pixel-mainline/modem
Archived
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
This repository has been archived on 2026-07-12. You can view files and clone it, but you cannot make any changes to its state, such as pushing and creating new issues, pull requests or comments.
10 commits 1 branch 0 tags 96 KiB
  • C 99.4%
  • Makefile 0.6%
Find a file
Exact
deusch 0b2eb0b898 README.md aktualisiert
2026-07-12 23:54:34 +02:00
.gitignore add rfs-server + rfs-smoke: userspace RFS carrier-config server 2026-07-07 20:41:27 +02:00
cbd-lite.c cbd-lite: open Exynos 5300 CP boot client 2026-07-06 22:16:33 +02:00
Makefile add rfs-server + rfs-smoke: userspace RFS carrier-config server 2026-07-07 20:41:27 +02:00
README.md README.md aktualisiert 2026-07-12 23:54:34 +02:00
rfs-server.c rfs-server: always answer an IO_REQUEST 2026-07-08 10:41:51 +02:00
rfs-smoke.c add rfs-server + rfs-smoke: userspace RFS carrier-config server 2026-07-07 20:41:27 +02:00
sit-smoke.c sit-smoke: query radio state instead of forcing SET_RADIO_POWER 2026-07-08 10:41:51 +02:00

README.md

pixel-mainline modem userspace

DEPRECATED

See exynos-modem instead.

Userspace tooling for bringing the discrete Samsung Exynos 5300 modem (PCIe) to ONLINE on the Google Pixel 9a (Tensor G4 / zumapro) with a mainline Linux kernel.

cbd-lite

cbd-lite is a minimal, open re-implementation of Samsung's closed cbd CP boot daemon — just enough to boot the modem to ONLINE. It opens /dev/umts_boot0 and drives the boot handshake:

  1. stage the handover block (IMEIs + signature) and power on the CP,
  2. load the first-stage bootloader,
  3. trigger the CP link bounce, then
  4. stream the whole firmware (TOC / MAIN / VSS / APM / NV / replay) over the SIT std_dl protocol — including the MAIN CRC-verify frame — and wait for the CP's INIT_START / PHONE_START handshake to ONLINE.

The kernel side is the transport only: it carries the frames on the shared-memory ring and returns the CP's acks. cbd-lite speaks the protocol. It works against both the mainline s5300 transport driver (drivers/net/wwan/s5300_modem.c) and, as a known-good reference, the downstream cpif stack.

No device data is baked in

The factory image, the per-device NV, and the handover block (which contains the two IMEIs and the signature) are read from files at runtime — from the mounted Android vendor partitions and /lib/firmware/tegu/cp_handover.bin. Nothing device-identifying is compiled into the source.

sit-smoke

sit-smoke is a round-trip test for the mainline s5300 SIT control port (WWAN_PORT_SIT, /dev/wwan0sit0). Run it once the modem is ONLINE: it sends one SIT_SET_RADIO_POWER(on) request and waits for the CP's radio-state indication (0x0802) and matching status response (0x0800), printing each SIT message. A clean round-trip proves the runtime FMT-queue path — userspace write → EXYNOS link header → FMT txq → CP → FMT rxq → read — before any data-path or ModemManager work. It only speaks the mainline driver (the downstream cpif stack does not expose this port).

Build

make                              # native aarch64 host, builds both tools
make CC=aarch64-linux-gnu-gcc     # cross-compile
make sit-smoke                    # just one tool

Both build freestanding (-nostdlib -static, raw aarch64 syscalls), so they need no libc and run unchanged in a busybox or bionic initramfs.

Roadmap

  • cbd-lite (C) — boot the CP to ONLINE. (done, HW-validated)
  • sit-smoke (C) — prove the SIT control port round-trips. (here now)
  • Runtime data path (PKTPROC → rmnet/wwan netdev) + SETUP_DATA_CALL.
  • A productized boot/control daemon (Rust).
  • A ModemManager plugin for the SIT protocol (XMM7360-templated).

License

GPL-2.0-only (see the SPDX headers).