Difference between revisions of "DMA Mapping Error Analysis"

From Linux Driver Project
Jump to: navigation, search
(Good)
 
mediawikimediawiki

(24 intermediate revisions by one user not shown)

Line 1: Line 1:
==== DMA memory map error check analysis ====
+
==== DMA Mapping Error Check Analysis ====
  
I analyzed all calls to dma_map_single() and dma_map_page() in the kernel to see if dma mapping errors are checked by the callers after mapping routines return. The goal of this analysis is to find drivers that don't currently check dma mapping errors and fix them. I did a grep for dma_map_single() and dma_map_page() and looked at the code that calls these routines. As a side note, this analysis stemmed from the discussion on my patch that disables swiotlb overflow as a first step towards removing the support all together.
+
I analyzed all calls to dma_map_single() and dma_map_page() in the kernel, to see if callers check for mapping errors, before using the returned address. The goal of this analysis is to find drivers that currently do not check dma mapping errors, and fix them. I did a grep for dma_map_single() and dma_map_page() and looked at the code that calls these routines. As a side note, this analysis stemmed from the discussion on my patch that disables swiotlb overflow as a first step towards removing the support all together.
  
'''Reference linux-next August 6 2012''' is used as the base for this analysis.
+
'''linux-next August 6 2012''' is used as the base for this analysis.
  
I classified the results of dma mapping error check status as follows:
+
I classified the results into three categories, Broken, Partially Broken, Unmap Broken, and Good. Details below:
  
'''Broken:'''
+
===== Broken =====
  
# No error checks
+
# Broken - No dma mapping error checks done on the returned address.
# Partial checks - In that source file, not all calls are followed by checks.
+
# Partially Broken - In that source file, not all calls are followed by mapping error checks.
# Checks dma mapping errors, doesn't unmap already mapped pages when mapping error occurs in the middle of a multiple mapping attempt.
+
# Unmap broken - Checks dma mapping errors, however doesn't unmap already mapped pages when mapping error occurs in the middle of a multiple page mapping attempt.
  
The first two categories are classified as broken and need fixing. The third one needs fixing, since it leaves dangling mapped pages, and holds on to them which is equivalent to memory leak. Some drivers release all mapped pages when the device closes, but others don't. Not doing unmap might be harmless on some architectures going by the comments I found in some source files.
 
  
'''Good:'''
+
The first two categories Broken, and Partially Broken are classified as severe and need fixing. The third one needs fixing, since it leaves dangling mapped pages, and holds on to them which is equivalent to a memory leak condition. Some drivers release all mapped pages when the device closes, but others don't. Not doing unmap might be harmless on some architectures going by the comments I found in some source files.
  
# Checks dma mapping errors and unmaps already mapped pages when mapping error occurs in the middle of a multiple mapping attempt.
+
===== Good =====
 +
 
 +
# Checks dma mapping errors and unmaps already mapped pages when mapping error occurs in the middle of a multiple page mapping attempt.
 
# Checks dma mapping errors without unlikely()
 
# Checks dma mapping errors without unlikely()
 
# Checks dma mapping errors with unlikely()
 
# Checks dma mapping errors with unlikely()
  
I grouped the above three cases as good cases. Using unlikely() is icing on the cake, and something we don't need to be concerned about considering the other more serious problems in this area.
 
  
'''dmap_map_single() - results'''
+
I grouped the above three cases as good cases. Using unlikely() is not recommended in all cases and these cases need attention, however we don't need to be concerned about considering the other more serious problems in this area.
  
* No error checks - 195 (46%)
+
==== dmap_map_single() - results ====
* Partial checks - 46 (11%)
+
 
* Doesn't unmap: 26 (6%)
+
* Broken - 195 (46%)
 +
* Partially broken - 46 (11%)
 +
* Unmap broken: 26 (6%)
 
* Good: 147 (35%)
 
* Good: 147 (35%)
  
'''dma_map_page() - results'''
+
==== dma_map_page() - results ====
  
* No error checks: 61 (59%)
+
* Broken: 61 (59%)
* Partial checks: 7 (.06%)
+
* Partially broken: 7 (.06%)
* Doesn't unmap: 15 (14.5%)
+
* Unmap broken: 15 (14.5%)
 
* Good: 20 (19%)
 
* Good: 20 (19%)
  
In summary a large % of the cases (> 50%) go unchecked. That raises the following questions:
+
In summary, a large % of the cases (> 50%) go unchecked. This raises the following questions:
  
 
* When do mapping errors get detected?
 
* When do mapping errors get detected?
Line 43: Line 45:
 
* Why don't we see failures related to missing dma mapping error checks?
 
* Why don't we see failures related to missing dma mapping error checks?
 
* Are they silent failures?
 
* Are they silent failures?
 +
  
 
I propose the following next steps to gather more information and understand the severity of the problem.
 
I propose the following next steps to gather more information and understand the severity of the problem.
Line 48: Line 51:
 
==== Next Steps ====
 
==== Next Steps ====
  
* Ehnance swiotlb or dma-debug infrastructure to track how often overflow buffer is triggered. I am working on this change.
+
* Enhanced dma-debug infrastructure to track dma map and unmap errors. A new interface debug_dma_mapping_error() is added to dma-debug API in 3.9 release. CommitID: 6c9c6d6301287e369a754d628230fa6e50cdb74b: Add dma-debug interface debug_dma_mapping_error() to debug drivers that fail to check dma mapping errors on addresses returned by dma_map_single() and dma_map_page() interfaces. This interface clears a flag set by debug_dma_map_page() to indicate that dma_mapping_error() has been called by the driver. When driver does unmap, debug_dma_unmap() checks the flag and if this flag is still set, prints warning message that includes call trace that leads up to the unmap. This interface can be called from dma_mapping_error() routines to enable dma mapping error check debugging.
* Enhance dma-debug infrastructure to track dma map and unmap errors - I am working on this change.
+
* Assess severity and fix drivers and modules as needed. Fixed a few drivers and work is in progress.
* Share the results with the community - Done vis this page.
+
* Remove swiotlb overflow buffer support to make it consistent with the rest of the iotlb implementations. Removing support will be done in phases starting with deprecation notice, before removing the feature. I no longer think removing switlb is necessary or worth while. It is more important to continue to identify drivers that are not checking map and unmap errors and continue to fix them.
  
In addition to the above, I am sharing the information with the community at large, so individual driver and module owners can take a look at this analysis and assess the severity of the reported problems. I propose that, we use this page to record comments and track progress made on fixing the problem drivers and modules. If you have comments, questions etc. please send me email - shuahkhan@gmail.com or shuah.khan@hp.com
+
Since the debug_dma_mapping_error() went into the kernel, indvidual driver owners have been fixing drivers that don't check map/unmap errors when debug_dma_mapping_error() generates warnings. I am planning to take a fresh look and re-do the analysis I did a year ago and publish results. In addition to that, I am planning to enhance DMA-DEBUG-API to add a way to check for unmap errors as they would result in dangling dma buffers. If you have comments, questions etc. please contact [[mailto:shuahkhan@gmail.com,shuah.kh@samsung.com?cc=linux-kernel@vger.kernel.org Shuah Khan]]
  
 
==== Detailed Analysis ====
 
==== Detailed Analysis ====
  
The following is the detailed information on the nature of problems with dma mapping error checking, ranging from not checking mapping errors to not unmapping etc.  
+
The following is the detailed information on the nature of problems with dma mapping error checking, ranging from not checking mapping errors, doing partial checks, not unmapping, and checking and unmapping correctly.  
  
 
===== dma_map_single() usages and error checking status =====
 
===== dma_map_single() usages and error checking status =====
Line 127: Line 130:
 
|drivers/usb/musb/musb_gadget.c || 1 || Broken ||
 
|drivers/usb/musb/musb_gadget.c || 1 || Broken ||
 
|-
 
|-
|drivers/usb/core/usb.c || 1 || Broken ||
+
|drivers/usb/core/usb.c || 1 || Cleanup || The code is #ifdef'ed out. It hasn't been used in many years; it should be removed. https://lkml.org/lkml/2012/9/7/455
 
|-
 
|-
 
|drivers/usb/gadget/atmel_usba_udc.c || 1 || Broken ||
 
|drivers/usb/gadget/atmel_usba_udc.c || 1 || Broken ||
Line 165: Line 168:
 
|drivers/net/ethernet/sun/sunbmac.c || 3 || Broken ||
 
|drivers/net/ethernet/sun/sunbmac.c || 3 || Broken ||
 
|-
 
|-
|drivers/net/ethernet/sun/niu.c || 1 || Broken || Fixed https://lkml.org/lkml/2012/7/20/444
+
|drivers/net/ethernet/sun/niu.c || 1 || Broken || [Fixed https://lkml.org/lkml/2012/7/20/401]
 
|-
 
|-
 
|drivers/net/ethernet/sun/sunhme.c || 5 || Broken ||
 
|drivers/net/ethernet/sun/sunhme.c || 5 || Broken ||
Line 245: Line 248:
 
|drivers/crypto/caam/caamrng.c || 2 || Broken ||
 
|drivers/crypto/caam/caamrng.c || 2 || Broken ||
 
|-
 
|-
|include/asm-generic/pci-dma-compat.h || 1 || Broken || pci_map_single() callers need to check
+
|include/asm-generic/pci-dma-compat.h || 1 || Broken || do pci_map_single() callers check errors?
 
|-
 
|-
 
|sound/soc/sh/fsi.c || 1 || Broken ||
 
|sound/soc/sh/fsi.c || 1 || Broken ||
Line 251: Line 254:
 
|sound/sparc/dbri.c || 1 || Broken ||
 
|sound/sparc/dbri.c || 1 || Broken ||
 
|-
 
|-
|drivers/scsi/advansys.c || 2 || Partial Broken ||
+
|drivers/scsi/advansys.c || 2 || Partially Broken || driver is still not properly converted to the DMA API - please read FIXME in this file for details on what is broken and what needs to be fixed.
 
|-
 
|-
|drivers/mmc/host/wbsd.c || 1 || Partial Broken || Checks returned address is aligned on 64k - however doesn't call dma_mapping_error()
+
|drivers/mmc/host/wbsd.c || 1 || Partially Broken || Checks returned address is aligned on 64k - however doesn't call dma_mapping_error()
 
|-
 
|-
|drivers/net/ethernet/intel/ixgb/ixgb_main.c || 2 || Partial Broken ||
+
|drivers/net/ethernet/intel/ixgb/ixgb_main.c || 2 || Partially Broken ||
 
|-
 
|-
|drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c || 2 || Partial Broken ||
+
|drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c || 2 || Partially Broken ||
 
|-
 
|-
|drivers/net/ethernet/intel/igbvf/netdev.c || 2 || Partial Broken ||
+
|drivers/net/ethernet/intel/igbvf/netdev.c || 2 || Partially Broken ||
 
|-
 
|-
|drivers/net/ethernet/calxeda/xgmac.c || 2 || Partial Broken ||
+
|drivers/net/ethernet/calxeda/xgmac.c || 2 || Partially Broken ||
 
|-
 
|-
|drivers/crypto/caam/caamhash.c || 20 || Partial Broken ||
+
|drivers/crypto/caam/caamhash.c || 20 || Partially Broken ||
 
|-
 
|-
|drivers/crypto/caam/caamalg.c || 13 || Partial Broken ||
+
|drivers/crypto/caam/caamalg.c || 13 || Partially Broken ||
 
|-
 
|-
|net/sunrpc/xprtrdma/verbs.c || 1 || Partial Broken ||
+
|net/sunrpc/xprtrdma/verbs.c || 1 || Partially Broken ||
 
|-
 
|-
 
|drivers/infiniband/ulp/iser/iser_verbs.c || 2 || Unmap Broken ||
 
|drivers/infiniband/ulp/iser/iser_verbs.c || 2 || Unmap Broken ||
Line 445: Line 448:
 
|net/9p/trans_rdma.c || 2 || Good ||
 
|net/9p/trans_rdma.c || 2 || Good ||
 
|}
 
|}
 
  
 
===== dma_map_page() usages and error checking status =====
 
===== dma_map_page() usages and error checking status =====
Line 464: Line 466:
 
|crypto/async_tx/async_memset.c || 4 || Broken ||
 
|crypto/async_tx/async_memset.c || 4 || Broken ||
 
|-
 
|-
|crypto/async_tx/async_raid6_recov.c || 5 | Broken ||
+
|crypto/async_tx/async_raid6_recov.c || 5 || Broken ||
 
|-
 
|-
 
|drivers/dma/mv_xor.c || 2 || Broken ||
 
|drivers/dma/mv_xor.c || 2 || Broken ||
Line 500: Line 502:
 
|net/sunrpc/xprtrdma/verbs.c || 1 || Broken ||
 
|net/sunrpc/xprtrdma/verbs.c || 1 || Broken ||
 
|-
 
|-
|drivers/net/ethernet/intel/e1000e/netdev.c || 2 || Partial Broken ||
+
|drivers/net/ethernet/intel/e1000e/netdev.c || 2 || Partially Broken ||
 
|-
 
|-
|net/sunrpc/xprtrdma/svc_rdma_sendto.c || 5 || Partial Broken ||
+
|net/sunrpc/xprtrdma/svc_rdma_sendto.c || 5 || Partially Broken ||
 
|-
 
|-
 
|drivers/infiniband/hw/qib/qib_user_sdma.c || 3 || Unmap Broken ||
 
|drivers/infiniband/hw/qib/qib_user_sdma.c || 3 || Unmap Broken ||
Line 508: Line 510:
 
|drivers/infiniband/hw/ipath/ipath_user_sdma.c || 3 || Unmap Broken ||
 
|drivers/infiniband/hw/ipath/ipath_user_sdma.c || 3 || Unmap Broken ||
 
|-
 
|-
|drivers/firewire/core-iso.c || 1 || Unmap Broken ||
+
|drivers/firewire/core-iso.c || 1 || Unmap Broken || On failure, the callers are responsible for cleanup by calling fw_iso_buffer_destroy() eventually. ioctl_create_iso_context() doesn't do this correctly if it's called multiple times. https://lkml.org/lkml/2012/9/10/76
|-
+
|drivers/firewire/ohci.c || 1 || Unmap Broken ||
+
 
|-
 
|-
 
|drivers/net/ethernet/sfc/rx.c || 1 || Unmap Broken ||
 
|drivers/net/ethernet/sfc/rx.c || 1 || Unmap Broken ||
Line 523: Line 523:
 
|-
 
|-
 
|drivers/infiniband/ulp/ipoib/ipoib_cm.c || 1 || Good ||
 
|drivers/infiniband/ulp/ipoib/ipoib_cm.c || 1 || Good ||
 +
|-
 +
|drivers/firewire/ohci.c || 1 || Good || ar_context_release() takes care of cleanup. https://lkml.org/lkml/2012/9/10/76
 
|-
 
|-
 
|drivers/scsi/cxgbi/libcxgbi.c || 1 || Good ||
 
|drivers/scsi/cxgbi/libcxgbi.c || 1 || Good ||

Latest revision as of 15:10, 17 October 2013

mediawiki

Contents

[edit] DMA Mapping Error Check Analysis

I analyzed all calls to dma_map_single() and dma_map_page() in the kernel, to see if callers check for mapping errors, before using the returned address. The goal of this analysis is to find drivers that currently do not check dma mapping errors, and fix them. I did a grep for dma_map_single() and dma_map_page() and looked at the code that calls these routines. As a side note, this analysis stemmed from the discussion on my patch that disables swiotlb overflow as a first step towards removing the support all together.

linux-next August 6 2012 is used as the base for this analysis.

I classified the results into three categories, Broken, Partially Broken, Unmap Broken, and Good. Details below:

[edit] Broken
  1. Broken - No dma mapping error checks done on the returned address.
  2. Partially Broken - In that source file, not all calls are followed by mapping error checks.
  3. Unmap broken - Checks dma mapping errors, however doesn't unmap already mapped pages when mapping error occurs in the middle of a multiple page mapping attempt.


The first two categories Broken, and Partially Broken are classified as severe and need fixing. The third one needs fixing, since it leaves dangling mapped pages, and holds on to them which is equivalent to a memory leak condition. Some drivers release all mapped pages when the device closes, but others don't. Not doing unmap might be harmless on some architectures going by the comments I found in some source files.

[edit] Good
  1. Checks dma mapping errors and unmaps already mapped pages when mapping error occurs in the middle of a multiple page mapping attempt.
  2. Checks dma mapping errors without unlikely()
  3. Checks dma mapping errors with unlikely()


I grouped the above three cases as good cases. Using unlikely() is not recommended in all cases and these cases need attention, however we don't need to be concerned about considering the other more serious problems in this area.

[edit] dmap_map_single() - results

  • Broken - 195 (46%)
  • Partially broken - 46 (11%)
  • Unmap broken: 26 (6%)
  • Good: 147 (35%)

[edit] dma_map_page() - results

  • Broken: 61 (59%)
  • Partially broken: 7 (.06%)
  • Unmap broken: 15 (14.5%)
  • Good: 20 (19%)

In summary, a large % of the cases (> 50%) go unchecked. This raises the following questions:

  • When do mapping errors get detected?
  • How often do these errors occur?
  • Why don't we see failures related to missing dma mapping error checks?
  • Are they silent failures?


I propose the following next steps to gather more information and understand the severity of the problem.

[edit] Next Steps

  • Enhanced dma-debug infrastructure to track dma map and unmap errors. A new interface debug_dma_mapping_error() is added to dma-debug API in 3.9 release. CommitID: 6c9c6d6301287e369a754d628230fa6e50cdb74b: Add dma-debug interface debug_dma_mapping_error() to debug drivers that fail to check dma mapping errors on addresses returned by dma_map_single() and dma_map_page() interfaces. This interface clears a flag set by debug_dma_map_page() to indicate that dma_mapping_error() has been called by the driver. When driver does unmap, debug_dma_unmap() checks the flag and if this flag is still set, prints warning message that includes call trace that leads up to the unmap. This interface can be called from dma_mapping_error() routines to enable dma mapping error check debugging.
  • Assess severity and fix drivers and modules as needed. Fixed a few drivers and work is in progress.
  • Remove swiotlb overflow buffer support to make it consistent with the rest of the iotlb implementations. Removing support will be done in phases starting with deprecation notice, before removing the feature. I no longer think removing switlb is necessary or worth while. It is more important to continue to identify drivers that are not checking map and unmap errors and continue to fix them.

Since the debug_dma_mapping_error() went into the kernel, indvidual driver owners have been fixing drivers that don't check map/unmap errors when debug_dma_mapping_error() generates warnings. I am planning to take a fresh look and re-do the analysis I did a year ago and publish results. In addition to that, I am planning to enhance DMA-DEBUG-API to add a way to check for unmap errors as they would result in dangling dma buffers. If you have comments, questions etc. please contact [Shuah Khan]

[edit] Detailed Analysis

The following is the detailed information on the nature of problems with dma mapping error checking, ranging from not checking mapping errors, doing partial checks, not unmapping, and checking and unmapping correctly.

[edit] dma_map_single() usages and error checking status

The following table lists the source files that call dma_map_single() and whether or not dma mapping errors are checked on the returned address. Also includes the status that indicates the cases that are broken and need fixing. Observations and open issues if any are captured in the Notes column. Individual driver and module owners can assess the severity of the broken cases.


File Name # of calls Status Notes
arch/arm/mach-rpc/dma.c 1 Broken
arch/arm/kernel/dma-isa.c 1 Broken
drivers/parport/parport_pc.c 1 Broken
drivers/parport/parport_ip32.c 1 Broken
drivers/infiniband/core/mad.c 3 Broken
drivers/atm/fore200e.c 1 Broken
drivers/tty/serial/msm_serial_hs.c 5 Broken
drivers/tty/serial/atmel_serial.c 2 Broken
drivers/tty/serial/mfd.c 2 Broken
drivers/spi/spi-stmp.c 1 Broken
drivers/dma/mv_xor.c 2 Broken
drivers/dma/dmaengine.c 3 Broken
drivers/dma/iop-adma.c 2 Broken
drivers/dma/dw_dmac.c 1 Broken
drivers/dma/ioat/dma.c 2 Broken
drivers/dma/dmatest.c 2 Broken
drivers/dma/txx9dmac.c 1 Broken
drivers/mtd/nand/fsmc_nand.c 1 Broken
drivers/scsi/initio.c 1 Broken
drivers/scsi/isci/request.c 1 Broken
drivers/scsi/sgiwd93.c 1 Broken
drivers/scsi/sun_esp.c 1 Broken
drivers/scsi/jazz_esp.c 1 Broken
drivers/scsi/53c700.c 2 Broken
drivers/scsi/sun3x_esp.c 1 Broken do sun3x_esp_map_single() callers check errors?
drivers/scsi/qla4xxx/ql4_os.c 1 Broken
drivers/usb/host/whci/qset.c 3 Broken
drivers/usb/musb/tusb6010_omap.c 2 Broken
drivers/usb/musb/musb_gadget.c 1 Broken
drivers/usb/core/usb.c 1 Cleanup The code is #ifdef'ed out. It hasn't been used in many years; it should be removed. https://lkml.org/lkml/2012/9/7/455
drivers/usb/gadget/atmel_usba_udc.c 1 Broken
drivers/usb/gadget/mv_udc_core.c 2 Broken
drivers/usb/gadget/fsl_udc_core.c 3 Broken
drivers/usb/gadget/lpc32xx_udc.c 1 Broken
drivers/usb/gadget/mv_u3d_core.c 1 Broken
drivers/usb/gadget/pch_udc.c 5 Broken
drivers/usb/gadget/fsl_qe_udc.c 3 Broken
drivers/video/grvga.c 1 Broken
drivers/staging/et131x/et131x.c 9 Broken
drivers/mmc/host/mmc_spi.c 2 Broken
drivers/media/video/vino.c 3 Broken
drivers/gpu/drm/via/via_dmablit.c 1 Broken
drivers/vme/bridges/vme_tsi148.c 2 Broken
drivers/message/i2o/memory.c 4 Broken i2o_dma_map_single() checks mapping error, but returns bad address - couldn't find any i2o_dma_map_single() callers.
drivers/net/wireless/rt2x00/rt2x00queue.c 2 Broken
drivers/net/wireless/brcm80211/brcmsmac/dma.c 2 Broken
drivers/net/ethernet/ibm/emac/core.c 6 Broken
drivers/net/ethernet/sun/sunbmac.c 3 Broken
drivers/net/ethernet/sun/niu.c 1 Broken [Fixed https://lkml.org/lkml/2012/7/20/401]
drivers/net/ethernet/sun/sunhme.c 5 Broken
drivers/net/ethernet/sgi/meth.c 5 Broken
drivers/net/ethernet/smsc/smc91x.h 2 Broken
drivers/net/ethernet/smsc/smc911x.h 2 Broken
drivers/net/ethernet/tundra/tsi108_eth.c 2 Broken
drivers/net/ethernet/stmicro/stmmac/ring_mode.c 3 Broken
drivers/net/ethernet/stmicro/stmmac/chain_mode.c 3 Broken
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c 3 Broken
drivers/net/ethernet/brocade/bna/bnad.c 2 Broken
drivers/net/ethernet/ti/cpmac.c 3 Broken
drivers/net/ethernet/ti/davinci_cpdma.c 1 Broken
drivers/net/ethernet/mellanox/mlx4/en_tx.c 1 Broken
drivers/net/ethernet/seeq/sgiseeq.c 3 Broken
drivers/net/ethernet/intel/e1000/e1000_ethtool.c 2 Broken
drivers/net/ethernet/freescale/fec_mpc52xx.c 2 Broken
drivers/net/ethernet/freescale/fec.c 3 Broken
drivers/net/ethernet/freescale/fs_enet/fs_enet-main.c 4 Broken
drivers/net/ethernet/freescale/ucc_geth.c 2 Broken
drivers/net/ethernet/freescale/gianfar.c 2 Broken
drivers/net/ethernet/xilinx/ll_temac_main.c 4 Broken
drivers/net/ethernet/xilinx/xilinx_axienet_main.c 4 Broken
drivers/net/ethernet/lantiq_etop.c 2 Broken
drivers/net/ethernet/renesas/sh_eth.c 3 Broken
drivers/net/ethernet/realtek/8139cp.c 5 Broken
drivers/net/ethernet/marvell/mv643xx_eth.c 2 Broken
drivers/net/ethernet/marvell/pxa168_eth.c 2 Broken
drivers/net/ethernet/cadence/at91_ether.c 1 Broken
drivers/net/ethernet/cadence/macb.c 1 Broken
drivers/net/ethernet/dec/tulip/de4x5.c 1 Broken
drivers/net/ethernet/i825xx/lib82596.c 3 Broken
drivers/net/ethernet/octeon/octeon_mgmt.c 4 Broken
drivers/net/ethernet/broadcom/bcm63xx_enet.c 2 Broken
drivers/net/fddi/defxx.c 3 Broken
drivers/crypto/talitos.c 3 Broken
drivers/crypto/ixp4xx_crypto.c 1 Broken
drivers/crypto/picoxcell_crypto.c 1 Broken
drivers/crypto/bfin_crc.c 2 Broken
drivers/crypto/caam/ctrl.c 1 Broken
drivers/crypto/caam/caamrng.c 2 Broken
include/asm-generic/pci-dma-compat.h 1 Broken do pci_map_single() callers check errors?
sound/soc/sh/fsi.c 1 Broken
sound/sparc/dbri.c 1 Broken
drivers/scsi/advansys.c 2 Partially Broken driver is still not properly converted to the DMA API - please read FIXME in this file for details on what is broken and what needs to be fixed.
drivers/mmc/host/wbsd.c 1 Partially Broken Checks returned address is aligned on 64k - however doesn't call dma_mapping_error()
drivers/net/ethernet/intel/ixgb/ixgb_main.c 2 Partially Broken
drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c 2 Partially Broken
drivers/net/ethernet/intel/igbvf/netdev.c 2 Partially Broken
drivers/net/ethernet/calxeda/xgmac.c 2 Partially Broken
drivers/crypto/caam/caamhash.c 20 Partially Broken
drivers/crypto/caam/caamalg.c 13 Partially Broken
net/sunrpc/xprtrdma/verbs.c 1 Partially Broken
drivers/infiniband/ulp/iser/iser_verbs.c 2 Unmap Broken
drivers/mtd/onenand/omap2.c 4 Unmap Broken
drivers/net/ethernet/ibm/ibmveth.c 6 Unmap Broken
drivers/net/ethernet/intel/e1000e/netdev.c 3 Unmap Broken
drivers/net/ethernet/dlink/sundance.c 3 Unmap Broken
drivers/net/ethernet/xscale/ixp4xx_eth.c 3 Unmap Broken
drivers/net/ethernet/sfc/rx.c 1 Unmap Broken
drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c 2 Unmap Broken
drivers/net/wan/ixp4xx_hss.c 3 Unmap Broken
arch/powerpc/platforms/cell/celleb_scc_pciex.c 1 Good
arch/powerpc/platforms/cell/spider-pci.c 1 Good
arch/c6x/include/asm/dma-mapping.h 1 Good
arch/c6x/kernel/dma.c 1 Good
drivers/infiniband/hw/qib/qib_sdma.c 1 Good
drivers/infiniband/hw/qib/qib_verbs.c 1 Good
drivers/infiniband/hw/ipath/ipath_sdma.c 2 Good
drivers/infiniband/ulp/ipoib/ipoib_ib.c 2 Good
drivers/infiniband/ulp/ipoib/ipoib_cm.c 2 Good
drivers/infiniband/ulp/srpt/ib_srpt.c 1 Good
drivers/infiniband/ulp/iser/iser_initiator.c 1 Good
drivers/infiniband/ulp/iser/iscsi_iser.c 1 Good
drivers/infiniband/ulp/srp/ib_srp.c 2 Good
drivers/spi/spi-au1550.c 3 Good
drivers/spi/spi-atmel.c 2 Good
drivers/spi/spi-omap2-mcspi.c 2 Good
drivers/spi/spi-davinci.c 2 Good
drivers/spi/spi-fsl-spi.c 4 Good
drivers/spi/spi-pxa2xx.c 2 Good
drivers/spi/spi-s3c64xx.c 4 Good
drivers/dma/ste_dma40.c 2 Good
drivers/dma/timb_dma.c 1 Good
drivers/mtd/onenand/samsung.c 1 Good
drivers/mtd/nand/gpmi-nand/gpmi-nand.c 2 Good
drivers/mtd/nand/atmel_nand.c 2 Good
drivers/mtd/nand/denali.c 1 Good
drivers/scsi/ibmvscsi/ibmvstgt.c 1 Good
drivers/scsi/ibmvscsi/ibmvfc.c 2 Good
drivers/scsi/ibmvscsi/rpa_vscsi.c 1 Good
drivers/scsi/ibmvscsi/ibmvscsi.c 3 Good
drivers/scsi/aha1740.c 1 Good
drivers/usb/host/imx21-hcd.c 1 Good
drivers/usb/core/hcd.c 2 Good
drivers/usb/gadget/fusb300_udc.c 1 Good
drivers/usb/gadget/s3c-hsotg.c 2 Good
drivers/usb/gadget/udc-core.c 1 Good
drivers/staging/rts_pstor/rtsx_transport.c 1 Good
drivers/mmc/host/sdhci.c 2 Good
drivers/media/video/videobuf-dma-contig.c 2 Good
drivers/media/video/omap/omap_vout.c 2 Good
drivers/firewire/ohci.c 1 Good
drivers/firewire/sbp2.c 4 Good
drivers/message/i2o/iop.c 1 Good
drivers/net/wireless/ath/ath9k/xmit.c 1 Good
drivers/net/wireless/ath/ath9k/beacon.c 1 Good
drivers/net/wireless/ath/ath9k/recv.c 3 Good
drivers/net/wireless/ath/ath5k/base.c 3 Good
drivers/net/wireless/b43legacy/dma.c 4 Good
drivers/net/wireless/b43/dma.c 4 Good
drivers/net/wireless/iwlwifi/pcie/trans.c 2 Good
drivers/net/wireless/iwlwifi/pcie/tx.c 2 Good
drivers/net/ethernet/aeroflex/greth.c 5 Good
drivers/net/ethernet/natsemi/sonic.c 3 Good
drivers/net/ethernet/cirrus/ep93xx_eth.c 2 Good
drivers/net/ethernet/faraday/ftmac100.c 1 Good
drivers/net/ethernet/micrel/ks8842.c 2 Good
drivers/net/ethernet/micrel/ks8695net.c 2 Good
drivers/net/ethernet/intel/e1000e/ethtool.c 2 Good
drivers/net/ethernet/intel/igb/igb_main.c 2 Good
drivers/net/ethernet/intel/e1000/e1000_main.c 2 Good
drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c 1 Good
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c 1 Good
drivers/net/ethernet/toshiba/ps3_gelic_net.c 3 Good
drivers/net/ethernet/realtek/r8169.c 3 Good
drivers/net/ethernet/sfc/tx.c 4 Good
drivers/net/ethernet/emulex/benet/be_main.c 1 Good
drivers/net/ethernet/chelsio/cxgb4vf/sge.c 2 Good
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c 3 Good
drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c 1 Good
drivers/net/ethernet/broadcom/bnx2.c 3 Good
drivers/net/ethernet/broadcom/b44.c 6 Good
drivers/ps3/ps3stor_lib.c 1 Good
drivers/crypto/atmel-tdes.c 2 Good
drivers/crypto/atmel-sha.c 2 Good
drivers/crypto/omap-aes.c 2 Good
drivers/crypto/omap-sham.c 1 Good
drivers/crypto/caam/jr.c 1 Good
drivers/crypto/caam/key_gen.c 2 Good
net/9p/trans_rdma.c 2 Good
[edit] dma_map_page() usages and error checking status

The following table lists the source files that call dma_map_page() and whether or not dma mapping errors are checked on the returned address. Also includes the status that indicates the cases that are broken and need fixing. Observations and open issues if any are captured in the Notes column. Individual driver and module owners can assess the severity of the broken cases.


File Name # of calls Status Notes
crypto/async_tx/async_pq.c 7 Broken
crypto/async_tx/async_memcpy.c 2 Broken
crypto/async_tx/async_memset.c 4 Broken
crypto/async_tx/async_raid6_recov.c 5 Broken
drivers/dma/mv_xor.c 2 Broken
drivers/dma/dmaengine.c 3 Broken
drivers/dma/iop-adma.c 10 Broken
drivers/dma/ioat/dma_v3.c 5 Broken
drivers/dma/ppc4xx/adma.c 3 Broken
drivers/mtd/onenand/samsung.c 1 Broken
drivers/staging/omapdrm/omap_gem.c 2 Broken
drivers/staging/et131x/et131x.c 2 Broken
drivers/staging/sep/sep_main.c 1 Broken
drivers/mmc/host/mmc_spi.c 1 Broken
drivers/gpu/drm/via/via_dmablit.c 1 Broken
drivers/net/wireless/iwlwifi/pcie/rx.c 2 Broken
drivers/net/ethernet/ibm/emac/core.c 2 Broken
drivers/net/ethernet/intel/igbvf/netdev.c 1 Broken
drivers/net/ethernet/emulex/benet/be_main.c 1 Broken
drivers/crypto/amcc/crypto4xx_core.c 5 Broken
net/sunrpc/xprtrdma/verbs.c 1 Broken
drivers/net/ethernet/intel/e1000e/netdev.c 2 Partially Broken
net/sunrpc/xprtrdma/svc_rdma_sendto.c 5 Partially Broken
drivers/infiniband/hw/qib/qib_user_sdma.c 3 Unmap Broken
drivers/infiniband/hw/ipath/ipath_user_sdma.c 3 Unmap Broken
drivers/firewire/core-iso.c 1 Unmap Broken On failure, the callers are responsible for cleanup by calling fw_iso_buffer_destroy() eventually. ioctl_create_iso_context() doesn't do this correctly if it's called multiple times. https://lkml.org/lkml/2012/9/10/76
drivers/net/ethernet/sfc/rx.c 1 Unmap Broken
drivers/net/ethernet/chelsio/cxgb4vf/sge.c 2 Unmap Broken
drivers/net/ethernet/chelsio/cxgb4/sge.c 2 Unmap Broken
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 2 Unmap Broken
drivers/infiniband/ulp/ipoib/ipoib_ib.c 2 Good
drivers/infiniband/ulp/ipoib/ipoib_cm.c 1 Good
drivers/firewire/ohci.c 1 Good ar_context_release() takes care of cleanup. https://lkml.org/lkml/2012/9/10/76
drivers/scsi/cxgbi/libcxgbi.c 1 Good
drivers/usb/core/hcd.c 1 Good
drivers/staging/media/go7007/saa7134-go7007.c 2 Good
drivers/net/ethernet/faraday/ftmac100.c 2 Good
drivers/net/ethernet/mellanox/mlx4/en_rx.c 2 Good
drivers/net/ethernet/intel/igb/igb_main.c 1 Good
drivers/net/ethernet/intel/e1000/e1000_main.c 1 Good
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c 1 Good
drivers/net/ethernet/sfc/tx.c 1 Good
drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c 1 Good
drivers/net/ethernet/broadcom/bnx2.c 1 Good
net/rds/iw_recv.c 1 Good
net/sunrpc/xprtrdma/svc_rdma_transport.c 2 Good
Personal tools
Namespaces

Variants
Actions
Navigation
Toolbox