thr3ads.net - Xen devel - [Xen-devel] crashes with 2.0 -- "Unable to reduce memory reservation" [Sep 2004]

If this information is useful, please help other people find it:
Share via:

Chris Andrews

2004-Sep-04 14:13 UTC

[Xen-devel] crashes with 2.0 -- "Unable to reduce memory reservation"

I''ve been running 2.6.8.1 DOM0 with 2.0 from 29th August for a few 
days, with so far a single unprivileged 2.6.8.1 domain, but I''ve now 
had this crash -- the xenU domain panicked, and trying to destroy it 
panicked Xen. I''ve also repeated this crash with 2.0 from today.

The unprivileged domain''s console showed:

   Kernel panic: Unable to reduce memory reservation
   In interrupt handler - not syncing

I dropped out of the console, and tried ''xm list'':

munkyII:~# xm list
Name              Id  Mem(MB)  CPU  State  Time(s)  Console
Domain-0           0      379    0  r----   5999.7
XVIII              3       63    0  -----   1500.4    9603
munkyII:~# xm destroy 3

When I ran ''xm destroy 3'', I got the output below on the
serial
console, and then a watchdog reboot but screen seems to have truncated 
the lines. The second crash has untruncated output. I''ve added the 
xensymoops output below.

Any thoughts?


Chris.







Traces from crash with code from 29th August:

(XEN) CPU:    0
(XEN) EIP:    0808:[<fc507265>]
(XEN) EFLAGS: 00013292
(XEN) eax: 00000000   ebx: 252cc063   ecx: fc5ba680   edx: 00000001
(XEN) esi: fd77c320   edi: 000252cc   ebp: 00000003   esp: fc503c08
(XEN) ds: 0810   es: 0810   fs: 0810   gs: 0810   ss: 0810
(XEN) Stack trace from ESP=fc503c08:
(XEN) fc503c40 fc503c58 00000000 252cc063 fd77c320 00000001 000002db 
[fc51b0a3]
(XEN)        00000001 fc5ba680 000252cc 00000003 00000001 fd5625b8 
00000000 000
(XEN)        [fc519d44] ffaa7000 fc5ba680 2c040000 fd4a2000 00000301 
ffaa1000 [
(XEN)        fd4a2000 20000000 fc5ba680 [fc509be2] 00000001 fd6ef7a0 
2c040001 0
(XEN)        fd680810 ffff0810 fc5ba680 fd705148 40000000 fd717040 
fc5ba680 [fc
(XEN)        fd705148 40000000 00000808 fc5ba680 00000000 fc5ba6c8 
40000001 fc5
(XEN)        00000000 00000000 fffffffd [fc505b21] fc5ba680 00000000 
fc5ba680 [
(XEN)        fc5ba680 bfffd330 00000050 00018d57 00000000 00000000 
00000010 000
(XEN)        00001455 00000000 00001455 00000000 ecb4f8af 00018029 
00000000 fc5
(XEN)        fc5be1ac 00000000 ffffffea 00000092 00000001 fc503e61 
00000007 000
(XEN)        fc563d91 00000000 ecb4f8af 00018029 fc5be1ac 00000092 
00000007 fc5
(XEN)        00000096 000c0ac9 00000000 000c0ac9 00000000 bdf46955 
00018c08 [fc
(XEN)        fc5bf124 fc5be1ac 00000000 fc5b99c0 00000096 0002ad1f 
00000000 000
(XEN)        00000096 0003fb96 00000000 0003fb96 00000000 7039706f 
00018cd6 000
(XEN)        fc5bf124 fc5be1ac 00000000 00000096 002730a4 00000000 
002730a4 000
(XEN)        00000092 004882f9 00000000 004882f9 00000096 003eaef9 
00000000 003
(XEN)        00000096 004c54ed [fc518298] fc503e18 fc5b99c0 000617b4 
00000000 f
(XEN)        00000000 fc550ac0 1ea47b39 00010810 [fc519e95] 00000001 
00000001 0
(XEN)        00000480 fc58b1c0 00000012 10ccf005 [fc519c97] 00000012 
00000000 0
(XEN)        fc5b99c0 fc5b99c0 00000000 30000046 fc5b99c0 fc501fc0 
ff9d6fc0 000
(XEN) Call Trace from ESP=fc503c08: [<fc51b0a3>] [<fc519d44>] 
[<fc51ae8c>] [<fc
(XEN)    [<fc504cab>] [<fc519e9f>] [<fc518298>]
[<fc519e95>]
[<fc519c97>] [<fc5
(XEN)    [<fc524bf3>] [<fc520069>]

EIP fc507265 in function fc507250 <gnttab_try_map>
Backtrace:
fc51b0a3 in function fc51ac70 <free_page_type>
fc519d44 in function fc519c50 <do_IRQ>
fc509be2 in function fc509af0 <free_domheap_pages>
fc505b21 in function fc505ae0 <domain_kill>
fc518298 in function fc518293 <call_apic_timer_interrupt>
fc519e95 in function fc519dc0 <__do_IRQ_guest>
fc519c97 in function fc519c50 <do_IRQ>

****************************************
CPU0 FATAL PAGE FAULT
[error_code=00000000]
Faulting linear address might be 00000b65
Aieee! CPU0 is toast...
****************************************

Reboot in five seconds...

(XEN) NMI Watchdog detected LOCKUP on CPU: 0000,0000
(XEN) CPU:    0
(XEN) EIP:    0808:[<fc5153b4>]
(XEN) EFLAGS: 00003097
(XEN) eax: 560df07f   ebx: 00134598   ecx: 5600c63e   edx: 0001f62e
(XEN) esi: fc529779   edi: 00003006   ebp: 00000008   esp: fc503acc
(XEN) ds: 0810   es: 0810   fs: 0810   gs: 0810   ss: 0810
(XEN) Stack trace from ESP=fc503acc:
(XEN) 00000709 [fc5115cd] 000003e8 fc52975e 00000000 fc503b94 30550030 
54414620
(XEN)        50204c41 20454741 4c554146 655b0a54 726f7272 646f635f 
30303d65 303
(XEN)        0a5d3030 6c756146 676e6974 6e696c20 20726165 72646461 
20737365 686
(XEN)        65622074 30303020 36623030 0a000a35 00003017 00000000 
fc52dfdf fc5
(XEN)        fc563d80 00003092 00000008 fc52dfde fc52dfdf fc503b88 
fc52e031 [fc
(XEN)        00003092 fc5b99c0 fc503bcc 00000000 00000000 [fc523153] 
fc52d4c0 0
(XEN)        00000000 00000b65 00000810 00000810 00000000 00000001 
00000810 000
(XEN)        fc503bcc fc5b99c0 00000000 [fc522f60] 00000003 [fc524d90] 
fc503bcc
(XEN)        252cc063 fc5ba680 00000001 fd77c320 000252cc 00000003 
00000000 000
(XEN)        fd700810 fc5b0810 00000810 ffffffff [fc507265] 00000808 
00013292 f
(XEN)        fc503c58 00000000 252cc063 fd77c320 00000001 000002db 
[fc51b0a3] 0
(XEN)        fc5ba680 000252cc 00000003 00000001 fd5625b8 00000000 
00003286 [fc
(XEN)        ffaa7000 fc5ba680 2c040000 fd4a2000 00000301 ffaa1000 
[fc51ae8c] f
(XEN)        20000000 fc5ba680 [fc509be2] 00000001 fd6ef7a0 2c040001 
00020363 f
(XEN)        ffff0810 fc5ba680 fd705148 40000000 fd717040 fc5ba680 
[fc516182] f
(XEN)        40000000 00000808 fc5ba680 00000000 fc5ba6c8 40000001 
fc5ba680 000
(XEN)        00000000 fffffffd [fc505b21] fc5ba680 00000000 fc5ba680 
[fc504cab]
(XEN)        bfffd330 00000050 00018d57 00000000 00000000 00000010 
00000092 000
(XEN)        00000000 00001455 00000000 ecb4f8af 00018029 00000000 
fc5bf124 fc5
(XEN)        00000000 ffffffea 00000092 00000001 fc503e61 00000007 
00000000 fc5
(XEN) Call Trace from ESP=fc503acc: [<fc5115cd>] [<fc520069>] 
[<fc523153>] [<fc
(XEN)    [<fc51b0a3>] [<fc519d44>] [<fc51ae8c>]
[<fc509be2>]
[<fc516182>] [<fc5
(XEN)    [<fc504cab>] [<fc519e9f>] [<fc518298>]
[<fc519e95>]
[<fc519c97>] [<fc5
(XEN)    [<fc524bf3>] [<fc520069>]

EIP fc5153b4 in function fc515390 <__udelay>
Backtrace:
fc5115cd in function fc510fd0 <panic>
fc523153 in function fc522f60 <do_page_fault>
fc522f60 in function fc522f60 <do_page_fault>
fc524d90 in function fc524d50 <error_code>
fc507265 in function fc507250 <gnttab_try_map>
fc51b0a3 in function fc51ac70 <free_page_type>
fc51ae8c in function fc51ac70 <free_page_type>
fc509be2 in function fc509af0 <free_domheap_pages>
fc516182 in function fc515f20 <domain_relinquish_memory>
fc505b21 in function fc505ae0 <domain_kill>
fc504cab in function fc504910 <do_dom0_op>

****************************************
Fatal crash within Xen.
Aieee! CPU0 is toast...
****************************************

Reboot in five seconds...

[machine rebooted]

Trace from crash with code from 4th September:

(XEN) CPU:    0
(XEN) EIP:    0808:[<fc507265>]
(XEN) EFLAGS: 00013292
(XEN) eax: 00000000   ebx: 1b2bb063   ecx: fc5ba680   edx: 00000001
(XEN) esi: fd68c188   edi: 0001b2bb   ebp: 00000003   esp: fc503c08
(XEN) ds: 0810   es: 0810   fs: 0810   gs: 0810   ss: 0810
(XEN) Stack trace from ESP=fc503c08:
(XEN) 00000000 00000000 00000000 1b2bb063 fd68c188 00000001 000003b0 
[fc51b0a3]
(XEN)        00000001 fc5ba680 0001b2bb 00000003 00000001 fd670e88 
00000000 00003286
(XEN)        00000440 ffa71000 fc5ba680 2c140000 fd670e70 00000305 
ffa68000 [fc51ae8c]
(XEN)        fd670e70 20000000 fc5ba680 [fc509be2] 00000001 fd6a3c78 
2c140001 0001b83f
(XEN)        fd9ffe20 ffffffff fc5ba680 fd6945e8 40000000 fd68bc18 
fc5ba680 [fc516182]
(XEN)        fd6945e8 40000000 00000810 fc5ba680 406f1fbc fc5ba6c8 
40000001 fc5ba680
(XEN)        406f1fbc 401d26a0 fffffffd [fc505b21] fc5ba680 406f1fbc 
fc5ba680 [fc504cab]
(XEN)        fc5ba680 bfffd330 00000050 00000efa 00000000 fc503e27 
0000000c 00000000
(XEN)        fc563d90 fc5ba6c8 0000000c 00000000 fc563d90 [fc5092bd] 
0000000c 00000000
(XEN)        00004000 00004000 ffffffea 0001e6f0 00000000 [fc510784] 
0000000c 00000000
(XEN)        00000010 00000000 00000010 fc5b99c0 00000096 00000000 
00000000 00000000
(XEN)        00000096 0045fe66 00000000 0045fe66 00000000 83df4815 
00000e5b fc503d9c
(XEN)        00000092 00036fb6 00000000 00036fb6 00000000 c99d7185 
00000092 00472ef4
(XEN)        00000096 00183ea9 00000000 00183ea9 00000000 a90902b6 
00000ebe fc5be1ac
(XEN)        fc5bf124 fc5be1ac 00000000 fc5b99c0 00000092 00000001 
00000000 0049aac0
(XEN)        [fc519e95] 00000001 00000000 00000001 00000480 fc58b1c0 
00000012 fc5b99c0
(XEN)        [fc519d44] 00000000 00000000 fc503e2c 00000000 fc5b99c0 
00000165 00000000
(XEN)        [fc5174d0] 00000000 fd400000 fd400000 fc5b99c0 00000165 
00000000 ffae3000
(XEN)        00010810 00000810 00010810 00000810 00000000 [fc519e95] 
00000001 00003286
(XEN)        00000001 00000440 00000000 30000032 fc5b99c0 fc501fc0 
ff9dafc0 00003286
(XEN) Call Trace from ESP=fc503c08: [<fc51b0a3>] [<fc51ae8c>] 
[<fc509be2>] [<fc516182>] [<fc505b21>] [<fc504cab>]
(XEN)    [<fc5092bd>] [<fc510784>] [<fc519e95>]
[<fc519d44>]
[<fc5174d0>] [<fc519e95>]
(XEN)    [<fc519c97>] [<fc51db4c>] [<fc51d51f>]
[<fc524bf3>]

EIP fc507265 in function fc507250 <gnttab_try_map>
Backtrace:
fc51b0a3 in function fc51ac70 <free_page_type>
fc51ae8c in function fc51ac70 <free_page_type>
fc509be2 in function fc509af0 <free_domheap_pages>
fc516182 in function fc515f20 <domain_relinquish_memory>
fc505b21 in function fc505ae0 <domain_kill>
fc504cab in function fc504910 <do_dom0_op>
fc5092bd in function fc509290 <__udivdi3>
fc510784 in function fc510420 <number>
fc519d44 in function fc519c50 <do_IRQ>
fc5174d0 in function fc5174cb <call_do_IRQ>
fc519e95 in function fc519dc0 <__do_IRQ_guest>



-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xen-devel

Keir Fraser

2004-Sep-04 15:56 UTC

head link

Re: [Xen-devel] crashes with 2.0 -- "Unable to reduce memory reservation"

> When I ran ''xm destroy 3'', I got the output below on the
serial
> console, and then a watchdog reboot but screen seems to have truncated 
> the lines. The second crash has untruncated output. I''ve added the
> xensymoops output below.
> 
> Any thoughts?
Yes, I think we''ve seen this crash ourselves. The page reference
counts are getting corrupted, so the page has been freed already, and
when free_page_type() looks for the domain pointer in the struct
pfn_info, it has already been overwritten with a CPU mask (that field
changes purpose when a page is freed).

So, type count and usage count are out of sync....

The most likely culprit is the writable page tables, but as you''ve
noticed the bug is hard to trigger so it''s difficult to try various
configurations and be sure which are safe!

 -- Keir


-------------------------------------------------------
This SF.Net email is sponsored by BEA Weblogic Workshop
FREE Java Enterprise J2EE developer tools!
Get your free copy of BEA WebLogic Workshop 8.1 today.
http://ads.osdn.com/?ad_id=5047&alloc_id=10808&op=click
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/xen-devel

Xen devel - Sep 2004 - crashes with 2.0 -- "Unable to reduce memory reservation"

[Xen-devel] crashes with 2.0 -- "Unable to reduce memory reservation"

Re: [Xen-devel] crashes with 2.0 -- "Unable to reduce memory reservation"