• Table of contents
• Qualcomm Kernel
  • diag
    • diag forwarding
    • diag char
      • DIAG_IOCTL_COMMAND_REG
      • DIAG_IOCTL_COMMAND_DEREG
      • DIAG_IOCTL_GET_DELAYED_RSP_ID
      • DIAG_IOCTL_DCI_REG
      • DIAG_IOCTL_DCI_DEINIT
      • DIAG_IOCTL_DCI_SUPPORT
      • DIAG_IOCTL_DCI_HEALTH_STATS
      • DIAG_IOCTL_DCI_LOG_STATUS
      • DIAG_IOCTL_DCI_EVENT_STATUS
      • DIAG_IOCTL_DCI_CLEAR_LOGS
      • DIAG_IOCTL_DCI_CLEAR_EVENTS
      • DIAG_IOCTL_LSM_DEINIT
      • DIAG_IOCTL_SWITCH_LOGGING
      • DIAG_IOCTL_REMOTE_DEV
      • DIAG_IOCTL_VOTE_REAL_TIME
      • DIAG_IOCTL_GET_REAL_TIME
      • DIAG_IOCTL_PERIPHERAL_BUF_CONFIG
      • DIAG_IOCTL_PERIPHERAL_BUF_DRAIN
      • DIAG_IOCTL_REGISTER_CALLBACK
      • DIAG_IOCTL_HDLC_TOGGLE
  • SMD (shared memory)
    • core driver
      • api
    • MSM IPC socket
    • packet ports
  • smem_log

Qualcomm Kernel¶

Random notes about the Qualcomm Kernel as used on the MDM9615

diag¶

diag forwarding¶

drivers/char/diag/diagfwd.[ch]
drivers/usb/gadget/f_diag.[ch]
drivers/usb/misc/diag_bridge.c

• the usb diag gadget handles diag packet read/write over usb
• issues events like USB_DIAG_READ_DONE
• picked up by diagfwd.c
  • can forward diag requests via SMD shared memory to other processors

diag char¶

The kernel exports a /dev/diag char device which userspce processes can
use to register/listen for DIAG events from the system, or actually
register a DIAG 'subsystem' themselves which can then be controlled from
QXDM.

drivers/char/diag/diagchar_core.c

• ioctl()s for diag configuration
• supports several concurrent diag clients
• diag logging can be directed to USB/HSIC, character device and more
  • {USB,CALLBACK,MEMORY_DEVICE,UART,NO_LOGGING}_MODE

drivers/char/diag/diag_dci.c

• DCI table is a routing table where pid/sockets can register for a
  given DCI. socket close/cleanup code releases all DCI routes for
  that socket.

DIAG_IOCTL_COMMAND_REG¶

• Register a new DIAG command so it can be used from the outside world (QXDM)
• use 'struct diag_cmd_reg_entry_t' per command
• driver keeps a driver->cmd_reg_list of registered commands

DIAG_IOCTL_COMMAND_DEREG¶

• unregister debug command

DIAG_IOCTL_GET_DELAYED_RSP_ID¶

DIAG_IOCTL_DCI_REG¶

DIAG_IOCTL_DCI_DEINIT¶

DIAG_IOCTL_DCI_SUPPORT¶

DIAG_IOCTL_DCI_HEALTH_STATS¶

DIAG_IOCTL_DCI_LOG_STATUS¶

DIAG_IOCTL_DCI_EVENT_STATUS¶

DIAG_IOCTL_DCI_CLEAR_LOGS¶

DIAG_IOCTL_DCI_CLEAR_EVENTS¶

DIAG_IOCTL_LSM_DEINIT¶

DIAG_IOCTL_SWITCH_LOGGING¶

• switch between USB and shared-memory diag *

DIAG_IOCTL_REMOTE_DEV¶

DIAG_IOCTL_VOTE_REAL_TIME¶

DIAG_IOCTL_GET_REAL_TIME¶

DIAG_IOCTL_PERIPHERAL_BUF_CONFIG¶

DIAG_IOCTL_PERIPHERAL_BUF_DRAIN¶

DIAG_IOCTL_REGISTER_CALLBACK¶

• doen't really do anything but checking arguments ?!?

DIAG_IOCTL_HDLC_TOGGLE¶

enable or disable HDLC framing of /dev/diag

SMD (shared memory)¶

• SMD sub-systems:
  • Modem (assumed to be hexagon with modem firmware?)
  • Q6 (formerly known as LPASS == Low Power Audio SubSystem)
  • DSPS
  • WCNSS (Wireless Connectivity Sub System) aka 'riva'
  • RPM (Resource Power Manager)
• inter-processor-interrupts for various 'edges'

core driver¶

• arch/arm/mach-msm/smd.c

api¶

• smd_open()
• smd_close()
• smd_write*()
• smd_read*()
• smsm_*()

MSM IPC socket¶

• arch/arm/mach-msm/ipc_socket.c
• AF_MSM_IPC

packet ports¶

• Some kind of packet oriented interface towards the SMD
• msm_smd_pkt.c contains driver
  • smdpkt0..7+smd22 devices, 2048 byte buffer
  • open/release/read/write/poll syscalls implemented

smem_log¶

This is some kidn of high speed shared memory based event log to which all processors can log events.

Userspace applications can use write() to /dev/smem_log to add log entries.

Qualcomm uses a proprietary minimal shim layer offering SMEM_LOG_EVENT and SMEM_LOG_EVENT6 macros
that can be used to write events with an event ID plus three data words or six data words, respectively.

The shared memory log can be read from linux userspace via debugfs, see the devices in /sys/kernel/debug/smem_log
and simply use cat on them. You will get lines like

MODM: 3982377401 000d0000: 00000001: 03000019 01000028 01000015 53505041 00000061 5f696d71
MODM: 3982378159      QCSI: 00000004: 00040029 00240015 00000003 00000001 0000002b 00000000
MODM: 3982378619 000d0000: 00000001: 03000019 0100002b 01000015 53505041 00000061 5f696d71
APPS: 3982397356      QCCI: 00000005: 0004001d 0024000e 00000003 00000003 00000019 00000000
APPS: 3982400571      QCCI: 00000005: 00040029 0024000e 00000003 00000003 00000019 00000000
MODM: 1841235211      QCSI: 00000004: 0004001e 0024001c 00000003 00000001 00000028 00000000
MODM: 1841236665 000d0000: 00000001: 03000019 01000028 0101001c 53505041 00000061 5f696d71
MODM: 1841241411      QCSI: 00000004: 0004002a 0024001c 00000003 00000001 0000002b 00000000
MODM: 1841242246 000d0000: 00000001: 03000019 0100002b 0100001c 53505041 00000061 5f696d71
MODM: 1841243796      QCSI: 00000004: 0004002b 00660019 00000003 00000001 0000002b 00000000
MODM: 1841244286 000d0000: 00000001: 03000019 0100002b 01000019 53505041 00000061 5f696d71
APPS: 1841255456      QCCI: 00000005: 0004001e 00240015 00000003 00000003 00000019 00000000
MODM: 1841255335 000d0000: 00000002: 0100ffff 0300ffff 07000014 53505041 0000016c 74646d73
MODM: 1841255828 000d0000: 00000702: 00000001 00000028 00000007
APPS: 1841261430      QCCI: 00000005: 0004002a 00240015 00000003 00000003 00000019 00000000