RE: [Xen-devel] Xen crashing

["Bonnell, David" <David_Bonnell@xxxxxxx>]

I finally managed to hook up a serial console as suggested by Ian and
the two crashes I have been seeing (unstable, changeset 6651) appear to
be separate issues.  Using restoretextmode (from svgalib) in dom0 causes
the following crash:

(XEN) (file=/xen/xen-unstable/xen/include/asm/mm.h, line=201) Error pfn
a5f9: rd=ffbfa900, od=00000000, caf=00000000, taf=00000000
(XEN) (file=/xen/xen-unstable/xen/include/asm/mm.h, line=201) Error pfn
a5f9: rd=ffbfa900, od=00000000, caf=00000000, taf=00000000
(XEN) DOM0: (file=mm.c, line=2935) ptwr: Could not re-validate l1 page
(XEN) Domain 0 (vcpu#0) crashed on cpu#0:
(XEN) CPU:    0
(XEN) EIP:    0061:[<c015e577>]
(XEN) EFLAGS: 00000246   CONTEXT: guest
(XEN) eax: 0000000e   ebx: b37e3000   ecx: fe27003f   edx: 00000000
(XEN) esi: 00000000   edi: fe27003f   ebp: b37e3000   esp: c350fe78
(XEN) cr0: 8005003b   cr3: 032ec000
(XEN) ds: 007b   es: 007b   fs: 0000   gs: 0033   ss: 0069   cs: 0061
(XEN) Guest stack trace from esp=c350fe78:
(XEN)    00000034 00000001 006d3000 c1104480 c2eb1f8c 01e00040 b37e1000
c36ecb34 
(XEN)    b3800000 b77e1000 c015e69a c64e3cbc c36ecb34 b37e1000 b3800000
000f0002 
(XEN)    0000003f c64e3cfc c64e3cbc b77e0fff 0003c81f c13d65a0 c30e043c
ffffffea 
(XEN)    04000000 c02ddf03 c2c65d50 b37e1000 000f0000 04000000 0000003f
c020131d 
(XEN)    c13d6538 c2c65d50 00000001 00000000 c01b74f7 c13d65a0 c13ceec4
c2c65d50 
(XEN)    c0422d00 c016216e c30e043c c2c65d50 c350ff74 c350ff70 c350ff6c
00000002 
(XEN)    c3b60020 00000004 c3a7b768 c64e3cbc 001000fb 00000000 00000001
00000000 
(XEN)    c3a7b768 c2c65d50 b37e1000 00004000 00000003 c3110598 c31105a4
c2c65a94 
(XEN)    c64e3cbc c64e3ce8 c350e000 c30e043c c0115cc4 c30e043c 00000000
04000000 
(XEN)    00000003 00000001 00000000 00000001 00000000 00000001 00000006
c350e000 
(XEN)    c0109f19 00000000 04000000 00000003 00000001 00000006 00000000
ffffffda 
(XEN)    0000007b c010007b 000000c0 fbffd402 00000073 00000246 bfefcdc8
0000007b 
(XEN)    5a5a5a5a a55a5a5a 
(XEN) Domain 0 shutdown: rebooting machine.

The second crash is triggered it seems by network I/O from a guest
domain as indicated by the DMA error below from the NIC:

Fatal DMA error! Please use 'swiotlb=force'
kernel BUG at arch/xen/i386/kernel/pci-dma.c:270 (dma_map_single)!
 [<c010eb36>] dma_map_single+0xf6/0x160
 [<c8d7c618>] e100_xmit_prepare+0x88/0xc0 [e100]
 [<c8d7c2cf>] e100_xmit_frame+0x8f/0x350 [e100]
 [<c02fe320>] qdisc_restart+0x100/0x2f0
 [<c02ec02f>] dev_queue_xmit+0x9f/0x340
 [<c8ef1de2>] br_dev_queue_push_xmit+0x72/0x160 [bridge]
 [<c8ef83bc>] br_nf_post_routing+0x12c/0x210 [bridge]
 [<c8ef1d70>] br_dev_queue_push_xmit+0x0/0x160 [bridge]
 [<c8ef1d70>] br_dev_queue_push_xmit+0x0/0x160 [bridge]
 [<c02f800b>] nf_iterate+0x6b/0xa0
 [<c8ef1d70>] br_dev_queue_push_xmit+0x0/0x160 [bridge]
 [<c8ef1d70>] br_dev_queue_push_xmit+0x0/0x160 [bridge]
 [<c02f83b4>] nf_hook_slow+0x64/0x110
 [<c8ef1d70>] br_dev_queue_push_xmit+0x0/0x160 [bridge]
 [<c8ef1ed0>] br_forward_finish+0x0/0x70 [bridge]
 [<c8ef1f1f>] br_forward_finish+0x4f/0x70 [bridge]
 [<c8ef1d70>] br_dev_queue_push_xmit+0x0/0x160 [bridge]
 [<c8ef7abc>] br_nf_forward_finish+0x9c/0x130 [bridge]
 [<c8ef1ed0>] br_forward_finish+0x0/0x70 [bridge]
 [<c8ef7c34>] br_nf_forward_ip+0xe4/0x1a0 [bridge]
 [<c8ef7a20>] br_nf_forward_finish+0x0/0x130 [bridge]
 [<c02f800b>] nf_iterate+0x6b/0xa0
 [<c8ef1ed0>] br_forward_finish+0x0/0x70 [bridge]
 [<c8ef1ed0>] br_forward_finish+0x0/0x70 [bridge]
 [<c02f83b4>] nf_hook_slow+0x64/0x110
 [<c8ef1ed0>] br_forward_finish+0x0/0x70 [bridge]
 [<c8ef2026>] __br_forward+0x66/0x80 [bridge]
 [<c8ef1ed0>] br_forward_finish+0x0/0x70 [bridge]
 [<c8ef2de3>] br_handle_frame_finish+0x133/0x180 [bridge]
 [<c8ef6fbc>] br_nf_pre_routing_finish+0x1cc/0x3a0 [bridge]
 [<c8ef2cb0>] br_handle_frame_finish+0x0/0x180 [bridge]
 [<c8ef6df0>] br_nf_pre_routing_finish+0x0/0x3a0 [bridge]
 [<c8ef6df0>] br_nf_pre_routing_finish+0x0/0x3a0 [bridge]
 [<c02f83b4>] nf_hook_slow+0x64/0x110
 [<c8ef6df0>] br_nf_pre_routing_finish+0x0/0x3a0 [bridge]
 [<c8ef6df0>] br_nf_pre_routing_finish+0x0/0x3a0 [bridge]
 [<c8ef2cb0>] br_handle_frame_finish+0x0/0x180 [bridge]
 [<c8ef7893>] br_nf_pre_routing+0x393/0x4b0 [bridge]
 [<c8ef6df0>] br_nf_pre_routing_finish+0x0/0x3a0 [bridge]
 [<c02f800b>] nf_iterate+0x6b/0xa0
 [<c8ef2cb0>] br_handle_frame_finish+0x0/0x180 [bridge]
 [<c8ef2cb0>] br_handle_frame_finish+0x0/0x180 [bridge]
 [<c02f83b4>] nf_hook_slow+0x64/0x110
 [<c8ef2cb0>] br_handle_frame_finish+0x0/0x180 [bridge]
 [<c8ef2f7c>] br_handle_frame+0x14c/0x250 [bridge]
 [<c8ef2cb0>] br_handle_frame_finish+0x0/0x180 [bridge]
 [<c8ef2cb0>] br_handle_frame_finish+0x0/0x180 [bridge]
 [<c02eca5b>] netif_receive_skb+0x19b/0x310
 [<c02ecc96>] process_backlog+0xc6/0x1b0
 [<c02ece5c>] net_rx_action+0xdc/0x220
 [<c012924a>] __do_softirq+0x8a/0x120
 [<c012935d>] do_softirq+0x7d/0x80
 [<c01293e5>] local_bh_enable+0x85/0x90
 [<c02ec14b>] dev_queue_xmit+0x1bb/0x340
 [<c030fd8c>] ip_finish_output+0x15c/0x2e0
 [<c030ff10>] ip_finish_output2+0x0/0x250
 [<c0310687>] ip_queue_xmit+0x2b7/0x560
 [<c030fc00>] dst_output+0x0/0x30
 [<c030fc00>] dst_output+0x0/0x30
 [<c0154c36>] check_poison_obj+0x26/0x1c0
 [<c0154a22>] poison_obj+0x32/0x60
 [<c01542c8>] dbg_redzone1+0x18/0x60
 [<c0156b6c>] cache_alloc_debugcheck_after+0x4c/0x1b0
 [<c0322bd4>] tcp_transmit_skb+0x3d4/0x810
 [<c02e5b30>] skb_clone+0x20/0x1d0
 [<c0323c4d>] tcp_write_xmit+0x10d/0x330
 [<c01f70b0>] copy_from_user+0x60/0xf0
 [<c0316c51>] tcp_sendmsg+0xcb1/0x10d0
 [<c02e4de2>] sock_common_recvmsg+0x52/0x70
 [<c02e071a>] sock_sendmsg+0x12a/0x170
 [<c0359d7b>] schedule+0x3db/0xcb0
 [<c0359da9>] schedule+0x409/0xcb0
 [<c013b030>] autoremove_wake_function+0x0/0x60
 [<c01719c9>] fget+0x49/0x60
 [<c01719c9>] fget+0x49/0x60
 [<c02e20c1>] sys_sendto+0x121/0x160
 [<c01512cc>] __alloc_pages+0xdc/0x490
 [<c013ae0d>] add_wait_queue+0x1d/0x50
 [<c0314d46>] tcp_poll+0x166/0x1e0
 [<c0154a22>] poison_obj+0x32/0x60
 [<c01542c8>] dbg_redzone1+0x18/0x60
 [<c0149e61>] audit_syscall_entry+0x181/0x200
 [<c02e2133>] sys_send+0x33/0x40
 [<c02e2bdd>] sys_socketcall+0x14d/0x280
 [<c0109f19>] syscall_call+0x7/0xb
Kernel panic - not syncing: BUG!
 smp_send_stop disable_local_APIC
(XEN) Domain 0 shutdown: rebooting machine.

I rebooted Xen with the "swiotlb=force" option as recommended in the
console output but the same crash still occurs.


-Dave

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel