There looks to be a regression from kernel 6.17 in kernel 7 relating to aacraid passthrough - when Proxmox is running on kernel 7.0.14, I'm getting a kernel oops on one of my machines on VM startup when passing through an Adaptec ASR-72405 HBA:
I've also replicated the same oops on that machine with earlier patches of 7.0.14 and with 7.0.6-2-pve. The bug can also be reliably triggered by manually unbinding the adapter from the host.
I've attempted some investigating with the assistance of ChatGPT, which has suggested that there has been a change in aacraid unbind behaviour in 7.0 - it flagged a patch `scsi: aacraid: Fix reply queue mapping to CPUs based on IRQ affinity` from June 2025 as a possible cause, but wasn't able to determine that definitively.
For now I have pinned the kernel to 6.17 on that machine as passthrough is working with that hardware/kernel combination. I do have another (much newer) machine which does passthrough an Adaptec ASR-72405 HBA under 7.0.14 successfully, so there does seem to be some additional factors that trigger this bug
Code:
Sep 01 11:01:12 starbase-375 kernel: BUG: unable to handle page fault for address: ffff8f4aedf8e018
Sep 01 11:01:12 starbase-375 kernel: #PF: supervisor write access in kernel mode
Sep 01 11:01:12 starbase-375 kernel: #PF: error_code(0x0002) - not-present page
Sep 01 11:01:12 starbase-375 kernel: PGD 296601067 P4D 296601067 PUD 0
Sep 01 11:01:12 starbase-375 kernel: Oops: Oops: 0002 [#1] SMP PTI
Sep 01 11:01:12 starbase-375 kernel: CPU: 5 UID: 0 PID: 2011 Comm: task UPID:starb Tainted: P O 7.0.14-14-pve #1 PREEMPT(lazy)
Sep 01 11:01:12 starbase-375 kernel: Tainted: [P]=PROPRIETARY_MODULE, [O]=OOT_MODULE
Sep 01 11:01:12 starbase-375 kernel: Hardware name: System manufacturer System Product Name/Z170-A, BIOS 3802 03/15/2018
Sep 01 11:01:12 starbase-375 kernel: RIP: 0010:__srcu_read_unlock+0x1a/0x30
Sep 01 11:01:12 starbase-375 kernel: Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 f0 83 44 24 fc 00 48 63 f6 48 c1 e6 04 48 03 77 08 <65> 48 ff 46 08 5d 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00
Sep 01 11:01:12 starbase-375 kernel: RSP: 0018:ffffd37387407a70 EFLAGS: 00010202
Sep 01 11:01:12 starbase-375 kernel: RAX: 0000000000000000 RBX: ffff8f475f230188 RCX: ffff8f475f2300e0
Sep 01 11:01:12 starbase-375 kernel: RDX: ffffd37387407b40 RSI: 0000000000000010 RDI: ffff8f475f230188
Sep 01 11:01:12 starbase-375 kernel: RBP: ffffd37387407a70 R08: 0000000000000000 R09: 0000000000000000
Sep 01 11:01:12 starbase-375 kernel: R10: 0000000000000000 R11: 0000000000000008 R12: 0000000000000000
Sep 01 11:01:12 starbase-375 kernel: R13: 0000000000000001 R14: ffffffffc063c8c8 R15: ffffffffc063c8c8
Sep 01 11:01:12 starbase-375 kernel: FS: 0000770845e52240(0000) GS:ffff8f4aedf8e000(0000) knlGS:0000000000000000
Sep 01 11:01:12 starbase-375 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Sep 01 11:01:12 starbase-375 kernel: CR2: ffff8f4aedf8e018 CR3: 000000010a4be001 CR4: 00000000003726f0
Sep 01 11:01:12 starbase-375 kernel: Call Trace:
Sep 01 11:01:12 starbase-375 kernel: <TASK>
Sep 01 11:01:12 starbase-375 kernel: blk_mq_tagset_busy_iter+0x1c9/0x420
Sep 01 11:01:12 starbase-375 kernel: ? schedule+0x27/0xb0
Sep 01 11:01:12 starbase-375 kernel: ? schedule_timeout+0xcf/0x110
Sep 01 11:01:12 starbase-375 kernel: ? __pfx___scsi_host_busy_iter_fn+0x10/0x10
Sep 01 11:01:12 starbase-375 kernel: ? __wait_for_common+0x15c/0x1a0
Sep 01 11:01:12 starbase-375 kernel: scsi_host_busy_iter+0x3a/0x60
Sep 01 11:01:12 starbase-375 kernel: ? __pfx_wait_for_io_iter+0x10/0x10 [aacraid]
Sep 01 11:01:12 starbase-375 kernel: aac_send_shutdown+0xb4/0x1a0 [aacraid]
Sep 01 11:01:12 starbase-375 kernel: __aac_shutdown+0x70/0x1c0 [aacraid]
Sep 01 11:01:12 starbase-375 kernel: aac_remove_one+0x47/0x170 [aacraid]
Sep 01 11:01:12 starbase-375 kernel: pci_device_remove+0x41/0xb0
Sep 01 11:01:12 starbase-375 kernel: device_remove+0x43/0x80
Sep 01 11:01:12 starbase-375 kernel: device_release_driver_internal+0x206/0x270
Sep 01 11:01:12 starbase-375 kernel: device_driver_detach+0x14/0x20
Sep 01 11:01:12 starbase-375 kernel: unbind_store+0xac/0xc0
Sep 01 11:01:12 starbase-375 kernel: drv_attr_store+0x24/0x50
Sep 01 11:01:12 starbase-375 kernel: sysfs_kf_write+0x72/0x90
Sep 01 11:01:12 starbase-375 kernel: kernfs_fop_write_iter+0x161/0x210
Sep 01 11:01:12 starbase-375 kernel: vfs_write+0x274/0x490
Sep 01 11:01:12 starbase-375 kernel: ksys_write+0x6f/0xf0
Sep 01 11:01:12 starbase-375 kernel: __x64_sys_write+0x19/0x30
Sep 01 11:01:12 starbase-375 kernel: x64_sys_call+0x22f/0x2390
Sep 01 11:01:12 starbase-375 kernel: do_syscall_64+0x10b/0x14e0
Sep 01 11:01:12 starbase-375 kernel: ? __x64_sys_openat+0x52/0xa0
Sep 01 11:01:12 starbase-375 kernel: ? x64_sys_call+0x1f4c/0x2390
Sep 01 11:01:12 starbase-375 kernel: ? do_syscall_64+0x148/0x14e0
Sep 01 11:01:12 starbase-375 kernel: ? exc_page_fault+0x92/0x1c0
Sep 01 11:01:12 starbase-375 kernel: entry_SYSCALL_64_after_hwframe+0x76/0x7e
Sep 01 11:01:12 starbase-375 kernel: RIP: 0033:0x770845f1e687
Sep 01 11:01:12 starbase-375 kernel: Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
Sep 01 11:01:12 starbase-375 kernel: RSP: 002b:00007fff33c14530 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
Sep 01 11:01:12 starbase-375 kernel: RAX: ffffffffffffffda RBX: 0000770845e52240 RCX: 0000770845f1e687
Sep 01 11:01:12 starbase-375 kernel: RDX: 000000000000000c RSI: 000060d9f7d56a70 RDI: 000000000000000f
Sep 01 11:01:12 starbase-375 kernel: RBP: 0000000000000018 R08: 0000000000000000 R09: 0000000000000000
Sep 01 11:01:12 starbase-375 kernel: R10: 0000000000000000 R11: 0000000000000202 R12: 000060d9f7d39fd8
Sep 01 11:01:12 starbase-375 kernel: R13: 000000000000000f R14: 0000000000000000 R15: 000060d9f7d39fc8
Sep 01 11:01:12 starbase-375 kernel: </TASK>
Sep 01 11:01:12 starbase-375 kernel: Modules linked in: ebtable_filter ebtables ip_set ip6table_raw iptable_raw ip6table_filter ip6_tables iptable_filter nf_tables sunrpc binfmt_misc bonding tls nfnetlink_log intel_rapl_msr intel_rapl_common intel_tcc_cooling x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel i915 mei_pxp mei_hdcp kvm drm_buddy ghash_clmulni_intel aesni_intel ttm rapl eeepc_wmi intel_wmi_thunderbolt wmi_bmof drm_display_helper mxm_wmi intel_cstate mei_me ee1004 pcspkr cec rc_core joydev intel_pmc_core mei i2c_algo_bit pmt_telemetry pmt_discovery pmt_class input_leds intel_pmc_ssram_telemetry intel_vsec acpi_pad mac_hid sch_fq_codel msr vhost_net vhost vhost_iotlb tap vfio_pci vfio_pci_core irqbypass vfio_iommu_type1 vfio nvme_fabrics iommufd nvme_core nvme_keyring nvme_auth hkdf efi_pstore nfnetlink dmi_sysfs ip_tables x_tables autofs4 zfs(PO) spl(O) btrfs libblake2b xor raid6_pq hid_logitech_hidpp hid_logitech_dj hid_generic usbkbd usbmouse usbhid hid mfd_aaeon asus_wmi sparse_keymap platform_profile ixgbe libie_fwlog
Sep 01 11:01:12 starbase-375 kernel: i2c_i801 psmouse xhci_pci xfrm_algo i2c_mux e1000e serio_raw video ahci i2c_smbus mdio aacraid dca libahci xhci_hcd wmi
Sep 01 11:01:12 starbase-375 kernel: CR2: ffff8f4aedf8e018
Sep 01 11:01:12 starbase-375 kernel: ---[ end trace 0000000000000000 ]---
Sep 01 11:01:12 starbase-375 kernel: RIP: 0010:__srcu_read_unlock+0x1a/0x30
Sep 01 11:01:12 starbase-375 kernel: Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 f0 83 44 24 fc 00 48 63 f6 48 c1 e6 04 48 03 77 08 <65> 48 ff 46 08 5d 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00
Sep 01 11:01:12 starbase-375 kernel: RSP: 0018:ffffd37387407a70 EFLAGS: 00010202
Sep 01 11:01:12 starbase-375 kernel: RAX: 0000000000000000 RBX: ffff8f475f230188 RCX: ffff8f475f2300e0
Sep 01 11:01:12 starbase-375 kernel: RDX: ffffd37387407b40 RSI: 0000000000000010 RDI: ffff8f475f230188
Sep 01 11:01:12 starbase-375 kernel: RBP: ffffd37387407a70 R08: 0000000000000000 R09: 0000000000000000
Sep 01 11:01:12 starbase-375 kernel: R10: 0000000000000000 R11: 0000000000000008 R12: 0000000000000000
Sep 01 11:01:12 starbase-375 kernel: R13: 0000000000000001 R14: ffffffffc063c8c8 R15: ffffffffc063c8c8
Sep 01 11:01:12 starbase-375 kernel: FS: 0000770845e52240(0000) GS:ffff8f4aedf8e000(0000) knlGS:0000000000000000
Sep 01 11:01:12 starbase-375 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Sep 01 11:01:12 starbase-375 kernel: CR2: ffff8f4aedf8e018 CR3: 000000010a4be001 CR4: 00000000003726f0
Sep 01 11:01:12 starbase-375 kernel: note: task UPID:starb[2011] exited with irqs disabled
Sep 01 11:01:14 starbase-375 pvesh[2008]: Starting VM 100 failed: unexpected status
I've also replicated the same oops on that machine with earlier patches of 7.0.14 and with 7.0.6-2-pve. The bug can also be reliably triggered by manually unbinding the adapter from the host.
I've attempted some investigating with the assistance of ChatGPT, which has suggested that there has been a change in aacraid unbind behaviour in 7.0 - it flagged a patch `scsi: aacraid: Fix reply queue mapping to CPUs based on IRQ affinity` from June 2025 as a possible cause, but wasn't able to determine that definitively.
For now I have pinned the kernel to 6.17 on that machine as passthrough is working with that hardware/kernel combination. I do have another (much newer) machine which does passthrough an Adaptec ASR-72405 HBA under 7.0.14 successfully, so there does seem to be some additional factors that trigger this bug