err.no Git - linux-2.6/blob - arch/x86/kernel/mmiotrace/mmio-mod.c

   1 /*
   2  * This program is free software; you can redistribute it and/or modify
   3  * it under the terms of the GNU General Public License as published by
   4  * the Free Software Foundation; either version 2 of the License, or
   5  * (at your option) any later version.
   6  *
   7  * This program is distributed in the hope that it will be useful,
   8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
   9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  10  * GNU General Public License for more details.
  11  *
  12  * You should have received a copy of the GNU General Public License
  13  * along with this program; if not, write to the Free Software
  14  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  15  *
  16  * Copyright (C) IBM Corporation, 2005
  17  *               Jeff Muizelaar, 2006, 2007
  18  *               Pekka Paalanen, 2008 <pq@iki.fi>
  19  *
  20  * Derived from the read-mod example from relay-examples by Tom Zanussi.
  21  */
  22 #include <linux/module.h>
  23 #include <linux/relay.h>
  24 #include <linux/debugfs.h>
  25 #include <linux/proc_fs.h>
  26 #include <asm/io.h>
  27 #include <linux/version.h>
  28 #include <linux/kallsyms.h>
  29 #include <asm/pgtable.h>
  30 #include <linux/mmiotrace.h>
  31 #include <asm/e820.h> /* for ISA_START_ADDRESS */
  32 #include <asm/atomic.h>
  33 #include <linux/percpu.h>
  34
  35 #include "pf_in.h"
  36
  37 /* This app's relay channel files will appear in /debug/mmio-trace */
  38 #define APP_DIR         "mmio-trace"
  39 /* the marker injection file in /proc */
  40 #define MARKER_FILE     "mmio-marker"
  41
  42 #define MODULE_NAME     "mmiotrace"
  43
  44 struct trap_reason {
  45         unsigned long addr;
  46         unsigned long ip;
  47         enum reason_type type;
  48         int active_traces;
  49 };
  50
  51 /* Accessed per-cpu. */
  52 static DEFINE_PER_CPU(struct trap_reason, pf_reason);
  53 static DEFINE_PER_CPU(struct mm_io_header_rw, cpu_trace);
  54
  55 /* Access to this is not per-cpu. */
  56 static DEFINE_PER_CPU(atomic_t, dropped);
  57
  58 static struct file_operations mmio_fops = {
  59         .owner = THIS_MODULE,
  60 };
  61
  62 static const size_t subbuf_size = 256*1024;
  63 static struct rchan *chan;
  64 static struct dentry *dir;
  65 static struct proc_dir_entry *proc_marker_file;
  66
  67 /* module parameters */
  68 static unsigned int      n_subbufs = 32*4;
  69 static unsigned long filter_offset;
  70 static int                 nommiotrace;
  71 static int               ISA_trace;
  72 static int                trace_pc;
  73
  74 module_param(n_subbufs, uint, 0);
  75 module_param(filter_offset, ulong, 0);
  76 module_param(nommiotrace, bool, 0);
  77 module_param(ISA_trace, bool, 0);
  78 module_param(trace_pc, bool, 0);
  79
  80 MODULE_PARM_DESC(n_subbufs, "Number of 256kB buffers, default 128.");
  81 MODULE_PARM_DESC(filter_offset, "Start address of traced mappings.");
  82 MODULE_PARM_DESC(nommiotrace, "Disable actual MMIO tracing.");
  83 MODULE_PARM_DESC(ISA_trace, "Do not exclude the low ISA range.");
  84 MODULE_PARM_DESC(trace_pc, "Record address of faulting instructions.");
  85
  86 static void record_timestamp(struct mm_io_header *header)
  87 {
  88         struct timespec now;
  89
  90         getnstimeofday(&now);
  91         header->sec = now.tv_sec;
  92         header->nsec = now.tv_nsec;
  93 }
  94
  95 /*
  96  * Write callback for the /proc entry:
  97  * Read a marker and write it to the mmio trace log
  98  */
  99 static int write_marker(struct file *file, const char __user *buffer,
 100                                         unsigned long count, void *data)
 101 {
 102         char *event = NULL;
 103         struct mm_io_header *headp;
 104         int len = (count > 65535) ? 65535 : count;
 105
 106         event = kzalloc(sizeof(*headp) + len, GFP_KERNEL);
 107         if (!event)
 108                 return -ENOMEM;
 109
 110         headp = (struct mm_io_header *)event;
 111         headp->type = MMIO_MAGIC | (MMIO_MARKER << MMIO_OPCODE_SHIFT);
 112         headp->data_len = len;
 113         record_timestamp(headp);
 114
 115         if (copy_from_user(event + sizeof(*headp), buffer, len)) {
 116                 kfree(event);
 117                 return -EFAULT;
 118         }
 119
 120         relay_write(chan, event, sizeof(*headp) + len);
 121         kfree(event);
 122         return len;
 123 }
 124
 125 static void print_pte(unsigned long address)
 126 {
 127         int level;
 128         pte_t *pte = lookup_address(address, &level);
 129
 130         if (!pte) {
 131                 pr_err(MODULE_NAME ": Error in %s: no pte for page 0x%08lx\n",
 132                                                         __func__, address);
 133                 return;
 134         }
 135
 136         if (level == PG_LEVEL_2M) {
 137                 pr_emerg(MODULE_NAME ": 4MB pages are not currently "
 138                                                 "supported: %lx\n", address);
 139                 BUG();
 140         }
 141         pr_info(MODULE_NAME ": pte for 0x%lx: 0x%lx 0x%lx\n",
 142                                         address, pte_val(*pte),
 143                                         pte_val(*pte) & _PAGE_PRESENT);
 144 }
 145
 146 /*
 147  * For some reason the pre/post pairs have been called in an
 148  * unmatched order. Report and die.
 149  */
 150 static void die_kmmio_nesting_error(struct pt_regs *regs, unsigned long addr)
 151 {
 152         const struct trap_reason *my_reason = &get_cpu_var(pf_reason);
 153         pr_emerg(MODULE_NAME ": unexpected fault for address: %lx, "
 154                                         "last fault for address: %lx\n",
 155                                         addr, my_reason->addr);
 156         print_pte(addr);
 157 #ifdef __i386__
 158         print_symbol(KERN_EMERG "faulting EIP is at %s\n", regs->ip);
 159         print_symbol(KERN_EMERG "last faulting EIP was at %s\n",
 160                                                         my_reason->ip);
 161         pr_emerg("eax: %08lx   ebx: %08lx   ecx: %08lx   edx: %08lx\n",
 162                         regs->ax, regs->bx, regs->cx, regs->dx);
 163         pr_emerg("esi: %08lx   edi: %08lx   ebp: %08lx   esp: %08lx\n",
 164                         regs->si, regs->di, regs->bp, regs->sp);
 165 #else
 166         print_symbol(KERN_EMERG "faulting RIP is at %s\n", regs->ip);
 167         print_symbol(KERN_EMERG "last faulting RIP was at %s\n",
 168                                                         my_reason->ip);
 169         pr_emerg("rax: %016lx   rcx: %016lx   rdx: %016lx\n",
 170                                         regs->ax, regs->cx, regs->dx);
 171         pr_emerg("rsi: %016lx   rdi: %016lx   rbp: %016lx   rsp: %016lx\n",
 172                                 regs->si, regs->di, regs->bp, regs->sp);
 173 #endif
 174         put_cpu_var(pf_reason);
 175         BUG();
 176 }
 177
 178 static void pre(struct kmmio_probe *p, struct pt_regs *regs,
 179                                                 unsigned long addr)
 180 {
 181         struct trap_reason *my_reason = &get_cpu_var(pf_reason);
 182         struct mm_io_header_rw *my_trace = &get_cpu_var(cpu_trace);
 183         const unsigned long instptr = instruction_pointer(regs);
 184         const enum reason_type type = get_ins_type(instptr);
 185
 186         /* it doesn't make sense to have more than one active trace per cpu */
 187         if (my_reason->active_traces)
 188                 die_kmmio_nesting_error(regs, addr);
 189         else
 190                 my_reason->active_traces++;
 191
 192         my_reason->type = type;
 193         my_reason->addr = addr;
 194         my_reason->ip = instptr;
 195
 196         my_trace->header.type = MMIO_MAGIC;
 197         my_trace->header.pid = 0;
 198         my_trace->header.data_len = sizeof(struct mm_io_rw);
 199         my_trace->rw.address = addr;
 200
 201         /*
 202          * Only record the program counter when requested.
 203          * It may taint clean-room reverse engineering.
 204          */
 205         if (trace_pc)
 206                 my_trace->rw.pc = instptr;
 207         else
 208                 my_trace->rw.pc = 0;
 209
 210         record_timestamp(&my_trace->header);
 211
 212         switch (type) {
 213         case REG_READ:
 214                 my_trace->header.type |=
 215                         (MMIO_READ << MMIO_OPCODE_SHIFT) |
 216                         (get_ins_mem_width(instptr) << MMIO_WIDTH_SHIFT);
 217                 break;
 218         case REG_WRITE:
 219                 my_trace->header.type |=
 220                         (MMIO_WRITE << MMIO_OPCODE_SHIFT) |
 221                         (get_ins_mem_width(instptr) << MMIO_WIDTH_SHIFT);
 222                 my_trace->rw.value = get_ins_reg_val(instptr, regs);
 223                 break;
 224         case IMM_WRITE:
 225                 my_trace->header.type |=
 226                         (MMIO_WRITE << MMIO_OPCODE_SHIFT) |
 227                         (get_ins_mem_width(instptr) << MMIO_WIDTH_SHIFT);
 228                 my_trace->rw.value = get_ins_imm_val(instptr);
 229                 break;
 230         default:
 231                 {
 232                         unsigned char *ip = (unsigned char *)instptr;
 233                         my_trace->header.type |=
 234                                         (MMIO_UNKNOWN_OP << MMIO_OPCODE_SHIFT);
 235                         my_trace->rw.value = (*ip) << 16 | *(ip + 1) << 8 |
 236                                                                 *(ip + 2);
 237                 }
 238         }
 239         put_cpu_var(cpu_trace);
 240         put_cpu_var(pf_reason);
 241 }
 242
 243 static void post(struct kmmio_probe *p, unsigned long condition,
 244                                                         struct pt_regs *regs)
 245 {
 246         struct trap_reason *my_reason = &get_cpu_var(pf_reason);
 247         struct mm_io_header_rw *my_trace = &get_cpu_var(cpu_trace);
 248
 249         /*
 250          * XXX: This might not get called, if the probe is removed while
 251          * trace hit is on flight.
 252          */
 253
 254         /* this should always return the active_trace count to 0 */
 255         my_reason->active_traces--;
 256         if (my_reason->active_traces) {
 257                 pr_emerg(MODULE_NAME ": unexpected post handler");
 258                 BUG();
 259         }
 260
 261         switch (my_reason->type) {
 262         case REG_READ:
 263                 my_trace->rw.value = get_ins_reg_val(my_reason->ip, regs);
 264                 break;
 265         default:
 266                 break;
 267         }
 268         relay_write(chan, my_trace, sizeof(*my_trace));
 269         put_cpu_var(cpu_trace);
 270         put_cpu_var(pf_reason);
 271 }
 272
 273 /*
 274  * subbuf_start() relay callback.
 275  *
 276  * Defined so that we know when events are dropped due to the buffer-full
 277  * condition.
 278  */
 279 static int subbuf_start_handler(struct rchan_buf *buf, void *subbuf,
 280                                         void *prev_subbuf, size_t prev_padding)
 281 {
 282         unsigned int cpu = buf->cpu;
 283         atomic_t *drop = &per_cpu(dropped, cpu);
 284         int count;
 285         if (relay_buf_full(buf)) {
 286                 if (atomic_inc_return(drop) == 1)
 287                         pr_err(MODULE_NAME ": cpu %d buffer full!\n", cpu);
 288                 return 0;
 289         }
 290         count = atomic_read(drop);
 291         if (count) {
 292                 pr_err(MODULE_NAME ": cpu %d buffer no longer full, "
 293                                                 "missed %d events.\n",
 294                                                 cpu, count);
 295                 atomic_sub(count, drop);
 296         }
 297
 298         return 1;
 299 }
 300
 301 /* file_create() callback.  Creates relay file in debugfs. */
 302 static struct dentry *create_buf_file_handler(const char *filename,
 303                                                 struct dentry *parent,
 304                                                 int mode,
 305                                                 struct rchan_buf *buf,
 306                                                 int *is_global)
 307 {
 308         struct dentry *buf_file;
 309
 310         mmio_fops.read = relay_file_operations.read;
 311         mmio_fops.open = relay_file_operations.open;
 312         mmio_fops.poll = relay_file_operations.poll;
 313         mmio_fops.mmap = relay_file_operations.mmap;
 314         mmio_fops.release = relay_file_operations.release;
 315         mmio_fops.splice_read = relay_file_operations.splice_read;
 316
 317         buf_file = debugfs_create_file(filename, mode, parent, buf,
 318                                                                 &mmio_fops);
 319
 320         return buf_file;
 321 }
 322
 323 /* file_remove() default callback.  Removes relay file in debugfs. */
 324 static int remove_buf_file_handler(struct dentry *dentry)
 325 {
 326         debugfs_remove(dentry);
 327         return 0;
 328 }
 329
 330 static struct rchan_callbacks relay_callbacks = {
 331         .subbuf_start = subbuf_start_handler,
 332         .create_buf_file = create_buf_file_handler,
 333         .remove_buf_file = remove_buf_file_handler,
 334 };
 335
 336 /*
 337  * create_channel - creates channel /debug/APP_DIR/cpuXXX
 338  * Returns channel on success, NULL otherwise
 339  */
 340 static struct rchan *create_channel(unsigned size, unsigned n)
 341 {
 342         return relay_open("cpu", dir, size, n, &relay_callbacks, NULL);
 343 }
 344
 345 /* destroy_channel - destroys channel /debug/APP_DIR/cpuXXX */
 346 static void destroy_channel(void)
 347 {
 348         if (chan) {
 349                 relay_close(chan);
 350                 chan = NULL;
 351         }
 352 }
 353
 354 struct remap_trace {
 355         struct list_head list;
 356         struct kmmio_probe probe;
 357 };
 358 static LIST_HEAD(trace_list);
 359 static DEFINE_SPINLOCK(trace_list_lock);
 360
 361 static void do_ioremap_trace_core(unsigned long offset, unsigned long size,
 362                                                         void __iomem *addr)
 363 {
 364         struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
 365         struct mm_io_header_map event = {
 366                 .header = {
 367                         .type = MMIO_MAGIC |
 368                                         (MMIO_PROBE << MMIO_OPCODE_SHIFT),
 369                         .sec = 0,
 370                         .nsec = 0,
 371                         .pid = 0,
 372                         .data_len = sizeof(struct mm_io_map)
 373                 },
 374                 .map = {
 375                         .phys = offset,
 376                         .addr = (unsigned long)addr,
 377                         .len  = size,
 378                         .pc   = 0
 379                 }
 380         };
 381         record_timestamp(&event.header);
 382
 383         *trace = (struct remap_trace) {
 384                 .probe = {
 385                         .addr = (unsigned long)addr,
 386                         .len = size,
 387                         .pre_handler = pre,
 388                         .post_handler = post,
 389                 }
 390         };
 391
 392         relay_write(chan, &event, sizeof(event));
 393         spin_lock(&trace_list_lock);
 394         list_add_tail(&trace->list, &trace_list);
 395         spin_unlock(&trace_list_lock);
 396         if (!nommiotrace)
 397                 register_kmmio_probe(&trace->probe);
 398 }
 399
 400 static void ioremap_trace_core(unsigned long offset, unsigned long size,
 401                                                         void __iomem *addr)
 402 {
 403         if ((filter_offset) && (offset != filter_offset))
 404                 return;
 405
 406         /* Don't trace the low PCI/ISA area, it's always mapped.. */
 407         if (!ISA_trace && (offset < ISA_END_ADDRESS) &&
 408                                         (offset + size > ISA_START_ADDRESS)) {
 409                 pr_notice(MODULE_NAME ": Ignoring map of low PCI/ISA area "
 410                                                 "(0x%lx-0x%lx)\n",
 411                                                 offset, offset + size);
 412                 return;
 413         }
 414         do_ioremap_trace_core(offset, size, addr);
 415 }
 416
 417 void __iomem *ioremap_cache_trace(unsigned long offset, unsigned long size)
 418 {
 419         void __iomem *p = ioremap_cache(offset, size);
 420         pr_debug(MODULE_NAME ": ioremap_cache(0x%lx, 0x%lx) = %p\n",
 421                                                         offset, size, p);
 422         ioremap_trace_core(offset, size, p);
 423         return p;
 424 }
 425 EXPORT_SYMBOL(ioremap_cache_trace);
 426
 427 void __iomem *ioremap_nocache_trace(unsigned long offset, unsigned long size)
 428 {
 429         void __iomem *p = ioremap_nocache(offset, size);
 430         pr_debug(MODULE_NAME ": ioremap_nocache(0x%lx, 0x%lx) = %p\n",
 431                                                         offset, size, p);
 432         ioremap_trace_core(offset, size, p);
 433         return p;
 434 }
 435 EXPORT_SYMBOL(ioremap_nocache_trace);
 436
 437 void iounmap_trace(volatile void __iomem *addr)
 438 {
 439         struct mm_io_header_map event = {
 440                 .header = {
 441                         .type = MMIO_MAGIC |
 442                                 (MMIO_UNPROBE << MMIO_OPCODE_SHIFT),
 443                         .sec = 0,
 444                         .nsec = 0,
 445                         .pid = 0,
 446                         .data_len = sizeof(struct mm_io_map)
 447                 },
 448                 .map = {
 449                         .phys = 0,
 450                         .addr = (unsigned long)addr,
 451                         .len  = 0,
 452                         .pc   = 0
 453                 }
 454         };
 455         struct remap_trace *trace;
 456         struct remap_trace *tmp;
 457         pr_debug(MODULE_NAME ": Unmapping %p.\n", addr);
 458         record_timestamp(&event.header);
 459
 460         spin_lock(&trace_list_lock);
 461         list_for_each_entry_safe(trace, tmp, &trace_list, list) {
 462                 if ((unsigned long)addr == trace->probe.addr) {
 463                         if (!nommiotrace)
 464                                 unregister_kmmio_probe(&trace->probe);
 465                         list_del(&trace->list);
 466                         kfree(trace);
 467                         break;
 468                 }
 469         }
 470         spin_unlock(&trace_list_lock);
 471         relay_write(chan, &event, sizeof(event));
 472         iounmap(addr);
 473 }
 474 EXPORT_SYMBOL(iounmap_trace);
 475
 476 static void clear_trace_list(void)
 477 {
 478         struct remap_trace *trace;
 479         struct remap_trace *tmp;
 480
 481         spin_lock(&trace_list_lock);
 482         list_for_each_entry_safe(trace, tmp, &trace_list, list) {
 483                 pr_warning(MODULE_NAME ": purging non-iounmapped "
 484                                         "trace @0x%08lx, size 0x%lx.\n",
 485                                         trace->probe.addr, trace->probe.len);
 486                 if (!nommiotrace)
 487                         unregister_kmmio_probe(&trace->probe);
 488                 list_del(&trace->list);
 489                 kfree(trace);
 490                 break;
 491         }
 492         spin_unlock(&trace_list_lock);
 493 }
 494
 495 static int __init init(void)
 496 {
 497         if (n_subbufs < 2)
 498                 return -EINVAL;
 499
 500         dir = debugfs_create_dir(APP_DIR, NULL);
 501         if (!dir) {
 502                 pr_err(MODULE_NAME ": Couldn't create relay app directory.\n");
 503                 return -ENOMEM;
 504         }
 505
 506         chan = create_channel(subbuf_size, n_subbufs);
 507         if (!chan) {
 508                 debugfs_remove(dir);
 509                 pr_err(MODULE_NAME ": relay app channel creation failed\n");
 510                 return -ENOMEM;
 511         }
 512
 513         reference_kmmio();
 514
 515         proc_marker_file = create_proc_entry(MARKER_FILE, 0, NULL);
 516         if (proc_marker_file)
 517                 proc_marker_file->write_proc = write_marker;
 518
 519         pr_debug(MODULE_NAME ": loaded.\n");
 520         if (nommiotrace)
 521                 pr_info(MODULE_NAME ": MMIO tracing disabled.\n");
 522         if (ISA_trace)
 523                 pr_warning(MODULE_NAME ": Warning! low ISA range will be "
 524                                                                 "traced.\n");
 525         return 0;
 526 }
 527
 528 static void __exit cleanup(void)
 529 {
 530         pr_debug(MODULE_NAME ": unload...\n");
 531         clear_trace_list();
 532         unreference_kmmio();
 533         remove_proc_entry(MARKER_FILE, NULL);
 534         destroy_channel();
 535         if (dir)
 536                 debugfs_remove(dir);
 537 }
 538
 539 module_init(init);
 540 module_exit(cleanup);
 541 MODULE_LICENSE("GPL");