From mboxrd@z Thu Jan  1 00:00:00 1970
From: Keir Fraser <keir.fraser@eu.citrix.com>
Subject: Bug in tmem: refcount leak leaves zombie saved domains
Date: Thu, 10 Jun 2010 10:46:55 +0100
Message-ID: <C836731F.17460%keir.fraser@eu.citrix.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xensource.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: "xen-devel@lists.xensource.com" <xen-devel@lists.xensource.com>
Cc: Dan Magenheimer <dan.magenheimer@oracle.com>
List-Id: xen-devel@lists.xenproject.org

Dan,

Just doing some save/restore testing on xen-unstable tip, I noticed that:
# xm create ./pv_config
# xm save PV1

Would leave the saved guest as a zombie in the DOMDYING_dead state with no
pages, yet with refcnt=1. This happens absolutely consistently. Just as
consistently, it does not happen when I boot Xen with no-tmem. My conclusion
is that tmem is leaking a domain reference count during domain save. This
doesn't happen if I merely "xm create ...; xm destroy ...".

My pv_config file contains nothing exciting:
kernel = "/nfs/keir/xen/xen64.hg/dist/install/boot/vmlinuz-2.6.18.8-xenU"
memory = 750
name = "PV1"
vcpus = 2
vif = [ 'mac=00:1a:00:00:01:01' ]
disk = [ 'phy:/dev/VG/Suse10.1_64_1,sda1,w' ]
root = "/dev/sda1 ro xencons=tty"
extra = ""
tsc_native = 1
on_poweroff = 'destroy'
on_reboot   = 'restart'
on_crash    = 'preserve'

The dom{0,U} kernels are tip of linux-2.6.18-xen, default -xen{0,U} configs.

 -- Keir