Re: Out-of-Line memory deallocation: MIG vs. glibc

[olafBuddenhagen]

Hi again,

On Mon, Apr 10, 2006 at 06:57:21PM -0400, Thomas Schwinge wrote:
> On Mon, Apr 10, 2006 at 01:32:17AM +0200, olafBuddenhagen@gmx.net
> wrote:

> > so many [port rights for the fdarray[] argument] that they are
> > automatically transferred out-of-line, which is one of the
> > conditions causing the crash. I wonder whether this is some bug by
> > itself.
> 
> Could you please elaborate on that?

When invoking an RPC with a variable-sized argument, the size of the
argument is checked. If it's <= 2 KiB, it iss transferred inline, as
part of the message body. If it is larger however, it is transferred
out-of-line, i.e. in an extra memory region that will get mapped into
the receiver's address space.

This also happens if the argument is an array of port rights: If it has
more than 2 KiB (512 entries), it is transferred out-of-line. This is
the condition under which the deallocation problem will show. (If the
RPC returns an error code.)

What I meant (you should have cited the hole paragraph -- it's missing
context), is not that the large array being transferred out-of-line is a
bug; this seems to be conscious and probably reasonable. I meant it
could be a bug that fakeroot-tcp tries to transfer this enormous arrays
in the first place. It just seems strange, but I haven't checked --
maybe there is some good reason for doing this.

Sorry for being unclear.

-antrik-