958699 – [virtio-win][netkvm]winxp Guest BSOD when change TX value to 256

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 958699 - [virtio-win][netkvm]winxp Guest BSOD when change TX value to 256

Summary: [virtio-win][netkvm]winxp Guest BSOD when change TX value to 256

Keywords:
Status:	CLOSED CURRENTRELEASE
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	virtio-win
Sub Component:
Version:	6.3
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	Yvugenfi@redhat.com
QA Contact:	Virtualization Bugs
Docs Contact:
URL:
Whiteboard:
Depends On:	912926
Blocks:
TreeView+	depends on / blocked

Reported:	2013-05-02 09:03 UTC by Mike Cao
Modified:	2015-11-23 03:36 UTC (History)
CC List:	8 users (show)
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed:	2014-01-01 16:39:45 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)
dump file for win2k3-32 (15.91 MB, application/octet-stream) 2013-05-07 03:32 UTC, Mike Cao	no flags	Details
View All

Description Mike Cao 2013-05-02 09:03:46 UTC

Description of problem:


Version-Release number of selected component (if applicable):
2.6.32-369.el6.x86_64
qemu-kvm-rhev-0.12.1.2-2.359.el6.x86_64
seabios-0.6.1.2-27.el6.x86_64
vgabios-0.6b-3.7.el6.noarch
spice-server-0.12.0-12.el6.x86_
virito-win-prewhql-59

How reproducible:
100%

Steps to Reproduce:
1.Start winxp w/ virtio-net-pci
CLI:/usr/libexec/qemu-kvm -m 6G -smp 4 -cpu cpu64-rhel6,+x2apic -usb -device usb-tablet -drive file=win2012-nic2.raw,if=none,id=drive-ide0-0-0,werror=stop,rerror=stop,cache=none -device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 -netdev tap,sndbuf=0,id=hostnet0,vhost=on,script=/etc/qemu-ifup-private,downscript=no -device virtio-net-pci,netdev=hostnet0,mac=00:13:31:56:35:14,bus=pci.0,addr=0x4,id=virtio-net-pci0 -netdev tap,sndbuf=0,id=hostnet2,script=/etc/qemu-ifup,downscript=no -device e1000,netdev=hostnet2,mac=00:28:16:26:42:31,bus=pci.0,addr=0x6 -uuid 558f2197-e4e0-4748-b314-5c4e523aa1f7 -no-kvm-pit-reinjection -chardev socket,id=111a,path=/tmp/monitor-win2012-nic2,server,nowait -mon chardev=111a,mode=readline -vnc :2 -rtc base=localtime,clock=host,driftfix=slew -global PIIX4_PM.disable_s3=0 -global PIIX4_PM.disable_s4=0
2.Change Tx value from 1024(defaults) to 256
  
Actual results:
Guest BSOD 

Expected results:
no BSOD occurs 

Additional info:
This bug is regression from build 49 ,marked regression keywords

Comment 4 Yvugenfi@redhat.com 2013-05-06 15:44:28 UTC

Please provide dump file. Cannot reproduce on Windows 2012 with build 59 or HEAD.

Comment 5 Mike Cao 2013-05-06 15:49:24 UTC

(In reply to comment #4)
> Please provide dump file. Cannot reproduce on Windows 2012 with build 59 or
> HEAD.

I 100% reproduce it ,but no idea why no crash dump in C:\ ,I am sure I set kernel dump enabled ,any idea about it ?

Comment 6 Yvugenfi@redhat.com 2013-05-06 15:55:19 UTC

Try in C:\Windows or set for minidump (might be good enough).

Comment 7 Yvugenfi@redhat.com 2013-05-06 15:55:28 UTC

Try in C:\Windows or set for minidump (might be good enough).

Comment 8 Mike Cao 2013-05-07 03:29:32 UTC

still can not find memeory dump in winxp ,since win2k3 also affacts ,Will upload dumps for win2k3.

Use !analyze -v to get detailed debugging information.

BugCheck D1, {4, d0000007, 0, f760cbf9}

*** ERROR: Module load completed but symbols could not be loaded for netkvm.sys
Page 7d57a not present in the dump file. Type ".hh dbgerr004" for details
Page 7d6a6 not present in the dump file. Type ".hh dbgerr004" for details
Probably caused by : netkvm.sys ( netkvm+5bf9 )

Followup: MachineOwner
---------

3: kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high.  This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 00000004, memory referenced
Arg2: d0000007, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f760cbf9, address which referenced memory

Debugging Details:
------------------

Page 7d57a not present in the dump file. Type ".hh dbgerr004" for details
Page 7d6a6 not present in the dump file. Type ".hh dbgerr004" for details

READ_ADDRESS:  00000004 

CURRENT_IRQL:  7

FAULTING_IP: 
netkvm+5bf9
f760cbf9 8b4804          mov     ecx,dword ptr [eax+4]

DEFAULT_BUCKET_ID:  DRIVER_FAULT

BUGCHECK_STR:  0xD1

PROCESS_NAME:  services.exe

TRAP_FRAME:  ba476ab0 -- (.trap 0xffffffffba476ab0)
ErrCode = 00000000
eax=00000000 ebx=ba476b83 ecx=01ce4ac7 edx=efa405f4 esi=897ca008 edi=00000000
eip=f760cbf9 esp=ba476b24 ebp=ba476b28 iopl=0         nv up ei pl nz na po nc
cs=0008  ss=0010  ds=0023  es=0023  fs=0030  gs=0000             efl=00010202
netkvm+0x5bf9:
f760cbf9 8b4804          mov     ecx,dword ptr [eax+4] ds:0023:00000004=????????
Resetting default scope

LAST_CONTROL_TRANSFER:  from f760cbf9 to 8088c9fb

STACK_TEXT:  
ba476ab0 f760cbf9 badb0d00 efa405f4 f7737120 nt!KiTrap0E+0x2a7
WARNING: Stack unwind information not available. Following frames may be wrong.
ba476b28 f760e076 897ca008 00000072 897cae18 netkvm+0x5bf9
ba476b44 f76079d2 897ca008 ba476b83 ba476b74 netkvm+0x7076
ba476b54 f7228409 ba476b73 ba476b83 897ca008 netkvm+0x9d2
ba476b74 8088d760 897cae18 017ca4d4 e11aeffc NDIS!ndisMIsr+0x36
ba476b98 8088d709 80805000 00000181 ba476c34 nt!KiChainedDispatch2ndLvl+0x48
ba476b98 8093ebd3 80805000 00000181 ba476c34 nt!KiChainedDispatch+0x29
ba476c24 8094894b 893b9d88 00000008 ba476c48 nt!ObFastReferenceObject+0x67
ba476c34 80971f37 893b9d88 00000000 00000000 nt!PsReferencePrimaryToken+0x17
ba476c48 80971fb7 01526da8 003b9d88 ba476c84 nt!SeCaptureSubjectContextEx+0x3d
ba476c5c 8096bbb2 ba476c84 ba476d64 0098f818 nt!SeCaptureSubjectContext+0x1d
ba476d04 8096c01e 000b4a10 00000000 00000054 nt!SeAccessCheckByType+0x3e6
ba476d3c 808897fc 000b4a10 00000054 02000002 nt!NtAccessCheck+0x28
ba476d3c 7c82846e 000b4a10 00000054 02000002 nt!KiFastCallEntry+0xfc
0098f860 00000000 00000000 00000000 00000000 0x7c82846e


STACK_COMMAND:  kb

FOLLOWUP_IP: 
netkvm+5bf9
f760cbf9 8b4804          mov     ecx,dword ptr [eax+4]

SYMBOL_STACK_INDEX:  1

SYMBOL_NAME:  netkvm+5bf9

FOLLOWUP_NAME:  MachineOwner

MODULE_NAME: netkvm

IMAGE_NAME:  netkvm.sys

DEBUG_FLR_IMAGE_TIMESTAMP:  516ea575

FAILURE_BUCKET_ID:  0xD1_netkvm+5bf9

BUCKET_ID:  0xD1_netkvm+5bf9

Followup: MachineOwner
---------

Comment 9 Mike Cao 2013-05-07 03:32:21 UTC

Created attachment 744432 [details]
dump file for win2k3-32

Comment 10 Yvugenfi@redhat.com 2013-05-20 11:38:15 UTC

Should be fixed in build 61.

The BZ that should fix it: bug #912926.

Comment 11 Yvugenfi@redhat.com 2013-05-20 11:39:42 UTC

According to crash dump the reason for crash is received interrupt while cleaning up the device (when we change parameter disable\enable for the device is initiated by OS).

Comment 13 guo jiang 2013-06-03 08:29:17 UTC

Tested this issue on virito-win-prewhql-59 - winxp-32/win2k3-32
Verified this issue on virtio-win-prewhql-63 - winxp-32/win2k3-32

Steps as comment #0.

Actual Result:
on virtio-win-prewhql-59:
 QE test at least ten times, no BSOD occurs on winxp-32 and win2k3-32,respectively.
on virtio-win-prewhql-63:
 no BSOD occurs

Base on above,this issue has been fixed already.

Comment 14 Mike Cao 2013-06-04 02:24:25 UTC

Move Bug status to VERIFIED according to comment #13 .
Will reopen it if QE hit it again

Note You need to log in before you can comment on or make changes to this bug.