an application such as DebugView reads it off the stack. This incurs even more ring 0 overhead on systems using the USB driver.

The DbgPrint spam is controlled via a registry entry in the ipw_*.inf files… It’s easier, to just find the keys, after installation and change the debug flags, than reinstalling the drivers with modified .inf files.

By disabling the debug information and the extra overhead when talking to the USB device, I’ve managed to shave around 5-8ms off my ping times. (A completely subjective measurement) [YMMV] <— Under profiling conditions, with a kernel debugger the call overhead per USB poll dropped from 230 cycles to 89 cycles which is a considerable saving in CPU cycles wasted. (This was an objective measurement).

I find it quite insane that a company such as MCCI can distribute drivers for production release with full debugging turned on.

Hopefully, once I patch the drivers this may drop to around 3-4% levels since there is still considerable overhead in checking the debug flags.

In the meantime, to at least reduce the syscall overhead when using the drivers, the following can be done:

_Warning, the StandardDisclaimer applies when attempting any of the following:_

Disabling the debug information (Win2000,WinXP):

*Fire up regedit.exe
*Do a search for the string “~MCCIUSB_~DebugLevel” by pressing Ctrl+F (enter it without the quotes)
*Once you’ve found the value (the default will be 0xffffffff), change it by double clicking on it.
*Change the value to 0 (decimal, or hexadicimal)
*Click ok.
*Press F3 to find the next occurrence of “~MCCIUSB_~DebugLevel” and keep on changing the values to 0.
*Once there are no more entries found, reboot your PC.

Getting the dialer to print more information

The dialler application, has a few registry entries to show more “debug” information in it’s window. This kind of information is actually useful, and has very little overhead, since the debug info is only printed during the connection establishment phase. If you’re like me and want to see what your modem is doing, then turn on the debugging for the dialler as described below.

To turn on full debugging for the dialler application:

*Fire up regedit.exe
*Navigate to HKEY_LOCAL_MACHINESOFTWAREIPWireless Inc.IPWireless PC Software
*Right click on “IPWireless PC Software” in the tree, and on the popup menu select New->Key
*Type in “Debug” (without the quotes) and hit enter, to create a new Key.
*Now, left click on HKEY_LOCAL_MACHINESOFTWAREIPWireless Inc.IPWireless PC SoftwareDebug in the tree.

__theloop__
*Right click in the blank area (NOT in the tree) and click on New->String Value
*Enter ATCMD, and hit enter
*Double click the ATCMD entry and type in “Enable” (without the quotes)

*Repeat starting at __theloop__ for the following values:
**ATRES
**ATRESP
**~RasTrace

Now, when you use the “Wireless Broadband Modem Dialler” application, some more debugging information will be shown in the “ISP” window.

Getting the dialler to retry more than 5 times after disconnect:

The “Wireless Broadband Modem Dialler” has an option on the “ISP” tab to “Reconnect if line dropped”
When you turn this checkbox on, the dialler will retry for a maximum amount of 5 times to reconnect to the Sentech network.

This is pretty useless, since we all know: _When it goes down, it goes down for a while_
To increase the number of attempts that the dialler will use when attempting to redial do the following:

*Fire up regedit.exe
*Navigate to HKEY_LOCAL_MACHINESOFTWAREIPWireless Inc.IPWireless PC Software
*Find the entry named RECONNECT_ATTEMPTS on the right-hand side.
*Double click the RECONNECT_ATTEMPTS entry, and change the value to 10000
*This will cause the dialler to retry 65536 times when the line gets disconnected.



 

 An interesting way to increase MyWireless signal strength

Lots of MyWireless users have reported that cutting a hole about 4cm from the back of a Pringles can, and sticking the modem’s antenna into it has increased their gain in signal from ~5% to 15%

This is very likely due to the fact that the PringlesCan acts as a basic “waveguide” which causes the modem’s output signal to be more directional than the standard omnidirectional antenna.

Simply cut a hole in a Pringles Can, and move your modem around towards the direction where it gains the most signal.

Of course, the rolls royce of CanTennae is the 750g Frisco coffee tin, with a PigTail.