Oops in xen 3.0.2 dequeue_signal [was: Re: DomU Oopsing on xen-3.0-testing changeset 8259]

[Charles Duffy <cduffy@spamcop.net>]

I'm seeing the same behavior I previously reported against 
xen-3.0-testing changeset 8259, albeit much more sporadically, on Xen 
3.0.2 (with a 2.6.16.16 kernel built via the Gentoo Xen packages). I'd 
use stock XenSource binaries, but last I checked they don't have support 
for some of my hardware (ie. the 3w9xxx driver).

Hints on anything I can do to provide more detailed information (in the 
hopes of actually getting this fixed) would be welcome.

ksymoops outlook looks like the following:

RIP: e030:[<ffffffff8013b1e3>] <ffffffff8013b1e3>{__dequeue_signal+259}
Using defaults from ksymoops -t elf64-x86-64 -a i386:x86-64
RSP: e02b:ffff88003144fe38  EFLAGS: 00010446
RAX: 0000000000000000 RBX: ffff88000b3e06d0 RCX: 0000000000000009
RDX: 0000000000000200 RSI: ffff88003144feb0 RDI: 0000000000000000
RBP: ffff88003144fe68 R08: ffff88003144e000 R09: 0000000000000000
R10: 0000000000000060 R11: 00000000fffffffa R12: ffff88001b05c950
R13: 000000000000000a R14: ffff88003144feb8 R15: 000000000000000a
FS:  00002b464b3890a0(0063) GS:ffffffff80535000(0000) knlGS:0000000000000000
CS:  e033 DS: 0000 ES: 0000
Stack: 000000003144fe88 0000000000000000 ffff88003144feb0 ffff88003144feb8
        ffff88000b3e00c0 0000000000000000 ffff88003144fe98 ffffffff8013b2f0
        0000000000000000 0000000000000000
Call Trace: <ffffffff8013b2f0>{dequeue_signal+48} 
<ffffffff8013dcf4>{sys_rt_sigtimedwait+596}
        <ffffffff8013e02a>{do_tkill+250} 
<ffffffff8013ab12>{recalc_sigpending+18}
        <ffffffff8013d621>{sigprocmask+225} 
<ffffffff8013d79c>{sys_rt_sigprocmask+268}
        <ffffffff8010b27e>{system_call+134} 
<ffffffff8010b1f8>{system_call+0}
Code: 48 8b 00 0f 18 08 48 39 df 75 e4 4d 85 e4 74 64 49 8b 54 24


 >>RIP; ffffffff8013b1e3 <__dequeue_signal+103/1e0>   <=====

 >>RBX; ffff88000b3e06d0 
<__start___xen_guest+ffff88000b3d42ea/ffffffff800f3c1a>
 >>RSI; ffff88003144feb0 
<__start___xen_guest+ffff880031443aca/ffffffff800f3c1a>
 >>RBP; ffff88003144fe68 
<__start___xen_guest+ffff880031443a82/ffffffff800f3c1a>
 >>R08; ffff88003144e000 
<__start___xen_guest+ffff880031441c1a/ffffffff800f3c1a>
 >>R11; 00000000fffffffa <__start___xen_guest+ffff3c14/ffffffff800f3c1a>
 >>R12; ffff88001b05c950 
<__start___xen_guest+ffff88001b05056a/ffffffff800f3c1a>
 >>R14; ffff88003144feb8 
<__start___xen_guest+ffff880031443ad2/ffffffff800f3c1a>

Trace; ffffffff8013b2f0 <dequeue_signal+30/e0>
Trace; ffffffff8013e02a <do_tkill+fa/150>
Trace; ffffffff8013d621 <sigprocmask+e1/150>
Trace; ffffffff8010b27e <system_call+86/8b>

Code;  ffffffff8013b1e3 <__dequeue_signal+103/1e0>
0000000000000000 <_RIP>:
Code;  ffffffff8013b1e3 <__dequeue_signal+103/1e0>   <=====
    0:   48 8b 00                  mov    (%rax),%rax   <=====
Code;  ffffffff8013b1e6 <__dequeue_signal+106/1e0>
    3:   0f 18 08                  prefetcht0 (%rax)
Code;  ffffffff8013b1e9 <__dequeue_signal+109/1e0>
    6:   48 39 df                  cmp    %rbx,%rdi
Code;  ffffffff8013b1ec <__dequeue_signal+10c/1e0>
    9:   75 e4                     jne    ffffffffffffffef 
<_RIP+0xffffffffffffffef>
Code;  ffffffff8013b1ee <__dequeue_signal+10e/1e0>
    b:   4d 85 e4                  test   %r12,%r12
Code;  ffffffff8013b1f1 <__dequeue_signal+111/1e0>
    e:   74 64                     je     74 <_RIP+0x74>
Code;  ffffffff8013b1f3 <__dequeue_signal+113/1e0>
   10:   49 8b 54 24 00            mov    0x0(%r12),%rdx

CR2: 0000000000000000