Qualcomm Snapdragon Sensor Core
 |
WARNING: The information on this page is not complete, it is actively being investigated |
Qualcomm SoCs such as MSM8998, SDM845, etc. contain a DSP to handle all sensors. This DSP is called 'Qualcomm Snapdragon Sensor Core' (SSC) or Sensor Low Power Island (SLPI). It is responsible for interfacing with all sensors of a phone such as proximity sensor, light sensor, accelerometer, gyroscope, and many many more. The SoC hypervisor prohibits accessing the sensors directly, so we have to interface with this component in order to get the sensors to work on these SoCs.
Unfortunately, 2 generations of SSC exist:
- MSM8998: QMI-only based SSC.
- SDM845 or later: ProtoBuf-based SSC encapsulated in QMI.
Generation 1: MSM8998
DTS
SLPI is just a regular DSP, existing drivers in the mainline kernel can be re-used to boot it.
Details: https://emainline.gitlab.io/2021/10/06/Unlocking_SSC_P1.html
Communication
All communication with the host happens with QMI messages.
The SLPI pops up as a QMI service which you can list with qrtr-lookup
$ qrtr-lookup
Service Version Instance Node Port
66 1 20 9 4 Service registry notification service
Several messages exist to retrieve sensors, their values, configure them, etc. Sensors must be initialized first before they give out data.
Details: https://emainline.gitlab.io/2022/04/08/Unlocking_SSC_P2.html
Generation 2: SDM845 or later
DTS
SLPI is just a regular DSP, existing drivers in the mainline kernel can be re-used to boot it.
Communication
While generation 1 uses only QMI, generation 2 uses Google's ProtoBuf for communicating.
ProtoBuf messages are encapsulated into QMI messages.
The SLPI pops up as a QMI service which you can list with qrtr-lookup
$ qrtr-lookup
Service Version Instance Node Port
400 X XX X X Unknown
Since ProtoBuf messages are binary encoded, we cannot really see the content easily like with QMI's Type-Length-Value (TLV) scheme.
Fortunately, some reverse engineering tools exist to decode ProtoBuf message such as ProtoBuf Inspector.
You may also find the ProtoBuf message definitions in Android builds as they are sometimes supplied with it, look for *.proto files.