Bug 66966 - Wrong physical address translation for DMA >4GB
Wrong physical address translation for DMA >4GB
Product: Red Hat Enterprise Linux 2.1
Classification: Red Hat
Component: kernel (Show other bugs)
i386 Linux
high Severity high
: ---
: ---
Assigned To: Larry Woodman
Brian Brock
Depends On: 66521
Blocks: 66527
  Show dependency treegraph
Reported: 2002-06-19 05:10 EDT by Martin Wilck
Modified: 2007-11-30 17:06 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2002-06-20 03:39:46 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Patch that solves this problem (439 bytes, patch)
2002-06-19 05:14 EDT, Martin Wilck
no flags Details | Diff

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2002:128 normal SHIPPED_LIVE Moderate: Updated kernel with information security fixes, bug fixes, and updated drivers 2002-06-25 00:00:00 EDT

  None (edit)
Description Martin Wilck 2002-06-19 05:10:49 EDT
Description of Problem:

A bug in inlude/asm-i386/io.h leads to wrong page to physical address
translation for DMA memory above 4GB. If high buffers are used for DMA, 
this may lead to DMA transfers to wrong memry regions, which (depending on
the false address) may lead to PCI bus aborts, data corruption, or 
even destruction of elementary kernel code or data (if DMA is carried out
into kernel core memory).

Version-Release number of selected component (if applicable):

How Reproducible:
Run IO stress test on e.g. a PCI SCSI controller capable of doing 
high-memory DMA (e.g. aic7xxx).

Steps to Reproduce:
1. Start stress test
2. wait

Actual Results:
Once a DMA buffer above 4GB is allocated (e.g. 0x101010000), the address
translation for the scatter-gather list discards the high bits, leading to
0x001010000. Depending on the address generated and the direction of the IO,
all sorts of errors may result, leaving the system in an undeterimined state.

Expected Results:
IO completes successfully.

Additional Information:

I reported this for RedHat 7.2 in the descussion of bug 66143
The problem is fixed in the 2.4.18 kernels of RedHat 7.3.

I will attach a patch that solves the problem.
Comment 1 Martin Wilck 2002-06-19 05:14:22 EDT
Created attachment 61544 [details]
Patch that solves this problem
Comment 2 Martin Wilck 2002-06-20 03:27:36 EDT
I am interesting what bug 66521 is but I have no permissions to see it.
Could you allow me in?
Comment 3 Larry Woodman 2002-08-05 12:27:01 EDT
Fixed in AS2.1 errata kernel-2.4.9-e.8, released on 7/29.

Larry Woodman
Comment 4 Annie 2003-05-08 11:55:52 EDT
We are seeing memory corruption when using > 4GB memory on AS 2.4.9-e12.  Any 
chance this bug has been re-introduced?  
Annie McQuilken, Experience, Inc.
Comment 5 Martin Wilck 2003-05-09 02:44:14 EDT
Certainly not this one.

Note You need to log in before you can comment on or make changes to this bug.