Project

General

Profile

Actions

XMMBoot » History » Revision 193

« Previous | Revision 193/213 (diff) | Next »
Denis 'GNUtoo' Carikli, 02/24/2021 02:17 PM
Move to ModemFirmwarePartitions


XMMBoot

Introduction

For both libsamsung-ipc and the Linux driver it's interesting to understand better the boot of the modem in order to come with good names for the abstraction.

Abstraction

  • hci_power -> link_power
TODO:
  • Find the difference between power_on and boot_power_on
    • Look at the GPIOs and understand what they do
    • Just read the code that use the GPIOs
    • Diff both procedures
  • Look which device has which XMM626X
  • Add XMM6210 devices too

GPIOs

Devices GPIOs assignement and drivers

Hardware Linux libsamsung-ipc
Variant SOC Modem Link GPIO usage GPIO assignement device driver name
Galaxy Tab:
GT-P1000
Exynos 3310 RAM aries
Galaxy S:
GT-I9000
Exynos 3110 XMM6160 RAM aries
Nexus S:
GT-I9020
GT-I9020A
GT-I9023
Exynos 3110 RAM crespo
Galaxy SII:
GT-I9100
Exynos 4210 XMM6260 HSIC CONFIG_UMTS_MODEM_XMM6260=y galaxys2
Galaxy Note:
GT-N7000
Exynos 4210 XMM6260 HSIC CONFIG_UMTS_MODEM_XMM6260=y galaxys2
Galaxy Nexus:
GT-I9250
OMAP 4460 XMM6260 MIPI CONFIG_UMTS_MODEM_XMM6260=y
Makefile
modem_modemctl_device_xmm6260.c
maguro
Galaxy SIII:
GT-I9300
Exynos 4412 XMM6262 HSIC CONFIG_UMTS_MODEM_XMM6262=y
Makefile
modem_modemctl_device_xmm6262.c
CONFIG_SEC_MODEM_M0=y
Makefile
board-m0-modems.c
CONFIG_MACH_M0=y
gpio-midas.h
gpio-rev00-m0.h
i9300
Galaxy Note 8.0 GSM:
GT-N5100
Exynos 4412 XMM6262 HSIC CONFIG_UMTS_MODEM_XMM6262=y n5100
Galaxy Note II:
GT-N7100
Exynos 4412 XMM6262 HSIC CONFIG_UMTS_MODEM_XMM6262=y n7100
Galaxy Tab 2:
GT-P3100
GT-P5100
OMAP 4430 XMM6262 MIPI CONFIG_UMTS_MODEM_XMM6262=y piranah

GPIOs usage

TODO: make sure to mention what applies to what device
  • Start with I9300. Assume I9300 if device is not mentioned. Mention device when not I9300
  • Add more devices and mention them

Note that we don't limit ourselves to the drivers that are in use on the devices supported by Replicant.
As Samsung wrote drivers for the modem interfaces, and that the interface is similar across many different modems, other unused drivers and their comments also gives many hints about what the GPIOs are supposed to be used for.

gpio platform data name present absent Implementation comments
gpio_cp_on powers on the modem? in which state (PMIC?, CPU?)
* On GT-I9100 it's connected to the ON1 modem pin and ON2 is not connected.
gpio_cp_reset Resets the modem CPU? PMIC?:
* ''check the reset timming with C2C connection'' : Here C2C probably means chip to chip
Can also read the modem CPU? and/or PMIC? reset state?
* Reads from the GPIO and ''CP not ready, Active State low'' comment
gpio_reset_req_n It seems to reset the modem. On some device with an MSM SOC (modem? AP?) in the smdk4412 kernel, it resets the modem PMIC. It can also be used to keep the modem (SOC? PMIC? CPU?) in reset mode while powered on.
gpio_pda_active Tell the modem if the SOC CPUs are sleeping/active or not?
* PDA == Application processor
* ''PDA_ACTIVE, let cp know AP sleep'' comment in status gc1-gpio.c
* PDA_ACTIVE set to 0 right after cpu_pm_enter()
* PDA_ACTIVE set to 1 right before cpu_pm_exit()
* GPIO direction is output on AP side and input on BP side, which is also confirmed by the pinout table in XDA
Also indicates when the CPU is ready to process modem stuff:
* set to 1 at the end of xmm6262_on in modem_modemctl_device_xmm6262.c
* The CPU can't process stuff if the HSIC link is in low power mode, as shown in set_hsic_lpa_states in board-m0-modems.c so it sets gpio_pda_active to 0 in these cases.
gpio_phone_active Seem the modem counterpart of gpio_pda_active:
* See umts_link_reconnect in board-m0-modems.c
* See also mc_work in the unused modemctl.c driver where that GPIO is used both to signal when the modem finished booting everything and is ready, and when the modem crashes or is reset
* phone_active_irq_handler in modem_modemctl_device_xmm6262.c seem to be doing exactly the same thing.
gpio_cp_dump_int
gpio_flm_uart_sel Only used for the Galaxy Nexus in libsamsung-ipc Modem download mode ?
* FLM could be Firmware Load mode ?
* On several devices, that GPIO seem to be used to switch between different UART, and the PMIC seem involved too in some devices. Not sure how it switches
gpio_cp_warm_reset
gpio_revers_bias_clear
gpio_revers_bias_restore
gpio_sim_detect Detect SIM card presence ?
gpio_link_enable
gpio_link_active set to 0 when the (HSIC) link is in low power and to 1 when it's back, like in set_hsic_lpa_states in board-m0-modems.c
gpio_link_hostwake
gpio_link_slavewake

Libsamsung-ipc

ioctl / function Devices
GT-I9250 GT-I9100 / GT-N7000 GT-I9300 GT-N5100 GT-N7100 GT-P3100 / GT-P5100 Galaxy S (GT-I9000) / Galaxy Tab Nexus S (GT-I902x)
libsamsung-ipc driver maguro galaxys2 i9300 n5100 n7100 piranah aries crespo
open, close, read, write
fmt/rfs
gprs
power
Yes
boot_power
status_online_wait
Yes No No
hci_power
link_control_active
link_connected_wait
link_get_hostwake_wait
No Yes No
link_control_enable Yes (ignored by Linux4[5][6]) Yes (ignored by Linux1[2][3])
psi_send xmm626_mipi_psi_send xmm626_hsic_psi_send xmm626_mipi_psi_send xmm616_psi_send
firmware_send xmm626_mipi_firmware_send xmm626_hsic_firmware_send xmm626_mipi_firmware_send xmm616_firmware_send
nv_data_send xmm626_mipi_nv_data_send xmm626_hsic_nv_data_send xmm626_mipi_nv_data_send xmm616_nv_data_send

1 https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-m0-modems.c#n221

2 https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-m0-modems.c#n218

3 https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-m0-modems.c#n136

4 https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-u1-modems.c#n153

5 https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-u1-modems.c#n151

6 https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-u1-modems.c#n139

libsamsung-ipc <-> kernel functions <-> gpios

libsamsung-ipc Kernel
Function using the ioctl ioctl name pointer signature GPIO used comment
xmm626_kernel_smdk4412_power IOCTL_MODEM_ON
IOCTL_MODEM_OFF
int (*modem_on)(struct modem_ctl*);

int (*modem_off)(struct modem_ctl*);
gpio_cp_on
gpio_cp_reset
gpio_reset_req_n
gpio_pda_active
gpio_phone_active
gpio_cp_dump_int
xmm626_kernel_smdk4412_boot_power IOCTL_MODEM_BOOT_ON
IOCTL_MODEM_BOOT_OFF
int (*modem_boot_on)(struct modem_ctl*);

int (*modem_boot_off)(struct modem_ctl*);
gpio_flm_uart_sel
gpio_cp_warm_reset
gpio_revers_bias_clear
gpio_revers_bias_restore
gpio_sim_detect
xmm626_kernel_smdk4412_status_online_wait IOCTL_MODEM_STATUS int phone_state; gpio_cp_on
gpio_cp_reset
gpio_pda_active
gpio_reset_req_n
gpio_phone_active
int phone_state get assigned the status computed from the various GPIO states
xmm626_kernel_smdk4412_status_online_wait only waits for the online status
xmm626_kernel_smdk4412_link_control_enable IOCTL_LINK_CONTROL_ENABLE
int (*link_ldo_enable)(bool);
gpio_link_enable on i9300:
* link_ldo_enable only returns 0 and has a comment ("Exynos HSIC V1.2 LDO was controlled by kernel")
* gpio_link_enable is set to 0 (so it's ignored)

Glossary

Terms for the modem CPU:
  • BP: Baseband processor
  • CP: Cellular? processor
Term for the CPU of the system on a chip running Replicant:
  • AP: Application processor

TODO: move in its own page and point to it

LPA: Low power mode active (Related to ULPI specs only?)

ULPI: Probably a USB PHY spec

SIM card presence detection

Do we really want to check the SIM card presence?

Would it be possible not to for privacy reasons?

Example:
  • Boot a modem with a SIM
  • Take away the SIM card
  • Go to a protest with only the SIM card and a phone with no data on it to be able to call if necessary.

TODO

  • check gpio_flm_uart_sel in smdk4412 kernel too

Potential privacy and security issues

gpio_pda_active

From cpuidle-exynos4.c we have things like that:

    cpu_pm_enter();

#if defined(CONFIG_INTERNAL_MODEM_IF) || defined(CONFIG_SAMSUNG_PHONE_TTY)
    gpio_set_value(GPIO_PDA_ACTIVE, 0);
#endif

    if (log_en)
        pr_debug("+++lpa\n")

and:

    if (log_en)
        pr_debug("---lpa\n");
#if defined(CONFIG_INTERNAL_MODEM_IF) || defined(CONFIG_SAMSUNG_PHONE_TTY)
    gpio_set_value(GPIO_PDA_ACTIVE, 1);
#endif

    cpu_pm_exit();

Does it means that we are telling the modem about each time we go in suspend to RAM?

Devices affected or not affected:

Device Config
GT-I9300 # CONFIG_INTERNAL_MODEM_IF is not set
# CONFIG_SAMSUNG_PHONE_TTY is not set

gpio_phone_active

From ehci-s5p.c we have things like that:

#if defined(CONFIG_UMTS_MODEM_XMM6262)
    if (pdata->get_cp_active_state && !pdata->get_cp_active_state()) {
        s5p_ehci_port_control(pdev, CP_PORT, 0);
        pr_err("mif: force port%d off by cp reset\n", CP_PORT);
    }
#endif

Does it allows the modem to trigger a re-enumeration of the HSIC bus?

Devices affected or not affected:

Device Config
GT-I9300 CONFIG_UMTS_MODEM_XMM6262=y
.gpio_phone_active = GPIO_PHONE_ACTIVE

Links

Updated by Denis 'GNUtoo' Carikli about 4 years ago · 193 revisions

Also available in: PDF HTML TXT