Hey Raj, Let us know if you need help in gathering more debugging information. For the time being we've decided to ERRATA the use of the Intel I/O MMU with IPsec till we Root Cause the issue. But this is still at the top of Harsh's bug list. With Robin's comments, I'm almost sure that the: (iov_pfn + sg->offset) << VTD_PAGE_SHIFT) in your suggested patch is an issue. iov_pfn is a Page Frame Number and sg->offset is a Byte Offset. It feels like this should be: size_t page_off = sg->offset & ~VTD_PAGE_MASK; unsigned long pfn_off = sg->offset >> VTD_PAGE_MASK; ... sg->dma_address = ((dma_addr_t) (iov_pfn + pfn_off) << VTD_PAGE_SHIFT) + page_off; When Harsh tried your original patch, Harsh' test system wouldn't even boot. Casey