mbuf cookie

 

rte_pktmbuf_pool_create: mmempool create 的时候调用
设置mempool obj的cookie

static void
mempool_add_elem(struct rte_mempool *mp, void *obj, phys_addr_t physaddr)
{
    struct rte_mempool_objhdr *hdr;
    struct rte_mempool_objtlr *tlr __rte_unused;

    /* set mempool ptr in header */
    hdr = RTE_PTR_SUB(obj, sizeof(*hdr));
    hdr->mp = mp;
    hdr->physaddr = physaddr;
    STAILQ_INSERT_TAIL(&mp->elt_list, hdr, next);
    mp->populated_size++;

#ifdef RTE_LIBRTE_MEMPOOL_DEBUG
    hdr->cookie = RTE_MEMPOOL_HEADER_COOKIE2; 
    tlr = __mempool_get_trailer(obj);
    tlr->cookie = RTE_MEMPOOL_TRAILER_COOKIE;
#endif

    /* enqueue in ring */
    rte_mempool_ops_enqueue_bulk(mp, &obj, 1);
}

 

rte_mempool_get 会调用

更改hdr->cookie 

hdr->cookie = RTE_MEMPOOL_HEADER_COOKIE2;  
-->

hdr->cookie = RTE_MEMPOOL_HEADER_COOKIE1; 

rte_mempool_generic_get(struct rte_mempool *mp, void **obj_table,
                        unsigned int n, struct rte_mempool_cache *cache)
{
        int ret;
        ret = __mempool_generic_get(mp, obj_table, n, cache);
        if (ret == 0)
                __mempool_check_cookies(mp, obj_table, n, 1);
        return ret;
}

 

更改hdr->cookie 

hdr->cookie = RTE_MEMPOOL_HEADER_COOKIE1;  
-->

hdr->cookie = RTE_MEMPOOL_HEADER_COOKIE2; 

 

static __rte_always_inline void
rte_mempool_generic_put(struct rte_mempool *mp, void * const *obj_table,
                        unsigned int n, struct rte_mempool_cache *cache)
{
        __mempool_check_cookies(mp, obj_table, n, 0);
        __mempool_generic_put(mp, obj_table, n, cache);
}

rte_mempool_check_cookies

free =2 ,提供给rte_mempool_audit(mp)

free =1 提供给 rte_mempool_generic_get

free = 0 提供给rte_mempool_generic_put

/* check and update cookies or panic (internal) */
void rte_mempool_check_cookies(const struct rte_mempool *mp,
    void * const *obj_table_const, unsigned n, int free)
{
#ifdef RTE_LIBRTE_MEMPOOL_DEBUG
    struct rte_mempool_objhdr *hdr;
    struct rte_mempool_objtlr *tlr;
    uint64_t cookie;
    void *tmp;
    void *obj;
    void **obj_table;

    /* Force to drop the "const" attribute. This is done only when
     * DEBUG is enabled */
    tmp = (void *) obj_table_const;
    obj_table = tmp;

    while (n--) {
        obj = obj_table[n];

        if (rte_mempool_from_obj(obj) != mp)
            rte_panic("MEMPOOL: object is owned by another "
                  "mempool\n");

        hdr = __mempool_get_header(obj);
        cookie = hdr->cookie;

        if (free == 0) {
            if (cookie != RTE_MEMPOOL_HEADER_COOKIE1) {
                RTE_LOG(CRIT, MEMPOOL,
                    "obj=%p, mempool=%p, cookie=%" PRIx64 "\n",
                    obj, (const void *) mp, cookie);
                rte_panic("MEMPOOL: bad header cookie (put)\n");
            }
            hdr->cookie = RTE_MEMPOOL_HEADER_COOKIE2;
        } else if (free == 1) {
            if (cookie != RTE_MEMPOOL_HEADER_COOKIE2) {
                RTE_LOG(CRIT, MEMPOOL,
                    "obj=%p, mempool=%p, cookie=%" PRIx64 "\n",
                    obj, (const void *) mp, cookie);
                rte_panic("MEMPOOL: bad header cookie (get)\n");
            }
            hdr->cookie = RTE_MEMPOOL_HEADER_COOKIE1;
        } else if (free == 2) {
            if (cookie != RTE_MEMPOOL_HEADER_COOKIE1 &&
                cookie != RTE_MEMPOOL_HEADER_COOKIE2) {
                RTE_LOG(CRIT, MEMPOOL,
                    "obj=%p, mempool=%p, cookie=%" PRIx64 "\n",
                    obj, (const void *) mp, cookie);
                rte_panic("MEMPOOL: bad header cookie (audit)\n");
            }
        }
        tlr = __mempool_get_trailer(obj);
        cookie = tlr->cookie;
        if (cookie != RTE_MEMPOOL_TRAILER_COOKIE) {
            RTE_LOG(CRIT, MEMPOOL,
                "obj=%p, mempool=%p, cookie=%" PRIx64 "\n",
                obj, (const void *) mp, cookie);
            rte_panic("MEMPOOL: bad trailer cookie\n");
        }
    }
#else
    RTE_SET_USED(mp);
    RTE_SET_USED(obj_table_const);
    RTE_SET_USED(n);
    RTE_SET_USED(free);
#endif
}

 

 

【DPDK17.11】记录一次由dpdk的野指针造成的coredump过程