<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/net/ethernet/3com, branch v4.1.10</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>drivers/net: Use setup_timer and mod_timer</title>
<updated>2015-02-12T03:40:12+00:00</updated>
<author>
<name>Vaishali Thakkar</name>
<email>vthakkar1994@gmail.com</email>
</author>
<published>2015-02-11T10:29:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1d6c4cca41840c82e6967a48137f622547244630'/>
<id>1d6c4cca41840c82e6967a48137f622547244630</id>
<content type='text'>
This patch introduces the use of functions setup_timer
and mod_timer.

This is done using Coccinelle and semantic patch used
for this as follows:

// &lt;smpl&gt;
@@
expression x,y,z,a,b;
@@

-init_timer (&amp;x);
+setup_timer (&amp;x, y, z);
+mod_timer (&amp;a, b);
-x.function = y;
-x.data = z;
-x.expires = b;
-add_timer(&amp;a);

// &lt;/smpl&gt;

Signed-off-by: Vaishali Thakkar &lt;vthakkar1994@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This patch introduces the use of functions setup_timer
and mod_timer.

This is done using Coccinelle and semantic patch used
for this as follows:

// &lt;smpl&gt;
@@
expression x,y,z,a,b;
@@

-init_timer (&amp;x);
+setup_timer (&amp;x, y, z);
+mod_timer (&amp;a, b);
-x.function = y;
-x.data = z;
-x.expires = b;
-add_timer(&amp;a);

// &lt;/smpl&gt;

Signed-off-by: Vaishali Thakkar &lt;vthakkar1994@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: rename vlan_tx_* helpers since "tx" is misleading there</title>
<updated>2015-01-13T22:51:08+00:00</updated>
<author>
<name>Jiri Pirko</name>
<email>jiri@resnulli.us</email>
</author>
<published>2015-01-13T16:13:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=df8a39defad46b83694ea6dd868d332976d62cc0'/>
<id>df8a39defad46b83694ea6dd868d332976d62cc0</id>
<content type='text'>
The same macros are used for rx as well. So rename it.

Signed-off-by: Jiri Pirko &lt;jiri@resnulli.us&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The same macros are used for rx as well. So rename it.

Signed-off-by: Jiri Pirko &lt;jiri@resnulli.us&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>net: typhoon: Remove redundant casts</title>
<updated>2014-10-24T04:41:31+00:00</updated>
<author>
<name>Rasmus Villemoes</name>
<email>linux@rasmusvillemoes.dk</email>
</author>
<published>2014-10-21T14:51:43+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=00fd5d94c219839925959d73e266702f08ba283a'/>
<id>00fd5d94c219839925959d73e266702f08ba283a</id>
<content type='text'>
Both image_data and typhoon_fw-&gt;data are const u8*, so the cast to u8*
is unnecessary and confusing.

Signed-off-by: Rasmus Villemoes &lt;linux@rasmusvillemoes.dk&gt;
Acked-by: David Dillow &lt;dave@thedillows.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Both image_data and typhoon_fw-&gt;data are const u8*, so the cast to u8*
is unnecessary and confusing.

Signed-off-by: Rasmus Villemoes &lt;linux@rasmusvillemoes.dk&gt;
Acked-by: David Dillow &lt;dave@thedillows.org&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net</title>
<updated>2014-10-08T20:22:22+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2014-10-08T20:22:22+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=64b1f00a0830e1c53874067273a096b228d83d36'/>
<id>64b1f00a0830e1c53874067273a096b228d83d36</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>3c59x: fix bad split of cpu_to_le32(pci_map_single())</title>
<updated>2014-10-07T17:16:06+00:00</updated>
<author>
<name>Sylvain "ythier" Hitier</name>
<email>sylvain.hitier@gmail.com</email>
</author>
<published>2014-10-07T13:40:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=88b09a6d958af6c458acf055ee2eb5bc9564efda'/>
<id>88b09a6d958af6c458acf055ee2eb5bc9564efda</id>
<content type='text'>
In commit 6f2b6a3005b2c34c39f207a87667564f64f2f91a,
  # 3c59x: Add dma error checking and recovery
the intent is to split out the mapping from the byte-swapping in order to
insert a dma_mapping_error() check.

Kinda this semantic patch:

    // See http://coccinelle.lip6.fr/
    //
    // Beware, grouik-and-dirty!
    @@
    expression DEV, X, Y, Z;
    @@
    -   cpu_to_le32(pci_map_single(DEV, X, Y, Z))
    +   dma_addr_t addr = pci_map_single(DEV, X, Y, Z);
    +   if (dma_mapping_error(&amp;DEV-&gt;dev, addr))
    +       /* snip */;
    +   cpu_to_le32(addr)

However, the #else part (of the #if DO_ZEROCOPY test) is changed this way:

    -   cpu_to_le32(pci_map_single(DEV, X, Y, Z))
    +   dma_addr_t addr = cpu_to_le32(pci_map_single(DEV, X, Y, Z));
    //                    ^^^^^^^^^^^
    //                    That mismatches the 3 other changes!
    +   if (dma_mapping_error(&amp;DEV-&gt;dev, addr))
    +       /* snip */;
    +   cpu_to_le32(addr)

Let's remove the leftover cpu_to_le32() for coherency.

v2: Better changelog.
v3: Add Acked-by

Fixes: 6f2b6a3005b2c34c39f207a87667564f64f2f91a
  # 3c59x: Add dma error checking and recovery
Acked-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Signed-off-by: Sylvain "ythier" Hitier &lt;sylvain.hitier@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In commit 6f2b6a3005b2c34c39f207a87667564f64f2f91a,
  # 3c59x: Add dma error checking and recovery
the intent is to split out the mapping from the byte-swapping in order to
insert a dma_mapping_error() check.

Kinda this semantic patch:

    // See http://coccinelle.lip6.fr/
    //
    // Beware, grouik-and-dirty!
    @@
    expression DEV, X, Y, Z;
    @@
    -   cpu_to_le32(pci_map_single(DEV, X, Y, Z))
    +   dma_addr_t addr = pci_map_single(DEV, X, Y, Z);
    +   if (dma_mapping_error(&amp;DEV-&gt;dev, addr))
    +       /* snip */;
    +   cpu_to_le32(addr)

However, the #else part (of the #if DO_ZEROCOPY test) is changed this way:

    -   cpu_to_le32(pci_map_single(DEV, X, Y, Z))
    +   dma_addr_t addr = cpu_to_le32(pci_map_single(DEV, X, Y, Z));
    //                    ^^^^^^^^^^^
    //                    That mismatches the 3 other changes!
    +   if (dma_mapping_error(&amp;DEV-&gt;dev, addr))
    +       /* snip */;
    +   cpu_to_le32(addr)

Let's remove the leftover cpu_to_le32() for coherency.

v2: Better changelog.
v3: Add Acked-by

Fixes: 6f2b6a3005b2c34c39f207a87667564f64f2f91a
  # 3c59x: Add dma error checking and recovery
Acked-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
Signed-off-by: Sylvain "ythier" Hitier &lt;sylvain.hitier@gmail.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net</title>
<updated>2014-09-23T16:09:27+00:00</updated>
<author>
<name>David S. Miller</name>
<email>davem@davemloft.net</email>
</author>
<published>2014-09-23T16:09:27+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1f6d80358dc9bbbeb56cb43384fa11fd645d9289'/>
<id>1f6d80358dc9bbbeb56cb43384fa11fd645d9289</id>
<content type='text'>
Conflicts:
	arch/mips/net/bpf_jit.c
	drivers/net/can/flexcan.c

Both the flexcan and MIPS bpf_jit conflicts were cases of simple
overlapping changes.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Conflicts:
	arch/mips/net/bpf_jit.c
	drivers/net/can/flexcan.c

Both the flexcan and MIPS bpf_jit conflicts were cases of simple
overlapping changes.

Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>3c59x: Fix bad offset spec in skb_frag_dma_map</title>
<updated>2014-09-19T20:28:57+00:00</updated>
<author>
<name>Neil Horman</name>
<email>nhorman@tuxdriver.com</email>
</author>
<published>2014-09-17T13:04:45+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8400dd029e764e30361a51a7ae35900ae0032b43'/>
<id>8400dd029e764e30361a51a7ae35900ae0032b43</id>
<content type='text'>
Recently aded the use of skb_frag_dma_map to 3c59x, but didn't realize it
automatically included the frag_offset internally, as well as provided an option
to specify an extra offset in the parameter list.  We need to specify an offset
of 0 in the parameter list to avoid skb corruption that results in lost
connections.

Signed-off-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
CC: Linux Kernel list &lt;linux-kernel@vger.kernel.org&gt;
CC: "David S. Miller" &lt;davem@davemloft.net&gt;
CC: Meelis Roos &lt;mroos@linux.ee&gt;
Tested-by: Meelis Roos &lt;mroos@linux.ee&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Recently aded the use of skb_frag_dma_map to 3c59x, but didn't realize it
automatically included the frag_offset internally, as well as provided an option
to specify an extra offset in the parameter list.  We need to specify an offset
of 0 in the parameter list to avoid skb corruption that results in lost
connections.

Signed-off-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
CC: Linux Kernel list &lt;linux-kernel@vger.kernel.org&gt;
CC: "David S. Miller" &lt;davem@davemloft.net&gt;
CC: Meelis Roos &lt;mroos@linux.ee&gt;
Tested-by: Meelis Roos &lt;mroos@linux.ee&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>3c59x: Add dma error checking and recovery</title>
<updated>2014-09-19T20:28:57+00:00</updated>
<author>
<name>Neil Horman</name>
<email>nhorman@tuxdriver.com</email>
</author>
<published>2014-09-17T13:04:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=6f2b6a3005b2c34c39f207a87667564f64f2f91a'/>
<id>6f2b6a3005b2c34c39f207a87667564f64f2f91a</id>
<content type='text'>
Noted that 3c59x has no checks on transmit for failed DMA mappings, and no
ability to unmap fragments when a single map fails in the middle of a transmit.
This patch provides error checking to ensure that dma mappings work properly,
and unrolls an skb mapping if a fragmented skb transmission has a mapping
failure to prevent leaks.

Signed-off-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
CC: Linux Kernel list &lt;linux-kernel@vger.kernel.org&gt;
CC: "David S. Miller" &lt;davem@davemloft.net&gt;
CC: Meelis Roos &lt;mroos@linux.ee&gt;
Tested-by: Meelis Roos &lt;mroos@linux.ee&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Noted that 3c59x has no checks on transmit for failed DMA mappings, and no
ability to unmap fragments when a single map fails in the middle of a transmit.
This patch provides error checking to ensure that dma mappings work properly,
and unrolls an skb mapping if a fragmented skb transmission has a mapping
failure to prevent leaks.

Signed-off-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
CC: Linux Kernel list &lt;linux-kernel@vger.kernel.org&gt;
CC: "David S. Miller" &lt;davem@davemloft.net&gt;
CC: Meelis Roos &lt;mroos@linux.ee&gt;
Tested-by: Meelis Roos &lt;mroos@linux.ee&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drivers/net: Convert remaining uses of pr_warning to pr_warn</title>
<updated>2014-09-10T03:37:08+00:00</updated>
<author>
<name>Joe Perches</name>
<email>joe@perches.com</email>
</author>
<published>2014-09-10T03:27:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=fe3881cf7e09dfb93e4a4c65f44e2d92f92d0022'/>
<id>fe3881cf7e09dfb93e4a4c65f44e2d92f92d0022</id>
<content type='text'>
Use the much more common pr_warn instead of pr_warning.

Other miscellanea:

o Typo fixes submiting/submitting
o Coalesce formats
o Realign arguments
o Add missing terminating '\n' to formats

Signed-off-by: Joe Perches &lt;joe@perches.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Use the much more common pr_warn instead of pr_warning.

Other miscellanea:

o Typo fixes submiting/submitting
o Coalesce formats
o Realign arguments
o Add missing terminating '\n' to formats

Signed-off-by: Joe Perches &lt;joe@perches.com&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>3c59x: avoid panic in boomerang_start_xmit when finding page address:</title>
<updated>2014-09-06T00:24:02+00:00</updated>
<author>
<name>Neil Horman</name>
<email>nhorman@tuxdriver.com</email>
</author>
<published>2014-09-04T10:13:38+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=98ea232cf63961fad734cc8c5e07e8915ec73073'/>
<id>98ea232cf63961fad734cc8c5e07e8915ec73073</id>
<content type='text'>
This bug was reported on a very old kernel (RHEL6, 2.6.32-491.el6):

BUG: unable to handle kernel paging request at 00800000
IP: [&lt;c04107b5&gt;] nommu_map_page+0x15/0x110
*pdpt = 000000003454f001 *pde = 000000003f03d067
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/system/cpu/online
Modules linked in: nfsd lockd nfs_acl auth_rpcgss sunrpc exportfs p4_clockmod
ipv6 ppdev parport_pc parport microcode iTCO_wdt iTCO_vendor_support 3c59x mii
dcdbas serio_raw snd_intel8x0 snd_ac97_codec ac97_bus snd_seq snd_seq_device
snd_pcm snd_timer snd soundcore snd_page_alloc i2c_i801 sg lpc_ich mfd_core ext4
jbd2 mbcache sr_mod cdrom sd_mod crc_t10dif pata_acpi ata_generic ata_piix
radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core dm_mirror dm_region_hash
dm_log dm_mod [last unloaded: mperf]

Pid: 4219, comm: nfsd Not tainted 2.6.32-491.el6.i686 #1 Dell Computer
Corporation OptiPlex GX240               /OptiPlex GX240
EIP: 0060:[&lt;c04107b5&gt;] EFLAGS: 00010246 CPU: 0
EIP is at nommu_map_page+0x15/0x110
EAX: 00000000 EBX: c0a83480 ECX: 00000000 EDX: 00800000
ESI: 00000000 EDI: f70e7860 EBP: e2d09b54 ESP: e2d09b24
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process nfsd (pid: 4219, ti=e2d08000 task=e2ceaaa0 task.ti=e2d08000)
Stack:
 00000056 00000000 0000000e c65efd38 00000020 00000296 00000206 00000206
&lt;0&gt; c050c850 c0a83480 e2cef154 00000001 e2d09ba8 f8fcd585 00000510 00000001
&lt;0&gt; 00000000 00000000 f5172200 f8fdac00 0039ef8c f5277020 f70e7860 00000510
Call Trace:
 [&lt;c050c850&gt;] ? page_address+0xd0/0xe0
 [&lt;f8fcd585&gt;] ? boomerang_start_xmit+0x3b5/0x520 [3c59x]
 [&lt;c07b2975&gt;] ? dev_hard_start_xmit+0xe5/0x400
 [&lt;f9182b00&gt;] ? ip6_output_finish+0x0/0xf0 [ipv6]
 [&lt;c07ca053&gt;] ? sch_direct_xmit+0x113/0x180
 [&lt;c07d5588&gt;] ? nf_hook_slow+0x68/0x120
 [&lt;c07b2ea5&gt;] ? dev_queue_xmit+0x1b5/0x290
 [&lt;f9182b6d&gt;] ? ip6_output_finish+0x6d/0xf0 [ipv6]
 [&lt;f9184cb8&gt;] ? ip6_xmit+0x3e8/0x490 [ipv6]
 [&lt;f91ab9f9&gt;] ? inet6_csk_xmit+0x289/0x2f0 [ipv6]
 [&lt;c07f6451&gt;] ? tcp_transmit_skb+0x431/0x7f0
 [&lt;c07a403f&gt;] ? __alloc_skb+0x4f/0x140
 [&lt;c07f85a2&gt;] ? tcp_write_xmit+0x1c2/0xa50
 [&lt;c07f90b1&gt;] ? __tcp_push_pending_frames+0x31/0xe0
 [&lt;c07ea47a&gt;] ? tcp_sendpage+0x44a/0x4b0
 [&lt;c07ea030&gt;] ? tcp_sendpage+0x0/0x4b0
 [&lt;c079be1e&gt;] ? kernel_sendpage+0x4e/0x90
 [&lt;f8457bb9&gt;] ? svc_send_common+0xc9/0x120 [sunrpc]
 [&lt;f8457c85&gt;] ? svc_sendto+0x75/0x1f0 [sunrpc]
 [&lt;c060d0d9&gt;] ? _atomic_dec_and_lock+0x59/0x90
 [&lt;f87d55d0&gt;] ? nfs3svc_encode_readres+0x0/0xc0 [nfsd]
 [&lt;f845876d&gt;] ? svc_authorise+0x2d/0x40 [sunrpc]
 [&lt;f87d4410&gt;] ? nfs3svc_release_fhandle+0x0/0x10 [nfsd]
 [&lt;f8455721&gt;] ? svc_process_common+0xf1/0x5a0 [sunrpc]
 [&lt;f8457e86&gt;] ? svc_tcp_sendto+0x36/0xa0 [sunrpc]
 [&lt;f8461778&gt;] ? svc_send+0x98/0xd0 [sunrpc]
 [&lt;f87c698c&gt;] ? nfsd+0xac/0x140 [nfsd]
 [&lt;c04470e0&gt;] ? complete+0x40/0x60
 [&lt;f87c68e0&gt;] ? nfsd+0x0/0x140 [nfsd]
 [&lt;c04802ac&gt;] ? kthread+0x7c/0xa0
 [&lt;c0480230&gt;] ? kthread+0x0/0xa0
 [&lt;c0409f9f&gt;] ? kernel_thread_helper+0x7/0x10
Code: 8d b6 00 00 00 00 eb f8 8d b4 26 00 00 00 00 8d bc 27 00 00 00 00 55 89 e5
83 ec 30 89 75 f8 31 f6 89 7d fc 89 c7 89 c8 89 5d f4 &lt;8b&gt; 1a 8b 4d 08 c1 eb 19
c1 e3 04 8b 9b c0 29 c7 c0 83 e3 fc 29

But the problem seems to still exist upstream.  It seems on 32 bit kernels
page_address() can reutrn a NULL value in some circumstances, and the
pci_map_single api isn't prepared to handle that (on this system it results in a
bogus pointer deference in nommu_map_page.

The fix is pretty easy, if we convert the 3c59x driver to use the more
convieient skb_frag_dma_map api we don't need to find the virtual address of the
page at all, and page gets mapped to the hardware properly.  Verified to fix the
problem as described by the reporter.

Applies to the net tree

Change Notes:

v2) Converted PCI_DMA_TODEVICE to DMA_TO_DEVICE.  Thanks Dave!

v3) Actually Run git commit after making changes to v2 :)

Signed-off-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
CC: klassert@mathematik.tu-chemnitz.de
CC: "David S. Miller" &lt;davem@davemloft.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
This bug was reported on a very old kernel (RHEL6, 2.6.32-491.el6):

BUG: unable to handle kernel paging request at 00800000
IP: [&lt;c04107b5&gt;] nommu_map_page+0x15/0x110
*pdpt = 000000003454f001 *pde = 000000003f03d067
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/system/cpu/online
Modules linked in: nfsd lockd nfs_acl auth_rpcgss sunrpc exportfs p4_clockmod
ipv6 ppdev parport_pc parport microcode iTCO_wdt iTCO_vendor_support 3c59x mii
dcdbas serio_raw snd_intel8x0 snd_ac97_codec ac97_bus snd_seq snd_seq_device
snd_pcm snd_timer snd soundcore snd_page_alloc i2c_i801 sg lpc_ich mfd_core ext4
jbd2 mbcache sr_mod cdrom sd_mod crc_t10dif pata_acpi ata_generic ata_piix
radeon ttm drm_kms_helper drm i2c_algo_bit i2c_core dm_mirror dm_region_hash
dm_log dm_mod [last unloaded: mperf]

Pid: 4219, comm: nfsd Not tainted 2.6.32-491.el6.i686 #1 Dell Computer
Corporation OptiPlex GX240               /OptiPlex GX240
EIP: 0060:[&lt;c04107b5&gt;] EFLAGS: 00010246 CPU: 0
EIP is at nommu_map_page+0x15/0x110
EAX: 00000000 EBX: c0a83480 ECX: 00000000 EDX: 00800000
ESI: 00000000 EDI: f70e7860 EBP: e2d09b54 ESP: e2d09b24
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process nfsd (pid: 4219, ti=e2d08000 task=e2ceaaa0 task.ti=e2d08000)
Stack:
 00000056 00000000 0000000e c65efd38 00000020 00000296 00000206 00000206
&lt;0&gt; c050c850 c0a83480 e2cef154 00000001 e2d09ba8 f8fcd585 00000510 00000001
&lt;0&gt; 00000000 00000000 f5172200 f8fdac00 0039ef8c f5277020 f70e7860 00000510
Call Trace:
 [&lt;c050c850&gt;] ? page_address+0xd0/0xe0
 [&lt;f8fcd585&gt;] ? boomerang_start_xmit+0x3b5/0x520 [3c59x]
 [&lt;c07b2975&gt;] ? dev_hard_start_xmit+0xe5/0x400
 [&lt;f9182b00&gt;] ? ip6_output_finish+0x0/0xf0 [ipv6]
 [&lt;c07ca053&gt;] ? sch_direct_xmit+0x113/0x180
 [&lt;c07d5588&gt;] ? nf_hook_slow+0x68/0x120
 [&lt;c07b2ea5&gt;] ? dev_queue_xmit+0x1b5/0x290
 [&lt;f9182b6d&gt;] ? ip6_output_finish+0x6d/0xf0 [ipv6]
 [&lt;f9184cb8&gt;] ? ip6_xmit+0x3e8/0x490 [ipv6]
 [&lt;f91ab9f9&gt;] ? inet6_csk_xmit+0x289/0x2f0 [ipv6]
 [&lt;c07f6451&gt;] ? tcp_transmit_skb+0x431/0x7f0
 [&lt;c07a403f&gt;] ? __alloc_skb+0x4f/0x140
 [&lt;c07f85a2&gt;] ? tcp_write_xmit+0x1c2/0xa50
 [&lt;c07f90b1&gt;] ? __tcp_push_pending_frames+0x31/0xe0
 [&lt;c07ea47a&gt;] ? tcp_sendpage+0x44a/0x4b0
 [&lt;c07ea030&gt;] ? tcp_sendpage+0x0/0x4b0
 [&lt;c079be1e&gt;] ? kernel_sendpage+0x4e/0x90
 [&lt;f8457bb9&gt;] ? svc_send_common+0xc9/0x120 [sunrpc]
 [&lt;f8457c85&gt;] ? svc_sendto+0x75/0x1f0 [sunrpc]
 [&lt;c060d0d9&gt;] ? _atomic_dec_and_lock+0x59/0x90
 [&lt;f87d55d0&gt;] ? nfs3svc_encode_readres+0x0/0xc0 [nfsd]
 [&lt;f845876d&gt;] ? svc_authorise+0x2d/0x40 [sunrpc]
 [&lt;f87d4410&gt;] ? nfs3svc_release_fhandle+0x0/0x10 [nfsd]
 [&lt;f8455721&gt;] ? svc_process_common+0xf1/0x5a0 [sunrpc]
 [&lt;f8457e86&gt;] ? svc_tcp_sendto+0x36/0xa0 [sunrpc]
 [&lt;f8461778&gt;] ? svc_send+0x98/0xd0 [sunrpc]
 [&lt;f87c698c&gt;] ? nfsd+0xac/0x140 [nfsd]
 [&lt;c04470e0&gt;] ? complete+0x40/0x60
 [&lt;f87c68e0&gt;] ? nfsd+0x0/0x140 [nfsd]
 [&lt;c04802ac&gt;] ? kthread+0x7c/0xa0
 [&lt;c0480230&gt;] ? kthread+0x0/0xa0
 [&lt;c0409f9f&gt;] ? kernel_thread_helper+0x7/0x10
Code: 8d b6 00 00 00 00 eb f8 8d b4 26 00 00 00 00 8d bc 27 00 00 00 00 55 89 e5
83 ec 30 89 75 f8 31 f6 89 7d fc 89 c7 89 c8 89 5d f4 &lt;8b&gt; 1a 8b 4d 08 c1 eb 19
c1 e3 04 8b 9b c0 29 c7 c0 83 e3 fc 29

But the problem seems to still exist upstream.  It seems on 32 bit kernels
page_address() can reutrn a NULL value in some circumstances, and the
pci_map_single api isn't prepared to handle that (on this system it results in a
bogus pointer deference in nommu_map_page.

The fix is pretty easy, if we convert the 3c59x driver to use the more
convieient skb_frag_dma_map api we don't need to find the virtual address of the
page at all, and page gets mapped to the hardware properly.  Verified to fix the
problem as described by the reporter.

Applies to the net tree

Change Notes:

v2) Converted PCI_DMA_TODEVICE to DMA_TO_DEVICE.  Thanks Dave!

v3) Actually Run git commit after making changes to v2 :)

Signed-off-by: Neil Horman &lt;nhorman@tuxdriver.com&gt;
CC: klassert@mathematik.tu-chemnitz.de
CC: "David S. Miller" &lt;davem@davemloft.net&gt;
Signed-off-by: David S. Miller &lt;davem@davemloft.net&gt;
</pre>
</div>
</content>
</entry>
</feed>
