Cellular Modem Information » Qualcomm Linux Modems by Quectel & Co

{{>toc}}

h1. Qualcomm Linux SMD (Shared Memory Device)

Individual processors / sub-systems in a multi-CPU SOC provide SMD channels.  This is basically a pipe abstraction over a shared memory protocol.  Each channel exists between two given CPU cores, so called _SMD sub-systems_.

* SMD sub-systems we know of:

** APPS (applications processor, this is the Linux system)

** Modem (assumed to be hexagon with modem firmware?)

** Q6 (formerly known as LPASS == Low Power Audio SubSystem)

** DSPS

** WCNSS (Wireless Connectivity Sub System) aka 'riva'

** RPM (Resource Power Manager)

* inter-processor-interrupts for various 'edges'

In the MDM9615/9x07 based devices it seems there is only the RPM, MODEM and APPS.

h2. core driver

* arch/arm/mach-msm/smd.c

h3. api

* smd_open() / smd_named_open_on_edge()

* smd_close()

* smd_write*()

* smd_read*()

* smsm_*()

h2. SMD based drivers

h3. smd_tty

Seems to expose tty devices (/dev/smdN) bound to SMD channels.

h3. smd_nmea

Exposes a tty device (/dev/nmea) bound to a SMD channel named "GPSNMEA".

h3. diagfwd

DIAG forwarding, see [[DIAG]]

h3. u_smd usb gadget

Used to forward data of certain USB endpoints towards other processors (mainly MDSP)

h3. packet ports

* Some kind of packet oriented interface towards the SMD

* msm_smd_pkt.c contains driver

** smdpkt0..7+smd22 devices, 2048 byte buffer

** open/release/read/write/poll syscalls implemented

|_.Pipe|_.Device|

|DATA5_CNTL|smdcntl0|

|DATA6_CNTL|smdcntl1|

|DATA7_CNTL|smdcntl2|

|DATA8_CNTL|smdcntl3|

|DATA9_CNTL|smdcntl4|

|DATA12_CNTL|smdcntl5|

|DATA13_CNTL|smdcntl6|

|DATA14_CNTL|smdcntl7|

|DATA22|smd22|

h3. hci_smd

Apparently used to talk HCI to a bluetooth chip on a different processor.  Not used in the modem devices we've seen.

h3. smd_qmi

Binds to the following channels and exposes the related devices:

|_.SMD Pipe|_.QMI Device|

|SMD_DATA5_CNTL|/dev/qmi0|

|SMD_DATA6_CNTL|/dev/qmi1|

|SMD_DATA7_CNTL|/dev/qmi2|

It seems this is an older generation of accessing [[QMI]] from the Linux application processor, which has now been replaced by qmuxd which opens @/dev/smdcntl@ devices and thus bypasses any QMI message parsing/interpretation inside the kernel?

h3. msm_rmnet

Implements a Linux kernel network device based on a SMD pipe.

The default SMD pipes used by the msm_rmnet driver are listed below.  There is no static mapping to a rmnetN device, as the numbers of the network devices are dynamically allocated.

|_.SMD Pipe|

|DATA5|

|DATA6|

|DATA7|

|DATA8|

|DATA9|

|DATA12|

|DATA13|

|DATA14|

Comparing this with the table from /sys/kernel/debug/smd/tbl on the [[EC20]] seems to suggest that DATA8 is the only SMD pipe used for msm_rmnet and thus the rmnet0 device.

h2. MSM IPC (Inter Process Communications) socket

Qualcomm implements a socket-based inter process communication on Linux.  It is implemented using a new address family, @AF_MSM_IPC@ (27).

The socket is used as datagram type socket (SOCK_DGRAM).

The socket address of a related socket consists of:

* the socket family (AF_MSM_IPC)

* a @struct msm_ipc_addr@, consisting of

** a single address type byte

** a port address (node_id, port_id)

** a port name (service, instance)

* arch/arm/mach-msm/ipc_socket.c

* AF_MSM_IPC

h2. available SMD pipes

h3. SMD pipes on an [[EC25]]

<pre>

Primary allocation table:

root@mdm9607-perf:~# cat /sys/kernel/debug/smd/ch

ID|CHANNEL NAME       |T|PROC |STATE  |FIFO SZ|RDPTR  |WRPTR  |FLAGS   |DATAPEN

-------------------------------------------------------------------------------

 4|rpm_requests       |P|APPS |OPENED |0x00400|0x001E0|0x001E0|DCCiwRsB|0x00000

  |                   | |RPM  |OPENED |0x00400|0x00118|0x00118|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

 5|rpm_requests       |P|MDMSW| Access Restricted

  |                   | |RPM  | Access Restricted

-------------------------------------------------------------------------------

 6|rpm_requests       |P|WCNSS| Access Restricted

  |                   | |RPM  | Access Restricted

-------------------------------------------------------------------------------

 7|rpm_requests       |P|TZ   | Access Restricted

  |                   | |RPM  | Access Restricted

-------------------------------------------------------------------------------

 8|rpm_requests       |P|ADSP | Access Restricted

  |                   | |RPM  | Access Restricted

-------------------------------------------------------------------------------

APPS <-> MDMSW Primary allocation table:

ID|CHANNEL NAME       |T|PROC |STATE  |FIFO SZ|RDPTR  |WRPTR  |FLAGS   |DATAPEN

-------------------------------------------------------------------------------

 0|DS                 |S|APPS |OPENED |0x02000|0x00000|0x00000|dcCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000

-------------------------------------------------------------------------------

 1|IPCRTR             |P|APPS |OPENED |0x02000|0x012E4|0x012E4|DCCiwrsB|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x011F8|0x011F8|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

 2|SSM_RTR_MODEM_APPS |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000

  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|DCCiwrSb|0x00000

-------------------------------------------------------------------------------

 3|DIAG_2_CMD         |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

-------------------------------------------------------------------------------

 4|DIAG_2             |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

-------------------------------------------------------------------------------

 5|DIAG_CNTL          |P|APPS |OPENED |0x02000|0x00062|0x00062|DCCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x007F5|0x007F5|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

 6|DIAG_CMD           |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

-------------------------------------------------------------------------------

 7|DIAG               |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00026|0x00026|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

 8|apr_audio_svc      |P|APPS |OPENED |0x02000|0x002F0|0x002F0|DCCiwrsB|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00248|0x00248|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

 9|apr_apps2          |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000

  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|DCCiwrSb|0x00000

-------------------------------------------------------------------------------

10|DATA1              |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000

-------------------------------------------------------------------------------

11|DATA2              |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000

  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|dCciwrSb|0x00000

-------------------------------------------------------------------------------

12|DATA3              |P|APPS |OPENED |0x02000|0x00000|0x00000|dcCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000

-------------------------------------------------------------------------------

13|DATA4              |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000

-------------------------------------------------------------------------------

14|DATA11             |S|APPS |OPENED |0x02000|0x00089|0x00089|dcCiwRsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x0012B|0x0012B|dCciwrsB|0x00000

-------------------------------------------------------------------------------

15|DATA40             |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000

  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|dcciwrSb|0x00000

-------------------------------------------------------------------------------

16|DATA5_CNTL         |P|APPS |CLOSED |0x00400|0x00000|0x00000|dcciwrsb|0x00000

  |                   | |MDMSW|OPENING|0x00400|0x00000|0x00000|DCCiwrSb|0x00000

-------------------------------------------------------------------------------

17|DATA40_CNTL        |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00100|0x00100|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

</pre>

h3. SMD pipes on an [[EC20]]:

<pre>

/sys/kernel/debug/smd # cat ch 

ch00:   OPENED(0000/0000) dcCiwrsb <->   OPENED(0000/0000) dCciwrsB :  2000

ch04:   OPENED(27336/27336) DCCiwrsB <->   OPENED(6552/6552) DCCiwrsB :  8000

ch05:   OPENED(0000/0000) DCCiwrsb <->   OPENED(12568/12568) DCCiwrsB : 10000

ch06:   OPENED(1872/1872) DCCiwrsB <->   OPENED(0216/0216) DCCiwrsB :  2000

ch07:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch08:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :   400

ch09:   OPENED(0952/0952) DCCiwrsb <->   OPENED(0438/0438) DCCiwrsB :   400

ch10:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsb :  2000

ch11:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch12:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsb :  2000

ch13:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch14:   OPENED(0480/0480) DCCiwrsB <->   OPENED(0376/0376) DCCiwrsB :   400

ch15:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch16:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch17:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :   400

ch18:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsb :  2000

ch19:   OPENED(0952/0952) DCCiwrsb <->   OPENED(0370/0370) DCCiwrsB :   400

ch20:   OPENED(0021/0021) DCCiwrsb <->   OPENED(0078/0078) DCCiwrsB :  2000

ch21:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch22:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dCciwrSb :  2000

ch23:   OPENED(0000/0000) dcCiwrsb <->   OPENED(0000/0000) dCciwrsB :  2000

ch24:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) dCciwrsb :  2000

ch25:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dCciwrSb :  2000

ch26:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dCciwrSb :  2000

ch27:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dcciwrSb :  2000

ch28:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsB :  2000

ch29:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dcciwrSb :  2000

ch30:   OPENED(0295/0295) DCCiwrsB <->   OPENED(0563/0563) DCCiwrsB :   400

ch31:   OPENED(0237/0237) DCCiwrsB <->   OPENED(0415/0415) DCCiwrsB :   400

ch32:   OPENED(0237/0237) DCCiwrsB <->   OPENED(0415/0415) DCCiwrsB :   400

ch33:   OPENED(0237/0237) DCCiwrsB <->   OPENED(0415/0415) DCCiwrsB :   400

ch34:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) dCciwrsb :  2000

</pre>

<pre>

/sys/kernel/debug/smd # cat tbl

name=DS cid=0 ch type=0 xfer type=1 ref_count=2

name= cid=0 ch type=0 xfer type=0 ref_count=0

name= cid=0 ch type=0 xfer type=0 ref_count=0

name= cid=0 ch type=0 xfer type=0 ref_count=0

name=MSGR_SMD_P1 cid=4 ch type=11 xfer type=2 ref_count=2

name=MSGR_SMD_P0 cid=5 ch type=11 xfer type=2 ref_count=2

name=IPCRTR cid=6 ch type=1 xfer type=2 ref_count=1

name=IPCRTR cid=7 ch type=2 xfer type=2 ref_count=1

name=sys_mon cid=8 ch type=1 xfer type=2 ref_count=1

name=DIAG_CNTL cid=9 ch type=1 xfer type=2 ref_count=2

name=DIAG cid=10 ch type=1 xfer type=2 ref_count=2

name=apr_audio_svc cid=11 ch type=1 xfer type=2 ref_count=1

name=apr_voice_svc cid=12 ch type=2 xfer type=2 ref_count=2

name=apr_apps2 cid=13 ch type=1 xfer type=2 ref_count=1

name=RPCRPY_CNTL cid=14 ch type=0 xfer type=2 ref_count=2

name=IPCROUTER cid=15 ch type=0 xfer type=0 ref_count=1

name=SSM_RTR cid=16 ch type=0 xfer type=2 ref_count=1

name=sys_mon cid=17 ch type=0 xfer type=2 ref_count=1

name=DIAG_2 cid=18 ch type=0 xfer type=2 ref_count=2

name=DIAG_CNTL cid=19 ch type=0 xfer type=2 ref_count=2

name=DIAG cid=20 ch type=0 xfer type=2 ref_count=2

name=apr_voice_svc cid=21 ch type=0 xfer type=2 ref_count=1

name=DATA1 cid=22 ch type=0 xfer type=2 ref_count=2

name=DATA2 cid=23 ch type=0 xfer type=2 ref_count=2

name=DATA3 cid=24 ch type=0 xfer type=2 ref_count=2

name=DATA4 cid=25 ch type=0 xfer type=2 ref_count=2

name=DATA11 cid=26 ch type=0 xfer type=1 ref_count=2

name=DATA40 cid=27 ch type=0 xfer type=2 ref_count=2

name=DATA40_CNTL cid=28 ch type=0 xfer type=2 ref_count=2

name=DATA8 cid=29 ch type=0 xfer type=2 ref_count=2

name=DATA5_CNTL cid=30 ch type=0 xfer type=2 ref_count=2

name=DATA6_CNTL cid=31 ch type=0 xfer type=2 ref_count=2

name=DATA7_CNTL cid=32 ch type=0 xfer type=2 ref_count=2

name=DATA8_CNTL cid=33 ch type=0 xfer type=2 ref_count=2

name=GPSNMEA cid=34 ch type=0 xfer type=2 ref_count=2

</pre>