> > AT+CNMI=1,2,2,1,0 > < OK

Well you can try to see what Android is doing for SMS with: # echo 0x7fffffff > /sys/module/ts27010mux/parameters/debug_level # dmesg | grep ts27010 | grep AT To send SMS, looks like Android RIL first does: 2 AT+CMGS=327 where 327 seems to be the size of the whatever encoded message. Then the next packet to dlci 2 contains the encoded message that is of size 327.

When receiving, mdm6600 sends these on dlci 1: ~+WAKEUP ~+WAKEUP ~+WAKEUP Then mdm6600 sends this on dlci 9: ~+CMT=372 And that's probably the incoming SMS size. But I don't see anything for what actually reads the incoming SMS.