This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] Possible shadow bug

To: Tim Deegan <Tim.Deegan@xxxxxxxxxx>
Subject: Re: [Xen-devel] Possible shadow bug
From: Igor Mammedov <imammedo@xxxxxxxxxx>
Date: Thu, 09 Jun 2011 18:47:09 +0200
Cc: xen-devel@xxxxxxxxxxxxxxxxxxx, Keir Fraser <keir@xxxxxxx>, Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>, "containers@xxxxxxxxxxxxxxxxxxxxxxxxxx" <containers@xxxxxxxxxxxxxxxxxxxxxxxxxx>, Li Zefan <lizf@xxxxxxxxxxxxxx>, "linux-kernel@xxxxxxxxxxxxxxx" <linux-kernel@xxxxxxxxxxxxxxx>, Michal Hocko <mhocko@xxxxxxx>, "linux-mm@xxxxxxxxx" <linux-mm@xxxxxxxxx>, Keir Fraser <keir.xen@xxxxxxxxx>, "akpm@xxxxxxxxxxxxxxxxxxxx" <akpm@xxxxxxxxxxxxxxxxxxxx>, "balbir@xxxxxxxxxxxxxxxxxx" <balbir@xxxxxxxxxxxxxxxxxx>, Paul Menage <menage@xxxxxxxxxx>, KAMEZAWA Hiroyuki <kamezawa.hiroyu@xxxxxxxxxxxxxx>, Hiroyuki Kamezawa <kamezawa.hiroyuki@xxxxxxxxx>
Delivery-date: Thu, 09 Jun 2011 09:49:10 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <20110609150133.GF5098@xxxxxxxxxxxxxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <4DE64F0C.3050203@xxxxxxxxxx> <20110601152039.GG4266@xxxxxxxxxxxxxxxxx> <4DE66BEB.7040502@xxxxxxxxxx> <BANLkTimbqHPeUdue=_Z31KVdPwcXtbLpeg@xxxxxxxxxxxxxx> <4DE8D50F.1090406@xxxxxxxxxx> <BANLkTinMamg_qesEffGxKu3QkT=zyQ2MRQ@xxxxxxxxxxxxxx> <4DEE26E7.2060201@xxxxxxxxxx> <20110608123527.479e6991.kamezawa.hiroyu@xxxxxxxxxxxxxx> <4DF0801F.9050908@xxxxxxxxxx> <alpine.DEB.2.00.1106091311530.12963@kaball-desktop> <20110609150133.GF5098@xxxxxxxxxxxxxxxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv: Gecko/20110419 Red Hat/3.1.10-1.el6_0 Lightning/1.0b2 Thunderbird/3.1.10
On 06/09/2011 05:01 PM, Tim Deegan wrote:
At 13:40 +0100 on 09 Jun (1307626812), Stefano Stabellini wrote:
CC'ing xen-devel and Tim.

This is a comment from a previous email in the thread:

It most easily reproduced only on xen hvm 32bit guest under heavy vcpus
contention for real cpus resources (i.e. I had to overcommit cpus and
run several cpu hog tasks on host to make guest crash on reboot cycle).
And from last experiments, crash happens only on on hosts that doesn't
have hap feature or if hap is disabled in hypervisor.
it makes me think that it is a shadow pagetables bug; see details below.
You can find more details on it following this thread on the lkml.
Oh dear.  I'm having a look at the linux code now to try and understand
the behaviour.  In the meantime, what version of Xen was this on?  If
It's rhel5.6 xen. I've tried to test on SLES 11 that has 4.0.1 xen, however
wasn't able to reproduce problem. (I'm not sure if hap was turned off in this
case). More detailed info can be found at RHBZ#700565

you're willing to try recompiling Xen with some small patches that
disable the "cleverer" parts of the shadow pagetable code that might
indicate something.  (Of course, it might just change the timing to
obscure a real linux bug too.)

Haven't got to this part yet. But looks like it's the only option left.

The only time I've seen a corruption like this, with a mapping
transiently going to the wrong frame, it turned out to be caused by
32-bit pagetable-handling code writing a PAE PTE with a single 64-bit
write (which is not atomic on x86-32), and the TLB happening to see the
intermediate, half-written entry.  I doubt that there's any bug like
that in linux, though, or we'd surely have seen it before now.




Xen-devel mailing list