http://bugzilla.novell.com/show_bug.cgi?id=561410 http://bugzilla.novell.com/show_bug.cgi?id=561410#c0 Summary: Xen hypervisor crashes when booting HVM domU when memory != maxmem Classification: openSUSE Product: openSUSE 11.2 Version: Final Platform: x86 OS/Version: openSUSE 11.2 Status: NEW Severity: Major Priority: P5 - None Component: Xen AssignedTo: jdouglas@novell.com ReportedBy: jeromepoulin@gmail.com QAContact: qa@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.4) Gecko/20091107 Gentoo Firefox/3.5.4 I booted a Xen HVM domU with the following configuration with the SystemRescueCD (sysresccd.org) and it crashed at the end of the boot: name="testAcronis" uuid="ac02bf2a-307e-a93a-d8c9-f90e962f2c3c" memory=512 maxmem=512 vcpus=2 on_poweroff="destroy" on_reboot="destroy" on_crash="destroy" localtime=1 keymap="en-us" builder="hvm" extid=0 device_model="/usr/lib/xen/bin/qemu-dm" kernel="/usr/lib/xen/boot/hvmloader" boot="d" disk=[ 'phy:/dev/sr0,hdc:cdrom,r', 'phy:/dev/vgXen/testAcronis,hda,w', ] vif=[ 'mac=00:16:3e:38:eb:74,bridge=br0,model=rtl8139', ] Reproducible: Always Steps to Reproduce: 1. Boot dom0 2. Insert SystemRescueCD and boot domU 3. Wait for the prompt in domU and look at dom0 crash. Actual Results: jerome@MobileCPU ~ % telnet localhost 2002 Trying 127.0.0.1... Connected to localhost. Escape character is '^]'. (XEN) Xen BUG at domain_page.c:102 (XEN) ----[ Xen-3.4.1_19718_04-2.1 x86_32p debug=n Not tainted ]---- (XEN) CPU: 3 (XEN) EIP: e008:[<ff1b1a3a>] map_domain_page+0x1ca/0x240 (XEN) EFLAGS: 00210012 CONTEXT: hypervisor (XEN) eax: 00000400 ebx: ff272000 ecx: 00000000 edx: 00000400 (XEN) esi: ffbdc000 edi: 00073b7d ebp: ff27238c esp: ff27fafc (XEN) cr0: 8005003b cr4: 000026f0 cr3: 4bcd0000 cr2: b7bcc014 (XEN) ds: e010 es: e010 fs: 00d8 gs: 00e0 ss: e010 cs: e008 (XEN) Xen stack trace from esp=ff27fafc: (XEN) ff272398 00000400 0000011b ffbe2000 00073b7c ff272398 00200283 ffbdc000 (XEN) ff174715 ff27fb4c 000dd1fa ffbd4000 73b7d001 1ce54000 00000000 ff199e01 (XEN) 00073b7d ff272000 00200202 ff1b1938 ff27238c 00200202 00073b7d 00000000 (XEN) 00073b7d 00000000 00200202 ffbdc000 00fc0000 ff10ae54 0000e008 0000000f (XEN) ff27fbf0 ffbd4000 ff27fcd4 ff1986c1 ffbd4000 0001ce54 ff27fc2c 00000000 (XEN) 00000004 fed05000 fedb8000 fee10000 fef13000 fefa3000 fed11000 fedf8000 (XEN) fef72000 fecba000 fee98000 fecae000 feed4000 fedf2000 fef84000 fed1a000 (XEN) 00000000 ffbd4300 00000010 fed3706a ff1ee000 00000001 00000001 00000001 (XEN) 00000001 00000001 00000001 00000001 00000001 00000001 00000001 00000001 (XEN) 00000001 00000001 00000001 00000001 00000004 00000000 00000000 ff272000 (XEN) ffbdc000 00012673 00012672 00012671 00012670 0001266f 0001266b 00012668 (XEN) 00012666 0001265d 0001265b 0001265a 00012659 00012657 00012656 00012655 (XEN) fefa32a0 12654267 00000000 ff199fb6 fefa32a0 00000000 000008da 00000003 (XEN) 00000001 00000002 ff27ffb4 ff27fba0 ff27fd48 ffbd4000 ff27fc40 00000010 (XEN) 01370000 ff27fbfc ff17c236 ff1e1e70 ffbd4000 0001ce54 ff27ffb4 ff199833 (XEN) ffbd4000 0001ce54 ff27fd88 00000000 1378d267 00000000 00000001 7367a000 (XEN) 00000000 00000001 00000067 0000000f 00000000 0001db81 ff1e1e70 00000000 (XEN) 00015ada 000118d8 000739d8 00000267 ff1f6000 00fc0000 ff27fe1c ff1f6000 (XEN) 000000ec ff1f6000 0c930068 0001ce73 0001ce72 0001ce71 0001ce70 0001ce6f (XEN) 0001ce6b 0001ce68 0001ce66 0001ce5d 0001ce5b 0001ce5a 0001ce59 0001ce57 (XEN) Xen call trace: (XEN) [<ff1b1a3a>] map_domain_page+0x1ca/0x240 (XEN) [<ff174715>] hvmemul_read_io+0x55/0x60 (XEN) [<ff199e01>] p2m_gfn_to_mfn+0xe1/0x2d0 (XEN) [<ff1b1938>] map_domain_page+0xc8/0x240 (XEN) [<ff10ae54>] do_xen_version+0x84/0x4a0 (XEN) [<ff1986c1>] p2m_pod_zero_check+0x2d1/0x2e0 (XEN) [<ff1ee000>] setup_IO_APIC+0x1c0/0xfc0 (XEN) [<ff199fb6>] p2m_gfn_to_mfn+0x296/0x2d0 (XEN) [<ff17c236>] handle_mmio+0x76/0x190 (XEN) [<ff1e1e70>] e820map+0x630/0xa00 (XEN) [<ff199833>] p2m_pod_demand_populate+0x6c3/0x950 (XEN) [<ff1e1e70>] e820map+0x630/0xa00 (XEN) [<ff1f6000>] bzimage_parse+0x9d0/0xc70 (XEN) [<ff1f6000>] bzimage_parse+0x9d0/0xc70 (XEN) [<ff1f6000>] bzimage_parse+0x9d0/0xc70 (XEN) [<ff199f97>] p2m_gfn_to_mfn+0x277/0x2d0 (XEN) [<ff14dea7>] smp_send_event_check_mask+0x37/0x40 (XEN) [<ff1483d2>] mod_l1_entry+0x682/0x730 (XEN) [<ff142393>] get_page+0x23/0xd0 (XEN) [<ff105cd4>] evtchn_set_pending+0x84/0x100 (XEN) [<ff13e340>] set_eoi_ready+0x0/0x40 (XEN) [<ff148fff>] do_mmu_update+0x63f/0x17f0 (XEN) [<ff14df74>] flush_area_mask+0xc4/0xe0 (XEN) [<ff145e1a>] process_deferred_ops+0x5a/0xb0 (XEN) [<ff145fad>] do_mmuext_op+0x13d/0xfd0 (XEN) [<ff138e17>] event_check_interrupt+0x57/0x60 (XEN) [<ff1b1b84>] hypercall+0x94/0x9b (XEN) (XEN) (XEN) **************************************** (XEN) Panic on CPU 3: (XEN) Xen BUG at domain_page.c:102 (XEN) **************************************** (XEN) (XEN) Reboot in five seconds... (XEN) Resetting with ACPI MEMORY or I/O RESET_REG. I'd say this can even be a security issue, an hypervisor should *never* crash, it makes it unusable. -- Configure bugmail: http://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.