QMI(Qualcomm MSM Interface,官方名称应该是Qualcomm Message Interface)是高通用来替代OneRPC/DM的协议，用来与modem通信。
QMI协议定义了多个服务： DMS(设备管理Device Management) 提供载入 设备信息的功能 NAS(网络访问Network Access)提供欧冠你注册网络的动作 WDS(数据连接) PDS(GPS定位报告) UIM(管理User Identity Module) CTL(控制服务：用户发起其他服务请求前，必须先申请 ClientID, 这个ID就是由控制服务分配的, 这个服务永远在线)
协议里的每个服务都定义了 请求和响应 （也叫做 Indication) 每个请求响应都有一个匹配的ID，这样用户可以一次发出多个请求。并且响应也不必严格按照请求的顺序进行回应。
Indication作为主动提供的消息， 要么发送给某个特定的客户端, 要么是广播消息（广播给所有使用这个服务的客户)。 通常情况下，用户需要通过一些请求/响应 来打开indication
协议中的每条消息都定义了一系列输入（在请求中才有输入）参数，或者输出（在响应或者indications中才有输出)参数。 这些参数，我们命名为TLV
QMI协议可以通过Linux kernels (>= 3.4)来访问。载入cdc-wdm和qmi_wwan之后即可
$ lsmod ... qmi_wwan 20971 0 cdc_wdm 17427 1 qmi_wwan ... usbnet 30844 3 rndis_host,qmi_wwan,cdc_ether usbcore 195340 14 rndis_host,rt2x00usb,usb_storage,rt2800usb,ehci_hcd,ehci_pci,qmi_wwan,usbhid,usbnet,cdc_wdm,xhci_hcd,cdc_ether
https://packages.debian.org/sid/libqmi-glib1 (/usr/lib/x86_64-linux-gnu/libqmi-glib.so.1) https://packages.debian.org/jessie/libqmi-utils (/usr/bin/qmi-network) (/usr/bin/qmicli) https://packages.debian.org/sid/libqmi-glib-dev
设置适当的usb模式
# setprop sys.usb.config diag,serial_smd,serial_tty,rmnet_bam,mass_storage,adb
在PC上可以看到
$ ls -la /dev/cdc* crw------- 1 root root 180, 0 10月 12 20:29 /dev/cdc-wdm0
演示
# qmicli -d /dev/cdc-wdm0 --dms-get-revision [/dev/cdc-wdm0] Device revision retrieved: Revision: 'M8626A-AAAANAZM-1.1.00759 1 [Dec 31 2013 03:00:00]' # qmicli -d /dev/cdc-wdm0 --dms-uim-get-imsi [/dev/cdc-wdm0] UIM IMSI retrieved: IMSI: '204043154974997' # qmicli -d /dev/cdc-wdm0 --dms-uim-get-iccid [/dev/cdc-wdm0] UIM ICCID retrieved: ICCID: '89860313100205205744' # qmicli -d /dev/cdc-wdm0 --dms-get-capabilities [/dev/cdc-wdm0] Device capabilities retrieved: Max TX channel rate: '1800000' Max RX channel rate: '3100000' Data Service: 'non-simultaneous-cs-ps' SIM: 'supported' Networks: 'cdma20001x, evdo, gsm' # qmicli -d /dev/cdc-wdm0 --dms-get-ids [/dev/cdc-wdm0] Device IDs retrieved: ESN: 'C33BA980' IMEI: '355991020927480' MEID: 'A1000051CA0BE1' # qmicli -d /dev/cdc-wdm0 --dms-get-band-capabilities [/dev/cdc-wdm0] Device band capabilities retrieved: Bands: 'bc-0-a-system, bc-0-b-system, gsm-dcs-1800, gsm-900-extended, gsm-850, gsm-pcs-1900' LTE bands: '(null)' v# qmicli -d /dev/cdc-wdm0 --nas-get-system-selection-preference [/dev/cdc-wdm0] Successfully got system selection preference Emergency mode: 'no' Mode preference: 'cdma-1x, cdma-1xevdo, gsm' Band preference: 'bc-0-a-system, bc-0-b-system, bc-1-all-blocks, bc-2, bc-3-a-system, bc-4-all-blocks, bc-5-all-blocks, gsm-dcs-1800, gsm-900-extended, gsm-900-primary, bc-6, bc-7, bc-8, bc-9, bc-10, bc-11, gsm-450, gsm-480, gsm-750, gsm-850, gsm-900-railways, gsm-pcs-1900, wcdma-2100, wcdma-pcs-1900, wcdma-dcs-1800, wcdma-1700-us, wcdma-850-us, wcdma-800, bc-12, bc-14, wcdma-2600, wcdma-900, wcdma-1700-japan, bc-16, bc-17, bc-18, bc-19' LTE band preference: '(null)' TD-SCDMA band preference: 'a, b, c, d, e, f' CDMA PRL preference: 'any' Roaming preference: 'any' Network selection preference: 'automatic' Service domain preference: 'cs-ps' Service selection preference: 'wcdma'
代码 http://cgit.freedesktop.org/libqmi
详细调试信息
v# qmicli -d /dev/cdc-wdm0 -v --dms-get-ids [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Opening device with flags 'none'... [12 10月 2014, 20:55:31] [Debug] QMI Device at '/dev/cdc-wdm0' ready [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Assuming service 'dms' is supported... [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Allocating new client ID... [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Sent message... <<<<<< RAW: <<<<<< length = 16 <<<<<< data = 01:0F:00:00:00:00:00:01:22:00:04:00:01:01:00:02 [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Sent message (translated)... <<<<<< QMUX: <<<<<< length = 15 <<<<<< flags = 0x00 <<<<<< service = "ctl" <<<<<< client = 0 <<<<<< QMI: <<<<<< flags = "none" <<<<<< transaction = 1 <<<<<< tlv_length = 4 <<<<<< message = "Allocate CID" (0x0022) <<<<<< TLV: <<<<<< type = "Service" (0x01) <<<<<< length = 1 <<<<<< value = 02 <<<<<< translated = dms [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Received message... >>>>>> RAW: >>>>>> length = 24 >>>>>> data = 01:17:00:80:00:00:01:01:22:00:0C:00:02:04:00:00:00:00:00:01:02:00:02:03 [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Received message (translated)... >>>>>> QMUX: >>>>>> length = 23 >>>>>> flags = 0x80 >>>>>> service = "ctl" >>>>>> client = 0 >>>>>> QMI: >>>>>> flags = "response" >>>>>> transaction = 1 >>>>>> tlv_length = 12 >>>>>> message = "Allocate CID" (0x0022) >>>>>> TLV: >>>>>> type = "Result" (0x02) >>>>>> length = 4 >>>>>> value = 00:00:00:00 >>>>>> translated = SUCCESS >>>>>> TLV: >>>>>> type = "Allocation Info" (0x01) >>>>>> length = 2 >>>>>> value = 02:03 >>>>>> translated = [ service = 'dms' cid = '3' ] [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Registered 'dms' (version unknown) client with ID '3' [12 10月 2014, 20:55:31] [Debug] Asynchronously getting IDs... [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Sent message... <<<<<< RAW: <<<<<< length = 13 <<<<<< data = 01:0C:00:00:02:03:00:01:00:25:00:00:00 [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Sent message (translated)... <<<<<< QMUX: <<<<<< length = 12 <<<<<< flags = 0x00 <<<<<< service = "dms" <<<<<< client = 3 <<<<<< QMI: <<<<<< flags = "none" <<<<<< transaction = 1 <<<<<< tlv_length = 0 <<<<<< message = "Get IDs" (0x0025) [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Received message... >>>>>> RAW: >>>>>> length = 66 >>>>>> data = 01:41:00:80:02:03:02:01:00:25:00:35:00:02:04:00:00:00:00:00:12:0E:00:41:31:30:30:30:30:35:31:43:41:30:42:45:31:10:08:00:43:33:33:42:41:39:38:30:11:0F:00:33:35:35:39:39:31:30:32:30:39:32:37:34:38:30 [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Received message (translated)... >>>>>> QMUX: >>>>>> length = 65 >>>>>> flags = 0x80 >>>>>> service = "dms" >>>>>> client = 3 >>>>>> QMI: >>>>>> flags = "response" >>>>>> transaction = 1 >>>>>> tlv_length = 53 >>>>>> message = "Get IDs" (0x0025) >>>>>> TLV: >>>>>> type = "Result" (0x02) >>>>>> length = 4 >>>>>> value = 00:00:00:00 >>>>>> translated = SUCCESS >>>>>> TLV: >>>>>> type = "Meid" (0x12) >>>>>> length = 14 >>>>>> value = 41:31:30:30:30:30:35:31:43:41:30:42:45:31 >>>>>> translated = A1000051CA0BE1 >>>>>> TLV: >>>>>> type = "Esn" (0x10) >>>>>> length = 8 >>>>>> value = 43:33:33:42:41:39:38:30 >>>>>> translated = C33BA980 >>>>>> TLV: >>>>>> type = "Imei" (0x11) >>>>>> length = 15 >>>>>> value = 33:35:35:39:39:31:30:32:30:39:32:37:34:38:30 >>>>>> translated = 355991020927480 [/dev/cdc-wdm0] Device IDs retrieved: ESN: 'C33BA980' IMEI: '355991020927480' MEID: 'A1000051CA0BE1' [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Releasing 'dms' client with flags 'release-cid'... [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Unregistered 'dms' client with ID '3' [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Sent message... <<<<<< RAW: <<<<<< length = 17 <<<<<< data = 01:10:00:00:00:00:00:02:23:00:05:00:01:02:00:02:03 [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Sent message (translated)... <<<<<< QMUX: <<<<<< length = 16 <<<<<< flags = 0x00 <<<<<< service = "ctl" <<<<<< client = 0 <<<<<< QMI: <<<<<< flags = "none" <<<<<< transaction = 2 <<<<<< tlv_length = 5 <<<<<< message = "Release CID" (0x0023) <<<<<< TLV: <<<<<< type = "Release Info" (0x01) <<<<<< length = 2 <<<<<< value = 02:03 <<<<<< translated = [ service = 'dms' cid = '3' ] [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Received message... >>>>>> RAW: >>>>>> length = 24 >>>>>> data = 01:17:00:80:00:00:01:02:23:00:0C:00:02:04:00:00:00:00:00:01:02:00:02:03 [12 10月 2014, 20:55:31] [Debug] [/dev/cdc-wdm0] Received message (translated)... >>>>>> QMUX: >>>>>> length = 23 >>>>>> flags = 0x80 >>>>>> service = "ctl" >>>>>> client = 0 >>>>>> QMI: >>>>>> flags = "response" >>>>>> transaction = 2 >>>>>> tlv_length = 12 >>>>>> message = "Release CID" (0x0023) >>>>>> TLV: >>>>>> type = "Result" (0x02) >>>>>> length = 4 >>>>>> value = 00:00:00:00 >>>>>> translated = SUCCESS >>>>>> TLV: >>>>>> type = "Release Info" (0x01) >>>>>> length = 2 >>>>>> value = 02:03 >>>>>> translated = [ service = 'dms' cid = '3' ] [12 10月 2014, 20:55:31] [Debug] Client released
参考资料 http://sigquit.wordpress.com/2012/08/20/an-introduction-to-libqmi/ http://www.lanedo.com/users/amorgado/talks/FOSDEM2013%20-%20Mobile%20broadband%20modem%20control%20protocols.pdf http://blogs.gnome.org/dcbw/2010/04/15/mobile-broadband-and-qualcomm-proprietary-protocols/
usb网络接口 ECM: Ethernet Control Model 802.3 ethernet frames 以太网控制模型
NCM: Network Control Model
MBIM协议 (由高通，爱立信，微软等开发, USB论坛发布) 内核驱动是 cdc_mbim (Linux Kernel >= 3.8) 设备是 /dev/cdc-wdm libmbim mbimcli(libmbim-utils)
mbimcli -d /dev/cdc-wdm1 --basic-connect-query-subscriber-ready-status
在ChromiumOS上也实现了部分QMI协议 https://chromium.googlesource.com/chromiumos/platform/libqmi/+/master/src/