Re: Xen 4.0.0x allows for data corruption in Dom0

[Joanna Rutkowska <joanna@invisiblethingslab.com>]

[-- Attachment #1.1: Type: text/plain, Size: 1845 bytes --]

On 03/09/2010 12:12 AM, Jeremy Fitzhardinge wrote:
> I think its most likely to be a dom0 bug, specifically a bug in one of
> the backend drivers.  The common failure mode which causes symtoms like
> this is when a granted page (=a domU page mapped into dom0) is released
> back into dom0's heap and reused as general memory while still being
> under the control of the domU.
> 
> However, given that the domU hasn't got any devices assigned to it aside
> from the console, none of the backend should be coming into play.  It
> might be a more general problem with the privcmd interface.
> 
> Alternatively, I suppose, the domain builder could end up using some of
> dom0 pages to construct the domU without properly freeing them, which
> would suggest a bug in the balloon driver.
> 
> I can't think of a Xen failure-mode which would cause these symptoms
> without also being massively obvious in other cases.  (But "I can't
> think of..." is where all the best bugs hide.)
> 

But the corruptions always happen in 32-bytes chunks, which might
suggest it's not a page-related problem (e.g. wrongly re-used page), as
in that case we would be observing (at least sometimes) much bigger
chunks of corrupted data, I think.

The reason why I still believe it's a hypervisor related thing, it that
I'm currently using the very *same* Dom0 kernel (very recent
xen/stable-2.6.31) with Xen 3.4.2 and the system is damn stable. And I
really mean extensive use with 5-7 VMs running all the time doing
various things from Web browsing to kernel building.

If I was to make an educated guess I would say it's something related to
some interrupt handling, i.e. Xen mishandling it, e.g. the handler is
writing out-of-buffer somewhere and it just happens to land in the Dom0
fs buffer used by e.g. dd operation.

joanna.


[-- Attachment #1.2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 226 bytes --]

[-- Attachment #2: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel