21 Nov, 2011

1 commit


01 Nov, 2011

1 commit


23 Aug, 2011

1 commit

  • Summary:
    Users of the pci_dma_sync_single_* api allow users to sync address ranges within
    the range of a mapped entry (i.e. you can dma map address X to dma_addr_t A and
    then pci_dma_sync_single on dma_addr_t A+1. The dma-debug library however
    assume dma syncs will always occur using the base address of a mapped region,
    and uses that assumption to find entries in its hash table. Since thats often
    (but not always the case), the dma debug library can give us false errors about
    missing entries, which are reported as syncing of memory not allocated by the
    driver. This was noted in the cxgb3 driver as this error:

    WARNING: at lib/dma-debug.c:902 check_sync+0xdd/0x48c()
    Hardware name: To be filled by O.E.M.
    cxgb3 0000:01:00.0: DMA-API: device driver tries to sync DMA memory it has not
    allocated [device address=0x00000000fff97800] [size=1984 bytes]
    Modules linked in: autofs4 sunrpc cpufreq_ondemand acpi_cpufreq freq_table
    mperf ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 uinput
    snd_hda_codec_intelhdmi snd_hda_codec_realtek snd_hda_intel snd_hda_codec
    snd_hwdep snd_seq snd_seq_device snd_pcm snd_timer e1000e snd soundcore r8169
    cxgb3 iTCO_wdt snd_page_alloc mii shpchp i2c_i801 iTCO_vendor_support mdio
    microcode firewire_ohci firewire_core crc_itu_t ata_generic pata_acpi i915
    drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded:
    scsi_wait_scan]
    Pid: 1818, comm: ifconfig Not tainted 2.6.35-0.23.rc3.git6.fc14.x86_64 #1
    Call Trace:
    [] warn_slowpath_common+0x85/0x9d
    [] warn_slowpath_fmt+0x46/0x48
    [] ? check_sync+0x39/0x48c
    [] ? trace_hardirqs_on+0xd/0xf
    [] check_sync+0xdd/0x48c
    [] debug_dma_sync_single_for_device+0x3f/0x41
    [] ? pci_map_page+0x84/0x97 [cxgb3]
    [] pci_dma_sync_single_for_device.clone.0+0x65/0x6e [cxgb3]
    [] refill_fl+0x305/0x30a [cxgb3]
    [] t3_sge_alloc_qset+0x6a7/0x821 [cxgb3]
    [] cxgb_up+0x4d0/0xe62 [cxgb3]
    [] ? __module_text_address+0x12/0x58
    [] cxgb_open+0x3f/0x309 [cxgb3]
    [] __dev_open+0x8e/0xbc
    [] __dev_change_flags+0xbe/0x142
    [] dev_change_flags+0x21/0x57
    [] devinet_ioctl+0x29a/0x54b
    [] ? inode_has_perm+0xaa/0xce
    [] inet_ioctl+0x8f/0xa7
    [] sock_do_ioctl+0x29/0x48
    [] sock_ioctl+0x213/0x222
    [] vfs_ioctl+0x32/0xa6
    [] do_vfs_ioctl+0x47a/0x4b3
    [] sys_ioctl+0x56/0x79
    [] system_call_fastpath+0x16/0x1b
    ---[ end trace 69a4d4cc77b58004 ]---

    (some edits by Joerg Roedel)

    Signed-off-by: Neil Horman
    Reported-by: Jay Fenalson
    CC: Divy LeRay
    CC: Stanislaw Gruszka
    CC: Joerg Roedel
    CC: Arnd Bergmann
    Signed-off-by: Joerg Roedel

    Neil Horman
     

07 Apr, 2011

1 commit


15 Oct, 2010

1 commit

  • All file_operations should get a .llseek operation so we can make
    nonseekable_open the default for future file operations without a
    .llseek pointer.

    The three cases that we can automatically detect are no_llseek, seq_lseek
    and default_llseek. For cases where we can we can automatically prove that
    the file offset is always ignored, we use noop_llseek, which maintains
    the current behavior of not returning an error from a seek.

    New drivers should normally not use noop_llseek but instead use no_llseek
    and call nonseekable_open at open time. Existing drivers can be converted
    to do the same when the maintainer knows for certain that no user code
    relies on calling seek on the device file.

    The generated code is often incorrectly indented and right now contains
    comments that clarify for each added line why a specific variant was
    chosen. In the version that gets submitted upstream, the comments will
    be gone and I will manually fix the indentation, because there does not
    seem to be a way to do that using coccinelle.

    Some amount of new code is currently sitting in linux-next that should get
    the same modifications, which I will do at the end of the merge window.

    Many thanks to Julia Lawall for helping me learn to write a semantic
    patch that does all this.

    ===== begin semantic patch =====
    // This adds an llseek= method to all file operations,
    // as a preparation for making no_llseek the default.
    //
    // The rules are
    // - use no_llseek explicitly if we do nonseekable_open
    // - use seq_lseek for sequential files
    // - use default_llseek if we know we access f_pos
    // - use noop_llseek if we know we don't access f_pos,
    // but we still want to allow users to call lseek
    //
    @ open1 exists @
    identifier nested_open;
    @@
    nested_open(...)
    {

    }

    @ open exists@
    identifier open_f;
    identifier i, f;
    identifier open1.nested_open;
    @@
    int open_f(struct inode *i, struct file *f)
    {

    }

    @ read disable optional_qualifier exists @
    identifier read_f;
    identifier f, p, s, off;
    type ssize_t, size_t, loff_t;
    expression E;
    identifier func;
    @@
    ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off)
    {

    }

    @ read_no_fpos disable optional_qualifier exists @
    identifier read_f;
    identifier f, p, s, off;
    type ssize_t, size_t, loff_t;
    @@
    ssize_t read_f(struct file *f, char *p, size_t s, loff_t *off)
    {
    ... when != off
    }

    @ write @
    identifier write_f;
    identifier f, p, s, off;
    type ssize_t, size_t, loff_t;
    expression E;
    identifier func;
    @@
    ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off)
    {

    }

    @ write_no_fpos @
    identifier write_f;
    identifier f, p, s, off;
    type ssize_t, size_t, loff_t;
    @@
    ssize_t write_f(struct file *f, const char *p, size_t s, loff_t *off)
    {
    ... when != off
    }

    @ fops0 @
    identifier fops;
    @@
    struct file_operations fops = {
    ...
    };

    @ has_llseek depends on fops0 @
    identifier fops0.fops;
    identifier llseek_f;
    @@
    struct file_operations fops = {
    ...
    .llseek = llseek_f,
    ...
    };

    @ has_read depends on fops0 @
    identifier fops0.fops;
    identifier read_f;
    @@
    struct file_operations fops = {
    ...
    .read = read_f,
    ...
    };

    @ has_write depends on fops0 @
    identifier fops0.fops;
    identifier write_f;
    @@
    struct file_operations fops = {
    ...
    .write = write_f,
    ...
    };

    @ has_open depends on fops0 @
    identifier fops0.fops;
    identifier open_f;
    @@
    struct file_operations fops = {
    ...
    .open = open_f,
    ...
    };

    // use no_llseek if we call nonseekable_open
    ////////////////////////////////////////////
    @ nonseekable1 depends on !has_llseek && has_open @
    identifier fops0.fops;
    identifier nso ~= "nonseekable_open";
    @@
    struct file_operations fops = {
    ... .open = nso, ...
    +.llseek = no_llseek, /* nonseekable */
    };

    @ nonseekable2 depends on !has_llseek @
    identifier fops0.fops;
    identifier open.open_f;
    @@
    struct file_operations fops = {
    ... .open = open_f, ...
    +.llseek = no_llseek, /* open uses nonseekable */
    };

    // use seq_lseek for sequential files
    /////////////////////////////////////
    @ seq depends on !has_llseek @
    identifier fops0.fops;
    identifier sr ~= "seq_read";
    @@
    struct file_operations fops = {
    ... .read = sr, ...
    +.llseek = seq_lseek, /* we have seq_read */
    };

    // use default_llseek if there is a readdir
    ///////////////////////////////////////////
    @ fops1 depends on !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier readdir_e;
    @@
    // any other fop is used that changes pos
    struct file_operations fops = {
    ... .readdir = readdir_e, ...
    +.llseek = default_llseek, /* readdir is present */
    };

    // use default_llseek if at least one of read/write touches f_pos
    /////////////////////////////////////////////////////////////////
    @ fops2 depends on !fops1 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier read.read_f;
    @@
    // read fops use offset
    struct file_operations fops = {
    ... .read = read_f, ...
    +.llseek = default_llseek, /* read accesses f_pos */
    };

    @ fops3 depends on !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier write.write_f;
    @@
    // write fops use offset
    struct file_operations fops = {
    ... .write = write_f, ...
    + .llseek = default_llseek, /* write accesses f_pos */
    };

    // Use noop_llseek if neither read nor write accesses f_pos
    ///////////////////////////////////////////////////////////

    @ fops4 depends on !fops1 && !fops2 && !fops3 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier read_no_fpos.read_f;
    identifier write_no_fpos.write_f;
    @@
    // write fops use offset
    struct file_operations fops = {
    ...
    .write = write_f,
    .read = read_f,
    ...
    +.llseek = noop_llseek, /* read and write both use no f_pos */
    };

    @ depends on has_write && !has_read && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier write_no_fpos.write_f;
    @@
    struct file_operations fops = {
    ... .write = write_f, ...
    +.llseek = noop_llseek, /* write uses no f_pos */
    };

    @ depends on has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    identifier read_no_fpos.read_f;
    @@
    struct file_operations fops = {
    ... .read = read_f, ...
    +.llseek = noop_llseek, /* read uses no f_pos */
    };

    @ depends on !has_read && !has_write && !fops1 && !fops2 && !has_llseek && !nonseekable1 && !nonseekable2 && !seq @
    identifier fops0.fops;
    @@
    struct file_operations fops = {
    ...
    +.llseek = noop_llseek, /* no read or write fn */
    };
    ===== End semantic patch =====

    Signed-off-by: Arnd Bergmann
    Cc: Julia Lawall
    Cc: Christoph Hellwig

    Arnd Bergmann
     

07 Apr, 2010

1 commit

  • Earlier in this function we set the last byte of "buf" to NULL so we
    always hit the break statement and "i" is never equal to NAME_MAX_LEN.
    This patch doesn't change how the driver works but it silences a Smatch
    warning and it makes it clearer that we don't write past the end of the
    array.

    Signed-off-by: Dan Carpenter
    Signed-off-by: Joerg Roedel

    Dan Carpenter
     

23 Jan, 2010

2 commits


12 Jan, 2010

1 commit


31 Dec, 2009

1 commit

  • Stephen Rothwell reported the following build warning:

    lib/dma-debug.c: In function 'dma_debug_device_change':
    lib/dma-debug.c:680: warning: 'return' with no value, in function returning non-void

    Introduced by commit f797d9881b62c2ddb1d2e7bd80d87141949c84aa
    ("dma-debug: Do not add notifier when dma debugging is disabled").

    Return 0 [notify-done] when disabled. (this is standard bus notifier behavior.)

    Signed-off-by: Shaun Ruffell
    Signed-off-by: Joerg Roedel
    Cc: Linus Torvalds
    Cc:
    LKML-Reference:
    Signed-off-by: Ingo Molnar

    Ingo Molnar
     

21 Dec, 2009

1 commit

  • If CONFIG_HAVE_DMA_API_DEBUG is defined and "dma_debug=off" is
    specified on the kernel command line, when you detach a driver from a
    device you can cause the following NULL pointer dereference:

    BUG: unable to handle kernel NULL pointer dereference at (null)
    IP: [] dma_debug_device_change+0x5d/0x117

    The problem is that the dma_debug_device_change notifier function is
    added to the bus notifier chain even though the dma_entry_hash array
    was never initialized. If dma debugging is disabled, this patch both
    prevents dma_debug_device_change notifiers from being added to the
    chain, and additionally ensures that the dma_debug_device_change
    notifier function is a no-op.

    Cc: stable@kernel.org
    Signed-off-by: Shaun Ruffell
    Signed-off-by: Joerg Roedel

    Shaun Ruffell
     

04 Dec, 2009

1 commit

  • That is "success", "unknown", "through", "performance", "[re|un]mapping"
    , "access", "default", "reasonable", "[con]currently", "temperature"
    , "channel", "[un]used", "application", "example","hierarchy", "therefore"
    , "[over|under]flow", "contiguous", "threshold", "enough" and others.

    Signed-off-by: André Goddard Rosa
    Signed-off-by: Jiri Kosina

    André Goddard Rosa
     

29 Oct, 2009

1 commit

  • When PAE is enabled in the kernel configuration the size of
    phys_addr_t differs from the size of a void pointer. The gcc
    prints a warning about that in dma-debug code.
    This patch fixes the warning by converting the output to
    unsigned long long instead of a pointer.

    Signed-off-by: Joerg Roedel

    Joerg Roedel
     

21 Aug, 2009

1 commit

  • While it's debatable whether or not a NULL device argument to
    the DMA API functions is valid... since it certainly isn't
    valid on devices with an IOMMU... dma-debug really shouldn't be
    dereferencing null pointers either.

    Guard against that in err_printk and the driver_filter
    functions. A Fedora rawhide user was seeing this in one of the
    dvb drivers resulting in an oops on boot.

    [ A patch has been sent for testing to the driver, but I feel
    the dma debugging support should be fixed as well. (There's
    still a pile of legacy garbage in the kernel passing null
    pointers to dma_{alloc,free}_*. :( ]

    Signed-off-by: Kyle McMartin
    Cc: mchehab@infradead.org
    Cc: Joerg Roedel
    LKML-Reference:
    Signed-off-by: Ingo Molnar

    Kyle McMartin
     

11 Jul, 2009

1 commit

  • Linus noticed how unclean and buggy the overlap() function is:

    - It uses convoluted (and bug-causing) positive checks for
    range overlap - instead of using a more natural negative
    check.

    - Even the positive checks are buggy: a positive intersection
    check has four natural cases while we checked only for three,
    missing the (addr < start && addr2 == end) case for example.

    - The variables are mis-named, making it non-obvious how the
    check was done.

    - It needlessly uses u64 instead of unsigned long. Since these
    are kernel memory pointers and we explicitly exclude highmem
    ranges anyway we cannot ever overflow 32 bits, even if we
    could. (and on 64-bit it doesnt matter anyway)

    All in one, this function needs a total revamp. I used Linus's
    suggestions minus the paranoid checks (we cannot overflow really
    because if we get totally bad DMA ranges passed far more things
    break in the systems than just DMA debugging). I also fixed a
    few other small details i noticed.

    Reported-by: Linus Torvalds
    Cc: Joerg Roedel
    Signed-off-by: Ingo Molnar

    Ingo Molnar
     

17 Jun, 2009

1 commit

  • Alan Cox reported that lockdep runs out of its stack-trace entries
    with certain configs:

    BUG: MAX_STACK_TRACE_ENTRIES too low

    This happens because there are 1024 hash buckets, each with a
    separate lock. Lockdep puts each lock into a separate lock class and
    tracks them independently.

    But in reality we never take more than one of the buckets, so they
    really belong into a single lock-class. Annotate the has bucket lock
    init accordingly.

    [ Impact: reduce the lockdep footprint of dma-debug ]

    Reported-by: Alan Cox
    Signed-off-by: Ingo Molnar
    Signed-off-by: Joerg Roedel

    Ingo Molnar
     

16 Jun, 2009

1 commit


15 Jun, 2009

2 commits


08 Jun, 2009

5 commits


07 Jun, 2009

2 commits

  • …/joro/linux-2.6-iommu into core/iommu

    Ingo Molnar
     
  • Some device drivers map the same physical address multiple times to a
    dma address. Without an IOMMU this results in the same dma address being
    put into the dma-debug hash multiple times. With a first-fit match in
    hash_bucket_find() this function may return the wrong dma_debug_entry.

    This can result in false positive warnings. This patch fixes it by
    changing the first-fit behavior of hash_bucket_find() into a best-fit
    algorithm.

    Reported-by: Torsten Kaiser
    Reported-by: FUJITA Tomonori
    Signed-off-by: Joerg Roedel
    Cc: lethal@linux-sh.org
    Cc: just.for.lkml@googlemail.com
    Cc: hancockrwd@gmail.com
    Cc: jens.axboe@oracle.com
    Cc: bharrosh@panasas.com
    Cc: FUJITA Tomonori
    Cc: Linus Torvalds
    Cc:
    LKML-Reference:
    Signed-off-by: Ingo Molnar

    Joerg Roedel
     

02 Jun, 2009

4 commits


29 May, 2009

3 commits

  • DMA-mapping.txt says that debug_dma_sync_sg family must be called with
    the _same_ one you passed into the dma_map_sg call, it should _NOT_ be
    the 'count' value _returned_ from the dma_map_sg call.

    debug_dma_sync_sg_for_cpu and debug_dma_sync_sg_for_device can't
    handle this properly; they need to use the sg_mapped_ents in struct
    dma_debug_entry as debug_dma_unmap_sg() does.

    Signed-off-by: FUJITA Tomonori
    Signed-off-by: Joerg Roedel

    FUJITA Tomonori
     
  • debug_dma_map_sg() and debug_dma_unmap_sg() use length in struct
    scatterlist while debug_dma_sync_sg_for_cpu() and
    debug_dma_sync_sg_for_device() use dma_length. This causes bugs
    warnings on some IOMMU implementations since these values are not
    same; the length doesn't represent the dma length.

    We always need to use sg_dma_len() accessor to get the dma length of a
    scatterlist entry.

    Signed-off-by: FUJITA Tomonori
    Signed-off-by: Joerg Roedel

    FUJITA Tomonori
     
  • Architectures might not have dma_address in struct scatterlist (PARISC
    doesn't). Directly accessing to dma_address in struct scatterlist is
    wrong; we need to use sg_dma_address() accesssor instead.

    Signed-off-by: FUJITA Tomonori
    Signed-off-by: Joerg Roedel

    FUJITA Tomonori
     

28 May, 2009

1 commit


11 May, 2009

1 commit


27 Apr, 2009

1 commit

  • The feature needs some more work because the notfier which is used to
    check for pending allocations is called before the device drivers
    ->remove() function. Therefore this feature reports false positives.

    A real fix for this issue is to introduce a new notifier event which sent
    _after_ the driver has deinitialized itself. That will done for the next
    kernel version.

    [ Impact: reduce the scope of CONFIG_DMA_API_DEBUG=y checks ]

    Signed-off-by: Joerg Roedel
    Cc: iommu@lists.linux-foundation.org
    LKML-Reference:
    Signed-off-by: Ingo Molnar

    Joerg Roedel
     

15 Apr, 2009

1 commit

  • We use a static value for the number of dma_debug_entries. It can be
    overwritten by a kernel command line option.

    Some IOMMUs (e.g. GART) can't set an appropriate value by a kernel
    command line option because they can't know such value until they
    finish initializing up their hardware.

    This patch adds dma_debug_resize_entries() enables IOMMUs to adjust
    the number of dma_debug_entries anytime.

    Signed-off-by: FUJITA Tomonori
    Acked-by: Joerg Roedel
    Cc: fujita.tomonori@lab.ntt.co.jp
    Cc: akpm@linux-foundation.org
    LKML-Reference:
    Signed-off-by: Ingo Molnar

    FUJITA Tomonori
     

31 Mar, 2009

1 commit

  • Fix printk format warnings in dma-debug:

    lib/dma-debug.c:645: warning: format '%016llx' expects type 'long long unsigned int', but argument 6 has type 'dma_addr_t'
    lib/dma-debug.c:662: warning: format '%016llx' expects type 'long long unsigned int', but argument 6 has type 'dma_addr_t'
    lib/dma-debug.c:676: warning: format '%016llx' expects type 'long long unsigned int', but argument 6 has type 'dma_addr_t'
    lib/dma-debug.c:686: warning: format '%016llx' expects type 'long long unsigned int', but argument 6 has type 'dma_addr_t'

    Signed-off-by: Randy Dunlap
    Signed-off-by: Linus Torvalds

    Randy Dunlap
     

24 Mar, 2009

1 commit

  • Impact: extend on-kernel-stack DMA debug checks to all !highmem pages

    We only checked dma_map_single() - extend it to dma_map_page()
    and dma_map_sg() as well.

    Also, fix dma_map_single() corner case bug: make sure we dont
    stack-check highmem (not mapped) pages.

    Reported-by: FUJITA Tomonori
    Signed-off-by: Joerg Roedel
    Cc: iommu@lists.linux-foundation.org
    LKML-Reference:
    Signed-off-by: Ingo Molnar

    Joerg Roedel
     

19 Mar, 2009

1 commit