Re: [Xen-devel] What is the current state of Dom0 kernel support? / crash

[Pasi Kärkkäinen <pasik@xxxxxx>]

On Wed, Jul 22, 2009 at 10:35:30PM +0300, Pasi Kärkkäinen wrote:
> On Wed, Jul 22, 2009 at 12:14:37PM -0700, Jeremy Fitzhardinge wrote:
> > On 07/21/09 06:03, Pasi Kärkkäinen wrote:
> > > I just tried the latest 32b PAE rebase/master tree (2.6.31-rc3).
> > >
> > > http://pasik.reaktio.net/xen/pv_ops-dom0-debug/pv_ops-dom0-log-10-rebase-master-with-highpte.txt
> > >
> > > Checking if this processor honours the WP bit even in supervisor mode...
> > > BUG: unable to handle kernel NULL pointer dereference at (null)
> > > IP: [<c058cdcb>] xen_evtchn_do_upcall+0xcc/0x13f
> > > *pdpt = 000000003d275001 
> > > Thread overran stack, or stack corrupted
> > > Oops: 0000 [#1] SMP 
> > > last sysfs file: 
> > > Modules linked in:
> > >
> > > Pid: 0, comm: swapper Not tainted (2.6.31-rc3 #20) P8SC8
> > > EIP: 0061:[<c058cdcb>] EFLAGS: 00010046 CPU: 0
> > > EIP is at xen_evtchn_do_upcall+0xcc/0x13f
> > > EAX: 00000000 EBX: ffffffff ECX: 00000000 EDX: 00000000
> > > ESI: 00000000 EDI: c08ec558 EBP: c087eedc ESP: c087eea0
> > >  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: e021
> > > Process swapper (pid: 0, ti=c087e000 task=c083b1a0 task.ti=c087e000)
> > > Stack:
> > >  00001a6e 00000220 00000200 00000000 00000000 00000000 e3201014 c08ec558
> > > <0> c087eee4 f5681000 e3201010 00000000 00000000 c09017f8 f54ff000 
> > > c087ef20
> > > <0> c0409927 00000000 c09017f8 f54ff000 c09017f8 f54ff000 c087ef20 
> > > c0843f70
> > > Call Trace:
> > >  [<c0409927>] ? xen_do_upcall+0x7/0xc
> > >  [<c0404581>] ? xen_pte_clear+0x9/0x12
> > >  [<c0427a94>] ? set_pte_vaddr+0xb4/0xc4
> > >  [<c0426c8c>] ? __native_set_fixmap+0x25/0x30
> > >  [<c040471a>] ? xen_set_fixmap+0xc7/0xcc
> > >  [<c0897d86>] ? mem_init+0x24a/0x298
> > >  [<c088367e>] ? start_kernel+0x14b/0x2cd
> > >  [<c088336f>] ? unknown_bootoption+0x0/0x18e
> > >  [<c0883082>] ? i386_start_kernel+0x71/0x79
> > >  [<c0886188>] ? xen_start_kernel+0x52a/0x533
> > > Code: d0 89 45 cc 89 55 c8 eb 16 0f bc c8 03 4d d4 8b 04 8a 83 f8 ff 74 f8
> > > 8b 55 e4 e8 36 de e7 ff 8b 55 f0 8b 45 d0 03 
> > > 05 1c 0c 97 c0 <8b> 0c 10 8b 55 e8 8b 45 cc 23 0c 82 8b 45 c8 8b 04 82 8b 
> > > 15
> > > 18 
> > > EIP: [<c058cdcb>] xen_evtchn_do_upcall+0xcc/0x13f SS:ESP e021:c087eea0
> > > CR2: 0000000000000000
> > > ---[ end trace 4eaa2a86a8e2da22 ]---
> > > Kernel panic - not syncing: Fatal exception in interrupt
> > >   
> > 
> > Haven't seen that one before.  
> >
> 
> Ok. I've seen many people report crashes during startup with rebase/master
> on 32b PAE. I assume they're seeing this same issue.
> 
> > The stack backtrace is a bit fuzzy; do you have CONFIG_FRAMEPOINTER 
> > enabled?  
> > And if you have CONFIG_DEBUGINFO enabled, you can map the eip c058cdcb 
> > to a specific source line (its not clear to me which pointer is NULL).
> > 
> 
> [root@dom0test linux-2.6-xen]# grep -i CONFIG_FRAMEPOINTER .config
> [root@dom0test linux-2.6-xen]# grep -i CONFIG_DEBUGINFO .config
> [root@dom0test linux-2.6-xen]# 
> 
> Unfortunately those were not enabled.. I'll build a new kernel with
> CONFIG_DEBUGINFO enabled.
> 

Actually CONFIG_DEBUG_INFO was enabled, if you meant that? 

(gdb) x/i 0xc058cdcb
0xc058cdcb <active_evtchns+124>:        mov    (%eax,%edx,1),%ecx

(gdb) disas 0xc058cdcb
Dump of assembler code for function active_evtchns:
0xc058cd4f <cpu_evtchn_mask+0>: shll   $0x7,-0x10(%ebp)
0xc058cd53 <xen_evtchn_do_upcall+84>:   mov    %edi,-0x20(%ebp)
0xc058cd56 <__xchg+10>: add    $0x4,%edx
0xc058cd59 <__xchg+13>: mov    %edx,-0x24(%ebp)
0xc058cd5c <xen_evtchn_do_upcall+93>:   mov    -0x14(%ebp),%ecx
0xc058cd5f <xen_evtchn_do_upcall+96>:   movb   $0x0,(%ecx)
0xc058cd62 <xen_evtchn_do_upcall+99>:   mov    %fs:0xc08ea60c,%eax
0xc058cd68 <xen_evtchn_do_upcall+105>:  add    %edi,%eax
0xc058cd6a <xen_evtchn_do_upcall+107>:  mov    (%eax),%ebx
0xc058cd6c <xen_evtchn_do_upcall+109>:  lea    0x1(%ebx),%edx
0xc058cd6f <xen_evtchn_do_upcall+112>:  test   %ebx,%ebx
0xc058cd71 <xen_evtchn_do_upcall+114>:  mov    %edx,(%eax)
0xc058cd73 <xen_evtchn_do_upcall+116>:  jne    0xc058ce28 
<xen_evtchn_do_upcall+297>
0xc058cd79 <__xchg+45>: mov    -0x24(%ebp),%eax
0xc058cd7c <__xchg+48>: xchg   %ebx,(%eax)
0xc058cd7e <xen_evtchn_do_upcall+127>:  jmp    0xc058cdfb 
<xen_evtchn_do_upcall+252>
0xc058cd80 <__ffs+0>:   bsf    %ebx,%esi
0xc058cd83 <xen_evtchn_do_upcall+132>:  mov    %esi,%edx
0xc058cd85 <xen_evtchn_do_upcall+134>:  shl    $0x5,%edx
0xc058cd88 <xen_evtchn_do_upcall+137>:  mov    %edx,-0x2c(%ebp)
0xc058cd8b <active_evtchns+60>: lea    0x0(,%esi,4),%ecx
0xc058cd92 <active_evtchns+67>: lea    0x200(%esi),%eax
0xc058cd98 <active_evtchns+73>: lea    0x220(%esi),%edx
0xc058cd9e <active_evtchns+79>: mov    %ecx,-0x30(%ebp)
0xc058cda1 <active_evtchns+82>: mov    %eax,-0x34(%ebp)
0xc058cda4 <active_evtchns+85>: mov    %edx,-0x38(%ebp)
0xc058cda7 <xen_evtchn_do_upcall+168>:  jmp    0xc058cdbf <active_evtchns+112>
0xc058cda9 <__ffs+0>:   bsf    %eax,%ecx
0xc058cdac <xen_evtchn_do_upcall+173>:  add    -0x2c(%ebp),%ecx
0xc058cdaf <xen_evtchn_do_upcall+176>:  mov    (%edx,%ecx,4),%eax
0xc058cdb2 <xen_evtchn_do_upcall+179>:  cmp    $0xffffffff,%eax
0xc058cdb5 <xen_evtchn_do_upcall+182>:  je     0xc058cdaf 
<xen_evtchn_do_upcall+176>
0xc058cdb7 <xen_evtchn_do_upcall+184>:  mov    -0x1c(%ebp),%edx
0xc058cdba <xen_evtchn_do_upcall+187>:  call   0xc040abf5 <handle_irq>
0xc058cdbf <active_evtchns+112>:        mov    -0x10(%ebp),%edx
0xc058cdc2 <active_evtchns+115>:        mov    -0x30(%ebp),%eax
0xc058cdc5 <active_evtchns+118>:        add    0xc0970c1c,%eax
0xc058cdcb <active_evtchns+124>:        mov    (%eax,%edx,1),%ecx
0xc058cdce <active_evtchns+127>:        mov    -0x18(%ebp),%edx
0xc058cdd1 <active_evtchns+130>:        mov    -0x34(%ebp),%eax
0xc058cdd4 <active_evtchns+133>:        and    (%edx,%eax,4),%ecx
0xc058cdd7 <active_evtchns+136>:        mov    -0x38(%ebp),%eax
0xc058cdda <active_evtchns+139>:        mov    (%edx,%eax,4),%eax
0xc058cddd <xen_evtchn_do_upcall+222>:  mov    0xc0970c18,%edx
0xc058cde3 <active_evtchns+148>:        not    %eax
0xc058cde5 <active_evtchns+150>:        mov    %eax,-0x3c(%ebp)
End of assembler dump.
(gdb) 

Hopefully that helps..

-- Pasi

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel