Fatal trap 12 on live migrate

[Linda Messerschmidt]

Hello,

With 8.1-STABLE (r214217) up and running under Xen 4.0.1 on the
2.6.32.24 pvops kernel, this command:

xm migrate freebsd8s localhost

Produces the following crash:

kernel trap 12 with interrupts disabled
Kernel page fault with the following non-sleepable locks held:
exclusive sleep mutex intr sources (intr sources) r = 0 (0xc051c540)
locked @ /usr/src/sys/i386/i386/intr_machdep.c:190
KDB: stack backtrace:
X_db_sym_numargs(c0333f0d,c00fbc50,d4667ad4,a,d4667b10,...) at
X_db_sym_numargs+0x146
kdb_backtrace(be,3,ffffffff,c04e24d4,d4667b64,...) at kdb_backtrace+0x2a
witness_display_spinlock(c0336345,d4667b78,4,1,0,...) at
witness_display_spinlock+0x75
witness_warn(5,0,c035da1d,c03b4e7c,c234d2a8,...) at witness_warn+0x1fe
trap(d4667bfc) at trap+0x16a
alltraps(c2366cc0,f,d4667c78,c02dc08e,83,...) at alltraps+0x1b
unbind_from_irqhandler(83,d4667cd8,c02d74d3,c22f7780,c22db03c,...) at
unbind_from_irqhandler+0x21
xencons_suspend(c22f7780,c22db03c,c036c3b8,b5,d4667cc8,...) at
xencons_suspend+0x1e
evtchn_device_upcall(c038d474,c262dc80,2,301,a,...) at
evtchn_device_upcall+0x4e3
xs_suspend(0,d4667d38,c032bf9f,345,c234d2a8,...) at xs_suspend+0x1fe
fork_exit(c02d9e10,0,d4667d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xd4667d70, ebp = 0 ---


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address	= 0x0
fault code		= supervisor read, page not present
instruction pointer	= 0x21:0x0
stack pointer	        = 0x29:0xd4667c3c
frame pointer	        = 0x29:0xd4667c5c
code segment		= base 0x0, limit 0xfffff, type 0x1b
			= DPL 1, pres 1, def32 1, gran 1
processor eflags	= resume, IOPL = 0
current process		= 14 (xenwatch)
[thread pid 14 tid 100017 ]
Stopped at      0:      *** error reading from address 0 ***

I am no expert but it looks like some sort of null pointer problem?
Maybe it tried to jump to a null address?  (eip = 0)

I would like to learn more about the inner workings of DomU FreeBSD.
How could I help debug this?

Thanks!