Generic xmm616 and xmm626 names

Signed-off-by: Paul Kocialkowski <contact@paulk.fr>

11 files changed, 2412 insertions, 0 deletions

diff --git a/samsung-ipc/devices/xmm626/modem.h b/samsung-ipc/devices/xmm626/modem.h
new file mode 100644
index 0000000..150bd8a
--- /dev/null
+++ b/samsung-ipc/devices/xmm626/modem.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010 Google, Inc.
+ * Copyright (C) 2010 Samsung Electronics.
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#ifndef __MODEM_IF_H__
+#define __MODEM_IF_H__
+
+enum modem_t {
+	IMC_XMM626,
+	IMC_XMM6262,
+	VIA_CBP71,
+	VIA_CBP72,
+	SEC_CMC221,
+	QC_MDM6600,
+	DUMMY,
+};
+
+enum dev_format {
+	IPC_FMT,
+	IPC_RAW,
+	IPC_RFS,
+	IPC_CMD,
+	IPC_BOOT,
+	IPC_MULTI_RAW,
+	IPC_RAMDUMP,
+	MAX_DEV_FORMAT,
+};
+#define MAX_IPC_DEV	(IPC_RFS + 1)
+
+enum modem_io {
+	IODEV_MISC,
+	IODEV_NET,
+	IODEV_DUMMY,
+};
+
+enum modem_link {
+	LINKDEV_UNDEFINED,
+	LINKDEV_MIPI,
+	LINKDEV_DPRAM,
+	LINKDEV_SPI,
+	LINKDEV_USB,
+	LINKDEV_HSIC,
+	LINKDEV_C2C,
+	LINKDEV_MAX,
+};
+#define LINKTYPE(modem_link) (1u << (modem_link))
+
+enum modem_network {
+	UMTS_NETWORK,
+	CDMA_NETWORK,
+	LTE_NETWORK,
+};
+
+enum sipc_ver {
+	NO_SIPC_VER = 0,
+	SIPC_VER_40 = 40,
+	SIPC_VER_41 = 41,
+	SIPC_VER_42 = 42,
+	SIPC_VER_50 = 50,
+	MAX_SIPC_VER,
+};
+
+#endif
diff --git a/samsung-ipc/devices/xmm626/modem_link_device_hsic.h b/samsung-ipc/devices/xmm626/modem_link_device_hsic.h
new file mode 100755
index 0000000..a8acca8
--- /dev/null
+++ b/samsung-ipc/devices/xmm626/modem_link_device_hsic.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2010 Google, Inc.
+ * Copyright (C) 2010 Samsung Electronics.
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#ifndef __MODEM_LINK_DEVICE_USB_H__
+#define __MODEM_LINK_DEVICE_USB_H__
+
+
+enum {
+	IF_USB_BOOT_EP = 0,
+	IF_USB_FMT_EP = 0,
+	IF_USB_RAW_EP,
+	IF_USB_RFS_EP,
+	IF_USB_CMD_EP,
+	IF_USB_DEVNUM_MAX,
+};
+
+/* each pipe has 2 ep for in/out */
+#define LINKPM_DEV_NUM	(IF_USB_DEVNUM_MAX * 2)
+/******************/
+/* xmm626 specific */
+
+#define IOCTL_LINK_CONTROL_ENABLE	_IO('o', 0x30)
+#define IOCTL_LINK_CONTROL_ACTIVE	_IO('o', 0x31)
+#define IOCTL_LINK_GET_HOSTWAKE		_IO('o', 0x32)
+#define IOCTL_LINK_CONNECTED		_IO('o', 0x33)
+#define IOCTL_LINK_SET_BIAS_CLEAR	_IO('o', 0x34)
+
+/* VID,PID for IMC - XMM626, XMM6262*/
+#define IMC_BOOT_VID		0x058b
+#define IMC_BOOT_PID		0x0041
+#define IMC_MAIN_VID		0x1519
+#define IMC_MAIN_PID		0x0020
+/* VID,PID for STE - M7400 */
+#define STE_BOOT_VID		0x04cc
+#define STE_BOOT_PID		0x7400
+#define STE_MAIN_VID		0x04cc
+#define STE_MAIN_PID		0x2333
+
+enum {
+	BOOT_DOWN = 0,
+	IPC_CHANNEL
+};
+
+enum ch_state {
+	STATE_SUSPENDED,
+	STATE_RESUMED,
+};
+
+#define HOSTWAKE_TRIGLEVEL	0
+
+#endif
diff --git a/samsung-ipc/devices/xmm626/modem_prj.h b/samsung-ipc/devices/xmm626/modem_prj.h
new file mode 100644
index 0000000..99f6087
--- /dev/null
+++ b/samsung-ipc/devices/xmm626/modem_prj.h
@@ -0,0 +1,230 @@
+/*
+ * Copyright (C) 2010 Google, Inc.
+ * Copyright (C) 2010 Samsung Electronics.
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#include <stdbool.h>
+#include <stdint.h>
+#include <linux/types.h>
+
+#define u8 uint8_t
+#define u16 uint16_t
+#define u32 uint32_t
+#define u64 uint64_t
+
+#ifndef __MODEM_PRJ_H__
+#define __MODEM_PRJ_H__
+
+#define MAX_CPINFO_SIZE		512
+
+#define MAX_LINK_DEVTYPE	3
+
+#define MAX_FMT_DEVS	10
+#define MAX_RAW_DEVS	32
+#define MAX_RFS_DEVS	10
+#define MAX_NUM_IO_DEV	(MAX_FMT_DEVS + MAX_RAW_DEVS + MAX_RFS_DEVS)
+
+#define IOCTL_MODEM_ON			_IO('o', 0x19)
+#define IOCTL_MODEM_OFF			_IO('o', 0x20)
+#define IOCTL_MODEM_RESET		_IO('o', 0x21)
+#define IOCTL_MODEM_BOOT_ON		_IO('o', 0x22)
+#define IOCTL_MODEM_BOOT_OFF		_IO('o', 0x23)
+#define IOCTL_MODEM_START		_IO('o', 0x24)
+
+#define IOCTL_MODEM_PROTOCOL_SUSPEND	_IO('o', 0x25)
+#define IOCTL_MODEM_PROTOCOL_RESUME	_IO('o', 0x26)
+
+#define IOCTL_MODEM_STATUS		_IO('o', 0x27)
+#define IOCTL_MODEM_DL_START		_IO('o', 0x28)
+#define IOCTL_MODEM_FW_UPDATE		_IO('o', 0x29)
+
+#define IOCTL_MODEM_NET_SUSPEND		_IO('o', 0x30)
+#define IOCTL_MODEM_NET_RESUME		_IO('o', 0x31)
+
+#define IOCTL_MODEM_DUMP_START		_IO('o', 0x32)
+#define IOCTL_MODEM_DUMP_UPDATE		_IO('o', 0x33)
+#define IOCTL_MODEM_FORCE_CRASH_EXIT	_IO('o', 0x34)
+#define IOCTL_MODEM_CP_UPLOAD		_IO('o', 0x35)
+#define IOCTL_MODEM_DUMP_RESET		_IO('o', 0x36)
+
+#define IOCTL_DPRAM_SEND_BOOT		_IO('o', 0x40)
+#define IOCTL_DPRAM_INIT_STATUS		_IO('o', 0x43)
+
+/* ioctl command definitions. */
+#define IOCTL_DPRAM_PHONE_POWON		_IO('o', 0xd0)
+#define IOCTL_DPRAM_PHONEIMG_LOAD	_IO('o', 0xd1)
+#define IOCTL_DPRAM_NVDATA_LOAD		_IO('o', 0xd2)
+#define IOCTL_DPRAM_PHONE_BOOTSTART	_IO('o', 0xd3)
+
+#define IOCTL_DPRAM_PHONE_UPLOAD_STEP1	_IO('o', 0xde)
+#define IOCTL_DPRAM_PHONE_UPLOAD_STEP2	_IO('o', 0xdf)
+
+/* modem status */
+#define MODEM_OFF		0
+#define MODEM_CRASHED		1
+#define MODEM_RAMDUMP		2
+#define MODEM_POWER_ON		3
+#define MODEM_BOOTING_NORMAL	4
+#define MODEM_BOOTING_RAMDUMP	5
+#define MODEM_DUMPING		6
+#define MODEM_RUNNING		7
+
+#define HDLC_HEADER_MAX_SIZE	6 /* fmt 3, raw 6, rfs 6 */
+
+#define PSD_DATA_CHID_BEGIN	0x2A
+#define PSD_DATA_CHID_END	0x38
+
+#define PS_DATA_CH_0	10
+#define PS_DATA_CH_LAST	24
+
+#define IP6VERSION		6
+
+#define SOURCE_MAC_ADDR		{0x12, 0x34, 0x56, 0x78, 0x9A, 0xBC}
+
+/* Debugging features */
+#define MAX_MIF_LOG_PATH_LEN	128
+#define MAX_MIF_LOG_FILE_SIZE	0x800000	/* 8 MB */
+
+#define MAX_MIF_EVT_BUFF_SIZE	256
+#define MAX_MIF_TIME_LEN	32
+#define MAX_MIF_NAME_LEN	16
+#define MAX_MIF_STR_LEN		127
+#define MAX_MIF_LOG_LEN		128
+
+enum mif_event_id {
+	MIF_IRQ_EVT = 0,
+	MIF_LNK_RX_EVT,
+	MIF_MUX_RX_EVT,
+	MIF_IOD_RX_EVT,
+	MIF_IOD_TX_EVT,
+	MIF_MUX_TX_EVT,
+	MIF_LNK_TX_EVT,
+	MAX_MIF_EVT
+};
+
+struct dpram_queue_status {
+	unsigned in;
+	unsigned out;
+};
+
+struct dpram_queue_status_pair {
+	struct dpram_queue_status txq;
+	struct dpram_queue_status rxq;
+};
+
+struct dpram_irq_buff {
+	unsigned magic;
+	unsigned access;
+	struct dpram_queue_status_pair qsp[MAX_IPC_DEV];
+	unsigned int2ap;
+	unsigned int2cp;
+};
+
+struct mif_event_buff {
+	char time[MAX_MIF_TIME_LEN];
+
+	struct timeval tv;
+	enum mif_event_id evt;
+
+	char mc[MAX_MIF_NAME_LEN];
+
+	char iod[MAX_MIF_NAME_LEN];
+
+	char ld[MAX_MIF_NAME_LEN];
+	enum modem_link link_type;
+
+	unsigned rcvd;
+	unsigned len;
+	union {
+		u8 data[MAX_MIF_LOG_LEN];
+		struct dpram_irq_buff dpram_irqb;
+	};
+};
+
+#define MIF_LOG_DIR	"/sdcard"
+#define MIF_LOG_LV_FILE	"/data/.mif_log_level"
+
+/* Does modem ctl structure will use state ? or status defined below ?*/
+enum modem_state {
+	STATE_OFFLINE,
+	STATE_CRASH_RESET, /* silent reset */
+	STATE_CRASH_EXIT, /* cp ramdump */
+	STATE_BOOTING,
+	STATE_ONLINE,
+	STATE_NV_REBUILDING, /* <= rebuilding start */
+	STATE_LOADER_DONE,
+	STATE_SIM_ATTACH,
+	STATE_SIM_DETACH,
+};
+
+enum com_state {
+	COM_NONE,
+	COM_ONLINE,
+	COM_HANDSHAKE,
+	COM_BOOT,
+	COM_CRASH,
+};
+
+enum link_mode {
+	LINK_MODE_INVALID = 0,
+	LINK_MODE_IPC,
+	LINK_MODE_BOOT,
+	LINK_MODE_DLOAD,
+	LINK_MODE_ULOAD,
+};
+
+struct sim_state {
+	bool online;	/* SIM is online? */
+	bool changed;	/* online is changed? */
+};
+
+#define HDLC_START		0x7F
+#define HDLC_END		0x7E
+#define SIZE_OF_HDLC_START	1
+#define SIZE_OF_HDLC_END	1
+#define MAX_LINK_PADDING_SIZE	3
+
+struct header_data {
+	char hdr[HDLC_HEADER_MAX_SIZE];
+	unsigned len;
+	unsigned frag_len;
+	char start; /*hdlc start header 0x7F*/
+};
+
+struct fmt_hdr {
+	u16 len;
+	u8 control;
+} __attribute__((packed));
+
+struct raw_hdr {
+	u32 len;
+	u8 channel;
+	u8 control;
+} __attribute__((packed));
+
+struct rfs_hdr {
+	u32 len;
+	u8 cmd;
+	u8 id;
+} __attribute__((packed));
+
+struct sipc_fmt_hdr {
+	u16 len;
+	u8  msg_seq;
+	u8  ack_seq;
+	u8  main_cmd;
+	u8  sub_cmd;
+	u8  cmd_type;
+} __attribute__((packed));
+
+#endif
diff --git a/samsung-ipc/devices/xmm626/xmm626.c b/samsung-ipc/devices/xmm626/xmm626.c
new file mode 100644
index 0000000..0c6846d
--- /dev/null
+++ b/samsung-ipc/devices/xmm626/xmm626.c
@@ -0,0 +1,43 @@
+/*
+ * This file is part of libsamsung-ipc.
+ *
+ * Copyright (C) 2012 Alexander Tarasikov <alexander.tarasikov@gmail.com>
+ * Copyright (C) 2013-2014 Paul Kocialkowski <contact@paulk.fr>
+ *
+ * libsamsung-ipc is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * libsamsung-ipc is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with libsamsung-ipc.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdlib.h>
+#include <sys/ioctl.h>
+
+#include "xmm626.h"
+
+unsigned char xmm626_crc_calculate(const void *data, size_t size)
+{
+    unsigned char crc;
+    unsigned char *p;
+
+    if (data == NULL || size == 0)
+        return 0;
+
+    p = (unsigned char *) data;
+
+    crc = 0;
+    while (size--)
+        crc ^= *p++;
+
+    return crc;
+}
+
+// vim:ts=4:sw=4:expandtab
diff --git a/samsung-ipc/devices/xmm626/xmm626.h b/samsung-ipc/devices/xmm626/xmm626.h
new file mode 100644
index 0000000..e93aca3
--- /dev/null
+++ b/samsung-ipc/devices/xmm626/xmm626.h
@@ -0,0 +1,53 @@
+/*
+ * This file is part of libsamsung-ipc.
+ *
+ * Copyright (C) 2013-2014 Paul Kocialkowski <contact@paulk.fr>
+ *
+ * libsamsung-ipc is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * libsamsung-ipc is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with libsamsung-ipc.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __XMM626_H__
+#define __XMM626_H__
+
+#define XMM626_AT                              "ATAT"
+#define XMM626_PSI_PADDING                                     0xFF
+#define XMM626_PSI_MAGIC                                       0x30
+#define XMM626_SEC_END_MAGIC                                   0x0000
+#define XMM626_HW_RESET_MAGIC                                  0x111001
+#define XMM626_DATA_SIZE                                       0x1000
+
+#define XMM626_COMMAND_SET_PORT_CONFIG                         0x86
+#define XMM626_COMMAND_SEC_START                               0x204
+#define XMM626_COMMAND_SEC_END                                 0x205
+#define XMM626_COMMAND_HW_RESET                                0x208
+#define XMM626_COMMAND_FLASH_SET_ADDRESS                       0x802
+#define XMM626_COMMAND_FLASH_WRITE_BLOCK                       0x804
+
+#define XMM626_FIRMWARE_ADDRESS                                0x60300000
+#define XMM626_NV_DATA_ADDRESS                                 0x60E80000
+#define XMM626_MPS_DATA_ADDRESS                                0x61080000
+
+#define XMM626_NV_DATA_PATH                    "/efs/nv_data.bin"
+#define XMM626_NV_DATA_MD5_PATH                "/efs/nv_data.bin.md5"
+#define XMM626_NV_DATA_BACKUP_PATH             "/efs/.nv_data.bak"
+#define XMM626_NV_DATA_BACKUP_MD5_PATH         "/efs/.nv_data.bak.md5"
+#define XMM626_NV_DATA_SECRET                  "Samsung_Android_RIL"
+#define XMM626_NV_DATA_SIZE                                    0x200000
+#define XMM626_NV_DATA_CHUNK_SIZE                              0x1000
+
+unsigned char xmm626_crc_calculate(const void *data, size_t size);
+
+#endif
+
+// vim:ts=4:sw=4:expandtab
diff --git a/samsung-ipc/devices/xmm626/xmm626_hsic.c b/samsung-ipc/devices/xmm626/xmm626_hsic.c
new file mode 100644
index 0000000..d7a5d4f
--- /dev/null
+++ b/samsung-ipc/devices/xmm626/xmm626_hsic.c
@@ -0,0 +1,588 @@
+/*
+ * This file is part of libsamsung-ipc.
+ *
+ * Copyright (C) 2012 Alexander Tarasikov <alexander.tarasikov@gmail.com>
+ * Copyright (C) 2013-2014 Paul Kocialkowski <contact@paulk.fr>
+ *
+ * Based on the incomplete C++ implementation which is:
+ * Copyright (C) 2012 Sergey Gridasov <grindars@gmail.com>
+ *
+ * libsamsung-ipc is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * libsamsung-ipc is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with libsamsung-ipc.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/select.h>
+
+#include <samsung-ipc.h>
+#include <utils.h>
+
+#include "xmm626.h"
+#include "xmm626_hsic.h"
+
+int xmm626_hsic_ack_read(int device_fd, unsigned short ack)
+{
+    struct timeval timeout;
+    fd_set fds;
+    unsigned short value;
+    int rc;
+    int i;
+
+    timeout.tv_sec = 1;
+    timeout.tv_usec = 0;
+
+    FD_ZERO(&fds);
+    FD_SET(device_fd, &fds);
+
+    for (i = 0; i < 50; i++) {
+        rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+        if (rc <= 0)
+            return -1;
+
+        value = 0;
+        rc = read(device_fd, &value, sizeof(value));
+        if (rc < (int) sizeof(value))
+            continue;
+
+        if (value == ack)
+            return 0;
+    }
+
+    return -1;
+}
+
+int xmm626_hsic_psi_send(struct ipc_client *client, int device_fd,
+    const void *psi_data, unsigned short psi_size)
+{
+    struct xmm626_hsic_psi_header psi_header;
+    char at[] = XMM626_AT;
+    unsigned char psi_ack;
+    unsigned char chip_id;
+    unsigned char psi_crc;
+    struct timeval timeout;
+    fd_set fds;
+    size_t wc;
+    size_t length;
+    unsigned char *p;
+    int rc;
+    int i;
+
+    if (client == NULL || device_fd < 0 || psi_data == NULL || psi_size == 0)
+        return -1;
+
+    FD_ZERO(&fds);
+
+    i = 0;
+    length = strlen(at);
+
+    do {
+        FD_SET(device_fd, &fds);
+
+        timeout.tv_sec = 0;
+        timeout.tv_usec = 100000;
+
+        rc = write(device_fd, at, length);
+        if (rc < (int) length) {
+            ipc_client_log(client, "Writing ATAT in ASCII failed");
+            goto error;
+        }
+        ipc_client_log(client, "Wrote ATAT in ASCII");
+
+        rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+        if (rc < 0) {
+            ipc_client_log(client, "Waiting for bootup failed");
+            goto error;
+        }
+
+        if (i++ > 50) {
+            ipc_client_log(client, "Waiting for bootup failed");
+            goto error;
+        }
+    } while(rc == 0);
+
+    FD_SET(device_fd, &fds);
+
+    timeout.tv_sec = 0;
+    timeout.tv_usec = 100000;
+
+    rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+    if (rc <= 0) {
+        ipc_client_log(client, "Reading chip id failed");
+        goto error;
+    }
+
+    psi_ack = 0;
+    rc = read(device_fd, &psi_ack, sizeof(psi_ack));
+    if (rc <= 0 || psi_ack != XMM626_HSIC_BOOT0_ACK) {
+        ipc_client_log(client, "Reading boot ACK failed");
+        goto error;
+    }
+
+    rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+    if (rc <= 0) {
+        ipc_client_log(client, "Reading chip id failed");
+        goto error;
+    }
+
+    chip_id = 0;
+    rc = read(device_fd, &chip_id, sizeof(chip_id));
+    if (rc <= 0) {
+        ipc_client_log(client, "Reading chip id failed");
+        goto error;
+    }
+    ipc_client_log(client, "Read chip id (0x%x)", chip_id);
+
+    psi_header.magic = XMM626_PSI_MAGIC;
+    psi_header.length = psi_size;
+    psi_header.padding = XMM626_PSI_PADDING;
+
+    rc = write(device_fd, &psi_header, sizeof(psi_header));
+    if (rc < (int) sizeof(psi_header)) {
+        ipc_client_log(client, "Writing PSI header failed");
+        goto error;
+    }
+    ipc_client_log(client, "Wrote PSI header");
+
+    p = (unsigned char *) psi_data;
+
+    wc = 0;
+    while (wc < psi_size) {
+        rc = write(device_fd, (void *) p, psi_size - wc);
+        if (rc <= 0) {
+            ipc_client_log(client, "Writing PSI failed");
+            goto error;
+        }
+
+        p += rc;
+        wc += rc;
+    }
+
+    psi_crc = xmm626_crc_calculate(psi_data, psi_size);
+
+    ipc_client_log(client, "Wrote PSI, CRC is 0x%x", psi_crc);
+
+    rc = write(device_fd, &psi_crc, sizeof(psi_crc));
+    if (rc < (int) sizeof(psi_crc)) {
+        ipc_client_log(client, "Writing PSI CRC failed");
+        goto error;
+    }
+    ipc_client_log(client, "Wrote PSI CRC (0x%x)", psi_crc);
+
+    timeout.tv_sec = 0;
+    timeout.tv_usec = 100000;
+
+    for (i = 0; i < XMM626_HSIC_PSI_UNKNOWN_COUNT; i++) {
+        rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+        if (rc <= 0) {
+            ipc_client_log(client, "Reading PSI unknown failed");
+            goto error;
+        }
+
+        rc = read(device_fd, &psi_ack, sizeof(psi_ack));
+        if (rc < (int) sizeof(psi_ack)) {
+            ipc_client_log(client, "Reading PSI unknown failed");
+            goto error;
+        }
+    }
+
+    for (i = 0; i < XMM626_HSIC_PSI_CRC_ACK_COUNT ; i++) {
+        rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+        if (rc <= 0) {
+            ipc_client_log(client, "Reading PSI CRC ACK failed");
+            goto error;
+        }
+
+        rc = read(device_fd, &psi_ack, sizeof(psi_ack));
+        if (rc < (int) sizeof(psi_ack) || psi_ack != XMM626_HSIC_PSI_CRC_ACK) {
+            ipc_client_log(client, "Reading PSI CRC ACK failed");
+            goto error;
+        }
+    }
+    ipc_client_log(client, "Read PSI CRC ACK");
+
+    rc = xmm626_hsic_ack_read(device_fd, XMM626_HSIC_PSI_ACK);
+    if (rc < 0) {
+        ipc_client_log(client, "Reading PSI ACK failed");
+        goto error;
+    }
+    ipc_client_log(client, "Read PSI ACK");
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    return rc;
+}
+
+int xmm626_hsic_ebl_send(struct ipc_client *client, int device_fd,
+    const void *ebl_data, size_t ebl_size)
+{
+    unsigned char ebl_crc;
+    size_t chunk;
+    size_t count;
+    size_t wc;
+    size_t size;
+    unsigned char *p;
+    int rc;
+
+    if (client == NULL || device_fd < 0 || ebl_data == NULL || ebl_size == 0)
+        return -1;
+
+    size = sizeof(ebl_size);
+
+    rc = write(device_fd, &ebl_size, size);
+    if (rc < (int) size) {
+        ipc_client_log(client, "Writing EBL size failed");
+        goto error;
+    }
+    ipc_client_log(client, "Wrote EBL size");
+
+    rc = xmm626_hsic_ack_read(device_fd, XMM626_HSIC_EBL_SIZE_ACK);
+    if (rc < 0) {
+        ipc_client_log(client, "Reading EBL size ACK failed");
+        goto error;
+    }
+
+    p = (unsigned char *) ebl_data;
+
+    chunk = XMM626_HSIC_EBL_CHUNK;
+    wc = 0;
+    while (wc < ebl_size) {
+        count = chunk < ebl_size - wc ? chunk : ebl_size - wc;
+
+        rc = write(device_fd, (void *) p, count);
+        if (rc <= 0) {
+            ipc_client_log(client, "Writing EBL failed");
+            goto error;
+        }
+
+        p += rc;
+        wc += rc;
+    }
+
+    ebl_crc = xmm626_crc_calculate(ebl_data, ebl_size);
+
+    ipc_client_log(client, "Wrote EBL, CRC is 0x%x", ebl_crc);
+
+    rc = write(device_fd, &ebl_crc, sizeof(ebl_crc));
+    if (rc < (int) sizeof(ebl_crc)) {
+        ipc_client_log(client, "Writing EBL CRC failed");
+        goto error;
+    }
+    ipc_client_log(client, "Wrote EBL CRC (0x%x)", ebl_crc);
+
+    rc = xmm626_hsic_ack_read(device_fd, XMM626_HSIC_EBL_ACK);
+    if (rc < 0) {
+        ipc_client_log(client, "Reading EBL ACK failed");
+        goto error;
+    }
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    return rc;
+}
+
+int xmm626_hsic_command_send(int device_fd, unsigned short code,
+    const void *data, size_t size, size_t command_data_size, int ack)
+{
+    struct xmm626_hsic_command_header header;
+    void *buffer = NULL;
+    size_t length;
+    struct timeval timeout;
+    fd_set fds;
+    unsigned char *p;
+    int rc;
+    int i;
+
+    if (device_fd < 0 || data == NULL || size == 0 || command_data_size == 0 || command_data_size < size)
+        return -1;
+
+    header.checksum = (size & 0xffff) + code;
+    header.code = code;
+    header.data_size = size;
+
+    p = (unsigned char *) data;
+
+    for (i = 0; i < (int) size; i++)
+        header.checksum += *p++;
+
+    length = command_data_size + sizeof(header);
+    buffer = calloc(1, length);
+
+    memset(buffer, 0, length);
+    p = (unsigned char *) buffer;
+    memcpy(p, &header, sizeof(header));
+    p += sizeof(header);
+    memcpy(p, data, size);
+
+    rc = write(device_fd, buffer, length);
+    if (rc < (int) length)
+        goto error;
+
+    if (!ack) {
+        rc = 0;
+        goto complete;
+    }
+
+    memset(buffer, 0, length);
+
+    FD_ZERO(&fds);
+    FD_SET(device_fd, &fds);
+
+    timeout.tv_sec = 1;
+    timeout.tv_usec = 0;
+
+    rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+    if (rc <= 0)
+        goto error;
+
+    rc = read(device_fd, &header, sizeof(header));
+    if (rc < (int) sizeof(header))
+        goto error;
+
+    rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+    if (rc <= 0)
+        goto error;
+
+    rc = read(device_fd, buffer, command_data_size);
+    if (rc < (int) command_data_size)
+        goto error;
+
+    if (header.code != code)
+        goto error;
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    if (buffer != NULL)
+        free(buffer);
+
+    return rc;
+}
+
+int xmm626_hsic_modem_data_send(int device_fd, const void *data, size_t size,
+    int address)
+{
+    size_t chunk;
+    size_t count;
+    size_t c;
+    unsigned char *p;
+    int rc;
+
+    if (device_fd < 0 || data == NULL || size == 0)
+        return -1;
+
+    rc = xmm626_hsic_command_send(device_fd, XMM626_COMMAND_FLASH_SET_ADDRESS, &address, sizeof(address), XMM626_HSIC_FLASH_SET_ADDRESS_SIZE, 1);
+    if (rc < 0)
+        goto error;
+
+    p = (unsigned char *) data;
+
+    chunk = XMM626_HSIC_MODEM_DATA_CHUNK;
+    c = 0;
+    while (c < size) {
+        count = chunk < size - c ? chunk : size - c;
+
+        rc = xmm626_hsic_command_send(device_fd, XMM626_COMMAND_FLASH_WRITE_BLOCK, p, count, XMM626_HSIC_FLASH_WRITE_BLOCK_SIZE, 0);
+        if (rc < 0)
+            goto error;
+
+        p += count;
+        c += count;
+    }
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    return rc;
+}
+
+int xmm626_hsic_port_config_send(struct ipc_client *client, int device_fd)
+{
+    void *buffer = NULL;
+    size_t length;
+    struct timeval timeout;
+    fd_set fds;
+    int rc;
+
+    if (client == NULL || device_fd < 0)
+        return -1;
+
+    FD_ZERO(&fds);
+    FD_SET(device_fd, &fds);
+
+    timeout.tv_sec = 2;
+    timeout.tv_usec = 0;
+
+    rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+    if (rc <= 0)
+        goto error;
+
+    length = XMM626_HSIC_PORT_CONFIG_SIZE;
+    buffer = calloc(1, length);
+
+    rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+    if (rc <= 0)
+        goto error;
+
+    rc = read(device_fd, buffer, length);
+    if (rc < (int) length) {
+        ipc_client_log(client, "Reading port config failed");
+        goto error;
+    }
+    ipc_client_log(client, "Read port config");
+
+    rc = xmm626_hsic_command_send(device_fd, XMM626_COMMAND_SET_PORT_CONFIG, buffer, length, XMM626_HSIC_SET_PORT_CONFIG_SIZE, 1);
+    if (rc < 0) {
+        ipc_client_log(client, "Sending port config command failed");
+        goto error;
+    }
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    if (buffer != NULL)
+        free(buffer);
+
+    return rc;
+}
+
+int xmm626_hsic_sec_start_send(struct ipc_client *client, int device_fd,
+    const void *sec_data, size_t sec_size)
+{
+    int rc;
+
+    if (client == NULL || device_fd < 0 || sec_data == NULL || sec_size == 0)
+        return -1;
+
+    rc = xmm626_hsic_command_send(device_fd, XMM626_COMMAND_SEC_START, sec_data, sec_size, XMM626_HSIC_SEC_START_SIZE, 1);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_hsic_sec_end_send(struct ipc_client *client, int device_fd)
+{
+    unsigned short sec_data;
+    size_t sec_size;
+    int rc;
+
+    if (client == NULL || device_fd < 0)
+        return -1;
+
+    sec_data = XMM626_SEC_END_MAGIC;
+    sec_size = sizeof(sec_data);
+
+    rc = xmm626_hsic_command_send(device_fd, XMM626_COMMAND_SEC_END, &sec_data, sec_size, XMM626_HSIC_SEC_END_SIZE, 1);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_hsic_firmware_send(struct ipc_client *client, int device_fd,
+    const void *firmware_data, size_t firmware_size)
+{
+    int rc;
+
+    if (client == NULL || device_fd < 0 || firmware_data == NULL || firmware_size == 0)
+        return -1;
+
+    rc = xmm626_hsic_modem_data_send(device_fd, firmware_data, firmware_size, XMM626_FIRMWARE_ADDRESS);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_hsic_nv_data_send(struct ipc_client *client, int device_fd)
+{
+    void *nv_data = NULL;
+    size_t nv_size;
+    int rc;
+
+    if (client == NULL || device_fd < 0)
+        return -1;
+
+    nv_size = ipc_client_nv_data_size(client);
+    if (nv_size == 0)
+        return -1;
+
+    nv_data = ipc_nv_data_load(client);
+    if (nv_data == NULL) {
+        ipc_client_log(client, "Loading nv_data failed");
+        goto error;
+    }
+    ipc_client_log(client, "Loaded nv_data");
+
+    rc = xmm626_hsic_modem_data_send(device_fd, nv_data, nv_size, XMM626_NV_DATA_ADDRESS);
+    if (rc < 0)
+        goto error;
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    if (nv_data != NULL)
+        free(nv_data);
+
+    return rc;
+}
+
+int xmm626_hsic_hw_reset_send(struct ipc_client *client, int device_fd)
+{
+    unsigned int hw_reset_data;
+    int hw_reset_size;
+    int rc;
+
+    if (client == NULL || device_fd < 0)
+        return -1;
+
+    hw_reset_data = XMM626_HW_RESET_MAGIC;
+    hw_reset_size = sizeof(hw_reset_data);
+
+    rc = xmm626_hsic_command_send(device_fd, XMM626_COMMAND_HW_RESET, &hw_reset_data, hw_reset_size, XMM626_HSIC_HW_RESET_SIZE, 0);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+// vim:ts=4:sw=4:expandtab
diff --git a/samsung-ipc/devices/xmm626/xmm626_hsic.h b/samsung-ipc/devices/xmm626/xmm626_hsic.h
new file mode 100644
index 0000000..6fd374c
--- /dev/null
+++ b/samsung-ipc/devices/xmm626/xmm626_hsic.h
@@ -0,0 +1,69 @@
+/*
+ * This file is part of libsamsung-ipc.
+ *
+ * Copyright (C) 2012 Alexander Tarasikov <alexander.tarasikov@gmail.com>
+ * Copyright (C) 2013-2014 Paul Kocialkowski <contact@paulk.fr>
+ *
+ * libsamsung-ipc is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * libsamsung-ipc is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with libsamsung-ipc.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __XMM626_HSIC_H__
+#define __XMM626_HSIC_H__
+
+#define XMM626_HSIC_BOOT0_ACK                                  0xF0
+#define XMM626_HSIC_PSI_UNKNOWN_COUNT                          22
+#define XMM626_HSIC_PSI_CRC_ACK                                0x01
+#define XMM626_HSIC_PSI_CRC_ACK_COUNT                          2
+#define XMM626_HSIC_PSI_ACK                                    0xAA00
+#define XMM626_HSIC_EBL_SIZE_ACK                               0xCCCC
+#define XMM626_HSIC_EBL_ACK                                    0xA551
+#define XMM626_HSIC_EBL_CHUNK                                  0x4000
+#define XMM626_HSIC_PORT_CONFIG_SIZE                           0x4C
+#define XMM626_HSIC_SET_PORT_CONFIG_SIZE                       0x800
+#define XMM626_HSIC_SEC_START_SIZE                             0x4000
+#define XMM626_HSIC_SEC_END_SIZE                               0x4000
+#define XMM626_HSIC_HW_RESET_SIZE                              0x4000
+#define XMM626_HSIC_FLASH_SET_ADDRESS_SIZE                     0x4000
+#define XMM626_HSIC_FLASH_WRITE_BLOCK_SIZE                     0x4000
+#define XMM626_HSIC_MODEM_DATA_CHUNK                           0x4000
+
+struct xmm626_hsic_psi_header {
+    unsigned char magic;
+    unsigned short length;
+    unsigned char padding;
+} __attribute__((packed));
+
+struct xmm626_hsic_command_header {
+    unsigned short checksum;
+    unsigned short code;
+    unsigned int data_size;
+} __attribute__((packed));
+
+int xmm626_hsic_psi_send(struct ipc_client *client, int device_fd,
+    const void *psi_data, unsigned short psi_size);
+int xmm626_hsic_ebl_send(struct ipc_client *client, int device_fd,
+    const void *ebl_data, size_t ebl_size);
+
+int xmm626_hsic_port_config_send(struct ipc_client *client, int device_fd);
+int xmm626_hsic_sec_start_send(struct ipc_client *client, int device_fd,
+    const void *sec_data, size_t sec_size);
+int xmm626_hsic_sec_end_send(struct ipc_client *client, int device_fd);
+int xmm626_hsic_firmware_send(struct ipc_client *client, int device_fd,
+    const void *firmware_data, size_t firmware_size);
+int xmm626_hsic_nv_data_send(struct ipc_client *client, int device_fd);
+int xmm626_hsic_hw_reset_send(struct ipc_client *client, int device_fd);
+
+#endif
+
+// vim:ts=4:sw=4:expandtab
diff --git a/samsung-ipc/devices/xmm626/xmm626_mipi.c b/samsung-ipc/devices/xmm626/xmm626_mipi.c
new file mode 100644
index 0000000..667a4ea
--- /dev/null
+++ b/samsung-ipc/devices/xmm626/xmm626_mipi.c
@@ -0,0 +1,654 @@
+/*
+ * This file is part of libsamsung-ipc.
+ *
+ * Copyright (C) 2012 Alexander Tarasikov <alexander.tarasikov@gmail.com>
+ * Copyright (C) 2013-2014 Paul Kocialkowski <contact@paulk.fr>
+ *
+ * Based on the incomplete C++ implementation which is:
+ * Copyright (C) 2012 Sergey Gridasov <grindars@gmail.com>
+ *
+ * libsamsung-ipc is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * libsamsung-ipc is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with libsamsung-ipc.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <sys/select.h>
+
+#include <samsung-ipc.h>
+#include <utils.h>
+
+#include "xmm626.h"
+#include "xmm626_mipi.h"
+
+int xmm626_mipi_crc_calculate(const void *data, size_t size)
+{
+    unsigned char crc;
+    int mipi_crc;
+
+    crc = xmm626_crc_calculate(data, size);
+    mipi_crc = (crc << 24) | 0xffffff;
+
+    return mipi_crc;
+}
+
+int xmm626_mipi_ack_read(int device_fd, unsigned short ack)
+{
+    struct timeval timeout;
+    fd_set fds;
+    unsigned int value;
+    int rc;
+    int i;
+
+    timeout.tv_sec = 1;
+    timeout.tv_usec = 0;
+
+    FD_ZERO(&fds);
+    FD_SET(device_fd, &fds);
+
+    for (i = 0; i < 50; i++) {
+        rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+        if (rc <= 0)
+            return -1;
+
+        value = 0;
+        rc = read(device_fd, &value, sizeof(value));
+        if (rc < (int) sizeof(value))
+            continue;
+
+        if ((value & 0xffff) == ack)
+            return 0;
+    }
+
+    return -1;
+}
+
+int xmm626_mipi_psi_send(struct ipc_client *client, int device_fd,
+    const void *psi_data, unsigned short psi_size)
+{
+    struct xmm626_mipi_psi_header psi_header;
+    char at[] = XMM626_AT;
+    int psi_crc;
+    struct timeval timeout;
+    fd_set fds;
+    size_t wc;
+    size_t length;
+    unsigned char *p;
+    int rc;
+    int i;
+
+    if (client == NULL || device_fd < 0 || psi_data == NULL || psi_size == 0)
+        return -1;
+
+    FD_ZERO(&fds);
+
+    i = 0;
+    length = strlen(at);
+
+    do {
+        FD_SET(device_fd, &fds);
+
+        timeout.tv_sec = 0;
+        timeout.tv_usec = 100000;
+
+        rc = write(device_fd, at, length);
+        if (rc < (int) length) {
+            ipc_client_log(client, "Writing ATAT in ASCII failed");
+            goto error;
+        }
+        ipc_client_log(client, "Wrote ATAT in ASCII");
+
+        rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+        if (rc < 0) {
+            ipc_client_log(client, "Waiting for bootup failed");
+            goto error;
+        }
+
+        if (i++ > 50) {
+            ipc_client_log(client, "Waiting for bootup failed");
+            goto error;
+        }
+    } while(rc == 0);
+
+    rc = xmm626_mipi_ack_read(device_fd, XMM626_MIPI_BOOT0_ACK);
+    if (rc < 0) {
+        ipc_client_log(client, "Reading boot ACK failed");
+        goto error;
+    }
+
+    psi_header.padding = XMM626_PSI_PADDING;
+    psi_header.length = ((psi_size >> 8) & 0xff) | ((psi_size & 0xff) << 8);
+    psi_header.magic = XMM626_PSI_MAGIC;
+
+    rc = write(device_fd, &psi_header, sizeof(psi_header));
+    if (rc < (int) sizeof(psi_header)) {
+        ipc_client_log(client, "Writing PSI header failed");
+        goto error;
+    }
+    ipc_client_log(client, "Wrote PSI header");
+
+    p = (unsigned char *) psi_data;
+
+    wc = 0;
+    while (wc < psi_size) {
+        rc = write(device_fd, (void *) p, psi_size - wc);
+        if (rc <= 0) {
+            ipc_client_log(client, "Writing PSI failed");
+            goto error;
+        }
+
+        p += rc;
+        wc += rc;
+    }
+
+    psi_crc = xmm626_mipi_crc_calculate(psi_data, psi_size);
+
+    ipc_client_log(client, "Wrote PSI, CRC is 0x%x", psi_crc);
+
+    rc = write(device_fd, &psi_crc, sizeof(psi_crc));
+    if (rc < (int) sizeof(psi_crc)) {
+        ipc_client_log(client, "Writing PSI CRC failed");
+        goto error;
+    }
+    ipc_client_log(client, "Wrote PSI CRC (0x%x)", psi_crc);
+
+    rc = xmm626_mipi_ack_read(device_fd, XMM626_MIPI_PSI_ACK);
+    if (rc < 0) {
+        ipc_client_log(client, "Reading PSI ACK failed");
+        goto error;
+    }
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    return rc;
+}
+
+int xmm626_mipi_ebl_send(struct ipc_client *client, int device_fd,
+    const void *ebl_data, size_t ebl_size)
+{
+    unsigned short boot_magic[4];
+    unsigned char ebl_crc;
+    size_t chunk;
+    size_t count;
+    size_t wc;
+    size_t size;
+    size_t length;
+    unsigned char *p;
+    int rc;
+
+    if (client == NULL || device_fd < 0 || ebl_data == NULL || ebl_size == 0)
+        return -1;
+
+    boot_magic[0] = 0;
+    boot_magic[1] = 0;
+    boot_magic[2] = XMM626_MIPI_BOOT1_MAGIC;
+    boot_magic[3] = XMM626_MIPI_BOOT1_MAGIC;
+
+    length = sizeof(boot_magic);
+
+    rc = write(device_fd, &length, sizeof(length));
+    if (rc < (int) sizeof(length)) {
+        ipc_client_log(client, "Writing boot magic length failed");
+        goto error;
+    }
+
+    rc = write(device_fd, &boot_magic, length);
+    if (rc < (int) length) {
+        ipc_client_log(client, "Writing boot magic failed");
+        goto error;
+    }
+    ipc_client_log(client, "Wrote boot magic");
+
+    rc = xmm626_mipi_ack_read(device_fd, XMM626_MIPI_BOOT1_ACK);
+    if (rc < 0) {
+        ipc_client_log(client, "Reading boot magic ACK failed");
+        goto error;
+    }
+
+    size = sizeof(ebl_size);
+
+    rc = write(device_fd, &size, sizeof(size));
+    if (rc < (int) sizeof(size)) {
+        ipc_client_log(client, "Writing EBL size length failed");
+        goto error;
+    }
+
+    rc = write(device_fd, &ebl_size, size);
+    if (rc < (int) size) {
+        ipc_client_log(client, "Writing EBL size failed");
+        goto error;
+    }
+    ipc_client_log(client, "Wrote EBL size");
+
+    rc = xmm626_mipi_ack_read(device_fd, XMM626_MIPI_EBL_SIZE_ACK);
+    if (rc < 0) {
+        ipc_client_log(client, "Reading EBL size ACK failed");
+        goto error;
+    }
+
+    ebl_size++;
+
+    rc = write(device_fd, &ebl_size, size);
+    if (rc < (int) size) {
+        ipc_client_log(client, "Writing EBL size failed");
+        goto error;
+    }
+
+    ebl_size--;
+
+    p = (unsigned char *) ebl_data;
+
+    chunk = XMM626_MIPI_EBL_CHUNK;
+    wc = 0;
+    while (wc < ebl_size) {
+        count = chunk < ebl_size - wc ? chunk : ebl_size - wc;
+
+        rc = write(device_fd, (void *) p, count);
+        if (rc <= 0) {
+            ipc_client_log(client, "Writing EBL failed");
+            goto error;
+        }
+
+        p += rc;
+        wc += rc;
+    }
+
+    ebl_crc = xmm626_crc_calculate(ebl_data, ebl_size);
+
+    ipc_client_log(client, "Wrote EBL, CRC is 0x%x", ebl_crc);
+
+    rc = write(device_fd, &ebl_crc, sizeof(ebl_crc));
+    if (rc < (int) sizeof(ebl_crc)) {
+        ipc_client_log(client, "Writing EBL CRC failed");
+        goto error;
+    }
+    ipc_client_log(client, "Wrote EBL CRC (0x%x)", ebl_crc);
+
+    rc = xmm626_mipi_ack_read(device_fd, XMM626_MIPI_EBL_ACK);
+    if (rc < 0) {
+        ipc_client_log(client, "Reading EBL ACK failed");
+        goto error;
+    }
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    return rc;
+}
+
+int xmm626_mipi_command_send(int device_fd, unsigned short code,
+    const void *data, size_t size, int ack, int short_footer)
+{
+    struct xmm626_mipi_command_header header;
+    struct xmm626_mipi_command_footer footer;
+    void *buffer = NULL;
+    size_t length;
+    size_t footer_length;
+    struct timeval timeout;
+    fd_set fds;
+    size_t chunk;
+    size_t c;
+    unsigned char *p;
+    int rc;
+    int i;
+
+    if (device_fd < 0 || data == NULL || size <= 0)
+        return -1;
+
+    header.size = size + sizeof(header);
+    header.magic = XMM626_MIPI_COMMAND_HEADER_MAGIC;
+    header.code = code;
+    header.data_size = size;
+
+    footer.checksum = (size & 0xffff) + code;
+    footer.magic = XMM626_MIPI_COMMAND_FOOTER_MAGIC;
+    footer.unknown = XMM626_MIPI_COMMAND_FOOTER_UNKNOWN;
+
+    p = (unsigned char *) data;
+
+    for (i = 0; i < (int) size; i++)
+        footer.checksum += *p++;
+
+    footer_length = sizeof(footer);
+    if (short_footer)
+        footer_length -= sizeof(short);
+
+    length = sizeof(header) + size + footer_length;
+    buffer = calloc(1, length);
+
+    p = (unsigned char *) buffer;
+    memcpy(p, &header, sizeof(header));
+    p += sizeof(header);
+    memcpy(p, data, size);
+    p += size;
+    memcpy(p, &footer, footer_length);
+
+    rc = write(device_fd, buffer, length);
+    if (rc < (int) length)
+        goto error;
+
+    free(buffer);
+    buffer = NULL;
+
+    if (!ack) {
+        rc = 0;
+        goto complete;
+    }
+
+    FD_ZERO(&fds);
+    FD_SET(device_fd, &fds);
+
+    timeout.tv_sec = 1;
+    timeout.tv_usec = 0;
+
+    rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+    if (rc <= 0)
+        goto error;
+
+    rc = read(device_fd, &length, sizeof(length));
+    if (rc < (int) sizeof(length) || length <= 0)
+        goto error;
+
+    length += sizeof(unsigned int);
+    if (length % 4 != 0)
+        length += length % 4;
+
+    if (length < (int) sizeof(buffer))
+        goto error;
+
+    buffer = calloc(1, length);
+
+    p = (unsigned char *) buffer;
+    memcpy(p, &length, sizeof(length));
+    p += sizeof(length);
+
+    chunk = 4;
+    c = sizeof(length);
+    while (c < length) {
+        rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+        if (rc <= 0)
+            goto error;
+
+        rc = read(device_fd, (void *) p, chunk);
+        if (rc < (int) chunk)
+            goto error;
+
+        p += rc;
+        c += rc;
+    }
+
+    memcpy(&header, buffer, sizeof(header));
+    if (header.code != code)
+        goto error;
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    if (buffer != NULL)
+        free(buffer);
+
+    return rc;
+}
+
+int xmm626_mipi_modem_data_send(int device_fd, const void *data, size_t size,
+    int address)
+{
+    size_t chunk;
+    size_t count;
+    size_t c;
+    unsigned char *p;
+    int rc;
+
+    if (device_fd < 0 || data == NULL || size == 0)
+        return -1;
+
+    rc = xmm626_mipi_command_send(device_fd, XMM626_COMMAND_FLASH_SET_ADDRESS, &address, sizeof(address), 1, 0);
+    if (rc < 0)
+        goto error;
+
+    p = (unsigned char *) data;
+
+    chunk = XMM626_MIPI_MODEM_DATA_CHUNK;
+    c = 0;
+    while (c < size) {
+        count = chunk < size - c ? chunk : size - c;
+
+        rc = xmm626_mipi_command_send(device_fd, XMM626_COMMAND_FLASH_WRITE_BLOCK, p, count, 1, 1);
+        if (rc < 0)
+            goto error;
+
+        p += count;
+        c += count;
+    }
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    return rc;
+}
+
+int xmm626_mipi_port_config_send(struct ipc_client *client, int device_fd)
+{
+    void *buffer = NULL;
+    size_t length;
+    struct timeval timeout;
+    fd_set fds;
+    size_t chunk;
+    size_t count;
+    size_t c;
+    unsigned char *p;
+    int rc;
+
+    if (client == NULL || device_fd < 0)
+        return -1;
+
+    FD_ZERO(&fds);
+    FD_SET(device_fd, &fds);
+
+    timeout.tv_sec = 2;
+    timeout.tv_usec = 0;
+
+    rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+    if (rc <= 0)
+        goto error;
+
+    rc = read(device_fd, &length, sizeof(length));
+    if (rc < (int) sizeof(length) || length == 0) {
+        ipc_client_log(client, "Reading port config length failed");
+        goto error;
+    }
+    ipc_client_log(client, "Read port config length (0x%x)", length);
+
+    buffer = calloc(1, length);
+
+    p = (unsigned char *) buffer;
+
+    chunk = 4;
+    c = 0;
+    while (c < length) {
+        count = chunk < length - c ? chunk : length - c;
+
+        rc = select(device_fd + 1, &fds, NULL, NULL, &timeout);
+        if (rc <= 0)
+            goto error;
+
+        rc = read(device_fd, p, count);
+        if (rc < (int) count) {
+            ipc_client_log(client, "Reading port config failed");
+            goto error;
+        }
+
+        p += count;
+        c += count;
+    }
+    ipc_client_log(client, "Read port config");
+
+    rc = xmm626_mipi_command_send(device_fd, XMM626_COMMAND_SET_PORT_CONFIG, buffer, length, 1, 0);
+    if (rc < 0) {
+        ipc_client_log(client, "Sending port config command failed");
+        goto error;
+    }
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    if (buffer != NULL)
+        free(buffer);
+
+    return rc;
+}
+
+int xmm626_mipi_sec_start_send(struct ipc_client *client, int device_fd,
+    const void *sec_data, size_t sec_size)
+{
+    int rc;
+
+    if (client == NULL || device_fd < 0 || sec_data == NULL || sec_size == 0)
+        return -1;
+
+    rc = xmm626_mipi_command_send(device_fd, XMM626_COMMAND_SEC_START, sec_data, sec_size, 1, 0);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_mipi_sec_end_send(struct ipc_client *client, int device_fd)
+{
+    unsigned short sec_data;
+    size_t sec_size;
+    int rc;
+
+    if (client == NULL || device_fd < 0)
+        return -1;
+
+    sec_data = XMM626_SEC_END_MAGIC;
+    sec_size = sizeof(sec_data);
+
+    rc = xmm626_mipi_command_send(device_fd, XMM626_COMMAND_SEC_END, &sec_data, sec_size, 1, 1);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_mipi_firmware_send(struct ipc_client *client, int device_fd,
+    const void *firmware_data, size_t firmware_size)
+{
+    int rc;
+
+    if (client == NULL || device_fd < 0 || firmware_data == NULL || firmware_size == 0)
+        return -1;
+
+    rc = xmm626_mipi_modem_data_send(device_fd, firmware_data, firmware_size, XMM626_FIRMWARE_ADDRESS);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_mipi_nv_data_send(struct ipc_client *client, int device_fd)
+{
+    void *nv_data = NULL;
+    size_t nv_size;
+    int rc;
+
+    if (client == NULL || device_fd < 0)
+        return -1;
+
+    nv_size = ipc_client_nv_data_size(client);
+    if (nv_size == 0)
+        return -1;
+
+    nv_data = ipc_nv_data_load(client);
+    if (nv_data == NULL) {
+        ipc_client_log(client, "Loading nv_data failed");
+        goto error;
+    }
+    ipc_client_log(client, "Loaded nv_data");
+
+    rc = xmm626_mipi_modem_data_send(device_fd, nv_data, nv_size, XMM626_NV_DATA_ADDRESS);
+    if (rc < 0)
+        goto error;
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    if (nv_data != NULL)
+        free(nv_data);
+
+    return rc;
+}
+
+int xmm626_mipi_mps_data_send(struct ipc_client *client, int device_fd,
+    const void *mps_data, size_t mps_size)
+{
+    int rc;
+
+    if (client == NULL || device_fd < 0 || mps_data == NULL || mps_size == 0)
+        return -1;
+
+    rc = xmm626_mipi_modem_data_send(device_fd, mps_data, mps_size, XMM626_MPS_DATA_ADDRESS);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_mipi_hw_reset_send(struct ipc_client *client, int device_fd)
+{
+    unsigned int hw_reset_data;
+    size_t hw_reset_size;
+    int rc;
+
+    if (client == NULL || device_fd < 0)
+        return -1;
+
+    hw_reset_data = XMM626_HW_RESET_MAGIC;
+    hw_reset_size = sizeof(hw_reset_data);
+
+    rc = xmm626_mipi_command_send(device_fd, XMM626_COMMAND_HW_RESET, &hw_reset_data, hw_reset_size, 0, 1);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+// vim:ts=4:sw=4:expandtab
diff --git a/samsung-ipc/devices/xmm626/xmm626_mipi.h b/samsung-ipc/devices/xmm626/xmm626_mipi.h
new file mode 100644
index 0000000..961744a
--- /dev/null
+++ b/samsung-ipc/devices/xmm626/xmm626_mipi.h
@@ -0,0 +1,73 @@
+/*
+ * This file is part of libsamsung-ipc.
+ *
+ * Copyright (C) 2012 Alexander Tarasikov <alexander.tarasikov@gmail.com>
+ * Copyright (C) 2013-2014 Paul Kocialkowski <contact@paulk.fr>
+ *
+ * libsamsung-ipc is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * libsamsung-ipc is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with libsamsung-ipc.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __XMM626_MIPI_H__
+#define __XMM626_MIPI_H__
+
+#define XMM626_MIPI_BOOT0_ACK                                  0xFFFF
+#define XMM626_MIPI_BOOT1_MAGIC                                0x02
+#define XMM626_MIPI_BOOT1_ACK                                  0xAA00
+#define XMM626_MIPI_PSI_ACK                                    0xDD01
+#define XMM626_MIPI_EBL_SIZE_ACK                               0xCCCC
+#define XMM626_MIPI_EBL_ACK                                    0xA551
+#define XMM626_MIPI_EBL_CHUNK                                  0xDFC
+#define XMM626_MIPI_MODEM_DATA_CHUNK                           0xDF2
+#define XMM626_MIPI_COMMAND_HEADER_MAGIC                       0x02
+#define XMM626_MIPI_COMMAND_FOOTER_MAGIC                       0x03
+#define XMM626_MIPI_COMMAND_FOOTER_UNKNOWN                     0xEAEA
+
+struct xmm626_mipi_psi_header {
+    unsigned char padding;
+    unsigned short length;
+    unsigned char magic;
+} __attribute__((packed));
+
+struct xmm626_mipi_command_header {
+    unsigned int size;
+    unsigned short magic;
+    unsigned short code;
+    unsigned short data_size;
+} __attribute__((packed));
+
+struct xmm626_mipi_command_footer {
+    unsigned short checksum;
+    unsigned short magic;
+    unsigned short unknown;
+} __attribute__((packed));
+
+int xmm626_mipi_psi_send(struct ipc_client *client, int device_fd,
+    const void *psi_data, unsigned short psi_size);
+int xmm626_mipi_ebl_send(struct ipc_client *client, int device_fd,
+    const void *ebl_data, size_t ebl_size);
+
+int xmm626_mipi_port_config_send(struct ipc_client *client, int device_fd);
+int xmm626_mipi_sec_start_send(struct ipc_client *client, int device_fd,
+    const void *sec_data, size_t sec_size);
+int xmm626_mipi_sec_end_send(struct ipc_client *client, int device_fd);
+int xmm626_mipi_firmware_send(struct ipc_client *client, int device_fd,
+    const void *firmware_data, size_t firmware_size);
+int xmm626_mipi_nv_data_send(struct ipc_client *client, int device_fd);
+int xmm626_mipi_mps_data_send(struct ipc_client *client, int device_fd,
+    const void *mps_data, size_t mps_size);
+int xmm626_mipi_hw_reset_send(struct ipc_client *client, int device_fd);
+
+#endif
+
+// vim:ts=4:sw=4:expandtab
diff --git a/samsung-ipc/devices/xmm626/xmm626_sec_modem.c b/samsung-ipc/devices/xmm626/xmm626_sec_modem.c
new file mode 100644
index 0000000..100ef5f
--- /dev/null
+++ b/samsung-ipc/devices/xmm626/xmm626_sec_modem.c
@@ -0,0 +1,502 @@
+/*
+ * This file is part of libsamsung-ipc.
+ *
+ * Copyright (C) 2012 Alexander Tarasikov <alexander.tarasikov@gmail.com>
+ * Copyright (C) 2013-2014 Paul Kocialkowski <contact@paulk.fr>
+ *
+ * libsamsung-ipc is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * libsamsung-ipc is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with libsamsung-ipc.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <stdlib.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <string.h>
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <sys/select.h>
+
+#include <samsung-ipc.h>
+#include <ipc.h>
+#include <utils.h>
+
+#include "modem.h"
+#include "modem_prj.h"
+#include "modem_link_device_hsic.h"
+
+#include "xmm626.h"
+#include "xmm626_sec_modem.h"
+
+int xmm626_sec_modem_power(int device_fd, int power)
+{
+    int rc;
+
+    if (device_fd < 0)
+        return -1;
+
+    rc = ioctl(device_fd, power ? IOCTL_MODEM_ON : IOCTL_MODEM_OFF, 0);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_sec_modem_boot_power(int device_fd, int power)
+{
+    int rc;
+
+    if (device_fd < 0)
+        return -1;
+
+    rc = ioctl(device_fd, power ? IOCTL_MODEM_BOOT_ON : IOCTL_MODEM_BOOT_OFF, 0);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_sec_modem_status_online_wait(int device_fd)
+{
+    int status;
+    int i;
+
+    if (device_fd < 0)
+        return -1;
+
+    i = 0;
+    for (i = 0; i < 100; i++) {
+        status = ioctl(device_fd, IOCTL_MODEM_STATUS, 0);
+        if (status == STATE_ONLINE)
+            return 0;
+
+        usleep(50000);
+    }
+
+    return -1;
+}
+
+int xmm626_sec_modem_hci_power(int power)
+{
+    int ehci_rc, ohci_rc;
+
+    ehci_rc = sysfs_value_write(XMM626_SEC_MODEM_EHCI_POWER_SYSFS, !!power);
+    if (ehci_rc >= 0)
+        usleep(50000);
+
+    ohci_rc = sysfs_value_write(XMM626_SEC_MODEM_OHCI_POWER_SYSFS, !!power);
+    if (ohci_rc >= 0)
+        usleep(50000);
+
+    if (ehci_rc < 0 && ohci_rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_sec_modem_link_control_enable(int device_fd, int enable)
+{
+    int rc;
+
+    if (device_fd < 0)
+        return -1;
+
+    rc = ioctl(device_fd, IOCTL_LINK_CONTROL_ENABLE, &enable);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_sec_modem_link_control_active(int device_fd, int active)
+{
+    int rc;
+
+    if (device_fd < 0)
+        return -1;
+
+    rc = ioctl(device_fd, IOCTL_LINK_CONTROL_ACTIVE, &active);
+    if (rc < 0)
+        return -1;
+
+    return 0;
+}
+
+int xmm626_sec_modem_link_connected_wait(int device_fd)
+{
+    int status;
+    int i;
+
+    if (device_fd < 0)
+        return -1;
+
+    i = 0;
+    for (i = 0; i < 100; i++) {
+        status = ioctl(device_fd, IOCTL_LINK_CONNECTED, 0);
+        if (status)
+            return 0;
+
+        usleep(50000);
+    }
+
+    return -1;
+}
+
+int xmm626_sec_modem_link_get_hostwake_wait(int device_fd)
+{
+    int status;
+    int i;
+
+    if (device_fd < 0)
+        return -1;
+
+    i = 0;
+    for (i = 0; i < 10; i++) {
+        status = ioctl(device_fd, IOCTL_LINK_GET_HOSTWAKE, 0);
+        if (status)
+            return 0;
+
+        usleep(50000);
+    }
+
+    return -1;
+}
+
+int xmm626_sec_modem_fmt_send(struct ipc_client *client,
+    struct ipc_message *message)
+{
+    struct ipc_fmt_header header;
+    void *buffer;
+    size_t length;
+    size_t count;
+    unsigned char *p;
+    int rc;
+
+    if (client == NULL || client->handlers == NULL || client->handlers->write == NULL || message == NULL)
+        return -1;
+
+    ipc_fmt_header_setup(&header, message);
+
+    length = header.length;
+    buffer = calloc(1, length);
+
+    memcpy(buffer, &header, sizeof(struct ipc_fmt_header));
+    if (message->data != NULL && message->size > 0)
+        memcpy((void *) ((unsigned char *) buffer + sizeof(struct ipc_fmt_header)), message->data, message->size);
+
+    ipc_client_log_send(client, message, __func__);
+
+    p = (unsigned char *) buffer;
+
+    count = 0;
+    while (count < length) {
+        rc = client->handlers->write(client->handlers->transport_data, p, length - count);
+        if (rc <= 0) {
+            ipc_client_log(client, "Writing FMT data failed");
+            goto error;
+        }
+
+        count += rc;
+        p += rc;
+    }
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    if (buffer != NULL)
+        free(buffer);
+
+    return rc;
+}
+
+int xmm626_sec_modem_fmt_recv(struct ipc_client *client,
+    struct ipc_message *message)
+{
+    struct ipc_fmt_header *header;
+    void *buffer = NULL;
+    size_t length;
+    size_t count;
+    unsigned char *p;
+    int rc;
+
+    if (client == NULL || client->handlers == NULL || client->handlers->read == NULL || message == NULL)
+        return -1;
+
+    length = XMM626_DATA_SIZE;
+    buffer = calloc(1, length);
+
+    rc = client->handlers->read(client->handlers->transport_data, buffer, length);
+    if (rc < (int) sizeof(struct ipc_fmt_header)) {
+        ipc_client_log(client, "Reading FMT header failed");
+        goto error;
+    }
+
+    header = (struct ipc_fmt_header *) buffer;
+
+    ipc_fmt_message_setup(header, message);
+
+    if (header->length > sizeof(struct ipc_fmt_header)) {
+        message->size = header->length - sizeof(struct ipc_fmt_header);
+        message->data = calloc(1, message->size);
+
+        p = (unsigned char *) message->data;
+
+        count = rc - sizeof(struct ipc_fmt_header);
+        if (count > 0) {
+            memcpy(p, (void *) ((unsigned char *) buffer + sizeof(struct ipc_fmt_header)), count);
+            p += count;
+        }
+
+        while (count < message->size) {
+            rc = client->handlers->read(client->handlers->transport_data, p, message->size - count);
+            if (rc <= 0) {
+                ipc_client_log(client, "Reading FMT data failed");
+                goto error;
+            }
+
+            count += rc;
+            p += rc;
+        }
+    }
+
+    ipc_client_log_recv(client, message, __func__);
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    if (buffer != NULL)
+        free(buffer);
+
+    return rc;
+}
+
+int xmm626_sec_modem_rfs_send(struct ipc_client *client,
+    struct ipc_message *message)
+{
+    struct ipc_rfs_header header;
+    void *buffer;
+    size_t length;
+    size_t count;
+    unsigned char *p;
+    int rc;
+
+    if (client == NULL || client->handlers == NULL || client->handlers->write == NULL || message == NULL)
+        return -1;
+
+    ipc_rfs_header_setup(&header, message);
+
+    length = header.length;
+    buffer = calloc(1, length);
+
+    memcpy(buffer, &header, sizeof(struct ipc_rfs_header));
+    if (message->data != NULL && message->size > 0)
+        memcpy((void *) ((unsigned char *) buffer + sizeof(struct ipc_rfs_header)), message->data, message->size);
+
+    ipc_client_log_send(client, message, __func__);
+
+    p = (unsigned char *) buffer;
+
+    count = 0;
+    while (count < length) {
+        rc = client->handlers->write(client->handlers->transport_data, p, length - count);
+        if (rc <= 0) {
+            ipc_client_log(client, "Writing RFS data failed");
+            goto error;
+        }
+
+        count += rc;
+        p += rc;
+    }
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    if (buffer != NULL)
+        free(buffer);
+
+    return rc;
+}
+
+int xmm626_sec_modem_rfs_recv(struct ipc_client *client,
+    struct ipc_message *message)
+{
+    struct ipc_rfs_header *header;
+    void *buffer = NULL;
+    size_t length;
+    size_t count;
+    unsigned char *p;
+    int rc;
+
+    if (client == NULL || client->handlers == NULL || client->handlers->read == NULL || message == NULL)
+        return -1;
+
+    length = XMM626_DATA_SIZE;
+    buffer = calloc(1, length);
+
+    rc = client->handlers->read(client->handlers->transport_data, buffer, length);
+    if (rc < (int) sizeof(struct ipc_rfs_header)) {
+        ipc_client_log(client, "Reading RFS header failed");
+        goto error;
+    }
+
+    header = (struct ipc_rfs_header *) buffer;
+
+    ipc_rfs_message_setup(header, message);
+
+    if (header->length > sizeof(struct ipc_rfs_header)) {
+        message->size = header->length - sizeof(struct ipc_rfs_header);
+        message->data = calloc(1, message->size);
+
+        p = (unsigned char *) message->data;
+
+        count = rc - sizeof(struct ipc_rfs_header);
+        if (count > 0) {
+            memcpy(p, (void *) ((unsigned char *) buffer + sizeof(struct ipc_rfs_header)), count);
+            p += count;
+        }
+
+        while (count < message->size) {
+            rc = client->handlers->read(client->handlers->transport_data, p, message->size - count);
+            if (rc <= 0) {
+                ipc_client_log(client, "Reading RFS data failed");
+                goto error;
+            }
+
+            count += rc;
+            p += rc;
+        }
+    }
+
+    ipc_client_log_recv(client, message, __func__);
+
+    rc = 0;
+    goto complete;
+
+error:
+    rc = -1;
+
+complete:
+    if (buffer != NULL)
+        free(buffer);
+
+    return rc;
+}
+
+int xmm626_sec_modem_open(int type)
+{
+    int fd;
+
+    switch (type) {
+        case IPC_CLIENT_TYPE_FMT:
+            fd = open(XMM626_SEC_MODEM_IPC0_DEVICE, O_RDWR | O_NOCTTY | O_NONBLOCK);
+            break;
+        case IPC_CLIENT_TYPE_RFS:
+            fd = open(XMM626_SEC_MODEM_RFS0_DEVICE, O_RDWR | O_NOCTTY | O_NONBLOCK);
+            break;
+        default:
+            return -1;
+    }
+
+    return fd;
+}
+
+int xmm626_sec_modem_close(int fd)
+{
+    if (fd < 0)
+        return -1;
+
+    close(fd);
+
+    return 0;
+}
+
+int xmm626_sec_modem_read(int fd, void *buffer, size_t length)
+{
+    int rc;
+
+    if (fd < 0 || buffer == NULL || length <= 0)
+        return -1;
+
+    rc = read(fd, buffer, length);
+
+    return rc;
+}
+
+int xmm626_sec_modem_write(int fd, const void *buffer, size_t length)
+{
+    int rc;
+
+    if (fd < 0 || buffer == NULL || length <= 0)
+        return -1;
+
+    rc = write(fd, buffer, length);
+
+    return rc;
+}
+
+int xmm626_sec_modem_poll(int fd, struct timeval *timeout)
+{
+    fd_set fds;
+    int rc;
+    int status;
+
+    if (fd < 0)
+        return -1;
+
+    FD_ZERO(&fds);
+    FD_SET(fd, &fds);
+
+    rc = select(fd + 1, &fds, NULL, NULL, timeout);
+    if (FD_ISSET(fd, &fds)) {
+        status = ioctl(fd, IOCTL_MODEM_STATUS, 0);
+        if (status != STATE_ONLINE && status != STATE_BOOTING)
+            return 0;
+    }
+
+    return rc;
+}
+
+char *xmm626_sec_modem_gprs_get_iface(int cid)
+{
+    char *iface = NULL;
+
+    if (cid > XMM626_SEC_MODEM_GPRS_IFACE_COUNT)
+        return NULL;
+
+    asprintf(&iface, "%s%d", XMM626_SEC_MODEM_GPRS_IFACE_PREFIX, cid - 1);
+
+    return iface;
+}
+
+int xmm626_sec_modem_gprs_get_capabilities(struct ipc_client_gprs_capabilities *capabilities)
+{
+    if (capabilities == NULL)
+        return -1;
+
+    capabilities->cid_count = XMM626_SEC_MODEM_GPRS_IFACE_COUNT;
+
+    return 0;
+}
+
+// vim:ts=4:sw=4:expandtab
diff --git a/samsung-ipc/devices/xmm626/xmm626_sec_modem.h b/samsung-ipc/devices/xmm626/xmm626_sec_modem.h
new file mode 100644
index 0000000..900ddad
--- /dev/null
+++ b/samsung-ipc/devices/xmm626/xmm626_sec_modem.h
@@ -0,0 +1,63 @@
+/*
+ * This file is part of libsamsung-ipc.
+ *
+ * Copyright (C) 2013-2014 Paul Kocialkowski <contact@paulk.fr>
+ *
+ * libsamsung-ipc is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * libsamsung-ipc is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with libsamsung-ipc.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef __XMM626_SEC_MODEM_H__
+#define __XMM626_SEC_MODEM_H__
+
+#define XMM626_SEC_MODEM_BOOT0_DEVICE          "/dev/umts_boot0"
+#define XMM626_SEC_MODEM_BOOT1_DEVICE          "/dev/umts_boot1"
+#define XMM626_SEC_MODEM_IPC0_DEVICE           "/dev/umts_ipc0"
+#define XMM626_SEC_MODEM_RFS0_DEVICE           "/dev/umts_rfs0"
+#define XMM626_SEC_MODEM_LINK_PM_DEVICE        "/dev/link_pm"
+#define XMM626_SEC_MODEM_EHCI_POWER_SYSFS      "/sys/devices/platform/s5p-ehci/ehci_power"
+#define XMM626_SEC_MODEM_OHCI_POWER_SYSFS      "/sys/devices/platform/s5p-ohci/ohci_power"
+
+#define XMM626_SEC_MODEM_GPRS_IFACE_PREFIX     "rmnet"
+#define XMM626_SEC_MODEM_GPRS_IFACE_COUNT                      3
+
+int xmm626_sec_modem_power(int device_fd, int power);
+int xmm626_sec_modem_boot_power(int device_fd, int power);
+int xmm626_sec_modem_status_online_wait(int device_fd);
+int xmm626_sec_modem_hci_power(int power);
+int xmm626_sec_modem_link_control_enable(int device_fd, int enable);
+int xmm626_sec_modem_link_control_active(int device_fd, int active);
+int xmm626_sec_modem_link_connected_wait(int device_fd);
+int xmm626_sec_modem_link_get_hostwake_wait(int device_fd);
+
+int xmm626_sec_modem_fmt_send(struct ipc_client *client,
+    struct ipc_message *message);
+int xmm626_sec_modem_fmt_recv(struct ipc_client *client,
+    struct ipc_message *message);
+int xmm626_sec_modem_rfs_send(struct ipc_client *client,
+    struct ipc_message *message);
+int xmm626_sec_modem_rfs_recv(struct ipc_client *client,
+    struct ipc_message *message);
+
+int xmm626_sec_modem_open(int type);
+int xmm626_sec_modem_close(int fd);
+int xmm626_sec_modem_read(int fd, void *buffer, size_t length);
+int xmm626_sec_modem_write(int fd, const void *buffer, size_t length);
+int xmm626_sec_modem_poll(int fd, struct timeval *timeout);
+
+char *xmm626_sec_modem_gprs_get_iface(int cid);
+int xmm626_sec_modem_gprs_get_capabilities(struct ipc_client_gprs_capabilities *capabilities);
+
+#endif
+
+// vim:ts=4:sw=4:expandtab