[Xen-bugs] [Bug 1543] New: [VT-d] Device assignment with NIC 82575 to guest cause xen crash

[bugzilla-daemon@xxxxxxxxxxxxxxxxxxx]

http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1543

           Summary: [VT-d] Device assignment with NIC 82575 to guest cause
                    xen crash
           Product: Xen
           Version: unstable
          Platform: x86-64
        OS/Version: Linux
            Status: NEW
          Severity: major
          Priority: P1
         Component: Hypervisor
        AssignedTo: xen-bugs@xxxxxxxxxxxxxxxxxxx
        ReportedBy: jiajun.xu@xxxxxxxxx


Environment:
------------
Service Arch (ia32/ia32e/IA64): ia32e
Guest Arch (ia32/ia32e/IA64): ia32e
Guest OS Type (Linux/Windows): Linux
Change Set: 20453
Hardware: Stoakley (Xeon 5300 Series),  Intel Corporation 82575EB Gigabit
Other:
xen-changeset:   20453:bec27eb6f72c

pvops git:
commit b9160b12ecc7148aa080b8d4ecf35f75d257f9d9
Merge: 69003a1... aa228e3...
Author: Jeremy Fitzhardinge <jeremy.fitzhardinge@xxxxxxxxxx>

ioemu git:
commit f72b6e0ffc3bb84d4442c5a7493bffbdce2a4468
Author: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
Date:   Wed Nov 4 17:07:57 2009 +0000

tboot changeset:
changeset:   176:e57acd4d1460
tag:         tip
user:        Shane Wang <shane.wang@xxxxxxxxx>
date:        Fri Oct 16 04:03:14 2009 -0700
summary:     Fixed a timeout bug in 163


Bug detailed description:
--------------------------
On Stoakley, when we assign the Intel Corporation 82575EB Gigabit NIC card to
guest, xen will crash when the guest is trying to get IP with the card. 

There is no such issue with the same card with INTx mode in guest. And we did
not find such issue on Gulftown-HEDT with other NICs.

The card lspci output:

[root@vt-dp6 ~]$ lspci -s 07:00.0 -vv
07:00.0 Ethernet controller: Intel Corporation 82575EB Gigabit Network
Connection (rev 02)
        Subsystem: Super Micro Computer Inc Unknown device 10a7
        Control: I/O+ Mem+ BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr-
Stepping- SERR- FastB2B-
        Status: Cap+ 66MHz- UDF- FastB2B- ParErr- DEVSEL=fast >TAbort- <TAbort-
<MAbort- >SERR- <PERR-
        Interrupt: pin A routed to IRQ 16
        Region 0: Memory at d8620000 (32-bit, non-prefetchable) [size=128K]
        Region 1: Memory at d8600000 (32-bit, non-prefetchable) [size=128K]
        Region 2: I/O ports at 4000 [size=32]
        Region 3: Memory at d8680000 (32-bit, non-prefetchable) [size=16K]
        [virtual] Expansion ROM at d8900000 [disabled] [size=128K]
        Capabilities: [40] Power Management version 2
                Flags: PMEClk- DSI+ D1- D2- AuxCurrent=0mA
PME(D0+,D1-,D2-,D3hot+,D3cold+)
                Status: D0 PME-Enable- DSel=0 DScale=1 PME-
        Capabilities: [50] Message Signalled Interrupts: 64bit+ Queue=0/0
Enable-
                Address: 0000000000000000  Data: 0000
        Capabilities: [60] MSI-X: Enable- Mask- TabSize=10
                Vector table: BAR=3 offset=00000000
                PBA: BAR=3 offset=00002000
        Capabilities: [a0] Express Endpoint IRQ 0
                Device: Supported: MaxPayload 256 bytes, PhantFunc 0, ExtTag-
                Device: Latency L0s <512ns, L1 <64us
                Device: AtnBtn- AtnInd- PwrInd-
                Device: Errors: Correctable- Non-Fatal- Fatal- Unsupported-
                Device: RlxdOrd+ ExtTag- PhantFunc- AuxPwr- NoSnoop+
                Device: MaxPayload 128 bytes, MaxReadReq 512 bytes
                Link: Supported Speed 2.5Gb/s, Width x4, ASPM L0s L1, Port 0
                Link: Latency L0s <4us, L1 <64us
                Link: ASPM Disabled RCB 64 bytes CommClk- ExtSynch-
                Link: Speed 2.5Gb/s, Width x4
        Capabilities: [100] Advanced Error Reporting
        Capabilities: [140] Device Serial Number a4-18-7d-ff-ff-48-30-00

Xen Crash log:
#########
(XEN) ----[ Xen-3.5-unstable  x86_64  debug=y  Not tainted ]----
(XEN) CPU:    3
(XEN) RIP:    e008:[<ffff82c4801fa0a2>] compat_test_guest_events+0x4/0x42
(XEN) RFLAGS: 0000000000010046   CONTEXT: hypervisor
(XEN) rax: 0000000000000000   rbx: ffff8300ce30a000   rcx: ffff82c480302680
(XEN) rdx: ffff82c480302680   rsi: ffff82c480267a38   rdi: 0000000000006000
(XEN) rbp: 00007cfdd00b8187   rsp: ffff83022ff47e58   r8:  0000000000000001
(XEN) r9:  0000000000000001   r10: ffff8300cfaf2060   r11: 00ff00ff00ff00ff
(XEN) r12: ffff82c480261a00   r13: ffff8300cfaf2000   r14: 0000000000000002
(XEN) r15: ffff82c480267080   cr0: 000000008005003b   cr4: 00000000000026f0
(XEN) cr3: 00000000cfcf4000   cr2: 0000000000000001
(XEN) ds: 002b   es: 002b   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff83022ff47e58:
(XEN)    ffff82c480267080 0000000000000002 ffff8300cfaf2000 ffff82c480261a00
(XEN)    ffff83022ff47f00 ffff83022ff47f28 00ff00ff00ff00ff ffff8300cfaf2060
(XEN)    0000000000000001 0000000000000001 00000000ffffffda ffff82c480302680
(XEN)    ffff82c480302680 ffff82c480267a38 0000000000006000 0000010000000000
(XEN)    ffff82c48014a4f4 000000000000e008 0000000000000246 ffff83022ff47f00
(XEN)    000000000000e010 ffff83022ff47f20 ffff82c48014a4be 0000000000000003
(XEN)    ffff8300ce30a000 ffff83022ff47db8 0000000000000000 0000000000000000
(XEN)    0000000000000000 0000000000000000 ffff8801f08adf10 ffffffff818a8118
(XEN)    0000000000000246 0000000000000001 0000003b9a6acf4f 0000000000000000
(XEN)    0000000000000000 ffffffff810093aa ffff8801f08ac000 00000000deadbeef
(XEN)    00000000deadbeef 0000010000000000 ffffffff810093aa 000000000000e033
(XEN)    0000000000000246 ffff8801f08adef8 000000000000e02b 000000000000beef
(XEN)    000000000000beef 000000000000beef 000000000000beef 0000000000000003
(XEN)    ffff8300ce30a000
(XEN) Xen call trace:
(XEN)    [<ffff82c4801fa0a2>] compat_test_guest_events+0x4/0x42
(XEN)    [<ffff82c48014a4f4>] default_idle+0x2f/0x34
(XEN)    [<ffff82c48014a4be>] idle_loop+0x75/0x7c
(XEN)
(XEN) Pagetable walk from 0000000000000001:
(XEN)  L4[0x000] = 000000022fff0063 5555555555555555
(XEN)  L3[0x000] = 000000022ffef063 5555555555555555
(XEN)  L2[0x000] = 000000022ffee063 5555555555555555
(XEN)  L1[0x000] = 0000000000000000 ffffffffffffffff
(XEN)
(XEN) ****************************************
(XEN) Panic on CPU 3:
(XEN) FATAL PAGE FAULT
(XEN) [error_code=0000]
(XEN) Faulting linear address: 0000000000000001
(XEN) ****************************************
(XEN)
(XEN) Reboot in five seconds...
#########


-- 
Configure bugmail: 
http://bugzilla.xensource.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

_______________________________________________
Xen-bugs mailing list
Xen-bugs@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-bugs