Xen devel - Mar 2006 - Assertion ''! IS_INVALID_M2P_ENTRY(gpfn)'' failed kills machine

I''ve triggered this a few times now, so time to report.  Unfortuantely,
I
don''t have a good recipe for reproducing this one, and this is a
reasonably
hacked up branch of (domU) XenLinux.  So, while I can''t discount bugs
in this domU, a domU bug shouldn''t crash Xen like this:

(I belive this one was from simply typing halt in domU)

(XEN) Assertion ''! IS_INVALID_M2P_ENTRY(gpfn)'' failed, line
395, file shadow32.c(XEN) BUG at shadow32.c:395
(XEN) ----[ Xen-3.0-unstable    Not tainted ]----
(XEN) CPU:    0
(XEN) EIP:    e008:[<ff14ad8d>] free_shadow_page+0xd5/0x2ef
(XEN) EFLAGS: 00010282   CONTEXT: hypervisor
(XEN) eax: ff1a9818   ebx: ffffffff   ecx: 00002a03   edx: 00002a03
(XEN) esi: 00000007   edi: ff1bdfac   ebp: ff1bdb6c   esp: ff1bdb24
(XEN) cr0: 80050033   cr3: 7a93e000
(XEN) ds: e010   es: e010   fs: 0000   gs: 0033   ss: e010   cs: e008
(XEN) Xen stack trace from esp=ff1bdb24:
(XEN)    ff19d28d ff19d23c 0000018b ff19d23c ff1bdfb4 ff1bdba8 00000082 40000000
(XEN)    ffffffff ff1bdfb4 ff1bdb6c ff11ea04 fca88308 00047535 ffbd0080 ffffffff
(XEN)    40000000 ffbd6080 ff1bdb9c ff14b380 00045acb 00000180 00000180 00000297
(XEN)    ff1a7308 ff27bf00 0b18a1d1 0027e063 00000001 00000000 ff1bdbbc ff14bc56
(XEN)    00045acb 00000004 ff27a700 ff27be80 ff27cc80 ff27bf00 ff1bdc1c ff14c484
(XEN)    00045acb 00000004 00000001 00000000 a0000000 a0000000 ff1bdbfc ff1112af
(XEN)    fc403bd0 fc403b40 00000000 00000001 00003bd0 00000058 00000000 00000000
(XEN)    ff1a7230 ff1c4ea8 ff1bdc2c 00000000 ff27bf00 00001000 ff1bdc4c ff14f52e
(XEN)    ffbd0080 a0000005 ff1bdc5c 00000286 a0000004 a0000005 a0000005 a0000005
(XEN)    00000020 ff1bdfb4 ff1bdc7c ff12ab9a ffbd0080 00000286 ff1bdc7c ff13d052
(XEN)    ff27e000 00000004 a0000004 a0000005 fca7acd8 00000000 ff1bdcac ff12aac3
(XEN)    ffbd0080 00000020 ff1bdcac ffbd2c00 ffbc7ffc ffbd0318 00000400 00000000
(XEN)    00000000 00000000 ff1bdccc ff105317 ffbd0080 ffbd0318 00000004 00000003
(XEN)    ffbd0080 00000000 ff1bdf8c ff1039df ffbd0080 ff1bddc8 00000000 00000001
(XEN)    00000002 00000003 00000002 00000000 ffbe851c ff1bdfb4 ff1bdd2c ff180266
(XEN)    0000001f 04c4b400 ff1bdd3c 00000004 00b29a64 00000000 ff1bdd7c 00000001
(XEN)    00000000 ffffffff ff1bdd4c 00000000 00000004 ffffffff ff1bdd4c ff13f0f4
(XEN)    ff1bdd74 00000020 ff1bdd6c ff13f08f ff1bdd74 00000020 ff1bdd6c ff13ef5e
(XEN)    00000300 ff219f98 ff1bdd8c 00000046 00000300 000008fc ff1bdd9c 00000004
(XEN)    ff1bdfb4 ff1bddb8 b0000002 ff15c32c b0000002 b0000001 b0000002 b0000002
(XEN) Xen call trace:
(XEN)    [<ff14ad8d>] free_shadow_page+0xd5/0x2ef
(XEN)    [<ff14b380>] put_shadow_ref+0x12c/0x12e
(XEN)    [<ff14bc56>] shadow_unpin+0xb2/0xb4
(XEN)    [<ff14c484>] free_shadow_pages+0x3b9/0x43f
(XEN)    [<ff14f52e>] __shadow_mode_disable+0x2a/0x11c
(XEN)    [<ff12ab9a>] shadow_mode_disable+0x83/0x134
(XEN)    [<ff12aac3>] domain_relinquish_resources+0x188/0x1dc
(XEN)    [<ff105317>] domain_kill+0x6b/0xa7
(XEN)    [<ff1039df>] do_dom0_op+0x8d9/0x19d4
(XEN)    [<ff180ac7>] hypercall+0x97/0xb7
(XEN)
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 0:
(XEN) CPU0 FATAL TRAP: vector = 6 (invalid opcode)
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds...


_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel