err.no Git - linux-2.6/blob - arch/x86/kernel/mmiotrace/mmio-mod.c

   1 /*
   2  * This program is free software; you can redistribute it and/or modify
   3  * it under the terms of the GNU General Public License as published by
   4  * the Free Software Foundation; either version 2 of the License, or
   5  * (at your option) any later version.
   6  *
   7  * This program is distributed in the hope that it will be useful,
   8  * but WITHOUT ANY WARRANTY; without even the implied warranty of
   9  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  10  * GNU General Public License for more details.
  11  *
  12  * You should have received a copy of the GNU General Public License
  13  * along with this program; if not, write to the Free Software
  14  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  15  *
  16  * Copyright (C) IBM Corporation, 2005
  17  *               Jeff Muizelaar, 2006, 2007
  18  *               Pekka Paalanen, 2008 <pq@iki.fi>
  19  *
  20  * Derived from the read-mod example from relay-examples by Tom Zanussi.
  21  */
  22 #include <linux/module.h>
  23 #include <linux/relay.h>
  24 #include <linux/debugfs.h>
  25 #include <linux/proc_fs.h>
  26 #include <asm/io.h>
  27 #include <linux/version.h>
  28 #include <linux/kallsyms.h>
  29 #include <asm/pgtable.h>
  30 #include <linux/mmiotrace.h>
  31 #include <asm/e820.h> /* for ISA_START_ADDRESS */
  32
  33 #include "kmmio.h"
  34 #include "pf_in.h"
  35
  36 /* This app's relay channel files will appear in /debug/mmio-trace */
  37 #define APP_DIR         "mmio-trace"
  38 /* the marker injection file in /proc */
  39 #define MARKER_FILE     "mmio-marker"
  40
  41 #define MODULE_NAME     "mmiotrace"
  42
  43 struct trap_reason {
  44         unsigned long addr;
  45         unsigned long ip;
  46         enum reason_type type;
  47         int active_traces;
  48 };
  49
  50 static struct trap_reason pf_reason[NR_CPUS];
  51 static struct mm_io_header_rw cpu_trace[NR_CPUS];
  52
  53 static struct file_operations mmio_fops = {
  54         .owner = THIS_MODULE,
  55 };
  56
  57 static const size_t subbuf_size = 256*1024;
  58 static struct rchan *chan;
  59 static struct dentry *dir;
  60 static int suspended;      /* XXX should this be per cpu? */
  61 static struct proc_dir_entry *proc_marker_file;
  62
  63 /* module parameters */
  64 static unsigned int      n_subbufs = 32*4;
  65 static unsigned long filter_offset;
  66 static int                 nommiotrace;
  67 static int               ISA_trace;
  68 static int                trace_pc;
  69
  70 module_param(n_subbufs, uint, 0);
  71 module_param(filter_offset, ulong, 0);
  72 module_param(nommiotrace, bool, 0);
  73 module_param(ISA_trace, bool, 0);
  74 module_param(trace_pc, bool, 0);
  75
  76 MODULE_PARM_DESC(n_subbufs, "Number of 256kB buffers, default 128.");
  77 MODULE_PARM_DESC(filter_offset, "Start address of traced mappings.");
  78 MODULE_PARM_DESC(nommiotrace, "Disable actual MMIO tracing.");
  79 MODULE_PARM_DESC(ISA_trace, "Do not exclude the low ISA range.");
  80 MODULE_PARM_DESC(trace_pc, "Record address of faulting instructions.");
  81
  82 static void record_timestamp(struct mm_io_header *header)
  83 {
  84         struct timespec now;
  85
  86         getnstimeofday(&now);
  87         header->sec = now.tv_sec;
  88         header->nsec = now.tv_nsec;
  89 }
  90
  91 /*
  92  * Write callback for the /proc entry:
  93  * Read a marker and write it to the mmio trace log
  94  */
  95 static int write_marker(struct file *file, const char __user *buffer,
  96                                         unsigned long count, void *data)
  97 {
  98         char *event = NULL;
  99         struct mm_io_header *headp;
 100         int len = (count > 65535) ? 65535 : count;
 101
 102         event = kzalloc(sizeof(*headp) + len, GFP_KERNEL);
 103         if (!event)
 104                 return -ENOMEM;
 105
 106         headp = (struct mm_io_header *)event;
 107         headp->type = MMIO_MAGIC | (MMIO_MARKER << MMIO_OPCODE_SHIFT);
 108         headp->data_len = len;
 109         record_timestamp(headp);
 110
 111         if (copy_from_user(event + sizeof(*headp), buffer, len)) {
 112                 kfree(event);
 113                 return -EFAULT;
 114         }
 115
 116         relay_write(chan, event, sizeof(*headp) + len);
 117         kfree(event);
 118         return len;
 119 }
 120
 121 static void print_pte(unsigned long address)
 122 {
 123         int level;
 124         pte_t *pte = lookup_address(address, &level);
 125
 126         if (!pte) {
 127                 printk(KERN_ERR "Error in %s: no pte for page 0x%08lx\n",
 128                                                 __FUNCTION__, address);
 129                 return;
 130         }
 131
 132         if (level == PG_LEVEL_2M) {
 133                 printk(KERN_EMERG MODULE_NAME ": 4MB pages are not "
 134                                                 "currently supported: %lx\n",
 135                                                 address);
 136                 BUG();
 137         }
 138         printk(KERN_DEBUG MODULE_NAME ": pte for 0x%lx: 0x%lx 0x%lx\n",
 139                                         address, pte_val(*pte),
 140                                         pte_val(*pte) & _PAGE_PRESENT);
 141 }
 142
 143 /*
 144  * For some reason the pre/post pairs have been called in an
 145  * unmatched order. Report and die.
 146  */
 147 static void die_kmmio_nesting_error(struct pt_regs *regs, unsigned long addr)
 148 {
 149         const unsigned long cpu = smp_processor_id();
 150         printk(KERN_EMERG MODULE_NAME ": unexpected fault for address: %lx, "
 151                                         "last fault for address: %lx\n",
 152                                         addr, pf_reason[cpu].addr);
 153         print_pte(addr);
 154 #ifdef __i386__
 155         print_symbol(KERN_EMERG "faulting EIP is at %s\n", regs->ip);
 156         print_symbol(KERN_EMERG "last faulting EIP was at %s\n",
 157                                                         pf_reason[cpu].ip);
 158         printk(KERN_EMERG
 159                         "eax: %08lx   ebx: %08lx   ecx: %08lx   edx: %08lx\n",
 160                         regs->ax, regs->bx, regs->cx, regs->dx);
 161         printk(KERN_EMERG
 162                         "esi: %08lx   edi: %08lx   ebp: %08lx   esp: %08lx\n",
 163                         regs->si, regs->di, regs->bp, regs->sp);
 164 #else
 165         print_symbol(KERN_EMERG "faulting RIP is at %s\n", regs->ip);
 166         print_symbol(KERN_EMERG "last faulting RIP was at %s\n",
 167                                                         pf_reason[cpu].ip);
 168         printk(KERN_EMERG "rax: %016lx   rcx: %016lx   rdx: %016lx\n",
 169                                         regs->ax, regs->cx, regs->dx);
 170         printk(KERN_EMERG "rsi: %016lx   rdi: %016lx   "
 171                                 "rbp: %016lx   rsp: %016lx\n",
 172                                 regs->si, regs->di, regs->bp, regs->sp);
 173 #endif
 174         BUG();
 175 }
 176
 177 static void pre(struct kmmio_probe *p, struct pt_regs *regs,
 178                                                 unsigned long addr)
 179 {
 180         const unsigned long cpu = smp_processor_id();
 181         const unsigned long instptr = instruction_pointer(regs);
 182         const enum reason_type type = get_ins_type(instptr);
 183
 184         /* it doesn't make sense to have more than one active trace per cpu */
 185         if (pf_reason[cpu].active_traces)
 186                 die_kmmio_nesting_error(regs, addr);
 187         else
 188                 pf_reason[cpu].active_traces++;
 189
 190         pf_reason[cpu].type = type;
 191         pf_reason[cpu].addr = addr;
 192         pf_reason[cpu].ip = instptr;
 193
 194         cpu_trace[cpu].header.type = MMIO_MAGIC;
 195         cpu_trace[cpu].header.pid = 0;
 196         cpu_trace[cpu].header.data_len = sizeof(struct mm_io_rw);
 197         cpu_trace[cpu].rw.address = addr;
 198
 199         /*
 200          * Only record the program counter when requested.
 201          * It may taint clean-room reverse engineering.
 202          */
 203         if (trace_pc)
 204                 cpu_trace[cpu].rw.pc = instptr;
 205         else
 206                 cpu_trace[cpu].rw.pc = 0;
 207
 208         record_timestamp(&cpu_trace[cpu].header);
 209
 210         switch (type) {
 211         case REG_READ:
 212                 cpu_trace[cpu].header.type |=
 213                         (MMIO_READ << MMIO_OPCODE_SHIFT) |
 214                         (get_ins_mem_width(instptr) << MMIO_WIDTH_SHIFT);
 215                 break;
 216         case REG_WRITE:
 217                 cpu_trace[cpu].header.type |=
 218                         (MMIO_WRITE << MMIO_OPCODE_SHIFT) |
 219                         (get_ins_mem_width(instptr) << MMIO_WIDTH_SHIFT);
 220                 cpu_trace[cpu].rw.value = get_ins_reg_val(instptr, regs);
 221                 break;
 222         case IMM_WRITE:
 223                 cpu_trace[cpu].header.type |=
 224                         (MMIO_WRITE << MMIO_OPCODE_SHIFT) |
 225                         (get_ins_mem_width(instptr) << MMIO_WIDTH_SHIFT);
 226                 cpu_trace[cpu].rw.value = get_ins_imm_val(instptr);
 227                 break;
 228         default:
 229                 {
 230                         unsigned char *ip = (unsigned char *)instptr;
 231                         cpu_trace[cpu].header.type |=
 232                                         (MMIO_UNKNOWN_OP << MMIO_OPCODE_SHIFT);
 233                         cpu_trace[cpu].rw.value = (*ip) << 16 |
 234                                                         *(ip + 1) << 8 |
 235                                                         *(ip + 2);
 236                 }
 237         }
 238 }
 239
 240 static void post(struct kmmio_probe *p, unsigned long condition,
 241                                                         struct pt_regs *regs)
 242 {
 243         const unsigned long cpu = smp_processor_id();
 244
 245         /* this should always return the active_trace count to 0 */
 246         pf_reason[cpu].active_traces--;
 247         if (pf_reason[cpu].active_traces) {
 248                 printk(KERN_EMERG MODULE_NAME ": unexpected post handler");
 249                 BUG();
 250         }
 251
 252         switch (pf_reason[cpu].type) {
 253         case REG_READ:
 254                 cpu_trace[cpu].rw.value = get_ins_reg_val(pf_reason[cpu].ip,
 255                                                                         regs);
 256                 break;
 257         default:
 258                 break;
 259         }
 260         relay_write(chan, &cpu_trace[cpu], sizeof(struct mm_io_header_rw));
 261 }
 262
 263 /*
 264  * subbuf_start() relay callback.
 265  *
 266  * Defined so that we know when events are dropped due to the buffer-full
 267  * condition.
 268  */
 269 static int subbuf_start_handler(struct rchan_buf *buf, void *subbuf,
 270                                         void *prev_subbuf, size_t prev_padding)
 271 {
 272         if (relay_buf_full(buf)) {
 273                 if (!suspended) {
 274                         suspended = 1;
 275                         printk(KERN_ERR MODULE_NAME
 276                                                 ": cpu %d buffer full!!!\n",
 277                                                 smp_processor_id());
 278                 }
 279                 return 0;
 280         } else if (suspended) {
 281                 suspended = 0;
 282                 printk(KERN_ERR MODULE_NAME
 283                                         ": cpu %d buffer no longer full.\n",
 284                                         smp_processor_id());
 285         }
 286
 287         return 1;
 288 }
 289
 290 /* file_create() callback.  Creates relay file in debugfs. */
 291 static struct dentry *create_buf_file_handler(const char *filename,
 292                                                 struct dentry *parent,
 293                                                 int mode,
 294                                                 struct rchan_buf *buf,
 295                                                 int *is_global)
 296 {
 297         struct dentry *buf_file;
 298
 299         mmio_fops.read = relay_file_operations.read;
 300         mmio_fops.open = relay_file_operations.open;
 301         mmio_fops.poll = relay_file_operations.poll;
 302         mmio_fops.mmap = relay_file_operations.mmap;
 303         mmio_fops.release = relay_file_operations.release;
 304         mmio_fops.splice_read = relay_file_operations.splice_read;
 305
 306         buf_file = debugfs_create_file(filename, mode, parent, buf,
 307                                                                 &mmio_fops);
 308
 309         return buf_file;
 310 }
 311
 312 /* file_remove() default callback.  Removes relay file in debugfs. */
 313 static int remove_buf_file_handler(struct dentry *dentry)
 314 {
 315         debugfs_remove(dentry);
 316         return 0;
 317 }
 318
 319 static struct rchan_callbacks relay_callbacks = {
 320         .subbuf_start = subbuf_start_handler,
 321         .create_buf_file = create_buf_file_handler,
 322         .remove_buf_file = remove_buf_file_handler,
 323 };
 324
 325 /*
 326  * create_channel - creates channel /debug/APP_DIR/cpuXXX
 327  * Returns channel on success, NULL otherwise
 328  */
 329 static struct rchan *create_channel(unsigned size, unsigned n)
 330 {
 331         return relay_open("cpu", dir, size, n, &relay_callbacks, NULL);
 332 }
 333
 334 /* destroy_channel - destroys channel /debug/APP_DIR/cpuXXX */
 335 static void destroy_channel(void)
 336 {
 337         if (chan) {
 338                 relay_close(chan);
 339                 chan = NULL;
 340         }
 341 }
 342
 343 struct remap_trace {
 344         struct list_head list;
 345         struct kmmio_probe probe;
 346 };
 347 static LIST_HEAD(trace_list);
 348 static DEFINE_SPINLOCK(trace_list_lock);
 349
 350 static void do_ioremap_trace_core(unsigned long offset, unsigned long size,
 351                                                         void __iomem *addr)
 352 {
 353         struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
 354         struct mm_io_header_map event = {
 355                 .header = {
 356                         .type = MMIO_MAGIC |
 357                                         (MMIO_PROBE << MMIO_OPCODE_SHIFT),
 358                         .sec = 0,
 359                         .nsec = 0,
 360                         .pid = 0,
 361                         .data_len = sizeof(struct mm_io_map)
 362                 },
 363                 .map = {
 364                         .phys = offset,
 365                         .addr = (unsigned long)addr,
 366                         .len  = size,
 367                         .pc   = 0
 368                 }
 369         };
 370         record_timestamp(&event.header);
 371
 372         *trace = (struct remap_trace) {
 373                 .probe = {
 374                         .addr = (unsigned long)addr,
 375                         .len = size,
 376                         .pre_handler = pre,
 377                         .post_handler = post,
 378                 }
 379         };
 380
 381         relay_write(chan, &event, sizeof(event));
 382         spin_lock(&trace_list_lock);
 383         list_add_tail(&trace->list, &trace_list);
 384         spin_unlock(&trace_list_lock);
 385         if (!nommiotrace)
 386                 register_kmmio_probe(&trace->probe);
 387 }
 388
 389 static void ioremap_trace_core(unsigned long offset, unsigned long size,
 390                                                         void __iomem *addr)
 391 {
 392         if ((filter_offset) && (offset != filter_offset))
 393                 return;
 394
 395         /* Don't trace the low PCI/ISA area, it's always mapped.. */
 396         if (!ISA_trace && (offset < ISA_END_ADDRESS) &&
 397                                         (offset + size > ISA_START_ADDRESS)) {
 398                 printk(KERN_NOTICE MODULE_NAME ": Ignoring map of low "
 399                                                 "PCI/ISA area (0x%lx-0x%lx)\n",
 400                                                 offset, offset + size);
 401                 return;
 402         }
 403         do_ioremap_trace_core(offset, size, addr);
 404 }
 405
 406 void __iomem *ioremap_cache_trace(unsigned long offset, unsigned long size)
 407 {
 408         void __iomem *p = ioremap_cache(offset, size);
 409         printk(KERN_DEBUG MODULE_NAME ": ioremap_cache(0x%lx, 0x%lx) = %p\n",
 410                                                         offset, size, p);
 411         ioremap_trace_core(offset, size, p);
 412         return p;
 413 }
 414 EXPORT_SYMBOL(ioremap_cache_trace);
 415
 416 void __iomem *ioremap_nocache_trace(unsigned long offset, unsigned long size)
 417 {
 418         void __iomem *p = ioremap_nocache(offset, size);
 419         printk(KERN_DEBUG MODULE_NAME ": ioremap_nocache(0x%lx, 0x%lx) = %p\n",
 420                                                         offset, size, p);
 421         ioremap_trace_core(offset, size, p);
 422         return p;
 423 }
 424 EXPORT_SYMBOL(ioremap_nocache_trace);
 425
 426 void iounmap_trace(volatile void __iomem *addr)
 427 {
 428         struct mm_io_header_map event = {
 429                 .header = {
 430                         .type = MMIO_MAGIC |
 431                                 (MMIO_UNPROBE << MMIO_OPCODE_SHIFT),
 432                         .sec = 0,
 433                         .nsec = 0,
 434                         .pid = 0,
 435                         .data_len = sizeof(struct mm_io_map)
 436                 },
 437                 .map = {
 438                         .phys = 0,
 439                         .addr = (unsigned long)addr,
 440                         .len  = 0,
 441                         .pc   = 0
 442                 }
 443         };
 444         struct remap_trace *trace;
 445         struct remap_trace *tmp;
 446         printk(KERN_DEBUG MODULE_NAME ": Unmapping %p.\n", addr);
 447         record_timestamp(&event.header);
 448
 449         spin_lock(&trace_list_lock);
 450         list_for_each_entry_safe(trace, tmp, &trace_list, list) {
 451                 if ((unsigned long)addr == trace->probe.addr) {
 452                         if (!nommiotrace)
 453                                 unregister_kmmio_probe(&trace->probe);
 454                         list_del(&trace->list);
 455                         kfree(trace);
 456                         break;
 457                 }
 458         }
 459         spin_unlock(&trace_list_lock);
 460         relay_write(chan, &event, sizeof(event));
 461         iounmap(addr);
 462 }
 463 EXPORT_SYMBOL(iounmap_trace);
 464
 465 static void clear_trace_list(void)
 466 {
 467         struct remap_trace *trace;
 468         struct remap_trace *tmp;
 469
 470         spin_lock(&trace_list_lock);
 471         list_for_each_entry_safe(trace, tmp, &trace_list, list) {
 472                 printk(KERN_WARNING MODULE_NAME ": purging non-iounmapped "
 473                                         "trace @0x%08lx, size 0x%lx.\n",
 474                                         trace->probe.addr, trace->probe.len);
 475                 if (!nommiotrace)
 476                         unregister_kmmio_probe(&trace->probe);
 477                 list_del(&trace->list);
 478                 kfree(trace);
 479                 break;
 480         }
 481         spin_unlock(&trace_list_lock);
 482 }
 483
 484 static int __init init(void)
 485 {
 486         if (n_subbufs < 2)
 487                 return -EINVAL;
 488
 489         dir = debugfs_create_dir(APP_DIR, NULL);
 490         if (!dir) {
 491                 printk(KERN_ERR MODULE_NAME
 492                                 ": Couldn't create relay app directory.\n");
 493                 return -ENOMEM;
 494         }
 495
 496         chan = create_channel(subbuf_size, n_subbufs);
 497         if (!chan) {
 498                 debugfs_remove(dir);
 499                 printk(KERN_ERR MODULE_NAME
 500                                 ": relay app channel creation failed\n");
 501                 return -ENOMEM;
 502         }
 503
 504         init_kmmio();
 505
 506         proc_marker_file = create_proc_entry(MARKER_FILE, 0, NULL);
 507         if (proc_marker_file)
 508                 proc_marker_file->write_proc = write_marker;
 509
 510         printk(KERN_DEBUG MODULE_NAME ": loaded.\n");
 511         if (nommiotrace)
 512                 printk(KERN_DEBUG MODULE_NAME ": MMIO tracing disabled.\n");
 513         if (ISA_trace)
 514                 printk(KERN_WARNING MODULE_NAME
 515                                 ": Warning! low ISA range will be traced.\n");
 516         return 0;
 517 }
 518
 519 static void __exit cleanup(void)
 520 {
 521         printk(KERN_DEBUG MODULE_NAME ": unload...\n");
 522         clear_trace_list();
 523         cleanup_kmmio();
 524         remove_proc_entry(MARKER_FILE, NULL);
 525         destroy_channel();
 526         if (dir)
 527                 debugfs_remove(dir);
 528 }
 529
 530 module_init(init);
 531 module_exit(cleanup);
 532 MODULE_LICENSE("GPL");