1a74e2a22SMauro Carvalho Chehab=========================================================================== 2a74e2a22SMauro Carvalho ChehabUsing physical DMA provided by OHCI-1394 FireWire controllers for debugging 3a74e2a22SMauro Carvalho Chehab=========================================================================== 4a74e2a22SMauro Carvalho Chehab 5a74e2a22SMauro Carvalho ChehabIntroduction 6a74e2a22SMauro Carvalho Chehab------------ 7a74e2a22SMauro Carvalho Chehab 8a74e2a22SMauro Carvalho ChehabBasically all FireWire controllers which are in use today are compliant 9a74e2a22SMauro Carvalho Chehabto the OHCI-1394 specification which defines the controller to be a PCI 10a74e2a22SMauro Carvalho Chehabbus master which uses DMA to offload data transfers from the CPU and has 11a74e2a22SMauro Carvalho Chehaba "Physical Response Unit" which executes specific requests by employing 12a74e2a22SMauro Carvalho ChehabPCI-Bus master DMA after applying filters defined by the OHCI-1394 driver. 13a74e2a22SMauro Carvalho Chehab 14a74e2a22SMauro Carvalho ChehabOnce properly configured, remote machines can send these requests to 15a74e2a22SMauro Carvalho Chehabask the OHCI-1394 controller to perform read and write requests on 16a74e2a22SMauro Carvalho Chehabphysical system memory and, for read requests, send the result of 17a74e2a22SMauro Carvalho Chehabthe physical memory read back to the requester. 18a74e2a22SMauro Carvalho Chehab 19a74e2a22SMauro Carvalho ChehabWith that, it is possible to debug issues by reading interesting memory 20a74e2a22SMauro Carvalho Chehablocations such as buffers like the printk buffer or the process table. 21a74e2a22SMauro Carvalho Chehab 22a74e2a22SMauro Carvalho ChehabRetrieving a full system memory dump is also possible over the FireWire, 23a74e2a22SMauro Carvalho Chehabusing data transfer rates in the order of 10MB/s or more. 24a74e2a22SMauro Carvalho Chehab 25a74e2a22SMauro Carvalho ChehabWith most FireWire controllers, memory access is limited to the low 4 GB 26a74e2a22SMauro Carvalho Chehabof physical address space. This can be a problem on IA64 machines where 27a74e2a22SMauro Carvalho Chehabmemory is located mostly above that limit, but it is rarely a problem on 28a74e2a22SMauro Carvalho Chehabmore common hardware such as x86, x86-64 and PowerPC. 29a74e2a22SMauro Carvalho Chehab 30a74e2a22SMauro Carvalho ChehabAt least LSI FW643e and FW643e2 controllers are known to support access to 31a74e2a22SMauro Carvalho Chehabphysical addresses above 4 GB, but this feature is currently not enabled by 32a74e2a22SMauro Carvalho ChehabLinux. 33a74e2a22SMauro Carvalho Chehab 34a74e2a22SMauro Carvalho ChehabTogether with a early initialization of the OHCI-1394 controller for debugging, 35a74e2a22SMauro Carvalho Chehabthis facility proved most useful for examining long debugs logs in the printk 36a74e2a22SMauro Carvalho Chehabbuffer on to debug early boot problems in areas like ACPI where the system 37a74e2a22SMauro Carvalho Chehabfails to boot and other means for debugging (serial port) are either not 38a74e2a22SMauro Carvalho Chehabavailable (notebooks) or too slow for extensive debug information (like ACPI). 39a74e2a22SMauro Carvalho Chehab 40a74e2a22SMauro Carvalho ChehabDrivers 41a74e2a22SMauro Carvalho Chehab------- 42a74e2a22SMauro Carvalho Chehab 43a74e2a22SMauro Carvalho ChehabThe firewire-ohci driver in drivers/firewire uses filtered physical 44a74e2a22SMauro Carvalho ChehabDMA by default, which is more secure but not suitable for remote debugging. 45a74e2a22SMauro Carvalho ChehabPass the remote_dma=1 parameter to the driver to get unfiltered physical DMA. 46a74e2a22SMauro Carvalho Chehab 47a74e2a22SMauro Carvalho ChehabBecause the firewire-ohci driver depends on the PCI enumeration to be 48a74e2a22SMauro Carvalho Chehabcompleted, an initialization routine which runs pretty early has been 49a74e2a22SMauro Carvalho Chehabimplemented for x86. This routine runs long before console_init() can be 50a74e2a22SMauro Carvalho Chehabcalled, i.e. before the printk buffer appears on the console. 51a74e2a22SMauro Carvalho Chehab 52a74e2a22SMauro Carvalho ChehabTo activate it, enable CONFIG_PROVIDE_OHCI1394_DMA_INIT (Kernel hacking menu: 53a74e2a22SMauro Carvalho ChehabRemote debugging over FireWire early on boot) and pass the parameter 54a74e2a22SMauro Carvalho Chehab"ohci1394_dma=early" to the recompiled kernel on boot. 55a74e2a22SMauro Carvalho Chehab 56a74e2a22SMauro Carvalho ChehabTools 57a74e2a22SMauro Carvalho Chehab----- 58a74e2a22SMauro Carvalho Chehab 59a74e2a22SMauro Carvalho Chehabfirescope - Originally developed by Benjamin Herrenschmidt, Andi Kleen ported 60a74e2a22SMauro Carvalho Chehabit from PowerPC to x86 and x86_64 and added functionality, firescope can now 61a74e2a22SMauro Carvalho Chehabbe used to view the printk buffer of a remote machine, even with live update. 62a74e2a22SMauro Carvalho Chehab 63a74e2a22SMauro Carvalho ChehabBernhard Kaindl enhanced firescope to support accessing 64-bit machines 64a74e2a22SMauro Carvalho Chehabfrom 32-bit firescope and vice versa: 65a74e2a22SMauro Carvalho Chehab- http://v3.sk/~lkundrak/firescope/ 66a74e2a22SMauro Carvalho Chehab 67a74e2a22SMauro Carvalho Chehaband he implemented fast system dump (alpha version - read README.txt): 68a74e2a22SMauro Carvalho Chehab- http://halobates.de/firewire/firedump-0.1.tar.bz2 69a74e2a22SMauro Carvalho Chehab 70a74e2a22SMauro Carvalho ChehabThere is also a gdb proxy for firewire which allows to use gdb to access 71a74e2a22SMauro Carvalho Chehabdata which can be referenced from symbols found by gdb in vmlinux: 72a74e2a22SMauro Carvalho Chehab- http://halobates.de/firewire/fireproxy-0.33.tar.bz2 73a74e2a22SMauro Carvalho Chehab 74a74e2a22SMauro Carvalho ChehabThe latest version of this gdb proxy (fireproxy-0.34) can communicate (not 75a74e2a22SMauro Carvalho Chehabyet stable) with kgdb over an memory-based communication module (kgdbom). 76a74e2a22SMauro Carvalho Chehab 77a74e2a22SMauro Carvalho ChehabGetting Started 78a74e2a22SMauro Carvalho Chehab--------------- 79a74e2a22SMauro Carvalho Chehab 80a74e2a22SMauro Carvalho ChehabThe OHCI-1394 specification regulates that the OHCI-1394 controller must 81a74e2a22SMauro Carvalho Chehabdisable all physical DMA on each bus reset. 82a74e2a22SMauro Carvalho Chehab 83a74e2a22SMauro Carvalho ChehabThis means that if you want to debug an issue in a system state where 84a74e2a22SMauro Carvalho Chehabinterrupts are disabled and where no polling of the OHCI-1394 controller 85a74e2a22SMauro Carvalho Chehabfor bus resets takes place, you have to establish any FireWire cable 86a74e2a22SMauro Carvalho Chehabconnections and fully initialize all FireWire hardware __before__ the 87a74e2a22SMauro Carvalho Chehabsystem enters such state. 88a74e2a22SMauro Carvalho Chehab 89a74e2a22SMauro Carvalho ChehabStep-by-step instructions for using firescope with early OHCI initialization: 90a74e2a22SMauro Carvalho Chehab 91a74e2a22SMauro Carvalho Chehab1) Verify that your hardware is supported: 92a74e2a22SMauro Carvalho Chehab 93a74e2a22SMauro Carvalho Chehab Load the firewire-ohci module and check your kernel logs. 94a74e2a22SMauro Carvalho Chehab You should see a line similar to:: 95a74e2a22SMauro Carvalho Chehab 96a74e2a22SMauro Carvalho Chehab firewire_ohci 0000:15:00.1: added OHCI v1.0 device as card 2, 4 IR + 4 IT 97a74e2a22SMauro Carvalho Chehab ... contexts, quirks 0x11 98a74e2a22SMauro Carvalho Chehab 99a74e2a22SMauro Carvalho Chehab when loading the driver. If you have no supported controller, many PCI, 100a74e2a22SMauro Carvalho Chehab CardBus and even some Express cards which are fully compliant to OHCI-1394 101a74e2a22SMauro Carvalho Chehab specification are available. If it requires no driver for Windows operating 102a74e2a22SMauro Carvalho Chehab systems, it most likely is. Only specialized shops have cards which are not 103a74e2a22SMauro Carvalho Chehab compliant, they are based on TI PCILynx chips and require drivers for Windows 104a74e2a22SMauro Carvalho Chehab operating systems. 105a74e2a22SMauro Carvalho Chehab 106a74e2a22SMauro Carvalho Chehab The mentioned kernel log message contains the string "physUB" if the 107a74e2a22SMauro Carvalho Chehab controller implements a writable Physical Upper Bound register. This is 108a74e2a22SMauro Carvalho Chehab required for physical DMA above 4 GB (but not utilized by Linux yet). 109a74e2a22SMauro Carvalho Chehab 110a74e2a22SMauro Carvalho Chehab2) Establish a working FireWire cable connection: 111a74e2a22SMauro Carvalho Chehab 112a74e2a22SMauro Carvalho Chehab Any FireWire cable, as long at it provides electrically and mechanically 113a74e2a22SMauro Carvalho Chehab stable connection and has matching connectors (there are small 4-pin and 114a74e2a22SMauro Carvalho Chehab large 6-pin FireWire ports) will do. 115a74e2a22SMauro Carvalho Chehab 116a74e2a22SMauro Carvalho Chehab If an driver is running on both machines you should see a line like:: 117a74e2a22SMauro Carvalho Chehab 118a74e2a22SMauro Carvalho Chehab firewire_core 0000:15:00.1: created device fw1: GUID 00061b0020105917, S400 119a74e2a22SMauro Carvalho Chehab 120a74e2a22SMauro Carvalho Chehab on both machines in the kernel log when the cable is plugged in 121a74e2a22SMauro Carvalho Chehab and connects the two machines. 122a74e2a22SMauro Carvalho Chehab 123a74e2a22SMauro Carvalho Chehab3) Test physical DMA using firescope: 124a74e2a22SMauro Carvalho Chehab 125a74e2a22SMauro Carvalho Chehab On the debug host, make sure that /dev/fw* is accessible, 126a74e2a22SMauro Carvalho Chehab then start firescope:: 127a74e2a22SMauro Carvalho Chehab 128a74e2a22SMauro Carvalho Chehab $ firescope 129a74e2a22SMauro Carvalho Chehab Port 0 (/dev/fw1) opened, 2 nodes detected 130a74e2a22SMauro Carvalho Chehab 131a74e2a22SMauro Carvalho Chehab FireScope 132a74e2a22SMauro Carvalho Chehab --------- 133a74e2a22SMauro Carvalho Chehab Target : <unspecified> 134a74e2a22SMauro Carvalho Chehab Gen : 1 135a74e2a22SMauro Carvalho Chehab [Ctrl-T] choose target 136a74e2a22SMauro Carvalho Chehab [Ctrl-H] this menu 137a74e2a22SMauro Carvalho Chehab [Ctrl-Q] quit 138a74e2a22SMauro Carvalho Chehab 139a74e2a22SMauro Carvalho Chehab ------> Press Ctrl-T now, the output should be similar to: 140a74e2a22SMauro Carvalho Chehab 141a74e2a22SMauro Carvalho Chehab 2 nodes available, local node is: 0 142a74e2a22SMauro Carvalho Chehab 0: ffc0, uuid: 00000000 00000000 [LOCAL] 143a74e2a22SMauro Carvalho Chehab 1: ffc1, uuid: 00279000 ba4bb801 144a74e2a22SMauro Carvalho Chehab 145a74e2a22SMauro Carvalho Chehab Besides the [LOCAL] node, it must show another node without error message. 146a74e2a22SMauro Carvalho Chehab 147a74e2a22SMauro Carvalho Chehab4) Prepare for debugging with early OHCI-1394 initialization: 148a74e2a22SMauro Carvalho Chehab 149a74e2a22SMauro Carvalho Chehab 4.1) Kernel compilation and installation on debug target 150a74e2a22SMauro Carvalho Chehab 151a74e2a22SMauro Carvalho Chehab Compile the kernel to be debugged with CONFIG_PROVIDE_OHCI1394_DMA_INIT 152a74e2a22SMauro Carvalho Chehab (Kernel hacking: Provide code for enabling DMA over FireWire early on boot) 153a74e2a22SMauro Carvalho Chehab enabled and install it on the machine to be debugged (debug target). 154a74e2a22SMauro Carvalho Chehab 155a74e2a22SMauro Carvalho Chehab 4.2) Transfer the System.map of the debugged kernel to the debug host 156a74e2a22SMauro Carvalho Chehab 157a74e2a22SMauro Carvalho Chehab Copy the System.map of the kernel be debugged to the debug host (the host 158a74e2a22SMauro Carvalho Chehab which is connected to the debugged machine over the FireWire cable). 159a74e2a22SMauro Carvalho Chehab 160a74e2a22SMauro Carvalho Chehab5) Retrieving the printk buffer contents: 161a74e2a22SMauro Carvalho Chehab 162a74e2a22SMauro Carvalho Chehab With the FireWire cable connected, the OHCI-1394 driver on the debugging 163a74e2a22SMauro Carvalho Chehab host loaded, reboot the debugged machine, booting the kernel which has 164a74e2a22SMauro Carvalho Chehab CONFIG_PROVIDE_OHCI1394_DMA_INIT enabled, with the option ohci1394_dma=early. 165a74e2a22SMauro Carvalho Chehab 166a74e2a22SMauro Carvalho Chehab Then, on the debugging host, run firescope, for example by using -A:: 167a74e2a22SMauro Carvalho Chehab 168a74e2a22SMauro Carvalho Chehab firescope -A System.map-of-debug-target-kernel 169a74e2a22SMauro Carvalho Chehab 170a74e2a22SMauro Carvalho Chehab Note: -A automatically attaches to the first non-local node. It only works 171a74e2a22SMauro Carvalho Chehab reliably if only connected two machines are connected using FireWire. 172a74e2a22SMauro Carvalho Chehab 173a74e2a22SMauro Carvalho Chehab After having attached to the debug target, press Ctrl-D to view the 174a74e2a22SMauro Carvalho Chehab complete printk buffer or Ctrl-U to enter auto update mode and get an 175a74e2a22SMauro Carvalho Chehab updated live view of recent kernel messages logged on the debug target. 176a74e2a22SMauro Carvalho Chehab 177a74e2a22SMauro Carvalho Chehab Call "firescope -h" to get more information on firescope's options. 178a74e2a22SMauro Carvalho Chehab 179a74e2a22SMauro Carvalho ChehabNotes 180a74e2a22SMauro Carvalho Chehab----- 181a74e2a22SMauro Carvalho Chehab 182a74e2a22SMauro Carvalho ChehabDocumentation and specifications: http://halobates.de/firewire/ 183a74e2a22SMauro Carvalho Chehab 184a74e2a22SMauro Carvalho ChehabFireWire is a trademark of Apple Inc. - for more information please refer to: 185a74e2a22SMauro Carvalho Chehabhttps://en.wikipedia.org/wiki/FireWire 186