Re: [Xen-devel] bug in hvmloader xenbus_shutdown logic

["Liuqiming (John)" <john.liuqiming@xxxxxxxxxx>]

According to oxenstored source code, oxenstored will read every domain's IO 
ring no matter what events happened.

Here is the main loop of oxenstored:

let main_loop () =
        incr periodic_ops_counter;
        if !periodic_ops_counter > 20 then (
                periodic_ops_counter := 0;
                periodic_ops ();
        );

        let mw = Connections.has_more_work cons in
        let inset, outset = Connections.select cons in
        let timeout = if List.length mw > 0 then 0. else -1. in
        let rset, wset, _ =
        try
                Unix.select (spec_fds @ inset) outset [] timeout    <--  poll 
event from fd set including /dev/xen/evtchn
        with Unix.Unix_error(Unix.EINTR, _, _) ->
                [], [], [] in
        let sfds, cfds =
                List.partition (fun fd -> List.mem fd spec_fds) rset in
        if List.length sfds > 0 then
                process_special_fds sfds;
        if List.length cfds > 0 || List.length wset > 0 then
                process_connection_fds store cons domains cfds wset;
        process_domains store cons domains   <- no matter what event income, 
this will handle IO ring request of all domains
        in

so when one domain's hvmloader is clearing its IO ring, oxenstored may access 
this IO ring because of another domain's event happened.
  

> -----Original Message-----
> From: Ian Campbell [mailto:Ian.Campbell@xxxxxxxxxx]
> Sent: Wednesday, December 04, 2013 5:50 PM
> To: Liuqiming (John)
> Cc: xen-devel@xxxxxxxxxxxxx; Yanqiangjun
> Subject: Re: [Xen-devel] bug in hvmloader xenbus_shutdown logic
> 
> On Wed, 2013-12-04 at 04:25 +0000, Liuqiming (John) wrote:
> 
> > memset can not set all the page to zero in an atomic way, and during
> > the clear up process oxenstored may access this ring.
> 
> Why is oxenstored poking at the ring? Surely it should only do so when
> the guest (hvmloader) sends it a request. If hvmloader is clearing the
> page while there is a request/event outstanding then this is an
> hvmloader bug.
> 
> Ian.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel