Bug 1289430 - migrate windows10 guest when uninstall and install NIC driver inside guest, re-uninstall NIC after migration finished, guest hang
migrate windows10 guest when uninstall and install NIC driver inside guest, r...
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: qemu-kvm (Show other bugs)
x86_64 Windows
high Severity high
: rc
: ---
Assigned To: jason wang
Virtualization Bugs
Depends On:
Blocks: 1359965
  Show dependency treegraph
Reported: 2015-12-08 00:47 EST by Qianqian Zhu
Modified: 2017-12-06 06:48 EST (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2017-12-06 06:48:53 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Qianqian Zhu 2015-12-08 00:47:43 EST
Description of problem:

migrate windows10 guest when uninstall and install NIC driver inside guest, re-uninstall NIC after migration finished, guest hang

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1.start win10 guest with cmd:
/usr/libexec/qemu-kvm -name win10 -m 2048 -cpu Westmere,check -realtime mlock=off -smp 4,sockets=2,cores=1,threads=1 -uuid 7bef3814-631a-48bb-bae8-2b1de75f7a13 -nodefaults -rtc base=localtime,driftfix=slew -global kvm-pit.lost_tick_policy=discard -global PIIX4_PM.disable_s3=1 -global PIIX4_PM.disable_s4=1 -boot order=c,menu=on -device virtio-serial-pci,id=virtio-serial0,bus=pci.0,addr=0x6 -drive file=/nfs/windows10.raw,if=none,id=drive-virtio-disk0,format=raw -device virtio-blk-pci,scsi=off,bus=pci.0,addr=0x7,drive=drive-virtio-disk0,id=virtio-disk0 -msg timestamp=on -device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x8 -vga cirrus -monitor stdio -vnc :3 -drive file=/nfs/en_windows_10_enterprise_x86_dvd_6851156.iso,if=none,media=cdrom,id=drive-ide0-1-0,readonly=on,format=raw -device ide-drive,drive=drive-ide0-1-0,id=ide0-1-0 -drive file=/usr/share/virtio-win/virtio-win-1.7.5_x86.vfd,if=none,id=drive-fdc0-0-0,format=raw,cache=none -global isa-fdc.driveA=drive-fdc0-0-0  -device e1000,netdev=hostnet0,id=net0,mac=D4:AE:52:E9:57:36 -netdev tap,id=hostnet0

2.start listening mode with -incoming tcp:0:5800 on dst host
3.migrate -d tcp:$dst_ip:5800
4.uninstall nic driver through device manager inside guest, then scan device updates to make nic driver installed again. finish this step before migration finished.
5.after migration finished, uninstall nic driver again: (Open device manager of guest, select the network adapter and click right button of mouse, select "Uninstall", click OK button.

Actual results:
guest hang after click OK button.

Expected results:
NIC driver uninstalled correctly, guest works well.

Additional info:
Comment 2 Amnon Ilan 2015-12-09 13:22:04 EST
Can you check it on 7.2? 
What happens if you restart the guest?
Comment 3 Qianqian Zhu 2015-12-10 02:08:34 EST
(In reply to Amnon Ilan from comment #2)
> Can you check it on 7.2? 
> What happens if you restart the guest?

1. Reproduced on:
Red Hat Enterprise Linux Server release 7.2 (Maipo)

Same steps as Description, and it acts exactly same as RHEL6.7 env.

2. Since guest hang, it can't be reboot inside, and no response for Ctrl+Alt+Del, so I tried with 'system_reset' in qemu monitor after guest hang.

Guest reboot successfully after 'system_reset', and hang again when re-uninstall the NIC driver(for both RHEL6.7 and RHEL7.2 env).
Comment 4 Yan Vugenfirer 2016-01-12 11:17:56 EST
Looks like related to https://bugzilla.redhat.com/show_bug.cgi?id=874406

Interrupt storm - e1000 driver handling interrupts:

0: kd> !analyze -v

*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *

This is typically due to a hardware malfunction.  The hardware supplier should
be called.
Arg1: 00000000004f4454
Arg2: 0000000000000000
Arg3: 0000000000000000
Arg4: 0000000000000000

Debugging Details:

Page 445e7 not present in the dump file. Type ".hh dbgerr004" for details



PROCESS_NAME:  TiWorker.exe


ANALYSIS_VERSION: 6.3.9600.17237 (debuggers(dbg).140716-0327) amd64fre

EXCEPTION_RECORD:  fffff800a7c0346b -- (.exr 0xfffff800a7c0346b)
ExceptionAddress: d08f8b48d075d83b
   ExceptionCode: f0d08b4c
  ExceptionFlags: 00240c83
NumberParameters: 1207959552
   Parameter[0]: 49000000dc8f8b44
   Parameter[1]: 287440f98341d28b
   Parameter[2]: 44d33348ff498d41
   Parameter[3]: 0f4cc98b41c1b60f
   Parameter[4]: 000001ba2272c2a3
   Parameter[5]: 48caff48e2d34800
   Parameter[6]: d20b49d32348d2f7
   Parameter[7]: 246c8b482a0c8d48
   Parameter[8]: b841fffffea9e940
   Parameter[9]: 49e0d34900000001
   Parameter[10]: 8b48cb2348ff488d
   Parameter[11]: 4cd20b49d33348d1
   Parameter[12]: f0d003490373d13b
   Parameter[13]: 000000c897b10f48
   Parameter[14]: 246c8b482a0c8d48

LAST_CONTROL_TRANSFER:  from fffff800a7c3782e to fffff800a7dbfc20

fffff800`a9806c08 fffff800`a7c3782e : 00000000`00000080 00000000`004f4454 00000000`00000000 00000000`00000000 : nt!KeBugCheckEx
fffff800`a9806c10 fffff800`a7ec61b4 : ffffe000`26c20968 fffff800`a7c4d970 fffff800`a7c4d970 00000000`00000000 : hal!HalBugCheckSystem+0x7e
fffff800`a9806c50 fffff800`a7c3880e : fffff800`000006c0 fffff800`a9806e30 00000000`00000001 00000000`00000000 : nt!WheaReportHwError+0x258
fffff800`a9806cb0 fffff800`a7e6cfe4 : fffff800`a9806e70 00000000`00000001 00000000`00000000 fffff800`a7e6e4dc : hal!HalHandleNMI+0xfe
fffff800`a9806ce0 fffff800`a7dc7dc2 : 00000000`00000000 fffff800`a9806ef0 00000000`00000000 00000000`00000000 : nt!KiProcessNMI+0x150
fffff800`a9806d30 fffff800`a7dc7c36 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KxNmiInterrupt+0x82
fffff800`a9806e70 fffff800`762f070a : ffffffff`ffffff91 fffff800`a7dc08c5 00000000`00000010 00000000`00000282 : nt!KiNmiInterrupt+0x176
fffff800`a97fba30 fffff800`762f044f : ffffe000`27176201 00000000`00000000 00000000`00000000 ffffe000`2808f0b0 : E1G6032E!RxProcessReceiveInterrupts+0x52
fffff800`a97fbaa0 fffff800`7505a817 : ffffe000`280881a0 fffff800`a97fbbd0 00000000`00000000 ffffe000`276f8000 : E1G6032E!E1000HandleInterrupt+0x8f
fffff800`a97fbad0 fffff800`a7cc2835 : fffff800`a97fbe70 fffff800`a7fd8f00 fffff800`a97fbd10 fffff800`a97fbee0 : ndis!ndisInterruptDpc+0x225b7
fffff800`a97fbc10 fffff800`a7cc1f10 : ffffe000`25e05540 00000000`00000001 00000000`00001567 00000000`00000000 : nt!KiExecuteAllDpcs+0x275
fffff800`a97fbd60 fffff800`a7dc48f5 : 00000000`00000000 fffff800`a7fd6180 ffffd000`8dc43500 ffffffff`ffd116f8 : nt!KiRetireDpcList+0xe0
fffff800`a97fbfb0 fffff800`a7dc4700 : 00000000`00000000 ffffb001`e9624400 00000000`00000000 ffffb001`dbb7dc00 : nt!KxRetireDpcList+0x5
ffffd000`8c54d170 fffff800`a7dc31d5 : 00000000`00000000 fffff800`a7dc10b1 00000000`00000000 00000000`00000000 : nt!KiDispatchInterruptContinue
ffffd000`8c54d1a0 fffff800`a7dc10b1 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiDpcInterruptBypass+0x25
ffffd000`8c54d1b0 fffff800`a7c1795d : fffff800`a7c0346b ffffe000`26d23010 00000000`00000000 fffff800`a7fb9250 : nt!KiInterruptDispatch+0xb1
ffffd000`8c54d348 fffff800`a7c0346b : ffffe000`26d23010 00000000`00000000 fffff800`a7fb9250 fffff800`a7fb91c8 : hal!HalpHpetQueryCounter+0xd
ffffd000`8c54d350 fffff800`a7cc2ee0 : 00000000`00000001 00000000`05f5e100 ffffe000`253f9060 ffffd000`8c54d4b8 : hal!KeQueryPerformanceCounter+0x15b
ffffd000`8c54d380 fffff800`a7d1f3fc : 00000000`00000420 ffffd000`8c54d4b8 00000000`00000000 00000000`00000420 : nt!EtwpLogKernelEvent+0x510
ffffd000`8c54d420 fffff800`a7d64664 : ffffd000`8c54d638 ffffd000`8c54d4f0 00000000`00000000 ffffe000`25253630 : nt!EtwTraceKernelEvent+0x80
ffffd000`8c54d470 fffff800`74aeb8ed : 00000000`00000000 00000000`00000000 ffffe000`28a5c888 ffffd000`8c54d638 : nt!EtwpTraceFileName+0xec
ffffd000`8c54d500 fffff800`74aeb68d : 00000000`00000000 ffffc000`0c02f610 ffffc000`0c061b60 fffff800`00000002 : fileinfo!FIStreamLog+0x1ed
ffffd000`8c54d600 fffff800`74aeb469 : 00000000`00000000 ffffd000`8c54d6c0 00000000`00000000 ffffe000`2997b010 : fileinfo!FIStreamSetFileInfo+0x12d
ffffd000`8c54d670 fffff800`74aeaa5b : 00000000`00000000 ffffe000`2997b010 ffffd000`8c54d818 00000000`00000000 : fileinfo!FIStreamQueryInfo+0x109
ffffd000`8c54d700 fffff800`74ae159e : 00000000`00000000 ffffd000`8c54d790 ffffe000`28d1d258 ffffc000`0c02f610 : fileinfo!FIStreamGetInfo+0x43
ffffd000`8c54d740 fffff800`74503652 : ffffe000`00000000 ffffc000`0c02f610 ffffe000`28d1d258 fffff800`74536647 : fileinfo!FIPostSetInformationCallback+0x1ee
ffffd000`8c54d7d0 fffff800`74503086 : ffffe000`28d1d100 00000000`00000000 00000000`00000008 00000000`00000000 : FLTMGR!FltpPerformPostCallbacks+0x2b2
ffffd000`8c54d8a0 fffff800`7450525a : ffffe000`28d1d198 ffffe000`28d1d180 ffffe000`256b0c10 ffffe000`256b0f68 : FLTMGR!FltpPassThroughCompletionWorker+0x76
ffffd000`8c54d8e0 fffff800`74503a16 : 00000000`00002020 ffffc9b9`8a47d4a3 00000000`00000000 00000051`3b82ebc0 : FLTMGR!FltpLegacyProcessingAfterPreCallbacksCompleted+0x33a
ffffd000`8c54d960 fffff800`a7d0651a : ffffe000`283d8320 ffffd000`8c54dcc0 00000000`00000000 ffffe000`00000001 : FLTMGR!FltpDispatch+0xb6
ffffd000`8c54d9c0 fffff800`a7dca263 : ffffc000`058c3e80 00000000`00000000 00000000`00000000 00000000`00000000 : nt!NtSetInformationFile+0x7ea
ffffd000`8c54dbd0 00007ffc`110b37ba : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : nt!KiSystemServiceCopyEnd+0x13
00000051`3b82eb08 00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x00007ffc`110b37ba


fffff800`762f070a 32c0            xor     al,al


SYMBOL_NAME:  E1G6032E!RxProcessReceiveInterrupts+52

FOLLOWUP_NAME:  MachineOwner


IMAGE_NAME:  E1G6032E.sys



FAILURE_BUCKET_ID:  0x80_E1G6032E!RxProcessReceiveInterrupts

BUCKET_ID:  0x80_E1G6032E!RxProcessReceiveInterrupts


FAILURE_ID_HASH_STRING:  km:0x80_e1g6032e!rxprocessreceiveinterrupts

FAILURE_ID_HASH:  {ad54256c-16f2-189b-95a0-c2c8038dedf6}

Followup: MachineOwner
Comment 5 Yan Vugenfirer 2016-03-17 11:35:08 EDT
Patches sent to upstream:
Comment 7 Jan Kurik 2017-12-06 06:48:53 EST
Red Hat Enterprise Linux 6 is in the Production 3 Phase. During the Production 3 Phase, Critical impact Security Advisories (RHSAs) and selected Urgent Priority Bug Fix Advisories (RHBAs) may be released as they become available.

The official life cycle policy can be reviewed here:


This issue does not meet the inclusion criteria for the Production 3 Phase and will be marked as CLOSED/WONTFIX. If this remains a critical requirement, please contact Red Hat Customer Support to request a re-evaluation of the issue, citing a clear business justification. Note that a strong business justification will be required for re-evaluation. Red Hat Customer Support can be contacted via the Red Hat Customer Portal at the following URL:


Note You need to log in before you can comment on or make changes to this bug.