xenpaging crashes xen in is_iomem_page()

[Olaf Hering <olaf@aepfle.de>]

Is xenpaging supposed to work?
For me its crashing on a 4x3.6GHz Xeon, 4G system running SLES11 SP1.

There is one guest running.
A simple minded test of xenpaging crashes the host with xen 4.0 and
xen-unstable the same way:

 # xenpaging 1 1
xc: error: Error flushing ioemu cache: Internal error
(XEN) mm.c:768:d0 mfn 431f page ffff82f6000863e0 ci 0180000000000000/0000000000000000 32
(XEN) mm.c:769:d0 ffff82f6000863e0: 0000000000000000 0180000000000000 0000000000000000 0000000000000000
(XEN) Assertion '(page->count_info & ((1UL<<(64 - (9)))-1)) != 0' failed at mm.c:772
(XEN) Debugging connection not set up.
(XEN) ----[ Xen-4.1.21836-20100726.111138  x86_64  debug=y  Not tainted ]----
(XEN) CPU:    3
(XEN) RIP:    e008:[<ffff82c480161d92>] is_iomem_page+0x11e/0x16c
(XEN) RFLAGS: 0000000000010246   CONTEXT: hypervisor
(XEN) rax: 007fffffffffffff   rbx: ffffffffffffffff   rcx: 00000000c8c7d8ae
(XEN) rdx: 00000000000000d5   rsi: 000000000036cb58   rdi: 00000000000003e8
(XEN) rbp: ffff83012fecfbd8   rsp: ffff83012fecfb98   r8:  0000000000000003
(XEN) r9:  0000000000000004   r10: 0000000000000004   r11: 0000000000000001
(XEN) r12: 0000000000000000   r13: 0180000000000000   r14: 0000000000000000
(XEN) r15: ffff82f6000863e0   cr0: 0000000080050033   cr4: 00000000000006f0
(XEN) cr3: 0000000127c2e000   cr2: 00007f2aeea5d270
(XEN) ds: 0000   es: 0000   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff83012fecfb98:
(XEN)    0180000000000000 0000000000000000 0000000000000000 ffff8301192c0000
(XEN)    000000000000431f ffff8301192c0000 000000000000431f 000000000060c000
(XEN)    ffff83012fecfc18 ffff82c4801ca912 0000000000000000 0000000100000000
(XEN)    ffff8301192c0000 000000000060c000 ffff8800cd749e58 0000000000000000
(XEN)    ffff83012fecfc28 ffff82c4801cee3d ffff83012fecfc78 ffff82c4801ceddd
(XEN)    000000000010e540 7400000000000002 ffff82f6021ca810 fffffffffffffff3
(XEN)    000000000060c000 ffff8800cd749e58 0000000000000000 000000000060c000
(XEN)    ffff83012fecfda8 ffff82c48014fc53 ffff83012fecff18 4c00000000000002
(XEN)    ffff82f6024f85d0 000000002ffe4c60 4000000000000000 ffff82f602510fa0
(XEN)    000000000012887d 0000000000000067 ffff83012fea0000 ffff83012fea0000
(XEN)    000000000010e540 ffff83012fecfe38 ffff83012fecfcf8 ffff82c480167c59
(XEN)    ffff83012fecfd88 ffff82c480167e96 ffff83012fecfd48 000000000012887d
(XEN)    0000000000000000 0000000000000000 ffff83012fecfd58 0000000000249b00
(XEN)    00000000001288a0 00000000124d8125 ffff8301288a02e8 0000000000000000
(XEN)    0000000000000000 0000000000000001 00000000124d8125 ffff83012fea0000
(XEN)    0000000000000202 fffffffffffffff3 000000000060c000 ffff8800cd749e58
(XEN)    0000000000000000 00007fffe5f712b0 ffff83012fecfef8 ffff82c480103568
(XEN)    ffff83012fea0000 0000000000000000 ffff83012fecfe08 ffff82c480163b65
(XEN)    0000000100000082 ffff82f602511400 ffff83012fea0000 ffff83012fea0000
(XEN)    0000000000000000 ffff82f602511400 ffff83012fecfee8 ffff82c48016e8d5
(XEN) Xen call trace:
(XEN)    [<ffff82c480161d92>] is_iomem_page+0x11e/0x16c
(XEN)    [<ffff82c4801ca912>] p2m_mem_paging_nominate+0xc3/0x252
(XEN)    [<ffff82c4801cee3d>] mem_paging_domctl+0x2d/0x70
(XEN)    [<ffff82c4801ceddd>] mem_event_domctl+0x36f/0x3a2
(XEN)    [<ffff82c48014fc53>] arch_do_domctl+0x2573/0x2740
(XEN)    [<ffff82c480103568>] do_domctl+0x1222/0x12aa
(XEN)    [<ffff82c4801fd392>] syscall_enter+0xf2/0x14c
(XEN)
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 3:
(XEN) Assertion '(page->count_info & ((1UL<<(64 - (9)))-1)) != 0' failed at mm.c:772
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds...
(XEN) Debugging connection not set up.


---
 xen/arch/x86/mm.c |    7 +++++++
 1 file changed, 7 insertions(+)

--- xen-unstable.hg-4.1.21836.orig/xen/arch/x86/mm.c
+++ xen-unstable.hg-4.1.21836/xen/arch/x86/mm.c
@@ -99,6 +99,7 @@
 #include <xen/event.h>
 #include <xen/iocap.h>
 #include <xen/guest_access.h>
+#include <xen/delay.h>
 #include <asm/paging.h>
 #include <asm/shadow.h>
 #include <asm/page.h>
@@ -762,6 +763,12 @@ int is_iomem_page(unsigned long mfn)
 
     /* Caller must know that it is an iomem page, or a reference is held. */
     page = mfn_to_page(mfn);
+    if ((page->count_info & PGC_count_mask) == 0) {
+    unsigned long **p = (unsigned long **)page;
+    MEM_LOG("mfn %lx page %p ci %p/%p %d", mfn, page, (void *)page->count_info, (void *)(page->count_info & PGC_count_mask), (int)sizeof(*page));
+    MEM_LOG("%p: %p %p %p %p",page,p[0],p[1],p[2],p[3]);
+    mdelay(1234);
+    }
     ASSERT((page->count_info & PGC_count_mask) != 0);
 
     return (page_get_owner(page) == dom_io);