[Xen-bugs] [Bug 1244] New: Destroying HVM guest causes HV crash

[bugzilla-daemon@xxxxxxxxxxxxxxxxxxx]

http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1244

           Summary: Destroying HVM guest causes HV crash
           Product: Xen
           Version: unstable
          Platform: x86-64
        OS/Version: All
            Status: NEW
          Severity: critical
          Priority: P1
         Component: Hypervisor
        AssignedTo: xen-bugs@xxxxxxxxxxxxxxxxxxx
        ReportedBy: haicheng.li@xxxxxxxxx


Environment:
------------
Service OS (ia32/ia32e/IA64): ia32e
Guest OS (ia32/ia32e/IA64): ia32e
Change Set: 17565



Bug detailed description:
--------------------------
Destroying HVM guest causes HV crash, call trace printed to serial port as:

(XEN) ----[ Xen-3.3-unstable  x86_64  debug=n  Not tainted ]----
(XEN) CPU:    0
(XEN) RIP:    e008:[<ffff828c801100e3>] free_heap_pages+0x173/0x230
(XEN) RFLAGS: 0000000000010246   CONTEXT: hypervisor
(XEN) rax: 0000000000200200   rbx: 0000000000000001   rcx: 0000000000000002
(XEN) rdx: 0000000000100100   rsi: ffff828405549250   rdi: 0000000000000015
(XEN) rbp: 0000000000000000   rsp: ffff828c8020fdb8   r8:  ffff8300cf052000
(XEN) r9:  cccccccccccccccd   r10: 0000000000000001   r11: 0000000000000000
(XEN) r12: ffff828405549250   r13: cccccccccccccccd   r14: 0000000000000000
(XEN) r15: 0000000000000015   cr0: 000000008005003b   cr4: 00000000000026b0
(XEN) cr3: 00000000cf014000   cr2: 0000000000100108
(XEN) ds: 002b   es: 002b   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff828c8020fdb8:
(XEN)    ffff830221d43000 0000000000000000 0000000000000100 0000000221d43000
(XEN)    0000000000000004 0000000000000080 ffff828c801235a9 ffff8300cefe0000
(XEN)    ffff8300cf0a2080 0000ffffffffffff 00000027801c3fb0 ffff8300cf0a2f28
(XEN)    ffff8300ceffd280 0000000480110053 0000ffffffffffff 0000000000000000
(XEN)    ffff8300cf0a2080 00000000ffffffff ffff8300cf0a2080 ffff828c80225780
(XEN)    ffff828c801e3100 0000000001c9c380 ffff828c80124f81 ffff8300cf0a2080
(XEN)    ffff828c8012fe71 000000000000001f ffff828c80104fc5 0000000000000000
(XEN)    ffff828c801e3220 0000000000000001 ffff828c8011a4a3 0000000000000000
(XEN)    ffff828c8020ff28 ffff828c80226780 ffff828c801160a0 000000000000e008
(XEN)    ffff828c8020ff28 ffff828c801c4d20 ffff828c801e3534 ffff828c80225780
(XEN)    ffff828c8012fc59 ffff8300cf0ae080 0000000000000000 ffff8300cee02080
(XEN)    ffff8300cf0ae080 00000032d18001c0 0000000000000000 0000000000000000
(XEN)    0000000000000000 0000000000000000 0000000000000000 0000000000000002
(XEN)    0000000000000246 00000000000000a4 ffff88002e063b18 ffff880006304000
(XEN)    0000000000000000 ffffffff802063aa 0000000000000000 0000000000000000
(XEN)    0000000000000001 0000010000000000 ffffffff802063aa 000000000000e033
(XEN)    0000000000000246 ffff880006305f08 000000000000e02b 0000000000000000
(XEN)    0000000000000000 0000000000000000 0000000000000000 0000000000000000
(XEN)    ffff8300cee02080
(XEN) Xen call trace:
(XEN)    [<ffff828c801100e3>] free_heap_pages+0x173/0x230
(XEN)    [<ffff828c801235a9>] dma_pte_free_pagetable+0x149/0x1d0
(XEN)    [<ffff828c80124f81>] iommu_domain_teardown+0x31/0x70
(XEN)    [<ffff828c8012fe71>] arch_domain_destroy+0x21/0x100
(XEN)    [<ffff828c80104fc5>] complete_domain_destroy+0x55/0xd0
(XEN)    [<ffff828c8011a4a3>] rcu_process_callbacks+0x173/0x1f0
(XEN)    [<ffff828c801160a0>] do_softirq+0x70/0x80
(XEN)    [<ffff828c8012fc59>] idle_loop+0x99/0xa0
(XEN)    
(XEN) Pagetable walk from 0000000000100108:
(XEN)  L4[0x000] = 000000022fdf7063 5555555555555555
(XEN)  L3[0x000] = 000000022fdf6063 5555555555555555
(XEN)  L2[0x000] = 000000022fdf5063 5555555555555555 
(XEN)  L1[0x100] = 0000000000000000 ffffffffffffffff
(XEN) 
(XEN) ****************************************
(XEN) Panic on CPU 0:
(XEN) FATAL PAGE FAULT
(XEN) [error_code=0002]
(XEN) Faulting linear address: 0000000000100108
(XEN) ****************************************
(XEN) 
(XEN) Reboot in five seconds...


-- 
Configure bugmail: 
http://bugzilla.xensource.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

_______________________________________________
Xen-bugs mailing list
Xen-bugs@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-bugs