Qualcomm Kernel » History » Version 13
laforge, 12/25/2016 10:08 PM
1 | 6 | laforge | {{>toc}} |
---|---|---|---|
2 | |||
3 | 1 | laforge | h1. Qualcomm Kernel |
4 | |||
5 | 13 | laforge | Random notes about the Qualcomm Kernel as used on the MDM9615 and MDM9x07. May also apply to other Qualcomm Linux based systems such as Android smartphones. |
6 | 1 | laforge | |
7 | h2. diag |
||
8 | |||
9 | h3. diag forwarding |
||
10 | |||
11 | <pre> |
||
12 | drivers/char/diag/diagfwd.[ch] |
||
13 | drivers/usb/gadget/f_diag.[ch] |
||
14 | drivers/usb/misc/diag_bridge.c |
||
15 | </pre> |
||
16 | |||
17 | * the usb diag gadget handles diag packet read/write over usb |
||
18 | * issues events like USB_DIAG_READ_DONE |
||
19 | * picked up by diagfwd.c |
||
20 | ** can forward diag requests via SMD shared memory to other processors |
||
21 | |||
22 | h3. diag char |
||
23 | |||
24 | 6 | laforge | The kernel exports a /dev/diag char device which userspce processes can |
25 | use to register/listen for DIAG events from the system, or actually |
||
26 | register a DIAG 'subsystem' themselves which can then be controlled from |
||
27 | QXDM. |
||
28 | |||
29 | 1 | laforge | <pre> |
30 | drivers/char/diag/diagchar_core.c |
||
31 | </pre> |
||
32 | |||
33 | * ioctl()s for diag configuration |
||
34 | * supports several concurrent diag clients |
||
35 | * diag logging can be directed to USB/HSIC, character device and more |
||
36 | ** {USB,CALLBACK,MEMORY_DEVICE,UART,NO_LOGGING}_MODE |
||
37 | |||
38 | 5 | laforge | drivers/char/diag/diag_dci.c |
39 | 1 | laforge | |
40 | * DCI table is a routing table where pid/sockets can register for a |
||
41 | given DCI. socket close/cleanup code releases all DCI routes for |
||
42 | that socket. |
||
43 | |||
44 | 7 | laforge | h4. DIAG_IOCTL_COMMAND_REG |
45 | |||
46 | * Register a new DIAG command so it can be used from the outside world (QXDM) |
||
47 | * use 'struct diag_cmd_reg_entry_t' per command |
||
48 | * driver keeps a driver->cmd_reg_list of registered commands |
||
49 | |||
50 | h4. DIAG_IOCTL_COMMAND_DEREG |
||
51 | |||
52 | * unregister debug command |
||
53 | |||
54 | h4. DIAG_IOCTL_GET_DELAYED_RSP_ID |
||
55 | |||
56 | h4. DIAG_IOCTL_DCI_REG |
||
57 | |||
58 | h4. DIAG_IOCTL_DCI_DEINIT |
||
59 | |||
60 | h4. DIAG_IOCTL_DCI_SUPPORT |
||
61 | |||
62 | h4. DIAG_IOCTL_DCI_HEALTH_STATS |
||
63 | |||
64 | h4. DIAG_IOCTL_DCI_LOG_STATUS |
||
65 | |||
66 | h4. DIAG_IOCTL_DCI_EVENT_STATUS |
||
67 | |||
68 | h4. DIAG_IOCTL_DCI_CLEAR_LOGS |
||
69 | |||
70 | h4. DIAG_IOCTL_DCI_CLEAR_EVENTS |
||
71 | |||
72 | h4. DIAG_IOCTL_LSM_DEINIT |
||
73 | |||
74 | h4. DIAG_IOCTL_SWITCH_LOGGING |
||
75 | |||
76 | * switch between USB and shared-memory diag |
||
77 | * |
||
78 | |||
79 | h4. DIAG_IOCTL_REMOTE_DEV |
||
80 | |||
81 | h4. DIAG_IOCTL_VOTE_REAL_TIME |
||
82 | |||
83 | h4. DIAG_IOCTL_GET_REAL_TIME |
||
84 | |||
85 | h4. DIAG_IOCTL_PERIPHERAL_BUF_CONFIG |
||
86 | |||
87 | h4. DIAG_IOCTL_PERIPHERAL_BUF_DRAIN |
||
88 | |||
89 | h4. DIAG_IOCTL_REGISTER_CALLBACK |
||
90 | |||
91 | * doen't really do anything but checking arguments ?!? |
||
92 | |||
93 | h4. DIAG_IOCTL_HDLC_TOGGLE |
||
94 | |||
95 | enable or disable HDLC framing of /dev/diag |
||
96 | 6 | laforge | |
97 | 12 | laforge | |
98 | h2. IRSC (IPC Router Security Control) |
||
99 | |||
100 | FIXME |
||
101 | |||
102 | h2. Shared Memory based Logging |
||
103 | |||
104 | 1 | laforge | h2. SMD (shared memory) |
105 | |||
106 | * SMD sub-systems: |
||
107 | ** Modem (assumed to be hexagon with modem firmware?) |
||
108 | ** Q6 (formerly known as LPASS == Low Power Audio SubSystem) |
||
109 | ** DSPS |
||
110 | ** WCNSS (Wireless Connectivity Sub System) aka 'riva' |
||
111 | ** RPM (Resource Power Manager) |
||
112 | * inter-processor-interrupts for various 'edges' |
||
113 | |||
114 | h3. core driver |
||
115 | |||
116 | * arch/arm/mach-msm/smd.c |
||
117 | |||
118 | h4. api |
||
119 | |||
120 | * smd_open() |
||
121 | * smd_close() |
||
122 | * smd_write*() |
||
123 | * smd_read*() |
||
124 | 3 | laforge | * smsm_*() |
125 | 1 | laforge | |
126 | 12 | laforge | h3. MSM IPC (Inter Process Communications) socket |
127 | 1 | laforge | |
128 | 12 | laforge | Qualcomm implements a socket-based inter process communication on Linux. It is implemented using a new address family, @AF_MSM_IPC@ (27). |
129 | |||
130 | The socket is used as datagram type socket (SOCK_DGRAM). |
||
131 | |||
132 | The socket address of a related socket consists of: |
||
133 | |||
134 | * the socket family (AF_MSM_IPC) |
||
135 | * a @struct msm_ipc_addr@, consisting of |
||
136 | ** a single address type byte |
||
137 | ** a port address (node_id, port_id) |
||
138 | ** a port name (service, instance) |
||
139 | |||
140 | 1 | laforge | * arch/arm/mach-msm/ipc_socket.c |
141 | * AF_MSM_IPC |
||
142 | 3 | laforge | |
143 | h3. packet ports |
||
144 | 1 | laforge | |
145 | * Some kind of packet oriented interface towards the SMD |
||
146 | * msm_smd_pkt.c contains driver |
||
147 | ** smdpkt0..7+smd22 devices, 2048 byte buffer |
||
148 | ** open/release/read/write/poll syscalls implemented |
||
149 | 10 | laforge | |
150 | h3. available SMD devices |
||
151 | |||
152 | From an EC25: |
||
153 | <pre> |
||
154 | Primary allocation table: |
||
155 | root@mdm9607-perf:~# cat /sys/kernel/debug/smd/ch |
||
156 | ID|CHANNEL NAME |T|PROC |STATE |FIFO SZ|RDPTR |WRPTR |FLAGS |DATAPEN |
||
157 | ------------------------------------------------------------------------------- |
||
158 | 4|rpm_requests |P|APPS |OPENED |0x00400|0x001E0|0x001E0|DCCiwRsB|0x00000 |
||
159 | | | |RPM |OPENED |0x00400|0x00118|0x00118|DCCiwrsB|0x00000 |
||
160 | ------------------------------------------------------------------------------- |
||
161 | 5|rpm_requests |P|MDMSW| Access Restricted |
||
162 | | | |RPM | Access Restricted |
||
163 | ------------------------------------------------------------------------------- |
||
164 | 6|rpm_requests |P|WCNSS| Access Restricted |
||
165 | | | |RPM | Access Restricted |
||
166 | ------------------------------------------------------------------------------- |
||
167 | 7|rpm_requests |P|TZ | Access Restricted |
||
168 | | | |RPM | Access Restricted |
||
169 | ------------------------------------------------------------------------------- |
||
170 | 8|rpm_requests |P|ADSP | Access Restricted |
||
171 | | | |RPM | Access Restricted |
||
172 | ------------------------------------------------------------------------------- |
||
173 | |||
174 | |||
175 | APPS <-> MDMSW Primary allocation table: |
||
176 | ID|CHANNEL NAME |T|PROC |STATE |FIFO SZ|RDPTR |WRPTR |FLAGS |DATAPEN |
||
177 | ------------------------------------------------------------------------------- |
||
178 | 0|DS |S|APPS |OPENED |0x02000|0x00000|0x00000|dcCiwrsb|0x00000 |
||
179 | | | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000 |
||
180 | ------------------------------------------------------------------------------- |
||
181 | 1|IPCRTR |P|APPS |OPENED |0x02000|0x012E4|0x012E4|DCCiwrsB|0x00000 |
||
182 | | | |MDMSW|OPENED |0x02000|0x011F8|0x011F8|DCCiwrsB|0x00000 |
||
183 | ------------------------------------------------------------------------------- |
||
184 | 2|SSM_RTR_MODEM_APPS |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000 |
||
185 | | | |MDMSW|OPENING|0x02000|0x00000|0x00000|DCCiwrSb|0x00000 |
||
186 | ------------------------------------------------------------------------------- |
||
187 | 3|DIAG_2_CMD |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000 |
||
188 | | | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000 |
||
189 | ------------------------------------------------------------------------------- |
||
190 | 4|DIAG_2 |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000 |
||
191 | | | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000 |
||
192 | ------------------------------------------------------------------------------- |
||
193 | 5|DIAG_CNTL |P|APPS |OPENED |0x02000|0x00062|0x00062|DCCiwrsb|0x00000 |
||
194 | | | |MDMSW|OPENED |0x02000|0x007F5|0x007F5|DCCiwrsB|0x00000 |
||
195 | ------------------------------------------------------------------------------- |
||
196 | 6|DIAG_CMD |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000 |
||
197 | | | |MDMSW|OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000 |
||
198 | ------------------------------------------------------------------------------- |
||
199 | 7|DIAG |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsb|0x00000 |
||
200 | | | |MDMSW|OPENED |0x02000|0x00026|0x00026|DCCiwrsB|0x00000 |
||
201 | ------------------------------------------------------------------------------- |
||
202 | 8|apr_audio_svc |P|APPS |OPENED |0x02000|0x002F0|0x002F0|DCCiwrsB|0x00000 |
||
203 | | | |MDMSW|OPENED |0x02000|0x00248|0x00248|DCCiwrsB|0x00000 |
||
204 | ------------------------------------------------------------------------------- |
||
205 | 9|apr_apps2 |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000 |
||
206 | | | |MDMSW|OPENING|0x02000|0x00000|0x00000|DCCiwrSb|0x00000 |
||
207 | ------------------------------------------------------------------------------- |
||
208 | 10|DATA1 |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000 |
||
209 | | | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000 |
||
210 | ------------------------------------------------------------------------------- |
||
211 | 11|DATA2 |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000 |
||
212 | | | |MDMSW|OPENING|0x02000|0x00000|0x00000|dCciwrSb|0x00000 |
||
213 | ------------------------------------------------------------------------------- |
||
214 | 12|DATA3 |P|APPS |OPENED |0x02000|0x00000|0x00000|dcCiwrsb|0x00000 |
||
215 | | | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000 |
||
216 | ------------------------------------------------------------------------------- |
||
217 | 13|DATA4 |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000 |
||
218 | | | |MDMSW|OPENED |0x02000|0x00000|0x00000|dCciwrsb|0x00000 |
||
219 | ------------------------------------------------------------------------------- |
||
220 | 14|DATA11 |S|APPS |OPENED |0x02000|0x00089|0x00089|dcCiwRsb|0x00000 |
||
221 | | | |MDMSW|OPENED |0x02000|0x0012B|0x0012B|dCciwrsB|0x00000 |
||
222 | ------------------------------------------------------------------------------- |
||
223 | 15|DATA40 |P|APPS |CLOSED |0x02000|0x00000|0x00000|dcciwrsb|0x00000 |
||
224 | | | |MDMSW|OPENING|0x02000|0x00000|0x00000|dcciwrSb|0x00000 |
||
225 | ------------------------------------------------------------------------------- |
||
226 | 16|DATA5_CNTL |P|APPS |CLOSED |0x00400|0x00000|0x00000|dcciwrsb|0x00000 |
||
227 | | | |MDMSW|OPENING|0x00400|0x00000|0x00000|DCCiwrSb|0x00000 |
||
228 | ------------------------------------------------------------------------------- |
||
229 | 17|DATA40_CNTL |P|APPS |OPENED |0x02000|0x00000|0x00000|DCCiwrsB|0x00000 |
||
230 | | | |MDMSW|OPENED |0x02000|0x00100|0x00100|DCCiwrsB|0x00000 |
||
231 | ------------------------------------------------------------------------------- |
||
232 | </pre> |
||
233 | 6 | laforge | |
234 | h2. smem_log |
||
235 | |||
236 | This is some kidn of high speed shared memory based event log to which all processors can log events. |
||
237 | |||
238 | Userspace applications can use write() to @/dev/smem_log@ to add log entries. |
||
239 | |||
240 | Qualcomm uses a proprietary minimal shim layer offering SMEM_LOG_EVENT and SMEM_LOG_EVENT6 macros |
||
241 | that can be used to write events with an event ID plus three data words or six data words, respectively. |
||
242 | |||
243 | The shared memory log can be read from linux userspace via debugfs, see the devices in @/sys/kernel/debug/smem_log@ |
||
244 | and simply use @cat@ on them. You will get lines like |
||
245 | <pre> |
||
246 | MODM: 3982377401 000d0000: 00000001: 03000019 01000028 01000015 53505041 00000061 5f696d71 |
||
247 | MODM: 3982378159 QCSI: 00000004: 00040029 00240015 00000003 00000001 0000002b 00000000 |
||
248 | MODM: 3982378619 000d0000: 00000001: 03000019 0100002b 01000015 53505041 00000061 5f696d71 |
||
249 | APPS: 3982397356 QCCI: 00000005: 0004001d 0024000e 00000003 00000003 00000019 00000000 |
||
250 | APPS: 3982400571 QCCI: 00000005: 00040029 0024000e 00000003 00000003 00000019 00000000 |
||
251 | MODM: 1841235211 QCSI: 00000004: 0004001e 0024001c 00000003 00000001 00000028 00000000 |
||
252 | MODM: 1841236665 000d0000: 00000001: 03000019 01000028 0101001c 53505041 00000061 5f696d71 |
||
253 | MODM: 1841241411 QCSI: 00000004: 0004002a 0024001c 00000003 00000001 0000002b 00000000 |
||
254 | MODM: 1841242246 000d0000: 00000001: 03000019 0100002b 0100001c 53505041 00000061 5f696d71 |
||
255 | MODM: 1841243796 QCSI: 00000004: 0004002b 00660019 00000003 00000001 0000002b 00000000 |
||
256 | MODM: 1841244286 000d0000: 00000001: 03000019 0100002b 01000019 53505041 00000061 5f696d71 |
||
257 | APPS: 1841255456 QCCI: 00000005: 0004001e 00240015 00000003 00000003 00000019 00000000 |
||
258 | MODM: 1841255335 000d0000: 00000002: 0100ffff 0300ffff 07000014 53505041 0000016c 74646d73 |
||
259 | MODM: 1841255828 000d0000: 00000702: 00000001 00000028 00000007 |
||
260 | 1 | laforge | APPS: 1841261430 QCCI: 00000005: 0004002a 00240015 00000003 00000003 00000019 00000000 |
261 | </pre> |
||
262 | 12 | laforge | |
263 | More information in @smem_log.h@ |
||
264 | 8 | laforge | |
265 | h2. rmnet |
||
266 | |||
267 | "remote network" ? |
||
268 | * consists of control channel and data channel |
||
269 | * data channel carries IP data |
||
270 | * control channel carries QMI messages |
||
271 | |||
272 | * drivers/net/ethernet/msm/msm_rmnet_bam.c |
||
273 | ** ioctl() to set ethernet or rawip (RMNET_IOCTL_SET_LLP_ETHERNET, RMNET_IOCTL_SET_LLP_IP, RMNET_IOCTL_GET_LLP), initial boot time config is ETHERNET |
||
274 | ** use msm_bam_dmux_open() to attach |
||
275 | ** use RMNET_IOCTL_GET_EPID to get the BAM_DMUX endpoint id |
||
276 | |||
277 | h2. bam (Bus Access Manager/Module) |
||
278 | |||
279 | * The Bus Access Manager/Module (BAM) can be |
||
280 | considered as a distributed data mover (DM) |
||
281 | * some kind of DMA controller/engine |
||
282 | * A number of the on-chip devices have their own BAM DMA controller |
||
283 | and use it to move data between system memory and peripherals or |
||
284 | between two peripherals. |
||
285 | |||
286 | Files: |
||
287 | <pre> |
||
288 | ./drivers/dma/qcom_bam_dma.c |
||
289 | ./drivers/net/ethernet/msm/msm_rmnet_bam.c |
||
290 | ./drivers/platform/msm/sps/bam.c |
||
291 | ./drivers/platform/msm/sps/sps_bam.c |
||
292 | ./drivers/platform/msm/usb_bam.c |
||
293 | </pre> |
||
294 | |||
295 | * channels (BAM_DMUX_) |
||
296 | ** RMNET_0...7 |
||
297 | ** USB_RMNET_0 |
||
298 | ** DATA_REV_RMNET_0..8 |
||
299 | ** USB_DPL |
||
300 | |||
301 | seem to be be based on dmux ./drivers/soc/qcom/bam_dmux.c |
||
302 | |||
303 | h2. IPA (Internet Packet Accelerator) |
||
304 | |||
305 | Internet Packet Accelerator (IPA) is a programmable protocol |
||
306 | processor HW block. It is designed to support generic HW processing |
||
307 | of UL/DL IP packets for various use cases independent of radio |
||
308 | technology. |
||
309 | |||
310 | See drivers/platform/msm/ipa/ |
||
311 | |||
312 | 11 | laforge | http://www.sumobrain.com/patents/wipo/Accelerator/WO2013063791A1.pdf |
313 | |||
314 | |||
315 | 8 | laforge | h2. bam2bam |
316 | |||
317 | maybe soem kind of direct connection between two peripherals by means of the BAM? |
||
318 | |||
319 | h2. Android USB Gadget |
||
320 | |||
321 | see [[Android_USB_Gadget]] |
||
322 | 9 | laforge | |
323 | h2. IPC Logging |
||
324 | |||
325 | see [[IPC_Logging]] |