2 * Copyright (C) 2008 Advanced Micro Devices, Inc.
4 * Author: Joerg Roedel <joerg.roedel@amd.com>
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License version 2 as published
8 * by the Free Software Foundation.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
20 #include <linux/scatterlist.h>
21 #include <linux/dma-mapping.h>
22 #include <linux/stacktrace.h>
23 #include <linux/dma-debug.h>
24 #include <linux/spinlock.h>
25 #include <linux/debugfs.h>
26 #include <linux/uaccess.h>
27 #include <linux/export.h>
28 #include <linux/device.h>
29 #include <linux/types.h>
30 #include <linux/sched.h>
31 #include <linux/ctype.h>
32 #include <linux/list.h>
33 #include <linux/slab.h>
35 #include <asm/sections.h>
37 #define HASH_SIZE 1024ULL
38 #define HASH_FN_SHIFT 13
39 #define HASH_FN_MASK (HASH_SIZE - 1)
50 MAP_ERR_CHECK_NOT_APPLICABLE,
55 #define DMA_DEBUG_STACKTRACE_ENTRIES 5
58 * struct dma_debug_entry - track a dma_map* or dma_alloc_coherent mapping
59 * @list: node on pre-allocated free_entries list
60 * @dev: 'dev' argument to dma_map_{page|single|sg} or dma_alloc_coherent
61 * @type: single, page, sg, coherent
62 * @pfn: page frame of the start address
63 * @offset: offset of mapping relative to pfn
64 * @size: length of the mapping
65 * @direction: enum dma_data_direction
66 * @sg_call_ents: 'nents' from dma_map_sg
67 * @sg_mapped_ents: 'mapped_ents' from dma_map_sg
68 * @map_err_type: track whether dma_mapping_error() was checked
69 * @stacktrace: support backtraces when a violation is detected
71 struct dma_debug_entry {
72 struct list_head list;
82 enum map_err_types map_err_type;
83 #ifdef CONFIG_STACKTRACE
84 struct stack_trace stacktrace;
85 unsigned long st_entries[DMA_DEBUG_STACKTRACE_ENTRIES];
89 typedef bool (*match_fn)(struct dma_debug_entry *, struct dma_debug_entry *);
92 struct list_head list;
94 } ____cacheline_aligned_in_smp;
96 /* Hash list to save the allocated dma addresses */
97 static struct hash_bucket dma_entry_hash[HASH_SIZE];
98 /* List of pre-allocated dma_debug_entry's */
99 static LIST_HEAD(free_entries);
100 /* Lock for the list above */
101 static DEFINE_SPINLOCK(free_entries_lock);
103 /* Global disable flag - will be set in case of an error */
104 static bool global_disable __read_mostly;
106 /* Early initialization disable flag, set at the end of dma_debug_init */
107 static bool dma_debug_initialized __read_mostly;
109 static inline bool dma_debug_disabled(void)
111 return global_disable || !dma_debug_initialized;
114 /* Global error count */
115 static u32 error_count;
117 /* Global error show enable*/
118 static u32 show_all_errors __read_mostly;
119 /* Number of errors to show */
120 static u32 show_num_errors = 1;
122 static u32 num_free_entries;
123 static u32 min_free_entries;
124 static u32 nr_total_entries;
126 /* number of preallocated entries requested by kernel cmdline */
127 static u32 req_entries;
129 /* debugfs dentry's for the stuff above */
130 static struct dentry *dma_debug_dent __read_mostly;
131 static struct dentry *global_disable_dent __read_mostly;
132 static struct dentry *error_count_dent __read_mostly;
133 static struct dentry *show_all_errors_dent __read_mostly;
134 static struct dentry *show_num_errors_dent __read_mostly;
135 static struct dentry *num_free_entries_dent __read_mostly;
136 static struct dentry *min_free_entries_dent __read_mostly;
137 static struct dentry *filter_dent __read_mostly;
139 /* per-driver filter related state */
141 #define NAME_MAX_LEN 64
143 static char current_driver_name[NAME_MAX_LEN] __read_mostly;
144 static struct device_driver *current_driver __read_mostly;
146 static DEFINE_RWLOCK(driver_name_lock);
148 static const char *const maperr2str[] = {
149 [MAP_ERR_CHECK_NOT_APPLICABLE] = "dma map error check not applicable",
150 [MAP_ERR_NOT_CHECKED] = "dma map error not checked",
151 [MAP_ERR_CHECKED] = "dma map error checked",
154 static const char *type2name[5] = { "single", "page",
155 "scather-gather", "coherent",
158 static const char *dir2name[4] = { "DMA_BIDIRECTIONAL", "DMA_TO_DEVICE",
159 "DMA_FROM_DEVICE", "DMA_NONE" };
162 * The access to some variables in this macro is racy. We can't use atomic_t
163 * here because all these variables are exported to debugfs. Some of them even
164 * writeable. This is also the reason why a lock won't help much. But anyway,
165 * the races are no big deal. Here is why:
167 * error_count: the addition is racy, but the worst thing that can happen is
168 * that we don't count some errors
169 * show_num_errors: the subtraction is racy. Also no big deal because in
170 * worst case this will result in one warning more in the
171 * system log than the user configured. This variable is
172 * writeable via debugfs.
174 static inline void dump_entry_trace(struct dma_debug_entry *entry)
176 #ifdef CONFIG_STACKTRACE
178 pr_warning("Mapped at:\n");
179 print_stack_trace(&entry->stacktrace, 0);
184 static bool driver_filter(struct device *dev)
186 struct device_driver *drv;
190 /* driver filter off */
191 if (likely(!current_driver_name[0]))
194 /* driver filter on and initialized */
195 if (current_driver && dev && dev->driver == current_driver)
198 /* driver filter on, but we can't filter on a NULL device... */
202 if (current_driver || !current_driver_name[0])
205 /* driver filter on but not yet initialized */
210 /* lock to protect against change of current_driver_name */
211 read_lock_irqsave(&driver_name_lock, flags);
215 strncmp(current_driver_name, drv->name, NAME_MAX_LEN - 1) == 0) {
216 current_driver = drv;
220 read_unlock_irqrestore(&driver_name_lock, flags);
225 #define err_printk(dev, entry, format, arg...) do { \
227 if (driver_filter(dev) && \
228 (show_all_errors || show_num_errors > 0)) { \
229 WARN(1, "%s %s: " format, \
230 dev ? dev_driver_string(dev) : "NULL", \
231 dev ? dev_name(dev) : "NULL", ## arg); \
232 dump_entry_trace(entry); \
234 if (!show_all_errors && show_num_errors > 0) \
235 show_num_errors -= 1; \
239 * Hash related functions
241 * Every DMA-API request is saved into a struct dma_debug_entry. To
242 * have quick access to these structs they are stored into a hash.
244 static int hash_fn(struct dma_debug_entry *entry)
247 * Hash function is based on the dma address.
248 * We use bits 20-27 here as the index into the hash
250 return (entry->dev_addr >> HASH_FN_SHIFT) & HASH_FN_MASK;
254 * Request exclusive access to a hash bucket for a given dma_debug_entry.
256 static struct hash_bucket *get_hash_bucket(struct dma_debug_entry *entry,
257 unsigned long *flags)
258 __acquires(&dma_entry_hash[idx].lock)
260 int idx = hash_fn(entry);
261 unsigned long __flags;
263 spin_lock_irqsave(&dma_entry_hash[idx].lock, __flags);
265 return &dma_entry_hash[idx];
269 * Give up exclusive access to the hash bucket
271 static void put_hash_bucket(struct hash_bucket *bucket,
272 unsigned long *flags)
273 __releases(&bucket->lock)
275 unsigned long __flags = *flags;
277 spin_unlock_irqrestore(&bucket->lock, __flags);
280 static bool exact_match(struct dma_debug_entry *a, struct dma_debug_entry *b)
282 return ((a->dev_addr == b->dev_addr) &&
283 (a->dev == b->dev)) ? true : false;
286 static bool containing_match(struct dma_debug_entry *a,
287 struct dma_debug_entry *b)
289 if (a->dev != b->dev)
292 if ((b->dev_addr <= a->dev_addr) &&
293 ((b->dev_addr + b->size) >= (a->dev_addr + a->size)))
300 * Search a given entry in the hash bucket list
302 static struct dma_debug_entry *__hash_bucket_find(struct hash_bucket *bucket,
303 struct dma_debug_entry *ref,
306 struct dma_debug_entry *entry, *ret = NULL;
307 int matches = 0, match_lvl, last_lvl = -1;
309 list_for_each_entry(entry, &bucket->list, list) {
310 if (!match(ref, entry))
314 * Some drivers map the same physical address multiple
315 * times. Without a hardware IOMMU this results in the
316 * same device addresses being put into the dma-debug
317 * hash multiple times too. This can result in false
318 * positives being reported. Therefore we implement a
319 * best-fit algorithm here which returns the entry from
320 * the hash which fits best to the reference value
321 * instead of the first-fit.
325 entry->size == ref->size ? ++match_lvl : 0;
326 entry->type == ref->type ? ++match_lvl : 0;
327 entry->direction == ref->direction ? ++match_lvl : 0;
328 entry->sg_call_ents == ref->sg_call_ents ? ++match_lvl : 0;
330 if (match_lvl == 4) {
331 /* perfect-fit - return the result */
333 } else if (match_lvl > last_lvl) {
335 * We found an entry that fits better then the
336 * previous one or it is the 1st match.
338 last_lvl = match_lvl;
344 * If we have multiple matches but no perfect-fit, just return
347 ret = (matches == 1) ? ret : NULL;
352 static struct dma_debug_entry *bucket_find_exact(struct hash_bucket *bucket,
353 struct dma_debug_entry *ref)
355 return __hash_bucket_find(bucket, ref, exact_match);
358 static struct dma_debug_entry *bucket_find_contain(struct hash_bucket **bucket,
359 struct dma_debug_entry *ref,
360 unsigned long *flags)
363 unsigned int max_range = dma_get_max_seg_size(ref->dev);
364 struct dma_debug_entry *entry, index = *ref;
365 unsigned int range = 0;
367 while (range <= max_range) {
368 entry = __hash_bucket_find(*bucket, ref, containing_match);
374 * Nothing found, go back a hash bucket
376 put_hash_bucket(*bucket, flags);
377 range += (1 << HASH_FN_SHIFT);
378 index.dev_addr -= (1 << HASH_FN_SHIFT);
379 *bucket = get_hash_bucket(&index, flags);
386 * Add an entry to a hash bucket
388 static void hash_bucket_add(struct hash_bucket *bucket,
389 struct dma_debug_entry *entry)
391 list_add_tail(&entry->list, &bucket->list);
395 * Remove entry from a hash bucket list
397 static void hash_bucket_del(struct dma_debug_entry *entry)
399 list_del(&entry->list);
402 static unsigned long long phys_addr(struct dma_debug_entry *entry)
404 if (entry->type == dma_debug_resource)
405 return __pfn_to_phys(entry->pfn) + entry->offset;
407 return page_to_phys(pfn_to_page(entry->pfn)) + entry->offset;
411 * Dump mapping entries for debugging purposes
413 void debug_dma_dump_mappings(struct device *dev)
417 for (idx = 0; idx < HASH_SIZE; idx++) {
418 struct hash_bucket *bucket = &dma_entry_hash[idx];
419 struct dma_debug_entry *entry;
422 spin_lock_irqsave(&bucket->lock, flags);
424 list_for_each_entry(entry, &bucket->list, list) {
425 if (!dev || dev == entry->dev) {
427 "%s idx %d P=%Lx N=%lx D=%Lx L=%Lx %s %s\n",
428 type2name[entry->type], idx,
429 phys_addr(entry), entry->pfn,
430 entry->dev_addr, entry->size,
431 dir2name[entry->direction],
432 maperr2str[entry->map_err_type]);
436 spin_unlock_irqrestore(&bucket->lock, flags);
439 EXPORT_SYMBOL(debug_dma_dump_mappings);
442 * For each mapping (initial cacheline in the case of
443 * dma_alloc_coherent/dma_map_page, initial cacheline in each page of a
444 * scatterlist, or the cacheline specified in dma_map_single) insert
445 * into this tree using the cacheline as the key. At
446 * dma_unmap_{single|sg|page} or dma_free_coherent delete the entry. If
447 * the entry already exists at insertion time add a tag as a reference
448 * count for the overlapping mappings. For now, the overlap tracking
449 * just ensures that 'unmaps' balance 'maps' before marking the
450 * cacheline idle, but we should also be flagging overlaps as an API
453 * Memory usage is mostly constrained by the maximum number of available
454 * dma-debug entries in that we need a free dma_debug_entry before
455 * inserting into the tree. In the case of dma_map_page and
456 * dma_alloc_coherent there is only one dma_debug_entry and one
457 * dma_active_cacheline entry to track per event. dma_map_sg(), on the
458 * other hand, consumes a single dma_debug_entry, but inserts 'nents'
459 * entries into the tree.
461 * At any time debug_dma_assert_idle() can be called to trigger a
462 * warning if any cachelines in the given page are in the active set.
464 static RADIX_TREE(dma_active_cacheline, GFP_NOWAIT);
465 static DEFINE_SPINLOCK(radix_lock);
466 #define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1)
467 #define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT)
468 #define CACHELINES_PER_PAGE (1 << CACHELINE_PER_PAGE_SHIFT)
470 static phys_addr_t to_cacheline_number(struct dma_debug_entry *entry)
472 return (entry->pfn << CACHELINE_PER_PAGE_SHIFT) +
473 (entry->offset >> L1_CACHE_SHIFT);
476 static int active_cacheline_read_overlap(phys_addr_t cln)
480 for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
481 if (radix_tree_tag_get(&dma_active_cacheline, cln, i))
486 static int active_cacheline_set_overlap(phys_addr_t cln, int overlap)
490 if (overlap > ACTIVE_CACHELINE_MAX_OVERLAP || overlap < 0)
493 for (i = RADIX_TREE_MAX_TAGS - 1; i >= 0; i--)
494 if (overlap & 1 << i)
495 radix_tree_tag_set(&dma_active_cacheline, cln, i);
497 radix_tree_tag_clear(&dma_active_cacheline, cln, i);
502 static void active_cacheline_inc_overlap(phys_addr_t cln)
504 int overlap = active_cacheline_read_overlap(cln);
506 overlap = active_cacheline_set_overlap(cln, ++overlap);
508 /* If we overflowed the overlap counter then we're potentially
509 * leaking dma-mappings. Otherwise, if maps and unmaps are
510 * balanced then this overflow may cause false negatives in
511 * debug_dma_assert_idle() as the cacheline may be marked idle
514 WARN_ONCE(overlap > ACTIVE_CACHELINE_MAX_OVERLAP,
515 "DMA-API: exceeded %d overlapping mappings of cacheline %pa\n",
516 ACTIVE_CACHELINE_MAX_OVERLAP, &cln);
519 static int active_cacheline_dec_overlap(phys_addr_t cln)
521 int overlap = active_cacheline_read_overlap(cln);
523 return active_cacheline_set_overlap(cln, --overlap);
526 static int active_cacheline_insert(struct dma_debug_entry *entry)
528 phys_addr_t cln = to_cacheline_number(entry);
532 /* If the device is not writing memory then we don't have any
533 * concerns about the cpu consuming stale data. This mitigates
534 * legitimate usages of overlapping mappings.
536 if (entry->direction == DMA_TO_DEVICE)
539 spin_lock_irqsave(&radix_lock, flags);
540 rc = radix_tree_insert(&dma_active_cacheline, cln, entry);
542 active_cacheline_inc_overlap(cln);
543 spin_unlock_irqrestore(&radix_lock, flags);
548 static void active_cacheline_remove(struct dma_debug_entry *entry)
550 phys_addr_t cln = to_cacheline_number(entry);
553 /* ...mirror the insert case */
554 if (entry->direction == DMA_TO_DEVICE)
557 spin_lock_irqsave(&radix_lock, flags);
558 /* since we are counting overlaps the final put of the
559 * cacheline will occur when the overlap count is 0.
560 * active_cacheline_dec_overlap() returns -1 in that case
562 if (active_cacheline_dec_overlap(cln) < 0)
563 radix_tree_delete(&dma_active_cacheline, cln);
564 spin_unlock_irqrestore(&radix_lock, flags);
568 * debug_dma_assert_idle() - assert that a page is not undergoing dma
569 * @page: page to lookup in the dma_active_cacheline tree
571 * Place a call to this routine in cases where the cpu touching the page
572 * before the dma completes (page is dma_unmapped) will lead to data
575 void debug_dma_assert_idle(struct page *page)
577 static struct dma_debug_entry *ents[CACHELINES_PER_PAGE];
578 struct dma_debug_entry *entry = NULL;
579 void **results = (void **) &ents;
580 unsigned int nents, i;
584 if (dma_debug_disabled())
590 cln = (phys_addr_t) page_to_pfn(page) << CACHELINE_PER_PAGE_SHIFT;
591 spin_lock_irqsave(&radix_lock, flags);
592 nents = radix_tree_gang_lookup(&dma_active_cacheline, results, cln,
593 CACHELINES_PER_PAGE);
594 for (i = 0; i < nents; i++) {
595 phys_addr_t ent_cln = to_cacheline_number(ents[i]);
597 if (ent_cln == cln) {
600 } else if (ent_cln >= cln + CACHELINES_PER_PAGE)
603 spin_unlock_irqrestore(&radix_lock, flags);
608 cln = to_cacheline_number(entry);
609 err_printk(entry->dev, entry,
610 "DMA-API: cpu touching an active dma mapped cacheline [cln=%pa]\n",
615 * Wrapper function for adding an entry to the hash.
616 * This function takes care of locking itself.
618 static void add_dma_entry(struct dma_debug_entry *entry)
620 struct hash_bucket *bucket;
624 bucket = get_hash_bucket(entry, &flags);
625 hash_bucket_add(bucket, entry);
626 put_hash_bucket(bucket, &flags);
628 rc = active_cacheline_insert(entry);
630 pr_err("DMA-API: cacheline tracking ENOMEM, dma-debug disabled\n");
631 global_disable = true;
634 /* TODO: report -EEXIST errors here as overlapping mappings are
635 * not supported by the DMA API
639 static struct dma_debug_entry *__dma_entry_alloc(void)
641 struct dma_debug_entry *entry;
643 entry = list_entry(free_entries.next, struct dma_debug_entry, list);
644 list_del(&entry->list);
645 memset(entry, 0, sizeof(*entry));
647 num_free_entries -= 1;
648 if (num_free_entries < min_free_entries)
649 min_free_entries = num_free_entries;
654 /* struct dma_entry allocator
656 * The next two functions implement the allocator for
657 * struct dma_debug_entries.
659 static struct dma_debug_entry *dma_entry_alloc(void)
661 struct dma_debug_entry *entry;
664 spin_lock_irqsave(&free_entries_lock, flags);
666 if (list_empty(&free_entries)) {
667 global_disable = true;
668 spin_unlock_irqrestore(&free_entries_lock, flags);
669 pr_err("DMA-API: debugging out of memory - disabling\n");
673 entry = __dma_entry_alloc();
675 spin_unlock_irqrestore(&free_entries_lock, flags);
677 #ifdef CONFIG_STACKTRACE
678 entry->stacktrace.max_entries = DMA_DEBUG_STACKTRACE_ENTRIES;
679 entry->stacktrace.entries = entry->st_entries;
680 entry->stacktrace.skip = 2;
681 save_stack_trace(&entry->stacktrace);
687 static void dma_entry_free(struct dma_debug_entry *entry)
691 active_cacheline_remove(entry);
694 * add to beginning of the list - this way the entries are
695 * more likely cache hot when they are reallocated.
697 spin_lock_irqsave(&free_entries_lock, flags);
698 list_add(&entry->list, &free_entries);
699 num_free_entries += 1;
700 spin_unlock_irqrestore(&free_entries_lock, flags);
703 int dma_debug_resize_entries(u32 num_entries)
705 int i, delta, ret = 0;
707 struct dma_debug_entry *entry;
710 spin_lock_irqsave(&free_entries_lock, flags);
712 if (nr_total_entries < num_entries) {
713 delta = num_entries - nr_total_entries;
715 spin_unlock_irqrestore(&free_entries_lock, flags);
717 for (i = 0; i < delta; i++) {
718 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
722 list_add_tail(&entry->list, &tmp);
725 spin_lock_irqsave(&free_entries_lock, flags);
727 list_splice(&tmp, &free_entries);
728 nr_total_entries += i;
729 num_free_entries += i;
731 delta = nr_total_entries - num_entries;
733 for (i = 0; i < delta && !list_empty(&free_entries); i++) {
734 entry = __dma_entry_alloc();
738 nr_total_entries -= i;
741 if (nr_total_entries != num_entries)
744 spin_unlock_irqrestore(&free_entries_lock, flags);
748 EXPORT_SYMBOL(dma_debug_resize_entries);
751 * DMA-API debugging init code
753 * The init code does two things:
754 * 1. Initialize core data structures
755 * 2. Preallocate a given number of dma_debug_entry structs
758 static int prealloc_memory(u32 num_entries)
760 struct dma_debug_entry *entry, *next_entry;
763 for (i = 0; i < num_entries; ++i) {
764 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
768 list_add_tail(&entry->list, &free_entries);
771 num_free_entries = num_entries;
772 min_free_entries = num_entries;
774 pr_info("DMA-API: preallocated %d debug entries\n", num_entries);
780 list_for_each_entry_safe(entry, next_entry, &free_entries, list) {
781 list_del(&entry->list);
788 static ssize_t filter_read(struct file *file, char __user *user_buf,
789 size_t count, loff_t *ppos)
791 char buf[NAME_MAX_LEN + 1];
795 if (!current_driver_name[0])
799 * We can't copy to userspace directly because current_driver_name can
800 * only be read under the driver_name_lock with irqs disabled. So
801 * create a temporary copy first.
803 read_lock_irqsave(&driver_name_lock, flags);
804 len = scnprintf(buf, NAME_MAX_LEN + 1, "%s\n", current_driver_name);
805 read_unlock_irqrestore(&driver_name_lock, flags);
807 return simple_read_from_buffer(user_buf, count, ppos, buf, len);
810 static ssize_t filter_write(struct file *file, const char __user *userbuf,
811 size_t count, loff_t *ppos)
813 char buf[NAME_MAX_LEN];
819 * We can't copy from userspace directly. Access to
820 * current_driver_name is protected with a write_lock with irqs
821 * disabled. Since copy_from_user can fault and may sleep we
822 * need to copy to temporary buffer first
824 len = min(count, (size_t)(NAME_MAX_LEN - 1));
825 if (copy_from_user(buf, userbuf, len))
830 write_lock_irqsave(&driver_name_lock, flags);
833 * Now handle the string we got from userspace very carefully.
835 * - only use the first token we got
836 * - token delimiter is everything looking like a space
837 * character (' ', '\n', '\t' ...)
840 if (!isalnum(buf[0])) {
842 * If the first character userspace gave us is not
843 * alphanumerical then assume the filter should be
846 if (current_driver_name[0])
847 pr_info("DMA-API: switching off dma-debug driver filter\n");
848 current_driver_name[0] = 0;
849 current_driver = NULL;
854 * Now parse out the first token and use it as the name for the
855 * driver to filter for.
857 for (i = 0; i < NAME_MAX_LEN - 1; ++i) {
858 current_driver_name[i] = buf[i];
859 if (isspace(buf[i]) || buf[i] == ' ' || buf[i] == 0)
862 current_driver_name[i] = 0;
863 current_driver = NULL;
865 pr_info("DMA-API: enable driver filter for driver [%s]\n",
866 current_driver_name);
869 write_unlock_irqrestore(&driver_name_lock, flags);
874 static const struct file_operations filter_fops = {
876 .write = filter_write,
877 .llseek = default_llseek,
880 static int dma_debug_fs_init(void)
882 dma_debug_dent = debugfs_create_dir("dma-api", NULL);
883 if (!dma_debug_dent) {
884 pr_err("DMA-API: can not create debugfs directory\n");
888 global_disable_dent = debugfs_create_bool("disabled", 0444,
891 if (!global_disable_dent)
894 error_count_dent = debugfs_create_u32("error_count", 0444,
895 dma_debug_dent, &error_count);
896 if (!error_count_dent)
899 show_all_errors_dent = debugfs_create_u32("all_errors", 0644,
902 if (!show_all_errors_dent)
905 show_num_errors_dent = debugfs_create_u32("num_errors", 0644,
908 if (!show_num_errors_dent)
911 num_free_entries_dent = debugfs_create_u32("num_free_entries", 0444,
914 if (!num_free_entries_dent)
917 min_free_entries_dent = debugfs_create_u32("min_free_entries", 0444,
920 if (!min_free_entries_dent)
923 filter_dent = debugfs_create_file("driver_filter", 0644,
924 dma_debug_dent, NULL, &filter_fops);
931 debugfs_remove_recursive(dma_debug_dent);
936 static int device_dma_allocations(struct device *dev, struct dma_debug_entry **out_entry)
938 struct dma_debug_entry *entry;
942 local_irq_save(flags);
944 for (i = 0; i < HASH_SIZE; ++i) {
945 spin_lock(&dma_entry_hash[i].lock);
946 list_for_each_entry(entry, &dma_entry_hash[i].list, list) {
947 if (entry->dev == dev) {
952 spin_unlock(&dma_entry_hash[i].lock);
955 local_irq_restore(flags);
960 static int dma_debug_device_change(struct notifier_block *nb, unsigned long action, void *data)
962 struct device *dev = data;
963 struct dma_debug_entry *uninitialized_var(entry);
966 if (dma_debug_disabled())
970 case BUS_NOTIFY_UNBOUND_DRIVER:
971 count = device_dma_allocations(dev, &entry);
974 err_printk(dev, entry, "DMA-API: device driver has pending "
975 "DMA allocations while released from device "
977 "One of leaked entries details: "
978 "[device address=0x%016llx] [size=%llu bytes] "
979 "[mapped with %s] [mapped as %s]\n",
980 count, entry->dev_addr, entry->size,
981 dir2name[entry->direction], type2name[entry->type]);
990 void dma_debug_add_bus(struct bus_type *bus)
992 struct notifier_block *nb;
994 if (dma_debug_disabled())
997 nb = kzalloc(sizeof(struct notifier_block), GFP_KERNEL);
999 pr_err("dma_debug_add_bus: out of memory\n");
1003 nb->notifier_call = dma_debug_device_change;
1005 bus_register_notifier(bus, nb);
1009 * Let the architectures decide how many entries should be preallocated.
1011 void dma_debug_init(u32 num_entries)
1015 /* Do not use dma_debug_initialized here, since we really want to be
1016 * called to set dma_debug_initialized
1021 for (i = 0; i < HASH_SIZE; ++i) {
1022 INIT_LIST_HEAD(&dma_entry_hash[i].list);
1023 spin_lock_init(&dma_entry_hash[i].lock);
1026 if (dma_debug_fs_init() != 0) {
1027 pr_err("DMA-API: error creating debugfs entries - disabling\n");
1028 global_disable = true;
1034 num_entries = req_entries;
1036 if (prealloc_memory(num_entries) != 0) {
1037 pr_err("DMA-API: debugging out of memory error - disabled\n");
1038 global_disable = true;
1043 nr_total_entries = num_free_entries;
1045 dma_debug_initialized = true;
1047 pr_info("DMA-API: debugging enabled by kernel config\n");
1050 static __init int dma_debug_cmdline(char *str)
1055 if (strncmp(str, "off", 3) == 0) {
1056 pr_info("DMA-API: debugging disabled on kernel command line\n");
1057 global_disable = true;
1063 static __init int dma_debug_entries_cmdline(char *str)
1070 res = get_option(&str, &req_entries);
1078 __setup("dma_debug=", dma_debug_cmdline);
1079 __setup("dma_debug_entries=", dma_debug_entries_cmdline);
1081 static void check_unmap(struct dma_debug_entry *ref)
1083 struct dma_debug_entry *entry;
1084 struct hash_bucket *bucket;
1085 unsigned long flags;
1087 bucket = get_hash_bucket(ref, &flags);
1088 entry = bucket_find_exact(bucket, ref);
1091 /* must drop lock before calling dma_mapping_error */
1092 put_hash_bucket(bucket, &flags);
1094 if (dma_mapping_error(ref->dev, ref->dev_addr)) {
1095 err_printk(ref->dev, NULL,
1096 "DMA-API: device driver tries to free an "
1097 "invalid DMA memory address\n");
1099 err_printk(ref->dev, NULL,
1100 "DMA-API: device driver tries to free DMA "
1101 "memory it has not allocated [device "
1102 "address=0x%016llx] [size=%llu bytes]\n",
1103 ref->dev_addr, ref->size);
1108 if (ref->size != entry->size) {
1109 err_printk(ref->dev, entry, "DMA-API: device driver frees "
1110 "DMA memory with different size "
1111 "[device address=0x%016llx] [map size=%llu bytes] "
1112 "[unmap size=%llu bytes]\n",
1113 ref->dev_addr, entry->size, ref->size);
1116 if (ref->type != entry->type) {
1117 err_printk(ref->dev, entry, "DMA-API: device driver frees "
1118 "DMA memory with wrong function "
1119 "[device address=0x%016llx] [size=%llu bytes] "
1120 "[mapped as %s] [unmapped as %s]\n",
1121 ref->dev_addr, ref->size,
1122 type2name[entry->type], type2name[ref->type]);
1123 } else if ((entry->type == dma_debug_coherent) &&
1124 (phys_addr(ref) != phys_addr(entry))) {
1125 err_printk(ref->dev, entry, "DMA-API: device driver frees "
1126 "DMA memory with different CPU address "
1127 "[device address=0x%016llx] [size=%llu bytes] "
1128 "[cpu alloc address=0x%016llx] "
1129 "[cpu free address=0x%016llx]",
1130 ref->dev_addr, ref->size,
1135 if (ref->sg_call_ents && ref->type == dma_debug_sg &&
1136 ref->sg_call_ents != entry->sg_call_ents) {
1137 err_printk(ref->dev, entry, "DMA-API: device driver frees "
1138 "DMA sg list with different entry count "
1139 "[map count=%d] [unmap count=%d]\n",
1140 entry->sg_call_ents, ref->sg_call_ents);
1144 * This may be no bug in reality - but most implementations of the
1145 * DMA API don't handle this properly, so check for it here
1147 if (ref->direction != entry->direction) {
1148 err_printk(ref->dev, entry, "DMA-API: device driver frees "
1149 "DMA memory with different direction "
1150 "[device address=0x%016llx] [size=%llu bytes] "
1151 "[mapped with %s] [unmapped with %s]\n",
1152 ref->dev_addr, ref->size,
1153 dir2name[entry->direction],
1154 dir2name[ref->direction]);
1157 if (entry->map_err_type == MAP_ERR_NOT_CHECKED) {
1158 err_printk(ref->dev, entry,
1159 "DMA-API: device driver failed to check map error"
1160 "[device address=0x%016llx] [size=%llu bytes] "
1162 ref->dev_addr, ref->size,
1163 type2name[entry->type]);
1166 hash_bucket_del(entry);
1167 dma_entry_free(entry);
1169 put_hash_bucket(bucket, &flags);
1172 static void check_for_stack(struct device *dev, void *addr)
1174 if (object_is_on_stack(addr))
1175 err_printk(dev, NULL, "DMA-API: device driver maps memory from "
1176 "stack [addr=%p]\n", addr);
1179 static inline bool overlap(void *addr, unsigned long len, void *start, void *end)
1181 unsigned long a1 = (unsigned long)addr;
1182 unsigned long b1 = a1 + len;
1183 unsigned long a2 = (unsigned long)start;
1184 unsigned long b2 = (unsigned long)end;
1186 return !(b1 <= a2 || a1 >= b2);
1189 static void check_for_illegal_area(struct device *dev, void *addr, unsigned long len)
1191 if (overlap(addr, len, _stext, _etext) ||
1192 overlap(addr, len, __start_rodata, __end_rodata))
1193 err_printk(dev, NULL, "DMA-API: device driver maps memory from kernel text or rodata [addr=%p] [len=%lu]\n", addr, len);
1196 static void check_sync(struct device *dev,
1197 struct dma_debug_entry *ref,
1200 struct dma_debug_entry *entry;
1201 struct hash_bucket *bucket;
1202 unsigned long flags;
1204 bucket = get_hash_bucket(ref, &flags);
1206 entry = bucket_find_contain(&bucket, ref, &flags);
1209 err_printk(dev, NULL, "DMA-API: device driver tries "
1210 "to sync DMA memory it has not allocated "
1211 "[device address=0x%016llx] [size=%llu bytes]\n",
1212 (unsigned long long)ref->dev_addr, ref->size);
1216 if (ref->size > entry->size) {
1217 err_printk(dev, entry, "DMA-API: device driver syncs"
1218 " DMA memory outside allocated range "
1219 "[device address=0x%016llx] "
1220 "[allocation size=%llu bytes] "
1221 "[sync offset+size=%llu]\n",
1222 entry->dev_addr, entry->size,
1226 if (entry->direction == DMA_BIDIRECTIONAL)
1229 if (ref->direction != entry->direction) {
1230 err_printk(dev, entry, "DMA-API: device driver syncs "
1231 "DMA memory with different direction "
1232 "[device address=0x%016llx] [size=%llu bytes] "
1233 "[mapped with %s] [synced with %s]\n",
1234 (unsigned long long)ref->dev_addr, entry->size,
1235 dir2name[entry->direction],
1236 dir2name[ref->direction]);
1239 if (to_cpu && !(entry->direction == DMA_FROM_DEVICE) &&
1240 !(ref->direction == DMA_TO_DEVICE))
1241 err_printk(dev, entry, "DMA-API: device driver syncs "
1242 "device read-only DMA memory for cpu "
1243 "[device address=0x%016llx] [size=%llu bytes] "
1244 "[mapped with %s] [synced with %s]\n",
1245 (unsigned long long)ref->dev_addr, entry->size,
1246 dir2name[entry->direction],
1247 dir2name[ref->direction]);
1249 if (!to_cpu && !(entry->direction == DMA_TO_DEVICE) &&
1250 !(ref->direction == DMA_FROM_DEVICE))
1251 err_printk(dev, entry, "DMA-API: device driver syncs "
1252 "device write-only DMA memory to device "
1253 "[device address=0x%016llx] [size=%llu bytes] "
1254 "[mapped with %s] [synced with %s]\n",
1255 (unsigned long long)ref->dev_addr, entry->size,
1256 dir2name[entry->direction],
1257 dir2name[ref->direction]);
1259 if (ref->sg_call_ents && ref->type == dma_debug_sg &&
1260 ref->sg_call_ents != entry->sg_call_ents) {
1261 err_printk(ref->dev, entry, "DMA-API: device driver syncs "
1262 "DMA sg list with different entry count "
1263 "[map count=%d] [sync count=%d]\n",
1264 entry->sg_call_ents, ref->sg_call_ents);
1268 put_hash_bucket(bucket, &flags);
1271 void debug_dma_map_page(struct device *dev, struct page *page, size_t offset,
1272 size_t size, int direction, dma_addr_t dma_addr,
1275 struct dma_debug_entry *entry;
1277 if (unlikely(dma_debug_disabled()))
1280 if (dma_mapping_error(dev, dma_addr))
1283 entry = dma_entry_alloc();
1288 entry->type = dma_debug_page;
1289 entry->pfn = page_to_pfn(page);
1290 entry->offset = offset,
1291 entry->dev_addr = dma_addr;
1293 entry->direction = direction;
1294 entry->map_err_type = MAP_ERR_NOT_CHECKED;
1297 entry->type = dma_debug_single;
1299 if (!PageHighMem(page)) {
1300 void *addr = page_address(page) + offset;
1302 check_for_stack(dev, addr);
1303 check_for_illegal_area(dev, addr, size);
1306 add_dma_entry(entry);
1308 EXPORT_SYMBOL(debug_dma_map_page);
1310 void debug_dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
1312 struct dma_debug_entry ref;
1313 struct dma_debug_entry *entry;
1314 struct hash_bucket *bucket;
1315 unsigned long flags;
1317 if (unlikely(dma_debug_disabled()))
1321 ref.dev_addr = dma_addr;
1322 bucket = get_hash_bucket(&ref, &flags);
1324 list_for_each_entry(entry, &bucket->list, list) {
1325 if (!exact_match(&ref, entry))
1329 * The same physical address can be mapped multiple
1330 * times. Without a hardware IOMMU this results in the
1331 * same device addresses being put into the dma-debug
1332 * hash multiple times too. This can result in false
1333 * positives being reported. Therefore we implement a
1334 * best-fit algorithm here which updates the first entry
1335 * from the hash which fits the reference value and is
1336 * not currently listed as being checked.
1338 if (entry->map_err_type == MAP_ERR_NOT_CHECKED) {
1339 entry->map_err_type = MAP_ERR_CHECKED;
1344 put_hash_bucket(bucket, &flags);
1346 EXPORT_SYMBOL(debug_dma_mapping_error);
1348 void debug_dma_unmap_page(struct device *dev, dma_addr_t addr,
1349 size_t size, int direction, bool map_single)
1351 struct dma_debug_entry ref = {
1352 .type = dma_debug_page,
1356 .direction = direction,
1359 if (unlikely(dma_debug_disabled()))
1363 ref.type = dma_debug_single;
1367 EXPORT_SYMBOL(debug_dma_unmap_page);
1369 void debug_dma_map_sg(struct device *dev, struct scatterlist *sg,
1370 int nents, int mapped_ents, int direction)
1372 struct dma_debug_entry *entry;
1373 struct scatterlist *s;
1376 if (unlikely(dma_debug_disabled()))
1379 for_each_sg(sg, s, mapped_ents, i) {
1380 entry = dma_entry_alloc();
1384 entry->type = dma_debug_sg;
1386 entry->pfn = page_to_pfn(sg_page(s));
1387 entry->offset = s->offset,
1388 entry->size = sg_dma_len(s);
1389 entry->dev_addr = sg_dma_address(s);
1390 entry->direction = direction;
1391 entry->sg_call_ents = nents;
1392 entry->sg_mapped_ents = mapped_ents;
1394 if (!PageHighMem(sg_page(s))) {
1395 check_for_stack(dev, sg_virt(s));
1396 check_for_illegal_area(dev, sg_virt(s), sg_dma_len(s));
1399 add_dma_entry(entry);
1402 EXPORT_SYMBOL(debug_dma_map_sg);
1404 static int get_nr_mapped_entries(struct device *dev,
1405 struct dma_debug_entry *ref)
1407 struct dma_debug_entry *entry;
1408 struct hash_bucket *bucket;
1409 unsigned long flags;
1412 bucket = get_hash_bucket(ref, &flags);
1413 entry = bucket_find_exact(bucket, ref);
1417 mapped_ents = entry->sg_mapped_ents;
1418 put_hash_bucket(bucket, &flags);
1423 void debug_dma_unmap_sg(struct device *dev, struct scatterlist *sglist,
1424 int nelems, int dir)
1426 struct scatterlist *s;
1427 int mapped_ents = 0, i;
1429 if (unlikely(dma_debug_disabled()))
1432 for_each_sg(sglist, s, nelems, i) {
1434 struct dma_debug_entry ref = {
1435 .type = dma_debug_sg,
1437 .pfn = page_to_pfn(sg_page(s)),
1438 .offset = s->offset,
1439 .dev_addr = sg_dma_address(s),
1440 .size = sg_dma_len(s),
1442 .sg_call_ents = nelems,
1445 if (mapped_ents && i >= mapped_ents)
1449 mapped_ents = get_nr_mapped_entries(dev, &ref);
1454 EXPORT_SYMBOL(debug_dma_unmap_sg);
1456 void debug_dma_alloc_coherent(struct device *dev, size_t size,
1457 dma_addr_t dma_addr, void *virt)
1459 struct dma_debug_entry *entry;
1461 if (unlikely(dma_debug_disabled()))
1464 if (unlikely(virt == NULL))
1467 entry = dma_entry_alloc();
1471 entry->type = dma_debug_coherent;
1473 entry->pfn = page_to_pfn(virt_to_page(virt));
1474 entry->offset = (size_t) virt & ~PAGE_MASK;
1476 entry->dev_addr = dma_addr;
1477 entry->direction = DMA_BIDIRECTIONAL;
1479 add_dma_entry(entry);
1481 EXPORT_SYMBOL(debug_dma_alloc_coherent);
1483 void debug_dma_free_coherent(struct device *dev, size_t size,
1484 void *virt, dma_addr_t addr)
1486 struct dma_debug_entry ref = {
1487 .type = dma_debug_coherent,
1489 .pfn = page_to_pfn(virt_to_page(virt)),
1490 .offset = (size_t) virt & ~PAGE_MASK,
1493 .direction = DMA_BIDIRECTIONAL,
1496 if (unlikely(dma_debug_disabled()))
1501 EXPORT_SYMBOL(debug_dma_free_coherent);
1503 void debug_dma_map_resource(struct device *dev, phys_addr_t addr, size_t size,
1504 int direction, dma_addr_t dma_addr)
1506 struct dma_debug_entry *entry;
1508 if (unlikely(dma_debug_disabled()))
1511 entry = dma_entry_alloc();
1515 entry->type = dma_debug_resource;
1517 entry->pfn = PHYS_PFN(addr);
1518 entry->offset = offset_in_page(addr);
1520 entry->dev_addr = dma_addr;
1521 entry->direction = direction;
1522 entry->map_err_type = MAP_ERR_NOT_CHECKED;
1524 add_dma_entry(entry);
1526 EXPORT_SYMBOL(debug_dma_map_resource);
1528 void debug_dma_unmap_resource(struct device *dev, dma_addr_t dma_addr,
1529 size_t size, int direction)
1531 struct dma_debug_entry ref = {
1532 .type = dma_debug_resource,
1534 .dev_addr = dma_addr,
1536 .direction = direction,
1539 if (unlikely(dma_debug_disabled()))
1544 EXPORT_SYMBOL(debug_dma_unmap_resource);
1546 void debug_dma_sync_single_for_cpu(struct device *dev, dma_addr_t dma_handle,
1547 size_t size, int direction)
1549 struct dma_debug_entry ref;
1551 if (unlikely(dma_debug_disabled()))
1554 ref.type = dma_debug_single;
1556 ref.dev_addr = dma_handle;
1558 ref.direction = direction;
1559 ref.sg_call_ents = 0;
1561 check_sync(dev, &ref, true);
1563 EXPORT_SYMBOL(debug_dma_sync_single_for_cpu);
1565 void debug_dma_sync_single_for_device(struct device *dev,
1566 dma_addr_t dma_handle, size_t size,
1569 struct dma_debug_entry ref;
1571 if (unlikely(dma_debug_disabled()))
1574 ref.type = dma_debug_single;
1576 ref.dev_addr = dma_handle;
1578 ref.direction = direction;
1579 ref.sg_call_ents = 0;
1581 check_sync(dev, &ref, false);
1583 EXPORT_SYMBOL(debug_dma_sync_single_for_device);
1585 void debug_dma_sync_single_range_for_cpu(struct device *dev,
1586 dma_addr_t dma_handle,
1587 unsigned long offset, size_t size,
1590 struct dma_debug_entry ref;
1592 if (unlikely(dma_debug_disabled()))
1595 ref.type = dma_debug_single;
1597 ref.dev_addr = dma_handle;
1598 ref.size = offset + size;
1599 ref.direction = direction;
1600 ref.sg_call_ents = 0;
1602 check_sync(dev, &ref, true);
1604 EXPORT_SYMBOL(debug_dma_sync_single_range_for_cpu);
1606 void debug_dma_sync_single_range_for_device(struct device *dev,
1607 dma_addr_t dma_handle,
1608 unsigned long offset,
1609 size_t size, int direction)
1611 struct dma_debug_entry ref;
1613 if (unlikely(dma_debug_disabled()))
1616 ref.type = dma_debug_single;
1618 ref.dev_addr = dma_handle;
1619 ref.size = offset + size;
1620 ref.direction = direction;
1621 ref.sg_call_ents = 0;
1623 check_sync(dev, &ref, false);
1625 EXPORT_SYMBOL(debug_dma_sync_single_range_for_device);
1627 void debug_dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
1628 int nelems, int direction)
1630 struct scatterlist *s;
1631 int mapped_ents = 0, i;
1633 if (unlikely(dma_debug_disabled()))
1636 for_each_sg(sg, s, nelems, i) {
1638 struct dma_debug_entry ref = {
1639 .type = dma_debug_sg,
1641 .pfn = page_to_pfn(sg_page(s)),
1642 .offset = s->offset,
1643 .dev_addr = sg_dma_address(s),
1644 .size = sg_dma_len(s),
1645 .direction = direction,
1646 .sg_call_ents = nelems,
1650 mapped_ents = get_nr_mapped_entries(dev, &ref);
1652 if (i >= mapped_ents)
1655 check_sync(dev, &ref, true);
1658 EXPORT_SYMBOL(debug_dma_sync_sg_for_cpu);
1660 void debug_dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
1661 int nelems, int direction)
1663 struct scatterlist *s;
1664 int mapped_ents = 0, i;
1666 if (unlikely(dma_debug_disabled()))
1669 for_each_sg(sg, s, nelems, i) {
1671 struct dma_debug_entry ref = {
1672 .type = dma_debug_sg,
1674 .pfn = page_to_pfn(sg_page(s)),
1675 .offset = s->offset,
1676 .dev_addr = sg_dma_address(s),
1677 .size = sg_dma_len(s),
1678 .direction = direction,
1679 .sg_call_ents = nelems,
1682 mapped_ents = get_nr_mapped_entries(dev, &ref);
1684 if (i >= mapped_ents)
1687 check_sync(dev, &ref, false);
1690 EXPORT_SYMBOL(debug_dma_sync_sg_for_device);
1692 static int __init dma_debug_driver_setup(char *str)
1696 for (i = 0; i < NAME_MAX_LEN - 1; ++i, ++str) {
1697 current_driver_name[i] = *str;
1702 if (current_driver_name[0])
1703 pr_info("DMA-API: enable driver filter for driver [%s]\n",
1704 current_driver_name);
1709 __setup("dma_debug_driver=", dma_debug_driver_setup);