[Xen-devel] CPU Fatal trap when killing a domU that has more than 4G

[Guillaume Thouvenin <guillaume.thouvenin@xxxxxxxx>]

Hello,

 On my computer there is a CPU Fatal trap each time I create and
shutdown (or reboot) a non privilege domain with 4096Mo or more. With
less than 4Go everything works fine.

 I'm using Xen version 3.0.3-rc3 from xen-3.0.3-testing.hg (latest
ChangeSet: Tue Oct 10 21:05:50 2006 +0100 11740:64b3e8596dc9)

 The computer is an Intel Xeon (x86_64) with 8 processors (dual core +
HT thus Xen sees 32 procs). I have 28Go of RAM.

  I can reproduce the problem. 

   1) xm create capablanca
   2) xm reboot capablanca
   3) crash...

  I submitted the bug to bugzilla see
http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=790



  Here is the configuration of domU:

#  -*- mode: python; -*-
#============================================================================
# Python configuration setup for 'xm create'.
# This script sets the parameters used when a domain is created using 'xm 
create'.
# You use a separate script for each domain you want to create, or
# you can set the parameters for the domain on the xm command line.
#============================================================================

#----------------------------------------------------------------------------
# Kernel image file.
kernel="/boot/vmlinuz-2.6.16.29-xen-sas-testing"
#ramdisk = "/boot/initrd.img-2.6.16-xen"

# Initial memory allocation (in megabytes) for the new domain.
memory=4096

# A name for your domain. All domains must have different names.
name="capablanca"

# Define the disk devices you want the domain to have access to, and
# what you want them accessible as.
# Each disk entry is of the form phy:UNAME,DEV,MODE
# where UNAME is the device, DEV is the device name the domain will see,
# and MODE is r for read-only, w for read-write.

disk=['phy:sdb5,sdb1,w','phy:sdb6,sdb2,w']

vif=[' ']

vcpus = 16

# Set root device.
root="/dev/sdb1 ro"
#============================================================================


  Here is the bug report obtained from the serial console:

(XEN) Watchdog timer detects that CPU23 is stuck!
(XEN) ----[ Xen-3.0.3-rc3  x86_64  debug=y  Not tainted ]----
(XEN) CPU:    23
(XEN) RIP:    e010:[<ffff830000112d6e>] free_domheap_pages+0x4c3/0x587
(XEN) RFLAGS: 0000000000000206   CONTEXT: hypervisor
(XEN) rax: 0000000000000000   rbx: 0000000000000000   rcx: 0000000000000000
(XEN) rdx: ffff828406912930   rsi: 00000000002a076e   rdi: ffff8300003ae080
(XEN) rbp: ffff830000f6ba78   rsp: ffff830000f6ba38   r8:  0000000000000000
(XEN) r9:  00000000deadbeef   r10: ffff8300001aae30   r11: 0000000000000282
(XEN) r12: ffff828406912958   r13: 0000000000000001   r14: ffff8300003ce380
(XEN) r15: 0000000000000001   cr0: 0000000080050033   cr4: 00000000000026f0
(XEN) cr3: 00000000d6173000   cr2: 00000000007126c0
(XEN) ds: 0000   es: 0000   fs: 0063   gs: 0000   ss: e018   cs: e010
(XEN) Xen stack trace from rsp=ffff830000f6ba38:
(XEN)    000000000064a790 ffff828406912930 ffff828406912930 0000000000001067
(XEN)    ffff828406912930 ffff8300003ce380 ffff8300003ce380 ffff828405596e60
(XEN)    ffff830000f6baa8 ffff83000012fe4e ffff830124d8a280 ffff830124d8b000
(XEN)    ffff8300003ce380 ffff828402dc1d90 ffff830000f6bae8 ffff83000012f783
(XEN)    ffff828402dc1db8 0000000020000001 0000000028000000 ffff828402dc1d90
(XEN)    ffff828402dc2038 ffff828405596e60 ffff830000f6bb18 ffff83000012f9b1
(XEN)    ffff830124d9c000 ffff828402dc1d90 ffff830124d9c000 0000000000124d9b
(XEN)    ffff830000f6bb38 ffff83000012ff93 ffff830000f6bb38 ffff830124d9b080
(XEN)    ffff830000f6bb78 ffff83000012f7dc ffff828402dc7060 0000000040000001
(XEN)    0000000048000000 ffff828402dc2038 ffff828402dae0b0 ffff828405596e60
(XEN)    ffff830000f6bba8 ffff83000012f9b1 ffff83012459f000 ffff828402dc2038
(XEN)    ffff83012459f000 000000000012459e ffff830000f6bbc8 ffff83000012ff1e
(XEN)    ffff830000f2b380 ffff83012459e010 ffff830000f6bc08 ffff83000012f83d
(XEN)    ffff830000f2b380 0000000060000001 0000000068000000 ffff828402dae0b0
(XEN)    ffff828405596e60 ffff828405596e60 ffff830000f6bc38 ffff83000012f9b1
(XEN)    00007cffff0943b7 ffff828402dae0b0 ffff830223c5c000 0000000000223c5c
(XEN)    ffff830000f6bc58 ffff83000012fa59 ffff830000f6bd28 0000000000000110
(XEN)    ffff830000f6bc98 ffff83000012f8a1 00000000deadbeef 0000000080000001
(XEN)    0000000088000000 ffff828405596e60 ffff828405596e60 ffff828405596e60
(XEN)    ffff830000f6bcc8 ffff83000012f9b1 ffff83000012507d 0000000080000004
(XEN) Xen call trace:
(XEN)    [<ffff830000112d6e>] free_domheap_pages+0x4c3/0x587
(XEN)    [<ffff83000012fe4e>] put_page_from_l1e+0x164/0x1f5
(XEN)    [<ffff83000012f783>] free_page_type+0x547/0x6c8
(XEN)    [<ffff83000012f9b1>] put_page_type+0xad/0x116
(XEN)    [<ffff83000012ff93>] put_page_from_l2e+0x3f/0x75
(XEN)    [<ffff83000012f7dc>] free_page_type+0x5a0/0x6c8
(XEN)    [<ffff83000012f9b1>] put_page_type+0xad/0x116
(XEN)    [<ffff83000012ff1e>] put_page_from_l3e+0x3f/0x75
(XEN)    [<ffff83000012f83d>] free_page_type+0x601/0x6c8
(XEN)    [<ffff83000012f9b1>] put_page_type+0xad/0x116
(XEN)    [<ffff83000012fa59>] put_page_from_l4e+0x3f/0x75
(XEN)    [<ffff83000012f8a1>] free_page_type+0x665/0x6c8
(XEN)    [<ffff83000012f9b1>] put_page_type+0xad/0x116
(XEN)    [<ffff83000012518a>] relinquish_memory+0x173/0x2cf
(XEN)    [<ffff830000125507>] domain_relinquish_resources+0x221/0x234
(XEN)    [<ffff830000107c46>] domain_kill+0x30/0x5e
(XEN)    [<ffff830000106512>] do_domctl+0x681/0xf4f
(XEN)    [<ffff8300001834e2>] syscall_enter+0xa2/0xfc
(XEN)
(XEN) ************************************
(XEN) CPU23 FATAL TRAP 2 (nmi), ERROR_CODE 0000.
(XEN) System shutting down -- need manual reset.
(XEN) ************************************


  If you need more information I can reproduce the problem and in the
same time I'm trying to find a solution.


Best regards,
 Guillaume

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel