Project

General

Profile

Qualcomm Linux SMD (Shared Memory Device)

Individual processors / sub-systems in a multi-CPU SOC provide SMD channels. This is basically a pipe abstraction over a shared memory protocol. Each channel exists between two given CPU cores, so called SMD sub-systems.

  • SMD sub-systems we know of:
    • APPS (applications processor, this is the Linux system)
    • Modem (assumed to be hexagon with modem firmware?)
    • Q6 (formerly known as LPASS == Low Power Audio SubSystem)
    • DSPS
    • WCNSS (Wireless Connectivity Sub System) aka 'riva'
    • RPM (Resource Power Manager)
  • inter-processor-interrupts for various 'edges'

In the MDM9615/9x07 based devices it seems there is only the RPM, MODEM and APPS.

core driver

  • arch/arm/mach-msm/smd.c

api

  • smd_open() / smd_named_open_on_edge()
  • smd_close()
  • smd_write*()
  • smd_read*()
  • smsm_*()

SMD based drivers

smd_tty

Seems to expose tty devices (/dev/smdN) bound to SMD channels.

smd_nmea

Exposes a tty device (/dev/nmea) bound to a SMD channel named "GPSNMEA".

diagfwd

DIAG forwarding, see DIAG

u_smd usb gadget

Used to forward data of certain USB endpoints (of USB serial devices) towards other processors (mainly MDSP).

The SMD channels used differ from device to device. In the EC20 case, it looks like DATA2, DS and DATA3 channels are exposed via USB.

The classic usb serial devices for AT command ports are implemented this way. Their data is passed from USB endpoints to SMD channels and vice-versa.

In difference to the BAM2BAM ports used for user (IP) data, the u_smd serial data still is received by the Linux serial gadget driver and then passed on towards the SMD devices, i.e. the buffers go throug the linux kernel (and can be interpreted/modified).

packet ports

  • Some kind of packet oriented interface towards the SMD
  • msm_smd_pkt.c contains driver
    • smdpkt0..7+smd22 devices, 2048 byte buffer
    • open/release/read/write/poll syscalls implemented
SMD Channel Device
DATA5_CNTL smdcntl0
DATA6_CNTL smdcntl1
DATA7_CNTL smdcntl2
DATA8_CNTL smdcntl3
DATA9_CNTL smdcntl4
DATA12_CNTL smdcntl5
DATA13_CNTL smdcntl6
DATA14_CNTL smdcntl7
DATA22 smd22

hci_smd

Apparently used to talk HCI to a bluetooth chip on a different processor. Not used in the modem devices we've seen.

smd_qmi

Binds to the following channels and exposes the related devices:

SMD Channels QMI Device
SMD_DATA5_CNTL /dev/qmi0
SMD_DATA6_CNTL /dev/qmi1
SMD_DATA7_CNTL /dev/qmi2

It seems this is an older generation of accessing QMI from the Linux application processor, which has now been replaced by qmuxd which opens /dev/smdcntl devices and thus bypasses any QMI message parsing/interpretation inside the kernel?

msm_rmnet

Implements a Linux kernel network device based on a SMD Cannels.

The default SMD channels used by the msm_rmnet driver are listed below. There is no static mapping to a rmnetN device, as the numbers of the network devices are dynamically allocated.

SMD Channel
DATA5
DATA6
DATA7
DATA8
DATA9
DATA12
DATA13
DATA14

Comparing this with the table from /sys/kernel/debug/smd/tbl on the EC20 seems to suggest that DATA8 is the only SMD channel used for msm_rmnet and thus the rmnet0 device.

MSM IPC (Inter Process Communications) socket

Qualcomm implements a socket-based inter process communication on Linux. It is implemented using a new address family, AF_MSM_IPC (27).

The socket is used as datagram type socket (SOCK_DGRAM).

The socket address of a related socket consists of:

  • the socket family (AF_MSM_IPC)
  • a struct msm_ipc_addr, consisting of
    • a single address type byte
    • a port address (node_id, port_id)
    • a port name (service, instance)
  • arch/arm/mach-msm/ipc_socket.c
  • AF_MSM_IPC

available SMD channels

SMD channels on an EC25

Primary allocation table:
root@mdm9607-perf:~# cat /sys/kernel/debug/smd/ch
ID|CHANNEL NAME       |T|PROC |STATE  |FIFO SZ|RDPTR  |WRPTR  |FLAGS   |DATAPEN
-------------------------------------------------------------------------------
 4|rpm_requests       |P|APPS |OPENED |0x00400|0x001E0|0x001E0|DCCiwRsB|0x00000
  |                   | |RPM  |OPENED |0x00400|0x00118|0x00118|DCCiwrsB|0x00000
-------------------------------------------------------------------------------
 5|rpm_requests       |P|MDMSW| Access Restricted
  |                   | |RPM  | Access Restricted
-------------------------------------------------------------------------------
 6|rpm_requests       |P|WCNSS| Access Restricted
  |                   | |RPM  | Access Restricted
-------------------------------------------------------------------------------
 7|rpm_requests       |P|TZ   | Access Restricted
  |                   | |RPM  | Access Restricted
-------------------------------------------------------------------------------
 8|rpm_requests       |P|ADSP | Access Restricted
  |                   | |RPM  | Access Restricted
-------------------------------------------------------------------------------

APPS <-> MDMSW Primary allocation table:
ID|CHANNEL NAME       |T|PROC |STATE  |FIFO SZ|RDPTR  |WRPTR  |FLAGS   |DATAPEN
-------------------------------------------------------------------------------
 0|DS                 |S|APPS |OPENED |0x02000|0x00000|0x00000|dcCiwrsb|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000
-------------------------------------------------------------------------------
 1|IPCRTR             |P|APPS |OPENED |0x02000|0x012E4|0x012E4|DCCiwrsB|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x011F8|0x011F8|DCCiwrsB|0x00000
-------------------------------------------------------------------------------
 2|SSM_RTR_MODEM_APPS |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000
  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|DCCiwrSb|0x00000
-------------------------------------------------------------------------------
 3|DIAG_2_CMD         |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000
-------------------------------------------------------------------------------
 4|DIAG_2             |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000
-------------------------------------------------------------------------------
 5|DIAG_CNTL          |P|APPS |OPENED |0x02000|0x00062|0x00062|DCCiwrsb|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x007F5|0x007F5|DCCiwrsB|0x00000
-------------------------------------------------------------------------------
 6|DIAG_CMD           |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000
-------------------------------------------------------------------------------
 7|DIAG               |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x00026|0x00026|DCCiwrsB|0x00000
-------------------------------------------------------------------------------
 8|apr_audio_svc      |P|APPS |OPENED |0x02000|0x002F0|0x002F0|DCCiwrsB|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x00248|0x00248|DCCiwrsB|0x00000
-------------------------------------------------------------------------------
 9|apr_apps2          |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000
  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|DCCiwrSb|0x00000
-------------------------------------------------------------------------------
10|DATA1              |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000
-------------------------------------------------------------------------------
11|DATA2              |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000
  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|dCciwrSb|0x00000
-------------------------------------------------------------------------------
12|DATA3              |P|APPS |OPENED |0x02000|0x00000|0x00000|dcCiwrsb|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000
-------------------------------------------------------------------------------
13|DATA4              |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000
-------------------------------------------------------------------------------
14|DATA11             |S|APPS |OPENED |0x02000|0x00089|0x00089|dcCiwRsb|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x0012B|0x0012B|dCciwrsB|0x00000
-------------------------------------------------------------------------------
15|DATA40             |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000
  |                   | |MDMSW|OPENING|0x02000|0x00000|0x00000|dcciwrSb|0x00000
-------------------------------------------------------------------------------
16|DATA5_CNTL         |P|APPS |CLOSED |0x00400|0x00000|0x00000|dcciwrsb|0x00000
  |                   | |MDMSW|OPENING|0x00400|0x00000|0x00000|DCCiwrSb|0x00000
-------------------------------------------------------------------------------
17|DATA40_CNTL        |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000
  |                   | |MDMSW|OPENED |0x02000|0x00100|0x00100|DCCiwrsB|0x00000
-------------------------------------------------------------------------------

SMD channels on an EC20:

/sys/kernel/debug/smd # cat ch 
ch00:   OPENED(0000/0000) dcCiwrsb <->   OPENED(0000/0000) dCciwrsB :  2000
ch04:   OPENED(27336/27336) DCCiwrsB <->   OPENED(6552/6552) DCCiwrsB :  8000
ch05:   OPENED(0000/0000) DCCiwrsb <->   OPENED(12568/12568) DCCiwrsB : 10000
ch06:   OPENED(1872/1872) DCCiwrsB <->   OPENED(0216/0216) DCCiwrsB :  2000
ch07:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000
ch08:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :   400
ch09:   OPENED(0952/0952) DCCiwrsb <->   OPENED(0438/0438) DCCiwrsB :   400
ch10:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsb :  2000
ch11:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000
ch12:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsb :  2000
ch13:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000
ch14:   OPENED(0480/0480) DCCiwrsB <->   OPENED(0376/0376) DCCiwrsB :   400
ch15:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000
ch16:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000
ch17:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :   400
ch18:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsb :  2000
ch19:   OPENED(0952/0952) DCCiwrsb <->   OPENED(0370/0370) DCCiwrsB :   400
ch20:   OPENED(0021/0021) DCCiwrsb <->   OPENED(0078/0078) DCCiwrsB :  2000
ch21:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) DCCiwrSb :  2000
ch22:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dCciwrSb :  2000
ch23:   OPENED(0000/0000) dcCiwrsb <->   OPENED(0000/0000) dCciwrsB :  2000
ch24:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) dCciwrsb :  2000
ch25:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dCciwrSb :  2000
ch26:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dCciwrSb :  2000
ch27:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dcciwrSb :  2000
ch28:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) DCCiwrsB :  2000
ch29:   CLOSED(0000/0000) dcciwrsb <->  OPENING(0000/0000) dcciwrSb :  2000
ch30:   OPENED(0295/0295) DCCiwrsB <->   OPENED(0563/0563) DCCiwrsB :   400
ch31:   OPENED(0237/0237) DCCiwrsB <->   OPENED(0415/0415) DCCiwrsB :   400
ch32:   OPENED(0237/0237) DCCiwrsB <->   OPENED(0415/0415) DCCiwrsB :   400
ch33:   OPENED(0237/0237) DCCiwrsB <->   OPENED(0415/0415) DCCiwrsB :   400
ch34:   OPENED(0000/0000) DCCiwrsb <->   OPENED(0000/0000) dCciwrsb :  2000
/sys/kernel/debug/smd # cat tbl
name=DS cid=0 ch type=0 xfer type=1 ref_count=2
name= cid=0 ch type=0 xfer type=0 ref_count=0
name= cid=0 ch type=0 xfer type=0 ref_count=0
name= cid=0 ch type=0 xfer type=0 ref_count=0
name=MSGR_SMD_P1 cid=4 ch type=11 xfer type=2 ref_count=2
name=MSGR_SMD_P0 cid=5 ch type=11 xfer type=2 ref_count=2
name=IPCRTR cid=6 ch type=1 xfer type=2 ref_count=1
name=IPCRTR cid=7 ch type=2 xfer type=2 ref_count=1
name=sys_mon cid=8 ch type=1 xfer type=2 ref_count=1
name=DIAG_CNTL cid=9 ch type=1 xfer type=2 ref_count=2
name=DIAG cid=10 ch type=1 xfer type=2 ref_count=2
name=apr_audio_svc cid=11 ch type=1 xfer type=2 ref_count=1
name=apr_voice_svc cid=12 ch type=2 xfer type=2 ref_count=2
name=apr_apps2 cid=13 ch type=1 xfer type=2 ref_count=1
name=RPCRPY_CNTL cid=14 ch type=0 xfer type=2 ref_count=2
name=IPCROUTER cid=15 ch type=0 xfer type=0 ref_count=1
name=SSM_RTR cid=16 ch type=0 xfer type=2 ref_count=1
name=sys_mon cid=17 ch type=0 xfer type=2 ref_count=1
name=DIAG_2 cid=18 ch type=0 xfer type=2 ref_count=2
name=DIAG_CNTL cid=19 ch type=0 xfer type=2 ref_count=2
name=DIAG cid=20 ch type=0 xfer type=2 ref_count=2
name=apr_voice_svc cid=21 ch type=0 xfer type=2 ref_count=1
name=DATA1 cid=22 ch type=0 xfer type=2 ref_count=2
name=DATA2 cid=23 ch type=0 xfer type=2 ref_count=2
name=DATA3 cid=24 ch type=0 xfer type=2 ref_count=2
name=DATA4 cid=25 ch type=0 xfer type=2 ref_count=2
name=DATA11 cid=26 ch type=0 xfer type=1 ref_count=2
name=DATA40 cid=27 ch type=0 xfer type=2 ref_count=2
name=DATA40_CNTL cid=28 ch type=0 xfer type=2 ref_count=2
name=DATA8 cid=29 ch type=0 xfer type=2 ref_count=2
name=DATA5_CNTL cid=30 ch type=0 xfer type=2 ref_count=2
name=DATA6_CNTL cid=31 ch type=0 xfer type=2 ref_count=2
name=DATA7_CNTL cid=32 ch type=0 xfer type=2 ref_count=2
name=DATA8_CNTL cid=33 ch type=0 xfer type=2 ref_count=2
name=GPSNMEA cid=34 ch type=0 xfer type=2 ref_count=2
Add picture from clipboard (Maximum size: 48.8 MB)