2 * Copyright (C) 2008 Advanced Micro Devices, Inc.
4 * Author: Joerg Roedel <joerg.roedel@amd.com>
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License version 2 as published
8 * by the Free Software Foundation.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 #include <linux/scatterlist.h>
21 #include <linux/dma-mapping.h>
22 #include <linux/stacktrace.h>
23 #include <linux/dma-debug.h>
24 #include <linux/spinlock.h>
25 #include <linux/vmalloc.h>
26 #include <linux/debugfs.h>
27 #include <linux/uaccess.h>
28 #include <linux/export.h>
29 #include <linux/device.h>
30 #include <linux/types.h>
31 #include <linux/sched.h>
32 #include <linux/ctype.h>
33 #include <linux/list.h>
34 #include <linux/slab.h>
36 #include <asm/sections.h>
38 #define HASH_SIZE 1024ULL
39 #define HASH_FN_SHIFT 13
40 #define HASH_FN_MASK (HASH_SIZE - 1)
50 MAP_ERR_CHECK_NOT_APPLICABLE,
55 #define DMA_DEBUG_STACKTRACE_ENTRIES 5
58 * struct dma_debug_entry - track a dma_map* or dma_alloc_coherent mapping
59 * @list: node on pre-allocated free_entries list
60 * @dev: 'dev' argument to dma_map_{page|single|sg} or dma_alloc_coherent
61 * @type: single, page, sg, coherent
62 * @pfn: page frame of the start address
63 * @offset: offset of mapping relative to pfn
64 * @size: length of the mapping
65 * @direction: enum dma_data_direction
66 * @sg_call_ents: 'nents' from dma_map_sg
67 * @sg_mapped_ents: 'mapped_ents' from dma_map_sg
68 * @map_err_type: track whether dma_mapping_error() was checked
69 * @stacktrace: support backtraces when a violation is detected
71 struct dma_debug_entry {
72 struct list_head list;
82 enum map_err_types map_err_type;
83 #ifdef CONFIG_STACKTRACE
84 struct stack_trace stacktrace;
85 unsigned long st_entries[DMA_DEBUG_STACKTRACE_ENTRIES];
89 typedef bool (*match_fn)(struct dma_debug_entry *, struct dma_debug_entry *);
92 struct list_head list;
94 } ____cacheline_aligned_in_smp;
96 /* Hash list to save the allocated dma addresses */
97 static struct hash_bucket dma_entry_hash[HASH_SIZE];
98 /* List of pre-allocated dma_debug_entry's */
99 static LIST_HEAD(free_entries);
100 /* Lock for the list above */
101 static DEFINE_SPINLOCK(free_entries_lock);
103 /* Global disable flag - will be set in case of an error */
104 static bool global_disable __read_mostly;
106 /* Early initialization disable flag, set at the end of dma_debug_init */
107 static bool dma_debug_initialized __read_mostly;
109 static inline bool dma_debug_disabled(void)
111 return global_disable || !dma_debug_initialized;
114 /* Global error count */
115 static u32 error_count;
117 /* Global error show enable*/
118 static u32 show_all_errors __read_mostly;
119 /* Number of errors to show */
120 static u32 show_num_errors = 1;
122 static u32 num_free_entries;
123 static u32 min_free_entries;
124 static u32 nr_total_entries;
126 /* number of preallocated entries requested by kernel cmdline */
127 static u32 req_entries;
129 /* debugfs dentry's for the stuff above */
130 static struct dentry *dma_debug_dent __read_mostly;
131 static struct dentry *global_disable_dent __read_mostly;
132 static struct dentry *error_count_dent __read_mostly;
133 static struct dentry *show_all_errors_dent __read_mostly;
134 static struct dentry *show_num_errors_dent __read_mostly;
135 static struct dentry *num_free_entries_dent __read_mostly;
136 static struct dentry *min_free_entries_dent __read_mostly;
137 static struct dentry *filter_dent __read_mostly;
139 /* per-driver filter related state */
141 #define NAME_MAX_LEN 64
143 static char current_driver_name[NAME_MAX_LEN] __read_mostly;
144 static struct device_driver *current_driver __read_mostly;
146 static DEFINE_RWLOCK(driver_name_lock);
148 static const char *const maperr2str[] = {
149 [MAP_ERR_CHECK_NOT_APPLICABLE] = "dma map error check not applicable",
150 [MAP_ERR_NOT_CHECKED] = "dma map error not checked",
151 [MAP_ERR_CHECKED] = "dma map error checked",
154 static const char *type2name[4] = { "single", "page",
155 "scather-gather", "coherent" };
157 static const char *dir2name[4] = { "DMA_BIDIRECTIONAL", "DMA_TO_DEVICE",
158 "DMA_FROM_DEVICE", "DMA_NONE" };
161 * The access to some variables in this macro is racy. We can't use atomic_t
162 * here because all these variables are exported to debugfs. Some of them even
163 * writeable. This is also the reason why a lock won't help much. But anyway,
164 * the races are no big deal. Here is why:
166 * error_count: the addition is racy, but the worst thing that can happen is
167 * that we don't count some errors
168 * show_num_errors: the subtraction is racy. Also no big deal because in
169 * worst case this will result in one warning more in the
170 * system log than the user configured. This variable is
171 * writeable via debugfs.
173 static inline void dump_entry_trace(struct dma_debug_entry *entry)
175 #ifdef CONFIG_STACKTRACE
177 pr_warning("Mapped at:\n");
178 print_stack_trace(&entry->stacktrace, 0);
183 static bool driver_filter(struct device *dev)
185 struct device_driver *drv;
189 /* driver filter off */
190 if (likely(!current_driver_name[0]))
193 /* driver filter on and initialized */
194 if (current_driver && dev && dev->driver == current_driver)
197 /* driver filter on, but we can't filter on a NULL device... */
201 if (current_driver || !current_driver_name[0])
204 /* driver filter on but not yet initialized */
209 /* lock to protect against change of current_driver_name */
210 read_lock_irqsave(&driver_name_lock, flags);
214 strncmp(current_driver_name, drv->name, NAME_MAX_LEN - 1) == 0) {
215 current_driver = drv;
219 read_unlock_irqrestore(&driver_name_lock, flags);
224 #define err_printk(dev, entry, format, arg...) do { \
226 if (driver_filter(dev) && \
227 (show_all_errors || show_num_errors > 0)) { \
228 WARN(1, "%s %s: " format, \
229 dev ? dev_driver_string(dev) : "NULL", \
230 dev ? dev_name(dev) : "NULL", ## arg); \
231 dump_entry_trace(entry); \
233 if (!show_all_errors && show_num_errors > 0) \
234 show_num_errors -= 1; \
238 * Hash related functions
240 * Every DMA-API request is saved into a struct dma_debug_entry. To
241 * have quick access to these structs they are stored into a hash.
243 static int hash_fn(struct dma_debug_entry *entry)
246 * Hash function is based on the dma address.
247 * We use bits 20-27 here as the index into the hash
249 return (entry->dev_addr >> HASH_FN_SHIFT) & HASH_FN_MASK;
253 * Request exclusive access to a hash bucket for a given dma_debug_entry.
255 static struct hash_bucket *get_hash_bucket(struct dma_debug_entry *entry,
256 unsigned long *flags)
257 __acquires(&dma_entry_hash[idx].lock)
259 int idx = hash_fn(entry);
260 unsigned long __flags;
262 spin_lock_irqsave(&dma_entry_hash[idx].lock, __flags);
264 return &dma_entry_hash[idx];
268 * Give up exclusive access to the hash bucket
270 static void put_hash_bucket(struct hash_bucket *bucket,
271 unsigned long *flags)
272 __releases(&bucket->lock)
274 unsigned long __flags = *flags;
276 spin_unlock_irqrestore(&bucket->lock, __flags);
279 static bool exact_match(struct dma_debug_entry *a, struct dma_debug_entry *b)
281 return ((a->dev_addr == b->dev_addr) &&
282 (a->dev == b->dev)) ? true : false;
285 static bool containing_match(struct dma_debug_entry *a,
286 struct dma_debug_entry *b)
288 if (a->dev != b->dev)
291 if ((b->dev_addr <= a->dev_addr) &&
292 ((b->dev_addr + b->size) >= (a->dev_addr + a->size)))
299 * Search a given entry in the hash bucket list
301 static struct dma_debug_entry *__hash_bucket_find(struct hash_bucket *bucket,
302 struct dma_debug_entry *ref,
305 struct dma_debug_entry *entry, *ret = NULL;
306 int matches = 0, match_lvl, last_lvl = -1;
308 list_for_each_entry(entry, &bucket->list, list) {
309 if (!match(ref, entry))
313 * Some drivers map the same physical address multiple
314 * times. Without a hardware IOMMU this results in the
315 * same device addresses being put into the dma-debug
316 * hash multiple times too. This can result in false
317 * positives being reported. Therefore we implement a
318 * best-fit algorithm here which returns the entry from
319 * the hash which fits best to the reference value
320 * instead of the first-fit.
324 entry->size == ref->size ? ++match_lvl : 0;
325 entry->type == ref->type ? ++match_lvl : 0;
326 entry->direction == ref->direction ? ++match_lvl : 0;
327 entry->sg_call_ents == ref->sg_call_ents ? ++match_lvl : 0;
329 if (match_lvl == 4) {
330 /* perfect-fit - return the result */
332 } else if (match_lvl > last_lvl) {
334 * We found an entry that fits better then the
335 * previous one or it is the 1st match.
337 last_lvl = match_lvl;
343 * If we have multiple matches but no perfect-fit, just return
346 ret = (matches == 1) ? ret : NULL;
351 static struct dma_debug_entry *bucket_find_exact(struct hash_bucket *bucket,
352 struct dma_debug_entry *ref)
354 return __hash_bucket_find(bucket, ref, exact_match);
357 static struct dma_debug_entry *bucket_find_contain(struct hash_bucket **bucket,
358 struct dma_debug_entry *ref,
359 unsigned long *flags)
362 unsigned int max_range = dma_get_max_seg_size(ref->dev);
363 struct dma_debug_entry *entry, index = *ref;
364 unsigned int range = 0;
366 while (range <= max_range) {
367 entry = __hash_bucket_find(*bucket, ref, containing_match);
373 * Nothing found, go back a hash bucket
375 put_hash_bucket(*bucket, flags);
376 range += (1 << HASH_FN_SHIFT);
377 index.dev_addr -= (1 << HASH_FN_SHIFT);
378 *bucket = get_hash_bucket(&index, flags);
385 * Add an entry to a hash bucket
387 static void hash_bucket_add(struct hash_bucket *bucket,
388 struct dma_debug_entry *entry)
390 list_add_tail(&entry->list, &bucket->list);
394 * Remove entry from a hash bucket list
396 static void hash_bucket_del(struct dma_debug_entry *entry)
398 list_del(&entry->list);
401 static unsigned long long phys_addr(struct dma_debug_entry *entry)
403 return page_to_phys(pfn_to_page(entry->pfn)) + entry->offset;
407 * Dump mapping entries for debugging purposes
409 void debug_dma_dump_mappings(struct device *dev)
413 for (idx = 0; idx < HASH_SIZE; idx++) {
414 struct hash_bucket *bucket = &dma_entry_hash[idx];
415 struct dma_debug_entry *entry;
418 spin_lock_irqsave(&bucket->lock, flags);
420 list_for_each_entry(entry, &bucket->list, list) {
421 if (!dev || dev == entry->dev) {
423 "%s idx %d P=%Lx N=%lx D=%Lx L=%Lx %s %s\n",
424 type2name[entry->type], idx,
425 phys_addr(entry), entry->pfn,
426 entry->dev_addr, entry->size,
427 dir2name[entry->direction],
428 maperr2str[entry->map_err_type]);
432 spin_unlock_irqrestore(&bucket->lock, flags);
435 EXPORT_SYMBOL(debug_dma_dump_mappings);
438 * For each mapping (initial cacheline in the case of
439 * dma_alloc_coherent/dma_map_page, initial cacheline in each page of a
440 * scatterlist, or the cacheline specified in dma_map_single) insert
441 * into this tree using the cacheline as the key. At
442 * dma_unmap_{single|sg|page} or dma_free_coherent delete the entry. If
443 * the entry already exists at insertion time add a tag as a reference
444 * count for the overlapping mappings. For now, the overlap tracking
445 * just ensures that 'unmaps' balance 'maps' before marking the
446 * cacheline idle, but we should also be flagging overlaps as an API
449 * Memory usage is mostly constrained by the maximum number of available
450 * dma-debug entries in that we need a free dma_debug_entry before
451 * inserting into the tree. In the case of dma_map_page and
452 * dma_alloc_coherent there is only one dma_debug_entry and one
453 * dma_active_cacheline entry to track per event. dma_map_sg(), on the
454 * other hand, consumes a single dma_debug_entry, but inserts 'nents'
455 * entries into the tree.
457 * At any time debug_dma_assert_idle() can be called to trigger a
458 * warning if any cachelines in the given page are in the active set.
460 static RADIX_TREE(dma_active_cacheline, GFP_NOWAIT);
461 static DEFINE_SPINLOCK(radix_lock);
462 #define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)
463 #define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT)
464 #define CACHELINES_PER_PAGE (1 << CACHELINE_PER_PAGE_SHIFT)
466 static phys_addr_t to_cacheline_number(struct dma_debug_entry *entry)
468 return (entry->pfn << CACHELINE_PER_PAGE_SHIFT) +
469 (entry->offset >> L1_CACHE_SHIFT);
472 static int active_cacheline_read_overlap(phys_addr_t cln)
476 for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
477 if (radix_tree_tag_get(&dma_active_cacheline, cln, i))
482 static int active_cacheline_set_overlap(phys_addr_t cln, int overlap)
486 if (overlap > ACTIVE_CACHELINE_MAX_OVERLAP || overlap < 0)
489 for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
490 if (overlap & 1 << i)
491 radix_tree_tag_set(&dma_active_cacheline, cln, i);
493 radix_tree_tag_clear(&dma_active_cacheline, cln, i);
498 static void active_cacheline_inc_overlap(phys_addr_t cln)
500 int overlap = active_cacheline_read_overlap(cln);
502 overlap = active_cacheline_set_overlap(cln, ++overlap);
504 /* If we overflowed the overlap counter then we're potentially
505 * leaking dma-mappings. Otherwise, if maps and unmaps are
506 * balanced then this overflow may cause false negatives in
507 * debug_dma_assert_idle() as the cacheline may be marked idle
510 WARN_ONCE(overlap > ACTIVE_CACHELINE_MAX_OVERLAP,
511 "DMA-API: exceeded %d overlapping mappings of cacheline %pa\n",
512 ACTIVE_CACHELINE_MAX_OVERLAP, &cln);
515 static int active_cacheline_dec_overlap(phys_addr_t cln)
517 int overlap = active_cacheline_read_overlap(cln);
519 return active_cacheline_set_overlap(cln, --overlap);
522 static int active_cacheline_insert(struct dma_debug_entry *entry)
524 phys_addr_t cln = to_cacheline_number(entry);
528 /* If the device is not writing memory then we don't have any
529 * concerns about the cpu consuming stale data. This mitigates
530 * legitimate usages of overlapping mappings.
532 if (entry->direction == DMA_TO_DEVICE)
535 spin_lock_irqsave(&radix_lock, flags);
536 rc = radix_tree_insert(&dma_active_cacheline, cln, entry);
538 active_cacheline_inc_overlap(cln);
539 spin_unlock_irqrestore(&radix_lock, flags);
544 static void active_cacheline_remove(struct dma_debug_entry *entry)
546 phys_addr_t cln = to_cacheline_number(entry);
549 /* ...mirror the insert case */
550 if (entry->direction == DMA_TO_DEVICE)
553 spin_lock_irqsave(&radix_lock, flags);
554 /* since we are counting overlaps the final put of the
555 * cacheline will occur when the overlap count is 0.
556 * active_cacheline_dec_overlap() returns -1 in that case
558 if (active_cacheline_dec_overlap(cln) < 0)
559 radix_tree_delete(&dma_active_cacheline, cln);
560 spin_unlock_irqrestore(&radix_lock, flags);
564 * debug_dma_assert_idle() - assert that a page is not undergoing dma
565 * @page: page to lookup in the dma_active_cacheline tree
567 * Place a call to this routine in cases where the cpu touching the page
568 * before the dma completes (page is dma_unmapped) will lead to data
571 void debug_dma_assert_idle(struct page *page)
573 static struct dma_debug_entry *ents[CACHELINES_PER_PAGE];
574 struct dma_debug_entry *entry = NULL;
575 void **results = (void **) &ents;
576 unsigned int nents, i;
580 if (dma_debug_disabled())
586 cln = (phys_addr_t) page_to_pfn(page) << CACHELINE_PER_PAGE_SHIFT;
587 spin_lock_irqsave(&radix_lock, flags);
588 nents = radix_tree_gang_lookup(&dma_active_cacheline, results, cln,
589 CACHELINES_PER_PAGE);
590 for (i = 0; i < nents; i++) {
591 phys_addr_t ent_cln = to_cacheline_number(ents[i]);
593 if (ent_cln == cln) {
596 } else if (ent_cln >= cln + CACHELINES_PER_PAGE)
599 spin_unlock_irqrestore(&radix_lock, flags);
604 cln = to_cacheline_number(entry);
605 err_printk(entry->dev, entry,
606 "DMA-API: cpu touching an active dma mapped cacheline [cln=%pa]\n",
611 * Wrapper function for adding an entry to the hash.
612 * This function takes care of locking itself.
614 static void add_dma_entry(struct dma_debug_entry *entry)
616 struct hash_bucket *bucket;
620 bucket = get_hash_bucket(entry, &flags);
621 hash_bucket_add(bucket, entry);
622 put_hash_bucket(bucket, &flags);
624 rc = active_cacheline_insert(entry);
626 pr_err("DMA-API: cacheline tracking ENOMEM, dma-debug disabled\n");
627 global_disable = true;
630 /* TODO: report -EEXIST errors here as overlapping mappings are
631 * not supported by the DMA API
635 static struct dma_debug_entry *__dma_entry_alloc(void)
637 struct dma_debug_entry *entry;
639 entry = list_entry(free_entries.next, struct dma_debug_entry, list);
640 list_del(&entry->list);
641 memset(entry, 0, sizeof(*entry));
643 num_free_entries -= 1;
644 if (num_free_entries < min_free_entries)
645 min_free_entries = num_free_entries;
650 /* struct dma_entry allocator
652 * The next two functions implement the allocator for
653 * struct dma_debug_entries.
655 static struct dma_debug_entry *dma_entry_alloc(void)
657 struct dma_debug_entry *entry;
660 spin_lock_irqsave(&free_entries_lock, flags);
662 if (list_empty(&free_entries)) {
663 global_disable = true;
664 spin_unlock_irqrestore(&free_entries_lock, flags);
665 pr_err("DMA-API: debugging out of memory - disabling\n");
669 entry = __dma_entry_alloc();
671 spin_unlock_irqrestore(&free_entries_lock, flags);
673 #ifdef CONFIG_STACKTRACE
674 entry->stacktrace.max_entries = DMA_DEBUG_STACKTRACE_ENTRIES;
675 entry->stacktrace.entries = entry->st_entries;
676 entry->stacktrace.skip = 2;
677 save_stack_trace(&entry->stacktrace);
683 static void dma_entry_free(struct dma_debug_entry *entry)
687 active_cacheline_remove(entry);
690 * add to beginning of the list - this way the entries are
691 * more likely cache hot when they are reallocated.
693 spin_lock_irqsave(&free_entries_lock, flags);
694 list_add(&entry->list, &free_entries);
695 num_free_entries += 1;
696 spin_unlock_irqrestore(&free_entries_lock, flags);
699 int dma_debug_resize_entries(u32 num_entries)
701 int i, delta, ret = 0;
703 struct dma_debug_entry *entry;
706 spin_lock_irqsave(&free_entries_lock, flags);
708 if (nr_total_entries < num_entries) {
709 delta = num_entries - nr_total_entries;
711 spin_unlock_irqrestore(&free_entries_lock, flags);
713 for (i = 0; i < delta; i++) {
714 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
718 list_add_tail(&entry->list, &tmp);
721 spin_lock_irqsave(&free_entries_lock, flags);
723 list_splice(&tmp, &free_entries);
724 nr_total_entries += i;
725 num_free_entries += i;
727 delta = nr_total_entries - num_entries;
729 for (i = 0; i < delta && !list_empty(&free_entries); i++) {
730 entry = __dma_entry_alloc();
734 nr_total_entries -= i;
737 if (nr_total_entries != num_entries)
740 spin_unlock_irqrestore(&free_entries_lock, flags);
744 EXPORT_SYMBOL(dma_debug_resize_entries);
747 * DMA-API debugging init code
749 * The init code does two things:
750 * 1. Initialize core data structures
751 * 2. Preallocate a given number of dma_debug_entry structs
754 static int prealloc_memory(u32 num_entries)
756 struct dma_debug_entry *entry, *next_entry;
759 for (i = 0; i < num_entries; ++i) {
760 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
764 list_add_tail(&entry->list, &free_entries);
767 num_free_entries = num_entries;
768 min_free_entries = num_entries;
770 pr_info("DMA-API: preallocated %d debug entries\n", num_entries);
776 list_for_each_entry_safe(entry, next_entry, &free_entries, list) {
777 list_del(&entry->list);
784 static ssize_t filter_read(struct file *file, char __user *user_buf,
785 size_t count, loff_t *ppos)
787 char buf[NAME_MAX_LEN + 1];
791 if (!current_driver_name[0])
795 * We can't copy to userspace directly because current_driver_name can
796 * only be read under the driver_name_lock with irqs disabled. So
797 * create a temporary copy first.
799 read_lock_irqsave(&driver_name_lock, flags);
800 len = scnprintf(buf, NAME_MAX_LEN + 1, "%s\n", current_driver_name);
801 read_unlock_irqrestore(&driver_name_lock, flags);
803 return simple_read_from_buffer(user_buf, count, ppos, buf, len);
806 static ssize_t filter_write(struct file *file, const char __user *userbuf,
807 size_t count, loff_t *ppos)
809 char buf[NAME_MAX_LEN];
815 * We can't copy from userspace directly. Access to
816 * current_driver_name is protected with a write_lock with irqs
817 * disabled. Since copy_from_user can fault and may sleep we
818 * need to copy to temporary buffer first
820 len = min(count, (size_t)(NAME_MAX_LEN - 1));
821 if (copy_from_user(buf, userbuf, len))
826 write_lock_irqsave(&driver_name_lock, flags);
829 * Now handle the string we got from userspace very carefully.
831 * - only use the first token we got
832 * - token delimiter is everything looking like a space
833 * character (' ', '\n', '\t' ...)
836 if (!isalnum(buf[0])) {
838 * If the first character userspace gave us is not
839 * alphanumerical then assume the filter should be
842 if (current_driver_name[0])
843 pr_info("DMA-API: switching off dma-debug driver filter\n");
844 current_driver_name[0] = 0;
845 current_driver = NULL;
850 * Now parse out the first token and use it as the name for the
851 * driver to filter for.
853 for (i = 0; i < NAME_MAX_LEN - 1; ++i) {
854 current_driver_name[i] = buf[i];
855 if (isspace(buf[i]) || buf[i] == ' ' || buf[i] == 0)
858 current_driver_name[i] = 0;
859 current_driver = NULL;
861 pr_info("DMA-API: enable driver filter for driver [%s]\n",
862 current_driver_name);
865 write_unlock_irqrestore(&driver_name_lock, flags);
870 static const struct file_operations filter_fops = {
872 .write = filter_write,
873 .llseek = default_llseek,
876 static int dma_debug_fs_init(void)
878 dma_debug_dent = debugfs_create_dir("dma-api", NULL);
879 if (!dma_debug_dent) {
880 pr_err("DMA-API: can not create debugfs directory\n");
884 global_disable_dent = debugfs_create_bool("disabled", 0444,
887 if (!global_disable_dent)
890 error_count_dent = debugfs_create_u32("error_count", 0444,
891 dma_debug_dent, &error_count);
892 if (!error_count_dent)
895 show_all_errors_dent = debugfs_create_u32("all_errors", 0644,
898 if (!show_all_errors_dent)
901 show_num_errors_dent = debugfs_create_u32("num_errors", 0644,
904 if (!show_num_errors_dent)
907 num_free_entries_dent = debugfs_create_u32("num_free_entries", 0444,
910 if (!num_free_entries_dent)
913 min_free_entries_dent = debugfs_create_u32("min_free_entries", 0444,
916 if (!min_free_entries_dent)
919 filter_dent = debugfs_create_file("driver_filter", 0644,
920 dma_debug_dent, NULL, &filter_fops);
927 debugfs_remove_recursive(dma_debug_dent);
932 static int device_dma_allocations(struct device *dev, struct dma_debug_entry **out_entry)
934 struct dma_debug_entry *entry;
938 local_irq_save(flags);
940 for (i = 0; i < HASH_SIZE; ++i) {
941 spin_lock(&dma_entry_hash[i].lock);
942 list_for_each_entry(entry, &dma_entry_hash[i].list, list) {
943 if (entry->dev == dev) {
948 spin_unlock(&dma_entry_hash[i].lock);
951 local_irq_restore(flags);
956 static int dma_debug_device_change(struct notifier_block *nb, unsigned long action, void *data)
958 struct device *dev = data;
959 struct dma_debug_entry *uninitialized_var(entry);
962 if (dma_debug_disabled())
966 case BUS_NOTIFY_UNBOUND_DRIVER:
967 count = device_dma_allocations(dev, &entry);
970 err_printk(dev, entry, "DMA-API: device driver has pending "
971 "DMA allocations while released from device "
973 "One of leaked entries details: "
974 "[device address=0x%016llx] [size=%llu bytes] "
975 "[mapped with %s] [mapped as %s]\n",
976 count, entry->dev_addr, entry->size,
977 dir2name[entry->direction], type2name[entry->type]);
986 void dma_debug_add_bus(struct bus_type *bus)
988 struct notifier_block *nb;
990 if (dma_debug_disabled())
993 nb = kzalloc(sizeof(struct notifier_block), GFP_KERNEL);
995 pr_err("dma_debug_add_bus: out of memory\n");
999 nb->notifier_call = dma_debug_device_change;
1001 bus_register_notifier(bus, nb);
1005 * Let the architectures decide how many entries should be preallocated.
1007 void dma_debug_init(u32 num_entries)
1011 /* Do not use dma_debug_initialized here, since we really want to be
1012 * called to set dma_debug_initialized
1017 for (i = 0; i < HASH_SIZE; ++i) {
1018 INIT_LIST_HEAD(&dma_entry_hash[i].list);
1019 spin_lock_init(&dma_entry_hash[i].lock);
1022 if (dma_debug_fs_init() != 0) {
1023 pr_err("DMA-API: error creating debugfs entries - disabling\n");
1024 global_disable = true;
1030 num_entries = req_entries;
1032 if (prealloc_memory(num_entries) != 0) {
1033 pr_err("DMA-API: debugging out of memory error - disabled\n");
1034 global_disable = true;
1039 nr_total_entries = num_free_entries;
1041 dma_debug_initialized = true;
1043 pr_info("DMA-API: debugging enabled by kernel config\n");
1046 static __init int dma_debug_cmdline(char *str)
1051 if (strncmp(str, "off", 3) == 0) {
1052 pr_info("DMA-API: debugging disabled on kernel command line\n");
1053 global_disable = true;
1059 static __init int dma_debug_entries_cmdline(char *str)
1066 res = get_option(&str, &req_entries);
1074 __setup("dma_debug=", dma_debug_cmdline);
1075 __setup("dma_debug_entries=", dma_debug_entries_cmdline);
1077 static void check_unmap(struct dma_debug_entry *ref)
1079 struct dma_debug_entry *entry;
1080 struct hash_bucket *bucket;
1081 unsigned long flags;
1083 bucket = get_hash_bucket(ref, &flags);
1084 entry = bucket_find_exact(bucket, ref);
1087 /* must drop lock before calling dma_mapping_error */
1088 put_hash_bucket(bucket, &flags);
1090 if (dma_mapping_error(ref->dev, ref->dev_addr)) {
1091 err_printk(ref->dev, NULL,
1092 "DMA-API: device driver tries to free an "
1093 "invalid DMA memory address\n");
1095 err_printk(ref->dev, NULL,
1096 "DMA-API: device driver tries to free DMA "
1097 "memory it has not allocated [device "
1098 "address=0x%016llx] [size=%llu bytes]\n",
1099 ref->dev_addr, ref->size);
1104 if (ref->size != entry->size) {
1105 err_printk(ref->dev, entry, "DMA-API: device driver frees "
1106 "DMA memory with different size "
1107 "[device address=0x%016llx] [map size=%llu bytes] "
1108 "[unmap size=%llu bytes]\n",
1109 ref->dev_addr, entry->size, ref->size);
1112 if (ref->type != entry->type) {
1113 err_printk(ref->dev, entry, "DMA-API: device driver frees "
1114 "DMA memory with wrong function "
1115 "[device address=0x%016llx] [size=%llu bytes] "
1116 "[mapped as %s] [unmapped as %s]\n",
1117 ref->dev_addr, ref->size,
1118 type2name[entry->type], type2name[ref->type]);
1119 } else if ((entry->type == dma_debug_coherent) &&
1120 (phys_addr(ref) != phys_addr(entry))) {
1121 err_printk(ref->dev, entry, "DMA-API: device driver frees "
1122 "DMA memory with different CPU address "
1123 "[device address=0x%016llx] [size=%llu bytes] "
1124 "[cpu alloc address=0x%016llx] "
1125 "[cpu free address=0x%016llx]",
1126 ref->dev_addr, ref->size,
1131 if (ref->sg_call_ents && ref->type == dma_debug_sg &&
1132 ref->sg_call_ents != entry->sg_call_ents) {
1133 err_printk(ref->dev, entry, "DMA-API: device driver frees "
1134 "DMA sg list with different entry count "
1135 "[map count=%d] [unmap count=%d]\n",
1136 entry->sg_call_ents, ref->sg_call_ents);
1140 * This may be no bug in reality - but most implementations of the
1141 * DMA API don't handle this properly, so check for it here
1143 if (ref->direction != entry->direction) {
1144 err_printk(ref->dev, entry, "DMA-API: device driver frees "
1145 "DMA memory with different direction "
1146 "[device address=0x%016llx] [size=%llu bytes] "
1147 "[mapped with %s] [unmapped with %s]\n",
1148 ref->dev_addr, ref->size,
1149 dir2name[entry->direction],
1150 dir2name[ref->direction]);
1153 if (entry->map_err_type == MAP_ERR_NOT_CHECKED) {
1154 err_printk(ref->dev, entry,
1155 "DMA-API: device driver failed to check map error"
1156 "[device address=0x%016llx] [size=%llu bytes] "
1158 ref->dev_addr, ref->size,
1159 type2name[entry->type]);
1162 hash_bucket_del(entry);
1163 dma_entry_free(entry);
1165 put_hash_bucket(bucket, &flags);
1168 static void check_for_stack(struct device *dev,
1169 struct page *page, size_t offset)
1172 struct vm_struct *stack_vm_area = task_stack_vm_area(current);
1174 if (!stack_vm_area) {
1175 /* Stack is direct-mapped. */
1176 if (PageHighMem(page))
1178 addr = page_address(page) + offset;
1179 if (object_is_on_stack(addr))
1180 err_printk(dev, NULL, "DMA-API: device driver maps memory from stack [addr=%p]\n", addr);
1182 /* Stack is vmalloced. */
1185 for (i = 0; i < stack_vm_area->nr_pages; i++) {
1186 if (page != stack_vm_area->pages[i])
1189 addr = (u8 *)current->stack + i * PAGE_SIZE + offset;
1190 err_printk(dev, NULL, "DMA-API: device driver maps memory from stack [probable addr=%p]\n", addr);
1196 static inline bool overlap(void *addr, unsigned long len, void *start, void *end)
1198 unsigned long a1 = (unsigned long)addr;
1199 unsigned long b1 = a1 + len;
1200 unsigned long a2 = (unsigned long)start;
1201 unsigned long b2 = (unsigned long)end;
1203 return !(b1 <= a2 || a1 >= b2);
1206 static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len)
1208 if (overlap(addr, len, _stext, _etext) ||
1209 overlap(addr, len, __start_rodata, __end_rodata))
1210 err_printk(dev, NULL, "DMA-API: device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len);
1213 static void check_sync(struct device *dev,
1214 struct dma_debug_entry *ref,
1217 struct dma_debug_entry *entry;
1218 struct hash_bucket *bucket;
1219 unsigned long flags;
1221 bucket = get_hash_bucket(ref, &flags);
1223 entry = bucket_find_contain(&bucket, ref, &flags);
1226 err_printk(dev, NULL, "DMA-API: device driver tries "
1227 "to sync DMA memory it has not allocated "
1228 "[device address=0x%016llx] [size=%llu bytes]\n",
1229 (unsigned long long)ref->dev_addr, ref->size);
1233 if (ref->size > entry->size) {
1234 err_printk(dev, entry, "DMA-API: device driver syncs"
1235 " DMA memory outside allocated range "
1236 "[device address=0x%016llx] "
1237 "[allocation size=%llu bytes] "
1238 "[sync offset+size=%llu]\n",
1239 entry->dev_addr, entry->size,
1243 if (entry->direction == DMA_BIDIRECTIONAL)
1246 if (ref->direction != entry->direction) {
1247 err_printk(dev, entry, "DMA-API: device driver syncs "
1248 "DMA memory with different direction "
1249 "[device address=0x%016llx] [size=%llu bytes] "
1250 "[mapped with %s] [synced with %s]\n",
1251 (unsigned long long)ref->dev_addr, entry->size,
1252 dir2name[entry->direction],
1253 dir2name[ref->direction]);
1256 if (to_cpu && !(entry->direction == DMA_FROM_DEVICE) &&
1257 !(ref->direction == DMA_TO_DEVICE))
1258 err_printk(dev, entry, "DMA-API: device driver syncs "
1259 "device read-only DMA memory for cpu "
1260 "[device address=0x%016llx] [size=%llu bytes] "
1261 "[mapped with %s] [synced with %s]\n",
1262 (unsigned long long)ref->dev_addr, entry->size,
1263 dir2name[entry->direction],
1264 dir2name[ref->direction]);
1266 if (!to_cpu && !(entry->direction == DMA_TO_DEVICE) &&
1267 !(ref->direction == DMA_FROM_DEVICE))
1268 err_printk(dev, entry, "DMA-API: device driver syncs "
1269 "device write-only DMA memory to device "
1270 "[device address=0x%016llx] [size=%llu bytes] "
1271 "[mapped with %s] [synced with %s]\n",
1272 (unsigned long long)ref->dev_addr, entry->size,
1273 dir2name[entry->direction],
1274 dir2name[ref->direction]);
1276 if (ref->sg_call_ents && ref->type == dma_debug_sg &&
1277 ref->sg_call_ents != entry->sg_call_ents) {
1278 err_printk(ref->dev, entry, "DMA-API: device driver syncs "
1279 "DMA sg list with different entry count "
1280 "[map count=%d] [sync count=%d]\n",
1281 entry->sg_call_ents, ref->sg_call_ents);
1285 put_hash_bucket(bucket, &flags);
1288 void debug_dma_map_page(struct device *dev, struct page *page, size_t offset,
1289 size_t size, int direction, dma_addr_t dma_addr,
1292 struct dma_debug_entry *entry;
1294 if (unlikely(dma_debug_disabled()))
1297 if (dma_mapping_error(dev, dma_addr))
1300 entry = dma_entry_alloc();
1305 entry->type = dma_debug_page;
1306 entry->pfn = page_to_pfn(page);
1307 entry->offset = offset,
1308 entry->dev_addr = dma_addr;
1310 entry->direction = direction;
1311 entry->map_err_type = MAP_ERR_NOT_CHECKED;
1314 entry->type = dma_debug_single;
1316 check_for_stack(dev, page, offset);
1318 if (!PageHighMem(page)) {
1319 void *addr = page_address(page) + offset;
1321 check_for_illegal_area(dev, addr, size);
1324 add_dma_entry(entry);
1326 EXPORT_SYMBOL(debug_dma_map_page);
1328 void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
1330 struct dma_debug_entry ref;
1331 struct dma_debug_entry *entry;
1332 struct hash_bucket *bucket;
1333 unsigned long flags;
1335 if (unlikely(dma_debug_disabled()))
1339 ref.dev_addr = dma_addr;
1340 bucket = get_hash_bucket(&ref, &flags);
1342 list_for_each_entry(entry, &bucket->list, list) {
1343 if (!exact_match(&ref, entry))
1347 * The same physical address can be mapped multiple
1348 * times. Without a hardware IOMMU this results in the
1349 * same device addresses being put into the dma-debug
1350 * hash multiple times too. This can result in false
1351 * positives being reported. Therefore we implement a
1352 * best-fit algorithm here which updates the first entry
1353 * from the hash which fits the reference value and is
1354 * not currently listed as being checked.
1356 if (entry->map_err_type == MAP_ERR_NOT_CHECKED) {
1357 entry->map_err_type = MAP_ERR_CHECKED;
1362 put_hash_bucket(bucket, &flags);
1364 EXPORT_SYMBOL(debug_dma_mapping_error);
1366 void debug_dma_unmap_page(struct device *dev, dma_addr_t addr,
1367 size_t size, int direction, bool map_single)
1369 struct dma_debug_entry ref = {
1370 .type = dma_debug_page,
1374 .direction = direction,
1377 if (unlikely(dma_debug_disabled()))
1381 ref.type = dma_debug_single;
1385 EXPORT_SYMBOL(debug_dma_unmap_page);
1387 void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
1388 int nents, int mapped_ents, int direction)
1390 struct dma_debug_entry *entry;
1391 struct scatterlist *s;
1394 if (unlikely(dma_debug_disabled()))
1397 for_each_sg(sg, s, mapped_ents, i) {
1398 entry = dma_entry_alloc();
1402 entry->type = dma_debug_sg;
1404 entry->pfn = page_to_pfn(sg_page(s));
1405 entry->offset = s->offset,
1406 entry->size = sg_dma_len(s);
1407 entry->dev_addr = sg_dma_address(s);
1408 entry->direction = direction;
1409 entry->sg_call_ents = nents;
1410 entry->sg_mapped_ents = mapped_ents;
1412 check_for_stack(dev, sg_page(s), s->offset);
1414 if (!PageHighMem(sg_page(s))) {
1415 check_for_illegal_area(dev, sg_virt(s), sg_dma_len(s));
1418 add_dma_entry(entry);
1421 EXPORT_SYMBOL(debug_dma_map_sg);
1423 static int get_nr_mapped_entries(struct device *dev,
1424 struct dma_debug_entry *ref)
1426 struct dma_debug_entry *entry;
1427 struct hash_bucket *bucket;
1428 unsigned long flags;
1431 bucket = get_hash_bucket(ref, &flags);
1432 entry = bucket_find_exact(bucket, ref);
1436 mapped_ents = entry->sg_mapped_ents;
1437 put_hash_bucket(bucket, &flags);
1442 void debug_dma_unmap_sg(struct device *dev, struct scatterlist *sglist,
1443 int nelems, int dir)
1445 struct scatterlist *s;
1446 int mapped_ents = 0, i;
1448 if (unlikely(dma_debug_disabled()))
1451 for_each_sg(sglist, s, nelems, i) {
1453 struct dma_debug_entry ref = {
1454 .type = dma_debug_sg,
1456 .pfn = page_to_pfn(sg_page(s)),
1457 .offset = s->offset,
1458 .dev_addr = sg_dma_address(s),
1459 .size = sg_dma_len(s),
1461 .sg_call_ents = nelems,
1464 if (mapped_ents && i >= mapped_ents)
1468 mapped_ents = get_nr_mapped_entries(dev, &ref);
1473 EXPORT_SYMBOL(debug_dma_unmap_sg);
1475 void debug_dma_alloc_coherent(struct device *dev, size_t size,
1476 dma_addr_t dma_addr, void *virt)
1478 struct dma_debug_entry *entry;
1480 if (unlikely(dma_debug_disabled()))
1483 if (unlikely(virt == NULL))
1486 entry = dma_entry_alloc();
1490 entry->type = dma_debug_coherent;
1492 entry->pfn = page_to_pfn(virt_to_page(virt));
1493 entry->offset = (size_t) virt & ~PAGE_MASK;
1495 entry->dev_addr = dma_addr;
1496 entry->direction = DMA_BIDIRECTIONAL;
1498 add_dma_entry(entry);
1500 EXPORT_SYMBOL(debug_dma_alloc_coherent);
1502 void debug_dma_free_coherent(struct device *dev, size_t size,
1503 void *virt, dma_addr_t addr)
1505 struct dma_debug_entry ref = {
1506 .type = dma_debug_coherent,
1508 .pfn = page_to_pfn(virt_to_page(virt)),
1509 .offset = (size_t) virt & ~PAGE_MASK,
1512 .direction = DMA_BIDIRECTIONAL,
1515 if (unlikely(dma_debug_disabled()))
1520 EXPORT_SYMBOL(debug_dma_free_coherent);
1522 void debug_dma_sync_single_for_cpu(struct device *dev, dma_addr_t dma_handle,
1523 size_t size, int direction)
1525 struct dma_debug_entry ref;
1527 if (unlikely(dma_debug_disabled()))
1530 ref.type = dma_debug_single;
1532 ref.dev_addr = dma_handle;
1534 ref.direction = direction;
1535 ref.sg_call_ents = 0;
1537 check_sync(dev, &ref, true);
1539 EXPORT_SYMBOL(debug_dma_sync_single_for_cpu);
1541 void debug_dma_sync_single_for_device(struct device *dev,
1542 dma_addr_t dma_handle, size_t size,
1545 struct dma_debug_entry ref;
1547 if (unlikely(dma_debug_disabled()))
1550 ref.type = dma_debug_single;
1552 ref.dev_addr = dma_handle;
1554 ref.direction = direction;
1555 ref.sg_call_ents = 0;
1557 check_sync(dev, &ref, false);
1559 EXPORT_SYMBOL(debug_dma_sync_single_for_device);
1561 void debug_dma_sync_single_range_for_cpu(struct device *dev,
1562 dma_addr_t dma_handle,
1563 unsigned long offset, size_t size,
1566 struct dma_debug_entry ref;
1568 if (unlikely(dma_debug_disabled()))
1571 ref.type = dma_debug_single;
1573 ref.dev_addr = dma_handle;
1574 ref.size = offset + size;
1575 ref.direction = direction;
1576 ref.sg_call_ents = 0;
1578 check_sync(dev, &ref, true);
1580 EXPORT_SYMBOL(debug_dma_sync_single_range_for_cpu);
1582 void debug_dma_sync_single_range_for_device(struct device *dev,
1583 dma_addr_t dma_handle,
1584 unsigned long offset,
1585 size_t size, int direction)
1587 struct dma_debug_entry ref;
1589 if (unlikely(dma_debug_disabled()))
1592 ref.type = dma_debug_single;
1594 ref.dev_addr = dma_handle;
1595 ref.size = offset + size;
1596 ref.direction = direction;
1597 ref.sg_call_ents = 0;
1599 check_sync(dev, &ref, false);
1601 EXPORT_SYMBOL(debug_dma_sync_single_range_for_device);
1603 void debug_dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
1604 int nelems, int direction)
1606 struct scatterlist *s;
1607 int mapped_ents = 0, i;
1609 if (unlikely(dma_debug_disabled()))
1612 for_each_sg(sg, s, nelems, i) {
1614 struct dma_debug_entry ref = {
1615 .type = dma_debug_sg,
1617 .pfn = page_to_pfn(sg_page(s)),
1618 .offset = s->offset,
1619 .dev_addr = sg_dma_address(s),
1620 .size = sg_dma_len(s),
1621 .direction = direction,
1622 .sg_call_ents = nelems,
1626 mapped_ents = get_nr_mapped_entries(dev, &ref);
1628 if (i >= mapped_ents)
1631 check_sync(dev, &ref, true);
1634 EXPORT_SYMBOL(debug_dma_sync_sg_for_cpu);
1636 void debug_dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
1637 int nelems, int direction)
1639 struct scatterlist *s;
1640 int mapped_ents = 0, i;
1642 if (unlikely(dma_debug_disabled()))
1645 for_each_sg(sg, s, nelems, i) {
1647 struct dma_debug_entry ref = {
1648 .type = dma_debug_sg,
1650 .pfn = page_to_pfn(sg_page(s)),
1651 .offset = s->offset,
1652 .dev_addr = sg_dma_address(s),
1653 .size = sg_dma_len(s),
1654 .direction = direction,
1655 .sg_call_ents = nelems,
1658 mapped_ents = get_nr_mapped_entries(dev, &ref);
1660 if (i >= mapped_ents)
1663 check_sync(dev, &ref, false);
1666 EXPORT_SYMBOL(debug_dma_sync_sg_for_device);
1668 static int __init dma_debug_driver_setup(char *str)
1672 for (i = 0; i < NAME_MAX_LEN - 1; ++i, ++str) {
1673 current_driver_name[i] = *str;
1678 if (current_driver_name[0])
1679 pr_info("DMA-API: enable driver filter for driver [%s]\n",
1680 current_driver_name);
1685 __setup("dma_debug_driver=", dma_debug_driver_setup);