Qualcomm Kernel » History » Version 20
laforge, 12/26/2016 10:24 PM
1 | 6 | laforge | {{>toc}} |
---|---|---|---|
2 | |||
3 | 1 | laforge | h1. Qualcomm Kernel |
4 | |||
5 | 13 | laforge | Random notes about the Qualcomm Kernel as used on the MDM9615 and MDM9x07. May also apply to other Qualcomm Linux based systems such as Android smartphones. |
6 | 1 | laforge | |
7 | 18 | laforge | h2. remote_spinlock |
8 | |||
9 | You probably know the regular spinlocks inside the linux kernel: They protect you from multiple processors entering the same critical section of code in the kernel. All but one processor core will be busy-waiting while the spinlock is held. |
||
10 | |||
11 | In the Qualcomm multi-CPU SoCs they have implemented a remote spinlock mechanism, in which e.g. the APPS processor can prevent the MODEM processor from entering a critical section (or rather, access critical shared data between the processors). |
||
12 | |||
13 | 1 | laforge | h2. SMD (shared memory) |
14 | |||
15 | See [[Qualcomm_Linux_SMD]] |
||
16 | |||
17 | h2. smem_log |
||
18 | |||
19 | This is some kidn of high speed shared memory based event log to which all processors can log events. |
||
20 | |||
21 | Userspace applications can use write() to @/dev/smem_log@ to add log entries. |
||
22 | |||
23 | Qualcomm uses a proprietary minimal shim layer offering SMEM_LOG_EVENT and SMEM_LOG_EVENT6 macros |
||
24 | that can be used to write events with an event ID plus three data words or six data words, respectively. |
||
25 | |||
26 | The shared memory log can be read from linux userspace via debugfs, see the devices in @/sys/kernel/debug/smem_log@ |
||
27 | and simply use @cat@ on them. You will get lines like |
||
28 | <pre> |
||
29 | MODM: 3982377401 000d0000: 00000001: 03000019 01000028 01000015 53505041 00000061 5f696d71 |
||
30 | MODM: 3982378159 QCSI: 00000004: 00040029 00240015 00000003 00000001 0000002b 00000000 |
||
31 | MODM: 3982378619 000d0000: 00000001: 03000019 0100002b 01000015 53505041 00000061 5f696d71 |
||
32 | APPS: 3982397356 QCCI: 00000005: 0004001d 0024000e 00000003 00000003 00000019 00000000 |
||
33 | APPS: 3982400571 QCCI: 00000005: 00040029 0024000e 00000003 00000003 00000019 00000000 |
||
34 | MODM: 1841235211 QCSI: 00000004: 0004001e 0024001c 00000003 00000001 00000028 00000000 |
||
35 | MODM: 1841236665 000d0000: 00000001: 03000019 01000028 0101001c 53505041 00000061 5f696d71 |
||
36 | MODM: 1841241411 QCSI: 00000004: 0004002a 0024001c 00000003 00000001 0000002b 00000000 |
||
37 | MODM: 1841242246 000d0000: 00000001: 03000019 0100002b 0100001c 53505041 00000061 5f696d71 |
||
38 | MODM: 1841243796 QCSI: 00000004: 0004002b 00660019 00000003 00000001 0000002b 00000000 |
||
39 | MODM: 1841244286 000d0000: 00000001: 03000019 0100002b 01000019 53505041 00000061 5f696d71 |
||
40 | APPS: 1841255456 QCCI: 00000005: 0004001e 00240015 00000003 00000003 00000019 00000000 |
||
41 | MODM: 1841255335 000d0000: 00000002: 0100ffff 0300ffff 07000014 53505041 0000016c 74646d73 |
||
42 | MODM: 1841255828 000d0000: 00000702: 00000001 00000028 00000007 |
||
43 | APPS: 1841261430 QCCI: 00000005: 0004002a 00240015 00000003 00000003 00000019 00000000 |
||
44 | </pre> |
||
45 | |||
46 | More information in @smem_log.h@ |
||
47 | |||
48 | h2. rmnet |
||
49 | |||
50 | "remote network" ? |
||
51 | * consists of control channel and data channel |
||
52 | * data channel carries IP data |
||
53 | * control channel carries QMI messages |
||
54 | |||
55 | * drivers/net/ethernet/msm/msm_rmnet_bam.c |
||
56 | ** ioctl() to set ethernet or rawip (RMNET_IOCTL_SET_LLP_ETHERNET, RMNET_IOCTL_SET_LLP_IP, RMNET_IOCTL_GET_LLP), initial boot time config is ETHERNET |
||
57 | ** use msm_bam_dmux_open() to attach |
||
58 | ** use RMNET_IOCTL_GET_EPID to get the BAM_DMUX endpoint id |
||
59 | |||
60 | h2. bam (Bus Access Manager/Module) |
||
61 | |||
62 | * The Bus Access Manager/Module (BAM) can be |
||
63 | considered as a distributed data mover (DM) |
||
64 | * some kind of DMA controller/engine |
||
65 | * A number of the on-chip devices have their own BAM DMA controller |
||
66 | and use it to move data between system memory and peripherals or |
||
67 | between two peripherals. |
||
68 | |||
69 | Files: |
||
70 | <pre> |
||
71 | ./drivers/dma/qcom_bam_dma.c |
||
72 | ./drivers/net/ethernet/msm/msm_rmnet_bam.c |
||
73 | ./drivers/platform/msm/sps/bam.c |
||
74 | ./drivers/platform/msm/sps/sps_bam.c |
||
75 | ./drivers/platform/msm/usb_bam.c |
||
76 | </pre> |
||
77 | |||
78 | * channels (BAM_DMUX_) |
||
79 | ** RMNET_0...7 |
||
80 | ** USB_RMNET_0 |
||
81 | ** DATA_REV_RMNET_0..8 |
||
82 | ** USB_DPL |
||
83 | |||
84 | seem to be be based on dmux ./drivers/soc/qcom/bam_dmux.c |
||
85 | |||
86 | h2. IPA (Internet Packet Accelerator) |
||
87 | |||
88 | Internet Packet Accelerator (IPA) is a programmable protocol |
||
89 | processor HW block. It is designed to support generic HW processing |
||
90 | of UL/DL IP packets for various use cases independent of radio |
||
91 | technology. |
||
92 | |||
93 | See drivers/platform/msm/ipa/ |
||
94 | |||
95 | http://www.sumobrain.com/patents/wipo/Accelerator/WO2013063791A1.pdf |
||
96 | |||
97 | |||
98 | h2. bam2bam |
||
99 | |||
100 | maybe soem kind of direct connection between two peripherals by means of the BAM? |
||
101 | |||
102 | h2. Android USB Gadget |
||
103 | |||
104 | see [[Android_USB_Gadget]] |
||
105 | |||
106 | h2. IPC Logging |
||
107 | |||
108 | 12 | laforge | see [[IPC_Logging]] |
109 | 20 | laforge | |
110 | h2. diag |
||
111 | |||
112 | Please see [[DIAG]] for more details on Qualcomm DIAG in the context of the modems we are documenting here. |
||
113 | |||
114 | h3. diag forwarding |
||
115 | |||
116 | <pre> |
||
117 | drivers/char/diag/diagfwd.[ch] |
||
118 | drivers/usb/gadget/f_diag.[ch] |
||
119 | drivers/usb/misc/diag_bridge.c |
||
120 | </pre> |
||
121 | |||
122 | * the usb diag gadget handles diag packet read/write over usb |
||
123 | * issues events like USB_DIAG_READ_DONE |
||
124 | * picked up by diagfwd.c |
||
125 | ** can forward diag requests via SMD shared memory to other processors |
||
126 | |||
127 | h3. diag char |
||
128 | |||
129 | The kernel exports a /dev/diag char device which userspce processes can |
||
130 | use to register/listen for DIAG events from the system, or actually |
||
131 | register a DIAG 'subsystem' themselves which can then be controlled from |
||
132 | QXDM. |
||
133 | |||
134 | <pre> |
||
135 | drivers/char/diag/diagchar_core.c |
||
136 | </pre> |
||
137 | |||
138 | * ioctl()s for diag configuration |
||
139 | * supports several concurrent diag clients |
||
140 | * diag logging can be directed to USB/HSIC, character device and more |
||
141 | ** {USB,CALLBACK,MEMORY_DEVICE,UART,NO_LOGGING}_MODE |
||
142 | |||
143 | drivers/char/diag/diag_dci.c |
||
144 | |||
145 | * DCI table is a routing table where pid/sockets can register for a |
||
146 | given DCI. socket close/cleanup code releases all DCI routes for |
||
147 | that socket. |
||
148 | |||
149 | h4. DIAG_IOCTL_COMMAND_REG |
||
150 | |||
151 | * Register a new DIAG command so it can be used from the outside world (QXDM) |
||
152 | * use 'struct diag_cmd_reg_entry_t' per command |
||
153 | * driver keeps a driver->cmd_reg_list of registered commands |
||
154 | |||
155 | h4. DIAG_IOCTL_COMMAND_DEREG |
||
156 | |||
157 | * unregister debug command |
||
158 | |||
159 | h4. DIAG_IOCTL_GET_DELAYED_RSP_ID |
||
160 | |||
161 | h4. DIAG_IOCTL_DCI_REG |
||
162 | |||
163 | h4. DIAG_IOCTL_DCI_DEINIT |
||
164 | |||
165 | h4. DIAG_IOCTL_DCI_SUPPORT |
||
166 | |||
167 | h4. DIAG_IOCTL_DCI_HEALTH_STATS |
||
168 | |||
169 | h4. DIAG_IOCTL_DCI_LOG_STATUS |
||
170 | |||
171 | h4. DIAG_IOCTL_DCI_EVENT_STATUS |
||
172 | |||
173 | h4. DIAG_IOCTL_DCI_CLEAR_LOGS |
||
174 | |||
175 | h4. DIAG_IOCTL_DCI_CLEAR_EVENTS |
||
176 | |||
177 | h4. DIAG_IOCTL_LSM_DEINIT |
||
178 | |||
179 | h4. DIAG_IOCTL_SWITCH_LOGGING |
||
180 | |||
181 | * switch between USB and shared-memory diag |
||
182 | * |
||
183 | |||
184 | h4. DIAG_IOCTL_REMOTE_DEV |
||
185 | |||
186 | h4. DIAG_IOCTL_VOTE_REAL_TIME |
||
187 | |||
188 | h4. DIAG_IOCTL_GET_REAL_TIME |
||
189 | |||
190 | h4. DIAG_IOCTL_PERIPHERAL_BUF_CONFIG |
||
191 | |||
192 | h4. DIAG_IOCTL_PERIPHERAL_BUF_DRAIN |
||
193 | |||
194 | h4. DIAG_IOCTL_REGISTER_CALLBACK |
||
195 | |||
196 | * doen't really do anything but checking arguments ?!? |
||
197 | |||
198 | h4. DIAG_IOCTL_HDLC_TOGGLE |
||
199 | |||
200 | enable or disable HDLC framing of /dev/diag |
||
201 | |||
202 | h2. IRSC (IPC Router Security Control) |
||
203 | |||
204 | FIXME |