Skip to content

plat-qcom: Introduce diagnostic ring buffer for post-mortem trace capture#7839

Merged
jenswikl merged 6 commits into
OP-TEE:masterfrom
zelvam95:feature/plat-qcom-diag-driver
Jun 23, 2026
Merged

plat-qcom: Introduce diagnostic ring buffer for post-mortem trace capture#7839
jenswikl merged 6 commits into
OP-TEE:masterfrom
zelvam95:feature/plat-qcom-diag-driver

Conversation

@zelvam95

Copy link
Copy Markdown
Contributor

Summary

On Qualcomm production devices the UART is typically disabled, and when
present it is shared between the non-secure (Linux kernel) and secure
(OP-TEE) execution environments. Consequently, the UART cannot serve as
a dedicated console for OP-TEE, and trace output is unavailable for
post-mortem analysis after a crash or reset.

This series introduces a diagnostic ring buffer in IMEM in which OP-TEE
records its log output. Because IMEM contents are preserved across a
warm reset, the captured trace can be retrieved out of band by an
external reader for debug and post-mortem use.

Design

The buffer is a write-only circular buffer placed in a fixed region of
IMEM. A header at the start of the region records the version, a magic
value indicating buffer state, the buffer offset and size, a wrap
counter, and the current write head. An external reader uses the
header to walk the buffer and reconstruct the log content.

The implementation exposes two functions:

  • qcom_diag_log_init() initializes the buffer header and the
    write-only circular log region in IMEM. Logging is suppressed when
    the SoC is in DLOAD (download) mode, as indicated by the TCSR
    boot-misc register.
  • qcom_diag_log_puts() appends a string to the circular buffer. On
    overflow the buffer wraps in place and a saturating wrap counter
    records the number of overruns.

These are wired into OP-TEE's trace subsystem by overriding the
plat_trace_init() and plat_trace_ext_puts() weak hooks defined in
core, so every trace line emitted by OP-TEE core is mirrored into the
IMEM buffer.

The feature is gated by CFG_QCOM_DIAG_LOG, which defaults to the
value of CFG_TEE_CORE_DEBUG on each enabled target. When disabled,
the buffer is not initialized and the trace hooks are no-ops.

Patches in this series

  1. plat-qcom: Add support for diagnostic ring buffer
    Introduce the diagnostic ring buffer in IMEM, including the
    qcom_diag_log_init() and qcom_diag_log_puts() interface.

  2. plat-qcom: Wire diagnostic ring buffer into OP-TEE trace path
    Override plat_trace_init() and plat_trace_ext_puts() so that
    OP-TEE trace output is captured in the ring buffer.

  3. plat-qcom: bobcat: Enable diagnostic ring buffer on ipq96xx and ipq52xx
    Add the buffer layout and per-target IMEM base/size for the bobcat
    architecture, and default CFG_QCOM_DIAG_LOG to
    CFG_TEE_CORE_DEBUG on both targets.

  4. plat-qcom: hoya: Enable diagnostic ring buffer on kodiak and lemans
    Same as above for the hoya architecture and its kodiak / lemans
    targets.

Testing

  • Built debug images for hoya/kodiak, hoya/lemans, bobcat/ipq96xx, and
    bobcat/ipq52xx with CFG_QCOM_DIAG_LOG=y and confirmed OP-TEE trace
    output is captured in the IMEM ring buffer and survives a warm
    reset.
  • Built release images with CFG_QCOM_DIAG_LOG=n (the default for
    non-debug builds) and confirmed there is no behavioural change and
    no IMEM region is reserved.
  • Verified that DLOAD mode (TCSR boot-misc register set to the
    download cookie) suppresses initialization of the buffer.

@github-actions

Copy link
Copy Markdown

FYI @ldts @b49020

@zelvam95

Copy link
Copy Markdown
Contributor Author

Gentle Reminder to help review this and share any comments @ldts / @b49020

@b49020

b49020 commented Jun 15, 2026

Copy link
Copy Markdown
Member

@zelvam95 please add CI build option for this DIAG driver. Similarly we need CI to build fuseprov drivers too, can you add the build config option for that too?

For both options, you can use lemans target.

@zelvam95

Copy link
Copy Markdown
Contributor Author

@zelvam95 please add CI build option for this DIAG driver. Similarly we need CI to build fuseprov drivers too, can you add the build config option for that too?

For both options, you can use lemans target.

Have added the CI build option for both these drivers for lemans target. Let me know if there is any other feedback.

@zelvam95

Copy link
Copy Markdown
Contributor Author

Gentle Reminder to share any other review comments/feedback @ldts / @b49020

@b49020

b49020 commented Jun 18, 2026

Copy link
Copy Markdown
Member

Based on review already done for this patch-set here: qualcomm-linux/optee_os#7, feel free to add following for the series:

Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

@zelvam95 zelvam95 force-pushed the feature/plat-qcom-diag-driver branch from 35f6cfe to 087cd01 Compare June 18, 2026 10:23
@zelvam95

Copy link
Copy Markdown
Contributor Author

Based on review already done for this patch-set here: qualcomm-linux/optee_os#7, feel free to add following for the series:

Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

Thanks Sumit, Have added the tags.

@jenswikl, Please let me know if you have any feedback/comments and if not, requesting to kindly help merge this.

Comment thread core/arch/arm/plat-qcom/diag_log.c Outdated
Comment thread core/arch/arm/plat-qcom/bobcat/ipq52xx/target.mk Outdated
Comment thread .github/workflows/ci.yml Outdated
@zelvam95 zelvam95 force-pushed the feature/plat-qcom-diag-driver branch from 087cd01 to 4aa72bf Compare June 19, 2026 05:59
@zelvam95

zelvam95 commented Jun 19, 2026

Copy link
Copy Markdown
Contributor Author

@b49020 / @ldts , Have added one more FUSEPROV config clean up commit based on the feedback I received for DIAG Log^. Please help to review that patch as well & the latest commits and let me know if you have any comments.

@jenswikl, Have addressed the review comments as part of the latest patchset pushed. Let me know if this looks good & if you have any other feedback?

@zelvam95 zelvam95 force-pushed the feature/plat-qcom-diag-driver branch from 6b7ec07 to b625bd8 Compare June 19, 2026 07:53
@ldts

ldts commented Jun 22, 2026

Copy link
Copy Markdown
Contributor

Reviewed-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>

Comment thread core/arch/arm/plat-qcom/hoya/kodiak/target.mk Outdated
zelvam95 added 5 commits June 22, 2026 17:13
On Qualcomm production devices the UART is typically disabled or
shared with the non-secure world, so it cannot be used as a
dedicated console for OP-TEE trace output.

Introduce a diagnostic ring buffer driver that records OP-TEE log
data in IMEM. Because IMEM contents are preserved across a warm
reset, the captured trace can be retrieved out of band by an
external reader for debug and post-mortem use.

The following interface is exposed:

  - qcom_diag_log_init(): initializes the buffer header and the
    write-only circular log region in IMEM. Logging is suppressed
    when the SoC is in DLOAD (download) mode, as indicated by the
    TCSR boot-misc register.

  - qcom_diag_log_puts(): appends a string to the circular buffer.
    On overflow the buffer wraps in place and a saturating wrap
    counter records the number of overruns.

Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@qti.qualcomm.com>
Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
The diagnostic ring buffer added in the previous commit is only
populated when something writes to it. Hook it into the OP-TEE
trace subsystem so that every trace line emitted by the core is
also captured in IMEM.

Override the two weak trace hooks provided by the core:

  - plat_trace_init() initializes the ring buffer early during
    console setup, before any trace output is emitted.

  - plat_trace_ext_puts() forwards each trace line to the ring
    buffer in addition to the regular console output.

With this in place, OP-TEE log output is preserved in IMEM on all
Qualcomm platforms that enable CFG_QCOM_DIAG_LOG, and can be read
out of band by an external tool for debug and post-mortem use.

Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@qti.qualcomm.com>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Reviewed-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
Add the platform configuration required by the diagnostic ring
buffer on the bobcat architecture, including the buffer layout
shared by all bobcat targets and the IMEM base and size for ipq96xx
and ipq52xx.

Default CFG_QCOM_DIAG_LOG to CFG_TEE_CORE_DEBUG on both targets so
that the buffer is enabled on debug builds.

Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@qti.qualcomm.com>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Reviewed-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
Add the platform configuration required by the diagnostic ring
buffer on the hoya architecture, including the buffer layout shared
by all hoya targets and the IMEM base and size for kodiak and
lemans.

Default CFG_QCOM_DIAG_LOG to CFG_TEE_CORE_DEBUG on both targets so
that the buffer is enabled on debug builds.

Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@qti.qualcomm.com>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Reviewed-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
Add PLATFORM=qcom-lemans builds that enable the diagnostic log and the
QFPROM fuse provisioning drivers so that both code paths are covered by
CI.

CFG_QCOM_DIAG_LOG=y builds the diagnostic ring buffer logging driver.
CFG_QFPROM_PROGRAMMING=y CFG_QCOM_QFPROM_FUSEPROV=y builds the fuse
provisioning path, which also pulls in the CMD_DB, RPMH client and
QFPROM drivers through its dependencies.

Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@qti.qualcomm.com>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Reviewed-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
@zelvam95 zelvam95 force-pushed the feature/plat-qcom-diag-driver branch from b625bd8 to dd0aa3a Compare June 22, 2026 11:45
@zelvam95

Copy link
Copy Markdown
Contributor Author

Thanks @ldts. Have added the tag.
@b49020, Have addressed the fuseprov config enforcement. Let me know if you have any other feedback.

@b49020

b49020 commented Jun 22, 2026

Copy link
Copy Markdown
Member

For the QFPROM commit:

Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

The QFPROM fuse provisioning feature cannot operate without the CMD_DB,
RPMH client and QFPROM drivers. Previously these were pulled in as soft
defaults (?=) derived from CFG_QCOM_QFPROM_FUSEPROV, and consistency was
separately validated with cfg-depends-all checks in the driver and
platform sub.mk files.

Centralise this in the Hoya kodiak and lemans targets: when
CFG_QCOM_QFPROM_FUSEPROV is enabled, force CFG_QCOM_CMD_DB,
CFG_QCOM_RPMH_CLIENT and CFG_QCOM_QFPROM on. This guarantees the
dependencies are always satisfied and makes the redundant cfg-depends-all
checks in core/drivers/qcom/sub.mk and core/arch/arm/plat-qcom/sub.mk
unnecessary, so drop them.

Also define CFG_INSECURE early in the Qualcomm conf.mk so the
CFG_INSECURE-based default of CFG_QCOM_QFPROM_FUSEPROV is evaluated
correctly (mk/config.mk is included after the platform conf.mk from
core/core.mk).

Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@qti.qualcomm.com>
Reviewed-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
@zelvam95 zelvam95 force-pushed the feature/plat-qcom-diag-driver branch from dd0aa3a to 611de50 Compare June 22, 2026 12:01
@zelvam95

Copy link
Copy Markdown
Contributor Author

Thanks @b49020.
@jenswikl, Gentle Reminder - Let me know if you have any other specific feedback/review comments.

@zelvam95 zelvam95 requested a review from jenswikl June 22, 2026 12:02
@jenswikl

Copy link
Copy Markdown
Contributor

Looks good, I'll merge this when CI tests have passed.

@jenswikl jenswikl merged commit 7c38cc3 into OP-TEE:master Jun 23, 2026
57 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants