From: Larry Finger <Larry.Finger@lwfinger.net>
To: "Rafał Miłecki" <zajec5@gmail.com>
Cc: linux-wireless@vger.kernel.org,
Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
Pekka Paalanen <pq@iki.fi>
Subject: Re: Faking MMIO ops? Fooling a driver
Date: Thu, 16 Jun 2011 13:07:46 -0500 [thread overview]
Message-ID: <4DFA4672.5080307@lwfinger.net> (raw)
In-Reply-To: <BANLkTinUxRGkXeOtBSKi51n3Q_rZEp1gUg@mail.gmail.com>
On 06/16/2011 12:20 PM, Rafał Miłecki wrote:
> W dniu 16 czerwca 2011 16:44 użytkownik Rafał Miłecki
> <zajec5@gmail.com> napisał:
>> I analyze MMIO dumps of closed source driver and found such a place:
>> W 2 3855.911536 9 0xb06003fc 0x810 0x0 0
>> R 2 3855.911540 9 0xb06003fe 0x0 0x0 0
>> W 2 3855.911541 9 0xb06003fe 0x0 0x0 0
>>
>> After translation:
>> phy_read(0x0810) -> 0x0000
>> phy_write(0x0810)<- 0x0000
>>
>> So it's quite obvious, the driver is reading PHY register, masking it
>> and writing masked value. Unfortunately from just looking at such
>> place we can not guess the mask driver uses.
>>
>> I'd like to fake value read from 0xb06003fe to be 0xFFFF.
>> Is there some ready method for doing such a trick?
>>
>> Dump comes from Kernel hacking → Tracers → MMIO and ndiswrapper.
>
> I can see values in MMIO trace struct are filled in
> arch/x86/mm/mmio-mod.c in "pre" and "post". However still no idea how
> to hack the returned value.
>
> Should I try hacking read[bwl] instead? :|
Probably. I do not see any way to trace and modify the results for a particular
address without special code.
FYI, my reference driver for reverse engineering has no instance of a
read/modify/write for PHY register 0x810. Is the code in question for a PHY type
> 6?
Larry
next prev parent reply other threads:[~2011-06-16 18:07 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-06-16 14:44 Faking MMIO ops? Fooling a driver Rafał Miłecki
2011-06-16 17:20 ` Rafał Miłecki
2011-06-16 18:07 ` Larry Finger [this message]
2011-06-16 19:19 ` Rafał Miłecki
2011-06-16 19:34 ` Pekka Paalanen
2011-06-16 21:47 ` Rafał Miłecki
2011-06-16 21:53 ` Rafał Miłecki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4DFA4672.5080307@lwfinger.net \
--to=larry.finger@lwfinger.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=pq@iki.fi \
--cc=zajec5@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.