XMMBoot¶

• Table of contents
• XMMBoot
  • Introduction
  • Abstraction
  • GPIOs
    • Devices GPIOs assignement and drivers
    • GPIOs usage
    • Libsamsung-ipc
    • libsamsung-ipc kernel functions gpios
    • Glossary
    • SIM card presence detection
    • TODO
  • Potential privacy and security issues
    • gpio_pda_active
    • gpio_phone_active
  • Modem partitions
    • • GT-I9300, GT-N7100, GT-P3100 modem partition table dump
    • Devices with a different partition table
    • Unknown
  • Links

Introduction¶

For both libsamsung-ipc and the Linux driver it's interesting to understand better the boot of the modem in order to come with good names for the abstraction.

Abstraction¶

• hci_power -> link_power

• Find the difference between power_on and boot_power_on
  • Look at the GPIOs and understand what they do
  • Just read the code that use the GPIOs
  • Diff both procedures
• Look which device has which XMM626X
• Add XMM6210 devices too

GPIOs¶

Devices GPIOs assignement and drivers¶

GPIOs usage¶

• Start with I9300. Assume I9300 if device is not mentioned. Mention device when not I9300
• Add more devices and mention them

Note that we don't limit ourselves to the drivers that are in use on the devices supported by Replicant.
As Samsung wrote drivers for the modem interfaces, and that the interface is similar across many different modems, other unused drivers and their comments also gives many hints about what the GPIOs are supposed to be used for.

Libsamsung-ipc¶

• Don't use abbreviated function names

¹ https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-m0-modems.c#n221

² https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-m0-modems.c#n218

³ https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-m0-modems.c#n136

⁴ https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-u1-modems.c#n153

⁵ https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-u1-modems.c#n151

⁶ https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-u1-modems.c#n139

libsamsung-ipc <-> kernel functions <-> gpios¶

int (*modem_on)(struct modem_ctl*);

int (*modem_off)(struct modem_ctl*);

int (*modem_boot_on)(struct modem_ctl*);

int (*modem_boot_off)(struct modem_ctl*);

int (*link_ldo_enable)(bool);

Glossary¶

• BP: Baseband processor
• CP: Cellular? processor

• AP: Application processor

TODO: move in its own page and point to it

LPA: Low power mode active (Related to ULPI specs only?)

ULPI: Probably a USB PHY spec

SIM card presence detection¶

Do we really want to check the SIM card presence?

Would it be possible not to for privacy reasons?

• Boot a modem with a SIM
• Take away the SIM card
• Go to a protest with only the SIM card and a phone with no data on it to be able to call if necessary.

TODO¶

• check gpio_flm_uart_sel in smdk4412 kernel too

Potential privacy and security issues¶

gpio_pda_active¶

From cpuidle-exynos4.c we have things like that:

    cpu_pm_enter();

#if defined(CONFIG_INTERNAL_MODEM_IF) || defined(CONFIG_SAMSUNG_PHONE_TTY)
    gpio_set_value(GPIO_PDA_ACTIVE, 0);
#endif

    if (log_en)
        pr_debug("+++lpa\n")

and:

    if (log_en)
        pr_debug("---lpa\n");
#if defined(CONFIG_INTERNAL_MODEM_IF) || defined(CONFIG_SAMSUNG_PHONE_TTY)
    gpio_set_value(GPIO_PDA_ACTIVE, 1);
#endif

    cpu_pm_exit();

Does it means that we are telling the modem about each time we go in suspend to RAM?

Devices affected or not affected:

gpio_phone_active¶

From ehci-s5p.c we have things like that:

#if defined(CONFIG_UMTS_MODEM_XMM6262)
    if (pdata->get_cp_active_state && !pdata->get_cp_active_state()) {
        s5p_ehci_port_control(pdev, CP_PORT, 0);
        pr_err("mif: force port%d off by cp reset\n", CP_PORT);
    }
#endif

Does it allows the modem to trigger a re-enumeration of the HSIC bus?

Devices affected or not affected:

Modem partitions¶

TODO: find the place in libsamsung-ipc source mentioning that

• https://git.replicant.us/replicant/external_libsamsung-ipc/tree/samsung-ipc/devices/i9300/i9300.h?id=9ff9785a7f48e32f107ca7fb2e298b1320ad4cbc
• https://git.replicant.us/replicant/external_libsamsung-ipc/tree/samsung-ipc/devices/n7100/n7100.h?id=9ff9785a7f48e32f107ca7fb2e298b1320ad4cbc
• Verified on GT-I9300 and GT-N7100 modem partition table

GT-I9300, GT-N7100, GT-P3100 modem partition table dump¶

• Send patch for the modem-partition-tool#n33
• Make sure that we know the device from the command line
• Understand the field depths along the way when supporting more devices
• Document all other devices that don't have this partition table
• Find the name of this partition table

$ hexdump -C RADIO.img
00000000  50 53 49 52 41 4d 00 00  00 00 00 00 00 10 00 00  |PSIRAM..........|
00000010  00 00 00 00 00 e0 00 00  00 00 00 00 00 00 00 00  |................|
00000020  45 42 4c 00 00 00 00 00  00 00 00 00 00 f0 00 00  |EBL.............|
00000030  00 00 00 60 00 90 01 00  00 00 00 00 00 00 00 00  |...`............|
00000040  4d 41 49 4e 00 00 00 00  00 00 00 00 00 80 02 00  |MAIN............|
00000050  00 00 30 60 00 78 9d 00  00 00 00 00 00 00 00 00  |..0`.x..........|
00000060  53 45 43 50 41 43 4b 00  00 00 00 00 00 f8 9f 00  |SECPACK.........|
00000070  00 00 00 00 00 08 00 00  00 00 00 00 00 00 00 00  |................|
00000080  4e 56 00 00 00 00 00 00  00 00 00 00 00 00 a0 00  |NV..............|
00000090  00 00 e8 60 00 00 20 00  00 00 00 00 00 00 00 00  |...`.. .........|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
[...]

Devices with a different partition table¶

• The devices with a Qualcomm modem like the GT-I9305 and the GT-N7105 have individual files inside the vfat modem partition. See the Samsung_Midas_4G on the quectel-modems osmocom project for more details.

Unknown¶

• Galaxy Note 8.0
• GT-P5100 is untested but but it's probably similar to the GT-P3100

Links¶

• modem_modemctl_device_xmm6262.c
• https://forum.xda-developers.com/galaxy-s2/help/how-to-talk-to-modem-commands-t1471241/page4
• http://www.arteris.com/blog/bid/59433/Interchip-Connectivity-HSIC-UniPro-HSI-C2C-LLI-oh-my
  • TODO: move this link somewhere where it's more useful