Re: Xen 4.7 crash

[Aaron Cornelius <aaron.cornelius@dornerworks.com>]

On 6/7/2016 9:40 AM, Aaron Cornelius wrote:
> On 6/7/2016 5:53 AM, Ian Jackson wrote:
>> Aaron Cornelius writes ("Re: [Xen-devel] Xen 4.7 crash"):
>>> We realized that we had forgotten to remove the domain from the
>>> permissions list when the domain is deleted (which would cause the error
>>> we saw).  The application was updated to remove the domain from the
>>> permissions list:
>>> 1. retrieve the permissions with xs_get_permissions()
>>> 2. find the domain ID that is being deleted
>>> 3. memmove() the remaining domains down by 1 to "delete" the old domain
>>> from the permissions list
>>> 4. update the permissions with xs_set_permissions()
>>>
>>> After we made that change, a load test over the weekend confirmed that
>>> the Xen crash no longer happens.  We checked this morning first thing
>>> and confirmed that without this change the crash reliably occurs.
>>
>> This is rather odd behaviour.  I don't think xenstored should hang
>> onto the domain's xs ring page just because the domain is still
>> mentioned in a permission list.
>>
>> But it may do.  I haven't checked the code.  Are you using the
>> ocaml xenstored (oxenstored) or the C one ?
>
> I didn't remember specifying anything special when building the xen
> tools, but I did run into troubles where the ocaml tools appeared to
> conflict with the opam installed mirage packages and libraries. Running
> "sudo make dist-install" command installs the ocaml libraries as root
> which made using opam difficult.  So I did disable the ocaml tools
> during my build.
>
> I double checked and confirmed that the C version of xenstored was
> built.  We will try to test the failure scenario with oxenstored to see
> if it behaves any differently.

I am not that familiar with the xenstored code, but as far as I can tell 
the grant mapping will be held by the xenstore until the xs_release() 
function is called (which is not called by libxl, and I do not 
explicitly call it in my software, although I might now just to be 
safe), or until the last reference to a domain is released and the 
registered destructor (destroy_domain), set by talloc_set_destructor(), 
is called.

I tried to follow the oxenstored code, but I certainly don't consider 
myself an expert at OCaml.  The oxenstored code does not appear to 
allocate grant mappings at all, which makes me think I am probably 
misunderstanding the code :)

- Aaron

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel