[Motorola Photon Q 4G LTE] mrvek:
Hi.

Just to point few more-less interesting findings.

1) modem watchdog bites in aiplane mode

2) modem watchdog bites without sim card present

3) modem crash log (/data/misc/ril/bp-dumps/modem.log) seems to be successfully written only when modem crashes on SMSM_RESET (which seems to be some bit set by modem). On watchdog bites 16Kb of nothing (0x0) is written

4) according to some reports of other qc baseband crashes the log_modem_sfr() sholud result in "SFR Init: wdog or kernel error suspected." (as seen in smem ramdump), but instead we get "modem subsystem failure reason: (unknown, smem_get_entry failed)."

5) ramdump_modem_{sw/fw}.bin is a lot of 0x0 - this and 4 might indicate some memory misconfiguration or similar issue

The most common "error" seen in smem ramdump is: "gfw_command_process.c

Invalid value passed to GFW in generic config command value passed %d, setting to %d", followed by some binary data which I have no clue how to intrepret. This string can significatly vary in count so it might not be fatal (dumping smem during normal operation and on 3.0.y might be interesting)

Stack dump is as below in vast majority of cases. Assuming it is correct, the issue is strongly related to idle states/suspend. On the other hand, according to some docs, modem disables its watchdog during certain power collapse periods (not clearly specified which).

The most reliable way I was able to find to trigger the modem crash is by toggling screen on/off several times (could be 2-3, might take more, but never fails).

Also, modem's tasks timeout is probably 60s for all tasks except one: "rxtx" (judging by modem crash log and assuming my interpretation of "Timeout" and "Count" table headers is correct. "Is_Blocked" always points to "xtm" and "tlm" tasks, whatever it may mean)

<3>[ 138.293270,0] Watchdog bite received from modem software!
<4>[ 138.293728,0] [<c00133bc>] (unwind_backtrace+0x0/0xe0) from [<c0057a3c>] (modem_wdog_bite_irq+0x20/0x58)
<4>[ 138.294094,0] [<c0057a3c>] (modem_wdog_bite_irq+0x20/0x58) from [<c00d1f28>] (handle_irq_event_percpu+0x84/0x26c)
<4>[ 138.294491,0] [<c00d1f28>] (handle_irq_event_percpu+0x84/0x26c) from [<c00d214c>] (handle_irq_event+0x3c/0x5c)
<4>[ 138.294704,0] [<c00d214c>] (handle_irq_event+0x3c/0x5c) from [<c00d4c60>] (handle_fasteoi_irq+0xd8/0x124)
<4>[ 138.295070,0] [<c00d4c60>] (handle_fasteoi_irq+0xd8/0x124) from [<c00d1834>] (generic_handle_irq+0x20/0x30)
<4>[ 138.295467,0] [<c00d1834>] (generic_handle_irq+0x20/0x30) from [<c000e240>] (handle_IRQ+0x7c/0xc0)
<4>[ 138.295833,0] [<c000e240>] (handle_IRQ+0x7c/0xc0) from [<c00085e8>] (gic_handle_irq+0x64/0xb4)
<4>[ 138.296200,0] [<c00085e8>] (gic_handle_irq+0x64/0xb4) from [<c07fd7c0>] (__irq_svc+0x40/0x74)
<4>[ 138.296413,0] Exception stack(0xc0e05f18 to 0xc0e05f60)
<4>[ 138.296749,0] 5f00: 00000000 00000018
<4>[ 138.297085,0] 5f20: 00000004 00000000 c2de75c0 00000000 c2de75c0 c0e51178 00000000 511f04d0
<4>[ 138.297298,0] 5f40: 00000000 00000000 00000000 c0e05f60 c0052704 c0058160 60000013 ffffffff
<4>[ 138.297695,0] [<c07fd7c0>] (__irq_svc+0x40/0x74) from [<c0058160>] (msm_cpuidle_enter+0x54/0x58)
<4>[ 138.298061,0] [<c0058160>] (msm_cpuidle_enter+0x54/0x58) from [<c0563404>] (cpuidle_enter+0x14/0x18)
<4>[ 138.298428,0] [<c0563404>] (cpuidle_enter+0x14/0x18) from [<c05637d4>] (cpuidle_enter_state+0x14/0x6c)
<4>[ 138.298794,0] [<c05637d4>] (cpuidle_enter_state+0x14/0x6c) from [<c056399c>] (cpuidle_idle_call+0x170/0x33c)
<4>[ 138.299038,0] [<c056399c>] (cpuidle_idle_call+0x170/0x33c) from [<c000e7e0>] (cpu_idle+0x58/0xe8)
<4>[ 138.299404,0] [<c000e7e0>] (cpu_idle+0x58/0xe8) from [<c07c8a14>] (rest_init+0x88/0xa0)
<4>[ 138.299771,0] [<c07c8a14>] (rest_init+0x88/0xa0) from [<c0d00b4c>] (start_kernel+0x41c/0x480)
<3>[ 138.300137,0] modem subsystem failure reason: (unknown, smem_get_entry failed).
<6>[ 138.300350,0] subsys-restart: subsystem_restart_dev(): Restart sequence requested for modem, restart_level = 3.

How do you keep track of proprietary blobs and which are compatible? I remember that some blob (libaducal?) was from a samsung device (S3?) at some point. More importantly, how do you know which blobs need to be updated when kernel updates? Is that perhaps documented somewhere? Keeping track of git history is causing me a lot of problems with this so I'd appreciate any pointers to right direction.

Btw., why are OEMs and chipset manufacturers so rigid on their baseband, ril, etc. sources, documentation and datasheets? Solely because of "security through obsucrity"?