1. 12 3月, 2009 1 次提交
  2. 09 3月, 2009 1 次提交
    • S
      x86 mmiotrace: fix remove_kmmio_fault_pages() · d0fc63f7
      Stuart Bennett 提交于
      Impact: fix race+crash in mmiotrace
      
      The list manipulation in remove_kmmio_fault_pages() was broken. If more
      than one consecutive kmmio_fault_page was re-added during the grace
      period between unregister_kmmio_probe() and remove_kmmio_fault_pages(),
      the list manipulation failed to remove pages from the release list.
      
      After a second grace period the pages get into rcu_free_kmmio_fault_pages()
      and raise a BUG_ON() kernel crash.
      
      The list manipulation is fixed to properly remove pages from the release
      list.
      
      This bug has been present from the very beginning of mmiotrace in the
      mainline kernel. It was introduced in 0fd0e3da ("x86: mmiotrace full
      patch, preview 1");
      
      An urgent fix for Linus. Tested by Stuart (on 32-bit) and Pekka
      (on amd and intel 64-bit systems, nouveau and nvidia proprietary).
      Signed-off-by: NStuart Bennett <stuart@freedesktop.org>
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      LKML-Reference: <20090308202135.34933feb@daedalus.pq.iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      d0fc63f7
  3. 02 3月, 2009 5 次提交
    • P
      x86 mmiotrace: fix race with release_kmmio_fault_page() · 340430c5
      Pekka Paalanen 提交于
      There was a theoretical possibility to a race between arming a page in
      post_kmmio_handler() and disarming the page in
      release_kmmio_fault_page():
      
      cpu0                             cpu1
      ------------------------------------------------------------------
      mmiotrace shutdown
      enter release_kmmio_fault_page
                                       fault on the page
                                       disarm the page
      disarm the page
                                       handle the MMIO access
                                       re-arm the page
      put the page on release list
      remove_kmmio_fault_pages()
                                       fault on the page
                                       page not known to mmiotrace
                                       fall back to do_page_fault()
                                       *KABOOM*
      
      (This scenario also shows the double disarm case which is allowed.)
      
      Fixed by acquiring kmmio_lock in post_kmmio_handler() and checking
      if the page is being released from mmiotrace.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Cc: Stuart Bennett <stuart@freedesktop.org>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      340430c5
    • S
      x86 mmiotrace: improve handling of secondary faults · 3e39aa15
      Stuart Bennett 提交于
      Upgrade some kmmio.c debug messages to warnings.
      Allow secondary faults on probed pages to fall through, and only log
      secondary faults that are not due to non-present pages.
      
      Patch edited by Pekka Paalanen.
      Signed-off-by: NStuart Bennett <stuart@freedesktop.org>
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      3e39aa15
    • P
      x86 mmiotrace: split set_page_presence() · 0b700a6a
      Pekka Paalanen 提交于
      From 36772dcb6ffbbb68254cbfc379a103acd2fbfefc Mon Sep 17 00:00:00 2001
      From: Pekka Paalanen <pq@iki.fi>
      Date: Sat, 28 Feb 2009 21:34:59 +0200
      
      Split set_page_presence() in kmmio.c into two more functions set_pmd_presence()
      and set_pte_presence(). Purely code reorganization, no functional changes.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Cc: Stuart Bennett <stuart@freedesktop.org>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      0b700a6a
    • P
      x86 mmiotrace: fix save/restore page table state · 5359b585
      Pekka Paalanen 提交于
      From baa99e2b32449ec7bf147c234adfa444caecac8a Mon Sep 17 00:00:00 2001
      From: Pekka Paalanen <pq@iki.fi>
      Date: Sun, 22 Feb 2009 20:02:43 +0200
      
      Blindly setting _PAGE_PRESENT in disarm_kmmio_fault_page() overlooks the
      possibility, that the page was not present when it was armed.
      
      Make arm_kmmio_fault_page() store the previous page presence in struct
      kmmio_fault_page and use it on disarm.
      
      This patch was originally written by Stuart Bennett, but Pekka Paalanen
      rewrote it a little different.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Cc: Stuart Bennett <stuart@freedesktop.org>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      5359b585
    • S
      x86 mmiotrace: WARN_ONCE if dis/arming a page fails · e9d54cae
      Stuart Bennett 提交于
      Print a full warning once, if arming or disarming a page fails.
      
      Also, if initial arming fails, do not handle the page further. This
      avoids the possibility of a page failing to arm and then later claiming
      to have handled any fault on that page.
      
      WARN_ONCE added by Pekka Paalanen.
      Signed-off-by: NStuart Bennett <stuart@freedesktop.org>
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      e9d54cae
  4. 25 5月, 2008 1 次提交
  5. 24 5月, 2008 12 次提交
    • P
      x86 mmiotrace: page level is unsigned · 790e2a29
      Pekka Paalanen 提交于
      Fixes some sparse warnings.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      790e2a29
    • P
      x86 mmiotrace: fix page-unaligned ioremaps · 87e547fe
      Pekka Paalanen 提交于
      mmiotrace_ioremap() expects to receive the original unaligned map phys address
      and size. Also fix {un,}register_kmmio_probe() to deal properly with
      unaligned size.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      87e547fe
    • P
      mmiotrace: code style cleanups · 970e6fa0
      Pekka Paalanen 提交于
      From c2da03771e29159627c5c7b9509ec70bce9f91ee Mon Sep 17 00:00:00 2001
      From: Pekka Paalanen <pq@iki.fi>
      Date: Mon, 28 Apr 2008 21:25:22 +0300
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      970e6fa0
    • P
      x86 mmiotrace: move files into arch/x86/mm/. · ff3a3e9b
      Pekka Paalanen 提交于
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      ff3a3e9b
    • I
      mmiotrace: cleanup · 49023168
      Ingo Molnar 提交于
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      49023168
    • P
      ftrace: mmiotrace update, #2 · 13829537
      Pekka Paalanen 提交于
      another weekend, another patch. This should apply on top of my previous patch
      from March 23rd.
      
      Summary of changes:
      - Print PCI device list in output header
      - work around recursive probe hits on SMP
      - refactor dis/arm_kmmio_fault_page() and add check for page levels
      - remove un/reference_kmmio(), the die notifier hook is registered
      permanently into the list
      - explicitly check for single stepping in die notifier callback
      
      I have tested this version on my UP Athlon64 desktop with Nouveau, and
      SMP Core 2 Duo laptop with the proprietary nvidia driver. Both systems
      are 64-bit. One previously unknown bug crept into daylight: the ftrace
      framework's output routines print the first entry last after buffer has
      wrapped around.
      
      The most important regressions compared to non-ftrace mmiotrace at this
      time are:
      - failure of trace_pipe file
      - illegal lines in output file
      - unaware of losing data due to buffer full
      
      Personally I'd like to see these three solved before submitting to
      mainline. Other issues may come up once we know when we lose events.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      13829537
    • P
      x86: mmiotrace, preview 2 · d61fc448
      Pekka Paalanen 提交于
      Kconfig.debug, Makefile and testmmiotrace.c style fixes.
      Use real mutex instead of mutex.
      Fix failure path in register probe func.
      kmmio: RCU read-locked over single stepping.
      Generate mapping id's.
      Make mmio-mod.c built-in and rewrite its locking.
      Add debugfs file to enable/disable mmiotracing.
      kmmio: use irqsave spinlocks.
      Lots of cleanups in mmio-mod.c
      Marker file moved from /proc into debugfs.
      Call mmiotrace entrypoints directly from ioremap.c.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      d61fc448
    • P
      x86: mmiotrace full patch, preview 1 · 0fd0e3da
      Pekka Paalanen 提交于
      kmmio.c handles the list of mmio probes with callbacks, list of traced
      pages, and attaching into the page fault handler and die notifier. It
      arms, traps and disarms the given pages, this is the core of mmiotrace.
      
      mmio-mod.c is a user interface, hooking into ioremap functions and
      registering the mmio probes. It also decodes the required information
      from trapped mmio accesses via the pre and post callbacks in each probe.
      Currently, hooking into ioremap functions works by redefining the symbols
      of the target (binary) kernel module, so that it calls the traced
      versions of the functions.
      
      The most notable changes done since the last discussion are:
      - kmmio.c is a built-in, not part of the module
      - direct call from fault.c to kmmio.c, removing all dynamic hooks
      - prepare for unregistering probes at any time
      - make kmmio re-initializable and accessible to more than one user
      - rewrite kmmio locking to remove all spinlocks from page fault path
      
      Can I abuse call_rcu() like I do in kmmio.c:unregister_kmmio_probe()
      or is there a better way?
      
      The function called via call_rcu() itself calls call_rcu() again,
      will this work or break? There I need a second grace period for RCU
      after the first grace period for page faults.
      
      Mmiotrace itself (mmio-mod.c) is still a module, I am going to attack
      that next. At some point I will start looking into how to make mmiotrace
      a tracer component of ftrace (thanks for the hint, Ingo). Ftrace should
      make the user space part of mmiotracing as simple as
      'cat /debug/trace/mmio > dump.txt'.
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      0fd0e3da
    • P
      x86 mmiotrace: Use percpu instead of arrays. · f5136380
      Pekka Paalanen 提交于
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Cc: Eric Dumazet <dada1@cosmosbay.com>
      Cc: pq@iki.fi
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      f5136380
    • P
      x86: explicit call to mmiotrace in do_page_fault() · 10c43d2e
      Pekka Paalanen 提交于
      The custom page fault handler list is replaced with a single function
      pointer. All related functions and variables are renamed for
      mmiotrace.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Cc: Christoph Hellwig <hch@infradead.org>
      Cc: Arjan van de Ven <arjan@infradead.org>
      Cc: pq@iki.fi
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      10c43d2e
    • P
      x86 mmiotrace: use lookup_address() · 75bb8835
      Pekka Paalanen 提交于
      Use lookup_address() from pageattr.c instead of doing the same
      manually. Also had to EXPORT_SYMBOL_GPL(lookup_address) to make this
      work for modules. This also fixes "undefined symbol 'init_mm'"
      compile error for x86_32.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      75bb8835
    • P
      x86: mmiotrace - trace memory mapped IO · 8b7d89d0
      Pekka Paalanen 提交于
      Mmiotrace is a tool for trapping memory mapped IO (MMIO) accesses within
      the kernel. It is used for debugging and especially for reverse
      engineering evil binary drivers.
      
      Mmiotrace works by wrapping the ioremap family of kernel functions and
      marking the returned pages as not present. Access to the IO memory
      triggers a page fault, which will be handled by mmiotrace's custom page
      fault handler. This will single-step the faulted instruction with the
      MMIO page marked as present. Access logs are directed to user space via
      relay and debug_fs.
      
      This page fault approach is necessary, because binary drivers have
      readl/writel etc. calls inlined and therefore extremely difficult to
      trap with with e.g. kprobes.
      
      This patch depends on the custom page fault handlers patch.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      8b7d89d0