[Xen-devel] Very strange behavior between balloon driver and network driver (Arndale)

[Jaeyong Yoo <jaeyong.yoo@xxxxxxxxxxx>]

Hello,
I'm testing xen in Arndale board and I found very strange behavior:

When I'm creating/destroying domUs consecutively, suddenly network driver does not work.
I tried both on-board and USB-dongle network devices but they show the similar behavior.
Only difference is that when I'm using on-board, it gives the following error message:

 

[ 709.900000] asix 1-3.2.4:1.0 eth0: asix_rx_fixup() Bad Header Length 0x85555, offset 4
[ 709.910000] asix 1-3.2.4:1.0 eth0: asix_rx_fixup() Bad Header Length 0x0, offset 4
[ 709.920000] asix 1-3.2.4:1.0 eth0: asix_rx_fixup() Bad Header Length 0x0, offset 4
[ 709.930000] asix 1-3.2.4:1.0 eth0: asix_rx_fixup() Bad Header Length 0x105555, offset 4

while USB-dongle network device does not show any message.

 

I investigated this problem and found out that when I comment out the following line
in file drivers/xen/balloon.c at function free_xenballooned_pages as follows,

        //if (current_credit())
        //      schedule_delayed_work(&balloon_worker, 0);
, the problem disappears.
balloon_worker is doing increase_reservation and decrease_reservation that use XENMEM

hypercalls. I think while mapping and unmapping domain pages with the above hypercalls,

somehow the network driver memory is corrupted.

 

Currently, most suspcious function is create_p2m_entries in xen (xen/arch/arm/p2m.c)
When we call this function with INSERT op, it maps the corresponding pte (page table entry)

to the given mfn without checking whether the pte is already take by someone.
I actually observed that pte's base address is overwritten to some other value and I'm not sure

this behavior is OK. If it is not OK, I think it can corrupt others memory (for instance, inocent

network driver).

 

Do you have any ideas or experience similar bug (the network error)?

 

Best,

Jaeyong

 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel