msm平臺，AP和CP封裝在一起，公用一塊內存。所以AP需要負責把整個modem, TZ , rpm等binary拷貝到內存中以供modem等subsystem去運行。那AP這邊是怎么分配這些內存，又是怎么讀出來相關的binary，又如何把binary上傳上去的呢？？

相關的feature

CONFIG_FW_LOADER CONFIG_FW_LOADER_USER_HELPER

• 1
• 2

modem使用的內存申請

要設置modem的內存大小，必須首先需要確認modem binary的大小，modem需要使用的內存大小等。這個在CMA相關的內容中說過。這里在說一下高通msm8916平臺，modem大小檢查以及修改方法。?
1) modem binary的大小可以從以下編譯的log里邊看出來！！(modem_proc/build/ms目錄下的pplk-XXX.log或者build_xxxx.log)。?
根據大小對齊1MB大小，就是modem binary需要流出來的大小。看如下例子里邊的log，總的大小是77.04，?
所以需要在上面的dtsi文件中留出來78MB就可以。

Image loaded at virtual address 0xc0000000 Image: 55.44 MiB AMSS Heap: 7.50 MiB (dynamic) MPSS Heap: 4.00 MiB (dynamic) DSM Pools: 5.06 MiB Q6Zip RO, Swap Pool: 2.00 MiB (dynamic) Q6Zip RW, Swap Pool: 1.00 MiB (dynamic) Q6Zip RW, dlpager Heap: 1.00 MiB Extra: 0.54 MiB Pad ding: 0.37 MiB End Address Alignment: 0.13 MiB Total: 77.04 MiB Available: 7.96 MiB

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13

2) 然后去修改modem_proc/config/xxx/ 目錄下的cust_config.xml文件中修改modem大小

<!-- 85 MB of physical pool--> <physical_pool name="DEFAULT_PHYSPOOL"> <region base="0x88000000" size="0x5500000" /> <region base="0x88000000" size="0x4E00000" /> </physical_pool>

• 1
• 2
• 3
• 4
• 5

以下是modem相關的device tree的設置。這些內容也在CMA和ion內存相關的帖子里邊都講過。?
但之前有一個疑問就是，在CMA預留了一段內存之后，會把這個賦值給modem的dev->cma_area，然后在分配需要使用的內存的時候從dev->cma_area中取出來，那這個過程好像跟ion內存沒有什么關系。能不能去掉下面msmxxx-ion.dtsi中?
modem_adsp_mem相關的設置呢？？?
是可以的！！！其他幾個DMA區(qū)域，如果直接從CMA分配的話，應該都可以從msmxxx-ion.dtsi文件中去掉！！?
也就是說下面qcom,ion-heap-type = “DMA”的部分其實都可以從msm8916-ion.dtsi文件中去掉，不影響。

//modem相關內存的device tree設置//pil設備相關的device tree定義qcom,mss@4080000 {compatible = "qcom,pil-q6v56-mss";....linux,contiguous-region = <&modem_adsp_mem>;};//msmxxx-ion.dtsi定義了如下，上面說了這個部分其實是可以去掉的，不會影響相關內存的分配！！qcom,ion-heap@26 { /* MODEM HEAP */compatible = "qcom,msm-ion-reserve";reg = <26>;linux,contiguous-region = <&modem_adsp_mem>;qcom,ion-heap-type = "DMA";};//msmxxx-memory.dtsi定義了如下內容modem_adsp_mem: modem_adsp_region@0 {linux,reserve-contiguous-region;linux,reserve-region;linux,remove-completely;reg = <0x0 0x86800000 0x0 0x05800000>;label = "modem_adsp_mem";};

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24

modem_adsp_mem指定的區(qū)域，需要分配出來，以供下載modem binary。

//pil_mss_driver_probe()->pil_subsys_init() static int pil_subsys_init(struct modem_data *drv,struct platform_device *pdev) {...drv->subsys_desc.name = "modem";drv->subsys_desc.dev = &pdev->dev;drv->subsys_desc.owner = THIS_MODULE;drv->subsys_desc.shutdown = modem_shutdown;drv->subsys_desc.powerup = modem_powerup;drv->subsys_desc.ramdump = modem_ramdump;drv->subsys_desc.free_memory = modem_free_memory;drv->subsys_desc.crash_shutdown = modem_crash_shutdown;drv->subsys_desc.err_fatal_handler = modem_err_fatal_intr_handler;drv->subsys_desc.stop_ack_handler = modem_stop_ack_intr_handler;drv->subsys_desc.wdog_bite_handler = modem_wdog_bite_intr_handler;drv->subsys = subsys_register(&drv->subsys_desc);drv->ramdump_dev = create_ramdump_device("modem", &pdev->dev);...return ret; }

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23

之后在modem_powerup()的時候,會先根據modem binary的elf結構獨處modem的大小等，然后計算出align之后應該的大小。?
pil_boot()-> request_firmware()讀出elf頭并計算大小等。?
在pil_setup_region()->pil_alloc_region()的時候，傳進去的大小就是從上面讀出來的大小。

pil_alloc_region min_addr = 0xc0000000 , max_addr = 0xc2b00000 , aligned_size = 0x2b00000

• 1

這里看著和實際的內存大小一致！！ 可能是因為留出來的CMA區(qū)域的大小正好和這個大小一致才這樣的。?
在實際調試過程中，也可以打印這個大小之后，調整CMA大小。

再看看實際的CMA大小是怎么申請的。

//調用順序 pil_boot()->pil_init_mmap()->pil_setup_region()->pil_alloc_region()-> dma_alloc_attrs()->arm_dma_alloc()->__dma_alloc()->__alloc_from_contiguous()->

• 1
• 2
• 3

這個調用的順序，一步一步往下看可以看到，實際上分配的區(qū)域是一塊CMA區(qū)域，而且就是在CMA注冊之后，在相應的platform設備注冊的時候保存到dev->cma_area中的區(qū)域。?
在相應的設備注冊的時候，如果設備的device tree中有”linux,contiguous-region”的時候，就會尋找相應的CMA區(qū)域并進行保留。這都是因為注冊了platform_bus_typ的notifier函數

bus_register_notifier(&platform_bus_type, &cma_dev_init_nb);

• 1

看下面的log。

<6>[0.487642] [0:swapper/0:1] cma: Assigned CMA region at 0 to 1de0000.qcom,venus device <6>[0.489469] [0:swapper/0:1] cma: Assigned CMA region at 0 to 4080000.qcom,mss device <6>[0.490756] [0:swapper/0:1] cma: Assigned CMA region at 0 to a21b000.qcom,pronto device <6>[1.125342] [0:swapper/0:1] cma: Assigned CMA region at 0 to 8.qcom,ion-heap device <6>[1.125793] [0:swapper/0:1] cma: Assigned CMA region at 0 to 1b.qcom,ion-heap device <6>[1.126233] [0:swapper/0:1] cma: Assigned CMA region at 0 to 1c.qcom,ion-heap device <6>[1.126671] [0:swapper/0:1] cma: Assigned CMA region at 0 to 17.qcom,ion-heap device <6>[1.127298] [0:swapper/0:1] cma: Assigned CMA region at 0 to 1a.qcom,ion-heap device

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8

這里看到4080000.qcom,mss這個device相應的區(qū)域已經保留了CMA區(qū)域。?
然后在上面進行分配的時候，在?
__alloc_from_contiguous()->dma_alloc_from_contiguous()->dev_get_cma_area()函數中取到?
相應的dev->cma_area。

modem相關內存的使用和下載

pil_load_seg()->request_firmware_direct()->_request_firmware()函數身生成相應的device節(jié)點，并通知ueventd去讀取相應的binary然后下載。以下是pil_load_seg里邊打印的正在試圖下載的binary。

<6>[29.129737] [1:init:1] pil_load_seg fw_name = modem.b02 <6>[29.157808] [1:init:1] pil_load_seg fw_name = modem.b07 <6>[29.191477] [1:init:1] pil_load_seg fw_name = modem.b17 <6>[29.348480] [1:init:1] pil_load_seg fw_name = modem.b19 <6>[29.409733] [1:init:1] pil_load_seg fw_name = modem.b20 <6>[29.489639] [1:init:1] pil_load_seg fw_name = modem.b23 <6>[29.519624] [1:init:1] pil_load_seg fw_name = modem.b24 <6>[29.549829] [1:init:1] pil_load_seg fw_name = modem.b25 <6>[29.591918] [1:init:1] pil_load_seg fw_name = modem.b27 <6>[31.997036] [0:wcnss_service:307] pil_load_seg fw_name = wcnss.b02 <6>[32.658390] [0:wcnss_service:307] pil_load_seg fw_name = wcnss.b04 <6>[32.693754] [0:wcnss_service:307] pil_load_seg fw_name = wcnss.b06 <6>[32.848104] [3:wcnss_service:307] pil_load_seg fw_name = wcnss.b09 <6>[32.854061] [3:wcnss_service:307] pil_load_seg fw_name = wcnss.b10 <6>[32.876115] [3:wcnss_service:307] pil_load_seg fw_name = wcnss.b11 <6>[37.384287] [1:TimedEventQueue:771] pil_load_seg fw_name = venus.b02 <6>[37.438222] [1:TimedEventQueue:771] pil_load_seg fw_name = venus.b03 <6>[37.484909] [2:TimedEventQueue:771] pil_load_seg fw_name = venus.b04

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18

在 _request_firmware()->fw_load_from_user_helper()->_request_firmware_load()函數中就在生成相應的dev節(jié)點，并通知ueventd。

static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,long timeout) {int retval = 0;struct device *f_dev = &fw_priv->dev;struct firmware_buf *buf = fw_priv->buf;struct bin_attribute *fw_attr_data = buf->dest_addr ?&firmware_direct_attr_data : &firmware_attr_data;/* fall back on userspace loading */buf->is_paged_buf = buf->dest_addr ? false : true;dev_set_uevent_suppress(f_dev, true);/* Need to pin this module until class device is destroyed */__module_get(THIS_MODULE);retval = device_add(f_dev);//以下生成的data和loading節(jié)點，用于ueventd讀取相應的binary，然后通過節(jié)點加載到內存的。//用于下載的節(jié)點，retval = device_create_bin_file(f_dev, fw_attr_data);//生成一個loading的節(jié)點，loading節(jié)點用于控制的retval = device_create_file(f_dev, &dev_attr_loading);if (retval) {dev_err(f_dev, "%s: device_create_file failed\n", __func__);goto err_del_bin_attr;}if (uevent) { //這里正在通知ueventddev_set_uevent_suppress(f_dev, false);dev_dbg(f_dev, "firmware: requesting %s\n", buf->fw_id);if (timeout != MAX_SCHEDULE_TIMEOUT)schedule_delayed_work(&fw_priv->timeout_work, timeout);kobject_uevent(&fw_priv->dev.kobj, KOBJ_ADD);}wait_for_completion(&buf->completion);cancel_delayed_work_sync(&fw_priv->timeout_work); }

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41

_request_firmware() -> assign_firmware_buf() 這是做什么的？？

來看一下ueventd.c文件中是怎么檢測這個然后讀binary，通過loading節(jié)點加載binary的。

int ueventd_main(int argc, char **argv){...while(1) {ufd.revents = 0;nr = poll(&ufd, 1, -1);if (nr <= 0)continue;if (ufd.revents & POLLIN)handle_device_fd();} }void handle_device_fd(){...handle_firmware_event(&uevent);//process_firmware_event() }#define SYSFS_PREFIX "/sys" #define FIRMWARE_DIR1 "/etc/firmware" #define FIRMWARE_DIR2 "/vendor/firmware" #define FIRMWARE_DIR3 "/firmware/image" #define FIRMWARE_DIR4 "/firmware-modem/image" #define DEVICES_BASE "/devices/soc.0"static void process_firmware_event(struct uevent *uevent){...l = asprintf(&root, SYSFS_PREFIX"%s/", uevent->path);l = asprintf(&loading, "%sloading", root);l = asprintf(&file1, FIRMWARE_DIR1"/%s", uevent->firmware);l = asprintf(&file2, FIRMWARE_DIR2"/%s", uevent->firmware);l = asprintf(&file3, FIRMWARE_DIR3"/%s", uevent->firmware);l = asprintf(&file4, FIRMWARE_DIR4"/%s", uevent->firmware);loading_fd = open(loading, O_WRONLY);...if(!load_firmware(fw_fd, loading_fd, data_fd)) //加載binaryINFO("firmware: copy success { '%s', '%s' }\n", root, uevent->firmware);elseINFO("firmware: copy failure { '%s', '%s' }\n", root, uevent->firmware);}

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42

以下看看ueventd中，真正把讀到的binary，傳給kernel的函數

static int load_firmware(int fw_fd, int loading_fd, int data_fd) {struct stat st;long len_to_copy;int ret = 0;//fstat查看binary的信息，讀出來size等if(fstat(fw_fd, &st) < 0)return -1;len_to_copy = st.st_size;write(loading_fd, "1", 1); /* start transfer */while (len_to_copy > 0) {char buf[PAGE_SIZE];ssize_t nr;//讀nr = read(fw_fd, buf, sizeof(buf));if(!nr)break;if(nr < 0) {ret = -1;break;}len_to_copy -= nr;while (nr > 0) {ssize_t nw = 0;//寫到data節(jié)點nw = write(data_fd, buf + nw, nr);if(nw <= 0) {ret = -1;goto out;}nr -= nw;}}out:if(!ret) //loading節(jié)點用于通知kernel加載情況！！write(loading_fd, "0", 1); /* successful end of transfer */elsewrite(loading_fd, "-1", 2); /* abort transfer */return ret; }

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• 44
• 45
• 46

內核中，data節(jié)點出來write的函數在_request_firmware_load()中根據buf->dest_addr的值有所不同

static int _request_firmware_load(struct firmware_priv *fw_priv, bool uevent,long timeout) {...struct bin_attribute *fw_attr_data = buf->dest_addr ?&firmware_direct_attr_data : &firmware_attr_data;...}

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9

在下載modem.bxx的時候應該都是有buf->dest_addr才對

<6>[29.355860] [0:init:1] pil_load_seg fw_name = modem.b02 <6>[29.361829] [0:init:1] fw_load_from_user_helper start <6>[29.368051] [0:init:1] _request_firmware_load buf->dest_addr = 0x86800000 <6>[29.380308] [0:ueventd:230] firmware_loading_store started ... <6>[29.391942] [0:init:1] pil_load_seg fw_name = modem.b07 <6>[29.398801] [0:init:1] fw_load_from_user_helper start <6>[29.404996] [0:init: 1] _request_firmware_load buf->dest_addr = 0x86840000 ...

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9

//write(data_fd, buf + nw, nr); buf對應buffer？ offset? count對應nr?? static ssize_t firmware_direct_write(struct file *filp, struct kobject *kobj,struct bin_attribute *bin_attr,char *buffer, loff_t offset, size_t count) {struct device *dev = kobj_to_dev(kobj);struct firmware_priv *fw_priv = to_firmware_priv(dev);//獲取uevent讀取modem binary時候讀到的內容，保存在firmware_priv中。firmware_priv中的firmware_buf保存了binary的物理地址，大小等等信息struct firmware *fw;ssize_t retval;if (!capable(CAP_SYS_RAWIO))return -EPERM;mutex_lock(&fw_lock);fw = fw_priv->fw;if (!fw || test_bit(FW_STATUS_DONE, &fw_priv->buf->status)) {retval = -ENODEV;goto out;}retval = __firmware_data_rw(fw_priv, buffer, &offset, count, 0);if (retval < 0)goto out;fw_priv->buf->size = max_t(size_t, offset, fw_priv->buf->size); out:mutex_unlock(&fw_lock);return retval; }static int __firmware_data_rw(struct firmware_priv *fw_priv, char *buffer,loff_t *offset, size_t count, int read) {u8 __iomem *fw_buf; struct firmware_buf *buf = fw_priv->buf;int retval = count;if ((*offset + count) > buf->dest_size) {pr_debug("%s: Failed size check.\n", __func__);retval = -EINVAL;goto out;}//fw_buf 就是要拷貝到內存中的modem binary物理地址對應的虛擬地址。//map_fw_mem函數中，會根據虛擬地址以及需要拷貝的大小，map出一段虛擬地址。//map一段物理地址，然后返回內核可以訪問的虛擬地址，，這個是通過ioremap相關的函數實現的fw_buf = buf->map_fw_mem(buf->dest_addr + *offset, count,buf->map_data);if (!fw_buf) {pr_debug("%s: Failed ioremap.\n", __func__);retval = -ENOMEM;goto out;}//讀寫，直接拷貝就可以if (read)memcpy(buffer, fw_buf, count);elsememcpy(fw_buf, buffer, count);*offset += count;buf->unmap_fw_mem(fw_buf, count, buf->map_data);out:return retval; }static void *map_fw_mem(phys_addr_t paddr, size_t size, void *data) {struct pil_map_fw_info *info = data;return dma_remap(info->dev, info->region, paddr, size,&info->attrs); }static inline void *dma_remap(struct device *dev, void *cpu_addr,dma_addr_t dma_handle, size_t size, struct dma_attrs *attrs) {const struct dma_map_ops *ops = get_dma_ops(dev);BUG_ON(!ops);if (!ops->remap) {WARN_ONCE(1, "Remap function not implemented for %pS\n",ops->remap);return NULL;}return ops->remap(dev, cpu_addr, dma_handle, size, attrs); }static void *arm_dma_remap(struct device *dev, void *cpu_addr,dma_addr_t handle, size_t size,struct dma_attrs *attrs) {struct page *page = pfn_to_page(dma_to_pfn(dev, handle));pgprot_t prot = __get_dma_pgprot(attrs, PAGE_KERNEL);unsigned long offset = handle & ~PAGE_MASK;size = PAGE_ALIGN(size + offset);return __dma_alloc_remap(page, size, GFP_KERNEL, prot,__builtin_return_address(0)) + offset;}static void * __dma_alloc_remap(struct page *page, size_t size, gfp_t gfp, pgprot_t prot,const void *caller) {struct vm_struct *area;unsigned long addr;/** DMA allocation can be mapped to user space, so lets* set VM_USERMAP flags too.*///得到一段滿足要求的vm_struct。這里area = get_vm_area_caller(size, VM_ARM_DMA_CONSISTENT | VM_USERMAP,caller);if (!area)return NULL; addr = (unsigned long)area->addr; area->phys_addr = __pfn_to_phys(page_to_pfn(page));//addr是得到的vm_struct對應的虛擬地址，內核可以訪問的//所以根據物理地址以及對應的虛擬地址以及大小等情況，ioremap_page_range會做一個page table//這樣內核就可以直接訪問這段內存if (ioremap_page_range(addr, addr + size, area->phys_addr, prot)) {vunmap((void *)addr);return NULL;}return (void *)addr;//返回虛擬內存，現在這個虛擬內存就可以直接訪問了 }

• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• 44
• 45
• 46
• 47
• 48
• 49
• 50
• 51
• 52
• 53
• 54
• 55
• 56
• 57
• 58
• 59
• 60
• 61
• 62
• 63
• 64
• 65
• 66
• 67
• 68
• 69
• 70
• 71
• 72
• 73
• 74
• 75
• 76
• 77
• 78
• 79
• 80
• 81
• 82
• 83
• 84
• 85
• 86
• 87
• 88
• 89
• 90
• 91
• 92
• 93
• 94
• 95
• 96
• 97
• 98
• 99
• 100
• 101
• 102
• 103
• 104
• 105
• 106
• 107
• 108
• 109
• 110
• 111
• 112
• 113
• 114
• 115
• 116
• 117
• 118
• 119
• 120
• 121
• 122
• 123
• 124
• 125
• 126
• 127
• 128
• 129
• 130
• 131
• 132
• 133
• 134
• 135
• 136

和ioremap_page_range()比較像。

總結

以上是生活随笔為你收集整理的Linux驱动基础：msm平台，modem等framework加载的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。