#define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16) /* If the pool runs out, add this many new entries at once */ #define DMA_DEBUG_DYNAMIC_ENTRIES (PAGE_SIZE / sizeof(struct dma_debug_entry))
/* Hash list to save the allocated dma addresses */ staticstruct hash_bucket dma_entry_hash[HASH_SIZE]; /* List of pre-allocated dma_debug_entry's */ static LIST_HEAD(free_entries); /* Lock for the list above */ static DEFINE_SPINLOCK(free_entries_lock);
/* Global disable flag - will be set in case of an error */ staticbool global_disable __read_mostly;
/* Early initialization disable flag, set at the end of dma_debug_init */ staticbool dma_debug_initialized __read_mostly;
/* * The access to some variables in this macro is racy. We can't use atomic_t * here because all these variables are exported to debugfs. Some of them even * writeable. This is also the reason why a lock won't help much. But anyway, * the races are no big deal. Here is why: * * error_count: the addition is racy, but the worst thing that can happen is * that we don't count some errors * show_num_errors: the subtraction is racy. Also no big deal because in * worst case this will result in one warning more in the * system log than the user configured. This variable is * writeable via debugfs.
*/ staticinlinevoid dump_entry_trace(struct dma_debug_entry *entry)
{ #ifdef CONFIG_STACKTRACE if (entry) {
pr_warn("Mapped at:\n");
stack_trace_print(entry->stack_entries, entry->stack_len, 0);
} #endif
}
/* driver filter off */ if (likely(!current_driver_name[0])) returntrue;
/* driver filter on and initialized */ if (current_driver && dev && dev->driver == current_driver) returntrue;
/* driver filter on, but we can't filter on a NULL device... */ if (!dev) returnfalse;
if (current_driver || !current_driver_name[0]) returnfalse;
/* driver filter on but not yet initialized */
drv = dev->driver; if (!drv) returnfalse;
/* lock to protect against change of current_driver_name */
read_lock_irqsave(&driver_name_lock, flags);
ret = false; if (drv->name &&
strncmp(current_driver_name, drv->name, NAME_MAX_LEN - 1) == 0) {
current_driver = drv;
ret = true;
}
read_unlock_irqrestore(&driver_name_lock, flags);
return ret;
}
#define err_printk(dev, entry, format, arg...) do { \
error_count += 1; \ if (driver_filter(dev) && \
(show_all_errors || show_num_errors > 0)) { \
WARN(1, pr_fmt("%s %s: ") format, \
dev ? dev_driver_string(dev) : "NULL", \
dev ? dev_name(dev) : "NULL", ## arg); \
dump_entry_trace(entry); \
} \ if (!show_all_errors && show_num_errors > 0) \
show_num_errors -= 1; \
} while (0);
/* * Hash related functions * * Every DMA-API request is saved into a struct dma_debug_entry. To * have quick access to these structs they are stored into a hash.
*/ staticint hash_fn(struct dma_debug_entry *entry)
{ /* * Hash function is based on the dma address. * We use bits 20-27 here as the index into the hash
*/ return (entry->dev_addr >> HASH_FN_SHIFT) & HASH_FN_MASK;
}
/* * Request exclusive access to a hash bucket for a given dma_debug_entry.
*/ staticstruct hash_bucket *get_hash_bucket(struct dma_debug_entry *entry, unsignedlong *flags)
__acquires(&dma_entry_hash[idx].lock)
{ int idx = hash_fn(entry); unsignedlong __flags;
/* * Search a given entry in the hash bucket list
*/ staticstruct dma_debug_entry *__hash_bucket_find(struct hash_bucket *bucket, struct dma_debug_entry *ref,
match_fn match)
{ struct dma_debug_entry *entry, *ret = NULL; int matches = 0, match_lvl, last_lvl = -1;
list_for_each_entry(entry, &bucket->list, list) { if (!match(ref, entry)) continue;
/* * Some drivers map the same physical address multiple * times. Without a hardware IOMMU this results in the * same device addresses being put into the dma-debug * hash multiple times too. This can result in false * positives being reported. Therefore we implement a * best-fit algorithm here which returns the entry from * the hash which fits best to the reference value * instead of the first-fit.
*/
matches += 1;
match_lvl = 0;
entry->size == ref->size ? ++match_lvl : 0;
entry->type == ref->type ? ++match_lvl : 0;
entry->direction == ref->direction ? ++match_lvl : 0;
entry->sg_call_ents == ref->sg_call_ents ? ++match_lvl : 0;
if (match_lvl == 4) { /* perfect-fit - return the result */ return entry;
} elseif (match_lvl > last_lvl) { /* * We found an entry that fits better then the * previous one or it is the 1st match.
*/
last_lvl = match_lvl;
ret = entry;
}
}
/* * If we have multiple matches but no perfect-fit, just return * NULL.
*/
ret = (matches == 1) ? ret : NULL;
struct dma_debug_entry *entry, index = *ref; int limit = min(HASH_SIZE, (index.dev_addr >> HASH_FN_SHIFT) + 1);
for (int i = 0; i < limit; i++) {
entry = __hash_bucket_find(*bucket, ref, containing_match);
if (entry) return entry;
/* * Nothing found, go back a hash bucket
*/
put_hash_bucket(*bucket, *flags);
index.dev_addr -= (1 << HASH_FN_SHIFT);
*bucket = get_hash_bucket(&index, flags);
}
return NULL;
}
/* * Add an entry to a hash bucket
*/ staticvoid hash_bucket_add(struct hash_bucket *bucket, struct dma_debug_entry *entry)
{
list_add_tail(&entry->list, &bucket->list);
}
/* * Remove entry from a hash bucket list
*/ staticvoid hash_bucket_del(struct dma_debug_entry *entry)
{
list_del(&entry->list);
}
/* * For each mapping (initial cacheline in the case of * dma_alloc_coherent/dma_map_page, initial cacheline in each page of a * scatterlist, or the cacheline specified in dma_map_single) insert * into this tree using the cacheline as the key. At * dma_unmap_{single|sg|page} or dma_free_coherent delete the entry. If * the entry already exists at insertion time add a tag as a reference * count for the overlapping mappings. For now, the overlap tracking * just ensures that 'unmaps' balance 'maps' before marking the * cacheline idle, but we should also be flagging overlaps as an API * violation. * * Memory usage is mostly constrained by the maximum number of available * dma-debug entries in that we need a free dma_debug_entry before * inserting into the tree. In the case of dma_map_page and * dma_alloc_coherent there is only one dma_debug_entry and one * dma_active_cacheline entry to track per event. dma_map_sg(), on the * other hand, consumes a single dma_debug_entry, but inserts 'nents' * entries into the tree. * * Use __GFP_NOWARN because the printk from an OOM, to netconsole, could end * up right back in the DMA debugging code, leading to a deadlock.
*/ static RADIX_TREE(dma_active_cacheline, GFP_ATOMIC | __GFP_NOWARN); static DEFINE_SPINLOCK(radix_lock); #define ACTIVE_CACHELINE_MAX_OVERLAP ((1 << RADIX_TREE_MAX_TAGS) - 1) #define CACHELINE_PER_PAGE_SHIFT (PAGE_SHIFT - L1_CACHE_SHIFT) #define CACHELINES_PER_PAGE (1 << CACHELINE_PER_PAGE_SHIFT)
/* If the device is not writing memory then we don't have any * concerns about the cpu consuming stale data. This mitigates * legitimate usages of overlapping mappings.
*/ if (entry->direction == DMA_TO_DEVICE) return 0;
/* ...mirror the insert case */ if (entry->direction == DMA_TO_DEVICE) return;
spin_lock_irqsave(&radix_lock, flags); /* since we are counting overlaps the final put of the * cacheline will occur when the overlap count is 0. * active_cacheline_dec_overlap() returns -1 in that case
*/ if (active_cacheline_dec_overlap(cln) < 0)
radix_tree_delete(&dma_active_cacheline, cln);
spin_unlock_irqrestore(&radix_lock, flags);
}
/* * Dump mappings entries on kernel space for debugging purposes
*/ void debug_dma_dump_mappings(struct device *dev)
{ int idx;
phys_addr_t cln;
/* * Wrapper function for adding an entry to the hash. * This function takes care of locking itself.
*/ staticvoid add_dma_entry(struct dma_debug_entry *entry, unsignedlong attrs)
{ struct hash_bucket *bucket; unsignedlong flags; int rc;
num_free_entries -= 1; if (num_free_entries < min_free_entries)
min_free_entries = num_free_entries;
return entry;
}
/* * This should be called outside of free_entries_lock scope to avoid potential * deadlocks with serial consoles that use DMA.
*/ staticvoid __dma_entry_alloc_check_leak(u32 nr_entries)
{
u32 tmp = nr_entries % nr_prealloc_entries;
/* Shout each time we tick over some multiple of the initial pool */ if (tmp < DMA_DEBUG_DYNAMIC_ENTRIES) {
pr_info("dma_debug_entry pool grown to %u (%u00%%)\n",
nr_entries,
(nr_entries / nr_prealloc_entries));
}
}
/* struct dma_entry allocator * * The next two functions implement the allocator for * struct dma_debug_entries.
*/ staticstruct dma_debug_entry *dma_entry_alloc(void)
{ bool alloc_check_leak = false; struct dma_debug_entry *entry; unsignedlong flags;
u32 nr_entries;
spin_lock_irqsave(&free_entries_lock, flags); if (num_free_entries == 0) { if (dma_debug_create_entries(GFP_ATOMIC)) {
global_disable = true;
spin_unlock_irqrestore(&free_entries_lock, flags);
pr_err("debugging out of memory - disabling\n"); return NULL;
}
alloc_check_leak = true;
nr_entries = nr_total_entries;
}
/* * add to beginning of the list - this way the entries are * more likely cache hot when they are reallocated.
*/
spin_lock_irqsave(&free_entries_lock, flags);
list_add(&entry->list, &free_entries);
num_free_entries += 1;
spin_unlock_irqrestore(&free_entries_lock, flags);
}
/* * DMA-API debugging init code * * The init code does two things: * 1. Initialize core data structures * 2. Preallocate a given number of dma_debug_entry structs
*/
/* * We can't copy to userspace directly because current_driver_name can * only be read under the driver_name_lock with irqs disabled. So * create a temporary copy first.
*/
read_lock_irqsave(&driver_name_lock, flags);
len = scnprintf(buf, NAME_MAX_LEN + 1, "%s\n", current_driver_name);
read_unlock_irqrestore(&driver_name_lock, flags);
/* * We can't copy from userspace directly. Access to * current_driver_name is protected with a write_lock with irqs * disabled. Since copy_from_user can fault and may sleep we * need to copy to temporary buffer first
*/
len = min(count, (size_t)(NAME_MAX_LEN - 1)); if (copy_from_user(buf, userbuf, len)) return -EFAULT;
buf[len] = 0;
write_lock_irqsave(&driver_name_lock, flags);
/* * Now handle the string we got from userspace very carefully. * The rules are: * - only use the first token we got * - token delimiter is everything looking like a space * character (' ', '\n', '\t' ...) *
*/ if (!isalnum(buf[0])) { /* * If the first character userspace gave us is not * alphanumerical then assume the filter should be * switched off.
*/ if (current_driver_name[0])
pr_info("switching off dma-debug driver filter\n");
current_driver_name[0] = 0;
current_driver = NULL; goto out_unlock;
}
/* * Now parse out the first token and use it as the name for the * driver to filter for.
*/ for (i = 0; i < NAME_MAX_LEN - 1; ++i) {
current_driver_name[i] = buf[i]; if (isspace(buf[i]) || buf[i] == ' ' || buf[i] == 0) break;
}
current_driver_name[i] = 0;
current_driver = NULL;
pr_info("enable driver filter for driver [%s]\n",
current_driver_name);
if (!entry) { /* must drop lock before calling dma_mapping_error */
put_hash_bucket(bucket, flags);
if (dma_mapping_error(ref->dev, ref->dev_addr)) {
err_printk(ref->dev, NULL, "device driver tries to free an " "invalid DMA memory address\n");
} else {
err_printk(ref->dev, NULL, "device driver tries to free DMA " "memory it has not allocated [device " "address=0x%016llx] [size=%llu bytes]\n",
ref->dev_addr, ref->size);
} return;
}
if (ref->size != entry->size) {
err_printk(ref->dev, entry, "device driver frees " "DMA memory with different size " "[device address=0x%016llx] [map size=%llu bytes] " "[unmap size=%llu bytes]\n",
ref->dev_addr, entry->size, ref->size);
}
if (ref->type != entry->type) {
err_printk(ref->dev, entry, "device driver frees " "DMA memory with wrong function " "[device address=0x%016llx] [size=%llu bytes] " "[mapped as %s] [unmapped as %s]\n",
ref->dev_addr, ref->size,
type2name[entry->type], type2name[ref->type]);
} elseif ((entry->type == dma_debug_coherent ||
entry->type == dma_debug_noncoherent) &&
ref->paddr != entry->paddr) {
err_printk(ref->dev, entry, "device driver frees " "DMA memory with different CPU address " "[device address=0x%016llx] [size=%llu bytes] " "[cpu alloc address=0x%pa] " "[cpu free address=0x%pa]",
ref->dev_addr, ref->size,
&entry->paddr,
&ref->paddr);
}
if (ref->sg_call_ents && ref->type == dma_debug_sg &&
ref->sg_call_ents != entry->sg_call_ents) {
err_printk(ref->dev, entry, "device driver frees " "DMA sg list with different entry count " "[map count=%d] [unmap count=%d]\n",
entry->sg_call_ents, ref->sg_call_ents);
}
/* * This may be no bug in reality - but most implementations of the * DMA API don't handle this properly, so check for it here
*/ if (ref->direction != entry->direction) {
err_printk(ref->dev, entry, "device driver frees " "DMA memory with different direction " "[device address=0x%016llx] [size=%llu bytes] " "[mapped with %s] [unmapped with %s]\n",
ref->dev_addr, ref->size,
dir2name[entry->direction],
dir2name[ref->direction]);
}
/* * Drivers should use dma_mapping_error() to check the returned * addresses of dma_map_single() and dma_map_page(). * If not, print this warning message. See Documentation/core-api/dma-api.rst.
*/ if (entry->map_err_type == MAP_ERR_NOT_CHECKED) {
err_printk(ref->dev, entry, "device driver failed to check map error" "[device address=0x%016llx] [size=%llu bytes] " "[mapped as %s]",
ref->dev_addr, ref->size,
type2name[entry->type]);
}
/* * Either the driver forgot to set dma_parms appropriately, or * whoever generated the list forgot to check them.
*/ if (sg->length > max_seg)
err_printk(dev, NULL, "mapping sg segment longer than device claims to support [len=%u] [max=%u]\n",
sg->length, max_seg); /* * In some cases this could potentially be the DMA API * implementation's fault, but it would usually imply that * the scatterlist was built inappropriately to begin with.
*/
start = sg_dma_address(sg);
end = start + sg_dma_len(sg) - 1; if ((start ^ end) & ~boundary)
err_printk(dev, NULL, "mapping sg segment across boundary [start=0x%016llx] [end=0x%016llx] [boundary=0x%016llx]\n",
start, end, boundary);
}
list_for_each_entry(entry, &bucket->list, list) { if (!exact_match(&ref, entry)) continue;
/* * The same physical address can be mapped multiple * times. Without a hardware IOMMU this results in the * same device addresses being put into the dma-debug * hash multiple times too. This can result in false * positives being reported. Therefore we implement a * best-fit algorithm here which updates the first entry * from the hash which fits the reference value and is * not currently listed as being checked.
*/ if (entry->map_err_type == MAP_ERR_NOT_CHECKED) {
entry->map_err_type = MAP_ERR_CHECKED; break;
}
}
Die Informationen auf dieser Webseite wurden
nach bestem Wissen sorgfältig zusammengestellt. Es wird jedoch weder Vollständigkeit, noch Richtigkeit,
noch Qualität der bereit gestellten Informationen zugesichert.
Bemerkung:
Die farbliche Syntaxdarstellung und die Messung sind noch experimentell.