高通 MSM8K bootloader 之二： SBL1

续：高通 MSM8K bootloader 之一： SBL1

上篇将我重点关注SBL1的内容１和２基本说明完，本篇继续内容３和４。
１、    CDT ： Platform ID和DDR参数 
２、　debug log　：
３、　download　： msm8K 新平台软件download支持两种协议，sahara和firehose
４、　ramdump　：死机异常信息dump

四、SW download

１、软件升级模式

　　高通8K以后平台支持如下两种，说到下载模式，忍不住又得骂高通。　

　　以前6K, 7K平台不支持紧急下载模式，工厂生产软件要down到手机里，非常复杂。

　　要嘛先用烧录器烧一段sbl image，然后剩下的image自己开发升级软件用usb多路升级。

　　要嘛全部image用烧录器一次性烧完。

　　坑人的高通啊！么得办法，就害苦咱苦命的民工。　好了，介绍一下现在支持的两种下载模式吧！　

　　紧急下载模式：pbl负责与ＰＣ交互，实现软件下载

　　自动进入紧急下载模式：主板刚生产emmc是裸片时，或者sbl运行异常时，系统自动进入紧急下载模式。

　　　　　　　　　　　　这种情况就不多说了，主要是用于工厂生产，及sbl异常处理。

　　手动进入紧急下载模式：通过硬件一个gpio下拉，pbl检测到该gpio后强制进入紧急下载模式。这种主要

　　　　　　　　　　　　　以防不测情况。

　　　另外一种就是软件通过设置magic number，然后由热重启，pbl检测到magic number后，强制进入下载模式。

　　软件切换接口，参考如下boot_dload.c代码：

/*=============================================================================

**  Function :  boot_dload_transition_pbl_forced_dload

** ==========================================================================
*/
/*!
*
* @brief
*   This function sets the magic numbers for PBL to detect and enter forced
*   download mode.  It then calls the target specific function to trigger a
*   system reset.
*
* @par Dependencies
*   None
*
* @retval
*   None
*
* @par Side Effects
*   Set's PBL magic numbers to enter forced download, resets target, never to
*   return.
*
*/
void <strong>boot_dload_transition_pbl_forced_dload</strong>( void )
{
  /* PBL uses the last four bits of BOOT_MISC_DETECT to trigger forced download.
     Preserve the other bits of the register. */

  uint32 register_value =
    HWIO_TCSR_BOOT_MISC_DETECT_INM(HWIO_TCSR_BOOT_MISC_DETECT_RMSK);

  /* Clear the PBL masked area and then apply HS_USB value */
  register_value &= ~(FORCE_DLOAD_MASK);
  register_value |= FORCE_DLOAD_HS_USB_MAGIC_NUM;

  /* Write the new value back out to the register */
  HWIO_TCSR_BOOT_MISC_DETECT_OUTM(FORCE_DLOAD_MASK,
                                  register_value);

  boot_hw_reset(BOOT_WARM_RESET_TYPE);
} /* boot_dload_transition_pbl_forced_dload() */

　普通下载模式：sbl负责与ＰＣ交互，实现软件下载

　手机第一次下载完软件以后，普通情况下，可不进入pbl紧急下载模式，可由sbl进行软件升级。

　sbl是如何进入普通下载模式的呢？看如下函数boot_dload_check()。

　boot_dload_check()检测到USB D+ 接地、或者sbl发生异常时调用boot_dload_set_cookie()设置了cookie，进自　　动进入普通的下载模式。

<pre name="code" class="cpp">
/*===========================================================================

**  Function :  boot_dload_check

** ==========================================================================
*/
/*!
*
* @brief
*   This function will check to see if the downloader should be entered
*   for QPST download, and enter the downloader if directed to.
*
* @param[in] bl_shared_data Pointer to the shared data
*
* @par Dependencies
*   Download ID must be present in IRAM if downloader is to be entered.
*
* @retval
*   None
*
* @par Side Effects
*   Boot may be halted and QPST downloader entered.
*
*/
void boot_dload_check
(
  bl_shared_data_type *bl_shared_data
)
{
  /* Check whether USB D+ line is grounded. If it is, then enter
     PBL Download mode */
<strong><span style="color:#cc0000;">  if(boot_qhsusb_al_check_for_pbl_dload(0))
  {
    boot_dload_transition_pbl_forced_dload();
  }</span></strong>

  /* Determine if the downloader should be entered at this time,
     instead of continuing with the normal boot process. */
  if ( boot_dload_entry( ) == TRUE )
  {
    /* Check the UEFI ram dump cookie, we enter download mode
       only if UEFI ram dump cookie is NOT set*/
    if ( !( boot_shared_imem_cookie_ptr != NULL &&
            boot_shared_imem_cookie_ptr->uefi_ram_dump_magic ==
            UEFI_CRASH_DUMP_MAGIC_NUM ) )
    {
      /* Before entering downloader clear RESET_DEBUG[BLOCK_RESIN] so
         the next resin_n is not blocked.  This is part of the abnormal
         reset logic in Bear family */
      HWIO_GCC_RESET_DEBUG_OUTM(HWIO_GCC_RESET_DEBUG_BLOCK_RESIN_BMSK,
                                0);

      /* Enter downloader for QPST */
      sbl_dload_entry();
    }
  }
} /* boot_dload_check() */

/*===========================================================================
**  Function :  boot_dload_set_cookie
** ==========================================================================
*/
/*!
*
* @brief
*   Set the SBL dload mode cookie
**
* @par Dependencies
*  None
*
*/
void boot_dload_set_cookie()
{
  HWIO_TCSR_BOOT_MISC_DETECT_OUTM(SBL_DLOAD_MODE_BIT_MASK,
                                  SBL_DLOAD_MODE_BIT_MASK);
}

再看看下面的代码！！！　我们又有新的发现！

sbl1_target.c

<pre name="code" class="cpp">/*===========================================================================

**  Function :  sbl_dload_entry

** ==========================================================================
*/
/*!
*
* @brief
*   This function pointer is defined in each SBL* Bootloader to handle SBL-specific
*   requirements to enter a download routine. It is initialized to
*   boot_dload_transition_pbl_forced_dload by default.
*
* @par Dependencies
*   None
*
* @retval
*   None
*
* @par Side Effects
*   None
*
*/
void (*sbl_dload_entry)(void) = boot_dload_transition_pbl_forced_dload;

函数指针sbl_dload_entry默认指向紧急下载模式的入口：boot_dload_transition_pbl_forced_dload ，

该下载方式会切换到pbl，由pbl通过firehose协议实现download。

void sbl1_dload_entry ()
{
  static uint32 dload_entry_count = 0;

  dload_entry_count++;

  /* Only execute the pre-dload procedures the first time we try to enter
   * dload in case there is an error within these procedures. */
  if( dload_entry_count == 1 && &bl_shared_data != NULL )
  {
    /* Entering dload routine for the first time */
    <strong>boot_do_procedures</strong>( &bl_shared_data, sbl1_pre_dload_procs );
  }

  pm_device_config_in_dloadmode();

  /* Enter boot Sahara */
  <strong>boot_dload_transition_enter_sahara</strong>();

}/* sbl1_dload_entry() */

而sbl1定义了另一个下载模式的入口：sbl1_dload_entry，它支持直接在sbl1中通过sahara协议download，

还支持crash ram dump 功能。包括dump to raw partition ,and dump to sdcard 。

见：boot_do_procedures( &bl_shared_data, sbl1_pre_dload_procs );　

crash ramdump章节再详细看看。

sbl1_mc.c

<pre name="code" class="cpp">/*DLOAD flag for SBL1 to enter PBL error handler*/
#ifdef BOOT_ENTER_PBL_DLOAD_ON_SBL_ERROR
  static boot_boolean edload_flag = TRUE;
#else
  static boot_boolean edload_flag = FALSE;
#endif

</pre><pre name="code" class="cpp">void sbl1_post_ddr_init(bl_shared_data_type *bl_shared_data)
{
   ..........

  if (edload_flag != TRUE)
  {
    /* Update the dload entry to sbl1 sahara dload entry function */
    sbl_dload_entry = sbl1_dload_entry;
  }
}

好，既然在sbl1有两个download入口，如何选则呢？ 

sbl1_mc.c 中通过宏BOOT_ENTER_PBL_DLOAD_ON_SBL_ERROR控制。

如果定义该宏，则dload处理会转交给PBL帮忙处理了。

２、进入升级模式的方法

　　上节描述的高通默认进入下载模式的方法，都是自动的，显然无法满足开发、生产、售后等需求。

　　因此如下两种方法，实用于开发、生产、售后。

　　 sbl1扫描按键组合：

　　关机状态下，sbl1扫描按键组合，比如，扫描到power & vol+ 两个按键同时按下，则进入pbl紧急下模模式。

　　当然，有些结构设计可能导致power & vol+ 两个按键开机容易误触，则可以采用别的硬件组合方式。比如，

　　vol+ & usb　等等！

　　关机状态，进入下载模式，没有ram dump的需求，因此当扫描到相应的硬件组合，

　　直接调用：boot_dload_transition_pbl_forced_dload

　　 adb reboot + edl / dload :

       手机正常开机，能连接usb上的状态下，可以使用 adb reboot edl 或者 adb reboot dload 命令，

　　使手机进入pbl紧急下载模式，或者进入sbl1普通下载模式。　

　　MSM8916平台参考如下代码，

　　kernel/drivers/power/reset/msm-poweroff.c　，相关代码由宏CONFIG_MSM_DLOAD_MODE控制。

static int msm_restart_probe(struct platform_device *pdev)
{
    struct device *dev = &pdev->dev;
    struct resource *mem;
    struct device_node *np;
    int ret = 0;

#ifdef CONFIG_MSM_DLOAD_MODE
    if (scm_is_call_available(SCM_SVC_BOOT, SCM_DLOAD_CMD) > 0)
        scm_dload_supported = true;

    atomic_notifier_chain_register(&panic_notifier_list, &panic_blk);
    np = of_find_compatible_node(NULL, NULL, DL_MODE_PROP);
    if (!np) {
        pr_err("unable to find DT imem DLOAD mode node\n");
    } else {
        dload_mode_addr = of_iomap(np, 0);
        if (!dload_mode_addr)
            pr_err("unable to map imem DLOAD offset\n");
    }

    np = of_find_compatible_node(NULL, NULL, EDL_MODE_PROP);
    if (!np) {
        pr_err("unable to find DT imem EDLOAD mode node\n");
    } else {
        emergency_dload_mode_addr = of_iomap(np, 0);
        if (!emergency_dload_mode_addr)
            pr_err("unable to map imem EDLOAD mode offset\n");
    }

    set_dload_mode(download_mode);
#endif
    np = of_find_compatible_node(NULL, NULL,
                "qcom,msm-imem-restart_reason");
    if (!np) {
        pr_err("unable to find DT imem restart reason node\n");
    } else {
        restart_reason = of_iomap(np, 0);
        if (!restart_reason) {
            pr_err("unable to map imem restart reason offset\n");
            ret = -ENOMEM;
            goto err_restart_reason;
        }
    }

    mem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
    msm_ps_hold = devm_ioremap_resource(dev, mem);
    if (IS_ERR(msm_ps_hold))
        return PTR_ERR(msm_ps_hold);

    pm_power_off = do_msm_poweroff;
    arm_pm_restart = do_msm_restart;

    if (scm_is_call_available(SCM_SVC_PWR, SCM_IO_DISABLE_PMIC_ARBITER) > 0)
        scm_pmic_arbiter_disable_supported = true;

    return 0;

err_restart_reason:
#ifdef CONFIG_MSM_DLOAD_MODE
    iounmap(emergency_dload_mode_addr);
    iounmap(dload_mode_addr);
#endif
    return ret;
}

msm_restart_probe函数在执行过程中打印出如下log，说明dts中没有设置emergency_dload_mode_addr，及dload_mode_addr的地址。

<3>[    6.627538] unable to find DT imem DLOAD mode node
<3>[    6.628075] unable to find DT imem EDLOAD mode node

但添加scm_dload_supported的打印信息，可以看到如下log，

<3>[    6.626976]  scm_dload_supported=1　，

说明，scm dload是支持的。因此，接下来的两个函数，都是通过scm dload实现download模式切换。

static void enable_emergency_dload_mode(void)
{
    int ret;

    if (emergency_dload_mode_addr) {
        __raw_writel(EMERGENCY_DLOAD_MAGIC1,
                emergency_dload_mode_addr);
        __raw_writel(EMERGENCY_DLOAD_MAGIC2,
                emergency_dload_mode_addr +
                sizeof(unsigned int));
        __raw_writel(EMERGENCY_DLOAD_MAGIC3,
                emergency_dload_mode_addr +
                (2 * sizeof(unsigned int)));

        /* Need disable the pmic wdt, then the emergency dload mode
         * will not auto reset. */
        qpnp_pon_wd_config(0);
        mb();
    }

    if (scm_dload_supported) {
        ret = scm_call_atomic2(SCM_SVC_BOOT,
                SCM_DLOAD_CMD, SCM_EDLOAD_MODE, 0);
        if (ret)
            pr_err("Failed to set EDLOAD mode: %d\n", ret);
    }
}

使能紧急下载模式。

static void set_dload_mode(int on)
{
    int ret;

    if (dload_mode_addr) {
        __raw_writel(on ? 0xE47B337D : 0, dload_mode_addr);
        __raw_writel(on ? 0xCE14091A : 0,
               dload_mode_addr + sizeof(unsigned int));
        mb();
    }

    if (scm_dload_supported) {
        ret = scm_call_atomic2(SCM_SVC_BOOT,
                SCM_DLOAD_CMD, on ? SCM_DLOAD_MODE : 0, 0);
        if (ret)
            pr_err("Failed to set DLOAD mode: %d\n", ret);
    }

    dload_mode_enabled = on;
}

使能普通下载模式。

这样adb reboot edl 或者 adb reboot dload 命令就可以使手机进入下载模式了。

３、软件升级工具及协议

高通平台，从MSM6K 、7K 到8K，　download的方法和协议，一直在更新。

协议经历了从stream dload到sahara，再到现在firehose 。

每一种协议的具体描述参考如下文档： 

80-V5348-1_J_Streaming_DLoad_Protocol.pdf

80-N1008-1_H_SaharaProtocolSpecification.pdf

80-NG319-1_A_Firehose Protocol V1.0_Def_Doc.pdf

参见本人的另一篇介绍《qualcomm 8K平台Sahara Protocol相对7K, 6K 平台Software Download优点》。

根据使用不同协议，相应的，高通提供两个下载工具：eMMC Software Download  和 QFIL (Qualcomm Flash Image Loader ) 

如下俩图 ：

通过这种普通下载模式，进入下载模后，windows设备管理器可以看到PC端枚举出一个9006的USB端口，

同时枚举出一个mass storage。

高通这种mass storage模式下载速率是非常的快。可是我也它有如下一些缺点：

pc端枚举mass storage速度很慢，根据测试也非常耗cpu。

pc端枚举mass storage容易出错，特别是多台手机同时枚举时。

纠错不易，按文件方式写入，目前我还没想到什么方法进行纠错？

好，下面贴相关代码所在的路径，及调用到的重要函数贴出来！

boot_images/core/storage/tools/emmcbld

boot_images/core/boot/secboot3/hw/msm8916/sbl1/

sbl1_mc.c

sbl1_target.c

sbl1_sahara.c

boot_images/core/boot/secboot3/src/

boot_sahara.c

boot_extern_hsusb_interface.c

boot_images/core/wiredconnectivity/qhsusb/src/al/qhsusb_al_bulk.c

boot_images/core/wiredconnectivity/qhsusb/src/func/

qhsusb_fd_hdlc.c

qhsusb_fd_ms.c

qhsusb_scsi.c

void sbl1_dload_entry ()
{
  static uint32 dload_entry_count = 0;

  dload_entry_count++;

  /* Only execute the pre-dload procedures the first time we try to enter
   * dload in case there is an error within these procedures. */
  if( dload_entry_count == 1 && &bl_shared_data != NULL )
  {
    /* Entering dload routine for the first time */
    boot_do_procedures( &bl_shared_data, sbl1_pre_dload_procs );
  }

  pm_device_config_in_dloadmode();

  /* Enter boot Sahara */
  boot_dload_transition_enter_sahara();

}/* sbl1_dload_entry() */

/*===========================================================================

**  Function :  boot_dload_transition_enter_sahara

** ==========================================================================
*/
/*!
*
* @brief
*   This function is implemented in each SBL to enter sahara dload mode
*
* @par Dependencies
*   None
*
* @retval
*   None
*
* @par Side Effects
*   None
*
*/
void boot_dload_transition_enter_sahara(void)
{
  /* Get Sahara interface */
  struct boot_sahara_interface* sbl_sahara_interface = sbl_sahara_get_interface();
  BL_VERIFY(sbl_sahara_interface != NULL, BL_ERR_NULL_PTR);

  /* Set Sahara mode to memory debug */
  sbl_sahara_interface->sahara_mode = SAHARA_MODE_MEMORY_DEBUG;

  /* Flush the cache before calling into sahara so that all data is flushed to memory */
  mmu_flush_cache();

  /* Enter Sahara */
  boot_sahara_entry(sbl_sahara_interface);
}

调用sbl_sahara_get_interface获取sahara如下函数接口：sbl_sahara_interface

调用boot_sahara_entry。

/* SBL Sahara dispatch table */
static struct boot_sahara_dispatch_tbl sbl_sahara_dispatch_tbl =
{
  SAHARA_INTERFACE_DISPATCH_VERSION,
  sbl_sahara_bulk_init,
  boot_qhsusb_al_bulk_shutdown,
  boot_qhsusb_al_bulk_poll,
  (sahara_rx_bulk_type) sbl_sahara_rx_bulk,
  (sahara_tx_bulk_type) boot_qhsusb_al_bulk_transmit,
  boot_qhsusb_al_bulk_get_max_packet_size,
  sbl_sahara_reset,
  boot_clobber_check_global_whitelist_range,
  sbl_sahara_exec_cmd,
  boot_qhsusb_al_bulk_get_max_raw_data_size,
  sbl_sahara_is_auth_enabled,
  qmemcpy,
  qmemset,
  sbl_sahara_get_bin_header_size,
  sbl_sahara_get_bin_image_id,
  sbl_sahara_get_bin_image_dest,
  sbl_sahara_get_bin_image_size,
  sbl_sahara_get_bin_code_size,
  sbl_sahara_get_bin_cert_chain_size,
  sbl_sahara_get_bin_signature_size,
  sbl_sahara_get_bin_image_src,
  sbl_sahara_unrecoverable_error_handler,
  sbl_sahara_image_load_post_proc,
  sbl_sahara_skip_image_load,
  boot_get_hash_segment_buffer,
  sbl_elf_optimized_segment_load,
  NULL,
  NULL,
};

/* ============================================================================
**  Function : boot_sahara_entry
** ============================================================================
*/
/*!
*   @brief
*   This function provides an entry into the Sahara protocol and jumps into
*   the protocol.
*
*   @details
*   This function initializes the Sahara protocol followed by sending a HELLO
*   packet to the host. After that, the target will proceed to wait for
*   incoming packets and handle them appropriately.
*
*   @param sahara_interface      -  [IN/OUT] Interface to be used by protocol
*
*   @par Dependencies
*   None
*
*   @par Side Effects
*   boot_sahara_init() will be called which calls the dispatch table's init()
*   routine - this is intended to initialize any hardware that is required
*   for the protocol to execute.
*
*   @retval  Boolean
*
*   @sa None
*/
boolean boot_sahara_entry
(
  struct boot_sahara_interface* sahara_interface
)
{
  boolean status = TRUE;

  sahara_if = sahara_interface;

  // Validate interface and initialize Sahara protocol if not previously executed
  status = boot_sahara_init();

  if (status)
  {
    // Send hello packet
    boot_sahara_handle_hello();

    // Enter Sahara packet handler
    boot_sahara_process_packets();

    // Reset authentication information
    sahara_auth_tbl = NULL;
    sahara_auth_elf = FALSE;
    sahara_auth_bin = FALSE;
  }

  return status;
}

调用函数boot_sahara_init初始化sahara协议，枚举usb com口及mass storage。

调用函数boot_sahara_handle_hello主动发送hello packet, 

调用函数boot_sahara_process_packets处理其它cmd packets。

/* ============================================================================
**  Function : boot_sahara_init
** ============================================================================
*/
/*!
*   @brief
*   This function initializes the state for the Sahara protocol
*
*   @details
*   This function performs basic initialization in order to transfer an image.
*   Based on the image type, the current image in shared data will be updated.
*   This function also initializes the internal state machine and hardware
*   driver.
*
*   @param  None
*
*   @par Dependencies
*   None
*
*   @par Side Effects
*   None
*
*   @retval  TRUE if initialization was successful; FALSE otherwise
*
*   @sa None
*/
static boolean boot_sahara_init ( void )
{
  boolean status = TRUE;

  do
  {
    // Check parameters
    if (sahara_if == NULL)
    {
      status = FALSE;
      break;
    }
    if ((sahara_if->sahara_shared_data == NULL) ||
        (sahara_if->dispatch_tbl == NULL))
    {
      status = FALSE;
      break;
    }

    sahara_shared_data = sahara_if->sahara_shared_data;
    sahara_dispatch_tbl = sahara_if->dispatch_tbl;

    if (sahara_if->sahara_shared_data->cur_image == NULL)
    {
      status = FALSE;
      break;
    }

    // Verify dispatch table
    if ((sahara_dispatch_tbl->init == NULL) ||
        (sahara_dispatch_tbl->shutdown == NULL) ||
        (sahara_dispatch_tbl->poll == NULL) ||
        (sahara_dispatch_tbl->rx_bulk == NULL) ||
        (sahara_dispatch_tbl->tx_bulk == NULL) ||
        (sahara_dispatch_tbl->shutdown == NULL) ||
        (sahara_dispatch_tbl->get_max_packet_size == NULL) ||
        (sahara_dispatch_tbl->reset == NULL) ||
        (sahara_dispatch_tbl->valid_address_range == NULL) ||
        (sahara_dispatch_tbl->exec_cmd == NULL) ||
        (sahara_dispatch_tbl->get_max_raw_data_size == NULL) ||
        (sahara_dispatch_tbl->auth_enabled == NULL) ||
        (sahara_dispatch_tbl->memcpy == NULL) ||
        (sahara_dispatch_tbl->memset == NULL) ||
        (sahara_dispatch_tbl->get_bin_header_size == NULL) ||
        (sahara_dispatch_tbl->get_bin_image_id == NULL) ||
        (sahara_dispatch_tbl->get_bin_image_dest == NULL) ||
        (sahara_dispatch_tbl->get_bin_image_size == NULL) ||
        (sahara_dispatch_tbl->get_bin_code_size == NULL) ||
        (sahara_dispatch_tbl->get_bin_cert_chain_size == NULL) ||
        (sahara_dispatch_tbl->get_bin_signature_size == NULL) ||
        (sahara_dispatch_tbl->get_hash_segment_buffer == NULL))
    {
      status = FALSE;
      break;
    }

    // Determine if image should be authenticated
    sahara_shared_data->is_secure = sahara_dispatch_tbl->auth_enabled();
    sahara_auth_tbl = sahara_if->auth_tbl;
   if (((sahara_auth_tbl == NULL) ||
        (sahara_auth_tbl->authenticate == NULL)) &&
        (sahara_if->sahara_mode != SAHARA_MODE_MEMORY_DEBUG))

    {
      status = FALSE;
      break;
    }
    else if (sahara_shared_data->is_secure &&
        (sahara_shared_data->expected_image_type == SAHARA_IMAGE_TYPE_ELF))
    {
        sahara_auth_elf = TRUE;
    }
    else if (sahara_shared_data->is_secure &&
            (sahara_shared_data->expected_image_type == SAHARA_IMAGE_TYPE_BINARY))
    {
        sahara_auth_bin = TRUE;
    }

    sahara_mem_debug_tbl = sahara_if->mem_debug_tbl;
    if (sahara_mem_debug_tbl == NULL)
    {
      sahara_mem_debug_enabled = FALSE;
    }
    else
    {
      if ((sahara_mem_debug_tbl->mem_debug_supported == NULL) ||
          (sahara_mem_debug_tbl->mem_debug_init == NULL) ||
          (sahara_mem_debug_tbl->mem_debug_verify_addr == NULL) ||
          (sahara_mem_debug_tbl->mem_debug_table_addr == NULL) ||
          (sahara_mem_debug_tbl->mem_debug_table_len == NULL) ||
          (sahara_mem_debug_tbl->mem_debug_is_restricted_addr == NULL) ||
          (sahara_mem_debug_tbl->mem_debug_copy_restricted == NULL))
      {
        status = FALSE;
        break;
      }
      else
      {
        sahara_mem_debug_enabled = TRUE;
      }
    }

    if (sahara_shared_data->expected_image_type == SAHARA_IMAGE_TYPE_BINARY)
    {
      sahara_binary_image_info =
        (struct boot_sahara_binary_image_info*)sahara_shared_data->cur_image;

      // Initialize binary image info
      sahara_binary_image_info->image_id = 0;
      // Check the binary image header has been initialized to a valid address
      if (sahara_binary_image_info->header == NULL)
      {
        status = FALSE;
        break;
      }
      sahara_dispatch_tbl->memset(sahara_binary_image_info->header,
                                  0,
                                  sahara_dispatch_tbl->get_bin_header_size());
    }
    else if (sahara_shared_data->expected_image_type == SAHARA_IMAGE_TYPE_ELF)
    {
      sahara_elf_image_info =
        (struct boot_sahara_elf_image_info*)sahara_shared_data->cur_image;
      // Check program headers buffer has been initialized to a valid address
      if (sahara_elf_image_info->prog_headers == NULL)
      {
        status = FALSE;
        break;
      }

      // Initialize ELF image info
      sahara_elf_image_info->image_id = 0;
      sahara_dispatch_tbl->memset(&(sahara_elf_image_info->elf_header),
                                  0,
                                  sizeof(Elf32_Ehdr));
      sahara_elf_image_info->hash_table = NULL;
      sahara_dispatch_tbl->memset(&(sahara_elf_image_info->shared_seg_index),
                                  0,
                                  sizeof(uint32));
      sahara_dispatch_tbl->memset(&(sahara_elf_image_info->entry_address),
                                  0,
                                  sizeof(uint32));
      /* zero initialize progressive_boot_block up to max possible
         prog-header entries */
      sahara_dispatch_tbl->memset((sahara_elf_image_info->prog_headers),
                                  0,
                                  sizeof(struct progressive_boot_block));
    }
    else if (sahara_if->sahara_mode != SAHARA_MODE_MEMORY_DEBUG)
    {
      // Image type not supported and not in memory debug mode
      status = FALSE;
      break;
    }

    // Initialize Sahara state information
    sahara_if->sahara_shared_data->image_rx_complete = FALSE;
    sahara_mode = (enum boot_sahara_mode) sahara_if->sahara_mode;
    sahara_state = SAHARA_STATE_ENTRY;
    sahara_done = FALSE;

    // Initialize hardware driver interface
    if(BULK_SUCCESS != sahara_dispatch_tbl->init())
    {
      status = FALSE;
        break;
    }
  } while (0);

  if(NULL != sahara_if)
  {
    if (status == FALSE)
    {
      // Report error in initialize to Sahara client
      sahara_if->sahara_status = SAHARA_NAK_TARGET_INIT_FAILURE;
    }
    else
    {
      // Initialize sahara status
      sahara_if->sahara_status = SAHARA_STATUS_SUCCESS;
    }
  }

  return status;
}

调用sahara_dispatch_tbl->init函数指针, 即sbl1_sahara.c文件中的sbl_sahara_bulk_init()。

struct qhsusb_dcd_dsc_device* qhsusb_fd_hdlc_init(void (*rx_callback)(struct qhsusb_urb* urb),
                                                  uint8* str_product,
                                                  void (*tx_callback)(struct qhsusb_urb* urb),
                                                  void (*enum_complete)(void),
                                                  void (*error_handler)(void),
                                                  qhsusb_transfer_mode transfer_mode)
#else
struct qhsusb_dcd_dsc_device* qhsusb_fd_hdlc_init(void (*rx_callback)(struct qhsusb_urb* urb),
                                                  uint8* str_product,
                                                  void (*tx_callback)(struct qhsusb_urb* urb),
                                                  void (*enum_complete)(void),
                                                  qhsusb_transfer_mode transfer_mode)
#endif
{
   boolean hdlc_enum_already_exists = FALSE;

   struct qhsusb_urb* urb;

   qhsusb_transfer_mode_g = transfer_mode;
   qhsusb_log(QHSUSB_FD_HDLC_INIT_LOG,0,0);
#ifndef FEATURE_SKIP_SERIAL_STR_UPDATE
   qhsusb_fd_hdlc_update_pid_and_serial_number_string();
#endif
   if ( NULL != str_product ) {
      sw_device.strings[2].descriptor = (struct usb_desc_header*)(void*)str_product;
   }
   /* set up sw -> hw links */
#if defined(FEATURE_QHSUSB_HDLC_CDCACM)
   hdlc_shutdown_in_progress = 0;
   if ( 0 != hdlc_use_cdcacm ) {
      sw_data_eps[0].descriptor = &hdlc_usb_config_cdcacm.ep_in;
      sw_data_eps[1].descriptor = &hdlc_usb_config_cdcacm.ep_out;
      sw_data_ifc.descriptor = &hdlc_usb_config_cdcacm.ifc_data;
      sw_config.descriptor = &hdlc_usb_config_cdcacm.conf1;
      sw_device.descriptor = &hdlc_usb_device_cdcacm;
      sw_config.interfaces = &sw_cdc_control_ifc;
   } else
#endif /* defined(FEATURE_QHSUSB_HDLC_CDCACM) */
   {
    if(QHSUSB_MODE__SER_MS == qhsusb_bulk_mode_g)
    {
      sw_data_eps[0].descriptor = &hdlc_usb_config_obex.ep_in;
      sw_data_eps[1].descriptor = &hdlc_usb_config_obex.ep_out;
      sw_data_ifc.descriptor = &hdlc_usb_config_obex.ifc_data;
      sw_config.descriptor = &hdlc_usb_config_obex.conf1;
    }
    else if (QHSUSB_MODE__SER_ONLY == qhsusb_bulk_mode_g)
    {
        sw_data_ifc.next = NULL;
        sw_data_eps[0].descriptor = &hdlc_usb_config_obex_only.ep_in;
        sw_data_eps[1].descriptor = &hdlc_usb_config_obex_only.ep_out;
        sw_data_ifc.descriptor = &hdlc_usb_config_obex_only.ifc_data;
        sw_config.descriptor = &hdlc_usb_config_obex_only.conf1;
        if(hdlc_usb_device_obex.idProduct == USB_PRODUCT_DIAG_MS )
        {
            /*For serial only mode, change the product ID to 0x9008*/
            hdlc_usb_device_obex.idProduct = USB_PRODUCT_DIAG_ONLY;
            hdlc_usb_device_obex.iSerialNumber = 0x0;
        }
    }
    else if (QHSUSB_MODE__SER_ONLY__DL_MODE == qhsusb_bulk_mode_g)
    {
        sw_data_ifc.next = NULL;
        sw_data_eps[0].descriptor = &hdlc_usb_config_obex_only.ep_in;
        sw_data_eps[1].descriptor = &hdlc_usb_config_obex_only.ep_out;
        sw_data_ifc.descriptor = &hdlc_usb_config_obex_only.ifc_data;
        sw_config.descriptor = &hdlc_usb_config_obex_only.conf1;
        if(hdlc_usb_device_obex.idProduct == USB_PRODUCT_DIAG_MS )
        {
            /*For serial only mode, change the product ID to 0x9008*/
            hdlc_usb_device_obex.idProduct = USB_PRODUCT_DIAG_ONLY;
            hdlc_usb_device_obex.iSerialNumber = 0x0;
        }
    }
      sw_device.descriptor = &hdlc_usb_device_obex;
      sw_config.interfaces = &sw_data_ifc;
#ifdef FEATURE_QHSUSB_MS
    if( QHSUSB_MODE__SER_MS == qhsusb_bulk_mode_g )
    {
        /*Initialize the MS stack when you are in download mode only*/
      qhsusb_fd_ms_init();
    }
#endif /* FEATURE_QHSUSB_MS */
   }
   // Set enum flag for RS bit to be turned ON in qhsusb_dci_init();
   qhsusb_dci_set_enum_flag(TRUE);
   qhsusb_dcd_init(&sw_device);
   user_rx_callback = rx_callback;
   if (tx_callback != NULL)
   {
      user_tx_callback = tx_callback;
   }
   if (enum_complete != NULL)
   {
      user_enum_complete = enum_complete;
   }
#ifdef FEATURE_QHSUSB_SAHARA_DOWNLOAD_PIPO
   if( error_handler !=NULL)
   {
      user_error_handler = error_handler;
   }
#endif
   hdlc_enum_already_exists = dci_skip_enumeration(sw_device.core_id);

   /* Data buffers & URB's */
   /* tx */
   urb                      = &hdlc_tx_urb;
   urb->usb_device          = &sw_device;
   urb->endpoint_address    = sw_data_eps[0].descriptor->bEndpointAddress;
   urb->transfer_buffer_ptr = hdlc_tx_buffer;
   urb->transfer_length     = 0;
   urb->transfer_status     = 0;
   urb->send_zlp            = TRUE;
   urb->complete_callback   = hdlc_tx_callback;
   urb->is_zero_address_chain_required     = FALSE;

   if (transfer_mode == FD_CLIENT_SUPPLIED_BUFFER_MODE) /* Client Supplied Buffer Mode */
   {
   /* rx */
   urb                      = &hdlc_rx_urb;
   urb->usb_device          = &sw_device;
   urb->endpoint_address    = sw_data_eps[1].descriptor->bEndpointAddress;
   urb->transfer_buffer_ptr = NULL; /* to be filled by al layer */
   urb->transfer_length     = 0; /* to be filled by al layer */
   urb->send_zlp            = FALSE;
   urb->complete_callback   = hdlc_rx_callback;
   urb->actual_length       = 0;
   /*Initially set the is_zero_address_chain_required to FALSE*/
   urb->is_zero_address_chain_required     = FALSE;
   }
   else /* Internal Buffer Mode */
   {
     uint8 i = 0;
     for (i = 0; i < 2; i++) {
       urb                      = &hdlc_rx_urb_fixed[i];
       urb->usb_device          = &sw_device;
       urb->endpoint_address    = sw_data_eps[1].descriptor->bEndpointAddress;
       urb->transfer_buffer_ptr = hdlc_rx_buffer_fixed[i];
       urb->transfer_length     = RX_BUF_SIZE_FIXED;
       urb->send_zlp            = FALSE;
       urb->complete_callback   = hdlc_rx_callback_int_buf_mode;
       urb->actual_length       = 0;
       /*Initially set the is_zero_address_chain_required to FALSE*/
       urb->is_zero_address_chain_required     = FALSE;
     }
   }

   /* cdc_notify_urb */
#if defined(FEATURE_QHSUSB_HDLC_CDCACM)
   if ( 0 != hdlc_use_cdcacm ) {
      urb = &cdc_notify_urb;
      urb->usb_device          = &sw_device;
      urb->endpoint_address    = hdlc_usb_config_cdcacm.ep_notify.bEndpointAddress;
      urb->transfer_length     = 0;
      urb->complete_callback   = NULL;
   }
#endif /* defined(FEATURE_QHSUSB_HDLC_CDCACM) */

#ifndef FEATURE_QHSUSB_PBL
   if (hdlc_enum_already_exists)
   {
     /**
     *  We got here without reconnect. enumeration already
     *  completed. Simulate connection and SET_CONFIG
     */
     qhsusb_dcd_port_status_changed(&sw_device); /* attachment, speed... */
     sw_device.address = 1;                      /* don't care, just not 0 */

     qhsusb_dci_cancel_transfer_wo_dqh_dtd(sw_device.core_id, 1, QHSUSB_EP_DIR_RX);
     qhsusb_dci_cancel_transfer_wo_dqh_dtd(sw_device.core_id, 1, QHSUSB_EP_DIR_TX);
     qhsusb_dci_cancel_transfer_wo_dqh_dtd(sw_device.core_id, 2, QHSUSB_EP_DIR_RX);
     qhsusb_dci_cancel_transfer_wo_dqh_dtd(sw_device.core_id, 2, QHSUSB_EP_DIR_TX);

     qhsusb_dcd_set_config(&sw_device, 1);

     if (transfer_mode == FD_USB_INTERNAL_BUFFER_MODE)
     {
       hdlc_init_rx_int_buf_mode(urb->usb_device);
     }
   }
#endif  /* !FEATURE_QHSUSB_PBL */

   return &sw_device;
}

sbl_sahara_bulk_init函数最终调用到qhsusb_fd_ms.c文件中的函数：qhsusb_fd_ms_init ,　

整个初始化过程结束后完成com端口及mass storage枚举过程。

还有！！！ 坑爹的高通，以前不提供生产用的软件下载工具，都得手机厂商自己开发。

高通思想终于改变了，QRD加入后，为手机厂商提供支持多路的软件升级工具：QMSCT 。

虽然设置比较繁琐，不管怎么样，总算可用。上张图吧！

QFIL和QMSCT是使用紧急下载模式，由PBL及下面firehose prog代码完成下载过程。

boot_images/core/storage/tools/deviceprogrammer

五、Crash ramdump

  　  哎，这篇被我写得又长又臭啦。算了，这节就不详细写了。

　　高通平台开放，本身也不稳定，因此做出的手机系统很多都不稳定。因此系统crash发生时，抓取crash现场就非常重要。

　　这里简单说一下，高通平台抓取系统crash现场的几种方法：

　　１、 通过QPST提供的 Memory Debug Application工具，当crash发生时，手机通过usb连接到ＰＣ,　然后用这个工具将crash现场的ram dump到电脑。

　　　显然，这种方法是最可靠的，但它有自身的局限性：不可能每次crash发生时，测试人员或者试用人员、研发人员都刚好在pc旁边。

　　２、　高通平台sbl１提供将crash现场dump到sdcard的功能，如下代码。　这种方法的局性限是：

　　　现在高端手机，都没有外置sdcard的配置的，而内置sdcard又使用fuse ext４文件系统，而sbl１只支持fat文件系统。　

　　　因此，这种不配置外置sdcard的手机，这种方法根本不可行。

/*==========================================================================
        List of SBL1 procedures to execute prior to dload entry
===========================================================================*/
boot_procedure_func_type sbl1_pre_dload_procs[] =
{
  /*-----------------------------------------------------------------------
   * Initialization functions for dload. This has to be the first function
   * called before Dload entry
   *----------------------------------------------------------------------*/
  boot_init_for_dload,

  /*-----------------------------------------------------------------------
   * Setup clocks for ram dump
   *----------------------------------------------------------------------*/
  sbl1_hw_dload_init,

  /*-----------------------------------------------------------------------
   * Ram dump to eMMC raw partition, this function will reset device
   * after successful dump collection if cookie is set
   *----------------------------------------------------------------------*/
  (boot_procedure_func_type) boot_ram_dump_to_raw_parition,


#ifdef FEATURE_BOOT_RAMDUMPS_TO_SD_CARD
  /*----------------------------------------------------------------------
   * Take the Ramdumps to SD card if  cookie file is
   *   present in SD card
   *---------------------------------------------------------------------*/
  boot_ram_dumps_to_sd_card,
#endif /*FEATURE_BOOT_RAMDUMPS_TO_SD_CARD*/

  /*-----------------------------------------------------------------------
   * NULL pointer indicates the end of the list
   *-----------------------------------------------------------------------*/
  NULL
};

　　３、　campact ramdump：这是ＱＲＤ提出来的思路，即：仅dump一部分比较有用的ram到一个专门为crash分配的emmc分区。

    system crash 的主要发生的，ap核的 kernel及service，rpm , modem 等核，而上层java代码不容易导致system crash。

　而现在手机的内置越来越大，１Ｇ、２Ｇ甚至３Ｇ，整个ram都dump到一个特定分区，就浪费emmc空间了。

　因此，compact ramdump就是将一部分关键的ram dump到专门为crash分配的emmc分区。 这样就不依赖于sdcard，也不依赖于usb。而且也不浪费emmc空间。

    高通很多平台都没实现这功能，比如，msm8916, msm8974等，实现思路可以参考QRD8x25平台。

六、其它

     sbl1_hw_init ()  

    boot_smem_store_pon_status()

    sbl1_hw_init_secondary()    

    =========>  pmic  初始化，电池低电时利用内部pmic进行预充电，power key 配置，获取、保存开机原因等。 见：pm_sbl_boot.c

   sbl1_tlmm_init()    //gpio 初始化

   sbl初始化gpio的初始状态代码如下：core/systemdrivers/tlmm/config/msm8916/TLMMChipset.xml

   sbl1_efs_handle_cookies   // efs backup/restore 

  

   boot_populate_ram_partition_table

   ====> 解析iram , imem , system ram 的起始地址，大小等， 并保存到smem: SMEM_USABLE_RAM_PARTITION_TABLE ，传递给lk和kernel。

    见： boot_ram_partition.c ， 这里重点看看ram的情况吧.

/*===========================================================================
**  Function :  sbl1_update_ddr_info
** ==========================================================================
*/
/*!
*
* @brief
*   This funcion will get ddr information from ddr driver and put it in
*   sbl_shared_data.
*
* @param[in] bl_shared_data Pointer to shared data
*
* @par Dependencies
*   Must be called after sbl1_ddr_init
*
* @retval
*   None
*
* @par Side Effects
*   None
*
*/
static void sbl1_update_ddr_info(bl_shared_data_type *bl_shared_data)
{
  static sbl_if_shared_ddr_device_info_type ddr_info;
  ddr_size_info ddr_available = boot_ddr_get_size();
  ddr_size_partition ddr_partition_info = boot_ddr_get_partition();

  boot_share_extended_ddr_info(&ddr_info, &ddr_available, &ddr_partition_info);
  bl_shared_data->sbl_shared_data->ddr_shared_info = &ddr_info;
  boot_set_ddr_info(bl_shared_data);
}

从ddr driver层获取到ddr 类型、大小，cs等信息，保存到sbl_shared_data->ddr_shared_info， 同时保存到sbl全局变量：boot_ddr_size_info

/*===========================================================================

**  Function :  add_system_ram_partitions

** ==========================================================================
*/
/*!
*
* @brief
*    Function adds all the DDR interfaces to ram partition table.
*    Each DDR interface will be added as a single entry in the table.
*    Partition category  will be RAM_PARTITION_SDRAM for all DDR entries.
*
* @param[in] usable_ram_part_tbl_ptr Pointer to the ram partition table that
*                                    should be populated
*
* @par Dependencies
*   None
*
* @retval
*   ram_partition_return_type
*   RAM_PART_SUCCESS        - if function is successful.
*   RAM_PART_TABLE_FULL_ERR - if table is full or not enough space in
*                             the table
*   RAM_PART_CATEGORY_NOT_EXIST_ERR - if unable to populate certain DDR information
*
* @par Side Effects
*   None
*/
static ram_partition_return_type add_system_ram_partitions
(
  usable_ram_part_table_t usable_ram_part_tbl_ptr
)
{
  ram_part_entry_t ram_part_entry_ptr = NULL;
  sbl_if_shared_ddr_info_type *ddr_info = NULL;
  sbl_if_shared_extended_ddr_info_type *ddr_extended_info = NULL;
  uint32 partition_index = 0;
  ram_partition_return_type result = RAM_PART_SUCCESS;
  sbl_if_shared_ddr_device_info_type *ddr_shared_info = boot_get_ddr_info();

  /*ram_part_entry_ptr points to first empty slot in the table*/
  ram_part_entry_ptr =
      &usable_ram_part_tbl_ptr->
        ram_part_entry[usable_ram_part_tbl_ptr->num_partitions];


  /*Loop through ddr_info and add all DDR interfaces into the table*/
  for(; partition_index < ddr_shared_info->noofddr  &&
        usable_ram_part_tbl_ptr->num_partitions < RAM_NUM_PART_ENTRIES;
        partition_index++)
  {
    ddr_info = &ddr_shared_info->ddr_info[partition_index];

    ram_part_entry_ptr->partition_category = RAM_PARTITION_SDRAM;
    ram_part_entry_ptr->start_address = ddr_info->cs_addr;
    ram_part_entry_ptr->length = ddr_info->ramsize << CONVERT_TO_BYTE_SHIFT;
    ram_part_entry_ptr->partition_attribute = RAM_PARTITION_READWRITE;
    ram_part_entry_ptr->partition_domain = RAM_PARTITION_DEFAULT_DOMAIN;
    ram_part_entry_ptr->partition_type = RAM_PARTITION_SYS_MEMORY;

    /*Add the extended ddr information to current ram partition entry*/
    if(ddr_shared_info->ddr_partition_info != NULL)
      {
      ddr_extended_info = &ddr_shared_info->ddr_partition_info[partition_index];

      /*Make sure the base address of ddr extended info matches the current ddr base address*/
      if (ddr_extended_info->sdram_addr != ram_part_entry_ptr->start_address)
      {
        result = RAM_PART_CATEGORY_NOT_EXIST_ERR;
        break;
      }
      ram_part_entry_ptr->num_partitions = ddr_extended_info->num_partitions;
    }

      ram_part_entry_ptr++;
      usable_ram_part_tbl_ptr->num_partitions++;
    }

  return result;
}

  添加如下打印log语句在代码ddr_info = &ddr_shared_info->ddr_info[partition_index];后面，

   snprintf(message, 256, 
            "noofddr %d , cs_addr %d,  ramsize %d", ddr_shared_info->noofddr, ddr_info->cs_addr, ddr_info->ramsize);
    boot_log_message(message);

可以看到如下ddr info log信息：

B -    376400 - noofddr 2 , cs_addr 80000000,  ramsize 1024
B -    376431 - noofddr 2 , cs_addr c0000000,  ramsize 1024

七、sbl1 常用的tools介绍

sbl1常用的tools及源码在如下目录：

boot_images/core/storage/tools/ 

１、 fat32 udisk 生成工具：

boot_images/core/storage/tools/fattool ，

python fatgen.py –fat32 --name=udisk.bin --size=2048   # Generate a 2GB FAT32 container.
python fatadd.py --name=udisk.bin --from=rdcookie.txt  ----add rdcookie.txt into udisk.bin ,for test

这两个py比原来７k平台可执行文件cpfatfs功能更强了，cpfatfs只支持fat16

２、QPST下载工具(shahara)：emmc programmer

 :/boot_images/core/storage/tools/emmcbld/MPRG8974.mbn

３、 T32 Jtag下载工具

boot_images/core/storage/tools/jsdcc/mjsdload.cmm 与jsdcc.elf

４、分区相关工具

boot_images/core/storage/tools/ptool/

ptool.py         //分区生成工具 partition =========> rawprogram0.xml

                    Python ptool.py –x partition.xml:

msp.py          //ubuntu使用：根据 rawprogram0.xml进行升级软件工具

                        

singleimage.py　　//根据singleimage_partition_8974.xml生成single boot image: 8974_msimage.mbn

                    python singleimage.py -x singleimage_partition_8974.xml

lsusb.py       // ls usb

dd.py            // dd command

checksparse.py         //sparse system/cache/userdata image