[PATCH 0/3] mm: cma: debugfs access to CMA

[PATCH 0/3] mm: cma: debugfs access to CMA

[Sasha Levin]

I've noticed that there is no interfaces exposed by CMA which would let me
fuzz what's going on in there.

This small patch set exposes some information out to userspace, plus adds
the ability to trigger allocation and freeing from userspace.

Sasha Levin (3):
  mm: cma: debugfs interface
  mm: cma: allocation trigger
  mm: cma: release trigger

 mm/Kconfig     |    6 ++
 mm/Makefile    |    1 +
 mm/cma.c       |   19 ++----
 mm/cma.h       |   20 +++++++
 mm/cma_debug.c |  175 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 206 insertions(+), 15 deletions(-)
 create mode 100644 mm/cma.h
 create mode 100644 mm/cma_debug.c

-- 
1.7.10.4

[PATCH 1/3] mm: cma: debugfs interface

[Sasha Levin]

Implement a simple debugfs interface to expose information about CMA areas
in the system.

Useful for testing/sanity checks for CMA since it was impossible to previously
retrieve this information in userspace.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
---
 mm/Kconfig     |    6 ++++++
 mm/Makefile    |    1 +
 mm/cma.c       |   19 ++++--------------
 mm/cma.h       |   20 +++++++++++++++++++
 mm/cma_debug.c |   61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 92 insertions(+), 15 deletions(-)
 create mode 100644 mm/cma.h
 create mode 100644 mm/cma_debug.c

diff --git a/mm/Kconfig b/mm/Kconfig
index a03131b..390214d 100644
--- a/mm/Kconfig
+++ b/mm/Kconfig
@@ -517,6 +517,12 @@ config CMA_DEBUG
 	  processing calls such as dma_alloc_from_contiguous().
 	  This option does not affect warning and error messages.
 
+config CMA_DEBUGFS
+	bool "CMA debugfs interface"
+	depends on CMA && DEBUG_FS
+	help
+	  Turns on the DebugFS interface for CMA.
+
 config CMA_AREAS
 	int "Maximum count of the CMA areas"
 	depends on CMA
diff --git a/mm/Makefile b/mm/Makefile
index 3548460..9ec12b4 100644
--- a/mm/Makefile
+++ b/mm/Makefile
@@ -73,3 +73,4 @@ obj-$(CONFIG_GENERIC_EARLY_IOREMAP) += early_ioremap.o
 obj-$(CONFIG_CMA)	+= cma.o
 obj-$(CONFIG_MEMORY_BALLOON) += balloon_compaction.o
 obj-$(CONFIG_PAGE_EXTENSION) += page_ext.o
+obj-$(CONFIG_CMA_DEBUGFS) += cma_debug.o
diff --git a/mm/cma.c b/mm/cma.c
index a85ae28..6a0b248 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -35,16 +35,10 @@
 #include <linux/highmem.h>
 #include <linux/io.h>
 
-struct cma {
-	unsigned long	base_pfn;
-	unsigned long	count;
-	unsigned long	*bitmap;
-	unsigned int order_per_bit; /* Order of pages represented by one bit */
-	struct mutex	lock;
-};
-
-static struct cma cma_areas[MAX_CMA_AREAS];
-static unsigned cma_area_count;
+#include "cma.h"
+
+struct cma cma_areas[MAX_CMA_AREAS];
+unsigned cma_area_count;
 static DEFINE_MUTEX(cma_mutex);
 
 phys_addr_t cma_get_base(struct cma *cma)
@@ -75,11 +69,6 @@ static unsigned long cma_bitmap_aligned_offset(struct cma *cma, int align_order)
 		(cma->base_pfn >> cma->order_per_bit);
 }
 
-static unsigned long cma_bitmap_maxno(struct cma *cma)
-{
-	return cma->count >> cma->order_per_bit;
-}
-
 static unsigned long cma_bitmap_pages_to_bits(struct cma *cma,
 						unsigned long pages)
 {
diff --git a/mm/cma.h b/mm/cma.h
new file mode 100644
index 0000000..4141887
--- /dev/null
+++ b/mm/cma.h
@@ -0,0 +1,20 @@
+#ifndef __MM_CMA_H__
+#define __MM_CMA_H__
+
+struct cma {
+	unsigned long   base_pfn;
+	unsigned long   count;
+	unsigned long   *bitmap;
+	unsigned int order_per_bit; /* Order of pages represented by one bit */
+	struct mutex    lock;
+};
+
+extern struct cma cma_areas[MAX_CMA_AREAS];
+extern unsigned cma_area_count;
+
+static unsigned long cma_bitmap_maxno(struct cma *cma)
+{
+	return cma->count >> cma->order_per_bit;
+}
+
+#endif
diff --git a/mm/cma_debug.c b/mm/cma_debug.c
new file mode 100644
index 0000000..3a25413
--- /dev/null
+++ b/mm/cma_debug.c
@@ -0,0 +1,61 @@
+/*
+ * CMA DebugFS Interface
+ *
+ * Copyright (c) 2015 Sasha Levin <sasha.levin@oracle.com>
+ */
+ 
+
+#include <linux/debugfs.h>
+#include <linux/cma.h>
+
+#include "cma.h"
+
+static struct dentry *cma_debugfs_root;
+
+static int cma_debugfs_get(void *data, u64 *val)
+{
+	unsigned long *p = data;
+
+	*val = *p;
+
+	return 0;
+} 
+
+DEFINE_SIMPLE_ATTRIBUTE(cma_debugfs_fops, cma_debugfs_get, NULL, "%llu\n");
+
+static void cma_debugfs_add_one(struct cma *cma, int idx)
+{
+	struct dentry *tmp;
+	char name[16];
+	int u32s;
+
+	sprintf(name, "cma-%d", idx);
+
+	tmp = debugfs_create_dir(name, cma_debugfs_root);
+
+	debugfs_create_file("base_pfn", S_IRUGO, tmp,
+				&cma->base_pfn, &cma_debugfs_fops);
+	debugfs_create_file("count", S_IRUGO, tmp,
+				&cma->count, &cma_debugfs_fops);
+	debugfs_create_file("order_per_bit", S_IRUGO, tmp,
+			&cma->order_per_bit, &cma_debugfs_fops);
+
+	u32s = DIV_ROUND_UP(cma_bitmap_maxno(cma), BITS_PER_BYTE * sizeof(u32));
+	debugfs_create_u32_array("bitmap", S_IRUGO, tmp, (u32*)cma->bitmap, u32s);
+}
+
+static int __init cma_debugfs_init(void)
+{
+	int i;
+
+	cma_debugfs_root = debugfs_create_dir("cma", NULL);
+	if (!cma_debugfs_root)
+		return -ENOMEM;
+
+	for (i = 0; i < cma_area_count; i++)
+		cma_debugfs_add_one(&cma_areas[i], i);
+
+	return 0;
+}
+late_initcall(cma_debugfs_init);
+
-- 
1.7.10.4

[PATCH 2/3] mm: cma: allocation trigger

[Sasha Levin]

Provides a userspace interface to trigger a CMA allocation.

Usage:

	echo [pages] > alloc

This would provide testing/fuzzing access to the CMA allocation paths.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
---
 mm/cma_debug.c |   58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)

diff --git a/mm/cma_debug.c b/mm/cma_debug.c
index 3a25413..eda0a41 100644
--- a/mm/cma_debug.c
+++ b/mm/cma_debug.c
@@ -7,9 +7,22 @@
 
 #include <linux/debugfs.h>
 #include <linux/cma.h>
+#include <linux/list.h>
+#include <linux/kernel.h>
+#include <linux/dma-contiguous.h>
+#include <linux/slab.h>
 
 #include "cma.h"
 
+struct cma_mem {
+	struct hlist_node node;
+	struct page *p;
+	unsigned long n;
+};
+
+static HLIST_HEAD(cma_mem_head);
+static DEFINE_SPINLOCK(cma_mem_head_lock);
+
 static struct dentry *cma_debugfs_root;
 
 static int cma_debugfs_get(void *data, u64 *val)
@@ -44,6 +57,48 @@ static void cma_debugfs_add_one(struct cma *cma, int idx)
 	debugfs_create_u32_array("bitmap", S_IRUGO, tmp, (u32*)cma->bitmap, u32s);
 }
 
+static void cma_add_to_cma_mem_list(struct cma_mem *mem)
+{
+	spin_lock(&cma_mem_head_lock);
+	hlist_add_head(&mem->node, &cma_mem_head);
+	spin_unlock(&cma_mem_head_lock);
+}
+
+static int cma_alloc_mem(int count)
+{
+	struct cma_mem *mem;
+	struct page *p;
+
+	mem = kzalloc(sizeof(*mem), GFP_KERNEL);
+	if (!mem) 
+		return -ENOMEM;
+
+	p = cma_alloc(dma_contiguous_default_area, count, CONFIG_CMA_ALIGNMENT);
+	if (!p) {
+		pr_info("CMA: Allocation failed.\n");
+		kfree(mem);
+		return -ENOMEM;
+	}
+
+	pr_info("CMA: Allocated %d pages at %p\n", count, p);
+
+	mem->p = p;
+	mem->n = count;
+
+	cma_add_to_cma_mem_list(mem);
+
+	return 0;
+}
+
+static int cma_alloc_write(void *data, u64 val)
+{
+	int pages = val;
+
+	return cma_alloc_mem(pages);
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cma_alloc_fops, NULL, cma_alloc_write, "%llu\n");
+
 static int __init cma_debugfs_init(void)
 {
 	int i;
@@ -52,6 +107,9 @@ static int __init cma_debugfs_init(void)
 	if (!cma_debugfs_root)
 		return -ENOMEM;
 
+	debugfs_create_file("alloc", S_IWUSR, cma_debugfs_root, NULL,
+				&cma_alloc_fops);
+
 	for (i = 0; i < cma_area_count; i++)
 		cma_debugfs_add_one(&cma_areas[i], i);
 
-- 
1.7.10.4

[PATCH 3/3] mm: cma: release trigger

[Sasha Levin]

Provides a userspace interface to trigger a CMA release.

Usage:

	echo [pages] > free

This would provide testing/fuzzing access to the CMA release paths.

Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
---
 mm/cma_debug.c |   56 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 56 insertions(+)

diff --git a/mm/cma_debug.c b/mm/cma_debug.c
index eda0a41..7bb1da1 100644
--- a/mm/cma_debug.c
+++ b/mm/cma_debug.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 #include <linux/dma-contiguous.h>
 #include <linux/slab.h>
+#include <linux/mm_types.h>
 
 #include "cma.h"
 
@@ -64,6 +65,59 @@ static void cma_add_to_cma_mem_list(struct cma_mem *mem)
 	spin_unlock(&cma_mem_head_lock);
 }
 
+static struct cma_mem *cma_get_entry_from_list(void)
+{
+	struct cma_mem *mem = NULL;
+
+	spin_lock(&cma_mem_head_lock);
+	if (!hlist_empty(&cma_mem_head)) {
+		mem = hlist_entry(cma_mem_head.first, struct cma_mem, node);
+		hlist_del_init(&mem->node);
+	}
+	spin_unlock(&cma_mem_head_lock);
+
+	return mem;
+}
+
+static int cma_free_mem(int count)
+{
+	struct cma_mem *mem = NULL;
+
+	while (count) {
+		mem = cma_get_entry_from_list();
+		if (mem == NULL)
+			return 0;
+
+		if (mem->n <= count) {
+			cma_release(dma_contiguous_default_area, mem->p, mem->n);
+			pr_info("CMA: Freeing %lu pages from %p.\n",
+					mem->n, mem->p);
+			count -= mem->n;
+			kfree(mem);
+		} else {
+			cma_release(dma_contiguous_default_area, mem->p, count);
+			pr_info("CMA: Freeing %d pages from %p.\n",
+					count, mem->p);
+			mem->p += count;
+			mem->n -= count;
+			count = 0;
+			cma_add_to_cma_mem_list(mem);
+		}
+	}
+
+	return 0;
+			
+}
+
+static int cma_free_write(void *data, u64 val)
+{
+        int pages = val;
+
+        return cma_free_mem(pages);
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(cma_free_fops, NULL, cma_free_write, "%llu\n");
+
 static int cma_alloc_mem(int count)
 {
 	struct cma_mem *mem;
@@ -109,6 +163,8 @@ static int __init cma_debugfs_init(void)
 
 	debugfs_create_file("alloc", S_IWUSR, cma_debugfs_root, NULL,
 				&cma_alloc_fops);
+	debugfs_create_file("free", S_IWUSR, cma_debugfs_root, NULL,
+				&cma_free_fops);
 
 	for (i = 0; i < cma_area_count; i++)
 		cma_debugfs_add_one(&cma_areas[i], i);
-- 
1.7.10.4

Re: [PATCH 2/3] mm: cma: allocation trigger

[Joonsoo Kim]

On Tue, Jan 20, 2015 at 12:38:32PM -0500, Sasha Levin wrote:
> Provides a userspace interface to trigger a CMA allocation.
> 
> Usage:
> 
> 	echo [pages] > alloc
> 
> This would provide testing/fuzzing access to the CMA allocation paths.
> 
> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
> ---
>  mm/cma_debug.c |   58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 58 insertions(+)
> 
> diff --git a/mm/cma_debug.c b/mm/cma_debug.c
> index 3a25413..eda0a41 100644
> --- a/mm/cma_debug.c
> +++ b/mm/cma_debug.c
> @@ -7,9 +7,22 @@
>  
>  #include <linux/debugfs.h>
>  #include <linux/cma.h>
> +#include <linux/list.h>
> +#include <linux/kernel.h>
> +#include <linux/dma-contiguous.h>
> +#include <linux/slab.h>
>  
>  #include "cma.h"
>  
> +struct cma_mem {
> +	struct hlist_node node;
> +	struct page *p;
> +	unsigned long n;
> +};
> +
> +static HLIST_HEAD(cma_mem_head);
> +static DEFINE_SPINLOCK(cma_mem_head_lock);
> +
>  static struct dentry *cma_debugfs_root;
>  
>  static int cma_debugfs_get(void *data, u64 *val)
> @@ -44,6 +57,48 @@ static void cma_debugfs_add_one(struct cma *cma, int idx)
>  	debugfs_create_u32_array("bitmap", S_IRUGO, tmp, (u32*)cma->bitmap, u32s);
>  }
>  
> +static void cma_add_to_cma_mem_list(struct cma_mem *mem)
> +{
> +	spin_lock(&cma_mem_head_lock);
> +	hlist_add_head(&mem->node, &cma_mem_head);
> +	spin_unlock(&cma_mem_head_lock);
> +}
> +
> +static int cma_alloc_mem(int count)
> +{
> +	struct cma_mem *mem;
> +	struct page *p;
> +
> +	mem = kzalloc(sizeof(*mem), GFP_KERNEL);
> +	if (!mem) 
> +		return -ENOMEM;
> +
> +	p = cma_alloc(dma_contiguous_default_area, count, CONFIG_CMA_ALIGNMENT);
> +	if (!p) {
> +		pr_info("CMA: Allocation failed.\n");
> +		kfree(mem);
> +		return -ENOMEM;
> +	}

Hello,

I'm glad to see this patchset. I had similar one privately. :)
Without this kind of facility, testing CMA is really hard.

Anyway, dma_contiguous_default_area is defined only in CONFIG_DMA_CMA.
So, it would cause build break.

And, I think that it is better for this tester to have an ability to
allocate pages on specific CMA reserved region. It could be easily
achieved by moving 'alloc' registration to cma_debugfs_add_one(). Is
there any reason not to do that?

> +
> +	pr_info("CMA: Allocated %d pages at %p\n", count, p);

I don't think this output is needed. If CONFIG_CMA_DEBUG is enabled,
cma_alloc() print similar output.

Thanks.

Re: [PATCH 2/3] mm: cma: allocation trigger

[Sasha Levin]

On 01/22/2015 03:26 AM, Joonsoo Kim wrote:
> On Tue, Jan 20, 2015 at 12:38:32PM -0500, Sasha Levin wrote:
>> Provides a userspace interface to trigger a CMA allocation.
>>
>> Usage:
>>
>> 	echo [pages] > alloc
>>
>> This would provide testing/fuzzing access to the CMA allocation paths.
>>
>> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
>> ---
>>  mm/cma_debug.c |   58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>  1 file changed, 58 insertions(+)
>>
>> diff --git a/mm/cma_debug.c b/mm/cma_debug.c
>> index 3a25413..eda0a41 100644
>> --- a/mm/cma_debug.c
>> +++ b/mm/cma_debug.c
>> @@ -7,9 +7,22 @@
>>  
>>  #include <linux/debugfs.h>
>>  #include <linux/cma.h>
>> +#include <linux/list.h>
>> +#include <linux/kernel.h>
>> +#include <linux/dma-contiguous.h>
>> +#include <linux/slab.h>
>>  
>>  #include "cma.h"
>>  
>> +struct cma_mem {
>> +	struct hlist_node node;
>> +	struct page *p;
>> +	unsigned long n;
>> +};
>> +
>> +static HLIST_HEAD(cma_mem_head);
>> +static DEFINE_SPINLOCK(cma_mem_head_lock);
>> +
>>  static struct dentry *cma_debugfs_root;
>>  
>>  static int cma_debugfs_get(void *data, u64 *val)
>> @@ -44,6 +57,48 @@ static void cma_debugfs_add_one(struct cma *cma, int idx)
>>  	debugfs_create_u32_array("bitmap", S_IRUGO, tmp, (u32*)cma->bitmap, u32s);
>>  }
>>  
>> +static void cma_add_to_cma_mem_list(struct cma_mem *mem)
>> +{
>> +	spin_lock(&cma_mem_head_lock);
>> +	hlist_add_head(&mem->node, &cma_mem_head);
>> +	spin_unlock(&cma_mem_head_lock);
>> +}
>> +
>> +static int cma_alloc_mem(int count)
>> +{
>> +	struct cma_mem *mem;
>> +	struct page *p;
>> +
>> +	mem = kzalloc(sizeof(*mem), GFP_KERNEL);
>> +	if (!mem) 
>> +		return -ENOMEM;
>> +
>> +	p = cma_alloc(dma_contiguous_default_area, count, CONFIG_CMA_ALIGNMENT);
>> +	if (!p) {
>> +		pr_info("CMA: Allocation failed.\n");
>> +		kfree(mem);
>> +		return -ENOMEM;
>> +	}
> 
> Hello,
> 
> I'm glad to see this patchset. I had similar one privately. :)
> Without this kind of facility, testing CMA is really hard.
> 
> Anyway, dma_contiguous_default_area is defined only in CONFIG_DMA_CMA.
> So, it would cause build break.
> 
> And, I think that it is better for this tester to have an ability to
> allocate pages on specific CMA reserved region. It could be easily
> achieved by moving 'alloc' registration to cma_debugfs_add_one(). Is
> there any reason not to do that?

Agreed, that would make more sense.

>> +
>> +	pr_info("CMA: Allocated %d pages at %p\n", count, p);
> 
> I don't think this output is needed. If CONFIG_CMA_DEBUG is enabled,
> cma_alloc() print similar output.

I didn't see any other output (and I have CONFIG_CMA_DEBUG set), which
is why I've added this pr_info().


Thanks,
Sasha

Re: [PATCH 2/3] mm: cma: allocation trigger

[Joonsoo Kim]

On Thu, Jan 22, 2015 at 09:48:25PM -0500, Sasha Levin wrote:
> On 01/22/2015 03:26 AM, Joonsoo Kim wrote:
> > On Tue, Jan 20, 2015 at 12:38:32PM -0500, Sasha Levin wrote:
> >> Provides a userspace interface to trigger a CMA allocation.
> >>
> >> Usage:
> >>
> >> 	echo [pages] > alloc
> >>
> >> This would provide testing/fuzzing access to the CMA allocation paths.
> >>
> >> Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
> >> ---
> >>  mm/cma_debug.c |   58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> >>  1 file changed, 58 insertions(+)
> >>
> >> diff --git a/mm/cma_debug.c b/mm/cma_debug.c
> >> index 3a25413..eda0a41 100644
> >> --- a/mm/cma_debug.c
> >> +++ b/mm/cma_debug.c
> >> @@ -7,9 +7,22 @@
> >>  
> >>  #include <linux/debugfs.h>
> >>  #include <linux/cma.h>
> >> +#include <linux/list.h>
> >> +#include <linux/kernel.h>
> >> +#include <linux/dma-contiguous.h>
> >> +#include <linux/slab.h>
> >>  
> >>  #include "cma.h"
> >>  
> >> +struct cma_mem {
> >> +	struct hlist_node node;
> >> +	struct page *p;
> >> +	unsigned long n;
> >> +};
> >> +
> >> +static HLIST_HEAD(cma_mem_head);
> >> +static DEFINE_SPINLOCK(cma_mem_head_lock);
> >> +
> >>  static struct dentry *cma_debugfs_root;
> >>  
> >>  static int cma_debugfs_get(void *data, u64 *val)
> >> @@ -44,6 +57,48 @@ static void cma_debugfs_add_one(struct cma *cma, int idx)
> >>  	debugfs_create_u32_array("bitmap", S_IRUGO, tmp, (u32*)cma->bitmap, u32s);
> >>  }
> >>  
> >> +static void cma_add_to_cma_mem_list(struct cma_mem *mem)
> >> +{
> >> +	spin_lock(&cma_mem_head_lock);
> >> +	hlist_add_head(&mem->node, &cma_mem_head);
> >> +	spin_unlock(&cma_mem_head_lock);
> >> +}
> >> +
> >> +static int cma_alloc_mem(int count)
> >> +{
> >> +	struct cma_mem *mem;
> >> +	struct page *p;
> >> +
> >> +	mem = kzalloc(sizeof(*mem), GFP_KERNEL);
> >> +	if (!mem) 
> >> +		return -ENOMEM;
> >> +
> >> +	p = cma_alloc(dma_contiguous_default_area, count, CONFIG_CMA_ALIGNMENT);
> >> +	if (!p) {
> >> +		pr_info("CMA: Allocation failed.\n");
> >> +		kfree(mem);
> >> +		return -ENOMEM;
> >> +	}
> > 
> > Hello,
> > 
> > I'm glad to see this patchset. I had similar one privately. :)
> > Without this kind of facility, testing CMA is really hard.
> > 
> > Anyway, dma_contiguous_default_area is defined only in CONFIG_DMA_CMA.
> > So, it would cause build break.
> > 
> > And, I think that it is better for this tester to have an ability to
> > allocate pages on specific CMA reserved region. It could be easily
> > achieved by moving 'alloc' registration to cma_debugfs_add_one(). Is
> > there any reason not to do that?
> 
> Agreed, that would make more sense.
> 
> >> +
> >> +	pr_info("CMA: Allocated %d pages at %p\n", count, p);
> > 
> > I don't think this output is needed. If CONFIG_CMA_DEBUG is enabled,
> > cma_alloc() print similar output.
> 
> I didn't see any other output (and I have CONFIG_CMA_DEBUG set), which
> is why I've added this pr_info().

If you raise up your loglevel, you can see it.
That message is printed through pr_debug().

Thanks.