Qualcomm Snapdragon Sensor Core

Qualcomm SoCs such as MSM8998, SDM845, etc. contain a DSP to handle all sensors. This DSP is called 'Qualcomm Snapdragon Sensor Core' (SSC) or Sensor Low Power Island (SLPI). It is responsible for interfacing with all sensors of a phone such as proximity sensor, light sensor, accelerometer, gyroscope, and many many more. The SoC hypervisor prohibits accessing the sensors directly, so we have to interface with this component in order to get the sensors to work on these SoCs.

Unfortunately, 2 generations of SSC exist:


 * MSM8998: QMI-only based SSC.
 * SDM845 or later: ProtoBuf-based SSC encapsulated in QMI.

DTS
SLPI is just a regular DSP, existing drivers in the mainline kernel can be re-used to boot it.

Details: https://emainline.gitlab.io/2021/10/06/Unlocking_SSC_P1.html

Communication
All communication with the host happens with QMI messages. The SLPI pops up as a QMI service which you can list with

$ qrtr-lookup Service Version Instance Node Port 66      1       20    9     4 Service registry notification service

Several messages exist to retrieve sensors, their values, configure them, etc. Sensors must be initialized first before they give out data.

Details: https://emainline.gitlab.io/2022/04/08/Unlocking_SSC_P2.html

DTS
SLPI is just a regular DSP, existing drivers in the mainline kernel can be re-used to boot it.

Communication
While generation 1 uses only QMI, generation 2 uses Google's ProtoBuf for communicating. ProtoBuf messages are encapsulated into QMI messages. The SLPI pops up as a QMI service which you can list with

$ qrtr-lookup Service Version Instance Node Port 400      X       XX    X     X Unknown

Since ProtoBuf messages are binary encoded, we cannot really see the content easily like with QMI's Type-Length-Value (TLV) scheme. Fortunately, some reverse engineering tools exist to decode ProtoBuf message such as ProtoBuf Inspector. You may also find the ProtoBuf message definitions in Android builds as they are sometimes supplied with it, look for  files.

Links

 * https://emainline.gitlab.io/2021/10/06/Unlocking_SSC_P1.html
 * https://emainline.gitlab.io/2022/04/08/Unlocking_SSC_P2.html
 * https://github.com/mildsunrise/protobuf-inspector