HDLC driver - dev_free_skb_irq causes Segfault

HDLC driver - dev_free_skb_irq causes Segfault

[Russell McGuire]

[-- Attachment #1: Type: text/plain, Size: 1264 bytes --]

All,

So I am in the process of debugging my newly established HDLC driver.
More or less modeled after a simplified gianfar / ucc_geth idea.

However, after loading, etc. and using the following commands

-> insmod hdlc-8360.ko
-> sethdlc hdlc0 hdlc-eth
-> ifconfig hdlc0 up 192.168.1.100

All is well, and I am seeing IDL interrupts. Great.

Now I go to ping an address like, 
ping 192.168.1.101

I can see that I get the start_xmit function, the IRQ from the QE comes back
and reports the TXBD as successfully sent.

Here is the problem, when I goto free the skb in the tx_handler, I get a 
'Unable to Handle Kernel Paging Request for data at address 0x00000000'
Even though for the life of me, I can't see any pointers that are at address
zero.

I have checked the pointer value I am passing in, and indeed it is the exact
same pointer I am receiving from the original 
start-xmit call..

Are we supposed to copy the skb? And free it immediately in the start_xmit?
Some special way to store the pointer? 

I have tried
txbd->buf = skb->data;
txbd->buf = virt_to_phys(skb->data);
etc.. and various other ways to save that I have seen in  the gianfar and
ucc_geth drivers.

My tx_sk_buff** is identical as alloced the same way. 

Anyone have any ideas?

-Russ




[-- Attachment #2: Type: text/html, Size: 8796 bytes --]

Re: HDLC driver - dev_free_skb_irq causes Segfault

[Laurent Pinchart]

[-- Attachment #1: Type: text/plain, Size: 2120 bytes --]

Hi Russ,

On Sunday 10 February 2008 03:32, Russell McGuire wrote:
> All,
>
> So I am in the process of debugging my newly established HDLC driver.
> More or less modeled after a simplified gianfar / ucc_geth idea.
>
> However, after loading, etc. and using the following commands
>
> -> insmod hdlc-8360.ko
> -> sethdlc hdlc0 hdlc-eth
> -> ifconfig hdlc0 up 192.168.1.100
>
> All is well, and I am seeing IDL interrupts. Great.
>
> Now I go to ping an address like,
> ping 192.168.1.101
>
> I can see that I get the start_xmit function, the IRQ from the QE comes
> back and reports the TXBD as successfully sent.
>
> Here is the problem, when I goto free the skb in the tx_handler, I get a
> 'Unable to Handle Kernel Paging Request for data at address 0x00000000'
> Even though for the life of me, I can't see any pointers that are at
> address zero.

I'm experiencing a similar problem here with a in-house HDLC driver. The 
kernel oopses after some time under high HDLC loads.

Could you please post a backtrace to see if our problems are related ? How do 
you free the skb ? Posting code snippet (or even the whole source code) would 
help.

> I have checked the pointer value I am passing in, and indeed it is the
> exact same pointer I am receiving from the original
> start-xmit call..
>
> Are we supposed to copy the skb? And free it immediately in the start_xmit?
> Some special way to store the pointer?

My understanding is that the skb is supposed to be freed in the TX interrupt 
handler.

> I have tried
> txbd->buf = skb->data;
> txbd->buf = virt_to_phys(skb->data);
> etc.. and various other ways to save that I have seen in  the gianfar and
> ucc_geth drivers.

You should map the skb data buffer using dma_map_single. Don't forget to unmap 
it with dma_unmap_single in the TX interrupt handler.

> My tx_sk_buff** is identical as alloced the same way.
>
> Anyone have any ideas?

Best regards,

-- 
Laurent Pinchart
CSE Semaphore Belgium

Chaussée de Bruxelles, 732A
B-1410 Waterloo
Belgium

T +32 (2) 387 42 59
F +32 (2) 387 42 75

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: HDLC driver - dev_free_skb_irq causes Segfault

[Jochen Friedrich]

Hi Russell,

> ‘Unable to Handle Kernel Paging Request for data at address 0x00000000’

You need to check where the crash happens and what data is 0.

> Anyone have any ideas?

Is the source of this driver available somewhere?

Thanks,
Jochen