xen assert in latest 3.3.2-rc bits

xen assert in latest 3.3.2-rc bits

[Mark Johnson]

I just got the following assertion when shutting down a windows 7 guest on
the latest 3.3-testing bits.. Has anyone else seen this?


MRJ


(xVM) Assertion 'd->dirty_vram->sl1ma[i] == sl1ma' failed at multi.c:1376
(xVM) ----[ Xen-3.3.2-rc1-pre-xvm-debug  x86_64  debug=y  Not tainted ]----
(xVM) CPU:    1
(xVM) RIP:    e008:[<ffff828c801b8641>]
sh_destroy_l1_shadow__guest_2+0x247/0x56c
(xVM) RFLAGS: 0000000000010287   CONTEXT: hypervisor
(xVM) rax: ffff8300ceeda100   rbx: 000000000012ffbe   rcx: 000000000000001d
(xVM) rdx: 0000000000000001   rsi: ffff8300ceecc100   rdi: 000000003a5fd025
(xVM) rbp: ffff8300cee0fbf8   rsp: ffff8300cee0fba8   r8:  ffff8300ceece100
(xVM) r9:  000000012ffbe0e8   r10: ffff83012ffbe0e8   r11: 0000000000000000
(xVM) r12: ffff83012ffbe0e8   r13: 000000000000001d   r14: ffff8300ceece100
(xVM) r15: ffff83012ffbe000   cr0: 000000008005003b   cr4: 00000000000026f0
(xVM) cr3: 00000000cad23000   cr2: fffffe00521aa128
(xVM) ds: 004b   es: 004b   fs: 0000   gs: 0000   ss: e010   cs: e008
(xVM) Xen stack trace from rsp=ffff8300cee0fba8:
(xVM)    555555555555beef 00000000000000be ffff8300ceece100 000000000012ffbe
(xVM)    ffff8300ceede100 ffff828402f7f5b0 0000000000000000 000000000012ffbe
(xVM)    0000000000000180 000000000012ffd3 ffff8300cee0fc08 ffff828c801b06e2
(xVM)    ffff8300cee0fc68 ffff828c801b83a7 ffff8300ceede100 ffff83012ffd3000
(xVM)    0000000300000000 000000000012ffd0 ffff8300ceede100 ffff828402f7f880
(xVM)    0000000000000000 000000000012ffd0 ffff8300ceece100 0000000000000002
(xVM)    ffff8300cee0fc78 ffff828c801b06ec ffff8300cee0fce8 ffff828c801ae3dd
(xVM)    000000008284f5d1 0000000000000000 ffff8300ceede100 ffff8300ceede100
(xVM)    ffff828401323708 ffff8300ceede100 00000001cee0fce8 ffff8300ceece100
(xVM)    0000000000000000 ffff8300ceedfb20 0000000000000002 0000000000000004
(xVM)    ffff8300cee0fd48 ffff828c801afa13 0000000800000000 ffff8300cee0ff28
(xVM)    ffff8300ceece120 0000000000000020 0000000000000000 ffff8300ceecf0b0
(xVM)    0000000000000000 ffff8300ceedfb20 ffff828c802b90c0 ffff8300ceece100
(xVM)    ffff8300cee0fd88 ffff828c801b4925 0000000000000000 ffff8300ceece100
(xVM)    ffff8300ceece100 00007ffffd0ef360 fffffffffffffffd ffffff00047c7e24
(xVM)    ffff8300cee0fda8 ffff828c801a961a ffff8300cee0fdc8 ffff8300ceece100
(xVM)    ffff8300cee0fdc8 ffff828c80141f17 ffff8300ceece100 0000000000000000
(xVM)    ffff8300cee0fdf8 ffff828c801056bd ffff828401fb0d90 ffff828c80240340
(xVM)    ffff8300cee0fe48 ffffff00047c7b60 ffff8300cee0ff08 ffff828c80104791
(xVM)    ffff828401fdd368 ffff828c80240340 0000000000000002 0000000080000000
(xVM) Xen call trace:
(xVM)    [<ffff828c801b8641>] sh_destroy_l1_shadow__guest_2+0x247/0x56c
(xVM)    [<ffff828c801b06e2>] sh_destroy_shadow+0xcd/0x16f
(xVM)    [<ffff828c801b83a7>] sh_destroy_l2_shadow__guest_2+0x2be/0x311
(xVM)    [<ffff828c801b06ec>] sh_destroy_shadow+0xd7/0x16f
(xVM)    [<ffff828c801ae3dd>] _shadow_prealloc+0x3cb/0x578
(xVM)    [<ffff828c801afa13>] sh_set_allocation+0x1ec/0x356
(xVM)    [<ffff828c801b4925>] shadow_teardown+0x2bf/0x461
(xVM)    [<ffff828c801a961a>] paging_teardown+0x30/0x3f
(xVM)    [<ffff828c80141f17>] domain_relinquish_resources+0x51/0x16d
(xVM)    [<ffff828c801056bd>] domain_kill+0x87/0x182
(xVM)    [<ffff828c80104791>] do_domctl+0x58c/0xcdb
(xVM)    [<ffff828c801d81bf>] syscall_enter+0xef/0x149
(xVM)
Xen panic[dom=0xffff8300ceefa100/vcpu=0xffff8300cfde4100]: Assertion
'd->dirty_vram->sl1ma[i] == sl1ma' failed at multi.c:1376

	rdi: ffff828c801f9b68 rsi: ffff8300cee0f9a8 rdx: ffff828c80159deb
	rcx:              560  r8: ffff8300cee0ff08  r9: ffff8300cee0ff18
	rax: ffff8300cee0f9c8 rbx: ffff828c801f9b68 rbp: ffff8300cee0fa88
	r10: ffff828c8029fdc0 r11: ffff8300cee0fa08 r12:              282
	r13: ffff8300cee0f928 r14: ffff828c8029fdc1 r15:       3000000008
	fsb:     7ffffe934a00 gsb: fffffffffbc619b0  ds:               4b
	 es:               4b  fs:                0  gs:                0
	 cs:             e008 rfl:              282 rsp: ffff8300cee0f9a0
	rip: ffff828c80159e40:  ss:             e010
	cr0: 8005003b  cr2: fffffe00521aa128  cr3: cad23000  cr4:     26f0

[PATCH]: fix vram tracking (was Re: xen assert in latest 3.3.2-rc bits)

[Gianluca Guida]

[-- Attachment #1: Type: text/plain, Size: 350 bytes --]



Mark Johnson wrote:
> I just got the following assertion when shutting down a windows 7 guest on
> the latest 3.3-testing bits.. Has anyone else seen this?

Can you try this patch?

--


Check for writable mappings in ptes before assuming that the type count 
in the page has changed.

Signed-off-by: Gianluca Guida <gianluca.guida@eu.citrix.com>


[-- Attachment #2: fix-track-vram.patch --]
[-- Type: text/x-diff, Size: 3838 bytes --]

diff -r b249f3e979a5 xen/arch/x86/mm/shadow/multi.c
--- a/xen/arch/x86/mm/shadow/multi.c	Mon Mar 09 10:32:24 2009 +0000
+++ b/xen/arch/x86/mm/shadow/multi.c	Tue Mar 10 21:48:42 2009 +0000
@@ -1039,18 +1039,19 @@ static inline void shadow_vram_get_l1e(s
                                        mfn_t sl1mfn,
                                        struct domain *d)
 { 
-    mfn_t mfn;
+    mfn_t mfn = shadow_l1e_get_mfn(new_sl1e);
+    int flags = shadow_l1e_get_flags(new_sl1e);
     unsigned long gfn;
 
-    if ( !d->dirty_vram ) return;
-
-    mfn = shadow_l1e_get_mfn(new_sl1e);
-
-    if ( !mfn_valid(mfn) ) return; /* m2p for mmio_direct may not exist */
+    if ( !d->dirty_vram         /* tracking disabled? */
+         || !(flags & _PAGE_RW) /* read-only mapping? */
+         || !mfn_valid(mfn) )   /* mfn can be invalid in mmio_direct */
+        return;
 
     gfn = mfn_to_gfn(d, mfn);
 
-    if ( (gfn >= d->dirty_vram->begin_pfn) && (gfn < d->dirty_vram->end_pfn) ) {
+    if ( (gfn >= d->dirty_vram->begin_pfn) && (gfn < d->dirty_vram->end_pfn) )
+    {
         unsigned long i = gfn - d->dirty_vram->begin_pfn;
         struct page_info *page = mfn_to_page(mfn);
         
@@ -1066,48 +1067,58 @@ static inline void shadow_vram_put_l1e(s
                                        mfn_t sl1mfn,
                                        struct domain *d)
 {
-    mfn_t mfn;
+    mfn_t mfn = shadow_l1e_get_mfn(old_sl1e);
+    int flags = shadow_l1e_get_flags(old_sl1e);
     unsigned long gfn;
 
-    if ( !d->dirty_vram ) return;
-
-    mfn = shadow_l1e_get_mfn(old_sl1e);
-
-    if ( !mfn_valid(mfn) ) return;
+    if ( !d->dirty_vram         /* tracking disabled? */
+         || !(flags & _PAGE_RW) /* read-only mapping? */
+         || !mfn_valid(mfn) )   /* mfn can be invalid in mmio_direct */
+        return;
 
     gfn = mfn_to_gfn(d, mfn);
 
-    if ( (gfn >= d->dirty_vram->begin_pfn) && (gfn < d->dirty_vram->end_pfn) ) {
+    if ( (gfn >= d->dirty_vram->begin_pfn) && (gfn < d->dirty_vram->end_pfn) )
+    {
         unsigned long i = gfn - d->dirty_vram->begin_pfn;
         struct page_info *page = mfn_to_page(mfn);
         int dirty = 0;
         paddr_t sl1ma = pfn_to_paddr(mfn_x(sl1mfn))
             | ((unsigned long)sl1e & ~PAGE_MASK);
 
-        if ( (page->u.inuse.type_info & PGT_count_mask) == 1 ) {
+        if ( (page->u.inuse.type_info & PGT_count_mask) == 1 )
+        {
             /* Last reference */
             if ( d->dirty_vram->sl1ma[i] == INVALID_PADDR ) {
                 /* We didn't know it was that one, let's say it is dirty */
                 dirty = 1;
-            } else {
+            }
+            else
+            {
                 ASSERT(d->dirty_vram->sl1ma[i] == sl1ma);
                 d->dirty_vram->sl1ma[i] = INVALID_PADDR;
-                if ( shadow_l1e_get_flags(old_sl1e) & _PAGE_DIRTY )
+                if ( flags & _PAGE_DIRTY )
                     dirty = 1;
             }
-        } else {
+        }
+        else
+        {
             /* We had more than one reference, just consider the page dirty. */
             dirty = 1;
             /* Check that it's not the one we recorded. */
-            if ( d->dirty_vram->sl1ma[i] == sl1ma ) {
+            if ( d->dirty_vram->sl1ma[i] == sl1ma )
+            {
                 /* Too bad, we remembered the wrong one... */
                 d->dirty_vram->sl1ma[i] = INVALID_PADDR;
-            } else {
+            }
+            else
+            {
                 /* Ok, our recorded sl1e is still pointing to this page, let's
                  * just hope it will remain. */
             }
         }
-        if ( dirty ) {
+        if ( dirty )
+        {
             d->dirty_vram->dirty_bitmap[i / 8] |= 1 << (i % 8);
             d->dirty_vram->last_dirty = NOW();
         }

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Re: [PATCH]: fix vram tracking (was Re: xen assert in latest 3.3.2-rc bits)

[Mark Johnson]

On Tue, Mar 10, 2009 at 5:53 PM, Gianluca Guida
<gianluca.guida@eu.citrix.com> wrote:
>
>
> Mark Johnson wrote:
>>
>> I just got the following assertion when shutting down a windows 7 guest on
>> the latest 3.3-testing bits.. Has anyone else seen this?
>
> Can you try this patch?

yep, I'll give it a try...


Thanks,

MRJ


> --
>
>
> Check for writable mappings in ptes before assuming that the type count in
> the page has changed.
>
> Signed-off-by: Gianluca Guida <gianluca.guida@eu.citrix.com>
>
>

Re: [PATCH]: fix vram tracking (was Re: xen assert in latest 3.3.2-rc bits)

[Gianluca Guida]

Mark Johnson wrote:
> On Tue, Mar 10, 2009 at 5:53 PM, Gianluca Guida
> <gianluca.guida@eu.citrix.com> wrote:
>>
>> Mark Johnson wrote:
>>> I just got the following assertion when shutting down a windows 7 guest on
>>> the latest 3.3-testing bits.. Has anyone else seen this?
>> Can you try this patch?
> 
> yep, I'll give it a try...

Wops, just realized that the patch I've sent it's against 
xen-unstable.hg; should be easy to backport, but in case I'll send you 
the correct one ASAP.

This fix should be applied to both xen-3.3-testing.hg and 
xen-unstable.hg, in case it works of course.

Gianluca

Re: [PATCH]: fix vram tracking (was Re: xen assert in latest 3.3.2-rc bits)

[Gianluca Guida]

[-- Attachment #1: Type: text/plain, Size: 233 bytes --]

Gianluca Guida wrote:
> Wops, just realized that the patch I've sent it's against 
> xen-unstable.hg; should be easy to backport, but in case I'll send you 
> the correct one ASAP.

Here's the patch for xen-3.3-testing.hg.

Gianluca

[-- Attachment #2: fix-vram-3.3.patch --]
[-- Type: text/x-diff, Size: 4300 bytes --]

diff -r 587e81dd3540 xen/arch/x86/mm/shadow/multi.c
--- a/xen/arch/x86/mm/shadow/multi.c	Mon Mar 02 14:19:35 2009 +0000
+++ b/xen/arch/x86/mm/shadow/multi.c	Wed Mar 11 01:30:55 2009 +0000
@@ -1320,23 +1320,23 @@ static inline void shadow_vram_get_l1e(s
                                        mfn_t sl1mfn,
                                        struct domain *d)
 { 
-    mfn_t mfn;
+    mfn_t mfn = shadow_l1e_get_mfn(new_sl1e);
+    int flags = shadow_l1e_get_flags(new_sl1e);
     unsigned long gfn;
 
-    if ( !d->dirty_vram ) return;
-
-    mfn = shadow_l1e_get_mfn(new_sl1e);
-
-    if ( !mfn_valid(mfn) ) return; /* m2p for mmio_direct may not exist */
+    if ( !d->dirty_vram         /* tracking disabled? */
+         || !(flags & _PAGE_RW) /* read-only mapping? */
+         || !mfn_valid(mfn) )   /* mfn can be invalid in mmio_direct */
+        return;
 
     gfn = mfn_to_gfn(d, mfn);
 
-    if ( (gfn >= d->dirty_vram->begin_pfn) && (gfn < d->dirty_vram->end_pfn) ) {
+    if ( (gfn >= d->dirty_vram->begin_pfn) && (gfn < d->dirty_vram->end_pfn) )
+    {
         unsigned long i = gfn - d->dirty_vram->begin_pfn;
         struct page_info *page = mfn_to_page(mfn);
-        u32 count_info = page->u.inuse.type_info & PGT_count_mask;
-        
-        if ( count_info == 1 )
+        
+        if ( (page->u.inuse.type_info & PGT_count_mask) == 1 )
             /* Initial guest reference, record it */
             d->dirty_vram->sl1ma[i] = pfn_to_paddr(mfn_x(sl1mfn))
                 | ((unsigned long)sl1e & ~PAGE_MASK);
@@ -1348,49 +1348,59 @@ static inline void shadow_vram_put_l1e(s
                                        mfn_t sl1mfn,
                                        struct domain *d)
 {
-    mfn_t mfn;
+    mfn_t mfn = shadow_l1e_get_mfn(old_sl1e);
+    int flags = shadow_l1e_get_flags(old_sl1e);
     unsigned long gfn;
 
-    if ( !d->dirty_vram ) return;
-
-    mfn = shadow_l1e_get_mfn(old_sl1e);
-
-    if ( !mfn_valid(mfn) ) return;
+    if ( !d->dirty_vram         /* tracking disabled? */
+         || !(flags & _PAGE_RW) /* read-only mapping? */
+         || !mfn_valid(mfn) )   /* mfn can be invalid in mmio_direct */
+        return;
 
     gfn = mfn_to_gfn(d, mfn);
 
-    if ( (gfn >= d->dirty_vram->begin_pfn) && (gfn < d->dirty_vram->end_pfn) ) {
+    if ( (gfn >= d->dirty_vram->begin_pfn) && (gfn < d->dirty_vram->end_pfn) )
+    {
         unsigned long i = gfn - d->dirty_vram->begin_pfn;
         struct page_info *page = mfn_to_page(mfn);
-        u32 count_info = page->u.inuse.type_info & PGT_count_mask;
         int dirty = 0;
         paddr_t sl1ma = pfn_to_paddr(mfn_x(sl1mfn))
             | ((unsigned long)sl1e & ~PAGE_MASK);
 
-        if ( count_info == 1 ) {
+        if ( (page->u.inuse.type_info & PGT_count_mask) == 1 )
+        {
             /* Last reference */
-            if ( d->dirty_vram->sl1ma[i] == INVALID_PADDR ) {
+            if ( d->dirty_vram->sl1ma[i] == INVALID_PADDR )
+            {
                 /* We didn't know it was that one, let's say it is dirty */
                 dirty = 1;
-            } else {
+            }
+            else
+            {
                 ASSERT(d->dirty_vram->sl1ma[i] == sl1ma);
                 d->dirty_vram->sl1ma[i] = INVALID_PADDR;
-                if ( shadow_l1e_get_flags(old_sl1e) & _PAGE_DIRTY )
+                if ( flags & _PAGE_DIRTY )
                     dirty = 1;
             }
-        } else {
+        }
+        else
+        {
             /* We had more than one reference, just consider the page dirty. */
             dirty = 1;
             /* Check that it's not the one we recorded. */
-            if ( d->dirty_vram->sl1ma[i] == sl1ma ) {
+            if ( d->dirty_vram->sl1ma[i] == sl1ma )
+            {
                 /* Too bad, we remembered the wrong one... */
                 d->dirty_vram->sl1ma[i] = INVALID_PADDR;
-            } else {
+            }
+            else
+            {
                 /* Ok, our recorded sl1e is still pointing to this page, let's
                  * just hope it will remain. */
             }
         }
-        if ( dirty ) {
+        if ( dirty )
+        {
             d->dirty_vram->dirty_bitmap[i / 8] |= 1 << (i % 8);
             d->dirty_vram->last_dirty = NOW();
         }

[-- Attachment #3: Type: text/plain, Size: 138 bytes --]

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel

Re: [PATCH]: fix vram tracking (was Re: xen assert in latest 3.3.2-rc bits)

[Mark Johnson]

On Tue, Mar 10, 2009 at 9:34 PM, Gianluca Guida
<gianluca.guida@eu.citrix.com> wrote:
> Gianluca Guida wrote:
>>
>> Wops, just realized that the patch I've sent it's against xen-unstable.hg;
>> should be easy to backport, but in case I'll send you the correct one ASAP.
>
> Here's the patch for xen-3.3-testing.hg.

I have not been able to reproduce the crash *before* I applied the
patch.. I did test with the patch, and I still could not reproduce the
problem which is good :-)


I did manage to get a crash dump when I did get that assert though
(see below)..
It has dom0 and hypervisor ram state and symbols. Is there anything
you would like me to look at to very your assumptions?



Thanks,


MRJ


: alpha[1]#; mdb /var/crash/alpha/unix.0  /var/crash/alpha/vmcore.0
Loading modules: [ unix genunix specfs dtrace mac cpu.generic xpv_uppc
xpv_psm scsi_vhci ufs sd sockfs ip hook neti sctp arp usba uhci qlc
fctl stmf nca lofs zfs mpt idm audiosup md random crypto fcip fcp
smbsrv nfs logindmux ptm nsctl sdbc sv ii sppp rdc nsmb emlxs xpv ]
> sh_destroy_l1_shadow__guest_2::dis
xpv`sh_destroy_l1_shadow__guest_2:      pushq  %rbp
xpv`sh_destroy_l1_shadow__guest_2+1:    movq   %rsp,%rbp
xpv`sh_destroy_l1_shadow__guest_2+4:    pushq  %r15
xpv`sh_destroy_l1_shadow__guest_2+6:    pushq  %r14
xpv`sh_destroy_l1_shadow__guest_2+8:    pushq  %r13
xpv`sh_destroy_l1_shadow__guest_2+0xa:  pushq  %r12
xpv`sh_destroy_l1_shadow__guest_2+0xc:  pushq  %rbx
xpv`sh_destroy_l1_shadow__guest_2+0xd:  subq   $0x28,%rsp
xpv`sh_destroy_l1_shadow__guest_2+0x11: movq   %rdi,-0x30(%rbp)
xpv`sh_destroy_l1_shadow__guest_2+0x15: movq   %rsi,-0x38(%rbp)
xpv`sh_destroy_l1_shadow__guest_2+0x19: movq   0x10(%rdi),%r14
xpv`sh_destroy_l1_shadow__guest_2+0x1d:
movq   +0x60f8a(%rip),%rax      <0xffff828c802193a8>
xpv`sh_destroy_l1_shadow__guest_2+0x24: movq   (%rax),%rdx
xpv`sh_destroy_l1_shadow__guest_2+0x27: leaq   (%rsi,%rsi,4),%rax
xpv`sh_destroy_l1_shadow__guest_2+0x2b: movzbl 0x10(%rdx,%rax,8),%eax
xpv`sh_destroy_l1_shadow__guest_2+0x30: movl   %eax,%ebx
xpv`sh_destroy_l1_shadow__guest_2+0x32: andl   $0x1f,%ebx
xpv`sh_destroy_l1_shadow__guest_2+0x35: leal   -0x1(%rbx),%eax
xpv`sh_destroy_l1_shadow__guest_2+0x38: cmpl   $0x1,%eax
xpv`sh_destroy_l1_shadow__guest_2+0x3b:
jbe    +0x19    <xpv`sh_destroy_l1_shadow__guest_2+0x56>
xpv`sh_destroy_l1_shadow__guest_2+0x3d: ud2
xpv`sh_destroy_l1_shadow__guest_2+0x3f: ret    $0x2437
xpv`sh_destroy_l1_shadow__guest_2+0x42: movq   $0xffff828c802050ee,%rsp
xpv`sh_destroy_l1_shadow__guest_2+0x4c: movq   $0xffff828c802051b6,%rsp
xpv`sh_destroy_l1_shadow__guest_2+0x56: cmpl   $0x2,%ebx
xpv`sh_destroy_l1_shadow__guest_2+0x59:
jne    +0x26    <xpv`sh_destroy_l1_shadow__guest_2+0x81>
xpv`sh_destroy_l1_shadow__guest_2+0x5b:
movq   +0x60f4c(%rip),%rax      <0xffff828c802193a8>
xpv`sh_destroy_l1_shadow__guest_2+0x62: movq   (%rax),%rdx
xpv`sh_destroy_l1_shadow__guest_2+0x65: movq   -0x38(%rbp),%rcx
>
> conring/s
xpv`conring:
xpv`conring:    (xVM)  xVM version 3.3.2-rc1-pre-xvm-debug
(xVM) Command line: com1=9600,8n1 console=com1 dom0_mem=2g msi
(xVM) Video information:
(xVM)  VGA is text mode 80x25, font 8x16
(xVM)  VBE/DDC methods: V2; EDID transfer time: 1 seconds
(xVM) Disc information:
(xVM)  Found 4 MBR signatures
(xVM)  Found 4 EDD information structures
(xVM) Xen-e820 RAM map:
(xVM)  0000000000000000 - 000000000009e800 (usable)
(xVM)  000000000009f800 - 00000000000a0000 (reserved)
(xVM)  00000000000f0000 - 0000000000100000 (reserved)
(xVM)  0000000000100000 - 00000000cfee0000 (usable)
(xVM)  00000000cfee0000 - 00000000cfee3000 (ACPI NVS)
(xVM)  00000000cfee3000 - 00000000cfef0000 (ACPI data)
(xVM)  00000000cfef0000 - 00000000cff00000 (reserved)
(xVM)  00000000d0000000 - 00000000e0000000 (reserved)
(xVM)  00000000fec00000 - 0000000100000000 (reserved)
(xVM)  0000000100000000 - 0000000130000000 (usable)
(xVM) System RAM: 4094MB (4192760kB)
(xVM) ACPI: RSDP 000F6FE0, 0014 (r0 GBT   )
(xVM) ACPI: RSDT CFEE3040, 003C (r1 GBT    GBTUACPI 42302E31 GBTU  1010101)
(xVM) ACPI: FACP CFEE30C0, 0074 (r1 GBT    GBTUACPI 42302E31 GBTU  1010101)
(xVM) ACPI: DSDT CFEE3180, 561E (r1 GBT    GBTUACPI     1000 MSFT  100000C)
(xVM) ACPI: FACS CFEE0000, 0040
(xVM) ACPI: HPET CFEE8900, 0038 (r1 GBT    GBTUACPI 42302E31 GBTU       98)
(xVM) ACPI: MCFG CFEE8980, 003C (r1 GBT    GBTUACPI 42302E31 GBTU  1010101)
(xVM) ACPI: APIC CFEE8800, 0084 (r1 GBT    GBTUACPI 42302E31 GBTU  1010101)
(xVM) ACPI: SSDT CFEE8A00, 015C (r1  PmRef  Cpu0Ist     3000 INTL 20040311)
(xVM) ACPI: SSDT CFEE8E90, 0275 (r1  PmRef    CpuPm     3000 INTL 20040311)
(xVM) NUMA turned off
(xVM) Faking a node at 0000000000000000-0000000130000000
(xVM) Xen heap: 14MB (14364kB)
(xVM) Domain heap initialised
(xVM) found SMP MP-table at 000f5620
(xVM) DMI 2.4 present.
(xVM) Using APIC driver default
(xVM) ACPI: PM-Timer IO Port: 0x408
(xVM) ACPI: ACPI SLEEP INFO: pm1x_cnt[404,0], pm1x_evt[400,0]
(xVM) ACPI:                  wakeup_vec[cfee000c], vec_size[20]
(xVM) ACPI: Local APIC address 0xfee00000
(xVM) ACPI: LAPIC (acpi_id[0x00] lapic_id[0x00] enabled)
(xVM) Processor #0 6:15 APIC version 20
(xVM) ACPI: LAPIC (acpi_id[0x01] lapic_id[0x01] enabled)
(xVM) Processor #1 6:15 APIC version 20
(xVM) ACPI: LAPIC (acpi_id[0x02] lapic_id[0x02] disabled)
(xVM) ACPI: LAPIC (acpi_id[0x03] lapic_id[0x03] disabled)
(xVM) ACPI: LAPIC_NMI (acpi_id[0x00] dfl dfl lint[0x1])
(xVM) ACPI: LAPIC_NMI (acpi_id[0x01] dfl dfl lint[0x1])
(xVM) ACPI: LAPIC_NMI (acpi_id[0x02] dfl dfl lint[0x1])
(xVM) ACPI: LAPIC_NMI (acpi_id[0x03] dfl dfl lint[0x1])
(xVM) ACPI: IOAPIC (id[0x02] address[0xfec00000] gsi_base[0])
(xVM) IOAPIC[0]: apic_id 2, version 32, address 0xfec00000, GSI 0-23
(xVM) ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
(xVM) ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
(xVM) ACPI: IRQ0 used by override.
(xVM) ACPI: IRQ2 used by override.
(xVM) ACPI: IRQ9 used by override.
(xVM) Enabling APIC mode:  Flat.  Using 1 I/O APICs
(xVM) ACPI: HPET id: 0x8086a201 base: 0xfed00000
(xVM) Using ACPI (MADT) for SMP configuration information
(xVM) Using scheduler: SMP Credit Scheduler (credit)
(xVM) Initializing CPU#0
(xVM) Detected 2133.372 MHz processor.
(xVM) CPU: L1 I cache: 32K, L1 D cache: 32K
(xVM) CPU: L2 cache: 2048K
(xVM) CPU: Physical Processor ID: 0
(xVM) CPU: Processor Core ID: 0
(xVM) VMX: Supported advanced features:
(xVM)  - APIC TPR shadow
(xVM)  - MSR direct-access bitmap
(xVM) HVM: VMX enabled
(xVM) Intel machine check reporting enabled on CPU#0.
(xVM) CPU0: Thermal monitoring enabled (TM2)
(xVM) CMCI: CPU0 has no CMCI support
(xVM) CPU0: Intel(R) Core(TM)2 CPU          6400  @ 2.13GHz stepping 02
(xVM) Booting processor 1/1 eip 8c000
(xVM) Initializing CPU#1
(xVM) CPU: L1 I cache: 32K, L1 D cache: 32K
(xVM) CPU: L2 cache: 2048K
(xVM) CPU: Physical Processor ID: 0
(xVM) CPU: Processor Core ID: 1
(xVM) Intel machine check reporting enabled on CPU#1.
(xVM) CPU1: Thermal monitoring enabled (TM2)
(xVM) CMCI: CPU1 has no CMCI support
(xVM) CPU1: Intel(R) Core(TM)2 CPU          6400  @ 2.13GHz stepping 02
(xVM) Total of 2 processors activated.
(xVM) ENABLING IO-APIC IRQs
(xVM)  -> Using new ACK method
(xVM) ..TIMER: vector=0xF0 apic1=0 pin1=2 apic2=-1 pin2=-1
(xVM) checking TSC synchronization across 2 CPUs: passed.
(xVM) Platform timer is 14.318MHz HPET
(xVM) Brought up 2 CPUs
(xVM) I/O virtualisation disabled
(xVM) ACPI sleep modes: S3
(xVM) mcheck_poll: Machine check polling timer started.
(xVM) *** LOADING DOMAIN 0 ***
(xVM) elf_parse_binary: phdr: paddr=0x40800000 memsz=0x26e78
(xVM) elf_parse_binary: phdr: paddr=0x40000000 memsz=0x14641c
(xVM) elf_parse_binary: phdr: paddr=0x40400000 memsz=0xc2660
(xVM) elf_parse_binary: memory: 0x40000000 -> 0x40826e78
(xVM) elf_xen_parse_note: LOADER = "generic"
(xVM) elf_xen_parse_note: XEN_VERSION = "xen-3.0"
(xVM) elf_xen_parse_note: GUEST_OS = "Solaris"
(xVM) elf_xen_parse_note: VIRT_BASE = 0x40000000
(xVM) elf_xen_parse_note: PADDR_OFFSET = 0x40000000
(xVM) elf_xen_addr_calc_check: addresses:
(xVM)     virt_base        = 0x40000000
(xVM)     elf_paddr_offset = 0x40000000
(xVM)     virt_offset      = 0x0
(xVM)     virt_kstart      = 0x40000000
(xVM)     virt_kend        = 0x40826e78
(xVM)     virt_entry       = 0x40800000
(xVM)  Xen  kernel: 64-bit, lsb, compat32
(xVM)  Dom0 kernel: 64-bit, lsb, paddr 0x40000000 -> 0x40826e78
(xVM) PHYSICAL MEMORY ARRANGEMENT:
(xVM)  Dom0 alloc.:   0000000128000000->000000012c000000 (507904 pages to be all
ocated)
(xVM) VIRTUAL MEMORY ARRANGEMENT:
(xVM)  Loaded kernel: 0000000040000000->0000000040826e78
(xVM)  Init. ramdisk: 0000000040827000->0000000042f4f000
(xVM)  Phys-Mach map: 0000000042f4f000->000000004334f000
(xVM)  Start info:    000000004334f000->000000004334f4a4
(xVM)  Page tables:   0000000043350000->000000004336d000
(xVM)  Boot stack:    000000004336d000->000000004336e000
(xVM)  TOTAL:         0000000040000000->0000000043400000
(xVM)  ENTRY ADDRESS: 0000000040800000
(xVM) Dom0 has maximum 2 VCPUs
(xVM) elf_load_binary: phdr 1 at 0x0000000040800000 -> 0x0000000040826e78
(xVM) elf_load_binary: phdr 2 at 0x0000000040000000 -> 0x000000004014641c
(xVM) elf_load_binary: phdr 3 at 0x0000000040400000 -> 0x0000000040410897
(xVM) Scrubbing Free RAM: ...................done.
(xVM) Xen trace buffers: disabled
(xVM) Std. Loglevel: All
(xVM) Guest Loglevel: All
(xVM) *** Serial input -> DOM0 (type 'CTRL-a' three times to switch input to Xen
)
(xVM) Freed 136kB init memory.
(xVM) microcode: CPU0 updated from revision 0x56 to 0x5a, date = 2007-09-26
(xVM) microcode: CPU1 updated from revision 0x56 to 0x5a, date = 2007-09-26
(xVM) grant_table.c:800:d0 Expanding dom (0) grant table from (4) to (32) frames
.
(xVM) PCI add device 00:1f.2
(xVM) PCI add device 00:1c.0
(xVM) PCI add device 00:1c.4
(xVM) PCI add device 00:1c.5
(xVM) PCI add device 04:00.0
(xVM) PCI add device 02:00.0
(xVM) Xen trace buffers: initialized
(xVM) HVM1: HVM Loader
(xVM) HVM1: Detected Xen v3.3.2-rc1-pre-xvm-
(xVM) HVM1: CPU speed is 2133 MHz
(xVM) HVM1: Multiprocessor initialisation:
(xVM) HVM1:  - CPU0 ... 36-bit phys ... fixed MTRRs ... var MTRRs ... done.
(xVM) HVM1: Writing SMBIOS tables ...
(xVM) HVM1: Loading ROMBIOS ...
(xVM) HVM1: 9068 bytes of ROMBIOS high-memory extensions:
(xVM) HVM1:   Relocating to 0x1fff8c00-0x1fffaf6c ... done
(xVM) irq.c:235: Dom1 PCI link 0 changed 0 -> 5
(xVM) HVM1: PCI-ISA link 0 routed to IRQ5
(xVM) irq.c:235: Dom1 PCI link 1 changed 0 -> 10
(xVM) HVM1: PCI-ISA link 1 routed to IRQ10
(xVM) irq.c:235: Dom1 PCI link 2 changed 0 -> 11
(xVM) HVM1: PCI-ISA link 2 routed to IRQ11
(xVM) irq.c:235: Dom1 PCI link 3 changed 0 -> 5
(xVM) HVM1: PCI-ISA link 3 routed to IRQ5
(xVM) HVM1: pci dev 01:2 INTD->IRQ5
(xVM) HVM1: pci dev 01:3 INTA->IRQ10
(xVM) HVM1: pci dev 03:0 INTA->IRQ5
(xVM) HVM1: pci dev 04:0 INTA->IRQ5
(xVM) HVM1: pci dev 02:0 bar 10 size 02000000: f0000008
(xVM) HVM1: pci dev 03:0 bar 14 size 01000000: f2000008
(xVM) HVM1: pci dev 02:0 bar 14 size 00001000: f3000000
(xVM) HVM1: pci dev 03:0 bar 10 size 00000100: 0000c001
(xVM) HVM1: pci dev 04:0 bar 10 size 00000100: 0000c101
(xVM) HVM1: pci dev 04:0 bar 14 size 00000100: f3001000
(xVM) HVM1: pci dev 01:2 bar 20 size 00000020: 0000c201
(xVM) HVM1: pci dev 01:1 bar 20 size 00000010: 0000c221
(xVM) HVM1: Loading Cirrus VGABIOS ...
(xVM) HVM1: Loading PXE ROM ...
(xVM) HVM1:  - Manufacturer: Etherboot
(xVM) HVM1:  - Product name: rtl8139.zrom 5.4.2 (GPL) etherboot.org
(xVM) HVM1: Loading ACPI ...
(xVM) HVM1:  - Lo data: 000ea000-000ea03f
(xVM) HVM1:  - Hi data: 1fff7800-1fff8b5f
(xVM) HVM1: BIOS map:
(xVM) HVM1:  c0000-c8bff: VGA BIOS
(xVM) HVM1:  d0000-d7fff: Etherboot ROM
(xVM) HVM1:  e9000-e9160: SMBIOS tables
(xVM) HVM1:  f0000-fffff: Main BIOS
(xVM) HVM1: Invoking ROMBIOS ...
(xVM) HVM1:  rombios.c,v 1.138 2005/05/07 15:55:26 vruppert Exp $
(xVM) stdvga.c:147:d1 entering stdvga and caching modes
(xVM) HVM1: HVMAssist BIOS, 1 cpu, $Revision: 1.138 $ $Date: 2005/05/07 15:55:26
 $
(xVM) HVM1:
(xVM) HVM1: ata0-0: PCHS=16383/16/63 translation=lba LCHS=1024/255/63
(xVM) HVM1: ata0 master: QEMU HARDDISK ATA-7 Hard-Disk (16384 MBytes)
(xVM) HVM1: ata0  slave: Unknown device
(xVM) HVM1:
(xVM) HVM1:
(xVM) HVM1:
(xVM) HVM1: Press F10 to select boot device.
(xVM) HVM1: Booting from Hard Disk...
(xVM) HVM1: int13_harddisk: function 41, unmapped device for ELDL=81
(xVM) HVM1: int13_harddisk: function 08, unmapped device for ELDL=81
(xVM) HVM1: *** int 15h function AX=00C0, BX=0000 not yet supported!
(xVM) HVM1: KBD: unsupported int 16h function 03
(xVM) HVM1: *** int 15h function AX=E980, BX=0000 not yet supported!
(xVM) vlapic.c:724:d1 Local APIC Write to read-only register 0x30
(xVM) grant_table.c:800:d2 Expanding dom (2) grant table from (4) to (32) frames
.
(xVM) HVM3: HVM Loader
(xVM) HVM3: Detected Xen v3.3.2-rc1-pre-xvm-
(xVM) HVM3: CPU speed is 2133 MHz
(xVM) HVM3: Multiprocessor initialisation:
(xVM) HVM3:  - CPU0 ... 36-bit phys ... fixed MTRRs ... var MTRRs ... done.
(xVM) HVM3: Writing SMBIOS tables ...
(xVM) HVM3: Loading ROMBIOS ...
(xVM) HVM3: 9068 bytes of ROMBIOS high-memory extensions:
(xVM) HVM3:   Relocating to 0x3fff8c00-0x3fffaf6c ... done
(xVM) irq.c:235: Dom3 PCI link 0 changed 0 -> 5
(xVM) HVM3: PCI-ISA link 0 routed to IRQ5
(xVM) irq.c:235: Dom3 PCI link 1 changed 0 -> 10
(xVM) HVM3: PCI-ISA link 1 routed to IRQ10
(xVM) irq.c:235: Dom3 PCI link 2 changed 0 -> 11
(xVM) HVM3: PCI-ISA link 2 routed to IRQ11
(xVM) irq.c:235: Dom3 PCI link 3 changed 0 -> 5
(xVM) HVM3: PCI-ISA link 3 routed to IRQ5
(xVM) HVM3: pci dev 01:2 INTD->IRQ5
(xVM) HVM3: pci dev 01:3 INTA->IRQ10
(xVM) HVM3: pci dev 03:0 INTA->IRQ5
(xVM) HVM3: pci dev 04:0 INTA->IRQ5
(xVM) HVM3: pci dev 02:0 bar 10 size 02000000: f0000008
(xVM) HVM3: pci dev 03:0 bar 14 size 01000000: f2000008
(xVM) HVM3: pci dev 02:0 bar 14 size 00001000: f3000000
(xVM) HVM3: pci dev 03:0 bar 10 size 00000100: 0000c001
(xVM) HVM3: pci dev 04:0 bar 10 size 00000100: 0000c101
(xVM) HVM3: pci dev 04:0 bar 14 size 00000100: f3001000
(xVM) HVM3: pci dev 01:2 bar 20 size 00000020: 0000c201
(xVM) HVM3: pci dev 01:1 bar 20 size 00000010: 0000c221
(xVM) HVM3: Creating MP tables ...
(xVM) HVM3: Loading Cirrus VGABIOS ...
(xVM) HVM3: Loading PXE ROM ...
(xVM) HVM3:  - Manufacturer: Etherboot
(xVM) HVM3:  - Product name: rtl8139.zrom 5.4.2 (GPL) etherboot.org
(xVM) HVM3: Loading ACPI ...
(xVM) HVM3:  - Lo data: 000ea000-000ea03f
(xVM) HVM3:  - Hi data: 3fff7400-3fff881f
(xVM) HVM3: BIOS map:
(xVM) HVM3:  c0000-c8bff: VGA BIOS
(xVM) HVM3:  d0000-d7fff: Etherboot ROM
(xVM) HVM3:  e9000-e9160: SMBIOS tables
(xVM) HVM3:  f0000-fffff: Main BIOS
(xVM) HVM3: Invoking ROMBIOS ...
(xVM) HVM3:  rombios.c,v 1.138 2005/05/07 15:55:26 vruppert Exp $
(xVM) stdvga.c:147:d3 entering stdvga and caching modes
(xVM) HVM3: HVMAssist BIOS, 1 cpu, $Revision: 1.138 $ $Date: 2005/05/07 15:55:26
 $
(xVM) HVM3:
(xVM) HVM3: ata0-0: PCHS=16383/16/63 translation=lba LCHS=1024/255/63
(xVM) HVM3: ata0 master: QEMU HARDDISK ATA-7 Hard-Disk (20480 MBytes)
(xVM) HVM3: ata0  slave: Unknown device
(xVM) HVM3: ata1 master: QEMU DVD-ROM ATAPI-4 CD-Rom/DVD-Rom
(xVM) HVM3: ata1  slave: Unknown device
(xVM) HVM3:
(xVM) HVM3:
(xVM) HVM3:
(xVM) HVM3: Press F10 to select boot device.
(xVM) HVM3: Booting from Hard Disk...
(xVM) stdvga.c:151:d3 leaving stdvga
(xVM) common.c:3546:d0 tracking VRAM f0000 - f0240
(xVM) irq.c:235: Dom3 PCI link 0 changed 5 -> 0
(xVM) irq.c:235: Dom3 PCI link 1 changed 10 -> 0
(xVM) irq.c:235: Dom3 PCI link 2 changed 11 -> 0
(xVM) irq.c:235: Dom3 PCI link 3 changed 5 -> 0
(xVM) Assertion 'd->dirty_vram->sl1ma[i] == sl1ma' failed at multi.c:1376
(xVM) ----[ Xen-3.3.2-rc1-pre-xvm-debug  x86_64  debug=y  Not tainted ]----
(xVM) CPU:    1
(xVM) RIP:    e008:[<ffff828c801b8641>] sh_destroy_l1_shadow__guest_2+0x247/0x56
c
(xVM) RFLAGS: 0000000000010287   CONTEXT: hypervisor
(xVM) rax: ffff8300ceeda100   rbx: 000000000012ffbe   rcx: 000000000000001d
(xVM) rdx: 0000000000000001   rsi: ffff8300ceecc100   rdi: 000000003a5fd025
(xVM) rbp: ffff8300cee0fbf8   rsp: ffff8300cee0fba8   r8:  ffff8300ceece100
(xVM) r9:  000000012ffbe0e8   r10: ffff83012ffbe0e8   r11: 0000000000000000
(xVM) r12: ffff83012ffbe0e8   r13: 000000000000001d   r14: ffff8300ceece100
(xVM) r15: ffff83012ffbe000   cr0: 000000008005003b   cr4: 00000000000026f0
(xVM) cr3: 00000000cad23000   cr2: fffffe00521aa128
(xVM) ds: 004b   es: 004b   fs: 0000   gs: 0000   ss: e010   cs: e008
(xVM) Xen stack trace from rsp=ffff8300cee0fba8:
(xVM)    555555555555beef 00000000000000be ffff8300ceece100 000000000012ffbe
(xVM)    ffff8300ceede100 ffff828402f7f5b0 0000000000000000 000000000012ffbe
(xVM)    0000000000000180 000000000012ffd3 ffff8300cee0fc08 ffff828c801b06e2
(xVM)    ffff8300cee0fc68 ffff828c801b83a7 ffff8300ceede100 ffff83012ffd3000
(xVM)    0000000300000000 000000000012ffd0 ffff8300ceede100 ffff828402f7f880
(xVM)    0000000000000000 000000000012ffd0 ffff8300ceece100 0000000000000002
(xVM)    ffff8300cee0fc78 ffff828c801b06ec ffff8300cee0fce8 ffff828c801ae3dd
(xVM)    000000008284f5d1 0000000000000000 ffff8300ceede100 ffff8300ceede100
(xVM)    ffff828401323708 ffff8300ceede100 00000001cee0fce8 ffff8300ceece100
(xVM)    0000000000000000 ffff8300ceedfb20 0000000000000002 0000000000000004
(xVM)    ffff8300cee0fd48 ffff828c801afa13 0000000800000000 ffff8300cee0ff28
(xVM)    ffff8300ceece120 0000000000000020 0000000000000000 ffff8300ceecf0b0
(xVM)    0000000000000000 ffff8300ceedfb20 ffff828c802b90c0 ffff8300ceece100
(xVM)    ffff8300cee0fd88 ffff828c801b4925 0000000000000000 ffff8300ceece100
(xVM)    ffff8300ceece100 00007ffffd0ef360 fffffffffffffffd ffffff00047c7e24
(xVM)    ffff8300cee0fda8 ffff828c801a961a ffff8300cee0fdc8 ffff8300ceece100
(xVM)    ffff8300cee0fdc8 ffff828c80141f17 ffff8300ceece100 0000000000000000
(xVM)    ffff8300cee0fdf8 ffff828c801056bd ffff828401fb0d90 ffff828c80240340
(xVM)    ffff8300cee0fe48 ffffff00047c7b60 ffff8300cee0ff08 ffff828c80104791
(xVM)    ffff828401fdd368 ffff828c80240340 0000000000000002 0000000080000000
(xVM) Xen call trace:
(xVM)    [<ffff828c801b8641>] sh_destroy_l1_shadow__guest_2+0x247/0x56c
(xVM)    [<ffff828c801b06e2>] sh_destroy_shadow+0xcd/0x16f
(xVM)    [<ffff828c801b83a7>] sh_destroy_l2_shadow__guest_2+0x2be/0x311
(xVM)    [<ffff828c801b06ec>] sh_destroy_shadow+0xd7/0x16f
(xVM)    [<ffff828c801ae3dd>] _shadow_prealloc+0x3cb/0x578
(xVM)    [<ffff828c801afa13>] sh_set_allocation+0x1ec/0x356
(xVM)    [<ffff828c801b4925>] shadow_teardown+0x2bf/0x461
(xVM)    [<ffff828c801a961a>] paging_teardown+0x30/0x3f
(xVM)    [<ffff828c80141f17>] domain_relinquish_resources+0x51/0x16d
(xVM)    [<ffff828c801056bd>] domain_kill+0x87/0x182
(xVM)    [<ffff828c80104791>] do_domctl+0x58c/0xcdb
(xVM)    [<ffff828c801d81bf>] syscall_enter+0xef/0x149
(xVM)
>