Cellular Modem Information » Qualcomm Linux Modems by Quectel & Co

{{>toc}}

h1. Qualcomm Linux SMD (Shared Memory Device)

Individual processors / sub-systems in a multi-CPU SOC provide SMD channels.  This is basically a pipe abstraction over a shared memory protocol.  Each channel exists between two given CPU cores, so called _SMD sub-systems_.

* SMD sub-systems we know of:

** APPS (applications processor, this is the Linux system)

** Modem (assumed to be hexagon with modem firmware?)

** Q6 (formerly known as LPASS == Low Power Audio SubSystem)

** DSPS

** WCNSS (Wireless Connectivity Sub System) aka 'riva'

** RPM (Resource Power Manager)

* inter-processor-interrupts for various 'edges'

In the MDM9615/9x07 based devices it seems there is only the RPM, MODEM and APPS.

h2. core driver

* arch/arm/mach-msm/smd.c

h3. api

* smd_open() / smd_named_open_on_edge()

* smd_close()

* smd_write*()

* smd_read*()

* smsm_*()

h2. SMD based drivers

h3. smd_tty

Seems to expose tty devices (/dev/smdN) bound to SMD channels.

h3. smd_nmea

Exposes a tty device (/dev/nmea) bound to a SMD channel named "GPSNMEA".

h3. diagfwd

DIAG forwarding, see [[DIAG]]

h3. u_smd usb gadget

Used to forward data of certain USB endpoints (of USB serial devices) towards other processors (mainly MDSP).

The SMD pipes used differ from device to device.  In the [[EC20]] case, it looks like DATA2, DS and DATA3 pipes are exposed via USB.

The classic usb serial devices for  AT command ports are implemented this way.  Their data is passed from USB endpoints to SMD pipes and vice-versa.

In difference to the BAM2BAM ports used for user (IP) data, the u_smd serial data still is received by the Linux serial gadget driver and then passed on towards the SMD devices, i.e. the buffers go throug the linux kernel (and can be interpreted/modified).

h3. packet ports

* Some kind of packet oriented interface towards the SMD

* msm_smd_pkt.c contains driver

** smdpkt0..7+smd22 devices, 2048 byte buffer

** open/release/read/write/poll syscalls implemented

|_.Pipe|_.Device|

|DATA5_CNTL|smdcntl0|

|DATA6_CNTL|smdcntl1|

|DATA7_CNTL|smdcntl2|

|DATA8_CNTL|smdcntl3|

|DATA9_CNTL|smdcntl4|

|DATA12_CNTL|smdcntl5|

|DATA13_CNTL|smdcntl6|

|DATA14_CNTL|smdcntl7|

|DATA22|smd22|

h3. hci_smd

Apparently used to talk HCI to a bluetooth chip on a different processor.  Not used in the modem devices we've seen.

h3. smd_qmi

Binds to the following channels and exposes the related devices:

|_.SMD Pipe|_.QMI Device|

|SMD_DATA5_CNTL|/dev/qmi0|

|SMD_DATA6_CNTL|/dev/qmi1|

|SMD_DATA7_CNTL|/dev/qmi2|

It seems this is an older generation of accessing [[QMI]] from the Linux application processor, which has now been replaced by qmuxd which opens @/dev/smdcntl@ devices and thus bypasses any QMI message parsing/interpretation inside the kernel?

h3. msm_rmnet

Implements a Linux kernel network device based on a SMD pipe.

The default SMD pipes used by the msm_rmnet driver are listed below.  There is no static mapping to a rmnetN device, as the numbers of the network devices are dynamically allocated.

|_.SMD Pipe|

|DATA5|

|DATA6|

|DATA7|

|DATA8|

|DATA9|

|DATA12|

|DATA13|

|DATA14|

Comparing this with the table from /sys/kernel/debug/smd/tbl on the [[EC20]] seems to suggest that DATA8 is the only SMD pipe used for msm_rmnet and thus the rmnet0 device.

h2. MSM IPC (Inter Process Communications) socket

Qualcomm implements a socket-based inter process communication on Linux.  It is implemented using a new address family, @AF_MSM_IPC@ (27).

The socket is used as datagram type socket (SOCK_DGRAM).

The socket address of a related socket consists of:

* the socket family (AF_MSM_IPC)

* a @struct msm_ipc_addr@, consisting of

** a single address type byte

** a port address (node_id, port_id)

** a port name (service, instance)

* arch/arm/mach-msm/ipc_socket.c

* AF_MSM_IPC

h2. available SMD pipes

h3. SMD pipes on an [[EC25]]

<pre>

Primary allocation table:

root@mdm9607-perf:~# cat /sys/kernel/debug/smd/ch

ID|CHANNEL NAME       |T|PROC |STATE  |FIFO SZ|RDPTR  |WRPTR  |FLAGS   |DATAPEN

-------------------------------------------------------------------------------

 4|rpm_requests       |P|APPS |OPENED |0x00400|0x001E0|0x001E0|DCCiwRsB|0x00000

  |                   | |RPM  |OPENED |0x00400|0x00118|0x00118|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

 5|rpm_requests       |P|MDMSW| Access Restricted

  |                   | |RPM  | Access Restricted

-------------------------------------------------------------------------------

 6|rpm_requests       |P|WCNSS| Access Restricted

  |                   | |RPM  | Access Restricted

-------------------------------------------------------------------------------

 7|rpm_requests       |P|TZ   | Access Restricted

  |                   | |RPM  | Access Restricted

-------------------------------------------------------------------------------

 8|rpm_requests       |P|ADSP | Access Restricted

  |                   | |RPM  | Access Restricted

-------------------------------------------------------------------------------

APPS <-> MDMSW Primary allocation table:

ID|CHANNEL NAME       |T|PROC |STATE  |FIFO SZ|RDPTR  |WRPTR  |FLAGS   |DATAPEN

-------------------------------------------------------------------------------

 0|DS                 |S|APPS |OPENED |0x02000|0x00000|0x00000|dcCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000

-------------------------------------------------------------------------------

 1|IPCRTR             |P|APPS |OPENED |0x02000|0x012E4|0x012E4|DCCiwrsB|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x011F8|0x011F8|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

 2|SSM_RTR_MODEM_APPS |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000

  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|DCCiwrSb|0x00000

-------------------------------------------------------------------------------

 3|DIAG_2_CMD         |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

-------------------------------------------------------------------------------

 4|DIAG_2             |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

-------------------------------------------------------------------------------

 5|DIAG_CNTL          |P|APPS |OPENED |0x02000|0x00062|0x00062|DCCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x007F5|0x007F5|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

 6|DIAG_CMD           |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

-------------------------------------------------------------------------------

 7|DIAG               |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00026|0x00026|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

 8|apr_audio_svc      |P|APPS |OPENED |0x02000|0x002F0|0x002F0|DCCiwrsB|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00248|0x00248|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

 9|apr_apps2          |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000

  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|DCCiwrSb|0x00000

-------------------------------------------------------------------------------

10|DATA1              |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000

-------------------------------------------------------------------------------

11|DATA2              |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000

  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|dCciwrSb|0x00000

-------------------------------------------------------------------------------

12|DATA3              |P|APPS |OPENED |0x02000|0x00000|0x00000|dcCiwrsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000

-------------------------------------------------------------------------------

13|DATA4              |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000

-------------------------------------------------------------------------------

14|DATA11             |S|APPS |OPENED |0x02000|0x00089|0x00089|dcCiwRsb|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x0012B|0x0012B|dCciwrsB|0x00000

-------------------------------------------------------------------------------

15|DATA40             |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000

  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|dcciwrSb|0x00000

-------------------------------------------------------------------------------

16|DATA5_CNTL         |P|APPS |CLOSED |0x00400|0x00000|0x00000|dcciwrsb|0x00000

  |                   | |MDMSW|OPENING|0x00400|0x00000|0x00000|DCCiwrSb|0x00000

-------------------------------------------------------------------------------

17|DATA40_CNTL        |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000

  |                   | |MDMSW|OPENED |0x02000|0x00100|0x00100|DCCiwrsB|0x00000

-------------------------------------------------------------------------------

</pre>

h3. SMD pipes on an [[EC20]]:

<pre>

/sys/kernel/debug/smd # cat ch 

ch00:   OPENED(0000/0000) dcCiwrsb <->   OPENED(0000/0000) dCciwrsB :  2000

ch04:   OPENED(27336/27336) DCCiwrsB <->   OPENED(6552/6552) DCCiwrsB :  8000

ch05:   OPENED(0000/0000) DCCiwrsb <->   OPENED(12568/12568) DCCiwrsB : 10000

ch06:   OPENED(1872/1872) DCCiwrsB <->   OPENED(0216/0216) DCCiwrsB :  2000

ch07:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch08:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :   400

ch09:   OPENED(0952/0952) DCCiwrsb <->   OPENED(0438/0438) DCCiwrsB :   400

ch10:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsb :  2000

ch11:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch12:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsb :  2000

ch13:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch14:   OPENED(0480/0480) DCCiwrsB <->   OPENED(0376/0376) DCCiwrsB :   400

ch15:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch16:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch17:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :   400

ch18:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsb :  2000

ch19:   OPENED(0952/0952) DCCiwrsb <->   OPENED(0370/0370) DCCiwrsB :   400

ch20:   OPENED(0021/0021) DCCiwrsb <->   OPENED(0078/0078) DCCiwrsB :  2000

ch21:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000

ch22:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dCciwrSb :  2000

ch23:   OPENED(0000/0000) dcCiwrsb <->   OPENED(0000/0000) dCciwrsB :  2000

ch24:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) dCciwrsb :  2000

ch25:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dCciwrSb :  2000

ch26:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dCciwrSb :  2000

ch27:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dcciwrSb :  2000

ch28:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsB :  2000

ch29:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dcciwrSb :  2000

ch30:   OPENED(0295/0295) DCCiwrsB <->   OPENED(0563/0563) DCCiwrsB :   400

ch31:   OPENED(0237/0237) DCCiwrsB <->   OPENED(0415/0415) DCCiwrsB :   400

ch32:   OPENED(0237/0237) DCCiwrsB <->   OPENED(0415/0415) DCCiwrsB :   400

ch33:   OPENED(0237/0237) DCCiwrsB <->   OPENED(0415/0415) DCCiwrsB :   400

ch34:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) dCciwrsb :  2000

</pre>

<pre>

/sys/kernel/debug/smd # cat tbl

name=DS cid=0 ch type=0 xfer type=1 ref_count=2

name= cid=0 ch type=0 xfer type=0 ref_count=0

name= cid=0 ch type=0 xfer type=0 ref_count=0

name= cid=0 ch type=0 xfer type=0 ref_count=0

name=MSGR_SMD_P1 cid=4 ch type=11 xfer type=2 ref_count=2

name=MSGR_SMD_P0 cid=5 ch type=11 xfer type=2 ref_count=2

name=IPCRTR cid=6 ch type=1 xfer type=2 ref_count=1

name=IPCRTR cid=7 ch type=2 xfer type=2 ref_count=1

name=sys_mon cid=8 ch type=1 xfer type=2 ref_count=1

name=DIAG_CNTL cid=9 ch type=1 xfer type=2 ref_count=2

name=DIAG cid=10 ch type=1 xfer type=2 ref_count=2

name=apr_audio_svc cid=11 ch type=1 xfer type=2 ref_count=1

name=apr_voice_svc cid=12 ch type=2 xfer type=2 ref_count=2

name=apr_apps2 cid=13 ch type=1 xfer type=2 ref_count=1

name=RPCRPY_CNTL cid=14 ch type=0 xfer type=2 ref_count=2

name=IPCROUTER cid=15 ch type=0 xfer type=0 ref_count=1

name=SSM_RTR cid=16 ch type=0 xfer type=2 ref_count=1

name=sys_mon cid=17 ch type=0 xfer type=2 ref_count=1

name=DIAG_2 cid=18 ch type=0 xfer type=2 ref_count=2

name=DIAG_CNTL cid=19 ch type=0 xfer type=2 ref_count=2

name=DIAG cid=20 ch type=0 xfer type=2 ref_count=2

name=apr_voice_svc cid=21 ch type=0 xfer type=2 ref_count=1

name=DATA1 cid=22 ch type=0 xfer type=2 ref_count=2

name=DATA2 cid=23 ch type=0 xfer type=2 ref_count=2

name=DATA3 cid=24 ch type=0 xfer type=2 ref_count=2

name=DATA4 cid=25 ch type=0 xfer type=2 ref_count=2

name=DATA11 cid=26 ch type=0 xfer type=1 ref_count=2

name=DATA40 cid=27 ch type=0 xfer type=2 ref_count=2

name=DATA40_CNTL cid=28 ch type=0 xfer type=2 ref_count=2

name=DATA8 cid=29 ch type=0 xfer type=2 ref_count=2

name=DATA5_CNTL cid=30 ch type=0 xfer type=2 ref_count=2

name=DATA6_CNTL cid=31 ch type=0 xfer type=2 ref_count=2

name=DATA7_CNTL cid=32 ch type=0 xfer type=2 ref_count=2

name=DATA8_CNTL cid=33 ch type=0 xfer type=2 ref_count=2

name=GPSNMEA cid=34 ch type=0 xfer type=2 ref_count=2

</pre>