HVM domain crash when network attach

[Hirofumi Tsujimura <tsujimura.hirof@jp.fujitsu.com>]

Hi all,

I found a problem when I tested vnif of PV-on-HVM.
My operation for the test is following.

On domain0:
# xm create -f domainHVM.config
# xm network-attach domainHVM

Then, the kernel of domainHVM panicked and outputted a message
"kernel panic - not syncing: Unable to reduce memory reservation".

The kernel sometimes panicked not always when I tested it some time.
In my investigation

### netfront/netfront.c
285 err = xenbus_scanf(XBT_NIL, dev->otherend, "feature-rx-copy", "%u",
286                    &feature_rx_copy);  <---------------- (A)
287 if (err != 1)
288   feature_rx_copy = 0;
===
802 if ( nr_flips != 0 ) {  <------------------------------- (B)
===
827   /* Check return status of HYPERVISOR_memory_op(). */
828   if (unlikely(np->rx_mcl[i].result != i))
829     panic("Unable to reduce memory reservation\n"); <------ (C)
830   } else {
831     if (HYPERVISOR_memory_op(XENMEM_decrease_reservation,
832                                                 &reservation) != i)
833       panic("Unable to reduce memory reservation\n"); <------- (D)
834 }

### netback/xenbus.c
111 err = xenbus_printf(xbt, dev->nodename,
                                  "feature-rx-copy", "%d", 1);<-- (E)

The problem happans in (C) or (D) when (B) become true.
I think that (B) must not become true on a domainHVM.
Because a domainHVM only uses rx_copy mode.

(B) is true because (A) fails.
(A) fails because (E) is executed after (A).
(E) must be execute before (A).
However (E) is not always executed before (A).

The test environment is as follows.
  - Architecture  : x86_32 with VTx
  - Xen change set: 11751
  - Domain 0      : kernel2.6.16.29-xen
  - Domain U      : kernel2.6.16.29-xen
  - Domain VTx    : kernel2.6.16

Does anyone know how to fix the problem ?
Thank you.
--
FUJITSU COMPUTER TECHNOLOGIES LIMITED
Development Dept. 5  Division 1
Hirofumi Tsujimura
E-MAIL: tsujimura.hirof@jp.fujitsu.com