1
2
3
4
5
6
7
8#define pr_fmt(fmt) "DMA-API: " fmt
9
10#include <linux/sched/task_stack.h>
11#include <linux/scatterlist.h>
12#include <linux/dma-mapping.h>
13#include <linux/sched/task.h>
14#include <linux/stacktrace.h>
15#include <linux/dma-debug.h>
16#include <linux/spinlock.h>
17#include <linux/vmalloc.h>
18#include <linux/debugfs.h>
19#include <linux/uaccess.h>
20#include <linux/export.h>
21#include <linux/device.h>
22#include <linux/types.h>
23#include <linux/sched.h>
24#include <linux/ctype.h>
25#include <linux/list.h>
26#include <linux/slab.h>
27
28#include <asm/sections.h>
29
30#define HASH_SIZE 16384ULL
31#define HASH_FN_SHIFT 13
32#define HASH_FN_MASK (HASH_SIZE - 1)
33
34#define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
35
36#define DMA_DEBUG_DYNAMIC_ENTRIES (PAGE_SIZE / sizeof(struct dma_debug_entry))
37
38enum {
39 dma_debug_single,
40 dma_debug_sg,
41 dma_debug_coherent,
42 dma_debug_resource,
43};
44
45enum map_err_types {
46 MAP_ERR_CHECK_NOT_APPLICABLE,
47 MAP_ERR_NOT_CHECKED,
48 MAP_ERR_CHECKED,
49};
50
51#define DMA_DEBUG_STACKTRACE_ENTRIES 5
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67struct dma_debug_entry {
68 struct list_head list;
69 struct device *dev;
70 u64 dev_addr;
71 u64 size;
72 int type;
73 int direction;
74 int sg_call_ents;
75 int sg_mapped_ents;
76 unsigned long pfn;
77 size_t offset;
78 enum map_err_types map_err_type;
79#ifdef CONFIG_STACKTRACE
80 unsigned int stack_len;
81 unsigned long stack_entries[DMA_DEBUG_STACKTRACE_ENTRIES];
82#endif
83} ____cacheline_aligned_in_smp;
84
85typedef bool (*match_fn)(struct dma_debug_entry *, struct dma_debug_entry *);
86
87struct hash_bucket {
88 struct list_head list;
89 spinlock_t lock;
90};
91
92
93static struct hash_bucket dma_entry_hash[HASH_SIZE];
94
95static LIST_HEAD(free_entries);
96
97static DEFINE_SPINLOCK(free_entries_lock);
98
99
100static bool global_disable __read_mostly;
101
102
103static bool dma_debug_initialized __read_mostly;
104
105static inline bool dma_debug_disabled(void)
106{
107 return global_disable || !dma_debug_initialized;
108}
109
110
111static u32 error_count;
112
113
114static u32 show_all_errors __read_mostly;
115
116static u32 show_num_errors = 1;
117
118static u32 num_free_entries;
119static u32 min_free_entries;
120static u32 nr_total_entries;
121
122
123static u32 nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES;
124
125
126
127#define NAME_MAX_LEN 64
128
129static char current_driver_name[NAME_MAX_LEN] __read_mostly;
130static struct device_driver *current_driver __read_mostly;
131
132static DEFINE_RWLOCK(driver_name_lock);
133
134static const char *const maperr2str[] = {
135 [MAP_ERR_CHECK_NOT_APPLICABLE] = "dma map error check not applicable",
136 [MAP_ERR_NOT_CHECKED] = "dma map error not checked",
137 [MAP_ERR_CHECKED] = "dma map error checked",
138};
139
140static const char *type2name[5] = { "single", "page",
141 "scather-gather", "coherent",
142 "resource" };
143
144static const char *dir2name[4] = { "DMA_BIDIRECTIONAL", "DMA_TO_DEVICE",
145 "DMA_FROM_DEVICE", "DMA_NONE" };
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160static inline void dump_entry_trace(struct dma_debug_entry *entry)
161{
162#ifdef CONFIG_STACKTRACE
163 if (entry) {
164 pr_warn("Mapped at:\n");
165 stack_trace_print(entry->stack_entries, entry->stack_len, 0);
166 }
167#endif
168}
169
170static bool driver_filter(struct device *dev)
171{
172 struct device_driver *drv;
173 unsigned long flags;
174 bool ret;
175
176
177 if (likely(!current_driver_name[0]))
178 return true;
179
180
181 if (current_driver && dev && dev->driver == current_driver)
182 return true;
183
184
185 if (!dev)
186 return false;
187
188 if (current_driver || !current_driver_name[0])
189 return false;
190
191
192 drv = dev->driver;
193 if (!drv)
194 return false;
195
196
197 read_lock_irqsave(&driver_name_lock, flags);
198
199 ret = false;
200 if (drv->name &&
201 strncmp(current_driver_name, drv->name, NAME_MAX_LEN - 1) == 0) {
202 current_driver = drv;
203 ret = true;
204 }
205
206 read_unlock_irqrestore(&driver_name_lock, flags);
207
208 return ret;
209}
210
211#define err_printk(dev, entry, format, arg...) do { \
212 error_count += 1; \
213 if (driver_filter(dev) && \
214 (show_all_errors || show_num_errors > 0)) { \
215 WARN(1, pr_fmt("%s %s: ") format, \
216 dev ? dev_driver_string(dev) : "NULL", \
217 dev ? dev_name(dev) : "NULL", ## arg); \
218 dump_entry_trace(entry); \
219 } \
220 if (!show_all_errors && show_num_errors > 0) \
221 show_num_errors -= 1; \
222 } while (0);
223
224
225
226
227
228
229
230static int hash_fn(struct dma_debug_entry *entry)
231{
232
233
234
235
236 return (entry->dev_addr >> HASH_FN_SHIFT) & HASH_FN_MASK;
237}
238
239
240
241
242static struct hash_bucket *get_hash_bucket(struct dma_debug_entry *entry,
243 unsigned long *flags)
244 __acquires(&dma_entry_hash[idx].lock)
245{
246 int idx = hash_fn(entry);
247 unsigned long __flags;
248
249 spin_lock_irqsave(&dma_entry_hash[idx].lock, __flags);
250 *flags = __flags;
251 return &dma_entry_hash[idx];
252}
253
254
255
256
257static void put_hash_bucket(struct hash_bucket *bucket,
258 unsigned long flags)
259 __releases(&bucket->lock)
260{
261 spin_unlock_irqrestore(&bucket->lock, flags);
262}
263
264static bool exact_match(struct dma_debug_entry *a, struct dma_debug_entry *b)
265{
266 return ((a->dev_addr == b->dev_addr) &&
267 (a->dev == b->dev)) ? true : false;
268}
269
270static bool containing_match(struct dma_debug_entry *a,
271 struct dma_debug_entry *b)
272{
273 if (a->dev != b->dev)
274 return false;
275
276 if ((b->dev_addr <= a->dev_addr) &&
277 ((b->dev_addr + b->size) >= (a->dev_addr + a->size)))
278 return true;
279
280 return false;
281}
282
283
284
285
286static struct dma_debug_entry *__hash_bucket_find(struct hash_bucket *bucket,
287 struct dma_debug_entry *ref,
288 match_fn match)
289{
290 struct dma_debug_entry *entry, *ret = NULL;
291 int matches = 0, match_lvl, last_lvl = -1;
292
293 list_for_each_entry(entry, &bucket->list, list) {
294 if (!match(ref, entry))
295 continue;
296
297
298
299
300
301
302
303
304
305
306
307 matches += 1;
308 match_lvl = 0;
309 entry->size == ref->size ? ++match_lvl : 0;
310 entry->type == ref->type ? ++match_lvl : 0;
311 entry->direction == ref->direction ? ++match_lvl : 0;
312 entry->sg_call_ents == ref->sg_call_ents ? ++match_lvl : 0;
313
314 if (match_lvl == 4) {
315
316 return entry;
317 } else if (match_lvl > last_lvl) {
318
319
320
321
322 last_lvl = match_lvl;
323 ret = entry;
324 }
325 }
326
327
328
329
330
331 ret = (matches == 1) ? ret : NULL;
332
333 return ret;
334}
335
336static struct dma_debug_entry *bucket_find_exact(struct hash_bucket *bucket,
337 struct dma_debug_entry *ref)
338{
339 return __hash_bucket_find(bucket, ref, exact_match);
340}
341
342static struct dma_debug_entry *bucket_find_contain(struct hash_bucket **bucket,
343 struct dma_debug_entry *ref,
344 unsigned long *flags)
345{
346
347 unsigned int max_range = dma_get_max_seg_size(ref->dev);
348 struct dma_debug_entry *entry, index = *ref;
349 unsigned int range = 0;
350
351 while (range <= max_range) {
352 entry = __hash_bucket_find(*bucket, ref, containing_match);
353
354 if (entry)
355 return entry;
356
357
358
359
360 put_hash_bucket(*bucket, *flags);
361 range += (1 << HASH_FN_SHIFT);
362 index.dev_addr -= (1 << HASH_FN_SHIFT);
363 *bucket = get_hash_bucket(&index, flags);
364 }
365
366 return NULL;
367}
368
369
370
371
372static void hash_bucket_add(struct hash_bucket *bucket,
373 struct dma_debug_entry *entry)
374{
375 list_add_tail(&entry->list, &bucket->list);
376}
377
378
379
380
381static void hash_bucket_del(struct dma_debug_entry *entry)
382{
383 list_del(&entry->list);
384}
385
386static unsigned long long phys_addr(struct dma_debug_entry *entry)
387{
388 if (entry->type == dma_debug_resource)
389 return __pfn_to_phys(entry->pfn) + entry->offset;
390
391 return page_to_phys(pfn_to_page(entry->pfn)) + entry->offset;
392}
393
394
395
396
397void debug_dma_dump_mappings(struct device *dev)
398{
399 int idx;
400
401 for (idx = 0; idx < HASH_SIZE; idx++) {
402 struct hash_bucket *bucket = &dma_entry_hash[idx];
403 struct dma_debug_entry *entry;
404 unsigned long flags;
405
406 spin_lock_irqsave(&bucket->lock, flags);
407
408 list_for_each_entry(entry, &bucket->list, list) {
409 if (!dev || dev == entry->dev) {
410 dev_info(entry->dev,
411 "%s idx %d P=%Lx N=%lx D=%Lx L=%Lx %s %s\n",
412 type2name[entry->type], idx,
413 phys_addr(entry), entry->pfn,
414 entry->dev_addr, entry->size,
415 dir2name[entry->direction],
416 maperr2str[entry->map_err_type]);
417 }
418 }
419
420 spin_unlock_irqrestore(&bucket->lock, flags);
421 cond_resched();
422 }
423}
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448static RADIX_TREE(dma_active_cacheline, GFP_NOWAIT);
449static DEFINE_SPINLOCK(radix_lock);
450#define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)
451#define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT)
452#define CACHELINES_PER_PAGE (1 << CACHELINE_PER_PAGE_SHIFT)
453
454static phys_addr_t to_cacheline_number(struct dma_debug_entry *entry)
455{
456 return (entry->pfn << CACHELINE_PER_PAGE_SHIFT) +
457 (entry->offset >> L1_CACHE_SHIFT);
458}
459
460static int active_cacheline_read_overlap(phys_addr_t cln)
461{
462 int overlap = 0, i;
463
464 for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
465 if (radix_tree_tag_get(&dma_active_cacheline, cln, i))
466 overlap |= 1 << i;
467 return overlap;
468}
469
470static int active_cacheline_set_overlap(phys_addr_t cln, int overlap)
471{
472 int i;
473
474 if (overlap > ACTIVE_CACHELINE_MAX_OVERLAP || overlap < 0)
475 return overlap;
476
477 for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
478 if (overlap & 1 << i)
479 radix_tree_tag_set(&dma_active_cacheline, cln, i);
480 else
481 radix_tree_tag_clear(&dma_active_cacheline, cln, i);
482
483 return overlap;
484}
485
486static void active_cacheline_inc_overlap(phys_addr_t cln)
487{
488 int overlap = active_cacheline_read_overlap(cln);
489
490 overlap = active_cacheline_set_overlap(cln, ++overlap);
491
492
493
494
495
496
497
498 WARN_ONCE(overlap > ACTIVE_CACHELINE_MAX_OVERLAP,
499 pr_fmt("exceeded %d overlapping mappings of cacheline %pa\n"),
500 ACTIVE_CACHELINE_MAX_OVERLAP, &cln);
501}
502
503static int active_cacheline_dec_overlap(phys_addr_t cln)
504{
505 int overlap = active_cacheline_read_overlap(cln);
506
507 return active_cacheline_set_overlap(cln, --overlap);
508}
509
510static int active_cacheline_insert(struct dma_debug_entry *entry)
511{
512 phys_addr_t cln = to_cacheline_number(entry);
513 unsigned long flags;
514 int rc;
515
516
517
518
519
520 if (entry->direction == DMA_TO_DEVICE)
521 return 0;
522
523 spin_lock_irqsave(&radix_lock, flags);
524 rc = radix_tree_insert(&dma_active_cacheline, cln, entry);
525 if (rc == -EEXIST)
526 active_cacheline_inc_overlap(cln);
527 spin_unlock_irqrestore(&radix_lock, flags);
528
529 return rc;
530}
531
532static void active_cacheline_remove(struct dma_debug_entry *entry)
533{
534 phys_addr_t cln = to_cacheline_number(entry);
535 unsigned long flags;
536
537
538 if (entry->direction == DMA_TO_DEVICE)
539 return;
540
541 spin_lock_irqsave(&radix_lock, flags);
542
543
544
545
546 if (active_cacheline_dec_overlap(cln) < 0)
547 radix_tree_delete(&dma_active_cacheline, cln);
548 spin_unlock_irqrestore(&radix_lock, flags);
549}
550
551
552
553
554
555
556
557
558
559void debug_dma_assert_idle(struct page *page)
560{
561 static struct dma_debug_entry *ents[CACHELINES_PER_PAGE];
562 struct dma_debug_entry *entry = NULL;
563 void **results = (void **) &ents;
564 unsigned int nents, i;
565 unsigned long flags;
566 phys_addr_t cln;
567
568 if (dma_debug_disabled())
569 return;
570
571 if (!page)
572 return;
573
574 cln = (phys_addr_t) page_to_pfn(page) << CACHELINE_PER_PAGE_SHIFT;
575 spin_lock_irqsave(&radix_lock, flags);
576 nents = radix_tree_gang_lookup(&dma_active_cacheline, results, cln,
577 CACHELINES_PER_PAGE);
578 for (i = 0; i < nents; i++) {
579 phys_addr_t ent_cln = to_cacheline_number(ents[i]);
580
581 if (ent_cln == cln) {
582 entry = ents[i];
583 break;
584 } else if (ent_cln >= cln + CACHELINES_PER_PAGE)
585 break;
586 }
587 spin_unlock_irqrestore(&radix_lock, flags);
588
589 if (!entry)
590 return;
591
592 cln = to_cacheline_number(entry);
593 err_printk(entry->dev, entry,
594 "cpu touching an active dma mapped cacheline [cln=%pa]\n",
595 &cln);
596}
597
598
599
600
601
602static void add_dma_entry(struct dma_debug_entry *entry)
603{
604 struct hash_bucket *bucket;
605 unsigned long flags;
606 int rc;
607
608 bucket = get_hash_bucket(entry, &flags);
609 hash_bucket_add(bucket, entry);
610 put_hash_bucket(bucket, flags);
611
612 rc = active_cacheline_insert(entry);
613 if (rc == -ENOMEM) {
614 pr_err("cacheline tracking ENOMEM, dma-debug disabled\n");
615 global_disable = true;
616 }
617
618
619
620
621}
622
623static int dma_debug_create_entries(gfp_t gfp)
624{
625 struct dma_debug_entry *entry;
626 int i;
627
628 entry = (void *)get_zeroed_page(gfp);
629 if (!entry)
630 return -ENOMEM;
631
632 for (i = 0; i < DMA_DEBUG_DYNAMIC_ENTRIES; i++)
633 list_add_tail(&entry[i].list, &free_entries);
634
635 num_free_entries += DMA_DEBUG_DYNAMIC_ENTRIES;
636 nr_total_entries += DMA_DEBUG_DYNAMIC_ENTRIES;
637
638 return 0;
639}
640
641static struct dma_debug_entry *__dma_entry_alloc(void)
642{
643 struct dma_debug_entry *entry;
644
645 entry = list_entry(free_entries.next, struct dma_debug_entry, list);
646 list_del(&entry->list);
647 memset(entry, 0, sizeof(*entry));
648
649 num_free_entries -= 1;
650 if (num_free_entries < min_free_entries)
651 min_free_entries = num_free_entries;
652
653 return entry;
654}
655
656void __dma_entry_alloc_check_leak(void)
657{
658 u32 tmp = nr_total_entries % nr_prealloc_entries;
659
660
661 if (tmp < DMA_DEBUG_DYNAMIC_ENTRIES) {
662 pr_info("dma_debug_entry pool grown to %u (%u00%%)\n",
663 nr_total_entries,
664 (nr_total_entries / nr_prealloc_entries));
665 }
666}
667
668
669
670
671
672
673static struct dma_debug_entry *dma_entry_alloc(void)
674{
675 struct dma_debug_entry *entry;
676 unsigned long flags;
677
678 spin_lock_irqsave(&free_entries_lock, flags);
679 if (num_free_entries == 0) {
680 if (dma_debug_create_entries(GFP_ATOMIC)) {
681 global_disable = true;
682 spin_unlock_irqrestore(&free_entries_lock, flags);
683 pr_err("debugging out of memory - disabling\n");
684 return NULL;
685 }
686 __dma_entry_alloc_check_leak();
687 }
688
689 entry = __dma_entry_alloc();
690
691 spin_unlock_irqrestore(&free_entries_lock, flags);
692
693#ifdef CONFIG_STACKTRACE
694 entry->stack_len = stack_trace_save(entry->stack_entries,
695 ARRAY_SIZE(entry->stack_entries),
696 1);
697#endif
698 return entry;
699}
700
701static void dma_entry_free(struct dma_debug_entry *entry)
702{
703 unsigned long flags;
704
705 active_cacheline_remove(entry);
706
707
708
709
710
711 spin_lock_irqsave(&free_entries_lock, flags);
712 list_add(&entry->list, &free_entries);
713 num_free_entries += 1;
714 spin_unlock_irqrestore(&free_entries_lock, flags);
715}
716
717
718
719
720
721
722
723
724
725static ssize_t filter_read(struct file *file, char __user *user_buf,
726 size_t count, loff_t *ppos)
727{
728 char buf[NAME_MAX_LEN + 1];
729 unsigned long flags;
730 int len;
731
732 if (!current_driver_name[0])
733 return 0;
734
735
736
737
738
739
740 read_lock_irqsave(&driver_name_lock, flags);
741 len = scnprintf(buf, NAME_MAX_LEN + 1, "%s\n", current_driver_name);
742 read_unlock_irqrestore(&driver_name_lock, flags);
743
744 return simple_read_from_buffer(user_buf, count, ppos, buf, len);
745}
746
747static ssize_t filter_write(struct file *file, const char __user *userbuf,
748 size_t count, loff_t *ppos)
749{
750 char buf[NAME_MAX_LEN];
751 unsigned long flags;
752 size_t len;
753 int i;
754
755
756
757
758
759
760
761 len = min(count, (size_t)(NAME_MAX_LEN - 1));
762 if (copy_from_user(buf, userbuf, len))
763 return -EFAULT;
764
765 buf[len] = 0;
766
767 write_lock_irqsave(&driver_name_lock, flags);
768
769
770
771
772
773
774
775
776
777 if (!isalnum(buf[0])) {
778
779
780
781
782
783 if (current_driver_name[0])
784 pr_info("switching off dma-debug driver filter\n");
785 current_driver_name[0] = 0;
786 current_driver = NULL;
787 goto out_unlock;
788 }
789
790
791
792
793
794 for (i = 0; i < NAME_MAX_LEN - 1; ++i) {
795 current_driver_name[i] = buf[i];
796 if (isspace(buf[i]) || buf[i] == ' ' || buf[i] == 0)
797 break;
798 }
799 current_driver_name[i] = 0;
800 current_driver = NULL;
801
802 pr_info("enable driver filter for driver [%s]\n",
803 current_driver_name);
804
805out_unlock:
806 write_unlock_irqrestore(&driver_name_lock, flags);
807
808 return count;
809}
810
811static const struct file_operations filter_fops = {
812 .read = filter_read,
813 .write = filter_write,
814 .llseek = default_llseek,
815};
816
817static int dump_show(struct seq_file *seq, void *v)
818{
819 int idx;
820
821 for (idx = 0; idx < HASH_SIZE; idx++) {
822 struct hash_bucket *bucket = &dma_entry_hash[idx];
823 struct dma_debug_entry *entry;
824 unsigned long flags;
825
826 spin_lock_irqsave(&bucket->lock, flags);
827 list_for_each_entry(entry, &bucket->list, list) {
828 seq_printf(seq,
829 "%s %s %s idx %d P=%llx N=%lx D=%llx L=%llx %s %s\n",
830 dev_name(entry->dev),
831 dev_driver_string(entry->dev),
832 type2name[entry->type], idx,
833 phys_addr(entry), entry->pfn,
834 entry->dev_addr, entry->size,
835 dir2name[entry->direction],
836 maperr2str[entry->map_err_type]);
837 }
838 spin_unlock_irqrestore(&bucket->lock, flags);
839 }
840 return 0;
841}
842DEFINE_SHOW_ATTRIBUTE(dump);
843
844static void dma_debug_fs_init(void)
845{
846 struct dentry *dentry = debugfs_create_dir("dma-api", NULL);
847
848 debugfs_create_bool("disabled", 0444, dentry, &global_disable);
849 debugfs_create_u32("error_count", 0444, dentry, &error_count);
850 debugfs_create_u32("all_errors", 0644, dentry, &show_all_errors);
851 debugfs_create_u32("num_errors", 0644, dentry, &show_num_errors);
852 debugfs_create_u32("num_free_entries", 0444, dentry, &num_free_entries);
853 debugfs_create_u32("min_free_entries", 0444, dentry, &min_free_entries);
854 debugfs_create_u32("nr_total_entries", 0444, dentry, &nr_total_entries);
855 debugfs_create_file("driver_filter", 0644, dentry, NULL, &filter_fops);
856 debugfs_create_file("dump", 0444, dentry, NULL, &dump_fops);
857}
858
859static int device_dma_allocations(struct device *dev, struct dma_debug_entry **out_entry)
860{
861 struct dma_debug_entry *entry;
862 unsigned long flags;
863 int count = 0, i;
864
865 for (i = 0; i < HASH_SIZE; ++i) {
866 spin_lock_irqsave(&dma_entry_hash[i].lock, flags);
867 list_for_each_entry(entry, &dma_entry_hash[i].list, list) {
868 if (entry->dev == dev) {
869 count += 1;
870 *out_entry = entry;
871 }
872 }
873 spin_unlock_irqrestore(&dma_entry_hash[i].lock, flags);
874 }
875
876 return count;
877}
878
879static int dma_debug_device_change(struct notifier_block *nb, unsigned long action, void *data)
880{
881 struct device *dev = data;
882 struct dma_debug_entry *uninitialized_var(entry);
883 int count;
884
885 if (dma_debug_disabled())
886 return 0;
887
888 switch (action) {
889 case BUS_NOTIFY_UNBOUND_DRIVER:
890 count = device_dma_allocations(dev, &entry);
891 if (count == 0)
892 break;
893 err_printk(dev, entry, "device driver has pending "
894 "DMA allocations while released from device "
895 "[count=%d]\n"
896 "One of leaked entries details: "
897 "[device address=0x%016llx] [size=%llu bytes] "
898 "[mapped with %s] [mapped as %s]\n",
899 count, entry->dev_addr, entry->size,
900 dir2name[entry->direction], type2name[entry->type]);
901 break;
902 default:
903 break;
904 }
905
906 return 0;
907}
908
909void dma_debug_add_bus(struct bus_type *bus)
910{
911 struct notifier_block *nb;
912
913 if (dma_debug_disabled())
914 return;
915
916 nb = kzalloc(sizeof(struct notifier_block), GFP_KERNEL);
917 if (nb == NULL) {
918 pr_err("dma_debug_add_bus: out of memory\n");
919 return;
920 }
921
922 nb->notifier_call = dma_debug_device_change;
923
924 bus_register_notifier(bus, nb);
925}
926
927static int dma_debug_init(void)
928{
929 int i, nr_pages;
930
931
932
933
934 if (global_disable)
935 return 0;
936
937 for (i = 0; i < HASH_SIZE; ++i) {
938 INIT_LIST_HEAD(&dma_entry_hash[i].list);
939 spin_lock_init(&dma_entry_hash[i].lock);
940 }
941
942 dma_debug_fs_init();
943
944 nr_pages = DIV_ROUND_UP(nr_prealloc_entries, DMA_DEBUG_DYNAMIC_ENTRIES);
945 for (i = 0; i < nr_pages; ++i)
946 dma_debug_create_entries(GFP_KERNEL);
947 if (num_free_entries >= nr_prealloc_entries) {
948 pr_info("preallocated %d debug entries\n", nr_total_entries);
949 } else if (num_free_entries > 0) {
950 pr_warn("%d debug entries requested but only %d allocated\n",
951 nr_prealloc_entries, nr_total_entries);
952 } else {
953 pr_err("debugging out of memory error - disabled\n");
954 global_disable = true;
955
956 return 0;
957 }
958 min_free_entries = num_free_entries;
959
960 dma_debug_initialized = true;
961
962 pr_info("debugging enabled by kernel config\n");
963 return 0;
964}
965core_initcall(dma_debug_init);
966
967static __init int dma_debug_cmdline(char *str)
968{
969 if (!str)
970 return -EINVAL;
971
972 if (strncmp(str, "off", 3) == 0) {
973 pr_info("debugging disabled on kernel command line\n");
974 global_disable = true;
975 }
976
977 return 0;
978}
979
980static __init int dma_debug_entries_cmdline(char *str)
981{
982 if (!str)
983 return -EINVAL;
984 if (!get_option(&str, &nr_prealloc_entries))
985 nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES;
986 return 0;
987}
988
989__setup("dma_debug=", dma_debug_cmdline);
990__setup("dma_debug_entries=", dma_debug_entries_cmdline);
991
992static void check_unmap(struct dma_debug_entry *ref)
993{
994 struct dma_debug_entry *entry;
995 struct hash_bucket *bucket;
996 unsigned long flags;
997
998 bucket = get_hash_bucket(ref, &flags);
999 entry = bucket_find_exact(bucket, ref);
1000
1001 if (!entry) {
1002
1003 put_hash_bucket(bucket, flags);
1004
1005 if (dma_mapping_error(ref->dev, ref->dev_addr)) {
1006 err_printk(ref->dev, NULL,
1007 "device driver tries to free an "
1008 "invalid DMA memory address\n");
1009 } else {
1010 err_printk(ref->dev, NULL,
1011 "device driver tries to free DMA "
1012 "memory it has not allocated [device "
1013 "address=0x%016llx] [size=%llu bytes]\n",
1014 ref->dev_addr, ref->size);
1015 }
1016 return;
1017 }
1018
1019 if (ref->size != entry->size) {
1020 err_printk(ref->dev, entry, "device driver frees "
1021 "DMA memory with different size "
1022 "[device address=0x%016llx] [map size=%llu bytes] "
1023 "[unmap size=%llu bytes]\n",
1024 ref->dev_addr, entry->size, ref->size);
1025 }
1026
1027 if (ref->type != entry->type) {
1028 err_printk(ref->dev, entry, "device driver frees "
1029 "DMA memory with wrong function "
1030 "[device address=0x%016llx] [size=%llu bytes] "
1031 "[mapped as %s] [unmapped as %s]\n",
1032 ref->dev_addr, ref->size,
1033 type2name[entry->type], type2name[ref->type]);
1034 } else if ((entry->type == dma_debug_coherent) &&
1035 (phys_addr(ref) != phys_addr(entry))) {
1036 err_printk(ref->dev, entry, "device driver frees "
1037 "DMA memory with different CPU address "
1038 "[device address=0x%016llx] [size=%llu bytes] "
1039 "[cpu alloc address=0x%016llx] "
1040 "[cpu free address=0x%016llx]",
1041 ref->dev_addr, ref->size,
1042 phys_addr(entry),
1043 phys_addr(ref));
1044 }
1045
1046 if (ref->sg_call_ents && ref->type == dma_debug_sg &&
1047 ref->sg_call_ents != entry->sg_call_ents) {
1048 err_printk(ref->dev, entry, "device driver frees "
1049 "DMA sg list with different entry count "
1050 "[map count=%d] [unmap count=%d]\n",
1051 entry->sg_call_ents, ref->sg_call_ents);
1052 }
1053
1054
1055
1056
1057
1058 if (ref->direction != entry->direction) {
1059 err_printk(ref->dev, entry, "device driver frees "
1060 "DMA memory with different direction "
1061 "[device address=0x%016llx] [size=%llu bytes] "
1062 "[mapped with %s] [unmapped with %s]\n",
1063 ref->dev_addr, ref->size,
1064 dir2name[entry->direction],
1065 dir2name[ref->direction]);
1066 }
1067
1068
1069
1070
1071
1072
1073 if (entry->map_err_type == MAP_ERR_NOT_CHECKED) {
1074 err_printk(ref->dev, entry,
1075 "device driver failed to check map error"
1076 "[device address=0x%016llx] [size=%llu bytes] "
1077 "[mapped as %s]",
1078 ref->dev_addr, ref->size,
1079 type2name[entry->type]);
1080 }
1081
1082 hash_bucket_del(entry);
1083 dma_entry_free(entry);
1084
1085 put_hash_bucket(bucket, flags);
1086}
1087
1088static void check_for_stack(struct device *dev,
1089 struct page *page, size_t offset)
1090{
1091 void *addr;
1092 struct vm_struct *stack_vm_area = task_stack_vm_area(current);
1093
1094 if (!stack_vm_area) {
1095
1096 if (PageHighMem(page))
1097 return;
1098 addr = page_address(page) + offset;
1099 if (object_is_on_stack(addr))
1100 err_printk(dev, NULL, "device driver maps memory from stack [addr=%p]\n", addr);
1101 } else {
1102
1103 int i;
1104
1105 for (i = 0; i < stack_vm_area->nr_pages; i++) {
1106 if (page != stack_vm_area->pages[i])
1107 continue;
1108
1109 addr = (u8 *)current->stack + i * PAGE_SIZE + offset;
1110 err_printk(dev, NULL, "device driver maps memory from stack [probable addr=%p]\n", addr);
1111 break;
1112 }
1113 }
1114}
1115
1116static inline bool overlap(void *addr, unsigned long len, void *start, void *end)
1117{
1118 unsigned long a1 = (unsigned long)addr;
1119 unsigned long b1 = a1 + len;
1120 unsigned long a2 = (unsigned long)start;
1121 unsigned long b2 = (unsigned long)end;
1122
1123 return !(b1 <= a2 || a1 >= b2);
1124}
1125
1126static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len)
1127{
1128 if (overlap(addr, len, _stext, _etext) ||
1129 overlap(addr, len, __start_rodata, __end_rodata))
1130 err_printk(dev, NULL, "device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len);
1131}
1132
1133static void check_sync(struct device *dev,
1134 struct dma_debug_entry *ref,
1135 bool to_cpu)
1136{
1137 struct dma_debug_entry *entry;
1138 struct hash_bucket *bucket;
1139 unsigned long flags;
1140
1141 bucket = get_hash_bucket(ref, &flags);
1142
1143 entry = bucket_find_contain(&bucket, ref, &flags);
1144
1145 if (!entry) {
1146 err_printk(dev, NULL, "device driver tries "
1147 "to sync DMA memory it has not allocated "
1148 "[device address=0x%016llx] [size=%llu bytes]\n",
1149 (unsigned long long)ref->dev_addr, ref->size);
1150 goto out;
1151 }
1152
1153 if (ref->size > entry->size) {
1154 err_printk(dev, entry, "device driver syncs"
1155 " DMA memory outside allocated range "
1156 "[device address=0x%016llx] "
1157 "[allocation size=%llu bytes] "
1158 "[sync offset+size=%llu]\n",
1159 entry->dev_addr, entry->size,
1160 ref->size);
1161 }
1162
1163 if (entry->direction == DMA_BIDIRECTIONAL)
1164 goto out;
1165
1166 if (ref->direction != entry->direction) {
1167 err_printk(dev, entry, "device driver syncs "
1168 "DMA memory with different direction "
1169 "[device address=0x%016llx] [size=%llu bytes] "
1170 "[mapped with %s] [synced with %s]\n",
1171 (unsigned long long)ref->dev_addr, entry->size,
1172 dir2name[entry->direction],
1173 dir2name[ref->direction]);
1174 }
1175
1176 if (to_cpu && !(entry->direction == DMA_FROM_DEVICE) &&
1177 !(ref->direction == DMA_TO_DEVICE))
1178 err_printk(dev, entry, "device driver syncs "
1179 "device read-only DMA memory for cpu "
1180 "[device address=0x%016llx] [size=%llu bytes] "
1181 "[mapped with %s] [synced with %s]\n",
1182 (unsigned long long)ref->dev_addr, entry->size,
1183 dir2name[entry->direction],
1184 dir2name[ref->direction]);
1185
1186 if (!to_cpu && !(entry->direction == DMA_TO_DEVICE) &&
1187 !(ref->direction == DMA_FROM_DEVICE))
1188 err_printk(dev, entry, "device driver syncs "
1189 "device write-only DMA memory to device "
1190 "[device address=0x%016llx] [size=%llu bytes] "
1191 "[mapped with %s] [synced with %s]\n",
1192 (unsigned long long)ref->dev_addr, entry->size,
1193 dir2name[entry->direction],
1194 dir2name[ref->direction]);
1195
1196 if (ref->sg_call_ents && ref->type == dma_debug_sg &&
1197 ref->sg_call_ents != entry->sg_call_ents) {
1198 err_printk(ref->dev, entry, "device driver syncs "
1199 "DMA sg list with different entry count "
1200 "[map count=%d] [sync count=%d]\n",
1201 entry->sg_call_ents, ref->sg_call_ents);
1202 }
1203
1204out:
1205 put_hash_bucket(bucket, flags);
1206}
1207
1208static void check_sg_segment(struct device *dev, struct scatterlist *sg)
1209{
1210#ifdef CONFIG_DMA_API_DEBUG_SG
1211 unsigned int max_seg = dma_get_max_seg_size(dev);
1212 u64 start, end, boundary = dma_get_seg_boundary(dev);
1213
1214
1215
1216
1217
1218 if (sg->length > max_seg)
1219 err_printk(dev, NULL, "mapping sg segment longer than device claims to support [len=%u] [max=%u]\n",
1220 sg->length, max_seg);
1221
1222
1223
1224
1225
1226 start = sg_dma_address(sg);
1227 end = start + sg_dma_len(sg) - 1;
1228 if ((start ^ end) & ~boundary)
1229 err_printk(dev, NULL, "mapping sg segment across boundary [start=0x%016llx] [end=0x%016llx] [boundary=0x%016llx]\n",
1230 start, end, boundary);
1231#endif
1232}
1233
1234void debug_dma_map_single(struct device *dev, const void *addr,
1235 unsigned long len)
1236{
1237 if (unlikely(dma_debug_disabled()))
1238 return;
1239
1240 if (!virt_addr_valid(addr))
1241 err_printk(dev, NULL, "device driver maps memory from invalid area [addr=%p] [len=%lu]\n",
1242 addr, len);
1243
1244 if (is_vmalloc_addr(addr))
1245 err_printk(dev, NULL, "device driver maps memory from vmalloc area [addr=%p] [len=%lu]\n",
1246 addr, len);
1247}
1248EXPORT_SYMBOL(debug_dma_map_single);
1249
1250void debug_dma_map_page(struct device *dev, struct page *page, size_t offset,
1251 size_t size, int direction, dma_addr_t dma_addr)
1252{
1253 struct dma_debug_entry *entry;
1254
1255 if (unlikely(dma_debug_disabled()))
1256 return;
1257
1258 if (dma_mapping_error(dev, dma_addr))
1259 return;
1260
1261 entry = dma_entry_alloc();
1262 if (!entry)
1263 return;
1264
1265 entry->dev = dev;
1266 entry->type = dma_debug_single;
1267 entry->pfn = page_to_pfn(page);
1268 entry->offset = offset,
1269 entry->dev_addr = dma_addr;
1270 entry->size = size;
1271 entry->direction = direction;
1272 entry->map_err_type = MAP_ERR_NOT_CHECKED;
1273
1274 check_for_stack(dev, page, offset);
1275
1276 if (!PageHighMem(page)) {
1277 void *addr = page_address(page) + offset;
1278
1279 check_for_illegal_area(dev, addr, size);
1280 }
1281
1282 add_dma_entry(entry);
1283}
1284EXPORT_SYMBOL(debug_dma_map_page);
1285
1286void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
1287{
1288 struct dma_debug_entry ref;
1289 struct dma_debug_entry *entry;
1290 struct hash_bucket *bucket;
1291 unsigned long flags;
1292
1293 if (unlikely(dma_debug_disabled()))
1294 return;
1295
1296 ref.dev = dev;
1297 ref.dev_addr = dma_addr;
1298 bucket = get_hash_bucket(&ref, &flags);
1299
1300 list_for_each_entry(entry, &bucket->list, list) {
1301 if (!exact_match(&ref, entry))
1302 continue;
1303
1304
1305
1306
1307
1308
1309
1310
1311
1312
1313
1314 if (entry->map_err_type == MAP_ERR_NOT_CHECKED) {
1315 entry->map_err_type = MAP_ERR_CHECKED;
1316 break;
1317 }
1318 }
1319
1320 put_hash_bucket(bucket, flags);
1321}
1322EXPORT_SYMBOL(debug_dma_mapping_error);
1323
1324void debug_dma_unmap_page(struct device *dev, dma_addr_t addr,
1325 size_t size, int direction)
1326{
1327 struct dma_debug_entry ref = {
1328 .type = dma_debug_single,
1329 .dev = dev,
1330 .dev_addr = addr,
1331 .size = size,
1332 .direction = direction,
1333 };
1334
1335 if (unlikely(dma_debug_disabled()))
1336 return;
1337 check_unmap(&ref);
1338}
1339EXPORT_SYMBOL(debug_dma_unmap_page);
1340
1341void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
1342 int nents, int mapped_ents, int direction)
1343{
1344 struct dma_debug_entry *entry;
1345 struct scatterlist *s;
1346 int i;
1347
1348 if (unlikely(dma_debug_disabled()))
1349 return;
1350
1351 for_each_sg(sg, s, mapped_ents, i) {
1352 entry = dma_entry_alloc();
1353 if (!entry)
1354 return;
1355
1356 entry->type = dma_debug_sg;
1357 entry->dev = dev;
1358 entry->pfn = page_to_pfn(sg_page(s));
1359 entry->offset = s->offset,
1360 entry->size = sg_dma_len(s);
1361 entry->dev_addr = sg_dma_address(s);
1362 entry->direction = direction;
1363 entry->sg_call_ents = nents;
1364 entry->sg_mapped_ents = mapped_ents;
1365
1366 check_for_stack(dev, sg_page(s), s->offset);
1367
1368 if (!PageHighMem(sg_page(s))) {
1369 check_for_illegal_area(dev, sg_virt(s), sg_dma_len(s));
1370 }
1371
1372 check_sg_segment(dev, s);
1373
1374 add_dma_entry(entry);
1375 }
1376}
1377EXPORT_SYMBOL(debug_dma_map_sg);
1378
1379static int get_nr_mapped_entries(struct device *dev,
1380 struct dma_debug_entry *ref)
1381{
1382 struct dma_debug_entry *entry;
1383 struct hash_bucket *bucket;
1384 unsigned long flags;
1385 int mapped_ents;
1386
1387 bucket = get_hash_bucket(ref, &flags);
1388 entry = bucket_find_exact(bucket, ref);
1389 mapped_ents = 0;
1390
1391 if (entry)
1392 mapped_ents = entry->sg_mapped_ents;
1393 put_hash_bucket(bucket, flags);
1394
1395 return mapped_ents;
1396}
1397
1398void debug_dma_unmap_sg(struct device *dev, struct scatterlist *sglist,
1399 int nelems, int dir)
1400{
1401 struct scatterlist *s;
1402 int mapped_ents = 0, i;
1403
1404 if (unlikely(dma_debug_disabled()))
1405 return;
1406
1407 for_each_sg(sglist, s, nelems, i) {
1408
1409 struct dma_debug_entry ref = {
1410 .type = dma_debug_sg,
1411 .dev = dev,
1412 .pfn = page_to_pfn(sg_page(s)),
1413 .offset = s->offset,
1414 .dev_addr = sg_dma_address(s),
1415 .size = sg_dma_len(s),
1416 .direction = dir,
1417 .sg_call_ents = nelems,
1418 };
1419
1420 if (mapped_ents && i >= mapped_ents)
1421 break;
1422
1423 if (!i)
1424 mapped_ents = get_nr_mapped_entries(dev, &ref);
1425
1426 check_unmap(&ref);
1427 }
1428}
1429EXPORT_SYMBOL(debug_dma_unmap_sg);
1430
1431void debug_dma_alloc_coherent(struct device *dev, size_t size,
1432 dma_addr_t dma_addr, void *virt)
1433{
1434 struct dma_debug_entry *entry;
1435
1436 if (unlikely(dma_debug_disabled()))
1437 return;
1438
1439 if (unlikely(virt == NULL))
1440 return;
1441
1442
1443 if (!is_vmalloc_addr(virt) && !virt_addr_valid(virt))
1444 return;
1445
1446 entry = dma_entry_alloc();
1447 if (!entry)
1448 return;
1449
1450 entry->type = dma_debug_coherent;
1451 entry->dev = dev;
1452 entry->offset = offset_in_page(virt);
1453 entry->size = size;
1454 entry->dev_addr = dma_addr;
1455 entry->direction = DMA_BIDIRECTIONAL;
1456
1457 if (is_vmalloc_addr(virt))
1458 entry->pfn = vmalloc_to_pfn(virt);
1459 else
1460 entry->pfn = page_to_pfn(virt_to_page(virt));
1461
1462 add_dma_entry(entry);
1463}
1464
1465void debug_dma_free_coherent(struct device *dev, size_t size,
1466 void *virt, dma_addr_t addr)
1467{
1468 struct dma_debug_entry ref = {
1469 .type = dma_debug_coherent,
1470 .dev = dev,
1471 .offset = offset_in_page(virt),
1472 .dev_addr = addr,
1473 .size = size,
1474 .direction = DMA_BIDIRECTIONAL,
1475 };
1476
1477
1478 if (!is_vmalloc_addr(virt) && !virt_addr_valid(virt))
1479 return;
1480
1481 if (is_vmalloc_addr(virt))
1482 ref.pfn = vmalloc_to_pfn(virt);
1483 else
1484 ref.pfn = page_to_pfn(virt_to_page(virt));
1485
1486 if (unlikely(dma_debug_disabled()))
1487 return;
1488
1489 check_unmap(&ref);
1490}
1491
1492void debug_dma_map_resource(struct device *dev, phys_addr_t addr, size_t size,
1493 int direction, dma_addr_t dma_addr)
1494{
1495 struct dma_debug_entry *entry;
1496
1497 if (unlikely(dma_debug_disabled()))
1498 return;
1499
1500 entry = dma_entry_alloc();
1501 if (!entry)
1502 return;
1503
1504 entry->type = dma_debug_resource;
1505 entry->dev = dev;
1506 entry->pfn = PHYS_PFN(addr);
1507 entry->offset = offset_in_page(addr);
1508 entry->size = size;
1509 entry->dev_addr = dma_addr;
1510 entry->direction = direction;
1511 entry->map_err_type = MAP_ERR_NOT_CHECKED;
1512
1513 add_dma_entry(entry);
1514}
1515EXPORT_SYMBOL(debug_dma_map_resource);
1516
1517void debug_dma_unmap_resource(struct device *dev, dma_addr_t dma_addr,
1518 size_t size, int direction)
1519{
1520 struct dma_debug_entry ref = {
1521 .type = dma_debug_resource,
1522 .dev = dev,
1523 .dev_addr = dma_addr,
1524 .size = size,
1525 .direction = direction,
1526 };
1527
1528 if (unlikely(dma_debug_disabled()))
1529 return;
1530
1531 check_unmap(&ref);
1532}
1533EXPORT_SYMBOL(debug_dma_unmap_resource);
1534
1535void debug_dma_sync_single_for_cpu(struct device *dev, dma_addr_t dma_handle,
1536 size_t size, int direction)
1537{
1538 struct dma_debug_entry ref;
1539
1540 if (unlikely(dma_debug_disabled()))
1541 return;
1542
1543 ref.type = dma_debug_single;
1544 ref.dev = dev;
1545 ref.dev_addr = dma_handle;
1546 ref.size = size;
1547 ref.direction = direction;
1548 ref.sg_call_ents = 0;
1549
1550 check_sync(dev, &ref, true);
1551}
1552EXPORT_SYMBOL(debug_dma_sync_single_for_cpu);
1553
1554void debug_dma_sync_single_for_device(struct device *dev,
1555 dma_addr_t dma_handle, size_t size,
1556 int direction)
1557{
1558 struct dma_debug_entry ref;
1559
1560 if (unlikely(dma_debug_disabled()))
1561 return;
1562
1563 ref.type = dma_debug_single;
1564 ref.dev = dev;
1565 ref.dev_addr = dma_handle;
1566 ref.size = size;
1567 ref.direction = direction;
1568 ref.sg_call_ents = 0;
1569
1570 check_sync(dev, &ref, false);
1571}
1572EXPORT_SYMBOL(debug_dma_sync_single_for_device);
1573
1574void debug_dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
1575 int nelems, int direction)
1576{
1577 struct scatterlist *s;
1578 int mapped_ents = 0, i;
1579
1580 if (unlikely(dma_debug_disabled()))
1581 return;
1582
1583 for_each_sg(sg, s, nelems, i) {
1584
1585 struct dma_debug_entry ref = {
1586 .type = dma_debug_sg,
1587 .dev = dev,
1588 .pfn = page_to_pfn(sg_page(s)),
1589 .offset = s->offset,
1590 .dev_addr = sg_dma_address(s),
1591 .size = sg_dma_len(s),
1592 .direction = direction,
1593 .sg_call_ents = nelems,
1594 };
1595
1596 if (!i)
1597 mapped_ents = get_nr_mapped_entries(dev, &ref);
1598
1599 if (i >= mapped_ents)
1600 break;
1601
1602 check_sync(dev, &ref, true);
1603 }
1604}
1605EXPORT_SYMBOL(debug_dma_sync_sg_for_cpu);
1606
1607void debug_dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
1608 int nelems, int direction)
1609{
1610 struct scatterlist *s;
1611 int mapped_ents = 0, i;
1612
1613 if (unlikely(dma_debug_disabled()))
1614 return;
1615
1616 for_each_sg(sg, s, nelems, i) {
1617
1618 struct dma_debug_entry ref = {
1619 .type = dma_debug_sg,
1620 .dev = dev,
1621 .pfn = page_to_pfn(sg_page(s)),
1622 .offset = s->offset,
1623 .dev_addr = sg_dma_address(s),
1624 .size = sg_dma_len(s),
1625 .direction = direction,
1626 .sg_call_ents = nelems,
1627 };
1628 if (!i)
1629 mapped_ents = get_nr_mapped_entries(dev, &ref);
1630
1631 if (i >= mapped_ents)
1632 break;
1633
1634 check_sync(dev, &ref, false);
1635 }
1636}
1637EXPORT_SYMBOL(debug_dma_sync_sg_for_device);
1638
1639static int __init dma_debug_driver_setup(char *str)
1640{
1641 int i;
1642
1643 for (i = 0; i < NAME_MAX_LEN - 1; ++i, ++str) {
1644 current_driver_name[i] = *str;
1645 if (*str == 0)
1646 break;
1647 }
1648
1649 if (current_driver_name[0])
1650 pr_info("enable driver filter for driver [%s]\n",
1651 current_driver_name);
1652
1653
1654 return 1;
1655}
1656__setup("dma_debug_driver=", dma_debug_driver_setup);
1657