1. 12 10月, 2009 1 次提交
  2. 02 3月, 2009 2 次提交
    • P
      x86: add far read test to testmmiotrace · 5ff93697
      Pekka Paalanen 提交于
      Apparently pages far into an ioremapped region might not actually be
      mapped during ioremap(). Add an optional read test to try to trigger a
      multiply faulting MMIO access. Also add more messages to the kernel log
      to help debugging.
      
      This patch is based on a patch suggested by
      Stuart Bennett <stuart@freedesktop.org>
      who discovered bugs in mmiotrace related to normal kernel space faults.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Cc: Stuart Bennett <stuart@freedesktop.org>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      5ff93697
    • P
      x86: count errors in testmmiotrace.ko · fab852aa
      Pekka Paalanen 提交于
      Check the read values against the written values in the MMIO read/write
      test. This test shows if the given MMIO test area really works as
      memory, which is a prerequisite for a successful mmiotrace test.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Cc: Stuart Bennett <stuart@freedesktop.org>
      Cc: Steven Rostedt <rostedt@goodmis.org>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      fab852aa
  3. 14 10月, 2008 1 次提交
  4. 24 5月, 2008 5 次提交
    • P
      mmiotrace: code style cleanups · 970e6fa0
      Pekka Paalanen 提交于
      From c2da03771e29159627c5c7b9509ec70bce9f91ee Mon Sep 17 00:00:00 2001
      From: Pekka Paalanen <pq@iki.fi>
      Date: Mon, 28 Apr 2008 21:25:22 +0300
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      970e6fa0
    • P
      x86 mmiotrace: move files into arch/x86/mm/. · ff3a3e9b
      Pekka Paalanen 提交于
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      ff3a3e9b
    • P
      x86: mmiotrace, preview 2 · d61fc448
      Pekka Paalanen 提交于
      Kconfig.debug, Makefile and testmmiotrace.c style fixes.
      Use real mutex instead of mutex.
      Fix failure path in register probe func.
      kmmio: RCU read-locked over single stepping.
      Generate mapping id's.
      Make mmio-mod.c built-in and rewrite its locking.
      Add debugfs file to enable/disable mmiotracing.
      kmmio: use irqsave spinlocks.
      Lots of cleanups in mmio-mod.c
      Marker file moved from /proc into debugfs.
      Call mmiotrace entrypoints directly from ioremap.c.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      d61fc448
    • P
      x86: mmiotrace full patch, preview 1 · 0fd0e3da
      Pekka Paalanen 提交于
      kmmio.c handles the list of mmio probes with callbacks, list of traced
      pages, and attaching into the page fault handler and die notifier. It
      arms, traps and disarms the given pages, this is the core of mmiotrace.
      
      mmio-mod.c is a user interface, hooking into ioremap functions and
      registering the mmio probes. It also decodes the required information
      from trapped mmio accesses via the pre and post callbacks in each probe.
      Currently, hooking into ioremap functions works by redefining the symbols
      of the target (binary) kernel module, so that it calls the traced
      versions of the functions.
      
      The most notable changes done since the last discussion are:
      - kmmio.c is a built-in, not part of the module
      - direct call from fault.c to kmmio.c, removing all dynamic hooks
      - prepare for unregistering probes at any time
      - make kmmio re-initializable and accessible to more than one user
      - rewrite kmmio locking to remove all spinlocks from page fault path
      
      Can I abuse call_rcu() like I do in kmmio.c:unregister_kmmio_probe()
      or is there a better way?
      
      The function called via call_rcu() itself calls call_rcu() again,
      will this work or break? There I need a second grace period for RCU
      after the first grace period for page faults.
      
      Mmiotrace itself (mmio-mod.c) is still a module, I am going to attack
      that next. At some point I will start looking into how to make mmiotrace
      a tracer component of ftrace (thanks for the hint, Ingo). Ftrace should
      make the user space part of mmiotracing as simple as
      'cat /debug/trace/mmio > dump.txt'.
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      0fd0e3da
    • P
      x86: mmiotrace - trace memory mapped IO · 8b7d89d0
      Pekka Paalanen 提交于
      Mmiotrace is a tool for trapping memory mapped IO (MMIO) accesses within
      the kernel. It is used for debugging and especially for reverse
      engineering evil binary drivers.
      
      Mmiotrace works by wrapping the ioremap family of kernel functions and
      marking the returned pages as not present. Access to the IO memory
      triggers a page fault, which will be handled by mmiotrace's custom page
      fault handler. This will single-step the faulted instruction with the
      MMIO page marked as present. Access logs are directed to user space via
      relay and debug_fs.
      
      This page fault approach is necessary, because binary drivers have
      readl/writel etc. calls inlined and therefore extremely difficult to
      trap with with e.g. kprobes.
      
      This patch depends on the custom page fault handlers patch.
      Signed-off-by: NPekka Paalanen <pq@iki.fi>
      Signed-off-by: NIngo Molnar <mingo@elte.hu>
      Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
      8b7d89d0