1. 24 May, 2008 11 commits
    • Pekka Paalanen's avatar
      ftrace: mmiotrace update, #2 · 13829537
      Pekka Paalanen authored
      another weekend, another patch. This should apply on top of my previous patch
      from March 23rd.
      
      Summary of changes:
      - Print PCI device list in output header
      - work around recursive probe hits on SMP
      - refactor dis/arm_kmmio_fault_page() and add check for page levels
      - remove un/reference_kmmio(), the die notifier hook is registered
      permanently into the list
      - explicitly check for single stepping in die notifier callback
      
      I have tested this version on my UP Athlon64 desktop with Nouveau, and
      SMP Core 2 Duo laptop with the proprietary nvidia driver. Both systems
      are 64-bit. One previously unknown bug crept into daylight: the ftrace
      framework's output routines print the first entry last after buffer has
      wrapped around.
      
      The most important regressions compared to non-ftrace mmiotrace at this
      time are:
      - failure of trace_pipe file
      - illegal lines in output file
      - unaware of losing data due to buffer full
      
      Personally I'd like to see these three solved before submitting to
      mainline. Other issues may come up once we know when we lose events.
      Signed-off-by: default avatarPekka Paalanen <pq@iki.fi>
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      13829537
    • Pekka Paalanen's avatar
      ftrace: mmiotrace, updates · bd8ac686
      Pekka Paalanen authored
      here is a patch that makes mmiotrace work almost well within the tracing
      framework. The patch applies on top of my previous patch. I have my own
      output formatting in place now.
      
      Summary of changes:
      - fix the NULL dereference that was due to not calling tracing_reset()
      - add print_line() callback into struct tracer
      - implement print_line() for mmiotrace, producing up-to-spec text
      - add my output header, but that is not really called in the right place
      - rewrote the main structs in mmiotrace
      - added two new trace entry types: TRACE_MMIO_RW and TRACE_MMIO_MAP
      - made some functions in trace.c non-static
      - check current==NULL in tracing_generic_entry_update()
      - fix(?) comparison in trace_seq_printf()
      
      Things seem to work fine except a few issues. Markers (text lines injected
      into mmiotrace log) are missing, I did not feel hacking them in before we
      have variable length entries. My output header is printed only for 'trace'
      file, but not 'trace_pipe'. For some reason, despite my quick fix,
      iter->trace is NULL in print_trace_line() when called from 'trace_pipe'
      file, which means I don't get proper output formatting.
      
      I only tried by loading nouveau.ko, which just detects the card, and that
      is traced fine. I didn't try further. Map, two reads and unmap. Works
      perfectly.
      
      I am missing the information about overflows, I'd prefer to have a
      counter for lost events. I didn't try, but I guess currently there is no
      way of knowning when it overflows?
      
      So, not too far from being fully operational, it seems :-)
      And looking at the diffstat, there also is some 700-900 lines of user space
      code that just became obsolete.
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      bd8ac686
    • Pekka Paalanen's avatar
      ftrace: add mmiotrace plugin · f984b51e
      Pekka Paalanen authored
      On Sat, 22 Mar 2008 13:07:47 +0100
      Ingo Molnar <mingo@elte.hu> wrote:
      
      > > > i'd suggest the following: pull x86.git and sched-devel.git into a
      > > > single tree [the two will combine without rejects]. Then try to add a
      > > > kernel/tracing/trace_mmiotrace.c ftrace plugin. The trace_sysprof.c
      > > > plugin might be a good example.
      > >
      > > I did this and now I have mmiotrace enabled/disabled via the tracing
      > > framework (what do we call this, since ftrace is one of the tracers?).
      >
      > cool! could you send the patches for that? (even if they are not fully
      > functional yet)
      
      Patch attached in the end. Nice to see how much code disappeared. I tried
      to mark all the features I had to break with XXX-comments.
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      f984b51e
    • Pekka Paalanen's avatar
      x86: mmiotrace, preview 2 · d61fc448
      Pekka Paalanen authored
      Kconfig.debug, Makefile and testmmiotrace.c style fixes.
      Use real mutex instead of mutex.
      Fix failure path in register probe func.
      kmmio: RCU read-locked over single stepping.
      Generate mapping id's.
      Make mmio-mod.c built-in and rewrite its locking.
      Add debugfs file to enable/disable mmiotracing.
      kmmio: use irqsave spinlocks.
      Lots of cleanups in mmio-mod.c
      Marker file moved from /proc into debugfs.
      Call mmiotrace entrypoints directly from ioremap.c.
      Signed-off-by: default avatarPekka Paalanen <pq@iki.fi>
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      d61fc448
    • Pekka Paalanen's avatar
      x86: mmiotrace full patch, preview 1 · 0fd0e3da
      Pekka Paalanen authored
      kmmio.c handles the list of mmio probes with callbacks, list of traced
      pages, and attaching into the page fault handler and die notifier. It
      arms, traps and disarms the given pages, this is the core of mmiotrace.
      
      mmio-mod.c is a user interface, hooking into ioremap functions and
      registering the mmio probes. It also decodes the required information
      from trapped mmio accesses via the pre and post callbacks in each probe.
      Currently, hooking into ioremap functions works by redefining the symbols
      of the target (binary) kernel module, so that it calls the traced
      versions of the functions.
      
      The most notable changes done since the last discussion are:
      - kmmio.c is a built-in, not part of the module
      - direct call from fault.c to kmmio.c, removing all dynamic hooks
      - prepare for unregistering probes at any time
      - make kmmio re-initializable and accessible to more than one user
      - rewrite kmmio locking to remove all spinlocks from page fault path
      
      Can I abuse call_rcu() like I do in kmmio.c:unregister_kmmio_probe()
      or is there a better way?
      
      The function called via call_rcu() itself calls call_rcu() again,
      will this work or break? There I need a second grace period for RCU
      after the first grace period for page faults.
      
      Mmiotrace itself (mmio-mod.c) is still a module, I am going to attack
      that next. At some point I will start looking into how to make mmiotrace
      a tracer component of ftrace (thanks for the hint, Ingo). Ftrace should
      make the user space part of mmiotracing as simple as
      'cat /debug/trace/mmio > dump.txt'.
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      0fd0e3da
    • Pekka Paalanen's avatar
      x86 mmiotrace: Use percpu instead of arrays. · f5136380
      Pekka Paalanen authored
      Signed-off-by: default avatarPekka Paalanen <pq@iki.fi>
      Cc: Eric Dumazet <dada1@cosmosbay.com>
      Cc: pq@iki.fi
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      f5136380
    • Pekka Paalanen's avatar
      x86: explicit call to mmiotrace in do_page_fault() · 10c43d2e
      Pekka Paalanen authored
      The custom page fault handler list is replaced with a single function
      pointer. All related functions and variables are renamed for
      mmiotrace.
      Signed-off-by: default avatarPekka Paalanen <pq@iki.fi>
      Cc: Christoph Hellwig <hch@infradead.org>
      Cc: Arjan van de Ven <arjan@infradead.org>
      Cc: pq@iki.fi
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      10c43d2e
    • Pekka Paalanen's avatar
      x86 mmiotrace: comment about user space ABI · 63ffa3e4
      Pekka Paalanen authored
      Signed-off-by: default avatarPekka Paalanen <pq@iki.fi>
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      63ffa3e4
    • Pekka Paalanen's avatar
      x86 mmiotrace: fix relay-buffer-full flag for SMP · fe1ffafa
      Pekka Paalanen authored
      Relay has per-cpu buffers, but mmiotrace was using only a single flag
      for detecting buffer full/not-full transitions. The new code makes
      this per-cpu and actually counts missed events.
      Signed-off-by: default avatarPekka Paalanen <pq@iki.fi>
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      fe1ffafa
    • Pekka Paalanen's avatar
      x86 mmiotrace: use lookup_address() · 75bb8835
      Pekka Paalanen authored
      Use lookup_address() from pageattr.c instead of doing the same
      manually. Also had to EXPORT_SYMBOL_GPL(lookup_address) to make this
      work for modules. This also fixes "undefined symbol 'init_mm'"
      compile error for x86_32.
      Signed-off-by: default avatarPekka Paalanen <pq@iki.fi>
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      75bb8835
    • Pekka Paalanen's avatar
      x86: mmiotrace - trace memory mapped IO · 8b7d89d0
      Pekka Paalanen authored
      Mmiotrace is a tool for trapping memory mapped IO (MMIO) accesses within
      the kernel. It is used for debugging and especially for reverse
      engineering evil binary drivers.
      
      Mmiotrace works by wrapping the ioremap family of kernel functions and
      marking the returned pages as not present. Access to the IO memory
      triggers a page fault, which will be handled by mmiotrace's custom page
      fault handler. This will single-step the faulted instruction with the
      MMIO page marked as present. Access logs are directed to user space via
      relay and debug_fs.
      
      This page fault approach is necessary, because binary drivers have
      readl/writel etc. calls inlined and therefore extremely difficult to
      trap with with e.g. kprobes.
      
      This patch depends on the custom page fault handlers patch.
      Signed-off-by: default avatarPekka Paalanen <pq@iki.fi>
      Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
      Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
      8b7d89d0
  2. 23 May, 2008 29 commits