[Xen-devel] Shadow OOS bug?

["Cui, Dexuan" <dexuan.cui@xxxxxxxxx>]

I'm using c/s 17893: dedfadeadf86.
When I destroy an HVM guest, I can _occasionally_ (maybe 30% probable)
see the issue.
Let me post the log below FYI.

--- Dexuan

(XEN) ----[ Xen-3.3-unstable  x86_64  debug=y  Not tainted ]----
(XEN) CPU:    0
(XEN) RIP:    e008:[<ffff828c8019d2bb>] oos_fixup_remove+0x55/0x71
(XEN) RFLAGS: 0000000000010206   CONTEXT: hypervisor
(XEN) rax: 0000000000000888   rbx: ffff82840085c7f8   rcx:
ffff83005d432000
(XEN) rdx: 0000000000000000   rsi: 0000000000035833   rdi:
ffff83005d436100
(XEN) rbp: ffff828c80277a98   rsp: ffff828c80277a98   r8:
000000000000005b
(XEN) r9:  ffffffffffffffff   r10: 0000000000000000   r11:
00ff00ff00ff00ff
(XEN) r12: 0000000000035833   r13: ffff83005d436100   r14:
ffff83005d4ec100
(XEN) r15: ffff83005d436100   cr0: 000000008005003b   cr4:
00000000000026b0
(XEN) cr3: 000000003fc3d000   cr2: ffff83005d432888
(XEN) ds: 0000   es: 0000   fs: 0063   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff828c80277a98:
(XEN)    ffff828c80277ac8 ffff828c8019e330 0000000000035833
0000000000000008
(XEN)    0000000000035833 000000000005cdb7 ffff828c80277b18
ffff828c801bbec6
(XEN)    ffff83005d4ec100 000000000005cdb7 ffff83005d436100
ffff828400e82498
(XEN)    0000000000000000 000000000005cdb7 0000000000000002
ffff83005d436100
(XEN)    ffff828c80277b28 ffff828c801a104c ffff828c80277b98
ffff828c801bbdb6
(XEN)    0000beef0000beef ffff83005d436100 0000000000e2d5d8
ffff83005abbf000
(XEN)    000000005d4ec100 000000000005abbf 000000000005abbf
ffff828400e2d5d8
(XEN)    0000000000000000 000000000005abbf 0000000000000000
ffff83003b58f000
(XEN)    ffff828c80277ba8 ffff828c801a107d ffff828c80277c08
ffff828c801bbaa7
(XEN)    ffff83005d4ec100 ffff83005d436100 000000000003b58f
000000000003b58f
(XEN)    ffff83005d436100 ffff828400945e58 0000000000000000
0000000000000000
(XEN)    000000000003b58f ffff83005d436100 ffff828c80277c18
ffff828c801a1084
(XEN)    ffff828c80277c78 ffff828c801bb816 ffff83005d436100
0000000080277f28
(XEN)    ffff830059c5d000 0000000000059c5d 0000000000059c5d
ffff828400e06e88
(XEN)    0000000000000000 0000000000059c5d ffff83005d4ec100
0000000000000002
(XEN)    ffff828c80277c88 ffff828c801a108b ffff828c80277cf8
ffff828c8019ed8d
(XEN)    ffff828c80277cd8 ffff828c80112a35 ffff83005d436100
ffff83005d436100
(XEN)    ffff83005d4ed068 ffff83005d436100 0000000100000002
ffff83005d4ec100
(XEN)    ffff83005d4ed0a8 0000000000000000 0000000000000002
0000000000000004
(XEN)    ffff828c80277d58 ffff828c801a038e ffff83005d4ec100
ffff828c80277f28
(XEN) Xen call trace:
(XEN)    [<ffff828c8019d2bb>] oos_fixup_remove+0x55/0x71
(XEN)    [<ffff828c8019e330>] shadow_demote+0xb2/0xca
(XEN)    [<ffff828c801bbec6>] sh_destroy_l1_shadow__guest_4+0xe4/0x338
(XEN)    [<ffff828c801a104c>] sh_destroy_shadow+0xfe/0x16f
(XEN)    [<ffff828c801bbdb6>] sh_destroy_l2_shadow__guest_4+0x2df/0x30b
(XEN)    [<ffff828c801a107d>] sh_destroy_shadow+0x12f/0x16f
(XEN)    [<ffff828c801bbaa7>] sh_destroy_l3_shadow__guest_4+0x265/0x295
(XEN)    [<ffff828c801a1084>] sh_destroy_shadow+0x136/0x16f
(XEN)    [<ffff828c801bb816>] sh_destroy_l4_shadow__guest_4+0x2b2/0x2de
(XEN)    [<ffff828c801a108b>] sh_destroy_shadow+0x13d/0x16f
(XEN)    [<ffff828c8019ed8d>] _shadow_prealloc+0x3bb/0x568 
(XEN)    [<ffff828c801a038e>] sh_set_allocation+0x1ec/0x32a
(XEN)    [<ffff828c801a5095>] shadow_teardown+0x2d0/0x465
(XEN)    [<ffff828c8019a03a>] paging_teardown+0x2e/0x3d
(XEN)    [<ffff828c8013fa58>] domain_relinquish_resources+0x51/0x190
(XEN)    [<ffff828c80105597>] domain_kill+0x76/0x171
(XEN)    [<ffff828c80104780>] do_domctl+0x54b/0xc4b
(XEN)    [<ffff828c801c71bf>] syscall_enter+0xef/0x149
(XEN)
(XEN) Pagetable walk from ffff83005d432888:
(XEN)  L4[0x106] = 000000005d67d027 5555555555555555
(XEN)  L3[0x001] = 000000005d67f027 5555555555555555
(XEN)  L2[0x0ea] = 000000007d59f063 5555555555555555
(XEN)  L1[0x032] = 000000005d432262 5555555555555555
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 0:
(XEN) FATAL PAGE FAULT
(XEN) [error_code=0000]
(XEN) Faulting linear address: ffff83005d432888
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds... 

 


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel