Memory leak in my driver (lengthy)???

Question

Someone please give me a hint on what happens here:
Test Program
===========
#define MEMSZ (256*1024)
main()
int devdes, count;
char devname[31];
unsigned char * buffer;
strcpy(devname,"/dev/mydriver\0") ;
devdes = open(devname,O_RDWR) ;
buffer = (unsigned char *)malloc(MEMSZ);
while(1){
i++;
count = read(devdes, buffer, MEMSZ);
if(count < 0)
printf("i = %d ERROR - errno=%d\n",i, errno);
break;
My Driver
=======
my_read(dev_t dev, struct uio uiop, cred_t credp) {
return (physio(my_strategy, (struct buf *)NULL, dev, B_READ, my_minphys,
uiop));
my_strategy(struct buf *bp)
//pdx is my soft state
pdx->buf_p = bp;
Allocate dma handle for user data buffer
if(ddi_dma_alloc_handle(pdx->dip, &pdx->dma_attr, DDI_DMA_DONTWAIT,
(caddr_t)0, &pdx->dma_handle) != DDI_SUCCESS) {
cmn_err(CE_WARN,"my_strategy: instance %d: ddi_dma_alloc_handle failure!",
instance) ;
bp->b_error |= EIO;
bp->b_flags |= B_ERROR;
biodone(bp);
return (0);
if (ddi_dma_buf_bind_handle(pdx->dma_handle, bp, DDI_DMA_READ|
DDI_DMA_CONSISTENT, DDI_DMA_DONTWAIT,
(caddr_t)0, &dma_cookie, &cookie_count) != DDI_DMA_MAPPED) {
cmn_err(CE_WARN,"my_strategy: instance %d: ddi_dma_buf_bind_handle
failure!", instance);
ddi_dma_free_handle(&pdx->dma_handle);
bp->b_error |= EIO;
bp->b_flags |= B_ERROR;
biodone(bp);
return (0);
* set up descriptor lists on the board based on each cookie
pdx->cookie_count = cookie_count;
ddi_put32(pdx->my_regs_handle,(uint32_t *)(pdx->my_base+HL_COMMAND),
CMD_SGREAD);
temp = HL_ARGS;
do {
ddi_put32(pdx->my_regs_handle,(uint32_t *)(pdx->my_base+temp),
dma_cookie.dmac_size);
temp += 4;
ddi_put32(pdx->my_regs_handle,(uint32_t *)(pdx->my_base+temp),
dma_cookie.dmac_address);
temp += 4;
cookie_count--;
if (cookie_count != 0)
ddi_dma_nextcookie(pdx->dma_handle, &dma_cookie);
else break;
} while (1);
ddi_put32(pdx->my_regs_handle,(uint32_t *)(pdx->my_base+temp), 0);
temp += 4;
ddi_put32(pdx->my_regs_handle,(uint32_t *)(pdx->my_base+temp), 0);
DELIVER_COMMAND(pdx, 1); //start DMA
return (0);
#define DMA_MINPHYS 0xffffffff
my_minphys(struct buf *bp)
minphys(bp);
bp->b_bcount = (min(bp->b_bcount, DMA_MINPHYS));
my_intr(...)
mutex_enter(&pdx->mutex);
ddi_dma_unbind_handle(pdx->dma_handle);
ddi_dma_free_handle(&pdx->dma_handle);
biodone(pdx->buf_p);
mutex_exit(&pdx->mutex);
return(DDI_INTR_CLAIMED);
NOTE:
The following is dma_attr:
pdx->dma_attr.dma_attr_version = DMA_ATTR_V0;
pdx->dma_attr.dma_attr_addr_lo = 0x0;
pdx->dma_attr.dma_attr_addr_hi = 0xFFFFFFFF;
pdx->dma_attr.dma_attr_count_max = 0xFFFFFFFF;
pdx->dma_attr.dma_attr_align = 0x1;
pdx->dma_attr.dma_attr_burstsizes = 0x17;
pdx->dma_attr.dma_attr_minxfer = 0x4;
pdx->dma_attr.dma_attr_maxxfer = 0xFFFFFFFF;
pdx->dma_attr.dma_attr_seg = 0xFFFFFFFF;
pdx->dma_attr.dma_attr_sgllen = 1;
pdx->dma_attr.dma_attr_granular = 1;
pdx->dma_attr.dma_attr_flags = 0x0;
What Happens
============
My test program does nothing but read 256k data out of my PCI board and
throw them to the ground. It is a stress test. It stops and shows
"i = 8192 ERROR = 22", which I figure means 8192 x 256K = 2G. I check my
driver code, and I don't allocate any memory and I only use whatever the
user program allocates. I unbindle_handle and free_handle for each
interrupt.(I only have one interrupt from my board; that is DMA done
interrupt). I hope I have given as much detail as possible. Is there
anything wrong in my driver that causes the possible memory leak?
Thanks

Answer 1

Hi tyh,
There is a lovely feature in mdb that allows you to track down memory usage in kernel modules (including drivers of course), so the hint is rather straight-forward: get the mdb (comes with Solaris 8), read the AnswerBook (available at docs.sun.com) and you are 75% done :).
Good luck ;)
--I.