Qualcomm Snapdragon Sensor Core

From postmarketOS
Icon WARNING: The information on this page is not complete, it is actively being investigated

Qualcomm SoCs such as MSM8998, SDM845, etc. contain a DSP to handle all sensors. This DSP is called 'Qualcomm Snapdragon Sensor Core' (SSC) or Sensor Low Power Island (SLPI). It is responsible for interfacing with all sensors of a phone such as proximity sensor, light sensor, accelerometer, gyroscope, and many many more. The SoC hypervisor prohibits accessing the sensors directly, so we have to interface with this component in order to get the sensors to work on these SoCs.

Unfortunately, 2 generations of SSC exist:

  • MSM8998: QMI-only based SSC.
  • SDM845 or later: ProtoBuf-based SSC encapsulated in QMI.

Generation 1: MSM8998

DTS

SLPI is just a regular DSP, existing drivers in the mainline kernel can be re-used to boot it.

Details: https://emainline.gitlab.io/2021/10/06/Unlocking_SSC_P1.html

Communication

All communication with the host happens with QMI messages. The SLPI pops up as a QMI service which you can list with qrtr-lookup

 $ qrtr-lookup
 Service Version Instance Node  Port
      66       1       20    9     4 Service registry notification service

Several messages exist to retrieve sensors, their values, configure them, etc. Sensors must be initialized first before they give out data.

Details: https://emainline.gitlab.io/2022/04/08/Unlocking_SSC_P2.html

Generation 2: SDM845 or later

DTS

SLPI is just a regular DSP, existing drivers in the mainline kernel can be re-used to boot it.

Communication

While generation 1 uses only QMI, generation 2 uses Google's ProtoBuf for communicating. ProtoBuf messages are encapsulated into QMI messages. The SLPI pops up as a QMI service which you can list with qrtr-lookup

 $ qrtr-lookup
 Service Version Instance Node  Port
     400       X       XX    X     X Unknown

Since ProtoBuf messages are binary encoded, we cannot really see the content easily like with QMI's Type-Length-Value (TLV) scheme. Fortunately, some reverse engineering tools exist to decode ProtoBuf message such as ProtoBuf Inspector. You may also find the ProtoBuf message definitions in Android builds as they are sometimes supplied with it, look for *.proto files.

Links