3 * drivers/gpu/ion/ion.c
5 * Copyright (C) 2011 Google, Inc.
7 * This software is licensed under the terms of the GNU General Public
8 * License version 2, as published by the Free Software Foundation, and
9 * may be copied, distributed, and modified under those terms.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
18 #include <linux/device.h>
19 #include <linux/err.h>
20 #include <linux/atomic.h>
21 #include <linux/file.h>
22 #include <linux/freezer.h>
24 #include <linux/anon_inodes.h>
25 #include <linux/kthread.h>
26 #include <linux/list.h>
27 #include <linux/memblock.h>
28 #include <linux/miscdevice.h>
29 #include <linux/export.h>
31 #include <linux/mm_types.h>
32 #include <linux/rbtree.h>
33 #include <linux/slab.h>
34 #include <linux/seq_file.h>
35 #include <linux/uaccess.h>
36 #include <linux/vmalloc.h>
37 #include <linux/debugfs.h>
38 #include <linux/dma-buf.h>
39 #include <linux/idr.h>
40 #include <linux/mtk_ion.h>
43 #include "compat_ion.h"
44 #include "ion_profile.h"
48 #include <linux/ion_drv.h>
49 #include "ion_debug.h"
50 #include "ion_debug_db.h"
51 #include <linux/kallsyms.h>
52 #include <linux/module.h>
53 #define ION_DEBUG_INFO KERN_DEBUG
54 #define ION_DEBUG_TRACE KERN_DEBUG
55 #define ION_DEBUG_ERROR KERN_ERR
56 #define ION_DEBUG_WARN KERN_WARNING
57 extern struct mutex buffer_lifecycle_mutex
;
60 #define DEBUG_HEAP_SHRINKER
62 #if 0 //we move it to ion_priv.h. so we can dump every buffer info in ion_mm_heap.c
64 * struct ion_device - the metadata of the ion device node
65 * @dev: the actual misc device
66 * @buffers: an rb tree of all the existing buffers
67 * @buffer_lock: lock protecting the tree of buffers
68 * @lock: rwsem protecting the tree of heaps and clients
69 * @heaps: list of all the heaps in the system
70 * @user_clients: list of all the clients created from userspace
73 struct miscdevice dev
;
74 struct rb_root buffers
;
75 struct mutex buffer_lock
;
76 struct rw_semaphore lock
;
77 struct plist_head heaps
;
78 long (*custom_ioctl
) (struct ion_client
*client
, unsigned int cmd
,
80 struct rb_root clients
;
81 struct dentry
*debug_root
;
82 struct dentry
*heaps_debug_root
;
83 struct dentry
*clients_debug_root
;
87 * struct ion_client - a process/hw block local address space
88 * @node: node in the tree of all clients
89 * @dev: backpointer to ion device
90 * @handles: an rb tree of all the handles in this client
91 * @idr: an idr space for allocating handle ids
92 * @lock: lock protecting the tree of handles
93 * @name: used for debugging
94 * @display_name: used for debugging (unique version of @name)
95 * @display_serial: used for debugging (to make display_name unique)
96 * @task: used for debugging
98 * A client represents a list of buffers this client may access.
99 * The mutex stored here is used to protect both handles tree
100 * as well as the handles themselves, and should be held while modifying either.
104 struct ion_device
*dev
;
105 struct rb_root handles
;
111 struct task_struct
*task
;
113 struct dentry
*debug_root
;
116 struct ion_handle_debug
{
119 unsigned int backtrace
[BACKTRACE_SIZE
];
120 unsigned int backtrace_num
;
124 * ion_handle - a client local reference to a buffer
125 * @ref: reference count
126 * @client: back pointer to the client the buffer resides in
127 * @buffer: pointer to the buffer
128 * @node: node in the client's handle rbtree
129 * @kmap_cnt: count of times this client has mapped to kernel
130 * @id: client-unique id allocated by client->idr
132 * Modifications to node, map_cnt or mapping should be protected by the
133 * lock in the client. Other fields are never changed after initialization.
137 struct ion_client
*client
;
138 struct ion_buffer
*buffer
;
140 unsigned int kmap_cnt
;
142 #if ION_RUNTIME_DEBUGGER
143 struct ion_handle_debug dbg
;
150 static void ion_debug_db_create_clentry(pid_t
);
151 static void ion_debug_db_destroy_clentry(pid_t pid
);
152 static void ion_debug_create_db(struct dentry
*root
);
155 static int ion_debug_kern_rec(struct ion_client
*client
,
156 struct ion_buffer
*buffer
,
157 struct ion_handle
* handle
,
159 unsigned int address_type
,
160 unsigned int address
,
164 bool ion_buffer_fault_user_mappings(struct ion_buffer
*buffer
)
166 return (buffer
->flags
& ION_FLAG_CACHED
) &&
167 !(buffer
->flags
& ION_FLAG_CACHED_NEEDS_SYNC
);
170 bool ion_buffer_cached(struct ion_buffer
*buffer
)
172 return !!(buffer
->flags
& ION_FLAG_CACHED
);
175 static inline struct page
*ion_buffer_page(struct page
*page
)
177 return (struct page
*)((unsigned long)page
& ~(1UL));
180 static inline bool ion_buffer_page_is_dirty(struct page
*page
)
182 return !!((unsigned long)page
& 1UL);
185 static inline void ion_buffer_page_dirty(struct page
**page
)
187 *page
= (struct page
*)((unsigned long)(*page
) | 1UL);
190 static inline void ion_buffer_page_clean(struct page
**page
)
192 *page
= (struct page
*)((unsigned long)(*page
) & ~(1UL));
195 /* this function should only be called while dev->lock is held */
196 static void ion_buffer_add(struct ion_device
*dev
,
197 struct ion_buffer
*buffer
)
199 struct rb_node
**p
= &dev
->buffers
.rb_node
;
200 struct rb_node
*parent
= NULL
;
201 struct ion_buffer
*entry
;
205 entry
= rb_entry(parent
, struct ion_buffer
, node
);
207 if (buffer
< entry
) {
209 } else if (buffer
> entry
) {
212 pr_err("%s: buffer already found.", __func__
);
217 rb_link_node(&buffer
->node
, parent
, p
);
218 rb_insert_color(&buffer
->node
, &dev
->buffers
);
221 /* this function should only be called while dev->lock is held */
222 static struct ion_buffer
*ion_buffer_create(struct ion_heap
*heap
,
223 struct ion_device
*dev
,
228 struct ion_buffer
*buffer
;
229 struct sg_table
*table
;
230 struct scatterlist
*sg
;
233 buffer
= kzalloc(sizeof(struct ion_buffer
), GFP_KERNEL
);
235 IONMSG("%s kzalloc failed, buffer is null.\n", __func__
);
236 return ERR_PTR(-ENOMEM
);
240 buffer
->flags
= flags
;
241 kref_init(&buffer
->ref
);
243 ret
= heap
->ops
->allocate(heap
, buffer
, len
, align
, flags
);
246 if (!(heap
->flags
& ION_HEAP_FLAG_DEFER_FREE
))
249 ion_heap_freelist_drain(heap
, 0);
250 ret
= heap
->ops
->allocate(heap
, buffer
, len
, align
,
259 table
= heap
->ops
->map_dma(heap
, buffer
);
260 if (WARN_ONCE(table
== NULL
,
261 "heap->ops->map_dma should return ERR_PTR on error"))
262 table
= ERR_PTR(-EINVAL
);
264 IONMSG("%s table is err 0x%p.\n", __func__
, table
);
265 heap
->ops
->free(buffer
);
267 return ERR_PTR(PTR_ERR(table
));
269 buffer
->sg_table
= table
;
270 if (ion_buffer_fault_user_mappings(buffer
)) {
271 int num_pages
= PAGE_ALIGN(buffer
->size
) / PAGE_SIZE
;
272 struct scatterlist
*sg
;
275 buffer
->pages
= vmalloc(sizeof(struct page
*) * num_pages
);
276 if (!buffer
->pages
) {
277 IONMSG("%s vamlloc failed pages is null.\n", __func__
);
282 for_each_sg(table
->sgl
, sg
, table
->nents
, i
) {
283 struct page
*page
= sg_page(sg
);
285 for (j
= 0; j
< sg
->length
/ PAGE_SIZE
; j
++)
286 buffer
->pages
[k
++] = page
++;
295 INIT_LIST_HEAD(&buffer
->vmas
);
297 //log task pid for debug +by k.zhang
299 struct task_struct
*task
;
300 task
= current
->group_leader
;
301 get_task_comm(buffer
->task_comm
, task
);
302 buffer
->pid
= task_pid_nr(task
);
305 mutex_init(&buffer
->lock
);
306 /* this will set up dma addresses for the sglist -- it is not
307 technically correct as per the dma api -- a specific
308 device isn't really taking ownership here. However, in practice on
309 our systems the only dma_address space is physical addresses.
310 Additionally, we can't afford the overhead of invalidating every
311 allocation via dma_map_sg. The implicit contract here is that
312 memory comming from the heaps is ready for dma, ie if it has a
313 cached mapping that mapping has been invalidated */
314 for_each_sg(buffer
->sg_table
->sgl
, sg
, buffer
->sg_table
->nents
, i
) {
315 sg_dma_address(sg
) = sg_phys(sg
);
316 #ifdef CONFIG_NEED_SG_DMA_LENGTH
317 sg
->dma_length
= sg
->length
;
320 mutex_lock(&dev
->buffer_lock
);
321 ion_buffer_add(dev
, buffer
);
322 mutex_unlock(&dev
->buffer_lock
);
326 heap
->ops
->unmap_dma(heap
, buffer
);
327 heap
->ops
->free(buffer
);
330 vfree(buffer
->pages
);
336 void ion_buffer_destroy(struct ion_buffer
*buffer
)
338 if (WARN_ON(buffer
->kmap_cnt
> 0))
339 buffer
->heap
->ops
->unmap_kernel(buffer
->heap
, buffer
);
340 buffer
->heap
->ops
->unmap_dma(buffer
->heap
, buffer
);
341 buffer
->heap
->ops
->free(buffer
);
343 vfree(buffer
->pages
);
347 static void _ion_buffer_destroy(struct kref
*kref
)
349 struct ion_buffer
*buffer
= container_of(kref
, struct ion_buffer
, ref
);
350 struct ion_heap
*heap
= buffer
->heap
;
351 struct ion_device
*dev
= buffer
->dev
;
353 mutex_lock(&dev
->buffer_lock
);
354 rb_erase(&buffer
->node
, &dev
->buffers
);
355 mutex_unlock(&dev
->buffer_lock
);
357 if (heap
->flags
& ION_HEAP_FLAG_DEFER_FREE
)
358 ion_heap_freelist_add(heap
, buffer
);
360 ion_buffer_destroy(buffer
);
363 static void ion_buffer_get(struct ion_buffer
*buffer
)
365 kref_get(&buffer
->ref
);
368 static int ion_buffer_put(struct ion_buffer
*buffer
)
370 return kref_put(&buffer
->ref
, _ion_buffer_destroy
);
373 static void ion_buffer_add_to_handle(struct ion_buffer
*buffer
)
375 mutex_lock(&buffer
->lock
);
376 buffer
->handle_count
++;
377 mutex_unlock(&buffer
->lock
);
380 static void ion_buffer_remove_from_handle(struct ion_buffer
*buffer
)
383 * when a buffer is removed from a handle, if it is not in
384 * any other handles, copy the taskcomm and the pid of the
385 * process it's being removed from into the buffer. At this
386 * point there will be no way to track what processes this buffer is
387 * being used by, it only exists as a dma_buf file descriptor.
388 * The taskcomm and pid can provide a debug hint as to where this fd
391 mutex_lock(&buffer
->lock
);
392 buffer
->handle_count
--;
393 BUG_ON(buffer
->handle_count
< 0);
394 if (!buffer
->handle_count
) {
395 struct task_struct
*task
;
397 task
= current
->group_leader
;
398 get_task_comm(buffer
->task_comm
, task
);
399 buffer
->pid
= task_pid_nr(task
);
401 mutex_unlock(&buffer
->lock
);
404 static struct ion_handle
*ion_handle_create(struct ion_client
*client
,
405 struct ion_buffer
*buffer
)
407 struct ion_handle
*handle
;
409 handle
= kzalloc(sizeof(struct ion_handle
), GFP_KERNEL
);
411 IONMSG("%s kzalloc failed handle is null.\n", __func__
);
412 return ERR_PTR(-ENOMEM
);
414 kref_init(&handle
->ref
);
415 RB_CLEAR_NODE(&handle
->node
);
416 handle
->client
= client
;
417 ion_buffer_get(buffer
);
418 ion_buffer_add_to_handle(buffer
);
419 handle
->buffer
= buffer
;
424 static void ion_handle_kmap_put(struct ion_handle
*);
426 static void ion_handle_destroy(struct kref
*kref
)
428 struct ion_handle
*handle
= container_of(kref
, struct ion_handle
, ref
);
429 struct ion_client
*client
= handle
->client
;
430 struct ion_buffer
*buffer
= handle
->buffer
;
432 mutex_lock(&buffer
->lock
);
433 while (handle
->kmap_cnt
)
434 ion_handle_kmap_put(handle
);
435 mutex_unlock(&buffer
->lock
);
437 idr_remove(&client
->idr
, handle
->id
);
438 if (!RB_EMPTY_NODE(&handle
->node
))
439 rb_erase(&handle
->node
, &client
->handles
);
441 ion_buffer_remove_from_handle(buffer
);
442 ion_buffer_put(buffer
);
444 handle
->buffer
= NULL
;
445 handle
->client
= NULL
;
450 struct ion_buffer
*ion_handle_buffer(struct ion_handle
*handle
)
452 return handle
->buffer
;
455 static void ion_handle_get(struct ion_handle
*handle
)
457 kref_get(&handle
->ref
);
460 /* Must hold the client lock */
461 static struct ion_handle
* ion_handle_get_check_overflow(struct ion_handle
*handle
)
463 if (atomic_read(&handle
->ref
.refcount
) + 1 == 0)
464 return ERR_PTR(-EOVERFLOW
);
465 ion_handle_get(handle
);
469 static int ion_handle_put_nolock(struct ion_handle
*handle
)
473 ret
= kref_put(&handle
->ref
, ion_handle_destroy
);
478 int ion_handle_put(struct ion_handle
*handle
)
480 struct ion_client
*client
= handle
->client
;
483 mutex_lock(&client
->lock
);
484 ret
= ion_handle_put_nolock(handle
);
485 mutex_unlock(&client
->lock
);
490 /* Must hold the client lock */
491 static void user_ion_handle_get(struct ion_handle
*handle
)
493 if (handle
->user_ref_count
++ == 0)
494 kref_get(&handle
->ref
);
498 /* Must hold the client lock */
499 static struct ion_handle
*user_ion_handle_get_check_overflow(struct ion_handle
*handle
)
501 if (handle
->user_ref_count
+ 1 == 0)
502 return ERR_PTR(-EOVERFLOW
);
503 user_ion_handle_get(handle
);
506 /* passes a kref to the user ref count.
507 * We know we're holding a kref to the object before and
508 * after this call, so no need to reverify handle.
510 static struct ion_handle
*pass_to_user(struct ion_handle
*handle
)
512 struct ion_client
*client
= handle
->client
;
513 struct ion_handle
*ret
;
514 mutex_lock(&client
->lock
);
515 ret
= user_ion_handle_get_check_overflow(handle
);
516 ion_handle_put_nolock(handle
);
517 mutex_unlock(&client
->lock
);
521 /* Must hold the client lock */
522 static int user_ion_handle_put_nolock(struct ion_handle
*handle
)
525 if (--handle
->user_ref_count
== 0)
526 ret
= ion_handle_put_nolock(handle
);
530 static struct ion_handle
*ion_handle_lookup(struct ion_client
*client
,
531 struct ion_buffer
*buffer
)
533 struct rb_node
*n
= client
->handles
.rb_node
;
536 struct ion_handle
*entry
= rb_entry(n
, struct ion_handle
, node
);
537 if (buffer
< entry
->buffer
)
539 else if (buffer
> entry
->buffer
)
544 return ERR_PTR(-EINVAL
);
547 static struct ion_handle
*ion_handle_get_by_id_nolock(struct ion_client
*client
,
550 struct ion_handle
*handle
;
552 handle
= idr_find(&client
->idr
, id
);
554 return ion_handle_get_check_overflow(handle
);
556 return ERR_PTR(-EINVAL
);
559 struct ion_handle
*ion_handle_get_by_id(struct ion_client
*client
,
562 struct ion_handle
*handle
;
564 mutex_lock(&client
->lock
);
565 handle
= ion_handle_get_by_id_nolock(client
, id
);
566 mutex_unlock(&client
->lock
);
572 static bool ion_handle_validate(struct ion_client
*client
,
573 struct ion_handle
*handle
)
575 WARN_ON(!mutex_is_locked(&client
->lock
));
576 return (idr_find(&client
->idr
, handle
->id
) == handle
);
579 static int ion_handle_add(struct ion_client
*client
, struct ion_handle
*handle
)
582 struct rb_node
**p
= &client
->handles
.rb_node
;
583 struct rb_node
*parent
= NULL
;
584 struct ion_handle
*entry
;
586 id
= idr_alloc(&client
->idr
, handle
, 1, 0, GFP_KERNEL
);
588 IONMSG("%s idr_alloc failed id = %d.\n", __func__
, id
);
596 entry
= rb_entry(parent
, struct ion_handle
, node
);
598 if (handle
->buffer
< entry
->buffer
)
600 else if (handle
->buffer
> entry
->buffer
)
603 WARN(1, "%s: buffer already found.", __func__
);
606 rb_link_node(&handle
->node
, parent
, p
);
607 rb_insert_color(&handle
->node
, &client
->handles
);
612 struct ion_handle
*__ion_alloc(struct ion_client
*client
, size_t len
,
613 size_t align
, unsigned int heap_id_mask
,
614 unsigned int flags
, bool grab_handle
)
616 struct ion_handle
*handle
;
617 struct ion_device
*dev
= client
->dev
;
618 struct ion_buffer
*buffer
= NULL
;
619 struct ion_heap
*heap
;
622 pr_debug("%s: len %zu align %zu heap_id_mask %u flags %x\n", __func__
,
623 len
, align
, heap_id_mask
, flags
);
625 * traverse the list of heaps available in this system in priority
626 * order. If the heap type is supported by the client, and matches the
627 * request of the caller allocate from it. Repeat until allocate has
628 * succeeded or all heaps have been tried
630 len
= PAGE_ALIGN(len
);
633 IONMSG("%s len cannot be zero.\n", __func__
);
634 return ERR_PTR(-EINVAL
);
637 //add by k.zhang for sgtable_init KE bug
638 if((len
> 1024*1024*1024))
640 IONMSG("%s error: size (%zu) is more than 1G !!\n", __FUNCTION__
,len
);
641 return ERR_PTR(-EINVAL
);
643 MMProfileLogEx(ION_MMP_Events
[PROFILE_ALLOC
], MMProfileFlagStart
, len
, 0);
645 down_read(&dev
->lock
);
646 plist_for_each_entry(heap
, &dev
->heaps
, node
) {
647 /* if the caller didn't specify this heap id */
648 if (!((1 << heap
->id
) & heap_id_mask
))
650 buffer
= ion_buffer_create(heap
, dev
, len
, align
, flags
);
656 if (buffer
== NULL
) {
657 IONMSG("%s buffer is null.\n", __func__
);
658 return ERR_PTR(-ENODEV
);
661 if (IS_ERR(buffer
)) {
662 IONMSG("%s buffer is error 0x%p.\n", __func__
, buffer
);
663 return ERR_PTR(PTR_ERR(buffer
));
666 handle
= ion_handle_create(client
, buffer
);
669 * ion_buffer_create will create a buffer with a ref_cnt of 1,
670 * and ion_handle_create will take a second reference, drop one here
672 ion_buffer_put(buffer
);
674 if (IS_ERR(handle
)) {
675 IONMSG("%s handle is error 0x%p.\n", __func__
, handle
);
679 mutex_lock(&client
->lock
);
681 ion_handle_get(handle
);
682 ret
= ion_handle_add(client
, handle
);
683 mutex_unlock(&client
->lock
);
685 ion_handle_put(handle
);
686 handle
= ERR_PTR(ret
);
687 IONMSG("%s ion handle add failed %d.\n", __func__
, ret
);
690 MMProfileLogEx(ION_MMP_Events
[PROFILE_ALLOC
], MMProfileFlagEnd
, buffer
->size
, 0);
695 struct ion_handle
*ion_alloc(struct ion_client
*client
, size_t len
,
696 size_t align
, unsigned int heap_id_mask
,
699 return __ion_alloc(client
, len
, align
, heap_id_mask
, flags
, false);
701 EXPORT_SYMBOL(ion_alloc
);
703 static void user_ion_free_nolock(struct ion_client
*client
, struct ion_handle
*handle
)
706 BUG_ON(client
!= handle
->client
);
707 valid_handle
= ion_handle_validate(client
, handle
);
709 WARN(1, "%s: invalid handle passed to free.\n", __func__
);
712 if (!handle
->user_ref_count
> 0) {
713 WARN(1, "%s: User does not have access!\n", __func__
);
716 user_ion_handle_put_nolock(handle
);
718 static void ion_free_nolock(struct ion_client
*client
, struct ion_handle
*handle
)
722 BUG_ON(client
!= handle
->client
);
724 valid_handle
= ion_handle_validate(client
, handle
);
727 WARN(1, "%s: invalid handle passed to free.\n", __func__
);
730 ion_handle_put_nolock(handle
);
733 void ion_free(struct ion_client
*client
, struct ion_handle
*handle
)
735 BUG_ON(client
!= handle
->client
);
737 mutex_lock(&client
->lock
);
738 ion_free_nolock(client
, handle
);
739 mutex_unlock(&client
->lock
);
741 ion_debug_kern_rec(client
, handle
->buffer
, NULL
, ION_FUNCTION_FREE
, 0, 0, 0, 0);
743 EXPORT_SYMBOL(ion_free
);
745 int ion_phys(struct ion_client
*client
, struct ion_handle
*handle
,
746 ion_phys_addr_t
*addr
, size_t *len
)
748 struct ion_buffer
*buffer
;
750 MMProfileLogEx(ION_MMP_Events
[PROFILE_GET_PHYS
], MMProfileFlagStart
, (unsigned long)client
, (unsigned long)handle
);
752 mutex_lock(&client
->lock
);
753 if (!ion_handle_validate(client
, handle
)) {
754 mutex_unlock(&client
->lock
);
755 IONMSG("%s invalid handle pass to phys.\n", __func__
);
759 buffer
= handle
->buffer
;
761 if (!buffer
->heap
->ops
->phys
) {
762 pr_err("%s: ion_phys is not implemented by this heap.\n",
764 mutex_unlock(&client
->lock
);
767 mutex_unlock(&client
->lock
);
768 ret
= buffer
->heap
->ops
->phys(buffer
->heap
, buffer
, addr
, len
);
770 MMProfileLogEx(ION_MMP_Events
[PROFILE_GET_PHYS
], MMProfileFlagEnd
, buffer
->size
, *addr
);
774 EXPORT_SYMBOL(ion_phys
);
776 static void *ion_buffer_kmap_get(struct ion_buffer
*buffer
)
780 if (buffer
->kmap_cnt
) {
782 return buffer
->vaddr
;
784 vaddr
= buffer
->heap
->ops
->map_kernel(buffer
->heap
, buffer
);
785 if (WARN_ONCE(vaddr
== NULL
,
786 "heap->ops->map_kernel should return ERR_PTR on error"))
787 return ERR_PTR(-EINVAL
);
789 IONMSG("%s map kernel is failed addr = 0x%p.\n", __func__
, vaddr
);
792 buffer
->vaddr
= vaddr
;
797 static void *ion_handle_kmap_get(struct ion_handle
*handle
)
799 struct ion_buffer
*buffer
= handle
->buffer
;
802 if (handle
->kmap_cnt
) {
804 return buffer
->vaddr
;
806 vaddr
= ion_buffer_kmap_get(buffer
);
808 IONMSG("%s vadd is error 0x%p.\n", __func__
, vaddr
);
815 static void ion_buffer_kmap_put(struct ion_buffer
*buffer
)
818 if (!buffer
->kmap_cnt
) {
819 MMProfileLogEx(ION_MMP_Events
[PROFILE_UNMAP_KERNEL
], MMProfileFlagStart
, buffer
->size
, 0);
820 buffer
->heap
->ops
->unmap_kernel(buffer
->heap
, buffer
);
821 MMProfileLogEx(ION_MMP_Events
[PROFILE_UNMAP_KERNEL
], MMProfileFlagEnd
, buffer
->size
, 0);
822 buffer
->vaddr
= NULL
;
826 static void ion_handle_kmap_put(struct ion_handle
*handle
)
828 struct ion_buffer
*buffer
= handle
->buffer
;
831 if (!handle
->kmap_cnt
)
832 ion_buffer_kmap_put(buffer
);
835 void *ion_map_kernel(struct ion_client
*client
, struct ion_handle
*handle
)
837 struct ion_buffer
*buffer
;
840 mutex_lock(&client
->lock
);
841 if (!ion_handle_validate(client
, handle
)) {
842 pr_err("%s: invalid handle passed to map_kernel.\n",
844 mutex_unlock(&client
->lock
);
845 return ERR_PTR(-EINVAL
);
848 buffer
= handle
->buffer
;
850 if (!handle
->buffer
->heap
->ops
->map_kernel
) {
851 pr_err("%s: map_kernel is not implemented by this heap.\n",
853 mutex_unlock(&client
->lock
);
854 return ERR_PTR(-ENODEV
);
857 mutex_lock(&buffer
->lock
);
858 vaddr
= ion_handle_kmap_get(handle
);
859 mutex_unlock(&buffer
->lock
);
860 mutex_unlock(&client
->lock
);
862 ion_debug_kern_rec(client
, handle
->buffer
, handle
, ION_FUNCTION_MMAP
,
863 ADDRESS_KERNEL_VIRTUAL
, (unsigned long)vaddr
, handle
->buffer
->size
, 0);
867 EXPORT_SYMBOL(ion_map_kernel
);
869 void ion_unmap_kernel(struct ion_client
*client
, struct ion_handle
*handle
)
871 struct ion_buffer
*buffer
;
873 ion_debug_kern_rec(client
, handle
->buffer
, handle
, ION_FUNCTION_MUNMAP
,
874 ADDRESS_KERNEL_VIRTUAL
, (unsigned long)handle
->buffer
->vaddr
, handle
->buffer
->size
, 0);
876 mutex_lock(&client
->lock
);
877 buffer
= handle
->buffer
;
878 mutex_lock(&buffer
->lock
);
879 ion_handle_kmap_put(handle
);
880 mutex_unlock(&buffer
->lock
);
881 mutex_unlock(&client
->lock
);
883 EXPORT_SYMBOL(ion_unmap_kernel
);
885 static int ion_debug_client_show(struct seq_file
*s
, void *unused
)
887 struct ion_client
*client
= s
->private;
889 size_t sizes
[ION_NUM_HEAP_IDS
] = {0};
890 const char *names
[ION_NUM_HEAP_IDS
] = {NULL
};
893 mutex_lock(&client
->lock
);
894 for (n
= rb_first(&client
->handles
); n
; n
= rb_next(n
)) {
895 struct ion_handle
*handle
= rb_entry(n
, struct ion_handle
,
897 unsigned int id
= handle
->buffer
->heap
->id
;
900 names
[id
] = handle
->buffer
->heap
->name
;
901 sizes
[id
] += handle
->buffer
->size
;
903 mutex_unlock(&client
->lock
);
905 seq_printf(s
, "%16.16s: %16.16s\n", "heap_name", "size_in_bytes");
906 for (i
= 0; i
< ION_NUM_HEAP_IDS
; i
++) {
909 seq_printf(s
, "%16.16s: %16zu\n", names
[i
], sizes
[i
]);
914 static int ion_debug_client_open(struct inode
*inode
, struct file
*file
)
916 return single_open(file
, ion_debug_client_show
, inode
->i_private
);
919 static const struct file_operations debug_client_fops
= {
920 .open
= ion_debug_client_open
,
923 .release
= single_release
,
926 static int ion_get_client_serial(const struct rb_root
*root
,
927 const unsigned char *name
)
930 struct rb_node
*node
;
931 for (node
= rb_first(root
); node
; node
= rb_next(node
)) {
932 struct ion_client
*client
= rb_entry(node
, struct ion_client
,
934 if (strcmp(client
->name
, name
))
936 serial
= max(serial
, client
->display_serial
);
941 struct ion_client
*__ion_client_create(struct ion_device
*dev
,
944 struct ion_client
*client
;
945 struct task_struct
*task
;
947 struct rb_node
*parent
= NULL
;
948 struct ion_client
*entry
;
952 pr_err("%s: Name cannot be null\n", __func__
);
953 return ERR_PTR(-EINVAL
);
956 get_task_struct(current
->group_leader
);
957 task_lock(current
->group_leader
);
958 pid
= task_pid_nr(current
->group_leader
);
959 /* don't bother to store task struct for kernel threads,
960 they can't be killed anyway */
961 if (current
->group_leader
->flags
& PF_KTHREAD
) {
962 put_task_struct(current
->group_leader
);
965 task
= current
->group_leader
;
967 task_unlock(current
->group_leader
);
969 client
= kzalloc(sizeof(struct ion_client
), GFP_KERNEL
);
971 goto err_put_task_struct
;
974 client
->handles
= RB_ROOT
;
975 idr_init(&client
->idr
);
976 mutex_init(&client
->lock
);
979 client
->name
= kstrdup(name
, GFP_KERNEL
);
981 goto err_free_client
;
983 down_write(&dev
->lock
);
984 client
->display_serial
= ion_get_client_serial(&dev
->clients
, name
);
985 client
->display_name
= kasprintf(
986 GFP_KERNEL
, "%s-%d", name
, client
->display_serial
);
987 if (!client
->display_name
) {
988 up_write(&dev
->lock
);
989 goto err_free_client_name
;
991 p
= &dev
->clients
.rb_node
;
994 entry
= rb_entry(parent
, struct ion_client
, node
);
998 else if (client
> entry
)
1001 rb_link_node(&client
->node
, parent
, p
);
1002 rb_insert_color(&client
->node
, &dev
->clients
);
1004 client
->debug_root
= debugfs_create_file(client
->display_name
, 0664,
1005 dev
->clients_debug_root
,
1006 client
, &debug_client_fops
);
1007 if (!client
->debug_root
) {
1008 char buf
[256], *path
;
1009 path
= dentry_path(dev
->clients_debug_root
, buf
, 256);
1010 pr_err("Failed to create client debugfs at %s/%s\n",
1011 path
, client
->display_name
);
1014 up_write(&dev
->lock
);
1017 ion_debug_db_create_clentry(client
->pid
);
1021 err_free_client_name
:
1022 kfree(client
->name
);
1025 err_put_task_struct
:
1027 put_task_struct(current
->group_leader
);
1028 return ERR_PTR(-ENOMEM
);
1032 struct ion_client
*ion_client_create(struct ion_device
*dev
,
1035 struct ion_client
*client
;
1037 client
= __ion_client_create(dev
, name
);
1038 if(IS_ERR_OR_NULL(client
)) {
1039 IONMSG("%s client is error or null 0x%p.\n", __func__
, client
);
1043 ion_debug_kern_rec(client
, NULL
, NULL
, ION_FUNCTION_CREATE_CLIENT
, 0, 0, 0, 0);
1047 EXPORT_SYMBOL(ion_client_create
);
1049 void __ion_client_destroy(struct ion_client
*client
, int from_kern
)
1051 struct ion_device
*dev
= client
->dev
;
1054 pr_debug("%s: %d\n", __func__
, __LINE__
);
1055 while ((n
= rb_first(&client
->handles
))) {
1056 struct ion_handle
*handle
= rb_entry(n
, struct ion_handle
,
1058 mutex_lock(&client
->lock
);
1059 IONMSG("warning: release handle @ client destory: handle=%p, buf=%p, ref=%d, size=%zu, kmap=%d\n",
1060 handle
, handle
->buffer
, atomic_read(&handle
->buffer
->ref
.refcount
), handle
->buffer
->size
, handle
->buffer
->kmap_cnt
);
1061 ion_handle_destroy(&handle
->ref
);
1062 mutex_unlock(&client
->lock
);
1065 idr_destroy(&client
->idr
);
1067 down_write(&dev
->lock
);
1069 put_task_struct(client
->task
);
1070 rb_erase(&client
->node
, &dev
->clients
);
1071 debugfs_remove_recursive(client
->debug_root
);
1072 up_write(&dev
->lock
);
1074 kfree(client
->display_name
);
1075 kfree(client
->name
);
1078 ion_debug_kern_rec(client
, NULL
, NULL
, ION_FUNCTION_DESTROY_CLIENT
, 0, 0, 0, 0);
1079 ion_debug_db_destroy_clentry(client
->pid
);
1085 void ion_client_destroy(struct ion_client
*client
)
1087 __ion_client_destroy(client
, 1);
1089 EXPORT_SYMBOL(ion_client_destroy
);
1091 struct sg_table
*ion_sg_table(struct ion_client
*client
,
1092 struct ion_handle
*handle
)
1094 struct ion_buffer
*buffer
;
1095 struct sg_table
*table
;
1097 mutex_lock(&client
->lock
);
1098 if (!ion_handle_validate(client
, handle
)) {
1099 pr_err("%s: invalid handle passed to map_dma.\n",
1101 mutex_unlock(&client
->lock
);
1102 return ERR_PTR(-EINVAL
);
1104 buffer
= handle
->buffer
;
1105 table
= buffer
->sg_table
;
1106 mutex_unlock(&client
->lock
);
1109 EXPORT_SYMBOL(ion_sg_table
);
1111 static void ion_buffer_sync_for_device(struct ion_buffer
*buffer
,
1113 enum dma_data_direction direction
);
1115 static struct sg_table
*ion_map_dma_buf(struct dma_buf_attachment
*attachment
,
1116 enum dma_data_direction direction
)
1118 struct dma_buf
*dmabuf
= attachment
->dmabuf
;
1119 struct ion_buffer
*buffer
= dmabuf
->priv
;
1121 ion_buffer_sync_for_device(buffer
, attachment
->dev
, direction
);
1122 return buffer
->sg_table
;
1125 static void ion_unmap_dma_buf(struct dma_buf_attachment
*attachment
,
1126 struct sg_table
*table
,
1127 enum dma_data_direction direction
)
1131 void ion_pages_sync_for_device(struct device
*dev
, struct page
*page
,
1132 size_t size
, enum dma_data_direction dir
)
1134 struct scatterlist sg
;
1136 sg_init_table(&sg
, 1);
1137 sg_set_page(&sg
, page
, size
, 0);
1139 * This is not correct - sg_dma_address needs a dma_addr_t that is valid
1140 * for the the targeted device, but this works on the currently targeted
1143 sg_dma_address(&sg
) = page_to_phys(page
);
1144 dma_sync_sg_for_device(dev
, &sg
, 1, dir
);
1147 struct ion_vma_list
{
1148 struct list_head list
;
1149 struct vm_area_struct
*vma
;
1152 static void ion_buffer_sync_for_device(struct ion_buffer
*buffer
,
1154 enum dma_data_direction dir
)
1156 struct ion_vma_list
*vma_list
;
1157 int pages
= PAGE_ALIGN(buffer
->size
) / PAGE_SIZE
;
1160 pr_debug("%s: syncing for device %s\n", __func__
,
1161 dev
? dev_name(dev
) : "null");
1163 if (!ion_buffer_fault_user_mappings(buffer
))
1166 mutex_lock(&buffer
->lock
);
1167 for (i
= 0; i
< pages
; i
++) {
1168 struct page
*page
= buffer
->pages
[i
];
1170 if (ion_buffer_page_is_dirty(page
))
1171 ion_pages_sync_for_device(dev
, ion_buffer_page(page
),
1174 ion_buffer_page_clean(buffer
->pages
+ i
);
1176 list_for_each_entry(vma_list
, &buffer
->vmas
, list
) {
1177 struct vm_area_struct
*vma
= vma_list
->vma
;
1179 zap_page_range(vma
, vma
->vm_start
, vma
->vm_end
- vma
->vm_start
,
1182 mutex_unlock(&buffer
->lock
);
1185 static int ion_vm_fault(struct vm_area_struct
*vma
, struct vm_fault
*vmf
)
1187 struct ion_buffer
*buffer
= vma
->vm_private_data
;
1191 mutex_lock(&buffer
->lock
);
1192 ion_buffer_page_dirty(buffer
->pages
+ vmf
->pgoff
);
1193 BUG_ON(!buffer
->pages
|| !buffer
->pages
[vmf
->pgoff
]);
1195 pfn
= page_to_pfn(ion_buffer_page(buffer
->pages
[vmf
->pgoff
]));
1196 ret
= vm_insert_pfn(vma
, (unsigned long)vmf
->virtual_address
, pfn
);
1197 mutex_unlock(&buffer
->lock
);
1199 IONMSG("%s vm insert pfn failed, vma = 0x%p, addr = 0x%p, pfn = %lu.\n", __func__
, vma
, vmf
->virtual_address
, pfn
);
1200 return VM_FAULT_ERROR
;
1203 return VM_FAULT_NOPAGE
;
1206 static void ion_vm_open(struct vm_area_struct
*vma
)
1208 struct ion_buffer
*buffer
= vma
->vm_private_data
;
1209 struct ion_vma_list
*vma_list
;
1211 vma_list
= kmalloc(sizeof(struct ion_vma_list
), GFP_KERNEL
);
1213 IONMSG("%s kmalloc failed, vma_list is null.\n", __func__
);
1216 vma_list
->vma
= vma
;
1217 mutex_lock(&buffer
->lock
);
1218 list_add(&vma_list
->list
, &buffer
->vmas
);
1219 mutex_unlock(&buffer
->lock
);
1220 pr_debug("%s: adding %p\n", __func__
, vma
);
1223 static void ion_vm_close(struct vm_area_struct
*vma
)
1225 struct ion_buffer
*buffer
= vma
->vm_private_data
;
1226 struct ion_vma_list
*vma_list
, *tmp
;
1228 pr_debug("%s\n", __func__
);
1229 mutex_lock(&buffer
->lock
);
1230 list_for_each_entry_safe(vma_list
, tmp
, &buffer
->vmas
, list
) {
1231 if (vma_list
->vma
!= vma
)
1233 list_del(&vma_list
->list
);
1235 pr_debug("%s: deleting %p\n", __func__
, vma
);
1238 mutex_unlock(&buffer
->lock
);
1241 static struct vm_operations_struct ion_vma_ops
= {
1242 .open
= ion_vm_open
,
1243 .close
= ion_vm_close
,
1244 .fault
= ion_vm_fault
,
1247 static int ion_mmap(struct dma_buf
*dmabuf
, struct vm_area_struct
*vma
)
1249 struct ion_buffer
*buffer
= dmabuf
->priv
;
1252 MMProfileLogEx(ION_MMP_Events
[PROFILE_MAP_USER
], MMProfileFlagStart
, buffer
->size
, vma
->vm_start
);
1254 if (!buffer
->heap
->ops
->map_user
) {
1255 pr_err("%s: this heap does not define a method for mapping "
1256 "to userspace\n", __func__
);
1260 if (ion_buffer_fault_user_mappings(buffer
)) {
1261 vma
->vm_flags
|= VM_IO
| VM_PFNMAP
| VM_DONTEXPAND
|
1263 vma
->vm_private_data
= buffer
;
1264 vma
->vm_ops
= &ion_vma_ops
;
1269 if (!(buffer
->flags
& ION_FLAG_CACHED
))
1270 //vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
1271 vma
->vm_page_prot
= pgprot_writecombine(vma
->vm_page_prot
);
1273 mutex_lock(&buffer
->lock
);
1274 /* now map it to userspace */
1275 ret
= buffer
->heap
->ops
->map_user(buffer
->heap
, buffer
, vma
);
1276 mutex_unlock(&buffer
->lock
);
1279 pr_err("%s: failure mapping buffer to userspace\n",
1281 MMProfileLogEx(ION_MMP_Events
[PROFILE_MAP_USER
], MMProfileFlagEnd
, buffer
->size
, vma
->vm_start
);
1286 static void ion_dma_buf_release(struct dma_buf
*dmabuf
)
1288 struct ion_buffer
*buffer
= dmabuf
->priv
;
1289 ion_buffer_put(buffer
);
1292 static void *ion_dma_buf_kmap(struct dma_buf
*dmabuf
, unsigned long offset
)
1294 struct ion_buffer
*buffer
= dmabuf
->priv
;
1295 return buffer
->vaddr
+ offset
* PAGE_SIZE
;
1298 static void ion_dma_buf_kunmap(struct dma_buf
*dmabuf
, unsigned long offset
,
1304 static int ion_dma_buf_begin_cpu_access(struct dma_buf
*dmabuf
, size_t start
,
1306 enum dma_data_direction direction
)
1308 struct ion_buffer
*buffer
= dmabuf
->priv
;
1311 if (!buffer
->heap
->ops
->map_kernel
) {
1312 pr_err("%s: map kernel is not implemented by this heap.\n",
1317 mutex_lock(&buffer
->lock
);
1318 vaddr
= ion_buffer_kmap_get(buffer
);
1319 mutex_unlock(&buffer
->lock
);
1321 return PTR_ERR(vaddr
);
1325 static void ion_dma_buf_end_cpu_access(struct dma_buf
*dmabuf
, size_t start
,
1327 enum dma_data_direction direction
)
1329 struct ion_buffer
*buffer
= dmabuf
->priv
;
1331 mutex_lock(&buffer
->lock
);
1332 ion_buffer_kmap_put(buffer
);
1333 mutex_unlock(&buffer
->lock
);
1336 static struct dma_buf_ops dma_buf_ops
= {
1337 .map_dma_buf
= ion_map_dma_buf
,
1338 .unmap_dma_buf
= ion_unmap_dma_buf
,
1340 .release
= ion_dma_buf_release
,
1341 .begin_cpu_access
= ion_dma_buf_begin_cpu_access
,
1342 .end_cpu_access
= ion_dma_buf_end_cpu_access
,
1343 .kmap_atomic
= ion_dma_buf_kmap
,
1344 .kunmap_atomic
= ion_dma_buf_kunmap
,
1345 .kmap
= ion_dma_buf_kmap
,
1346 .kunmap
= ion_dma_buf_kunmap
,
1349 struct dma_buf
*ion_share_dma_buf(struct ion_client
*client
,
1350 struct ion_handle
*handle
)
1352 struct ion_buffer
*buffer
;
1353 struct dma_buf
*dmabuf
;
1356 mutex_lock(&client
->lock
);
1357 valid_handle
= ion_handle_validate(client
, handle
);
1358 if (!valid_handle
) {
1359 WARN(1, "%s: invalid handle passed to share.\n", __func__
);
1360 mutex_unlock(&client
->lock
);
1361 return ERR_PTR(-EINVAL
);
1363 buffer
= handle
->buffer
;
1364 ion_buffer_get(buffer
);
1365 mutex_unlock(&client
->lock
);
1367 dmabuf
= dma_buf_export(buffer
, &dma_buf_ops
, buffer
->size
, O_RDWR
);
1368 if (IS_ERR(dmabuf
)) {
1369 IONMSG("%s dma buf export failed dmabuf is error 0x%p.\n", __func__
, dmabuf
);
1370 ion_buffer_put(buffer
);
1376 EXPORT_SYMBOL(ion_share_dma_buf
);
1378 int __ion_share_dma_buf_fd(struct ion_client
*client
, struct ion_handle
*handle
, int from_kern
)
1380 struct dma_buf
*dmabuf
;
1383 dmabuf
= ion_share_dma_buf(client
, handle
);
1384 if (IS_ERR(dmabuf
)) {
1385 IONMSG("%s dmabuf is err 0x%p.\n", __func__
, dmabuf
);
1386 return PTR_ERR(dmabuf
);
1389 fd
= dma_buf_fd(dmabuf
, O_CLOEXEC
);
1391 IONMSG("%s dma_buf_fd failed %d.\n", __func__
, fd
);
1392 dma_buf_put(dmabuf
);
1396 ion_debug_kern_rec(client
, handle
->buffer
, handle
, ION_FUNCTION_SHARE
, 0, 0, 0, fd
);
1401 int ion_share_dma_buf_fd(struct ion_client
*client
, struct ion_handle
*handle
)
1403 return __ion_share_dma_buf_fd(client
, handle
, 1);
1405 EXPORT_SYMBOL(ion_share_dma_buf_fd
);
1407 struct ion_handle
*__ion_import_dma_buf(struct ion_client
*client
, int fd
, int from_kern
)
1409 struct dma_buf
*dmabuf
;
1410 struct ion_buffer
*buffer
;
1411 struct ion_handle
*handle
;
1414 MMProfileLogEx(ION_MMP_Events
[PROFILE_IMPORT
], MMProfileFlagStart
, 1, 1);
1416 dmabuf
= dma_buf_get(fd
);
1419 IONMSG("%s dma_buf_get fail fd=%d ret=0x%p\n", __func__
, fd
, dmabuf
);
1420 return ERR_PTR(PTR_ERR(dmabuf
));
1422 /* if this memory came from ion */
1424 if (dmabuf
->ops
!= &dma_buf_ops
) {
1425 pr_err("%s: can not import dmabuf from another exporter\n",
1427 dma_buf_put(dmabuf
);
1428 return ERR_PTR(-EINVAL
);
1430 buffer
= dmabuf
->priv
;
1432 mutex_lock(&client
->lock
);
1433 /* if a handle exists for this buffer just take a reference to it */
1434 handle
= ion_handle_lookup(client
, buffer
);
1435 if (!IS_ERR(handle
)) {
1436 handle
= ion_handle_get_check_overflow(handle
);
1437 mutex_unlock(&client
->lock
);
1441 handle
= ion_handle_create(client
, buffer
);
1444 mutex_unlock(&client
->lock
);
1445 IONMSG("%s handle is error 0x%p.\n", __func__
, handle
);
1449 ret
= ion_handle_add(client
, handle
);
1450 mutex_unlock(&client
->lock
);
1452 ion_handle_put(handle
);
1453 handle
= ERR_PTR(ret
);
1454 IONMSG("ion_import: ion_handle_add fail %d\n", ret
);
1458 dma_buf_put(dmabuf
);
1461 if (!IS_ERR_OR_NULL(handle
) && from_kern
)
1462 ion_debug_kern_rec(client
, handle
->buffer
, handle
, ION_FUNCTION_IMPORT
, 0, 0, 0, 0);
1465 MMProfileLogEx(ION_MMP_Events
[PROFILE_IMPORT
], MMProfileFlagEnd
, 1, 1);
1469 struct ion_handle
*ion_import_dma_buf(struct ion_client
*client
, int fd
)
1471 return __ion_import_dma_buf(client
, fd
, 1);
1474 EXPORT_SYMBOL(ion_import_dma_buf
);
1476 static int ion_sync_for_device(struct ion_client
*client
, int fd
)
1478 struct dma_buf
*dmabuf
;
1479 struct ion_buffer
*buffer
;
1481 dmabuf
= dma_buf_get(fd
);
1482 if (IS_ERR(dmabuf
)) {
1483 IONMSG("%s dma_buf_get failed dmabuf is err %d, 0x%p.\n", __func__
, fd
, dmabuf
);
1484 return PTR_ERR(dmabuf
);
1487 /* if this memory came from ion */
1488 if (dmabuf
->ops
!= &dma_buf_ops
) {
1489 pr_err("%s: can not sync dmabuf from another exporter\n",
1491 dma_buf_put(dmabuf
);
1494 buffer
= dmabuf
->priv
;
1496 dma_sync_sg_for_device(NULL
, buffer
->sg_table
->sgl
,
1497 buffer
->sg_table
->nents
, DMA_BIDIRECTIONAL
);
1498 dma_buf_put(dmabuf
);
1502 /* fix up the cases where the ioctl direction bits are incorrect */
1503 static unsigned int ion_ioctl_dir(unsigned int cmd
)
1508 case ION_IOC_CUSTOM
:
1511 return _IOC_DIR(cmd
);
1515 static long ion_ioctl(struct file
*filp
, unsigned int cmd
, unsigned long arg
)
1517 struct ion_client
*client
= filp
->private_data
;
1518 struct ion_device
*dev
= client
->dev
;
1519 struct ion_handle
*cleanup_handle
= NULL
;
1524 struct ion_fd_data fd
;
1525 struct ion_allocation_data allocation
;
1526 struct ion_handle_data handle
;
1527 struct ion_custom_data custom
;
1530 dir
= ion_ioctl_dir(cmd
);
1532 if (_IOC_SIZE(cmd
) > sizeof(data
)) {
1533 IONMSG("ion_ioctl cmd = %d, _IOC_SIZE(cmd) = %d, sizeof(data) = %zd.\n", cmd
, _IOC_SIZE(cmd
), sizeof(data
));
1537 if (dir
& _IOC_WRITE
) {
1538 if (copy_from_user(&data
, (void __user
*)arg
, _IOC_SIZE(cmd
))) {
1539 IONMSG("ion_ioctl copy_from_user fail!. cmd = %d, n = %d.\n", cmd
, _IOC_SIZE(cmd
));
1547 struct ion_handle
*handle
;
1549 handle
= __ion_alloc(client
, data
.allocation
.len
,
1550 data
.allocation
.align
,
1551 data
.allocation
.heap_id_mask
,
1552 data
.allocation
.flags
, true);
1553 if (IS_ERR(handle
)) {
1554 ret
= PTR_ERR(handle
);
1555 IONMSG("ION_IOC_ALLOC handle is invalid. ret = %d.\n", ret
);
1558 pass_to_user(handle
);
1559 data
.allocation
.handle
= handle
->id
;
1561 cleanup_handle
= handle
;
1566 struct ion_handle
*handle
;
1568 mutex_lock(&client
->lock
);
1569 handle
= ion_handle_get_by_id_nolock(client
, data
.handle
.handle
);
1570 if (IS_ERR(handle
)) {
1571 mutex_unlock(&client
->lock
);
1572 IONMSG("ION_IOC_FREE handle is invalid. handle = %d, ret = %d.\n", data
.handle
.handle
, ret
);
1573 return PTR_ERR(handle
);
1575 user_ion_free_nolock(client
, handle
);
1576 ion_handle_put_nolock(handle
);
1577 mutex_unlock(&client
->lock
);
1583 struct ion_handle
*handle
;
1585 handle
= ion_handle_get_by_id(client
, data
.handle
.handle
);
1586 if (IS_ERR(handle
)) {
1587 ret
= PTR_ERR(handle
);
1588 IONMSG("ION_IOC_SHARE handle is invalid. handle = %d, ret = %d.\n", data
.handle
.handle
, ret
);
1591 data
.fd
.fd
= __ion_share_dma_buf_fd(client
, handle
, 0);
1592 ion_handle_put(handle
);
1593 if (data
.fd
.fd
< 0) {
1594 IONMSG("ION_IOC_SHARE fd = %d.\n", data
.fd
.fd
);
1599 case ION_IOC_IMPORT
:
1601 struct ion_handle
*handle
;
1602 handle
= __ion_import_dma_buf(client
, data
.fd
.fd
, 0);
1605 ret
= PTR_ERR(handle
);
1606 IONMSG("ion_import fail: fd=%d, ret=%d\n", data
.fd
.fd
, ret
);
1608 handle
= pass_to_user(handle
);
1610 ret
= PTR_ERR(handle
);
1612 data
.handle
.handle
= handle
->id
;
1617 ret
= ion_sync_for_device(client
, data
.fd
.fd
);
1620 case ION_IOC_CUSTOM
:
1622 if (!dev
->custom_ioctl
) {
1623 IONMSG("ION_IOC_CUSTOM dev has no custom ioctl!.\n");
1626 ret
= dev
->custom_ioctl(client
, data
.custom
.cmd
,
1631 IONMSG("ion_ioctl : No such command!! 0x%x\n", cmd
);
1636 if (dir
& _IOC_READ
) {
1637 if (copy_to_user((void __user
*)arg
, &data
, _IOC_SIZE(cmd
))) {
1638 if (cleanup_handle
) {
1639 mutex_lock(&client
->lock
);
1640 user_ion_free_nolock(client
, cleanup_handle
);
1641 ion_handle_put_nolock(cleanup_handle
);
1642 mutex_unlock(&client
->lock
);
1644 IONMSG("ion_ioctl copy_to_user fail! cmd = %d, n = %d.\n", cmd
, _IOC_SIZE(cmd
));
1649 ion_handle_put(cleanup_handle
);
1653 static int ion_release(struct inode
*inode
, struct file
*file
)
1655 struct ion_client
*client
= file
->private_data
;
1657 pr_debug("%s: %d\n", __func__
, __LINE__
);
1658 __ion_client_destroy(client
, 0);
1662 static int ion_open(struct inode
*inode
, struct file
*file
)
1664 struct miscdevice
*miscdev
= file
->private_data
;
1665 struct ion_device
*dev
= container_of(miscdev
, struct ion_device
, dev
);
1666 struct ion_client
*client
;
1667 char debug_name
[64];
1669 pr_debug("%s: %d\n", __func__
, __LINE__
);
1670 snprintf(debug_name
, 64, "%u", task_pid_nr(current
->group_leader
));
1671 client
= __ion_client_create(dev
, debug_name
);
1672 if (IS_ERR(client
)) {
1673 IONMSG("%s ion client create failed 0x%p.\n", __func__
, client
);
1674 return PTR_ERR(client
);
1676 file
->private_data
= client
;
1681 static const struct file_operations ion_fops
= {
1682 .owner
= THIS_MODULE
,
1684 .release
= ion_release
,
1685 .unlocked_ioctl
= ion_ioctl
,
1686 .compat_ioctl
= compat_ion_ioctl
,
1689 static size_t ion_debug_heap_total(struct ion_client
*client
,
1695 mutex_lock(&client
->lock
);
1696 for (n
= rb_first(&client
->handles
); n
; n
= rb_next(n
)) {
1697 struct ion_handle
*handle
= rb_entry(n
,
1700 if (handle
->buffer
->heap
->id
== id
)
1701 size
+= handle
->buffer
->size
;
1703 mutex_unlock(&client
->lock
);
1707 static int ion_debug_heap_show(struct seq_file
*s
, void *unused
)
1709 struct ion_heap
*heap
= s
->private;
1710 struct ion_device
*dev
= heap
->dev
;
1712 size_t total_size
= 0;
1713 size_t total_orphaned_size
= 0;
1715 seq_printf(s
, "%16.s(%16.s) %16.s %16.s %s\n", "client", "dbg_name", "pid", "size", "address");
1716 seq_printf(s
, "----------------------------------------------------\n");
1718 down_read(&dev
->lock
);
1719 for (n
= rb_first(&dev
->clients
); n
; n
= rb_next(n
)) {
1720 struct ion_client
*client
= rb_entry(n
, struct ion_client
,
1722 size_t size
= ion_debug_heap_total(client
, heap
->id
);
1726 char task_comm
[TASK_COMM_LEN
];
1728 get_task_comm(task_comm
, client
->task
);
1729 seq_printf(s
, "%16.s(%16.s) %16u %16zu 0x%p\n", task_comm
,
1730 client
->dbg_name
, client
->pid
, size
, client
);
1732 seq_printf(s
, "%16.s(%16.s) %16u %16zu 0x%p\n", client
->name
,
1733 "from_kernel", client
->pid
, size
, client
);
1736 up_read(&dev
->lock
);
1737 seq_printf(s
, "----------------------------------------------------\n");
1738 seq_printf(s
, "orphaned allocations (info is from last known client):"
1740 mutex_lock(&dev
->buffer_lock
);
1741 for (n
= rb_first(&dev
->buffers
); n
; n
= rb_next(n
)) {
1742 struct ion_buffer
*buffer
= rb_entry(n
, struct ion_buffer
,
1744 if (buffer
->heap
->id
!= heap
->id
)
1746 total_size
+= buffer
->size
;
1747 if (!buffer
->handle_count
) {
1748 seq_printf(s
, "%16.s %16u %16zu %d %d\n",
1749 buffer
->task_comm
, buffer
->pid
,
1750 buffer
->size
, buffer
->kmap_cnt
,
1751 atomic_read(&buffer
->ref
.refcount
));
1752 total_orphaned_size
+= buffer
->size
;
1755 mutex_unlock(&dev
->buffer_lock
);
1756 seq_printf(s
, "----------------------------------------------------\n");
1757 seq_printf(s
, "%16.s %16zu\n", "total orphaned",
1758 total_orphaned_size
);
1759 seq_printf(s
, "%16.s %16zu\n", "total ", total_size
);
1760 if (heap
->flags
& ION_HEAP_FLAG_DEFER_FREE
)
1761 seq_printf(s
, "%16.s %16zu\n", "deferred free",
1762 heap
->free_list_size
);
1763 seq_printf(s
, "----------------------------------------------------\n");
1765 if (heap
->debug_show
)
1766 heap
->debug_show(heap
, s
, unused
);
1771 static int ion_debug_heap_open(struct inode
*inode
, struct file
*file
)
1773 return single_open(file
, ion_debug_heap_show
, inode
->i_private
);
1776 static const struct file_operations debug_heap_fops
= {
1777 .open
= ion_debug_heap_open
,
1779 .llseek
= seq_lseek
,
1780 .release
= single_release
,
1783 #ifdef DEBUG_HEAP_SHRINKER
1784 static int debug_shrink_set(void *data
, u64 val
)
1786 struct ion_heap
*heap
= data
;
1787 struct shrink_control sc
;
1794 IONMSG("%s val cannot be zero.\n", __func__
);
1798 objs
= heap
->shrinker
.shrink(&heap
->shrinker
, &sc
);
1799 sc
.nr_to_scan
= objs
;
1801 heap
->shrinker
.shrink(&heap
->shrinker
, &sc
);
1805 static int debug_shrink_get(void *data
, u64
*val
)
1807 struct ion_heap
*heap
= data
;
1808 struct shrink_control sc
;
1814 objs
= heap
->shrinker
.shrink(&heap
->shrinker
, &sc
);
1819 DEFINE_SIMPLE_ATTRIBUTE(debug_shrink_fops
, debug_shrink_get
,
1820 debug_shrink_set
, "%llu\n");
1823 void ion_device_add_heap(struct ion_device
*dev
, struct ion_heap
*heap
)
1825 struct dentry
*debug_file
;
1827 if (!heap
->ops
->allocate
|| !heap
->ops
->free
|| !heap
->ops
->map_dma
||
1828 !heap
->ops
->unmap_dma
)
1829 pr_err("%s: can not add heap with invalid ops struct.\n",
1832 if (heap
->flags
& ION_HEAP_FLAG_DEFER_FREE
)
1833 ion_heap_init_deferred_free(heap
);
1835 if ((heap
->flags
& ION_HEAP_FLAG_DEFER_FREE
) || heap
->ops
->shrink
)
1836 ion_heap_init_shrinker(heap
);
1839 down_write(&dev
->lock
);
1840 /* use negative heap->id to reverse the priority -- when traversing
1841 the list later attempt higher id numbers first */
1842 plist_node_init(&heap
->node
, -heap
->id
);
1843 plist_add(&heap
->node
, &dev
->heaps
);
1844 debug_file
= debugfs_create_file(heap
->name
, 0664,
1845 dev
->heaps_debug_root
, heap
,
1849 char buf
[256], *path
;
1850 path
= dentry_path(dev
->heaps_debug_root
, buf
, 256);
1851 pr_err("Failed to create heap debugfs at %s/%s\n",
1855 #ifdef DEBUG_HEAP_SHRINKER
1856 if (heap
->shrinker
.shrink
) {
1857 char debug_name
[64];
1859 snprintf(debug_name
, 64, "%s_shrink", heap
->name
);
1860 debug_file
= debugfs_create_file(
1861 debug_name
, 0644, dev
->heaps_debug_root
, heap
,
1862 &debug_shrink_fops
);
1864 char buf
[256], *path
;
1865 path
= dentry_path(dev
->heaps_debug_root
, buf
, 256);
1866 pr_err("Failed to create heap shrinker debugfs at %s/%s\n",
1871 up_write(&dev
->lock
);
1874 struct ion_device
*ion_device_create(long (*custom_ioctl
)
1875 (struct ion_client
*client
,
1879 struct ion_device
*idev
;
1882 idev
= kzalloc(sizeof(struct ion_device
), GFP_KERNEL
);
1884 IONMSG("%s kzalloc failed idev is null.\n", __func__
);
1885 return ERR_PTR(-ENOMEM
);
1888 idev
->dev
.minor
= MISC_DYNAMIC_MINOR
;
1889 idev
->dev
.name
= "ion";
1890 idev
->dev
.fops
= &ion_fops
;
1891 idev
->dev
.parent
= NULL
;
1892 ret
= misc_register(&idev
->dev
);
1894 pr_err("ion: failed to register misc device.\n");
1895 return ERR_PTR(ret
);
1898 idev
->debug_root
= debugfs_create_dir("ion", NULL
);
1899 if (!idev
->debug_root
) {
1900 pr_err("ion: failed to create debugfs root directory.\n");
1903 idev
->heaps_debug_root
= debugfs_create_dir("heaps", idev
->debug_root
);
1904 if (!idev
->heaps_debug_root
) {
1905 pr_err("ion: failed to create debugfs heaps directory.\n");
1908 idev
->clients_debug_root
= debugfs_create_dir("clients",
1910 if (!idev
->clients_debug_root
)
1911 pr_err("ion: failed to create debugfs clients directory.\n");
1915 idev
->custom_ioctl
= custom_ioctl
;
1916 idev
->buffers
= RB_ROOT
;
1917 mutex_init(&idev
->buffer_lock
);
1918 init_rwsem(&idev
->lock
);
1919 plist_head_init(&idev
->heaps
);
1920 idev
->clients
= RB_ROOT
;
1922 /* Create ION Debug DB Root */
1923 ion_debug_create_db(idev
->debug_root
);
1928 void ion_device_destroy(struct ion_device
*dev
)
1930 misc_deregister(&dev
->dev
);
1931 debugfs_remove_recursive(dev
->debug_root
);
1932 /* XXX need to free the heaps and clients ? */
1936 void __init
ion_reserve(struct ion_platform_data
*data
)
1940 for (i
= 0; i
< data
->nr
; i
++) {
1941 if (data
->heaps
[i
].size
== 0)
1944 if (data
->heaps
[i
].base
== 0) {
1946 paddr
= memblock_alloc_base(data
->heaps
[i
].size
,
1947 data
->heaps
[i
].align
,
1948 MEMBLOCK_ALLOC_ANYWHERE
);
1950 pr_err("%s: error allocating memblock for "
1955 data
->heaps
[i
].base
= paddr
;
1957 int ret
= memblock_reserve(data
->heaps
[i
].base
,
1958 data
->heaps
[i
].size
);
1960 pr_err("memblock reserve of %zx@%lx failed\n",
1961 data
->heaps
[i
].size
,
1962 data
->heaps
[i
].base
);
1964 pr_info("%s: %s reserved base %lx size %zu\n", __func__
,
1965 data
->heaps
[i
].name
,
1966 data
->heaps
[i
].base
,
1967 data
->heaps
[i
].size
);
1971 //============================================================================
1973 //============================================================================
1975 struct ion_handle
* ion_drv_get_handle(struct ion_client
* client
, int user_handle
, struct ion_handle
* kernel_handle
, int from_kernel
)
1977 struct ion_handle
* handle
;
1980 handle
= kernel_handle
;
1982 if (IS_ERR_OR_NULL(handle
)) {
1983 IONMSG("%s handle invalid, handle = 0x%p.\n", __FUNCTION__
, handle
);
1984 return ERR_PTR(-EINVAL
);
1987 mutex_lock(&client
->lock
);
1988 if (!ion_handle_validate(client
, handle
)) {
1989 IONMSG("%s handle invalid, handle=0x%p\n", __FUNCTION__
, handle
);
1990 mutex_unlock(&client
->lock
);
1991 return ERR_PTR(-EINVAL
);
1993 ion_handle_get(handle
);
1994 mutex_unlock(&client
->lock
);
1996 handle
= ion_handle_get_by_id(client
, user_handle
);
1998 IONMSG("%s handle invalid, handle_id=%d\n", __FUNCTION__
, user_handle
);
1999 return ERR_PTR(-EINVAL
);
2005 int ion_drv_put_kernel_handle(void *kernel_handle
)
2007 return ion_handle_put(kernel_handle
);
2010 //=============================================================================================
2013 static int ion_debug_kern_rec(struct ion_client
*client
,
2014 struct ion_buffer
*buffer
,
2015 struct ion_handle
* handle
,
2016 unsigned int action
,
2017 unsigned int address_type
,
2018 unsigned int address
,
2022 ion_sys_record_t record_param
;
2023 record_param
.client
= client
;
2024 record_param
.pid
= client
->pid
;
2025 if(current
->pid
!= current
->tgid
)
2027 record_param
.group_id
= current
->tgid
;
2028 printk(ION_DEBUG_INFO
"[KERNEL tgid is %d]\n",(unsigned int)current
->tgid
);
2032 record_param
.group_id
= current
->pid
;
2035 record_param
.buffer
= buffer
;
2036 record_param
.handle
= handle
;
2037 record_param
.action
= action
;
2038 record_param
.address_type
= address_type
;
2039 record_param
.address
= (unsigned int)address
;
2040 record_param
.length
= length
;
2041 record_param
.fd
= fd
;
2042 record_param
.backtrace_num
= get_kernel_backtrace((unsigned long *)record_param
.backtrace
);
2043 get_kernel_symbol((unsigned long *)record_param
.backtrace
,record_param
.backtrace_num
,&(record_param
.kernel_symbol
[0]));
2044 record_ion_info((int)1,&record_param
);
2048 static int ion_debug_kern_rec(struct ion_client
*client
,
2049 struct ion_buffer
*buffer
,
2050 struct ion_handle
* handle
,
2051 unsigned int action
,
2052 unsigned int address_type
,
2053 unsigned int address
,
2063 * ION Debug assistant function
2065 static void *ion_get_list_from_buffer(struct ion_buffer
*buf
, unsigned int type
)
2067 struct ion_buffer_record
*buf_rec
= NULL
;
2069 /* Get the inuse buffer record */
2070 buf_rec
= ion_get_inuse_buffer_record();
2072 printk(KERN_WARNING
"No inuse buffers!\n");
2078 /* We only need to find out the record with corresponding buffer */
2079 if (buf_rec
->buffer_address
== buf
) {
2080 return ion_get_list(LIST_BUFFER
,buf_rec
, type
);
2083 buf_rec
= buf_rec
->next
;
2084 } while (!!buf_rec
);
2090 * ION Debug assistant function
2092 static void *ion_get_list_from_process(pid_t pid
, unsigned int type
)
2094 struct ion_process_record
*process_rec
= NULL
;
2096 /* Get the inuse buffer record */
2097 process_rec
= (struct ion_process_record
*)ion_get_inuse_process_usage_record2();
2099 printk(KERN_WARNING
"No inuse process!\n");
2105 /* We only need to find out the record with corresponding buffer */
2106 if (process_rec
->pid
== pid
) {
2107 return ion_get_list(LIST_PROCESS
,process_rec
, type
);
2110 process_rec
= process_rec
->next
;
2111 } while (!!process_rec
);
2117 * ION Debug assistant function
2119 static void *ion_get_client_record(struct ion_client
*client
)
2121 struct ion_client_usage_record
*client_rec
= NULL
;
2123 /* Get the inuse buffer record */
2124 client_rec
= ion_get_inuse_client_record();
2126 printk(KERN_WARNING
"No inuse client!\n");
2132 /* We only need to find out the record with corresponding buffer */
2133 if ((client_rec
->tracking_info
.from_kernel
)&&(client_rec
->tracking_info
.recordID
.client_address
== (unsigned int)client
) && (client_rec
->tracking_info
.recordID
.group_pid
== client
->pid
))
2135 return (void *)client_rec
;
2137 else if ((!client_rec
->tracking_info
.from_kernel
)&&(client_rec
->tracking_info
.recordID
.client_address
== (unsigned int)client
) && (client_rec
->tracking_info
.recordID
.pid
== client
->pid
))
2139 return (void *)client_rec
;
2142 client_rec
= (struct ion_client_usage_record
*)client_rec
->next
;
2143 } while (!!client_rec
);
2149 * ION Debug DB assistant function of showing backtrace
2151 static int ion_debugdb_show_backtrace(struct seq_file
*s
, struct ion_record_basic_info
*ti
, unsigned int sbt
)
2154 unsigned int backtrace_count
= 0;
2155 ObjectEntry
*tmp
= NULL
;
2156 unsigned int stringCount
= KSYM_SYMBOL_LEN
+ 30;
2162 if (sbt
== ALLOCATE_BACKTRACE_INFO
) {
2163 tmp
= (ObjectEntry
*)ti
->allocate_backtrace
;
2166 backtrace_count
= tmp
->numEntries
;
2167 } else if (sbt
== RELEASE_BACKTRACE_INFO
) {
2168 tmp
= (ObjectEntry
*)ti
->release_backtrace
;
2171 backtrace_count
= tmp
->numEntries
;
2174 //printk("%s [%d] backtrace_count = (%d)\n",__FUNCTION__,__LINE__,backtrace_count);
2175 if (backtrace_count
!= 0) {
2176 seq_printf(s
, "%19s\n", "[BACKTRACE]");
2179 for (i
= 0;i
< backtrace_count
;i
++) {
2180 char tmpString
[stringCount
];
2181 ion_get_backtrace_info(ti
, tmpString
, stringCount
, i
, sbt
);
2182 seq_printf(s
, "%10s %s", "::", tmpString
);
2188 * ION Debug DB file operations
2191 extern struct ion_device
*g_ion_device
;
2192 static int ion_debug_dbcl_show(struct seq_file
*s
, void *unused
)
2194 unsigned long key
=(unsigned long) s
->private;
2196 enum dbcl_types type
;
2198 struct ion_device
*dev
= g_ion_device
;
2199 struct rb_node
*cn
, *hn
;
2200 struct ion_client
*client
;
2201 struct ion_handle
*handle
;
2202 struct ion_buffer
*buffer
;
2203 int client_cnt
= 0, buffer_cnt
= 0;
2207 * Here is an introduction about how we convert key to raw_key.
2209 * Firstly, we have following observations,
2210 * 1. Process IDs have a maximum bound of pid_max, which is rarely larger than PID_MAX_DEFAULT(0x8000).
2212 * (No-use)2. Kernel modules often have higher value than 0xbf000000 and are page-aligned.
2213 * (No-use)3. Other kernel parts often have higher value than 0xc0000000.
2215 * Based on above observations, we can using following rules to change raw_key to key & vice versa.
2216 * 1. For processes, we use ((dbcl_types << 16) | raw_key) as the key, in which raw_key equals Process ID.
2218 * (No-use)2. For kernel modules, we use (raw_key | dbcl_types) as the key, in which raw_key is the virtual address the module is resident in.
2219 * (No-use)3. For other kernel parts, we use dbcl_types as the key.
2224 if (unlikely(key
>= 0xbf000000)) {
2225 /* Rarely-used case */
2226 } else if (likely(key
>= 0x8000)) {
2228 raw_key
= key
& 0xffff;
2230 /* Rarely-used case */
2238 raw_key
= key
& 0xffff;
2239 seq_printf(s
, "Process [%d]\n", raw_key
);
2244 /* Lv1 - all clients
2245 * Lv2 - all client-handles
2246 * Lv3 - all client-handle-buffers
2248 printk(KERN_INFO
"DBCL_CLIENT\n");
2250 /* Lv1 - all clients */
2251 for (cn
= rb_first(&dev
->clients
); cn
; cn
= rb_next(cn
)) {
2252 client
= rb_entry(cn
, struct ion_client
, node
);
2253 /* Matched clients */
2254 if (client
->pid
== raw_key
) {
2255 seq_printf(s
, "%-8s[%2d] %12p\n", "client", client_cnt
++, client
);
2256 mutex_lock(&client
->lock
);
2257 /* Lv2 - all client-handles */
2258 for (hn
= rb_first(&client
->handles
); hn
; hn
= rb_next(hn
)) {
2259 handle
= rb_entry(hn
, struct ion_handle
, node
);
2260 seq_printf(s
, "%10s[%2d] kmap_cnt(%d)\n", "handle", buffer_cnt
, handle
->kmap_cnt
);
2261 /* Lv3 - all client-handle-buffers */
2262 buffer
= handle
->buffer
;
2263 mutex_lock(&buffer
->lock
);
2264 seq_printf(s
, "%10s[%2d] heap(%s) flags(%d) size(%d) kmap_cnt(%d) kvaddr(0x%x)\n",
2265 "buffer", buffer_cnt
++, buffer
->heap
->name
, (unsigned int)buffer
->flags
,
2266 buffer
->size
, (unsigned int)buffer
->kmap_cnt
, (unsigned int)buffer
->vaddr
);
2267 mutex_unlock(&buffer
->lock
);
2269 mutex_unlock(&client
->lock
);
2275 /* Lv1 - all buffers
2276 * Lv2 - all buffer-usage
2278 printk(KERN_INFO
"DBCL_BUFFER\n");
2280 struct ion_buffer_usage_record
*usg_rec
;
2281 struct ion_buffer_record
*buf_rec
= NULL
;
2282 int buffer_count
= 0;
2283 buf_rec
= ion_get_inuse_buffer_record();
2285 /* Find matched clients */
2286 for (cn
= rb_first(&dev
->clients
); cn
; cn
= rb_next(cn
)) {
2287 client
= rb_entry(cn
, struct ion_client
, node
);
2288 /* Matched clients */
2289 if (client
->pid
== raw_key
) {
2290 mutex_lock(&client
->lock
);
2291 /* Lv1 - all buffers */
2292 for (hn
= rb_first(&client
->handles
); hn
; hn
= rb_next(hn
)) {
2293 handle
= rb_entry(hn
, struct ion_handle
, node
);
2294 buffer
= handle
->buffer
;
2295 mutex_lock(&buffer
->lock
);
2296 seq_printf(s
, "%s[%2d] size(%d) %12p\n", "buffer", buffer_cnt
++, buffer
->size
, buffer
);
2297 mutex_unlock(&buffer
->lock
);
2298 /* Lv2 - all buffer-usage */
2300 usg_rec
= ion_get_list_from_buffer(buffer
, BUFFER_ALLOCATION_LIST
);
2302 seq_printf(s
, "%s\n"," <BUFFER_ALLOCATION_LIST>");
2304 seq_printf(s
, "%s [0x%x] %10s [%d] (%s [%d]) \n"," client",
2305 usg_rec
->tracking_info
.recordID
.client_address
,
2307 usg_rec
->tracking_info
.recordID
.pid
,
2309 usg_rec
->tracking_info
.recordID
.group_pid
);
2310 /* Show buffer allocation backtrace */
2311 ion_debugdb_show_backtrace(s
, &usg_rec
->tracking_info
, ALLOCATE_BACKTRACE_INFO
);
2312 /* Next buffer usage record */
2313 usg_rec
= (struct ion_buffer_usage_record
*)ion_get_data_from_record((void *)usg_rec
, RECORD_NEXT
);
2316 usg_rec
= ion_get_list_from_buffer(buffer
, BUFFER_FREE_LIST
);
2318 seq_printf(s
, "%s\n"," <BUFFER_FREE_LIST>");
2320 seq_printf(s
, "%s [0x%x] %10s [%d] \n"," client",
2321 usg_rec
->tracking_info
.recordID
.client_address
,
2323 usg_rec
->tracking_info
.recordID
.pid
,
2325 usg_rec
->tracking_info
.recordID
.group_pid
);
2326 /* Show buffer free backtrace */
2327 ion_debugdb_show_backtrace(s
, &usg_rec
->tracking_info
, RELEASE_BACKTRACE_INFO
);
2328 /* Next buffer usage record */
2329 usg_rec
= (struct ion_buffer_usage_record
*)ion_get_data_from_record((void *)usg_rec
, RECORD_NEXT
);
2331 seq_printf(s
, "%10s\n","==================================================");
2334 mutex_unlock(&client
->lock
);
2337 while (buf_rec
!= NULL
) {
2339 usg_rec
= ion_get_list(LIST_BUFFER
,buf_rec
, BUFFER_ALLOCATION_LIST
);
2341 while ((!!usg_rec
) &&(usg_rec
->tracking_info
.recordID
.pid
== raw_key
)) {
2343 if(buffer_count
== 1)
2345 seq_printf(s
, "%8s[%2d] buffer: 0x%p buffer structure adr: 0x%p size(%d)\n", "buffer", buffer_cnt
++, buf_rec
->buffer
, buf_rec
->buffer_address
, buf_rec
->buffer
->size
);
2347 seq_printf(s
, "%s\n"," <BUFFER_ALLOCATION_LIST>");
2348 seq_printf(s
, "%s [0x%x] %10s [%d] (%s [%d])\n"," client",
2349 usg_rec
->tracking_info
.recordID
.client_address
,
2351 usg_rec
->tracking_info
.recordID
.pid
,
2353 usg_rec
->tracking_info
.recordID
.group_pid
);
2355 /* Show buffer allocation backtrace */
2356 ion_debugdb_show_backtrace(s
, &usg_rec
->tracking_info
, ALLOCATE_BACKTRACE_INFO
);
2357 /* Next buffer usage record */
2358 usg_rec
= (struct ion_buffer_usage_record
*)ion_get_data_from_record((void *)usg_rec
, RECORD_NEXT
);
2363 usg_rec
= ion_get_list(LIST_BUFFER
,buf_rec
, BUFFER_FREE_LIST
);
2364 while ((!!usg_rec
)&&(usg_rec
->tracking_info
.recordID
.pid
== raw_key
)) {
2365 seq_printf(s
, "%s\n"," <BUFFER_FREE_LIST>");
2366 seq_printf(s
, "%s [0x%x] %10s [%d] (%s [%d])\n"," client",
2367 usg_rec
->tracking_info
.recordID
.client_address
,
2369 usg_rec
->tracking_info
.recordID
.pid
,
2371 usg_rec
->tracking_info
.recordID
.group_pid
);
2372 /* Show buffer free backtrace */
2373 ion_debugdb_show_backtrace(s
, &usg_rec
->tracking_info
, RELEASE_BACKTRACE_INFO
);
2374 /* Next buffer usage record */
2375 usg_rec
= (struct ion_buffer_usage_record
*)ion_get_data_from_record((void *)usg_rec
, RECORD_NEXT
);
2379 buf_rec
= buf_rec
->next
;
2384 /* Lv1 - all buffers
2385 * Lv2 - all buffer-mmaps
2387 printk(KERN_INFO
"DBCL_MMAP\n");
2389 struct ion_address_usage_record
*adr_rec
;
2390 struct ion_client_usage_record
*client_rec
;
2391 /* Find matched clients */
2392 for (cn
= rb_first(&dev
->clients
); cn
; cn
= rb_next(cn
)) {
2393 client
= rb_entry(cn
, struct ion_client
, node
);
2394 /* Matched clients */
2395 if (client
->pid
== raw_key
) {
2396 mutex_lock(&client
->lock
);
2397 /* Lv1 - all buffers */
2398 for (hn
= rb_first(&client
->handles
); hn
; hn
= rb_next(hn
)) {
2399 handle
= rb_entry(hn
, struct ion_handle
, node
);
2400 buffer
= handle
->buffer
;
2401 mutex_lock(&buffer
->lock
);
2402 seq_printf(s
, "%-8s[%2d] size(%d) %12p\n",
2403 "buffer", buffer_cnt
++, buffer
->size
, buffer
);
2404 mutex_unlock(&buffer
->lock
);
2405 /* Lv2 - all buffer-mmaps */
2406 adr_rec
= ion_get_list_from_buffer(buffer
, ADDRESS_ALLOCATION_LIST
);
2409 seq_printf(s
, "%10s\n","<ADDRESS_ALLOCATION_LIST_IN_KERNELSPACE>");
2412 seq_printf(s
, "%10s [%d] - %10s [0x%x]-[0x%x]%10s [%d]\n",
2413 "Process", adr_rec
->tracking_info
.recordID
.pid
,
2414 "Address", adr_rec
->mapping_address
,(adr_rec
->mapping_address
+adr_rec
->size
),
2415 "Size", adr_rec
->size
);
2416 /* Show address allocation backtrace */
2417 ion_debugdb_show_backtrace(s
, &adr_rec
->tracking_info
, ALLOCATE_BACKTRACE_INFO
);
2418 /* Next address record */
2419 adr_rec
= (struct ion_address_usage_record
*)ion_get_data_from_record((void *)adr_rec
, RECORD_NEXT
);
2422 adr_rec
= ion_get_list_from_buffer(buffer
, ADDRESS_FREE_LIST
);
2425 seq_printf(s
, "%10s\n","<ADDRESS_FREE_LIST_IN_KERNELSPACE>");
2428 seq_printf(s
, "%10s [%d] - %10s [0x%x]-[0x%x] %10s [%d]\n",
2429 "Process", adr_rec
->tracking_info
.recordID
.pid
,
2430 "Address", adr_rec
->mapping_address
,(adr_rec
->mapping_address
+adr_rec
->size
),
2431 "Size", adr_rec
->size
);
2432 /* Show address release backtrace */
2433 ion_debugdb_show_backtrace(s
, &adr_rec
->tracking_info
, RELEASE_BACKTRACE_INFO
);
2434 /* Next address record */
2435 adr_rec
= (struct ion_address_usage_record
*)ion_get_data_from_record((void *)adr_rec
, RECORD_NEXT
);
2439 client_rec
= (struct ion_client_usage_record
*)ion_get_client_record(client
);
2440 if(client_rec
!= NULL
)
2442 adr_rec
= ion_get_list_from_process(client_rec
->tracking_info
.recordID
.pid
, ADDRESS_ALLOCATION_LIST
);
2444 seq_printf(s
, "%10s\n","<ADDRESS_ALLOCATION_LIST_IN_USERSPACE>");
2447 seq_printf(s
, "%10s [%d] - %10s [0x%x]-[0x%x] %10s [%d]\n",
2448 "Process", adr_rec
->tracking_info
.recordID
.pid
,
2449 "Address", adr_rec
->mapping_address
,(adr_rec
->mapping_address
+adr_rec
->size
),
2450 "Size", adr_rec
->size
);
2451 /* Show address allocation backtrace */
2452 ion_debugdb_show_backtrace(s
, &adr_rec
->tracking_info
, ALLOCATE_BACKTRACE_INFO
);
2453 /* Next address record */
2454 adr_rec
= (struct ion_address_usage_record
*)ion_get_data_from_record((void *)adr_rec
, RECORD_NEXT
);
2456 adr_rec
= ion_get_list_from_process(client_rec
->tracking_info
.recordID
.pid
, ADDRESS_FREE_LIST
);
2458 seq_printf(s
, "%10s\n","<ADDRESS_FREE_LIST_IN_USERSPACE>");
2461 seq_printf(s
, "%10s [%d] - %10s [0x%x]-[0x%x] %10s [%d]\n",
2462 "Process", adr_rec
->tracking_info
.recordID
.pid
,
2463 "Address", adr_rec
->mapping_address
,(adr_rec
->mapping_address
+adr_rec
->size
),
2464 "Size", adr_rec
->size
);
2465 /* Show address release backtrace */
2466 ion_debugdb_show_backtrace(s
, &adr_rec
->tracking_info
, RELEASE_BACKTRACE_INFO
);
2467 /* Next address record */
2468 adr_rec
= (struct ion_address_usage_record
*)ion_get_data_from_record((void *)adr_rec
, RECORD_NEXT
);
2472 mutex_unlock(&client
->lock
);
2478 /* Lv1 - all buffers
2479 * Lv2 - all buffer-fds
2481 printk(KERN_INFO
"DBCL_FD\n");
2483 struct ion_fd_usage_record
*fd_rec
;
2484 struct ion_client_usage_record
*client_rec
;
2486 /* Find matched clients */
2487 for (cn
= rb_first(&dev
->clients
); cn
; cn
= rb_next(cn
)) {
2488 client
= rb_entry(cn
, struct ion_client
, node
);
2489 /* Matched clients */
2490 if (client
->pid
== raw_key
) {
2491 mutex_lock(&client
->lock
);
2492 /* Lv1 - all buffers */
2493 client_rec
= (struct ion_client_usage_record
*)ion_get_client_record(client
);
2494 //printk("[FD] client_rec %x input is %x groupd id is %d\n",client_rec,client,client->pid);
2495 if(client_rec
!= NULL
)
2497 //printk("[FD] client pid is %d\n",client_rec->tracking_info.recordID.pid);
2498 fd_rec
= ion_get_list_from_process(client_rec
->tracking_info
.recordID
.pid
, FD_ALLOCATION_LIST
);
2500 seq_printf(s
, "%10s\n","<FD_ALLOCATION_LIST>");
2501 //printk("[FD] get fd_rec %x\n",fd_rec);
2503 seq_printf(s
, "%10s [%d] %10s [%d]\n",
2504 "Process", fd_rec
->tracking_info
.recordID
.pid
,
2505 "inused fd", fd_rec
->fd
);
2506 /* Show address allocation backtrace */
2507 ion_debugdb_show_backtrace(s
, &fd_rec
->tracking_info
, ALLOCATE_BACKTRACE_INFO
);
2508 /* Next address record */
2509 fd_rec
= (struct ion_fd_usage_record
*)ion_get_data_from_record((void *)fd_rec
, RECORD_NEXT
);
2512 fd_rec
= ion_get_list_from_process(client_rec
->tracking_info
.recordID
.pid
, FD_FREE_LIST
);
2514 seq_printf(s
, "%10s\n","<FD_FREE_LIST>");
2516 seq_printf(s
, "%10s [%d] %10s [%d]\n",
2517 "Process", fd_rec
->tracking_info
.recordID
.pid
,
2518 "freed fd", fd_rec
->fd
);
2519 /* Show address release backtrace */
2520 ion_debugdb_show_backtrace(s
, &fd_rec
->tracking_info
, RELEASE_BACKTRACE_INFO
);
2521 /* Next address record */
2522 fd_rec
= (struct ion_address_usage_record
*)ion_get_data_from_record((void *)fd_rec
, RECORD_NEXT
);
2526 mutex_unlock(&client
->lock
);
2538 static int ion_debug_dbcl_open(struct inode
*inode
, struct file
*file
)
2540 return single_open(file
, ion_debug_dbcl_show
, inode
->i_private
);
2544 static const struct file_operations debug_dbcl_fops
= {
2545 .open
= ion_debug_dbcl_open
,
2547 .llseek
= seq_lseek
,
2548 .release
= single_release
,
2551 static int ion_debug_dbis_show(struct seq_file
*s
, void *unused
)
2553 unsigned long type
= (unsigned long)s
->private;
2554 unsigned long ori_type
= type
;
2555 struct ion_device
*dev
= g_ion_device
;
2556 struct rb_node
*cn
, *hn
;
2557 struct ion_client
*client
;
2558 struct ion_handle
*handle
;
2559 struct ion_buffer
*buffer
;
2560 int client_cnt
= 0, buffer_cnt
= 0,process_cnt
= 0;
2562 struct ion_buffer_record
*buf_rec
= NULL
;
2563 struct ion_process_record
*process_rec
= NULL
;
2564 struct ion_client_usage_record
*client_rec
= NULL
;
2566 /* History records */
2567 if (type
>= (unsigned long)DBIS_DIR
) {
2568 printk(KERN_INFO
"ION Debug History Records\n");
2570 type
-= (unsigned long)DBIS_DIR
;
2571 switch ((enum dbis_types
)type
)
2575 client_rec
= ion_get_freed_client_record();
2580 buf_rec
= ion_get_freed_buffer_record();
2585 buf_rec
= ion_get_freed_buffer_record();
2589 process_rec
= ion_get_freed_process_record();
2594 client_rec
= ion_get_inuse_client_record();
2595 process_rec
= ion_get_inuse_process_usage_record2();
2608 printk(KERN_INFO
"ION Debug Non-History Records\n");
2609 switch ((enum dbis_types
)type
)
2613 client_rec
= ion_get_inuse_client_record();
2618 buf_rec
= ion_get_inuse_buffer_record();
2623 buf_rec
= ion_get_inuse_buffer_record();
2627 process_rec
= ion_get_inuse_process_usage_record2();
2632 client_rec
= ion_get_inuse_client_record();
2633 process_rec
= ion_get_inuse_process_usage_record2();
2646 /* Non-history records */
2647 switch ((enum dbis_types
)type
) {
2649 printk(KERN_INFO
"DBIS_CLIENTS\n");
2653 for (cn
= rb_first(&dev
->clients
); cn
; cn
= rb_next(cn
)) {
2654 client
= rb_entry(cn
, struct ion_client
, node
);
2655 seq_printf(s
, "\n%8s[%2d] 0x%p PID[%d]\n", "client", client_cnt
++, client
, client
->pid
);
2656 mutex_lock(&client
->lock
);
2657 /* All client-handles */
2658 for (hn
= rb_first(&client
->handles
); hn
; hn
= rb_next(hn
)) {
2659 handle
= rb_entry(hn
, struct ion_handle
, node
);
2660 seq_printf(s
, "%10s[%2d] kmap_cnt(%d)\n", "handle", buffer_cnt
, handle
->kmap_cnt
);
2661 /* All client-handle-buffers */
2662 buffer
= handle
->buffer
;
2663 mutex_lock(&buffer
->lock
);
2664 seq_printf(s
, "%10s[%2d] heap(%s) address(0x%x) flags(%d) size(%d) kmap_cnt(%d) kvaddr(0x%x)\n",
2665 "buffer", buffer_cnt
++, buffer
->heap
->name
,buffer
,buffer
->flags
,
2666 buffer
->size
, buffer
->kmap_cnt
, buffer
->vaddr
);
2667 mutex_unlock(&buffer
->lock
);
2669 mutex_unlock(&client
->lock
);
2674 while(client_rec
!= NULL
)
2676 seq_printf(s
, "\n[%2d]%s: fd[%d] 0x%p PID[%d] GROUP_PID[%d]\n",client_cnt
++,"client",client_rec
->fd
, client_rec
->tracking_info
.recordID
.client
,client_rec
->tracking_info
.recordID
.pid
,client_rec
->tracking_info
.recordID
.group_pid
);
2677 /* Show buffer allocation backtrace */
2678 seq_printf(s
, " %s\n","<CLIENT_ALLOCATION_LIST>");
2679 ion_debugdb_show_backtrace(s
, &client_rec
->tracking_info
,ALLOCATE_BACKTRACE_INFO
);
2680 if (ori_type
>= (unsigned long)DBIS_DIR
)
2682 seq_printf(s
, " %s\n","<CLIENT_FREE_LIST>");
2683 ion_debugdb_show_backtrace(s
, &client_rec
->tracking_info
,RELEASE_BACKTRACE_INFO
);
2685 client_rec
= (struct ion_client_usage_record
*)client_rec
->next
;
2690 printk(KERN_INFO
"DBIS_BUFFERS\n");
2692 struct ion_buffer_usage_record
*usg_rec
;
2695 buf_rec
= ion_get_inuse_buffer_record();
2697 while (buf_rec
!= NULL
)
2699 seq_printf(s
, "%8s[%2d][0x%x] buffer structure: 0x%p size(%d)\n", "buffer", buffer_cnt
++,(unsigned int)buf_rec
->buffer
,buf_rec
->buffer_address
, buf_rec
->buffer
->size
);
2701 usg_rec
= ion_get_list(LIST_BUFFER
,buf_rec
, BUFFER_ALLOCATION_LIST
);
2704 seq_printf(s
, "%30s\n","<BUFFER_ALLOCATION_LIST>");
2708 if(usg_rec
->function_type
== ION_FUNCTION_ALLOC
)
2710 seq_printf(s
, "%15s [%d] (%s [%d]) %s (0x%x) FUNCTION %s\n","Process", usg_rec
->tracking_info
.recordID
.pid
,
2711 "GroupLeader", usg_rec
->tracking_info
.recordID
.group_pid
,"handle",(unsigned int)usg_rec
->handle
,"ION_ALLOC");
2714 seq_printf(s
, "%15s [%d] (%s [%d]) %s (0x%x) FUNCTION %s\n","Process", usg_rec
->tracking_info
.recordID
.pid
,
2715 "GroupLeader", usg_rec
->tracking_info
.recordID
.group_pid
,"handle",(unsigned int)usg_rec
->handle
,"ION_IMPORT");
2717 /* Show buffer allocation backtrace */
2718 ion_debugdb_show_backtrace(s
, &usg_rec
->tracking_info
, ALLOCATE_BACKTRACE_INFO
);
2719 /* Next buffer usage record */
2720 usg_rec
= (struct ion_buffer_usage_record
*)ion_get_data_from_record((void *)usg_rec
, RECORD_NEXT
);
2724 seq_printf(s
, "%30s\n","<BUFFER_FREE_LIST>");
2726 usg_rec
= ion_get_list(LIST_BUFFER
,buf_rec
, BUFFER_FREE_LIST
);
2728 seq_printf(s
, "%15s [%d] (%15s [%d])\n","Process", usg_rec
->tracking_info
.recordID
.pid
,
2729 "GroupLeader", usg_rec
->tracking_info
.recordID
.group_pid
);
2730 /* Show buffer free backtrace */
2731 ion_debugdb_show_backtrace(s
, &usg_rec
->tracking_info
, RELEASE_BACKTRACE_INFO
);
2732 /* Next buffer usage record */
2733 usg_rec
= (struct ion_buffer_usage_record
*)ion_get_data_from_record((void *)usg_rec
, RECORD_NEXT
);
2737 buf_rec
= buf_rec
->next
;
2742 printk(KERN_INFO
"DBIS_MMAPS\n");
2744 struct ion_address_usage_record
*adr_rec
= NULL
;
2745 struct ion_address_usage_record
*adr_rec_free
= NULL
;
2746 struct ion_address_usage_record
*adr_rec_user
= NULL
;
2747 struct ion_address_usage_record
*adr_rec_user_free
= NULL
;
2748 seq_printf(s
, "%8s\n","<USERSPACE MAPPING>");
2749 while (process_rec
!= NULL
) {
2751 adr_rec_user
= ion_get_list(LIST_PROCESS
,process_rec
, ADDRESS_ALLOCATION_LIST
);
2752 adr_rec_user_free
= ion_get_list(LIST_PROCESS
,process_rec
, ADDRESS_FREE_LIST
);
2753 if((adr_rec_user
== NULL
) && (adr_rec_user_free
== NULL
))
2755 process_rec
= process_rec
->next
;
2758 if(process_rec
== NULL
)
2760 seq_printf(s
, "[%2d]%8s[0x%x] [%d] group_id [%d]\n",process_cnt
++,"process",(unsigned int)process_rec
, process_rec
->pid
, process_rec
->group_id
);
2761 if(adr_rec_user
!= NULL
)
2763 seq_printf(s
, " %s\n","<ADDRESS_ALLOCATION_LIST>");
2767 seq_printf(s
, " %s\n","<NO ADDRESS_ALLOCATION_LIST>");
2770 while (!!adr_rec_user
) {
2771 seq_printf(s
, " %s[0x%x] [%d] - %s [0x%x] - [0x%x] %10s [%d]\n",
2772 "Process",(unsigned int)process_rec
, adr_rec_user
->tracking_info
.recordID
.pid
,
2773 "Address", adr_rec_user
->mapping_address
,(adr_rec_user
->mapping_address
+ adr_rec_user
->size
),
2774 "Size", adr_rec_user
->size
);
2776 /* Show fd allocation backtrace */
2777 ion_debugdb_show_backtrace(s
, &adr_rec_user
->tracking_info
, ALLOCATE_BACKTRACE_INFO
);
2778 /* Next fd record */
2779 adr_rec_user
= (struct ion_address_usage_record
*)ion_get_data_from_record((void *)adr_rec_user
, RECORD_NEXT
);
2782 if(adr_rec_user_free
!= NULL
)
2784 seq_printf(s
, " %s\n","<ADDRESS_FREE_LIST>");
2788 seq_printf(s
, " %s\n","<NO_ADDRESS_FREE_LIST>");
2791 while (!!adr_rec_user_free
) {
2792 seq_printf(s
, " %s[0x%x] [%d] - %s [0x%x] - [0x%x]%10s [%d]\n",
2793 "Process",(unsigned int)process_rec
, adr_rec_user_free
->tracking_info
.recordID
.pid
,
2794 "Address", adr_rec_user_free
->mapping_address
,(adr_rec_user_free
->mapping_address
+ adr_rec_user_free
->size
),
2795 "Size", adr_rec_user_free
->size
);
2797 /* Show fd release backtrace */
2798 ion_debugdb_show_backtrace(s
, &adr_rec_user_free
->tracking_info
, RELEASE_BACKTRACE_INFO
);
2799 /* Next fd record */
2800 adr_rec_user_free
= (struct ion_address_usage_record
*)ion_get_data_from_record((void *)adr_rec_user_free
, RECORD_NEXT
);
2803 process_rec
= process_rec
->next
;
2805 seq_printf(s
, "%s\n","<KENREL MAPPING>");
2806 mutex_lock(&buffer_lifecycle_mutex
);
2807 while (buf_rec
!= NULL
) {
2808 mutex_lock(&buf_rec
->ion_address_usage_mutex
);
2810 adr_rec
= ion_get_list(LIST_BUFFER
,buf_rec
, ADDRESS_ALLOCATION_LIST
);
2813 adr_rec_free
= ion_get_list(LIST_BUFFER
,buf_rec
, ADDRESS_FREE_LIST
);
2814 mutex_unlock(&buf_rec
->ion_address_usage_mutex
);
2815 if((adr_rec
== NULL
)&&(adr_rec_free
== NULL
))
2817 buf_rec
= buf_rec
->next
;
2821 seq_printf(s
, "%8s[%2d] size(%d) %12p\n", "buffer", buffer_cnt
++, buf_rec
->buffer
->size
, buf_rec
->buffer
);
2824 seq_printf(s
, " %s\n","<ADDRESS_ALLOCATION_LIST>");
2828 seq_printf(s
, "%8s [%d] - %20s [0x%x] - [0x%x] %10s [%d]\n",
2829 "Process", adr_rec
->tracking_info
.recordID
.pid
,
2830 "Address", adr_rec
->mapping_address
,(adr_rec_user
->mapping_address
+ adr_rec_user
->size
),
2831 "Size", adr_rec
->size
);
2832 /* Show address allocation backtrace */
2833 ion_debugdb_show_backtrace(s
, &adr_rec
->tracking_info
, ALLOCATE_BACKTRACE_INFO
);
2834 /* Next address record */
2835 adr_rec
= (struct ion_address_usage_record
*)ion_get_data_from_record((void *)adr_rec
, RECORD_NEXT
);
2837 if(adr_rec_free
!= NULL
)
2839 seq_printf(s
, " %s\n","<ADDRESS_FREE_LIST>");
2842 while (!!adr_rec_free
) {
2843 seq_printf(s
, "%8s [%d] - %20s [0x%x] - [0x%x] %10s [%d]\n",
2844 "Process", adr_rec_free
->tracking_info
.recordID
.pid
,
2845 "Address", adr_rec_free
->mapping_address
,(adr_rec_free
->mapping_address
+ adr_rec_free
->size
),
2846 "Size", adr_rec_free
->size
);
2847 /* Show address release backtrace */
2848 ion_debugdb_show_backtrace(s
, &adr_rec_free
->tracking_info
, RELEASE_BACKTRACE_INFO
);
2849 /* Next address record */
2850 adr_rec_free
= (struct ion_address_usage_record
*)ion_get_data_from_record((void *)adr_rec_free
, RECORD_NEXT
);
2853 adr_rec_free
= NULL
;
2855 buf_rec
= buf_rec
->next
;
2857 mutex_unlock(&buffer_lifecycle_mutex
);
2861 printk(KERN_INFO
"DBIS_FDS\n");
2863 struct ion_fd_usage_record
*fd_rec
;
2864 while (process_rec
!= NULL
) {
2866 fd_rec
= ion_get_list(LIST_PROCESS
,process_rec
, FD_ALLOCATION_LIST
);
2867 //fd_rec2 = ion_get_list(LIST_PROCESS,process_rec, FD_FREE_LIST);
2870 process_rec
= process_rec
->next
;
2873 seq_printf(s
, "[%2d] %8s[0x%x] [%d] group_id [%d]\n",process_cnt
++, "process",(unsigned int)process_rec
, process_rec
->pid
,process_rec
->group_id
);
2876 seq_printf(s
, " %s\n","<FD_ALLOCATION_LIST>");
2880 seq_printf(s
, " %s\n","<NO_FD_ALLOCATION_LIST>");
2884 seq_printf(s
, " %8s[0x%x] [%d] - %8s [%d]\n",
2885 "Process",(unsigned int)process_rec
, fd_rec
->tracking_info
.recordID
.pid
,
2886 "inused Fd", fd_rec
->fd
);
2887 /* Show fd allocation backtrace */
2888 ion_debugdb_show_backtrace(s
, &fd_rec
->tracking_info
, ALLOCATE_BACKTRACE_INFO
);
2889 /* Next fd record */
2890 fd_rec
= (struct ion_fd_usage_record
*)ion_get_data_from_record((void *)fd_rec
, RECORD_NEXT
);
2895 seq_printf(s
, " %s\n","<FD_FREE_LIST>");
2899 seq_printf(s
, "%7s[0x%x] [%d] - %6s [%d]\n",
2900 "Process",process_rec
, fd_rec2
->tracking_info
.recordID
.pid
,
2901 "freed Fd", fd_rec2
->fd
);
2902 /* Show fd release backtrace */
2903 ion_debugdb_show_backtrace(s
, &fd_rec2
->tracking_info
, RELEASE_BACKTRACE_INFO
);
2904 /* Next fd record */
2905 fd_rec2
= (struct ion_fd_usage_record
*)ion_get_data_from_record((void *)fd_rec2
, RECORD_NEXT
);
2909 process_rec
= process_rec
->next
;
2914 printk(KERN_INFO
"DBIS_PIDS\n");
2916 struct dbis_process_entry proclist
= {.pid
= -1, .clients
= NULL
, .next
= NULL
};
2917 struct dbis_process_entry
*pe
= NULL
;
2918 struct dbis_client_entry
*ce
= NULL
;
2919 struct ion_process_record
*current_process_rec
= NULL
;
2920 struct ion_client_usage_record
*current_client_rec
= NULL
;
2921 struct ion_fd_usage_record
*current_fd_usage_rec
= NULL
;
2922 struct ion_address_usage_record
*current_mmap_usage_rec
= NULL
;
2923 process_rec
= ion_get_inuse_process_usage_record2();
2924 /* Firstly, we should go through all clients. */
2925 for (cn
= rb_first(&dev
->clients
); cn
; cn
= rb_next(cn
)) {
2926 client
= rb_entry(cn
, struct ion_client
, node
);
2927 dbis_insert_proc_clients(&proclist
, client
, client
->pid
);
2930 /* Now we can go through all processes using ION. */
2933 while (pe
!= NULL
) {
2934 seq_printf(s
, "%s[%d]\n","Process", pe
->pid
);
2935 current_process_rec
= process_rec
;
2936 while (current_process_rec
!= NULL
) {
2937 if(current_process_rec
->pid
== pe
->pid
)
2939 printk("found process pid %d in record\n",current_process_rec
->pid
);
2942 current_process_rec
= current_process_rec
->next
;
2944 if(current_process_rec
== NULL
)
2946 seq_printf(s
, "ERROR!!!! can't find process pid %d in record \n",pe
->pid
);
2947 printk("ERROR!!!! can't find process pid %d in record\n",pe
->pid
);
2950 /* Go through all clients for this pe */
2953 while (ce
!= NULL
) {
2954 client
= ce
->client
;
2955 current_client_rec
= (struct ion_client_usage_record
*)client_rec
;
2956 while(current_client_rec
!= NULL
)
2958 if((current_client_rec
->tracking_info
.recordID
.client_address
== (unsigned int)client
)&&(current_client_rec
->tracking_info
.recordID
.pid
== pe
->pid
))
2960 printk("found client client address 0x%x",current_client_rec
->tracking_info
.recordID
.client_address
);
2963 current_client_rec
= (struct ion_client_usage_record
*)current_client_rec
->next
;
2965 /* Show all client information */
2966 if(current_client_rec
!= NULL
)
2968 seq_printf(s
, "\n%8s[%2d] %12p fd[%d]\n", "client", client_cnt
++, client
,current_client_rec
->fd
);
2972 seq_printf(s
, "\n%8s[%2d] %12p\n", "client", client_cnt
++, client
);
2974 mutex_lock(&client
->lock
);
2975 /* All client-handles */
2976 for (hn
= rb_first(&client
->handles
); hn
; hn
= rb_next(hn
)) {
2977 handle
= rb_entry(hn
, struct ion_handle
, node
);
2978 seq_printf(s
, "%10s[%2d](0x%x) ref_count %d kmap_cnt(%d)\n", "handle", buffer_cnt
,(unsigned int)handle
,atomic_read(&handle
->ref
.refcount
),handle
->kmap_cnt
);
2979 /* All client-handle-buffers */
2980 buffer
= handle
->buffer
;
2981 current_fd_usage_rec
= current_process_rec
->fd_using_list
;
2982 while(current_fd_usage_rec
!= NULL
)
2984 if((current_fd_usage_rec
->buffer
== buffer
) && (current_fd_usage_rec
->handle
== handle
))
2988 current_fd_usage_rec
= (struct ion_fd_usage_record
*)current_fd_usage_rec
->next
;
2990 mutex_lock(&buffer
->lock
);
2991 if(current_fd_usage_rec
!= NULL
)
2993 seq_printf(s
, "%14s[%2d] fd(%d) heap(%s) ref_count(%d)flags(%d) buffer(0x%x) addr(0x%x) size(%d) \n",
2994 "--buffer", buffer_cnt
++,current_fd_usage_rec
->fd
, buffer
->heap
->name
,(int)atomic_read(&buffer
->ref
.refcount
),(int)buffer
->flags
,
2995 (unsigned int)buffer
,(unsigned int)buffer
->vaddr
,(int)buffer
->size
);
2999 seq_printf(s
, "%14s[%2d] heap(%s) flags(%d) buffer (0x%x) addr(0x%x) size(%d) kmap_cnt(%d) kvaddr(0x%x)\n",
3000 "--buffer", buffer_cnt
++,buffer
->heap
->name
, (int)buffer
->flags
,
3001 (unsigned int)buffer
,(unsigned int)buffer
->vaddr
,(int)buffer
->size
,(int)buffer
->kmap_cnt
, (unsigned int)buffer
->vaddr
);
3003 mutex_unlock(&buffer
->lock
);
3004 current_mmap_usage_rec
= current_process_rec
->address_using_list
;
3005 while(current_mmap_usage_rec
!= NULL
)
3007 if(current_mmap_usage_rec
->buffer
== buffer
)
3009 seq_printf(s
,"%16s mapping address[0x%x - 0x%x] size(%d)\n","----buffer",current_mmap_usage_rec
->mapping_address
,current_mmap_usage_rec
->mapping_address
+current_mmap_usage_rec
->size
,current_mmap_usage_rec
->size
);
3011 current_mmap_usage_rec
= current_mmap_usage_rec
->next
;
3014 mutex_unlock(&client
->lock
);
3024 /* Finally, delete all entries in proclist */
3025 destroy_proclist(&proclist
);
3030 printk(KERN_INFO
"DBIS_MODS\n");
3041 static int ion_debug_dbis_open(struct inode
*inode
, struct file
*file
)
3043 return single_open(file
, ion_debug_dbis_show
, inode
->i_private
);
3046 static const struct file_operations debug_dbis_fops
= {
3047 .open
= ion_debug_dbis_open
,
3049 .llseek
= seq_lseek
,
3050 .release
= single_release
,
3053 static void ion_debug_create_db(struct dentry
*root
)
3057 /* Create checking_leakage folder */
3058 debug_db_root
.checking_leakage
= debugfs_create_dir("checking_leakage", root
);
3059 INIT_LIST_HEAD(&debug_db_root
.dbcl
.child
);
3061 /* Create ion_statistics folder & its children */
3062 debug_db_root
.ion_statistics
= debugfs_create_dir("ion_statistics", root
);
3063 for (index
= 0; index
<= _TOTAL_DBIS
; ++index
)
3065 if (dbis_child_attr
[index
].attr
== DBIS_FILE
)
3067 debug_db_root
.dbis
.child
[index
]
3068 = debugfs_create_file(dbis_child_attr
[index
].name
, 0444, debug_db_root
.ion_statistics
,(void *)index
, &debug_dbis_fops
);
3071 {/* This is only for history now. */
3072 debug_db_root
.dbis
.child
[index
] = debugfs_create_dir(dbis_child_attr
[index
].name
, debug_db_root
.ion_statistics
);
3074 for (his_index
= 0; his_index
< _TOTAL_DBIS
; ++his_index
) {
3075 debug_db_root
.dbis
.history_record
[his_index
]
3076 = debugfs_create_file(dbis_child_attr
[index
+his_index
+1].name
, 0444, debug_db_root
.dbis
.child
[index
], his_index
+index
+1, &debug_dbis_fops
);
3079 /* client - Use (DBIS_CLIENTS + DBIS_DIR) to identify history/clients */
3080 debug_db_root
.dbis
.history_record
[0]
3081 = debugfs_create_file(dbis_child_attr
[DBIS_CLIENTS
].name
, 0444,
3082 debug_db_root
.dbis
.child
[index
], (void *)(DBIS_CLIENTS
+ DBIS_DIR
), &debug_dbis_fops
);
3084 /* buffers - Use (DBIS_BUFFERS + DBIS_DIR) to identify history/buffers */
3085 debug_db_root
.dbis
.history_record
[1]
3086 = debugfs_create_file(dbis_child_attr
[DBIS_BUFFERS
].name
, 0444,
3087 debug_db_root
.dbis
.child
[index
], (void *)(DBIS_BUFFERS
+ DBIS_DIR
), &debug_dbis_fops
);
3088 /* mmaps - Use (DBIS_MMAPS + DBIS_DIR) to identify history/mmaps */
3089 debug_db_root
.dbis
.history_record
[2]
3090 = debugfs_create_file(dbis_child_attr
[DBIS_MMAPS
].name
, 0444,
3091 debug_db_root
.dbis
.child
[index
], (void *)(DBIS_MMAPS
+ DBIS_DIR
), &debug_dbis_fops
);
3092 /* fds - Use (DBIS_fdS + DBIS_DIR) to identify history/fds */
3093 debug_db_root
.dbis
.history_record
[3]
3094 = debugfs_create_file(dbis_child_attr
[DBIS_FDS
].name
, 0444,
3095 debug_db_root
.dbis
.child
[index
], (void *)(DBIS_FDS
+ DBIS_DIR
), &debug_dbis_fops
);
3096 /* pids - Use (DBIS_PIDS + DBIS_DIR) to identify history/pids */
3097 debug_db_root
.dbis
.history_record
[4]
3098 = debugfs_create_file(dbis_child_attr
[DBIS_PIDS
].name
, 0444,
3099 debug_db_root
.dbis
.child
[index
], (void *)(DBIS_PIDS
+ DBIS_DIR
), &debug_dbis_fops
);
3104 static void ion_debug_db_create_clentry(pid_t pid
)
3106 struct list_head
*pos
, *n
;
3107 struct dbcl_child
*found
;
3111 /* Check whether pid is in the cl list*/
3112 list_for_each_safe(pos
, n
, &debug_db_root
.dbcl
.child
) {
3113 found
= list_entry(pos
, struct dbcl_child
, entry
);
3114 if ((pid_t
)found
->raw_key
== pid
) {
3115 /* We have found one. */
3116 atomic_inc(&found
->refcount
);
3121 /* No existing entry */
3122 found
= kmalloc(sizeof(struct dbcl_child
), GFP_KERNEL
);
3123 found
->raw_key
= (void *)pid
;
3124 snprintf(process_id
, 6, "%d", pid
);
3125 found
->root
= debugfs_create_dir(process_id
, debug_db_root
.checking_leakage
);
3126 for (index
= 0; index
< _TOTAL_DBCL
; ++index
) {
3127 found
->type
[index
] = debugfs_create_file(dbcl_child_name
[index
], 0444, found
->root
, (void *)((index
<< 16) | pid
), &debug_dbcl_fops
);
3129 atomic_set(&found
->refcount
, 1);
3130 list_add_tail(&found
->entry
, &debug_db_root
.dbcl
.child
);
3133 static void ion_debug_db_destroy_clentry(pid_t pid
)
3135 struct list_head
*pos
, *n
;
3136 struct dbcl_child
*found
;
3138 /* Check whether pid is in the cl list*/
3139 list_for_each_safe(pos
, n
, &debug_db_root
.dbcl
.child
) {
3140 found
= list_entry(pos
, struct dbcl_child
, entry
);
3141 if ((pid_t
)found
->raw_key
== pid
) {
3142 /* We have found one. */
3143 if (atomic_dec_and_test(&found
->refcount
)) {
3144 /* Delete list entry, remove corresponding debugfs dir/files, free memory. */
3145 list_del(&found
->entry
);
3146 debugfs_remove_recursive(found
->root
);
3153 printk(KERN_DEBUG
"Oh!!!!!\n");