XMMBoot¶

• Table of contents
• XMMBoot
  • Introduction
  • Abstraction
  • GPIOs
    • Devices GPIOs assignement and drivers
    • GPIOs usage
    • Libsamsung-ipc
    • libsamsung-ipc kernel functions gpios
    • Glossary
    • SIM card presence detection
    • TODO
  • Potential privacy and security issues
    • gpio_pda_active
    • gpio_phone_active
  • Modem partitions
    • GT-I9300, GT-N7100
      • GT-I9300 and GT-N7100 modem partition table dump
    • Devices without a partition table or with a different one
  • Links

Introduction¶

For both libsamsung-ipc and the Linux driver it's interesting to understand better the boot of the modem in order to come with good names for the abstraction.

Abstraction¶

• hci_power -> link_power

• Find the difference between power_on and boot_power_on
  • Look at the GPIOs and understand what they do
  • Just read the code that use the GPIOs
  • Diff both procedures
• Look which device has which XMM626X
• Add XMM6210 devices too

GPIOs¶

Devices GPIOs assignement and drivers¶

GPIOs usage¶

• Start with I9300. Assume I9300 if device is not mentioned. Mention device when not I9300
• Add more devices and mention them

Libsamsung-ipc¶

• Don't use abbreviated function names

libsamsung-ipc <-> kernel functions <-> gpios¶

Glossary¶

• BP: Baseband processor
• CP: Cellular? processor

• AP: Application processor

TODO: move in its own page and point to it

SIM card presence detection¶

Do we really want to check the SIM card presence?

Would it be possible not to for privacy reasons?

• Boot a modem with a SIM
• Take away the SIM card
• Go to a protest with only the SIM card and a phone with no data on it to be able to call if necessary.

TODO¶

• check gpio_flm_uart_sel in smdk4412 kernel too

Potential privacy and security issues¶

gpio_pda_active¶

From cpuidle-exynos4.c we have things like that:

    cpu_pm_enter();

#if defined(CONFIG_INTERNAL_MODEM_IF) || defined(CONFIG_SAMSUNG_PHONE_TTY)
    gpio_set_value(GPIO_PDA_ACTIVE, 0);
#endif

    if (log_en)
        pr_debug("+++lpa\n")

and:

    if (log_en)
        pr_debug("---lpa\n");
#if defined(CONFIG_INTERNAL_MODEM_IF) || defined(CONFIG_SAMSUNG_PHONE_TTY)
    gpio_set_value(GPIO_PDA_ACTIVE, 1);
#endif

    cpu_pm_exit();

Does it means that we are telling the modem about each time we go in suspend to RAM?

Devices affected or not affected:

gpio_phone_active¶

From ehci-s5p.c we have things like that:

#if defined(CONFIG_UMTS_MODEM_XMM6262)
    if (pdata->get_cp_active_state && !pdata->get_cp_active_state()) {
        s5p_ehci_port_control(pdev, CP_PORT, 0);
        pr_err("mif: force port%d off by cp reset\n", CP_PORT);
    }
#endif

Does it allows the modem to trigger a re-enumeration of the HSIC bus?

Devices affected or not affected:

Modem partitions¶

GT-I9300, GT-N7100¶

• https://git.replicant.us/replicant/external_libsamsung-ipc/tree/samsung-ipc/devices/i9300/i9300.h?id=9ff9785a7f48e32f107ca7fb2e298b1320ad4cbc
• https://git.replicant.us/replicant/external_libsamsung-ipc/tree/samsung-ipc/devices/n7100/n7100.h?id=9ff9785a7f48e32f107ca7fb2e298b1320ad4cbc
• Verified on GT-I9300 and GT-N7100 modem partition table

GT-I9300 and GT-N7100 modem partition table dump¶

• Send patch for the modem-partition-tool#n33
• Make sure that we know the device from the command line
• Understand the field depths along the way when supporting more devices
• Document all other devices that don't have this partition table
• Find the name of this partition table

$ hexdump -C RADIO.img
00000000  50 53 49 52 41 4d 00 00  00 00 00 00 00 10 00 00  |PSIRAM..........|
00000010  00 00 00 00 00 e0 00 00  00 00 00 00 00 00 00 00  |................|
00000020  45 42 4c 00 00 00 00 00  00 00 00 00 00 f0 00 00  |EBL.............|
00000030  00 00 00 60 00 90 01 00  00 00 00 00 00 00 00 00  |...`............|
00000040  4d 41 49 4e 00 00 00 00  00 00 00 00 00 80 02 00  |MAIN............|
00000050  00 00 30 60 00 78 9d 00  00 00 00 00 00 00 00 00  |..0`.x..........|
00000060  53 45 43 50 41 43 4b 00  00 00 00 00 00 f8 9f 00  |SECPACK.........|
00000070  00 00 00 00 00 08 00 00  00 00 00 00 00 00 00 00  |................|
00000080  4e 56 00 00 00 00 00 00  00 00 00 00 00 00 a0 00  |NV..............|
00000090  00 00 e8 60 00 00 20 00  00 00 00 00 00 00 00 00  |...`.. .........|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
[...]

Devices without a partition table or with a different one¶

• GT-I9100, GT-I9250, GT-N7000, GT-P3100
• Probably GT-P5100 as well, as it's similar to GT-P3100
• All the devices with Qualcomm modems (GT-I9305, GT-N7105)

• Galaxy Note 8.0

Links¶

• modem_modemctl_device_xmm6262.c
• https://forum.xda-developers.com/galaxy-s2/help/how-to-talk-to-modem-commands-t1471241/page4
• http://www.arteris.com/blog/bid/59433/Interchip-Connectivity-HSIC-UniPro-HSI-C2C-LLI-oh-my
  • TODO: move this link somewhere where it's more useful