[Xen-bugs] [Bug 1630] New: CPU panic when destroying the guest with NIC assignment

[bugzilla-daemon@xxxxxxxxxxxxxxxxxxx]

http://bugzilla.xensource.com/bugzilla/show_bug.cgi?id=1630

           Summary: CPU panic when destroying the guest with NIC assignment
           Product: Xen
           Version: unstable
          Platform: Other
        OS/Version: Linux
            Status: NEW
          Severity: critical
          Priority: P1
         Component: Hypervisor
        AssignedTo: xen-bugs@xxxxxxxxxxxxxxxxxxx
        ReportedBy: jiajun.xu@xxxxxxxxx


Environment:
------------
Service Arch (ia32/ia32e/IA64): ia32/ia32e 
Guest Arch (ia32/ia32e/IA64):
Guest OS Type (Linux/Windows):
Change Set: 21624
Hardware: Stoakley/Gulftown-HEDT
Other:
xen-changeset:   21624:b9c541d9c138

pvops git:
commit b29254c40dac94960fd3887275c65c83b71086ea
Merge: cc867b2... 9d85e25...
Author: Jeremy Fitzhardinge <jeremy.fitzhardinge@xxxxxxxxxx>

ioemu git:
commit 6392763643311272590ef5c6f75ba11d5b132585
Author: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
Date:   Wed Jun 9 17:10:59 2010 +0100


Bug detailed description:
--------------------------
When we try to destroy or poweroff the guest which has an assigned pcie NIC,
the Xen would hang , Following is the serial output log. 
---------------------------------------------------------------------------
[  407.885241] +------ PCI-Express Device Error ------+
[  407.890607] Error Severity        : Corrected
[  407.894849] PCIE Bus Error type    : Physical Layer
[  407.899944] Receiver Error            : First
[  407.904469] Receiver ID        : 0038
[  407.907959] VendorID=8086h, DeviceID=340eh, Bus=00h, Device=07h,
Function=00h
(XEN) domctl.c:1003:d0 memory_map:remove: gfn=f3000 mfn=d3d00 nr_mfns=20
(XEN) domctl.c:1003:d0 memory_map:remove: gfn=f3021 mfn=d3d23 nr_mfns=1
(XEN) domctl.c:1073:d0 ioport_map:remove f_gport=c100 f_mport=7100 np=20
(XEN) Assertion 'timer->status >= 1' failed at timer.c:277
(XEN) ----[ Xen-4.1-unstable  x86_64  debug=y  Tainted:    C ]----
(XEN) CPU:    1
(XEN) RIP:    e008:[<ffff82c480122316>] active_timer+0xc/0x38
(XEN) RFLAGS: 0000000000010046   CONTEXT: hypervisor
(XEN) rax: 0000000000000000   rbx: ffff8300be100748   rcx: 0000000000000001
(XEN) rdx: 0000000000000082   rsi: 000000000000000a   rdi: ffff8300be100748
(XEN) rbp: ffff83012ff2fd00   rsp: ffff83012ff2fd00   r8:  0000000000000004
(XEN) r9:  0000000000000034   r10: 0000ffff0000ffff   r11: 00ff00ff00ff00ff
(XEN) r12: 0000000000000000   r13: ffff82c4802c1480   r14: 0000000000000217
(XEN) r15: ffff82c4802c1480   cr0: 000000008005003b   cr4: 00000000000026f0
(XEN) cr3: 00000000cf28c000   cr2: ffff88001f4b3068
(XEN) ds: 002b   es: 002b   fs: 0000   gs: 0000   ss: e010   cs: e008
(XEN) Xen stack trace from rsp=ffff83012ff2fd00:
(XEN)    ffff83012ff2fd40 ffff82c4801234e5 ffff83012ff2fd40 0000000000000037
(XEN)    ffff830129ed0000 ffff8301266b8c20 00000000000003c0 0000000000000037
(XEN)    ffff83012ff2fd80 ffff82c48013e4a8 ffff830129ed0190 ffff8300bafc6000
(XEN)    ffff830129ed0000 00000000ffffffff ffff830129ed0000 ffff82c4802a0880
(XEN)    ffff83012ff2fda0 ffff82c480150402 ffff8300bafc6000 fffffffffffffff8
(XEN)    ffff83012ff2fdd0 ffff82c4801042e7 0000000000000000 ffff83012ff36220
(XEN)    0000000000000001 ffff83012ff2ff28 ffff83012ff2fe00 ffff82c4801273e7
(XEN)    0000000000000001 0000000000000001 0000000000000001 fffffffffffffffd
(XEN)    ffff83012ff2fe40 ffff82c48012006a ffff830126401ab0 ffff83012ff2ff28
(XEN)    ffff830126401ab0 ffff830126401b10 0000000000000002 ffff83012ff36080
(XEN)    ffff83012ff2fe50 ffff82c4801200e8 ffff83012ff2ff00 ffff82c4801933df
(XEN)    ffff83012ff2feb0 ffff82c480122d1e ffff83012ff46bf0 ffff83012ff36180
(XEN)    ffff8300cf7d6000 0000000000000001 0000000000000001 ffffffffffffffff
(XEN)    ffff83012ff2ff28 00000001802a0880 0000000000000000 0000000000000000
(XEN)    ffff82c4802a0880 000002c8000000b7 ffff8300cd9b0000 ffff83012ff2ff28
(XEN)    ffff8300cd9b0000 ffff8300cf7d6000 0000000000000002 ffff83012ff36080
(XEN)    ffff83012ff2ff20 ffff82c48014f269 ffff82c480120089 0000000000000001
(XEN)    ffff83012ff2fdb8 0000000000000000 0000000000000000 0000000000000000
(XEN)    0000000000000000 ffff88003f8a3f10 ffffffff8183ec58 0000000000000246
(XEN)    ffffc90000045140 ffff88003f9a5dd0 0000000000000000 0000000000000000
(XEN) Xen call trace:
(XEN)    [<ffff82c480122316>] active_timer+0xc/0x38
(XEN)    [<ffff82c4801234e5>] kill_timer+0x226/0x245
(XEN)    [<ffff82c48013e4a8>] pci_release_devices+0xbe/0x228
(XEN)    [<ffff82c480150402>] arch_domain_destroy+0x28/0x2c9
(XEN)    [<ffff82c4801042e7>] complete_domain_destroy+0x72/0x138
(XEN)    [<ffff82c4801273e7>] rcu_process_callbacks+0x17d/0x1e6
(XEN)    [<ffff82c48012006a>] __do_softirq+0x87/0x98
(XEN)    [<ffff82c4801200e8>] process_pending_softirqs+0x5d/0x5f
(XEN)    [<ffff82c4801933df>] acpi_processor_idle+0x169/0x6f6
(XEN)    [<ffff82c48014f269>] idle_loop+0x4d/0x5b
(XEN)    
(XEN) 
(XEN) ****************************************
(XEN) Panic on CPU 1:
(XEN) Assertion 'timer->status >= 1' failed at timer.c:277
(XEN) ****************************************
(XEN) 
(XEN) Reboot in five seconds..
--------------------------------------------------------------------------
And following is our grub option 

title Xen-unstable (ia32e)
        root (hd0,0)
        kernel (hd0,0)/boot/xen.gz iommu=1 loglvl=all guest_loglvl=all
unrestricted_guest=1 com1=115200,8n1,0x1028,0,07:02.0,00:1e.00 console=com1
sync_console dom0_mem=1024M iommu=1 msi=1 conring_size=4M
        module (hd0,0)/boot/vmlinuz-2.6-xen ro root=/dev/sda1 console=hvc0
earlyprintk=xen ignore_loglevel
        module (hd0,0)/boot/initrd-2.6-xen.img


-- 
Configure bugmail: 
http://bugzilla.xensource.com/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.

_______________________________________________
Xen-bugs mailing list
Xen-bugs@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-bugs