7 files changed, 1022 insertions, 0 deletions

diff --git a/kernel/Makefile b/kernel/Makefile
index 2093a691f1c2..52508612a08f 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -99,6 +99,7 @@ obj-$(CONFIG_X86_DS) += trace/
 obj-$(CONFIG_RING_BUFFER) += trace/
 obj-$(CONFIG_SMP) += sched_cpupri.o
 obj-$(CONFIG_SLOW_WORK) += slow-work.o
+obj-$(CONFIG_HAVE_HW_BREAKPOINT) += hw_breakpoint.o
 obj-$(CONFIG_PERF_COUNTERS) += perf_counter.o
 
 ifneq ($(CONFIG_SCHED_OMIT_FRAME_POINTER),y)
diff --git a/kernel/hw_breakpoint.c b/kernel/hw_breakpoint.c
new file mode 100644
index 000000000000..c1f64e65a9f3
--- /dev/null
+++ b/kernel/hw_breakpoint.c
@@ -0,0 +1,378 @@
+/*
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Copyright (C) 2007 Alan Stern
+ * Copyright (C) IBM Corporation, 2009
+ */
+
+/*
+ * HW_breakpoint: a unified kernel/user-space hardware breakpoint facility,
+ * using the CPU's debug registers.
+ * This file contains the arch-independent routines.
+ */
+
+#include <linux/irqflags.h>
+#include <linux/kallsyms.h>
+#include <linux/notifier.h>
+#include <linux/kprobes.h>
+#include <linux/kdebug.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/percpu.h>
+#include <linux/sched.h>
+#include <linux/init.h>
+#include <linux/smp.h>
+
+#include <asm/hw_breakpoint.h>
+#include <asm/processor.h>
+
+#ifdef CONFIG_X86
+#include <asm/debugreg.h>
+#endif
+/*
+ * Spinlock that protects all (un)register operations over kernel/user-space
+ * breakpoint requests
+ */
+static DEFINE_SPINLOCK(hw_breakpoint_lock);
+
+/* Array of kernel-space breakpoint structures */
+struct hw_breakpoint *hbp_kernel[HBP_NUM];
+
+/*
+ * Per-processor copy of hbp_kernel[]. Used only when hbp_kernel is being
+ * modified but we need the older copy to handle any hbp exceptions. It will
+ * sync with hbp_kernel[] value after updation is done through IPIs.
+ */
+DEFINE_PER_CPU(struct hw_breakpoint*, this_hbp_kernel[HBP_NUM]);
+
+/*
+ * Kernel breakpoints grow downwards, starting from HBP_NUM
+ * 'hbp_kernel_pos' denotes lowest numbered breakpoint register occupied for
+ * kernel-space request. We will initialise it here and not in an __init
+ * routine because load_debug_registers(), which uses this variable can be
+ * called very early during CPU initialisation.
+ */
+unsigned int hbp_kernel_pos = HBP_NUM;
+
+/*
+ * An array containing refcount of threads using a given bkpt register
+ * Accesses are synchronised by acquiring hw_breakpoint_lock
+ */
+unsigned int hbp_user_refcount[HBP_NUM];
+
+/*
+ * Load the debug registers during startup of a CPU.
+ */
+void load_debug_registers(void)
+{
+        unsigned long flags;
+        struct task_struct *tsk = current;
+
+        spin_lock_bh(&hw_breakpoint_lock);
+
+        /* Prevent IPIs for new kernel breakpoint updates */
+        local_irq_save(flags);
+        arch_update_kernel_hw_breakpoint(NULL);
+        local_irq_restore(flags);
+
+        if (test_tsk_thread_flag(tsk, TIF_DEBUG))
+                arch_install_thread_hw_breakpoint(tsk);
+
+        spin_unlock_bh(&hw_breakpoint_lock);
+}
+
+/*
+ * Erase all the hardware breakpoint info associated with a thread.
+ *
+ * If tsk != current then tsk must not be usable (for example, a
+ * child being cleaned up from a failed fork).
+ */
+void flush_thread_hw_breakpoint(struct task_struct *tsk)
+{
+        int i;
+        struct thread_struct *thread = &(tsk->thread);
+
+        spin_lock_bh(&hw_breakpoint_lock);
+
+        /* The thread no longer has any breakpoints associated with it */
+        clear_tsk_thread_flag(tsk, TIF_DEBUG);
+        for (i = 0; i < HBP_NUM; i++) {
+                if (thread->hbp[i]) {
+                        hbp_user_refcount[i]--;
+                        kfree(thread->hbp[i]);
+                        thread->hbp[i] = NULL;
+                }
+        }
+
+        arch_flush_thread_hw_breakpoint(tsk);
+
+        /* Actually uninstall the breakpoints if necessary */
+        if (tsk == current)
+                arch_uninstall_thread_hw_breakpoint();
+        spin_unlock_bh(&hw_breakpoint_lock);
+}
+
+/*
+ * Copy the hardware breakpoint info from a thread to its cloned child.
+ */
+int copy_thread_hw_breakpoint(struct task_struct *tsk,
+                struct task_struct *child, unsigned long clone_flags)
+{
+        /*
+         * We will assume that breakpoint settings are not inherited
+         * and the child starts out with no debug registers set.
+         * But what about CLONE_PTRACE?
+         */
+        clear_tsk_thread_flag(child, TIF_DEBUG);
+
+        /* We will call flush routine since the debugregs are not inherited */
+        arch_flush_thread_hw_breakpoint(child);
+
+        return 0;
+}
+
+static int __register_user_hw_breakpoint(int pos, struct task_struct *tsk,
+                                        struct hw_breakpoint *bp)
+{
+        struct thread_struct *thread = &(tsk->thread);
+        int rc;
+
+        /* Do not overcommit. Fail if kernel has used the hbp registers */
+        if (pos >= hbp_kernel_pos)
+                return -ENOSPC;
+
+        rc = arch_validate_hwbkpt_settings(bp, tsk);
+        if (rc)
+                return rc;
+
+        thread->hbp[pos] = bp;
+        hbp_user_refcount[pos]++;
+
+        arch_update_user_hw_breakpoint(pos, tsk);
+        /*
+         * Does it need to be installed right now?
+         * Otherwise it will get installed the next time tsk runs
+         */
+        if (tsk == current)
+                arch_install_thread_hw_breakpoint(tsk);
+
+        return rc;
+}
+
+/*
+ * Modify the address of a hbp register already in use by the task
+ * Do not invoke this in-lieu of a __unregister_user_hw_breakpoint()
+ */
+static int __modify_user_hw_breakpoint(int pos, struct task_struct *tsk,
+                                        struct hw_breakpoint *bp)
+{
+        struct thread_struct *thread = &(tsk->thread);
+
+        if ((pos >= hbp_kernel_pos) || (arch_validate_hwbkpt_settings(bp, tsk)))
+                return -EINVAL;
+
+        if (thread->hbp[pos] == NULL)
+                return -EINVAL;
+
+        thread->hbp[pos] = bp;
+        /*
+         * 'pos' must be that of a hbp register already used by 'tsk'
+         * Otherwise arch_modify_user_hw_breakpoint() will fail
+         */
+        arch_update_user_hw_breakpoint(pos, tsk);
+
+        if (tsk == current)
+                arch_install_thread_hw_breakpoint(tsk);
+
+        return 0;
+}
+
+static void __unregister_user_hw_breakpoint(int pos, struct task_struct *tsk)
+{
+        hbp_user_refcount[pos]--;
+        tsk->thread.hbp[pos] = NULL;
+
+        arch_update_user_hw_breakpoint(pos, tsk);
+
+        if (tsk == current)
+                arch_install_thread_hw_breakpoint(tsk);
+}
+
+/**
+ * register_user_hw_breakpoint - register a hardware breakpoint for user space
+ * @tsk: pointer to 'task_struct' of the process to which the address belongs
+ * @bp: the breakpoint structure to register
+ *
+ * @bp.info->name or @bp.info->address, @bp.info->len, @bp.info->type and
+ * @bp->triggered must be set properly before invocation
+ *
+ */
+int register_user_hw_breakpoint(struct task_struct *tsk,
+                                        struct hw_breakpoint *bp)
+{
+        struct thread_struct *thread = &(tsk->thread);
+        int i, rc = -ENOSPC;
+
+        spin_lock_bh(&hw_breakpoint_lock);
+
+        for (i = 0; i < hbp_kernel_pos; i++) {
+                if (!thread->hbp[i]) {
+                        rc = __register_user_hw_breakpoint(i, tsk, bp);
+                        break;
+                }
+        }
+        if (!rc)
+                set_tsk_thread_flag(tsk, TIF_DEBUG);
+
+        spin_unlock_bh(&hw_breakpoint_lock);
+        return rc;
+}
+EXPORT_SYMBOL_GPL(register_user_hw_breakpoint);
+
+/**
+ * modify_user_hw_breakpoint - modify a user-space hardware breakpoint
+ * @tsk: pointer to 'task_struct' of the process to which the address belongs
+ * @bp: the breakpoint structure to unregister
+ *
+ */
+int modify_user_hw_breakpoint(struct task_struct *tsk, struct hw_breakpoint *bp)
+{
+        struct thread_struct *thread = &(tsk->thread);
+        int i, ret = -ENOENT;
+
+        spin_lock_bh(&hw_breakpoint_lock);
+        for (i = 0; i < hbp_kernel_pos; i++) {
+                if (bp == thread->hbp[i]) {
+                        ret = __modify_user_hw_breakpoint(i, tsk, bp);
+                        break;
+                }
+        }
+        spin_unlock_bh(&hw_breakpoint_lock);
+        return ret;
+}
+EXPORT_SYMBOL_GPL(modify_user_hw_breakpoint);
+
+/**
+ * unregister_user_hw_breakpoint - unregister a user-space hardware breakpoint
+ * @tsk: pointer to 'task_struct' of the process to which the address belongs
+ * @bp: the breakpoint structure to unregister
+ *
+ */
+void unregister_user_hw_breakpoint(struct task_struct *tsk,
+                                                struct hw_breakpoint *bp)
+{
+        struct thread_struct *thread = &(tsk->thread);
+        int i, pos = -1, hbp_counter = 0;
+
+        spin_lock_bh(&hw_breakpoint_lock);
+        for (i = 0; i < hbp_kernel_pos; i++) {
+                if (thread->hbp[i])
+                        hbp_counter++;
+                if (bp == thread->hbp[i])
+                        pos = i;
+        }
+        if (pos >= 0) {
+                __unregister_user_hw_breakpoint(pos, tsk);
+                hbp_counter--;
+        }
+        if (!hbp_counter)
+                clear_tsk_thread_flag(tsk, TIF_DEBUG);
+
+        spin_unlock_bh(&hw_breakpoint_lock);
+}
+EXPORT_SYMBOL_GPL(unregister_user_hw_breakpoint);
+
+/**
+ * register_kernel_hw_breakpoint - register a hardware breakpoint for kernel space
+ * @bp: the breakpoint structure to register
+ *
+ * @bp.info->name or @bp.info->address, @bp.info->len, @bp.info->type and
+ * @bp->triggered must be set properly before invocation
+ *
+ */
+int register_kernel_hw_breakpoint(struct hw_breakpoint *bp)
+{
+        int rc;
+
+        rc = arch_validate_hwbkpt_settings(bp, NULL);
+        if (rc)
+                return rc;
+
+        spin_lock_bh(&hw_breakpoint_lock);
+
+        rc = -ENOSPC;
+        /* Check if we are over-committing */
+        if ((hbp_kernel_pos > 0) && (!hbp_user_refcount[hbp_kernel_pos-1])) {
+                hbp_kernel_pos--;
+                hbp_kernel[hbp_kernel_pos] = bp;
+                on_each_cpu(arch_update_kernel_hw_breakpoint, NULL, 1);
+                rc = 0;
+        }
+
+        spin_unlock_bh(&hw_breakpoint_lock);
+        return rc;
+}
+EXPORT_SYMBOL_GPL(register_kernel_hw_breakpoint);
+
+/**
+ * unregister_kernel_hw_breakpoint - unregister a HW breakpoint for kernel space
+ * @bp: the breakpoint structure to unregister
+ *
+ * Uninstalls and unregisters @bp.
+ */
+void unregister_kernel_hw_breakpoint(struct hw_breakpoint *bp)
+{
+        int i, j;
+
+        spin_lock_bh(&hw_breakpoint_lock);
+
+        /* Find the 'bp' in our list of breakpoints for kernel */
+        for (i = hbp_kernel_pos; i < HBP_NUM; i++)
+                if (bp == hbp_kernel[i])
+                        break;
+
+        /* Check if we did not find a match for 'bp'. If so return early */
+        if (i == HBP_NUM) {
+                spin_unlock_bh(&hw_breakpoint_lock);
+                return;
+        }
+
+        /*
+         * We'll shift the breakpoints one-level above to compact if
+         * unregistration creates a hole
+         */
+        for (j = i; j > hbp_kernel_pos; j--)
+                hbp_kernel[j] = hbp_kernel[j-1];
+
+        hbp_kernel[hbp_kernel_pos] = NULL;
+        on_each_cpu(arch_update_kernel_hw_breakpoint, NULL, 1);
+        hbp_kernel_pos++;
+
+        spin_unlock_bh(&hw_breakpoint_lock);
+}
+EXPORT_SYMBOL_GPL(unregister_kernel_hw_breakpoint);
+
+static struct notifier_block hw_breakpoint_exceptions_nb = {
+        .notifier_call = hw_breakpoint_exceptions_notify,
+        /* we need to be notified first */
+        .priority = 0x7fffffff
+};
+
+static int __init init_hw_breakpoint(void)
+{
+        return register_die_notifier(&hw_breakpoint_exceptions_nb);
+}
+
+core_initcall(init_hw_breakpoint);
diff --git a/kernel/trace/Kconfig b/kernel/trace/Kconfig
index 1ea0d1234f4a..5efeb4229ea0 100644
--- a/kernel/trace/Kconfig
+++ b/kernel/trace/Kconfig
@@ -329,6 +329,27 @@ config POWER_TRACER
           power management decisions, specifically the C-state and P-state
           behavior.
 
+config KSYM_TRACER
+        bool "Trace read and write access on kernel memory locations"
+        depends on HAVE_HW_BREAKPOINT
+        select TRACING
+        help
+          This tracer helps find read and write operations on any given kernel
+          symbol i.e. /proc/kallsyms.
+
+config PROFILE_KSYM_TRACER
+        bool "Profile all kernel memory accesses on 'watched' variables"
+        depends on KSYM_TRACER
+        help
+          This tracer profiles kernel accesses on variables watched through the
+          ksym tracer ftrace plugin. Depending upon the hardware, all read
+          and write operations on kernel variables can be monitored for
+          accesses.
+
+          The results will be displayed in:
+          /debugfs/tracing/profile_ksym
+
+          Say N if unsure.
 
 config STACK_TRACER
         bool "Trace max stack"
diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
index 844164dca90a..ce3b1cd02732 100644
--- a/kernel/trace/Makefile
+++ b/kernel/trace/Makefile
@@ -54,5 +54,6 @@ obj-$(CONFIG_EVENT_TRACING) += trace_export.o
 obj-$(CONFIG_FTRACE_SYSCALLS) += trace_syscalls.o
 obj-$(CONFIG_EVENT_PROFILE) += trace_event_profile.o
 obj-$(CONFIG_EVENT_TRACING) += trace_events_filter.o
+obj-$(CONFIG_KSYM_TRACER) += trace_ksym.o
 
 libftrace-y := ftrace.o
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index fa1dccb579d5..ea7e0bcbd539 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -15,6 +15,10 @@
 #include <linux/trace_seq.h>
 #include <linux/ftrace_event.h>
 
+#ifdef CONFIG_KSYM_TRACER
+#include <asm/hw_breakpoint.h>
+#endif
+
 enum trace_type {
         __TRACE_FIRST_TYPE = 0,
 
@@ -38,6 +42,7 @@ enum trace_type {
         TRACE_KMEM_FREE,
         TRACE_POWER,
         TRACE_BLK,
+        TRACE_KSYM,
 
         __TRACE_LAST_TYPE,
 };
@@ -205,6 +210,16 @@ struct syscall_trace_exit {
         unsigned long           ret;
 };
 
+#define KSYM_SELFTEST_ENTRY "ksym_selftest_dummy"
+extern int process_new_ksym_entry(char *ksymname, int op, unsigned long addr);
+
+struct ksym_trace_entry {
+        struct trace_entry      ent;
+        unsigned long           ip;
+        unsigned char           type;
+        char                    ksym_name[KSYM_NAME_LEN];
+        char                    cmd[TASK_COMM_LEN];
+};
 
 /*
  * trace_flag_type is an enumeration that holds different
@@ -315,6 +330,7 @@ extern void __ftrace_bad_type(void);
                           TRACE_KMEM_ALLOC);    \
                 IF_ASSIGN(var, ent, struct kmemtrace_free_entry,        \
                           TRACE_KMEM_FREE);     \
+                IF_ASSIGN(var, ent, struct ksym_trace_entry, TRACE_KSYM);\
                 __ftrace_bad_type();                                    \
         } while (0)
 
@@ -558,6 +574,8 @@ extern int trace_selftest_startup_branch(struct tracer *trace,
                                          struct trace_array *tr);
 extern int trace_selftest_startup_hw_branches(struct tracer *trace,
                                               struct trace_array *tr);
+extern int trace_selftest_startup_ksym(struct tracer *trace,
+                                         struct trace_array *tr);
 #endif /* CONFIG_FTRACE_STARTUP_TEST */
 
 extern void *head_page(struct trace_array_cpu *data);
diff --git a/kernel/trace/trace_ksym.c b/kernel/trace/trace_ksym.c
new file mode 100644
index 000000000000..2fde875ead4c
--- /dev/null
+++ b/kernel/trace/trace_ksym.c
@@ -0,0 +1,550 @@
+/*
+ * trace_ksym.c - Kernel Symbol Tracer
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ * Copyright (C) IBM Corporation, 2009
+ */
+
+#include <linux/kallsyms.h>
+#include <linux/uaccess.h>
+#include <linux/debugfs.h>
+#include <linux/ftrace.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+
+#include "trace_output.h"
+#include "trace_stat.h"
+#include "trace.h"
+
+/* For now, let us restrict the no. of symbols traced simultaneously to number
+ * of available hardware breakpoint registers.
+ */
+#define KSYM_TRACER_MAX HBP_NUM
+
+#define KSYM_TRACER_OP_LEN 3 /* rw- */
+
+struct trace_ksym {
+        struct hw_breakpoint    *ksym_hbp;
+        unsigned long           ksym_addr;
+#ifdef CONFIG_PROFILE_KSYM_TRACER
+        unsigned long           counter;
+#endif
+        struct hlist_node       ksym_hlist;
+};
+
+static struct trace_array *ksym_trace_array;
+
+static unsigned int ksym_filter_entry_count;
+static unsigned int ksym_tracing_enabled;
+
+static HLIST_HEAD(ksym_filter_head);
+
+static DEFINE_MUTEX(ksym_tracer_mutex);
+
+#ifdef CONFIG_PROFILE_KSYM_TRACER
+
+#define MAX_UL_INT 0xffffffff
+
+void ksym_collect_stats(unsigned long hbp_hit_addr)
+{
+        struct hlist_node *node;
+        struct trace_ksym *entry;
+
+        rcu_read_lock();
+        hlist_for_each_entry_rcu(entry, node, &ksym_filter_head, ksym_hlist) {
+                if ((entry->ksym_addr == hbp_hit_addr) &&
+                    (entry->counter <= MAX_UL_INT)) {
+                        entry->counter++;
+                        break;
+                }
+        }
+        rcu_read_unlock();
+}
+#endif /* CONFIG_PROFILE_KSYM_TRACER */
+
+void ksym_hbp_handler(struct hw_breakpoint *hbp, struct pt_regs *regs)
+{
+        struct ring_buffer_event *event;
+        struct trace_array *tr;
+        struct ksym_trace_entry *entry;
+        int pc;
+
+        if (!ksym_tracing_enabled)
+                return;
+
+        tr = ksym_trace_array;
+        pc = preempt_count();
+
+        event = trace_buffer_lock_reserve(tr, TRACE_KSYM,
+                                                        sizeof(*entry), 0, pc);
+        if (!event)
+                return;
+
+        entry           = ring_buffer_event_data(event);
+        entry->ip       = instruction_pointer(regs);
+        entry->type     = hbp->info.type;
+        strlcpy(entry->ksym_name, hbp->info.name, KSYM_SYMBOL_LEN);
+        strlcpy(entry->cmd, current->comm, TASK_COMM_LEN);
+
+#ifdef CONFIG_PROFILE_KSYM_TRACER
+        ksym_collect_stats(hbp->info.address);
+#endif /* CONFIG_PROFILE_KSYM_TRACER */
+
+        trace_buffer_unlock_commit(tr, event, 0, pc);
+}
+
+/* Valid access types are represented as
+ *
+ * rw- : Set Read/Write Access Breakpoint
+ * -w- : Set Write Access Breakpoint
+ * --- : Clear Breakpoints
+ * --x : Set Execution Break points (Not available yet)
+ *
+ */
+static int ksym_trace_get_access_type(char *str)
+{
+        int access = 0;
+
+        if (str[0] == 'r')
+                access += 4;
+        else if (str[0] != '-')
+                return -EINVAL;
+
+        if (str[1] == 'w')
+                access += 2;
+        else if (str[1] != '-')
+                return -EINVAL;
+
+        if (str[2] != '-')
+                return -EINVAL;
+
+        switch (access) {
+        case 6:
+                access = HW_BREAKPOINT_RW;
+                break;
+        case 4:
+                access = -EINVAL;
+                break;
+        case 2:
+                access = HW_BREAKPOINT_WRITE;
+                break;
+        }
+
+        return access;
+}
+
+/*
+ * There can be several possible malformed requests and we attempt to capture
+ * all of them. We enumerate some of the rules
+ * 1. We will not allow kernel symbols with ':' since it is used as a delimiter.
+ *    i.e. multiple ':' symbols disallowed. Possible uses are of the form
+ *    <module>:<ksym_name>:<op>.
+ * 2. No delimiter symbol ':' in the input string
+ * 3. Spurious operator symbols or symbols not in their respective positions
+ * 4. <ksym_name>:--- i.e. clear breakpoint request when ksym_name not in file
+ * 5. Kernel symbol not a part of /proc/kallsyms
+ * 6. Duplicate requests
+ */
+static int parse_ksym_trace_str(char *input_string, char **ksymname,
+                                                        unsigned long *addr)
+{
+        int ret;
+
+        *ksymname = strsep(&input_string, ":");
+        *addr = kallsyms_lookup_name(*ksymname);
+
+        /* Check for malformed request: (2), (1) and (5) */
+        if ((!input_string) ||
+            (strlen(input_string) != KSYM_TRACER_OP_LEN) ||
+            (*addr == 0))
+                return -EINVAL;;
+
+        ret = ksym_trace_get_access_type(input_string);
+
+        return ret;
+}
+
+int process_new_ksym_entry(char *ksymname, int op, unsigned long addr)
+{
+        struct trace_ksym *entry;
+        int ret = -ENOMEM;
+
+        if (ksym_filter_entry_count >= KSYM_TRACER_MAX) {
+                printk(KERN_ERR "ksym_tracer: Maximum limit:(%d) reached. No"
+                " new requests for tracing can be accepted now.\n",
+                        KSYM_TRACER_MAX);
+                return -ENOSPC;
+        }
+
+        entry = kzalloc(sizeof(struct trace_ksym), GFP_KERNEL);
+        if (!entry)
+                return -ENOMEM;
+
+        entry->ksym_hbp = kzalloc(sizeof(struct hw_breakpoint), GFP_KERNEL);
+        if (!entry->ksym_hbp)
+                goto err;
+
+        entry->ksym_hbp->info.name = kstrdup(ksymname, GFP_KERNEL);
+        if (!entry->ksym_hbp->info.name)
+                goto err;
+
+        entry->ksym_hbp->info.type = op;
+        entry->ksym_addr = entry->ksym_hbp->info.address = addr;
+#ifdef CONFIG_X86
+        entry->ksym_hbp->info.len = HW_BREAKPOINT_LEN_4;
+#endif
+        entry->ksym_hbp->triggered = (void *)ksym_hbp_handler;
+
+        ret = register_kernel_hw_breakpoint(entry->ksym_hbp);
+        if (ret < 0) {
+                printk(KERN_INFO "ksym_tracer request failed. Try again"
+                                        " later!!\n");
+                ret = -EAGAIN;
+                goto err;
+        }
+        hlist_add_head_rcu(&(entry->ksym_hlist), &ksym_filter_head);
+        ksym_filter_entry_count++;
+        return 0;
+err:
+        if (entry->ksym_hbp)
+                kfree(entry->ksym_hbp->info.name);
+        kfree(entry->ksym_hbp);
+        kfree(entry);
+        return ret;
+}
+
+static ssize_t ksym_trace_filter_read(struct file *filp, char __user *ubuf,
+                                                size_t count, loff_t *ppos)
+{
+        struct trace_ksym *entry;
+        struct hlist_node *node;
+        struct trace_seq *s;
+        ssize_t cnt = 0;
+        int ret;
+
+        s = kmalloc(sizeof(*s), GFP_KERNEL);
+        if (!s)
+                return -ENOMEM;
+        trace_seq_init(s);
+
+        mutex_lock(&ksym_tracer_mutex);
+
+        hlist_for_each_entry(entry, node, &ksym_filter_head, ksym_hlist) {
+                ret = trace_seq_printf(s, "%s:", entry->ksym_hbp->info.name);
+                if (entry->ksym_hbp->info.type == HW_BREAKPOINT_WRITE)
+                        ret = trace_seq_puts(s, "-w-\n");
+                else if (entry->ksym_hbp->info.type == HW_BREAKPOINT_RW)
+                        ret = trace_seq_puts(s, "rw-\n");
+                WARN_ON_ONCE(!ret);
+        }
+
+        cnt = simple_read_from_buffer(ubuf, count, ppos, s->buffer, s->len);
+
+        mutex_unlock(&ksym_tracer_mutex);
+
+        kfree(s);
+
+        return cnt;
+}
+
+static void __ksym_trace_reset(void)
+{
+        struct trace_ksym *entry;
+        struct hlist_node *node, *node1;
+
+        mutex_lock(&ksym_tracer_mutex);
+        hlist_for_each_entry_safe(entry, node, node1, &ksym_filter_head,
+                                                                ksym_hlist) {
+                unregister_kernel_hw_breakpoint(entry->ksym_hbp);
+                ksym_filter_entry_count--;
+                hlist_del_rcu(&(entry->ksym_hlist));
+                synchronize_rcu();
+                kfree(entry->ksym_hbp->info.name);
+                kfree(entry->ksym_hbp);
+                kfree(entry);
+        }
+        mutex_unlock(&ksym_tracer_mutex);
+}
+
+static ssize_t ksym_trace_filter_write(struct file *file,
+                                        const char __user *buffer,
+                                                size_t count, loff_t *ppos)
+{
+        struct trace_ksym *entry;
+        struct hlist_node *node;
+        char *input_string, *ksymname = NULL;
+        unsigned long ksym_addr = 0;
+        int ret, op, changed = 0;
+
+        input_string = kzalloc(count + 1, GFP_KERNEL);
+        if (!input_string)
+                return -ENOMEM;
+
+        if (copy_from_user(input_string, buffer, count)) {
+                kfree(input_string);
+                return -EFAULT;
+        }
+        input_string[count] = '\0';
+
+        strstrip(input_string);
+
+        /*
+         * Clear all breakpoints if:
+         * 1: echo > ksym_trace_filter
+         * 2: echo 0 > ksym_trace_filter
+         * 3: echo "*:---" > ksym_trace_filter
+         */
+        if (!input_string[0] || !strcmp(input_string, "0") ||
+            !strcmp(input_string, "*:---")) {
+                __ksym_trace_reset();
+                kfree(input_string);
+                return count;
+        }
+
+        ret = op = parse_ksym_trace_str(input_string, &ksymname, &ksym_addr);
+        if (ret < 0) {
+                kfree(input_string);
+                return ret;
+        }
+
+        mutex_lock(&ksym_tracer_mutex);
+
+        ret = -EINVAL;
+        hlist_for_each_entry(entry, node, &ksym_filter_head, ksym_hlist) {
+                if (entry->ksym_addr == ksym_addr) {
+                        /* Check for malformed request: (6) */
+                        if (entry->ksym_hbp->info.type != op)
+                                changed = 1;
+                        else
+                                goto out;
+                        break;
+                }
+        }
+        if (changed) {
+                unregister_kernel_hw_breakpoint(entry->ksym_hbp);
+                entry->ksym_hbp->info.type = op;
+                if (op > 0) {
+                        ret = register_kernel_hw_breakpoint(entry->ksym_hbp);
+                        if (ret == 0)
+                                goto out;
+                }
+                ksym_filter_entry_count--;
+                hlist_del_rcu(&(entry->ksym_hlist));
+                synchronize_rcu();
+                kfree(entry->ksym_hbp->info.name);
+                kfree(entry->ksym_hbp);
+                kfree(entry);
+                ret = 0;
+                goto out;
+        } else {
+                /* Check for malformed request: (4) */
+                if (op == 0)
+                        goto out;
+                ret = process_new_ksym_entry(ksymname, op, ksym_addr);
+        }
+out:
+        mutex_unlock(&ksym_tracer_mutex);
+
+        kfree(input_string);
+
+        if (!ret)
+                ret = count;
+        return ret;
+}
+
+static const struct file_operations ksym_tracing_fops = {
+        .open           = tracing_open_generic,
+        .read           = ksym_trace_filter_read,
+        .write          = ksym_trace_filter_write,
+};
+
+static void ksym_trace_reset(struct trace_array *tr)
+{
+        ksym_tracing_enabled = 0;
+        __ksym_trace_reset();
+}
+
+static int ksym_trace_init(struct trace_array *tr)
+{
+        int cpu, ret = 0;
+
+        for_each_online_cpu(cpu)
+                tracing_reset(tr, cpu);
+        ksym_tracing_enabled = 1;
+        ksym_trace_array = tr;
+
+        return ret;
+}
+
+static void ksym_trace_print_header(struct seq_file *m)
+{
+        seq_puts(m,
+                 "#       TASK-PID   CPU#      Symbol                    "
+                 "Type    Function\n");
+        seq_puts(m,
+                 "#          |        |          |                       "
+                 " |         |\n");
+}
+
+static enum print_line_t ksym_trace_output(struct trace_iterator *iter)
+{
+        struct trace_entry *entry = iter->ent;
+        struct trace_seq *s = &iter->seq;
+        struct ksym_trace_entry *field;
+        char str[KSYM_SYMBOL_LEN];
+        int ret;
+
+        if (entry->type != TRACE_KSYM)
+                return TRACE_TYPE_UNHANDLED;
+
+        trace_assign_type(field, entry);
+
+        ret = trace_seq_printf(s, "%11s-%-5d [%03d] %-30s ", field->cmd,
+                                entry->pid, iter->cpu, field->ksym_name);
+        if (!ret)
+                return TRACE_TYPE_PARTIAL_LINE;
+
+        switch (field->type) {
+        case HW_BREAKPOINT_WRITE:
+                ret = trace_seq_printf(s, " W  ");
+                break;
+        case HW_BREAKPOINT_RW:
+                ret = trace_seq_printf(s, " RW ");
+                break;
+        default:
+                return TRACE_TYPE_PARTIAL_LINE;
+        }
+
+        if (!ret)
+                return TRACE_TYPE_PARTIAL_LINE;
+
+        sprint_symbol(str, field->ip);
+        ret = trace_seq_printf(s, "%s\n", str);
+        if (!ret)
+                return TRACE_TYPE_PARTIAL_LINE;
+
+        return TRACE_TYPE_HANDLED;
+}
+
+struct tracer ksym_tracer __read_mostly =
+{
+        .name           = "ksym_tracer",
+        .init           = ksym_trace_init,
+        .reset          = ksym_trace_reset,
+#ifdef CONFIG_FTRACE_SELFTEST
+        .selftest       = trace_selftest_startup_ksym,
+#endif
+        .print_header   = ksym_trace_print_header,
+        .print_line     = ksym_trace_output
+};
+
+__init static int init_ksym_trace(void)
+{
+        struct dentry *d_tracer;
+        struct dentry *entry;
+
+        d_tracer = tracing_init_dentry();
+        ksym_filter_entry_count = 0;
+
+        entry = debugfs_create_file("ksym_trace_filter", 0644, d_tracer,
+                                    NULL, &ksym_tracing_fops);
+        if (!entry)
+                pr_warning("Could not create debugfs "
+                           "'ksym_trace_filter' file\n");
+
+        return register_tracer(&ksym_tracer);
+}
+device_initcall(init_ksym_trace);
+
+
+#ifdef CONFIG_PROFILE_KSYM_TRACER
+static int ksym_tracer_stat_headers(struct seq_file *m)
+{
+        seq_puts(m, "  Access Type ");
+        seq_puts(m, "  Symbol                                       Counter\n");
+        seq_puts(m, "  ----------- ");
+        seq_puts(m, "  ------                                       -------\n");
+        return 0;
+}
+
+static int ksym_tracer_stat_show(struct seq_file *m, void *v)
+{
+        struct hlist_node *stat = v;
+        struct trace_ksym *entry;
+        int access_type = 0;
+        char fn_name[KSYM_NAME_LEN];
+
+        entry = hlist_entry(stat, struct trace_ksym, ksym_hlist);
+
+        if (entry->ksym_hbp)
+                access_type = entry->ksym_hbp->info.type;
+
+        switch (access_type) {
+        case HW_BREAKPOINT_WRITE:
+                seq_puts(m, "  W           ");
+                break;
+        case HW_BREAKPOINT_RW:
+                seq_puts(m, "  RW          ");
+                break;
+        default:
+                seq_puts(m, "  NA          ");
+        }
+
+        if (lookup_symbol_name(entry->ksym_addr, fn_name) >= 0)
+                seq_printf(m, "  %-36s", fn_name);
+        else
+                seq_printf(m, "  %-36s", "<NA>");
+        seq_printf(m, " %15lu\n", entry->counter);
+
+        return 0;
+}
+
+static void *ksym_tracer_stat_start(struct tracer_stat *trace)
+{
+        return ksym_filter_head.first;
+}
+
+static void *
+ksym_tracer_stat_next(void *v, int idx)
+{
+        struct hlist_node *stat = v;
+
+        return stat->next;
+}
+
+static struct tracer_stat ksym_tracer_stats = {
+        .name = "ksym_tracer",
+        .stat_start = ksym_tracer_stat_start,
+        .stat_next = ksym_tracer_stat_next,
+        .stat_headers = ksym_tracer_stat_headers,
+        .stat_show = ksym_tracer_stat_show
+};
+
+__init static int ksym_tracer_stat_init(void)
+{
+        int ret;
+
+        ret = register_stat_tracer(&ksym_tracer_stats);
+        if (ret) {
+                printk(KERN_WARNING "Warning: could not register "
+                                    "ksym tracer stats\n");
+                return 1;
+        }
+
+        return 0;
+}
+fs_initcall(ksym_tracer_stat_init);
+#endif /* CONFIG_PROFILE_KSYM_TRACER */
diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c
index d2cdbabb4ead..7179c12e4f0f 100644
--- a/kernel/trace/trace_selftest.c
+++ b/kernel/trace/trace_selftest.c
@@ -17,6 +17,7 @@ static inline int trace_valid_entry(struct trace_entry *entry)
         case TRACE_GRAPH_ENT:
         case TRACE_GRAPH_RET:
         case TRACE_HW_BRANCHES:
+        case TRACE_KSYM:
                 return 1;
         }
         return 0;
@@ -808,3 +809,55 @@ trace_selftest_startup_hw_branches(struct tracer *trace,
         return ret;
 }
 #endif /* CONFIG_HW_BRANCH_TRACER */
+
+#ifdef CONFIG_KSYM_TRACER
+static int ksym_selftest_dummy;
+
+int
+trace_selftest_startup_ksym(struct tracer *trace, struct trace_array *tr)
+{
+        unsigned long count;
+        int ret;
+
+        /* start the tracing */
+        ret = tracer_init(trace, tr);
+        if (ret) {
+                warn_failed_init_tracer(trace, ret);
+                return ret;
+        }
+
+        ksym_selftest_dummy = 0;
+        /* Register the read-write tracing request */
+        ret = process_new_ksym_entry(KSYM_SELFTEST_ENTRY, HW_BREAKPOINT_RW,
+                                        (unsigned long)(&ksym_selftest_dummy));
+
+        if (ret < 0) {
+                printk(KERN_CONT "ksym_trace read-write startup test failed\n");
+                goto ret_path;
+        }
+        /* Perform a read and a write operation over the dummy variable to
+         * trigger the tracer
+         */
+        if (ksym_selftest_dummy == 0)
+                ksym_selftest_dummy++;
+
+        /* stop the tracing. */
+        tracing_stop();
+        /* check the trace buffer */
+        ret = trace_test_buffer(tr, &count);
+        trace->reset(tr);
+        tracing_start();
+
+        /* read & write operations - one each is performed on the dummy variable
+         * triggering two entries in the trace buffer
+         */
+        if (!ret && count != 2) {
+                printk(KERN_CONT "Ksym tracer startup test failed");
+                ret = -1;
+        }
+
+ret_path:
+        return ret;
+}
+#endif /* CONFIG_KSYM_TRACER */
+