This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-devel] [PATCH][SPT][DISCUSS] BUG() in shadow.h delete_shadow_status

To: xen-devel@xxxxxxxxxxxxxxxxxxx
Subject: [Xen-devel] [PATCH][SPT][DISCUSS] BUG() in shadow.h delete_shadow_status() with HVM guest
From: "Woller, Thomas" <thomas.woller@xxxxxxx>
Date: Tue, 9 May 2006 13:24:42 -0500
Delivery-date: Tue, 09 May 2006 11:25:17 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
Thread-index: AcZzldcJdz7SebjeQ1OGHswZcegpxQ==
Thread-topic: [PATCH][SPT][DISCUSS] BUG() in shadow.h delete_shadow_status() with HVM guest
We are hitting the BUG() at the end of delete_shadow_status() in
xen/include/asm-x86/shadow.h with a PAE enabled 32bit unmodified windows
guest, on both SVM and VMX, with a 64bit hypervisor.  After a PAE 32bit
winxpsp2 or win2003 guest, boots, and then has been properly shutdown -
performing a "xm destroy/xm shutdown" results in this BUG().

We clearly don't understand the intricacies of the SPT code, but our
best guess seems to be that the BUG() is not valid in the failing case.

The theory is that since a single PDPT page can have multiple PDPs, then
maybe this function has already been called for this particular gmfn.
Took the same philosophy as with free_shadow_page() in shadow_public.c
line 766ish.

We are definitely unsure as to the viability of this fix as a final
solution, but the below fix alleviates this BUG() on both SVM and VMX
boxes.  If anyone knowledgable in the SPT area could take a look at the
patch, we'd appreciate your thoughts.

# HG changeset patch
# User twoller@xxxxxxxxxxxxxxxx
# Node ID c8e01ad41814e923c70e97877a22ae6ffeacb30a
# Parent  6e35b42994944e82550da99d03bcf9676b4ddec2
Fix a problem when destroying windows domains that are PAE enabled.

diff -r 6e35b4299494 -r c8e01ad41814 xen/include/asm-x86/shadow.h
--- a/xen/include/asm-x86/shadow.h      Mon May  8 17:44:46 2006
+++ b/xen/include/asm-x86/shadow.h      Tue May  9 15:40:35 2006
@@ -1352,6 +1352,17 @@
     while ( x != NULL );
+    /*
+     * Since a single PDPT page can have multiple PDPs, it's possible
+     * that it has been already called for this gmfn.
+     */
+    if ( stype == PGT_l4_shadow && (!mfn_is_page_table(gmfn)) )
+    {
+        goto found;
+    }
     /* If we got here, it wasn't in the list! */

Xen-devel mailing list

<Prev in Thread] Current Thread [Next in Thread>
  • [Xen-devel] [PATCH][SPT][DISCUSS] BUG() in shadow.h delete_shadow_status() with HVM guest, Woller, Thomas <=