1
2
3
4
5
6
7
8#define pr_fmt(fmt) "DMA-API: " fmt
9
10#include <linux/sched/task_stack.h>
11#include <linux/scatterlist.h>
12#include <linux/dma-map-ops.h>
13#include <linux/sched/task.h>
14#include <linux/stacktrace.h>
15#include <linux/spinlock.h>
16#include <linux/vmalloc.h>
17#include <linux/debugfs.h>
18#include <linux/uaccess.h>
19#include <linux/export.h>
20#include <linux/device.h>
21#include <linux/types.h>
22#include <linux/sched.h>
23#include <linux/ctype.h>
24#include <linux/list.h>
25#include <linux/slab.h>
26#include <asm/sections.h>
27#include "debug.h"
28
29#define HASH_SIZE 16384ULL
30#define HASH_FN_SHIFT 13
31#define HASH_FN_MASK (HASH_SIZE - 1)
32
33#define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
34
35#define DMA_DEBUG_DYNAMIC_ENTRIES (PAGE_SIZE / sizeof(struct dma_debug_entry))
36
37enum {
38 dma_debug_single,
39 dma_debug_sg,
40 dma_debug_coherent,
41 dma_debug_resource,
42};
43
44enum map_err_types {
45 MAP_ERR_CHECK_NOT_APPLICABLE,
46 MAP_ERR_NOT_CHECKED,
47 MAP_ERR_CHECKED,
48};
49
50#define DMA_DEBUG_STACKTRACE_ENTRIES 5
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66struct dma_debug_entry {
67 struct list_head list;
68 struct device *dev;
69 u64 dev_addr;
70 u64 size;
71 int type;
72 int direction;
73 int sg_call_ents;
74 int sg_mapped_ents;
75 unsigned long pfn;
76 size_t offset;
77 enum map_err_types map_err_type;
78#ifdef CONFIG_STACKTRACE
79 unsigned int stack_len;
80 unsigned long stack_entries[DMA_DEBUG_STACKTRACE_ENTRIES];
81#endif
82} ____cacheline_aligned_in_smp;
83
84typedef bool (*match_fn)(struct dma_debug_entry *, struct dma_debug_entry *);
85
86struct hash_bucket {
87 struct list_head list;
88 spinlock_t lock;
89};
90
91
92static struct hash_bucket dma_entry_hash[HASH_SIZE];
93
94static LIST_HEAD(free_entries);
95
96static DEFINE_SPINLOCK(free_entries_lock);
97
98
99static bool global_disable __read_mostly;
100
101
102static bool dma_debug_initialized __read_mostly;
103
104static inline bool dma_debug_disabled(void)
105{
106 return global_disable || !dma_debug_initialized;
107}
108
109
110static u32 error_count;
111
112
113static u32 show_all_errors __read_mostly;
114
115static u32 show_num_errors = 1;
116
117static u32 num_free_entries;
118static u32 min_free_entries;
119static u32 nr_total_entries;
120
121
122static u32 nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES;
123
124
125
126#define NAME_MAX_LEN 64
127
128static char current_driver_name[NAME_MAX_LEN] __read_mostly;
129static struct device_driver *current_driver __read_mostly;
130
131static DEFINE_RWLOCK(driver_name_lock);
132
133static const char *const maperr2str[] = {
134 [MAP_ERR_CHECK_NOT_APPLICABLE] = "dma map error check not applicable",
135 [MAP_ERR_NOT_CHECKED] = "dma map error not checked",
136 [MAP_ERR_CHECKED] = "dma map error checked",
137};
138
139static const char *type2name[] = {
140 [dma_debug_single] = "single",
141 [dma_debug_sg] = "scather-gather",
142 [dma_debug_coherent] = "coherent",
143 [dma_debug_resource] = "resource",
144};
145
146static const char *dir2name[] = {
147 [DMA_BIDIRECTIONAL] = "DMA_BIDIRECTIONAL",
148 [DMA_TO_DEVICE] = "DMA_TO_DEVICE",
149 [DMA_FROM_DEVICE] = "DMA_FROM_DEVICE",
150 [DMA_NONE] = "DMA_NONE",
151};
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166static inline void dump_entry_trace(struct dma_debug_entry *entry)
167{
168#ifdef CONFIG_STACKTRACE
169 if (entry) {
170 pr_warn("Mapped at:\n");
171 stack_trace_print(entry->stack_entries, entry->stack_len, 0);
172 }
173#endif
174}
175
176static bool driver_filter(struct device *dev)
177{
178 struct device_driver *drv;
179 unsigned long flags;
180 bool ret;
181
182
183 if (likely(!current_driver_name[0]))
184 return true;
185
186
187 if (current_driver && dev && dev->driver == current_driver)
188 return true;
189
190
191 if (!dev)
192 return false;
193
194 if (current_driver || !current_driver_name[0])
195 return false;
196
197
198 drv = dev->driver;
199 if (!drv)
200 return false;
201
202
203 read_lock_irqsave(&driver_name_lock, flags);
204
205 ret = false;
206 if (drv->name &&
207 strncmp(current_driver_name, drv->name, NAME_MAX_LEN - 1) == 0) {
208 current_driver = drv;
209 ret = true;
210 }
211
212 read_unlock_irqrestore(&driver_name_lock, flags);
213
214 return ret;
215}
216
217#define err_printk(dev, entry, format, arg...) do { \
218 error_count += 1; \
219 if (driver_filter(dev) && \
220 (show_all_errors || show_num_errors > 0)) { \
221 WARN(1, pr_fmt("%s %s: ") format, \
222 dev ? dev_driver_string(dev) : "NULL", \
223 dev ? dev_name(dev) : "NULL", ## arg); \
224 dump_entry_trace(entry); \
225 } \
226 if (!show_all_errors && show_num_errors > 0) \
227 show_num_errors -= 1; \
228 } while (0);
229
230
231
232
233
234
235
236static int hash_fn(struct dma_debug_entry *entry)
237{
238
239
240
241
242 return (entry->dev_addr >> HASH_FN_SHIFT) & HASH_FN_MASK;
243}
244
245
246
247
248static struct hash_bucket *get_hash_bucket(struct dma_debug_entry *entry,
249 unsigned long *flags)
250 __acquires(&dma_entry_hash[idx].lock)
251{
252 int idx = hash_fn(entry);
253 unsigned long __flags;
254
255 spin_lock_irqsave(&dma_entry_hash[idx].lock, __flags);
256 *flags = __flags;
257 return &dma_entry_hash[idx];
258}
259
260
261
262
263static void put_hash_bucket(struct hash_bucket *bucket,
264 unsigned long flags)
265 __releases(&bucket->lock)
266{
267 spin_unlock_irqrestore(&bucket->lock, flags);
268}
269
270static bool exact_match(struct dma_debug_entry *a, struct dma_debug_entry *b)
271{
272 return ((a->dev_addr == b->dev_addr) &&
273 (a->dev == b->dev)) ? true : false;
274}
275
276static bool containing_match(struct dma_debug_entry *a,
277 struct dma_debug_entry *b)
278{
279 if (a->dev != b->dev)
280 return false;
281
282 if ((b->dev_addr <= a->dev_addr) &&
283 ((b->dev_addr + b->size) >= (a->dev_addr + a->size)))
284 return true;
285
286 return false;
287}
288
289
290
291
292static struct dma_debug_entry *__hash_bucket_find(struct hash_bucket *bucket,
293 struct dma_debug_entry *ref,
294 match_fn match)
295{
296 struct dma_debug_entry *entry, *ret = NULL;
297 int matches = 0, match_lvl, last_lvl = -1;
298
299 list_for_each_entry(entry, &bucket->list, list) {
300 if (!match(ref, entry))
301 continue;
302
303
304
305
306
307
308
309
310
311
312
313 matches += 1;
314 match_lvl = 0;
315 entry->size == ref->size ? ++match_lvl : 0;
316 entry->type == ref->type ? ++match_lvl : 0;
317 entry->direction == ref->direction ? ++match_lvl : 0;
318 entry->sg_call_ents == ref->sg_call_ents ? ++match_lvl : 0;
319
320 if (match_lvl == 4) {
321
322 return entry;
323 } else if (match_lvl > last_lvl) {
324
325
326
327
328 last_lvl = match_lvl;
329 ret = entry;
330 }
331 }
332
333
334
335
336
337 ret = (matches == 1) ? ret : NULL;
338
339 return ret;
340}
341
342static struct dma_debug_entry *bucket_find_exact(struct hash_bucket *bucket,
343 struct dma_debug_entry *ref)
344{
345 return __hash_bucket_find(bucket, ref, exact_match);
346}
347
348static struct dma_debug_entry *bucket_find_contain(struct hash_bucket **bucket,
349 struct dma_debug_entry *ref,
350 unsigned long *flags)
351{
352
353 unsigned int max_range = dma_get_max_seg_size(ref->dev);
354 struct dma_debug_entry *entry, index = *ref;
355 unsigned int range = 0;
356
357 while (range <= max_range) {
358 entry = __hash_bucket_find(*bucket, ref, containing_match);
359
360 if (entry)
361 return entry;
362
363
364
365
366 put_hash_bucket(*bucket, *flags);
367 range += (1 << HASH_FN_SHIFT);
368 index.dev_addr -= (1 << HASH_FN_SHIFT);
369 *bucket = get_hash_bucket(&index, flags);
370 }
371
372 return NULL;
373}
374
375
376
377
378static void hash_bucket_add(struct hash_bucket *bucket,
379 struct dma_debug_entry *entry)
380{
381 list_add_tail(&entry->list, &bucket->list);
382}
383
384
385
386
387static void hash_bucket_del(struct dma_debug_entry *entry)
388{
389 list_del(&entry->list);
390}
391
392static unsigned long long phys_addr(struct dma_debug_entry *entry)
393{
394 if (entry->type == dma_debug_resource)
395 return __pfn_to_phys(entry->pfn) + entry->offset;
396
397 return page_to_phys(pfn_to_page(entry->pfn)) + entry->offset;
398}
399
400
401
402
403void debug_dma_dump_mappings(struct device *dev)
404{
405 int idx;
406
407 for (idx = 0; idx < HASH_SIZE; idx++) {
408 struct hash_bucket *bucket = &dma_entry_hash[idx];
409 struct dma_debug_entry *entry;
410 unsigned long flags;
411
412 spin_lock_irqsave(&bucket->lock, flags);
413
414 list_for_each_entry(entry, &bucket->list, list) {
415 if (!dev || dev == entry->dev) {
416 dev_info(entry->dev,
417 "%s idx %d P=%Lx N=%lx D=%Lx L=%Lx %s %s\n",
418 type2name[entry->type], idx,
419 phys_addr(entry), entry->pfn,
420 entry->dev_addr, entry->size,
421 dir2name[entry->direction],
422 maperr2str[entry->map_err_type]);
423 }
424 }
425
426 spin_unlock_irqrestore(&bucket->lock, flags);
427 cond_resched();
428 }
429}
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451static RADIX_TREE(dma_active_cacheline, GFP_NOWAIT);
452static DEFINE_SPINLOCK(radix_lock);
453#define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)
454#define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT)
455#define CACHELINES_PER_PAGE (1 << CACHELINE_PER_PAGE_SHIFT)
456
457static phys_addr_t to_cacheline_number(struct dma_debug_entry *entry)
458{
459 return (entry->pfn << CACHELINE_PER_PAGE_SHIFT) +
460 (entry->offset >> L1_CACHE_SHIFT);
461}
462
463static int active_cacheline_read_overlap(phys_addr_t cln)
464{
465 int overlap = 0, i;
466
467 for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
468 if (radix_tree_tag_get(&dma_active_cacheline, cln, i))
469 overlap |= 1 << i;
470 return overlap;
471}
472
473static int active_cacheline_set_overlap(phys_addr_t cln, int overlap)
474{
475 int i;
476
477 if (overlap > ACTIVE_CACHELINE_MAX_OVERLAP || overlap < 0)
478 return overlap;
479
480 for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
481 if (overlap & 1 << i)
482 radix_tree_tag_set(&dma_active_cacheline, cln, i);
483 else
484 radix_tree_tag_clear(&dma_active_cacheline, cln, i);
485
486 return overlap;
487}
488
489static void active_cacheline_inc_overlap(phys_addr_t cln)
490{
491 int overlap = active_cacheline_read_overlap(cln);
492
493 overlap = active_cacheline_set_overlap(cln, ++overlap);
494
495
496
497
498 WARN_ONCE(overlap > ACTIVE_CACHELINE_MAX_OVERLAP,
499 pr_fmt("exceeded %d overlapping mappings of cacheline %pa\n"),
500 ACTIVE_CACHELINE_MAX_OVERLAP, &cln);
501}
502
503static int active_cacheline_dec_overlap(phys_addr_t cln)
504{
505 int overlap = active_cacheline_read_overlap(cln);
506
507 return active_cacheline_set_overlap(cln, --overlap);
508}
509
510static int active_cacheline_insert(struct dma_debug_entry *entry)
511{
512 phys_addr_t cln = to_cacheline_number(entry);
513 unsigned long flags;
514 int rc;
515
516
517
518
519
520 if (entry->direction == DMA_TO_DEVICE)
521 return 0;
522
523 spin_lock_irqsave(&radix_lock, flags);
524 rc = radix_tree_insert(&dma_active_cacheline, cln, entry);
525 if (rc == -EEXIST)
526 active_cacheline_inc_overlap(cln);
527 spin_unlock_irqrestore(&radix_lock, flags);
528
529 return rc;
530}
531
532static void active_cacheline_remove(struct dma_debug_entry *entry)
533{
534 phys_addr_t cln = to_cacheline_number(entry);
535 unsigned long flags;
536
537
538 if (entry->direction == DMA_TO_DEVICE)
539 return;
540
541 spin_lock_irqsave(&radix_lock, flags);
542
543
544
545
546 if (active_cacheline_dec_overlap(cln) < 0)
547 radix_tree_delete(&dma_active_cacheline, cln);
548 spin_unlock_irqrestore(&radix_lock, flags);
549}
550
551
552
553
554
555static void add_dma_entry(struct dma_debug_entry *entry, unsigned long attrs)
556{
557 struct hash_bucket *bucket;
558 unsigned long flags;
559 int rc;
560
561 bucket = get_hash_bucket(entry, &flags);
562 hash_bucket_add(bucket, entry);
563 put_hash_bucket(bucket, flags);
564
565 rc = active_cacheline_insert(entry);
566 if (rc == -ENOMEM) {
567 pr_err("cacheline tracking ENOMEM, dma-debug disabled\n");
568 global_disable = true;
569 } else if (rc == -EEXIST && !(attrs & DMA_ATTR_SKIP_CPU_SYNC)) {
570 err_printk(entry->dev, entry,
571 "cacheline tracking EEXIST, overlapping mappings aren't supported\n");
572 }
573}
574
575static int dma_debug_create_entries(gfp_t gfp)
576{
577 struct dma_debug_entry *entry;
578 int i;
579
580 entry = (void *)get_zeroed_page(gfp);
581 if (!entry)
582 return -ENOMEM;
583
584 for (i = 0; i < DMA_DEBUG_DYNAMIC_ENTRIES; i++)
585 list_add_tail(&entry[i].list, &free_entries);
586
587 num_free_entries += DMA_DEBUG_DYNAMIC_ENTRIES;
588 nr_total_entries += DMA_DEBUG_DYNAMIC_ENTRIES;
589
590 return 0;
591}
592
593static struct dma_debug_entry *__dma_entry_alloc(void)
594{
595 struct dma_debug_entry *entry;
596
597 entry = list_entry(free_entries.next, struct dma_debug_entry, list);
598 list_del(&entry->list);
599 memset(entry, 0, sizeof(*entry));
600
601 num_free_entries -= 1;
602 if (num_free_entries < min_free_entries)
603 min_free_entries = num_free_entries;
604
605 return entry;
606}
607
608static void __dma_entry_alloc_check_leak(void)
609{
610 u32 tmp = nr_total_entries % nr_prealloc_entries;
611
612
613 if (tmp < DMA_DEBUG_DYNAMIC_ENTRIES) {
614 pr_info("dma_debug_entry pool grown to %u (%u00%%)\n",
615 nr_total_entries,
616 (nr_total_entries / nr_prealloc_entries));
617 }
618}
619
620
621
622
623
624
625static struct dma_debug_entry *dma_entry_alloc(void)
626{
627 struct dma_debug_entry *entry;
628 unsigned long flags;
629
630 spin_lock_irqsave(&free_entries_lock, flags);
631 if (num_free_entries == 0) {
632 if (dma_debug_create_entries(GFP_ATOMIC)) {
633 global_disable = true;
634 spin_unlock_irqrestore(&free_entries_lock, flags);
635 pr_err("debugging out of memory - disabling\n");
636 return NULL;
637 }
638 __dma_entry_alloc_check_leak();
639 }
640
641 entry = __dma_entry_alloc();
642
643 spin_unlock_irqrestore(&free_entries_lock, flags);
644
645#ifdef CONFIG_STACKTRACE
646 entry->stack_len = stack_trace_save(entry->stack_entries,
647 ARRAY_SIZE(entry->stack_entries),
648 1);
649#endif
650 return entry;
651}
652
653static void dma_entry_free(struct dma_debug_entry *entry)
654{
655 unsigned long flags;
656
657 active_cacheline_remove(entry);
658
659
660
661
662
663 spin_lock_irqsave(&free_entries_lock, flags);
664 list_add(&entry->list, &free_entries);
665 num_free_entries += 1;
666 spin_unlock_irqrestore(&free_entries_lock, flags);
667}
668
669
670
671
672
673
674
675
676
677static ssize_t filter_read(struct file *file, char __user *user_buf,
678 size_t count, loff_t *ppos)
679{
680 char buf[NAME_MAX_LEN + 1];
681 unsigned long flags;
682 int len;
683
684 if (!current_driver_name[0])
685 return 0;
686
687
688
689
690
691
692 read_lock_irqsave(&driver_name_lock, flags);
693 len = scnprintf(buf, NAME_MAX_LEN + 1, "%s\n", current_driver_name);
694 read_unlock_irqrestore(&driver_name_lock, flags);
695
696 return simple_read_from_buffer(user_buf, count, ppos, buf, len);
697}
698
699static ssize_t filter_write(struct file *file, const char __user *userbuf,
700 size_t count, loff_t *ppos)
701{
702 char buf[NAME_MAX_LEN];
703 unsigned long flags;
704 size_t len;
705 int i;
706
707
708
709
710
711
712
713 len = min(count, (size_t)(NAME_MAX_LEN - 1));
714 if (copy_from_user(buf, userbuf, len))
715 return -EFAULT;
716
717 buf[len] = 0;
718
719 write_lock_irqsave(&driver_name_lock, flags);
720
721
722
723
724
725
726
727
728
729 if (!isalnum(buf[0])) {
730
731
732
733
734
735 if (current_driver_name[0])
736 pr_info("switching off dma-debug driver filter\n");
737 current_driver_name[0] = 0;
738 current_driver = NULL;
739 goto out_unlock;
740 }
741
742
743
744
745
746 for (i = 0; i < NAME_MAX_LEN - 1; ++i) {
747 current_driver_name[i] = buf[i];
748 if (isspace(buf[i]) || buf[i] == ' ' || buf[i] == 0)
749 break;
750 }
751 current_driver_name[i] = 0;
752 current_driver = NULL;
753
754 pr_info("enable driver filter for driver [%s]\n",
755 current_driver_name);
756
757out_unlock:
758 write_unlock_irqrestore(&driver_name_lock, flags);
759
760 return count;
761}
762
763static const struct file_operations filter_fops = {
764 .read = filter_read,
765 .write = filter_write,
766 .llseek = default_llseek,
767};
768
769static int dump_show(struct seq_file *seq, void *v)
770{
771 int idx;
772
773 for (idx = 0; idx < HASH_SIZE; idx++) {
774 struct hash_bucket *bucket = &dma_entry_hash[idx];
775 struct dma_debug_entry *entry;
776 unsigned long flags;
777
778 spin_lock_irqsave(&bucket->lock, flags);
779 list_for_each_entry(entry, &bucket->list, list) {
780 seq_printf(seq,
781 "%s %s %s idx %d P=%llx N=%lx D=%llx L=%llx %s %s\n",
782 dev_name(entry->dev),
783 dev_driver_string(entry->dev),
784 type2name[entry->type], idx,
785 phys_addr(entry), entry->pfn,
786 entry->dev_addr, entry->size,
787 dir2name[entry->direction],
788 maperr2str[entry->map_err_type]);
789 }
790 spin_unlock_irqrestore(&bucket->lock, flags);
791 }
792 return 0;
793}
794DEFINE_SHOW_ATTRIBUTE(dump);
795
796static int __init dma_debug_fs_init(void)
797{
798 struct dentry *dentry = debugfs_create_dir("dma-api", NULL);
799
800 debugfs_create_bool("disabled", 0444, dentry, &global_disable);
801 debugfs_create_u32("error_count", 0444, dentry, &error_count);
802 debugfs_create_u32("all_errors", 0644, dentry, &show_all_errors);
803 debugfs_create_u32("num_errors", 0644, dentry, &show_num_errors);
804 debugfs_create_u32("num_free_entries", 0444, dentry, &num_free_entries);
805 debugfs_create_u32("min_free_entries", 0444, dentry, &min_free_entries);
806 debugfs_create_u32("nr_total_entries", 0444, dentry, &nr_total_entries);
807 debugfs_create_file("driver_filter", 0644, dentry, NULL, &filter_fops);
808 debugfs_create_file("dump", 0444, dentry, NULL, &dump_fops);
809
810 return 0;
811}
812core_initcall_sync(dma_debug_fs_init);
813
814static int device_dma_allocations(struct device *dev, struct dma_debug_entry **out_entry)
815{
816 struct dma_debug_entry *entry;
817 unsigned long flags;
818 int count = 0, i;
819
820 for (i = 0; i < HASH_SIZE; ++i) {
821 spin_lock_irqsave(&dma_entry_hash[i].lock, flags);
822 list_for_each_entry(entry, &dma_entry_hash[i].list, list) {
823 if (entry->dev == dev) {
824 count += 1;
825 *out_entry = entry;
826 }
827 }
828 spin_unlock_irqrestore(&dma_entry_hash[i].lock, flags);
829 }
830
831 return count;
832}
833
834static int dma_debug_device_change(struct notifier_block *nb, unsigned long action, void *data)
835{
836 struct device *dev = data;
837 struct dma_debug_entry *entry;
838 int count;
839
840 if (dma_debug_disabled())
841 return 0;
842
843 switch (action) {
844 case BUS_NOTIFY_UNBOUND_DRIVER:
845 count = device_dma_allocations(dev, &entry);
846 if (count == 0)
847 break;
848 err_printk(dev, entry, "device driver has pending "
849 "DMA allocations while released from device "
850 "[count=%d]\n"
851 "One of leaked entries details: "
852 "[device address=0x%016llx] [size=%llu bytes] "
853 "[mapped with %s] [mapped as %s]\n",
854 count, entry->dev_addr, entry->size,
855 dir2name[entry->direction], type2name[entry->type]);
856 break;
857 default:
858 break;
859 }
860
861 return 0;
862}
863
864void dma_debug_add_bus(struct bus_type *bus)
865{
866 struct notifier_block *nb;
867
868 if (dma_debug_disabled())
869 return;
870
871 nb = kzalloc(sizeof(struct notifier_block), GFP_KERNEL);
872 if (nb == NULL) {
873 pr_err("dma_debug_add_bus: out of memory\n");
874 return;
875 }
876
877 nb->notifier_call = dma_debug_device_change;
878
879 bus_register_notifier(bus, nb);
880}
881
882static int dma_debug_init(void)
883{
884 int i, nr_pages;
885
886
887
888
889 if (global_disable)
890 return 0;
891
892 for (i = 0; i < HASH_SIZE; ++i) {
893 INIT_LIST_HEAD(&dma_entry_hash[i].list);
894 spin_lock_init(&dma_entry_hash[i].lock);
895 }
896
897 nr_pages = DIV_ROUND_UP(nr_prealloc_entries, DMA_DEBUG_DYNAMIC_ENTRIES);
898 for (i = 0; i < nr_pages; ++i)
899 dma_debug_create_entries(GFP_KERNEL);
900 if (num_free_entries >= nr_prealloc_entries) {
901 pr_info("preallocated %d debug entries\n", nr_total_entries);
902 } else if (num_free_entries > 0) {
903 pr_warn("%d debug entries requested but only %d allocated\n",
904 nr_prealloc_entries, nr_total_entries);
905 } else {
906 pr_err("debugging out of memory error - disabled\n");
907 global_disable = true;
908
909 return 0;
910 }
911 min_free_entries = num_free_entries;
912
913 dma_debug_initialized = true;
914
915 pr_info("debugging enabled by kernel config\n");
916 return 0;
917}
918core_initcall(dma_debug_init);
919
920static __init int dma_debug_cmdline(char *str)
921{
922 if (!str)
923 return -EINVAL;
924
925 if (strncmp(str, "off", 3) == 0) {
926 pr_info("debugging disabled on kernel command line\n");
927 global_disable = true;
928 }
929
930 return 0;
931}
932
933static __init int dma_debug_entries_cmdline(char *str)
934{
935 if (!str)
936 return -EINVAL;
937 if (!get_option(&str, &nr_prealloc_entries))
938 nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES;
939 return 0;
940}
941
942__setup("dma_debug=", dma_debug_cmdline);
943__setup("dma_debug_entries=", dma_debug_entries_cmdline);
944
945static void check_unmap(struct dma_debug_entry *ref)
946{
947 struct dma_debug_entry *entry;
948 struct hash_bucket *bucket;
949 unsigned long flags;
950
951 bucket = get_hash_bucket(ref, &flags);
952 entry = bucket_find_exact(bucket, ref);
953
954 if (!entry) {
955
956 put_hash_bucket(bucket, flags);
957
958 if (dma_mapping_error(ref->dev, ref->dev_addr)) {
959 err_printk(ref->dev, NULL,
960 "device driver tries to free an "
961 "invalid DMA memory address\n");
962 } else {
963 err_printk(ref->dev, NULL,
964 "device driver tries to free DMA "
965 "memory it has not allocated [device "
966 "address=0x%016llx] [size=%llu bytes]\n",
967 ref->dev_addr, ref->size);
968 }
969 return;
970 }
971
972 if (ref->size != entry->size) {
973 err_printk(ref->dev, entry, "device driver frees "
974 "DMA memory with different size "
975 "[device address=0x%016llx] [map size=%llu bytes] "
976 "[unmap size=%llu bytes]\n",
977 ref->dev_addr, entry->size, ref->size);
978 }
979
980 if (ref->type != entry->type) {
981 err_printk(ref->dev, entry, "device driver frees "
982 "DMA memory with wrong function "
983 "[device address=0x%016llx] [size=%llu bytes] "
984 "[mapped as %s] [unmapped as %s]\n",
985 ref->dev_addr, ref->size,
986 type2name[entry->type], type2name[ref->type]);
987 } else if ((entry->type == dma_debug_coherent) &&
988 (phys_addr(ref) != phys_addr(entry))) {
989 err_printk(ref->dev, entry, "device driver frees "
990 "DMA memory with different CPU address "
991 "[device address=0x%016llx] [size=%llu bytes] "
992 "[cpu alloc address=0x%016llx] "
993 "[cpu free address=0x%016llx]",
994 ref->dev_addr, ref->size,
995 phys_addr(entry),
996 phys_addr(ref));
997 }
998
999 if (ref->sg_call_ents && ref->type == dma_debug_sg &&
1000 ref->sg_call_ents != entry->sg_call_ents) {
1001 err_printk(ref->dev, entry, "device driver frees "
1002 "DMA sg list with different entry count "
1003 "[map count=%d] [unmap count=%d]\n",
1004 entry->sg_call_ents, ref->sg_call_ents);
1005 }
1006
1007
1008
1009
1010
1011 if (ref->direction != entry->direction) {
1012 err_printk(ref->dev, entry, "device driver frees "
1013 "DMA memory with different direction "
1014 "[device address=0x%016llx] [size=%llu bytes] "
1015 "[mapped with %s] [unmapped with %s]\n",
1016 ref->dev_addr, ref->size,
1017 dir2name[entry->direction],
1018 dir2name[ref->direction]);
1019 }
1020
1021
1022
1023
1024
1025
1026 if (entry->map_err_type == MAP_ERR_NOT_CHECKED) {
1027 err_printk(ref->dev, entry,
1028 "device driver failed to check map error"
1029 "[device address=0x%016llx] [size=%llu bytes] "
1030 "[mapped as %s]",
1031 ref->dev_addr, ref->size,
1032 type2name[entry->type]);
1033 }
1034
1035 hash_bucket_del(entry);
1036 dma_entry_free(entry);
1037
1038 put_hash_bucket(bucket, flags);
1039}
1040
1041static void check_for_stack(struct device *dev,
1042 struct page *page, size_t offset)
1043{
1044 void *addr;
1045 struct vm_struct *stack_vm_area = task_stack_vm_area(current);
1046
1047 if (!stack_vm_area) {
1048
1049 if (PageHighMem(page))
1050 return;
1051 addr = page_address(page) + offset;
1052 if (object_is_on_stack(addr))
1053 err_printk(dev, NULL, "device driver maps memory from stack [addr=%p]\n", addr);
1054 } else {
1055
1056 int i;
1057
1058 for (i = 0; i < stack_vm_area->nr_pages; i++) {
1059 if (page != stack_vm_area->pages[i])
1060 continue;
1061
1062 addr = (u8 *)current->stack + i * PAGE_SIZE + offset;
1063 err_printk(dev, NULL, "device driver maps memory from stack [probable addr=%p]\n", addr);
1064 break;
1065 }
1066 }
1067}
1068
1069static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len)
1070{
1071 if (memory_intersects(_stext, _etext, addr, len) ||
1072 memory_intersects(__start_rodata, __end_rodata, addr, len))
1073 err_printk(dev, NULL, "device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len);
1074}
1075
1076static void check_sync(struct device *dev,
1077 struct dma_debug_entry *ref,
1078 bool to_cpu)
1079{
1080 struct dma_debug_entry *entry;
1081 struct hash_bucket *bucket;
1082 unsigned long flags;
1083
1084 bucket = get_hash_bucket(ref, &flags);
1085
1086 entry = bucket_find_contain(&bucket, ref, &flags);
1087
1088 if (!entry) {
1089 err_printk(dev, NULL, "device driver tries "
1090 "to sync DMA memory it has not allocated "
1091 "[device address=0x%016llx] [size=%llu bytes]\n",
1092 (unsigned long long)ref->dev_addr, ref->size);
1093 goto out;
1094 }
1095
1096 if (ref->size > entry->size) {
1097 err_printk(dev, entry, "device driver syncs"
1098 " DMA memory outside allocated range "
1099 "[device address=0x%016llx] "
1100 "[allocation size=%llu bytes] "
1101 "[sync offset+size=%llu]\n",
1102 entry->dev_addr, entry->size,
1103 ref->size);
1104 }
1105
1106 if (entry->direction == DMA_BIDIRECTIONAL)
1107 goto out;
1108
1109 if (ref->direction != entry->direction) {
1110 err_printk(dev, entry, "device driver syncs "
1111 "DMA memory with different direction "
1112 "[device address=0x%016llx] [size=%llu bytes] "
1113 "[mapped with %s] [synced with %s]\n",
1114 (unsigned long long)ref->dev_addr, entry->size,
1115 dir2name[entry->direction],
1116 dir2name[ref->direction]);
1117 }
1118
1119 if (to_cpu && !(entry->direction == DMA_FROM_DEVICE) &&
1120 !(ref->direction == DMA_TO_DEVICE))
1121 err_printk(dev, entry, "device driver syncs "
1122 "device read-only DMA memory for cpu "
1123 "[device address=0x%016llx] [size=%llu bytes] "
1124 "[mapped with %s] [synced with %s]\n",
1125 (unsigned long long)ref->dev_addr, entry->size,
1126 dir2name[entry->direction],
1127 dir2name[ref->direction]);
1128
1129 if (!to_cpu && !(entry->direction == DMA_TO_DEVICE) &&
1130 !(ref->direction == DMA_FROM_DEVICE))
1131 err_printk(dev, entry, "device driver syncs "
1132 "device write-only DMA memory to device "
1133 "[device address=0x%016llx] [size=%llu bytes] "
1134 "[mapped with %s] [synced with %s]\n",
1135 (unsigned long long)ref->dev_addr, entry->size,
1136 dir2name[entry->direction],
1137 dir2name[ref->direction]);
1138
1139 if (ref->sg_call_ents && ref->type == dma_debug_sg &&
1140 ref->sg_call_ents != entry->sg_call_ents) {
1141 err_printk(ref->dev, entry, "device driver syncs "
1142 "DMA sg list with different entry count "
1143 "[map count=%d] [sync count=%d]\n",
1144 entry->sg_call_ents, ref->sg_call_ents);
1145 }
1146
1147out:
1148 put_hash_bucket(bucket, flags);
1149}
1150
1151static void check_sg_segment(struct device *dev, struct scatterlist *sg)
1152{
1153#ifdef CONFIG_DMA_API_DEBUG_SG
1154 unsigned int max_seg = dma_get_max_seg_size(dev);
1155 u64 start, end, boundary = dma_get_seg_boundary(dev);
1156
1157
1158
1159
1160
1161 if (sg->length > max_seg)
1162 err_printk(dev, NULL, "mapping sg segment longer than device claims to support [len=%u] [max=%u]\n",
1163 sg->length, max_seg);
1164
1165
1166
1167
1168
1169 start = sg_dma_address(sg);
1170 end = start + sg_dma_len(sg) - 1;
1171 if ((start ^ end) & ~boundary)
1172 err_printk(dev, NULL, "mapping sg segment across boundary [start=0x%016llx] [end=0x%016llx] [boundary=0x%016llx]\n",
1173 start, end, boundary);
1174#endif
1175}
1176
1177void debug_dma_map_single(struct device *dev, const void *addr,
1178 unsigned long len)
1179{
1180 if (unlikely(dma_debug_disabled()))
1181 return;
1182
1183 if (!virt_addr_valid(addr))
1184 err_printk(dev, NULL, "device driver maps memory from invalid area [addr=%p] [len=%lu]\n",
1185 addr, len);
1186
1187 if (is_vmalloc_addr(addr))
1188 err_printk(dev, NULL, "device driver maps memory from vmalloc area [addr=%p] [len=%lu]\n",
1189 addr, len);
1190}
1191EXPORT_SYMBOL(debug_dma_map_single);
1192
1193void debug_dma_map_page(struct device *dev, struct page *page, size_t offset,
1194 size_t size, int direction, dma_addr_t dma_addr,
1195 unsigned long attrs)
1196{
1197 struct dma_debug_entry *entry;
1198
1199 if (unlikely(dma_debug_disabled()))
1200 return;
1201
1202 if (dma_mapping_error(dev, dma_addr))
1203 return;
1204
1205 entry = dma_entry_alloc();
1206 if (!entry)
1207 return;
1208
1209 entry->dev = dev;
1210 entry->type = dma_debug_single;
1211 entry->pfn = page_to_pfn(page);
1212 entry->offset = offset;
1213 entry->dev_addr = dma_addr;
1214 entry->size = size;
1215 entry->direction = direction;
1216 entry->map_err_type = MAP_ERR_NOT_CHECKED;
1217
1218 check_for_stack(dev, page, offset);
1219
1220 if (!PageHighMem(page)) {
1221 void *addr = page_address(page) + offset;
1222
1223 check_for_illegal_area(dev, addr, size);
1224 }
1225
1226 add_dma_entry(entry, attrs);
1227}
1228
1229void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
1230{
1231 struct dma_debug_entry ref;
1232 struct dma_debug_entry *entry;
1233 struct hash_bucket *bucket;
1234 unsigned long flags;
1235
1236 if (unlikely(dma_debug_disabled()))
1237 return;
1238
1239 ref.dev = dev;
1240 ref.dev_addr = dma_addr;
1241 bucket = get_hash_bucket(&ref, &flags);
1242
1243 list_for_each_entry(entry, &bucket->list, list) {
1244 if (!exact_match(&ref, entry))
1245 continue;
1246
1247
1248
1249
1250
1251
1252
1253
1254
1255
1256
1257 if (entry->map_err_type == MAP_ERR_NOT_CHECKED) {
1258 entry->map_err_type = MAP_ERR_CHECKED;
1259 break;
1260 }
1261 }
1262
1263 put_hash_bucket(bucket, flags);
1264}
1265EXPORT_SYMBOL(debug_dma_mapping_error);
1266
1267void debug_dma_unmap_page(struct device *dev, dma_addr_t addr,
1268 size_t size, int direction)
1269{
1270 struct dma_debug_entry ref = {
1271 .type = dma_debug_single,
1272 .dev = dev,
1273 .dev_addr = addr,
1274 .size = size,
1275 .direction = direction,
1276 };
1277
1278 if (unlikely(dma_debug_disabled()))
1279 return;
1280 check_unmap(&ref);
1281}
1282
1283void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
1284 int nents, int mapped_ents, int direction,
1285 unsigned long attrs)
1286{
1287 struct dma_debug_entry *entry;
1288 struct scatterlist *s;
1289 int i;
1290
1291 if (unlikely(dma_debug_disabled()))
1292 return;
1293
1294 for_each_sg(sg, s, nents, i) {
1295 check_for_stack(dev, sg_page(s), s->offset);
1296 if (!PageHighMem(sg_page(s)))
1297 check_for_illegal_area(dev, sg_virt(s), s->length);
1298 }
1299
1300 for_each_sg(sg, s, mapped_ents, i) {
1301 entry = dma_entry_alloc();
1302 if (!entry)
1303 return;
1304
1305 entry->type = dma_debug_sg;
1306 entry->dev = dev;
1307 entry->pfn = page_to_pfn(sg_page(s));
1308 entry->offset = s->offset;
1309 entry->size = sg_dma_len(s);
1310 entry->dev_addr = sg_dma_address(s);
1311 entry->direction = direction;
1312 entry->sg_call_ents = nents;
1313 entry->sg_mapped_ents = mapped_ents;
1314
1315 check_sg_segment(dev, s);
1316
1317 add_dma_entry(entry, attrs);
1318 }
1319}
1320
1321static int get_nr_mapped_entries(struct device *dev,
1322 struct dma_debug_entry *ref)
1323{
1324 struct dma_debug_entry *entry;
1325 struct hash_bucket *bucket;
1326 unsigned long flags;
1327 int mapped_ents;
1328
1329 bucket = get_hash_bucket(ref, &flags);
1330 entry = bucket_find_exact(bucket, ref);
1331 mapped_ents = 0;
1332
1333 if (entry)
1334 mapped_ents = entry->sg_mapped_ents;
1335 put_hash_bucket(bucket, flags);
1336
1337 return mapped_ents;
1338}
1339
1340void debug_dma_unmap_sg(struct device *dev, struct scatterlist *sglist,
1341 int nelems, int dir)
1342{
1343 struct scatterlist *s;
1344 int mapped_ents = 0, i;
1345
1346 if (unlikely(dma_debug_disabled()))
1347 return;
1348
1349 for_each_sg(sglist, s, nelems, i) {
1350
1351 struct dma_debug_entry ref = {
1352 .type = dma_debug_sg,
1353 .dev = dev,
1354 .pfn = page_to_pfn(sg_page(s)),
1355 .offset = s->offset,
1356 .dev_addr = sg_dma_address(s),
1357 .size = sg_dma_len(s),
1358 .direction = dir,
1359 .sg_call_ents = nelems,
1360 };
1361
1362 if (mapped_ents && i >= mapped_ents)
1363 break;
1364
1365 if (!i)
1366 mapped_ents = get_nr_mapped_entries(dev, &ref);
1367
1368 check_unmap(&ref);
1369 }
1370}
1371
1372void debug_dma_alloc_coherent(struct device *dev, size_t size,
1373 dma_addr_t dma_addr, void *virt,
1374 unsigned long attrs)
1375{
1376 struct dma_debug_entry *entry;
1377
1378 if (unlikely(dma_debug_disabled()))
1379 return;
1380
1381 if (unlikely(virt == NULL))
1382 return;
1383
1384
1385 if (!is_vmalloc_addr(virt) && !virt_addr_valid(virt))
1386 return;
1387
1388 entry = dma_entry_alloc();
1389 if (!entry)
1390 return;
1391
1392 entry->type = dma_debug_coherent;
1393 entry->dev = dev;
1394 entry->offset = offset_in_page(virt);
1395 entry->size = size;
1396 entry->dev_addr = dma_addr;
1397 entry->direction = DMA_BIDIRECTIONAL;
1398
1399 if (is_vmalloc_addr(virt))
1400 entry->pfn = vmalloc_to_pfn(virt);
1401 else
1402 entry->pfn = page_to_pfn(virt_to_page(virt));
1403
1404 add_dma_entry(entry, attrs);
1405}
1406
1407void debug_dma_free_coherent(struct device *dev, size_t size,
1408 void *virt, dma_addr_t addr)
1409{
1410 struct dma_debug_entry ref = {
1411 .type = dma_debug_coherent,
1412 .dev = dev,
1413 .offset = offset_in_page(virt),
1414 .dev_addr = addr,
1415 .size = size,
1416 .direction = DMA_BIDIRECTIONAL,
1417 };
1418
1419
1420 if (!is_vmalloc_addr(virt) && !virt_addr_valid(virt))
1421 return;
1422
1423 if (is_vmalloc_addr(virt))
1424 ref.pfn = vmalloc_to_pfn(virt);
1425 else
1426 ref.pfn = page_to_pfn(virt_to_page(virt));
1427
1428 if (unlikely(dma_debug_disabled()))
1429 return;
1430
1431 check_unmap(&ref);
1432}
1433
1434void debug_dma_map_resource(struct device *dev, phys_addr_t addr, size_t size,
1435 int direction, dma_addr_t dma_addr,
1436 unsigned long attrs)
1437{
1438 struct dma_debug_entry *entry;
1439
1440 if (unlikely(dma_debug_disabled()))
1441 return;
1442
1443 entry = dma_entry_alloc();
1444 if (!entry)
1445 return;
1446
1447 entry->type = dma_debug_resource;
1448 entry->dev = dev;
1449 entry->pfn = PHYS_PFN(addr);
1450 entry->offset = offset_in_page(addr);
1451 entry->size = size;
1452 entry->dev_addr = dma_addr;
1453 entry->direction = direction;
1454 entry->map_err_type = MAP_ERR_NOT_CHECKED;
1455
1456 add_dma_entry(entry, attrs);
1457}
1458
1459void debug_dma_unmap_resource(struct device *dev, dma_addr_t dma_addr,
1460 size_t size, int direction)
1461{
1462 struct dma_debug_entry ref = {
1463 .type = dma_debug_resource,
1464 .dev = dev,
1465 .dev_addr = dma_addr,
1466 .size = size,
1467 .direction = direction,
1468 };
1469
1470 if (unlikely(dma_debug_disabled()))
1471 return;
1472
1473 check_unmap(&ref);
1474}
1475
1476void debug_dma_sync_single_for_cpu(struct device *dev, dma_addr_t dma_handle,
1477 size_t size, int direction)
1478{
1479 struct dma_debug_entry ref;
1480
1481 if (unlikely(dma_debug_disabled()))
1482 return;
1483
1484 ref.type = dma_debug_single;
1485 ref.dev = dev;
1486 ref.dev_addr = dma_handle;
1487 ref.size = size;
1488 ref.direction = direction;
1489 ref.sg_call_ents = 0;
1490
1491 check_sync(dev, &ref, true);
1492}
1493
1494void debug_dma_sync_single_for_device(struct device *dev,
1495 dma_addr_t dma_handle, size_t size,
1496 int direction)
1497{
1498 struct dma_debug_entry ref;
1499
1500 if (unlikely(dma_debug_disabled()))
1501 return;
1502
1503 ref.type = dma_debug_single;
1504 ref.dev = dev;
1505 ref.dev_addr = dma_handle;
1506 ref.size = size;
1507 ref.direction = direction;
1508 ref.sg_call_ents = 0;
1509
1510 check_sync(dev, &ref, false);
1511}
1512
1513void debug_dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
1514 int nelems, int direction)
1515{
1516 struct scatterlist *s;
1517 int mapped_ents = 0, i;
1518
1519 if (unlikely(dma_debug_disabled()))
1520 return;
1521
1522 for_each_sg(sg, s, nelems, i) {
1523
1524 struct dma_debug_entry ref = {
1525 .type = dma_debug_sg,
1526 .dev = dev,
1527 .pfn = page_to_pfn(sg_page(s)),
1528 .offset = s->offset,
1529 .dev_addr = sg_dma_address(s),
1530 .size = sg_dma_len(s),
1531 .direction = direction,
1532 .sg_call_ents = nelems,
1533 };
1534
1535 if (!i)
1536 mapped_ents = get_nr_mapped_entries(dev, &ref);
1537
1538 if (i >= mapped_ents)
1539 break;
1540
1541 check_sync(dev, &ref, true);
1542 }
1543}
1544
1545void debug_dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
1546 int nelems, int direction)
1547{
1548 struct scatterlist *s;
1549 int mapped_ents = 0, i;
1550
1551 if (unlikely(dma_debug_disabled()))
1552 return;
1553
1554 for_each_sg(sg, s, nelems, i) {
1555
1556 struct dma_debug_entry ref = {
1557 .type = dma_debug_sg,
1558 .dev = dev,
1559 .pfn = page_to_pfn(sg_page(s)),
1560 .offset = s->offset,
1561 .dev_addr = sg_dma_address(s),
1562 .size = sg_dma_len(s),
1563 .direction = direction,
1564 .sg_call_ents = nelems,
1565 };
1566 if (!i)
1567 mapped_ents = get_nr_mapped_entries(dev, &ref);
1568
1569 if (i >= mapped_ents)
1570 break;
1571
1572 check_sync(dev, &ref, false);
1573 }
1574}
1575
1576static int __init dma_debug_driver_setup(char *str)
1577{
1578 int i;
1579
1580 for (i = 0; i < NAME_MAX_LEN - 1; ++i, ++str) {
1581 current_driver_name[i] = *str;
1582 if (*str == 0)
1583 break;
1584 }
1585
1586 if (current_driver_name[0])
1587 pr_info("enable driver filter for driver [%s]\n",
1588 current_driver_name);
1589
1590
1591 return 1;
1592}
1593__setup("dma_debug_driver=", dma_debug_driver_setup);
1594