WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] Question regarding SLAB corruption

To: Keir Fraser <keir@xxxxxxxxxxxxx>
Subject: Re: [Xen-devel] Question regarding SLAB corruption
From: Lukas Hejtmanek <xhejtman@xxxxxxxxxxx>
Date: Mon, 9 Jul 2007 19:42:26 +0200
Cc: Roland Dreier <rdreier@xxxxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxx
Delivery-date: Mon, 09 Jul 2007 10:39:31 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
In-reply-to: <C2B82D24.12201%keir@xxxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <20070709171103.GO3885@xxxxxxxxxxx> <C2B82D24.12201%keir@xxxxxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mutt/1.5.16 (2007-06-11)
On Mon, Jul 09, 2007 at 06:21:24PM +0100, Keir Fraser wrote:
> By my understanding, the infiniband driver is doing an order-6 allocation,
> then stuffing that multi-page region into a single element of a scatterlist.
> It is then calling dma_map_sg(), which [on Xen] calls swiotlb_map_sg(),
> which calls map_single() on that multi-page extent. Am I misunderstanding
> something?

Not exactly.

IB driver does alloc_pages (order-6). Then it calls pci_map_sg() which is
basically dma_map_sg(). This one invokes swiotlb_map_sg() which possibly calls
map_single() (right now I'm not sure, I must check it, but if yes, it creates
index 3328).

Then later, IB driver invokes dma_sync_single on the first page from that
order-6 allocation via dma_handle. And in __sync_single it crashes because
sync_single picks up index 3332 instead of 3328.

Btw, please, keep Roland in Cc.

-- 
Lukáš Hejtmánek

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel

<Prev in Thread] Current Thread [Next in Thread>