Replicant

h1. XMMBoot

{{toc}}

h2.  Introduction

For both libsamsung-ipc and the Linux driver it's interesting to understand better the boot of the modem in order to come with good names for the abstraction.

h2. Abstraction

* hci_power -> link_power

h2. GPIOs

h3. Devices GPIOs assignement and drivers

|_. Variant |_. SOC |_. Modem  |_. GPIO usage |_. GPIO assignement |

| GT-I9300 | Exynos 4412 | XMM6262 | "CONFIG_UMTS_MODEM_XMM6262=y":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/configs/lineageos_i9300_defconfig#n1350

"Makefile":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/drivers/misc/modem_if/Makefile#n10

"modem_modemctl_device_xmm6262.c":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/drivers/misc/modem_if/modem_modemctl_device_xmm6262.c | "CONFIG_SEC_MODEM_M0=y":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/configs/lineageos_i9300_defconfig#n541

"Makefile":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/Makefile#n320

"board-m0-modems.c":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-m0-modems.c 

"CONFIG_MACH_M0=y":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/configs/lineageos_i9300_defconfig#n455

"gpio-midas.h":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/include/mach/gpio-midas.h#n28

"gpio-rev00-m0.h":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/include/mach/gpio-rev00-m0.h |

h3. GPIOs usage

|_. gpio platform data name |_. present |_. absent |_. Implementation |_. comments |

| gpio_cp_on | | | | powers on the modem? in which state (PMIC?, CPU?)

* On GT-I9100 it's connected to the ON1 modem pin and ON2 is not connected. |

| gpio_cp_reset | | | | Resets the modem CPU? PMIC?:

* "''check the reset timming with C2C connection''":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/drivers/misc/modem_if/modem_modemctl_device_xmm6262.c#n106 : Here C2C probably means chip to chip

Can also read the modem CPU? and/or PMIC? reset state?

* "Reads from the GPIO and ''CP not ready, Active State low'' comment":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/board-m0-modems.c#n287 |

| gpio_reset_req_n | | | |

| gpio_pda_active | | | | Tell the modem if the SOC CPUs are sleeping/active or not?

* "PDA == Application processor":https://android.stackexchange.com/questions/176515/what-do-the-terms-bl-ap-cp-and-csc-mean-in-odin

* "''PDA_ACTIVE, let cp know AP sleep'' comment in status gc1-gpio.c":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/gc1-gpio.c#n213

* "PDA_ACTIVE set to 0 right after cpu_pm_enter()":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/cpuidle-exynos4.c#n701

* "PDA_ACTIVE set to 1 right before cpu_pm_exit()":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/arch/arm/mach-exynos/cpuidle-exynos4.c#n796

* GPIO direction is output on AP side and input on BP side, which is also confirmed by the "pinout table in XDA":https://forum.xda-developers.com/galaxy-s2/help/how-to-talk-to-modem-commands-t1471241/page4 |

| gpio_phone_active | | | | |

| gpio_cp_dump_int | | | | cp: baseband processor |

| gpio_flm_uart_sel |\2. Only used for the Galaxy Nexus in libsamsung-ipc | | Modem download mode ? |

| gpio_cp_warm_reset | | | | cp: baseband processor |

| gpio_revers_bias_clear | | | | |

| gpio_revers_bias_restore | | | | |

| gpio_sim_detect | | | | Detect SIM card presence ? |

h3. Libsamsung-ipc

|/2. ioctl / function |\6. Devices |

| GT-I9250 (maguro) | GT-I9100 | GT-I9300 | GT-N5100 | GT-N7100 | GT-P3100 / GT-P5100 (piranah) |

| open, close, read, write 

fmt/rfs

gprs

power |\6. Yes |

| boot_power

status_online_wait | Yes |\5. No |

| hci_power

link_control_enable

link_control_active

link_control_wait

link_get_hostwake_wait | No |\4. Yes | No |

h3. libsamsung-ipc <-> kernel functions <-> gpios

|_. libsamsung-ipc |_\3. Kernel |

|_. Function using the ioctl |_. ioctl name |_. function pointer name |_. GPIO used |

| xmm626_kernel_smdk4412_power | IOCTL_MODEM_ON

IOCTL_MODEM_OFF | modem_on

modem_off | gpio_cp_on

gpio_cp_reset

gpio_reset_req_n

gpio_pda_active |

| | | | gpio_phone_active |

| | | | gpio_cp_dump_int |

| xmm626_kernel_smdk4412_boot_power | IOCTL_MODEM_BOOT_ON

IOCTL_MODEM_BOOT_OFF | modem_boot_on

modem_boot_off | gpio_flm_uart_sel |

| | | | gpio_cp_warm_reset |

| | | | gpio_revers_bias_clear |

| | | | gpio_revers_bias_restore |

| | | | gpio_sim_detect |

h3. Glossary

* cp: baseband processor

h3. SIM card presence detection

Do we really want to check the SIM card presence?

Would it be possible not to for privacy reasons?

Example:

* Boot a modem with a SIM

* Take away the SIM card

* Go to a protest with only the SIM card and a phone with no data on it to be able to call if necessary.

h3. TODO

* check gpio_flm_uart_sel in smdk4412 kernel too

h2. Modem partitions

h3. GT-I9300, GT-N7100

|_. Location |_. Name |_. Content |

| [ 0x0 -> 0xfff ] | ? | Partition table? |

| [ 0x1000 -> 0xefff ] | PSIRAM | First stage bootloader? |

| [ 0xF000 -> 0x27fff ] | EBL | Second stage bootloader ? |

| [ 0x28000 -> 0x9ff7ff ] | MAIN | ? |

| [ 0x9ff800 -> 0x9fffff ] | SECPACK | ? |

| [ 0xa00000 -> 0xbfffff ] | NV | ? |

References for the table:

* https://git.replicant.us/replicant/external_libsamsung-ipc/tree/samsung-ipc/devices/i9300/i9300.h?id=9ff9785a7f48e32f107ca7fb2e298b1320ad4cbc

* https://git.replicant.us/replicant/external_libsamsung-ipc/tree/samsung-ipc/devices/n7100/n7100.h?id=9ff9785a7f48e32f107ca7fb2e298b1320ad4cbc

* Verified on GT-I9300 and GT-N7100 modem partition table

h4. GT-I9300 and GT-N7100 modem partition table dump

<pre>

$ hexdump -C RADIO.img

00000000  50 53 49 52 41 4d 00 00  00 00 00 00 00 10 00 00  |PSIRAM..........|

00000010  00 00 00 00 00 e0 00 00  00 00 00 00 00 00 00 00  |................|

00000020  45 42 4c 00 00 00 00 00  00 00 00 00 00 f0 00 00  |EBL.............|

00000030  00 00 00 60 00 90 01 00  00 00 00 00 00 00 00 00  |...`............|

00000040  4d 41 49 4e 00 00 00 00  00 00 00 00 00 80 02 00  |MAIN............|

00000050  00 00 30 60 00 78 9d 00  00 00 00 00 00 00 00 00  |..0`.x..........|

00000060  53 45 43 50 41 43 4b 00  00 00 00 00 00 f8 9f 00  |SECPACK.........|

00000070  00 00 00 00 00 08 00 00  00 00 00 00 00 00 00 00  |................|

00000080  4e 56 00 00 00 00 00 00  00 00 00 00 00 00 a0 00  |NV..............|

00000090  00 00 e8 60 00 00 20 00  00 00 00 00 00 00 00 00  |...`.. .........|

000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

*

[...]

</pre>

h3. Devices without a partition table or with a different one

* GT-I9250

h2. Links

* "modem_modemctl_device_xmm6262.c":https://git.replicant.us/replicant/kernel_samsung_smdk4412/tree/drivers/misc/modem_if/modem_modemctl_device_xmm6262.c

* https://forum.xda-developers.com/galaxy-s2/help/how-to-talk-to-modem-commands-t1471241/page4

* http://www.arteris.com/blog/bid/59433/Interchip-Connectivity-HSIC-UniPro-HSI-C2C-LLI-oh-my