NetBSD Problem Report #33093

From  Fri Mar 17 04:14:08 2006
Return-Path: <>
Received: from ( [])
	by (Postfix) with ESMTP id E0DA963B8C2
	for <>; Fri, 17 Mar 2006 04:14:07 +0000 (UTC)
Message-Id: <>
Date: Thu, 16 Mar 2006 22:14:02 -0600
Subject: dom0 reboots when destroying domU in non-halted state
X-Send-Pr-Version: 3.95

>Number:         33093
>Category:       port-xen
>Synopsis:       dom0 reboots when destroying domU in non-halted state
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    port-xen-maintainer
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Mar 17 04:15:00 +0000 2006
>Closed-Date:    Tue Jun 19 21:24:35 +0000 2018
>Last-Modified:  Tue Jun 19 21:24:35 +0000 2018
>Originator:     Jason White
>Release:        NetBSD 3.0
Jason White <>       Jabber: jdwhite(                 jason.d.white(
PGP KeyID: 0x5290E477

System: NetBSD mcp 3.0 NetBSD 3.0 (MCP_DOM0) #1: Wed Mar 15 17:47:56 CST 2006 jdwhite@smeghead:/usr/obj/i386/MCP_DOM0 i386
Architecture: i386
Machine: i386
Xen 2.0.  When a domU that's been given access to the UHCI USB controller is 
destroyed (via 'xm destroy <id>') while domU is in a non-halted state, dom0 
locks up for ~10 seconds, then reboots.  Same config file where domU is not 
given access to the UHCI controller does NOT cause dom0 to reboot.

I am unsure if this problem is triggered by giving a domU access to any PCI 
device or just a particular device.

domU config file used at:


Use sample config file from Xen-HOWTO:

Delegeate a pci device to the domU.  My UHCI controller was on bus0, device 
7, func 2.  I added the following to my config file:
pci = [ '0,7,2' ]

# xm create -c /path/to/config

Kernel boots, detects UHCI controller.  Then, destroy the domain:

# xm destroy <id>

Dom0 hangs for a few seconds; reboots.

Shutdown of the domain to bring it to a halted/stopped state is always 
desirable, but not always possible.  If your domU kernel has the debugger 
enabled (and you can get in to it), "reboot 0x8" will halt.  But if domU is 
just hung and can't be halted, "xm destroy" is your only option.

Either way, bad behavior of a domU or destroying a domU, regardless of what 
state that domU is in, should never bring down dom0.


From: Jason White <>
Subject: Re: port-xen/33093: dom0 reboots when destroying domU in non-halted state
Date: Fri, 17 Mar 2006 02:10:55 -0600

 The kernel config file for the DomU can be found at:

From: Jason White <>
Subject: Re: port-xen/33093: dom0 reboots when destroying domU in non-halted state
Date: Fri, 17 Mar 2006 10:28:17 -0600

 Xen reports the following when I attempt to destroy the domain:

 (XEN) BUG at domain.c:144
 (XEN) CPU:    0
 (XEN) EIP:    0808:[<fc505c70>]      
 (XEN) EFLAGS: 00011296
 (XEN) eax: fc545454   ebx: fc57d9e0   ecx: 00000000   edx: 00000018
 (XEN) esi: 000e0002   edi: 00000800   ebp: c6b96024   esp: fc503f8c
 (XEN) ds: 0810   es: 0810   fs: 0810   gs: 0810   ss: 0810
 (XEN) Stack trace from ESP=fc503f8c:
 (XEN) fc528e95 fc528ed6 00000090 000e0002 00000800 c6b96024 fc57d9e0 
 (XEN)        [fc505c80] 00000808 00001286 c067d960 00000000 67716b98 0000000b 
 (XEN)        c6b96024 67716b98 000e0002 c038cb5e 00000009 00011202 c6b95f5c 
 (XEN)        00000011 00000011 00000031 00000011 fc57d9e0 
 (XEN) Call Trace from ESP=fc503f8c: [<fc505c88>] [<fc505c80>] 

 CPU0 FATAL TRAP: vector = 6 (invalid operand)
 Aieee! CPU0 is toast...

 Reboot in five seconds...

State-Changed-From-To: open->closed
State-Changed-When: Tue, 19 Jun 2018 21:24:35 +0000
Xen 2.0 is EOLed by upstream.


NetBSD Home
NetBSD PR Database Search

(Contact us) $NetBSD: query-full-pr,v 1.43 2018/01/16 07:36:43 maya Exp $
$NetBSD:,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2017 The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.