Can someone shed some light on what just happened here, and if this is a known/already fixed issue? (XEN) Pagetable walk from 00000000c13a7f30: (XEN) L4[0x000] = 0000000395f1b027 0000000000015dc6 (XEN) ----[ Xen-3.2.0 x86_64 debug=y Not tainted ]---- (XEN) CPU: 7 (XEN) RIP: e008:[<ffff828c801b3506>] show_page_walk+0xd1/0x1dc (XEN) RFLAGS: 0000000000010206 CONTEXT: hypervisor (XEN) rax: 000a5d855a211000 rbx: 702a5d855a2119d4 rcx: ffff830000000000 (XEN) rdx: 000000000000000a rsi: 0000000000000003 rdi: ffff828c8024dc8f (XEN) rbp: ffff8300ceeeff10 rsp: ffff8300ceeefee0 r8: 0000000000000004 (XEN) r9: 0000000000000004 r10: ffff8300ceeefce5 r11: 0000000000000010 (XEN) r12: 000000a5d855a211 r13: 00000000c13a7f30 r14: ffff828000000000 (XEN) r15: 000ffffffffff000 cr0: 000000008005003b cr4: 00000000000026b0 (XEN) cr3: 00000003a3ceb000 cr2: ffff87aec2ad1088 (XEN) ds: 007b es: 007b fs: 0000 gs: 0000 ss: 0000 cs: e008 (XEN) Xen stack trace from rsp=ffff8300ceeefee0: (XEN) 00000000c13a7f2c ffff8300cf36c100 0000000000000000 0000000000000000 (XEN) 0000000000000000 0000000000000000 00007cff311100b7 ffff828c801bc03c (XEN) ffff828c801bbe5f 0000000000000000 0000000000000000 0000000000000000 (XEN) 0000000000000000 00000000c13a7fac 00000000deadbeef 0000000000000000 (XEN) 0000000000000000 0000000000000000 0000000000000000 0000000000000000 (XEN) 00000000deadbeef 00000000deadbeef 00000000deadbeef 00000000c1390ab0 (XEN) 0000000e00000010 00000000c0101347 0000000000000061 0000000000010246 (XEN) 00000000c13a7f38 0000000000000069 5555555555555555 5555555555555555 (XEN) 5555555555555555 5555555555555555 5555555500000007 ffff8300cf36c100 (XEN) Xen call trace: (XEN) [<ffff828c801b3506>] show_page_walk+0xd1/0x1dc (XEN) [<ffff828c801bc03c>] compat_crash_page_fault+0x9/0xbe1 (XEN) (XEN) Pagetable walk from ffff87aec2ad1088: (XEN) L4[0x10f] = 0000000000000000 ffffffffffffffff (XEN) (XEN) **************************************** (XEN) Panic on CPU 7: (XEN) FATAL PAGE FAULT (XEN) [error_code=0000] (XEN) Faulting linear address: ffff87aec2ad1088 (XEN) **************************************** Thanks, -Chris _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel
On 4/3/08 21:11, "Christopher S. Aker" <caker@theshore.net> wrote:> Can someone shed some light on what just happened here, and if this is a > known/already fixed issue? > > (XEN) Pagetable walk from 00000000c13a7f30: > (XEN) L4[0x000] = 0000000395f1b027 0000000000015dc6Crashed while returning to compat-mode guest. Probably was trying to push an exception or interrupt frame onto the compat guest''s kernel stack at the time. The faulting guest address was c13a7f30.> (XEN) ----[ Xen-3.2.0 x86_64 debug=y Not tainted ]---- > (XEN) CPU: 7 > (XEN) RIP: e008:[<ffff828c801b3506>] show_page_walk+0xd1/0x1dcThen the show_page_walk() diagnostic function itself crashes. It had just printed out the L4 entry, so was probably reading the L3 entry...> (XEN) **************************************** > (XEN) Panic on CPU 7: > (XEN) FATAL PAGE FAULT > (XEN) [error_code=0000] > (XEN) Faulting linear address: ffff87aec2ad1088 > (XEN) ****************************************...except that the faulting linear address is unexpected. The L4 entry of the original pagetable walk was 0000000395f1b027, hence the physical address of the L3 entry should be somewhere around 395f1b000, which should have a virtual address (in Xen''s mapping of all physical memory) of ffff830395f1b000. The actual faulting linear address is literally in the middle of nowhere: it''s an unused virtual address. How much memory does this machine have? Do you have the xen-syms file associated with this crash dump? It may shed some light. Mail it to me privately or stick it somewhere for download if possible. -- Keir _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel
Thanks for the explanation -- interesting stuff :)> How much memory does this machine have?total_memory : 24574> Do you have the xen-syms file associated with this crash dump?> It may shed some light. Mail it to me privately or stick it > somewhere for download if possible. http://www.linode.com/~caker/xen/BUGshow_page_walk/ Thanks, -Chris _______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel
Thanks, This host crash is fixed (in xen-unstable, and I will backport to 3.2 branch) -- we are doing a mfn-to-pfn translation lookup on an unvalidated mfn. In fact the ''mfn'' is not a frame number at all. It''s (legitimately) garbage; probably a Linux swap_pte. Of course this doesn''t explain why your guest crashed in the first place, apart from the obvuous that it dereferenced a not-present page, but at least in 3.2.1 it will be just a guest crash. Not a host crash! -- Keir On 5/3/08 04:32, "Christopher S. Aker" <caker@theshore.net> wrote:> Thanks for the explanation -- interesting stuff :) > >> How much memory does this machine have? > > total_memory : 24574 > >> Do you have the xen-syms file associated with this crash dump? >> It may shed some light. Mail it to me privately or stick it >> somewhere for download if possible. > > http://www.linode.com/~caker/xen/BUGshow_page_walk/ > > Thanks, > -Chris_______________________________________________ Xen-devel mailing list Xen-devel@lists.xensource.com http://lists.xensource.com/xen-devel