From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp.codeaurora.org by pdx-caf-mail.web.codeaurora.org (Dovecot) with LMTP id DsHBKHLbGVtEBAAAmS7hNA ; Fri, 08 Jun 2018 01:27:14 +0000 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 878F76089E; Fri, 8 Jun 2018 01:27:14 +0000 (UTC) Authentication-Results: smtp.codeaurora.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="MaMrZoMW" X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on pdx-caf-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI autolearn=ham autolearn_force=no version=3.4.0 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by smtp.codeaurora.org (Postfix) with ESMTP id 95680601B4; Fri, 8 Jun 2018 01:27:13 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 95680601B4 Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752618AbeFHB1L (ORCPT + 25 others); Thu, 7 Jun 2018 21:27:11 -0400 Received: from mail-pf0-f196.google.com ([209.85.192.196]:41634 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752385AbeFHB1K (ORCPT ); Thu, 7 Jun 2018 21:27:10 -0400 Received: by mail-pf0-f196.google.com with SMTP id a11-v6so5773086pff.8 for ; Thu, 07 Jun 2018 18:27:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding; bh=wjAdVNBA2U5x1PjU5dbhZ6vgJ8C6ILcAyewR0BZUWyM=; b=MaMrZoMWnbP63FR7slPYXAIh5sfPhVd0SIkIxM3xPUIkytLgKxhmQ7nDmrwBFeT10P fA6zbl8p3mUXA853Uy5Rv1Xv02pl3cauGmyDaor5Bdgl9nDWmj1gUp0maxlYsMRAhaZP Ra2UH/hrSDqfD0yDx1ksZimR+Dhpi1zkI+Gk9J+7YbWBjS97jLGZ0E5S7KSq+L6I1bfQ Z/hPMVWS7ts2IZ7wtYhTgHiZPVqGfOn1QCJxVmoHEY4BNYY0cXNjCCj1vD/MNYupB1X5 Drk6EtuINI6R+8dK7hdL951fVFODcQ5sg5opHZ4KV2Sbgc855vyTxdWepjVliX0JTnaL rXHQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=wjAdVNBA2U5x1PjU5dbhZ6vgJ8C6ILcAyewR0BZUWyM=; b=BvypYGe+Sb1n71zYj9zMonGCIHsmHEDJ1JESeMJRu6AVp8AKaDs5PRwFf2Gzc/Kgq0 cboluU0qBHyRzU17eCHoR/fFWAxIFcnOaWBUQuDh75S8Kc0BgEdBuH95Bl3wiux3Bpoe Q4fG2gyLmXsddSZuksF4cZmkhQhkJpyZUAN9VejnlfEYdxsqlM9sAwUEB+knn08JAYmK KNvYUHwJNibkrsQ3MQNuNVAB3q7qTc0pHTEmCdQlz6ZC4MPO9isSiaW4OVpoMqh6zOHc 19gDWX8Ho82WtLkhs7UjX0oB+FGMpBi71ovA6xot2BldOgXdNgyw0dcPbVwxPYyW8WPh cj7g== X-Gm-Message-State: APt69E1FPQR5tgTbSSaMra2tr13ptkNjNMyDjbtAccrB4jLpamrM7I9m FH7uGnezIY4htlJDiITaR/M= X-Google-Smtp-Source: ADUXVKL0Jhf9LhPReMvPhilQ2Pg+All0ve4+7ffG9RjpJYyP+DmWPADUSNYyHdmL+enBGynrB2elyg== X-Received: by 2002:a65:4d47:: with SMTP id j7-v6mr3395760pgt.19.1528421229668; Thu, 07 Jun 2018 18:27:09 -0700 (PDT) Received: from [0.0.0.0] (67.216.217.169.16clouds.com. [67.216.217.169]) by smtp.gmail.com with ESMTPSA id e1-v6sm18790351pgt.71.2018.06.07.18.27.05 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 07 Jun 2018 18:27:09 -0700 (PDT) Subject: Re: [PATCH v2 1/2] KVM: arm/arm64: add WARN_ON if size is not PAGE_SIZE aligned in unmap_stage2_range To: Christoffer Dall , Marc Zyngier , linux-arm-kernel@lists.infradead.org, kvmarm@lists.cs.columbia.edu Cc: Suzuki.Poulose@arm.com, linux-kernel@vger.kernel.org, jia.he@hxt-semitech.com References: <1526635630-18917-1-git-send-email-hejianet@gmail.com> From: Jia He Message-ID: Date: Fri, 8 Jun 2018 09:27:02 +0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.8.0 MIME-Version: 1.0 In-Reply-To: <1526635630-18917-1-git-send-email-hejianet@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Pingļ¼Œthanks -- Cheers, Jia On 5/18/2018 5:27 PM, Jia He Wrote: > There is a panic in armv8a server(QDF2400) under memory pressure tests > (start 20 guests and run memhog in the host). > > ---------------------------------begin-------------------------------- > [35380.800950] BUG: Bad page state in process qemu-kvm pfn:dd0b6 > [35380.805825] page:ffff7fe003742d80 count:-4871 mapcount:-2126053375 > mapping: (null) index:0x0 > [35380.815024] flags: 0x1fffc00000000000() > [35380.818845] raw: 1fffc00000000000 0000000000000000 0000000000000000 > ffffecf981470000 > [35380.826569] raw: dead000000000100 dead000000000200 ffff8017c001c000 > 0000000000000000 > [35380.805825] page:ffff7fe003742d80 count:-4871 mapcount:-2126053375 > mapping: (null) index:0x0 > [35380.815024] flags: 0x1fffc00000000000() > [35380.818845] raw: 1fffc00000000000 0000000000000000 0000000000000000 > ffffecf981470000 > [35380.826569] raw: dead000000000100 dead000000000200 ffff8017c001c000 > 0000000000000000 > [35380.834294] page dumped because: nonzero _refcount > [35380.839069] Modules linked in: vhost_net vhost tap ebtable_filter > ebtables ip6table_filter ip6_tables iptable_filter fcoe libfcoe libfc > 8021q garp mrp stp llc scsi_transport_fc openvswitch nf_conntrack_ipv6 > nf_nat_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_defrag_ipv6 > nf_nat nf_conntrack vfat fat rpcrdma ib_isert iscsi_target_mod ib_iser > libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp > scsi_transport_srp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm > ib_cm iw_cm mlx5_ib ib_core crc32_ce ipmi_ssif tpm_tis tpm_tis_core sg > nfsd auth_rpcgss nfs_acl lockd grace sunrpc dm_multipath ip_tables xfs > libcrc32c mlx5_core mlxfw devlink ahci_platform libahci_platform libahci > qcom_emac sdhci_acpi sdhci hdma mmc_core hdma_mgmt i2c_qup dm_mirror > dm_region_hash dm_log dm_mod > [35380.908341] CPU: 29 PID: 18323 Comm: qemu-kvm Tainted: G W > 4.14.15-5.hxt.aarch64 #1 > [35380.917107] Hardware name: > [35380.930909] Call trace: > [35380.933345] [] dump_backtrace+0x0/0x22c > [35380.938723] [] show_stack+0x24/0x2c > [35380.943759] [] dump_stack+0x8c/0xb0 > [35380.948794] [] bad_page+0xf4/0x154 > [35380.953740] [] free_pages_check_bad+0x90/0x9c > [35380.959642] [] free_pcppages_bulk+0x464/0x518 > [35380.965545] [] free_hot_cold_page+0x22c/0x300 > [35380.971448] [] __put_page+0x54/0x60 > [35380.976484] [] unmap_stage2_range+0x170/0x2b4 > [35380.982385] [] kvm_unmap_hva_handler+0x30/0x40 > [35380.988375] [] handle_hva_to_gpa+0xb0/0xec > [35380.994016] [] kvm_unmap_hva_range+0x5c/0xd0 > [35380.999833] [] > kvm_mmu_notifier_invalidate_range_start+0x60/0xb0 > [35381.007387] [] > __mmu_notifier_invalidate_range_start+0x64/0x8c > [35381.014765] [] try_to_unmap_one+0x78c/0x7a4 > [35381.020493] [] rmap_walk_ksm+0x124/0x1a0 > [35381.025961] [] rmap_walk+0x94/0x98 > [35381.030909] [] try_to_unmap+0x100/0x124 > [35381.036293] [] unmap_and_move+0x480/0x6fc > [35381.041847] [] migrate_pages+0x10c/0x288 > [35381.047318] [] compact_zone+0x238/0x954 > [35381.052697] [] compact_zone_order+0xc4/0xe8 > [35381.058427] [] try_to_compact_pages+0x160/0x294 > [35381.064503] [] > __alloc_pages_direct_compact+0x68/0x194 > [35381.071187] [] __alloc_pages_nodemask+0xc20/0xf7c > [35381.077437] [] alloc_pages_vma+0x1a4/0x1c0 > [35381.083080] [] > do_huge_pmd_anonymous_page+0x128/0x324 > [35381.089677] [] __handle_mm_fault+0x71c/0x7e8 > [35381.095492] [] handle_mm_fault+0xf8/0x194 > [35381.101049] [] __get_user_pages+0x124/0x34c > [35381.106777] [] populate_vma_page_range+0x90/0x9c > [35381.112941] [] __mm_populate+0xc4/0x15c > [35381.118322] [] SyS_mlockall+0x100/0x164 > [35381.123705] Exception stack(0xffff800dce5f3ec0 to 0xffff800dce5f4000) > [35381.130128] 3ec0: 0000000000000003 d6e6024cc9b87e00 0000aaaabe94f000 > 0000000000000000 > [35381.137940] 3ee0: 0000000000000002 0000000000000000 0000000000000000 > 0000aaaacf6fc3c0 > [35381.145753] 3f00: 00000000000000e6 0000aaaacf6fc490 0000ffffeeeab0f0 > d6e6024cc9b87e00 > [35381.153565] 3f20: 0000000000000000 0000aaaabe81b3c0 0000000000000020 > 00009e53eff806b5 > [35381.161379] 3f40: 0000aaaabe94de48 0000ffffa7c269b0 0000000000000011 > 0000ffffeeeabf68 > [35381.169190] 3f60: 0000aaaaceacfe60 0000aaaabe94f000 0000aaaabe9ba358 > 0000aaaabe7ffb80 > [35381.177003] 3f80: 0000aaaabe9ba000 0000aaaabe959f64 0000000000000000 > 0000aaaabe94f000 > [35381.184815] 3fa0: 0000000000000000 0000ffffeeeabdb0 0000aaaabe5f3bf8 > 0000ffffeeeabdb0 > [35381.192628] 3fc0: 0000ffffa7c269b8 0000000060000000 0000000000000003 > 00000000000000e6 > [35381.200440] 3fe0: 0000000000000000 0000000000000000 0000000000000000 > 0000000000000000 > [35381.208254] [] __sys_trace_return+0x0/0x4 > [35381.213809] Disabling lock debugging due to kernel taint > --------------------------------end-------------------------------------- > > The root cause might be what I fixed at [1]. But from arm kvm points of > view, it would be better we caught the exception earlier and clearer. > > If the size is not PAGE_SIZE aligned, unmap_stage2_range might unmap the > wrong(more or less) page range. Hence it caused the "BUG: Bad page > state" > > [1] https://lkml.org/lkml/2018/5/3/1042 > > Signed-off-by: jia.he@hxt-semitech.com > Reviewed-by: Suzuki K Poulose > --- > v2: refine the commit log > > virt/kvm/arm/mmu.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c > index 7f6a944..8dac311 100644 > --- a/virt/kvm/arm/mmu.c > +++ b/virt/kvm/arm/mmu.c > @@ -297,6 +297,8 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size) > phys_addr_t next; > > assert_spin_locked(&kvm->mmu_lock); > + WARN_ON(size & ~PAGE_MASK); > + > pgd = kvm->arch.pgd + stage2_pgd_index(addr); > do { > /* > From mboxrd@z Thu Jan 1 00:00:00 1970 From: hejianet@gmail.com (Jia He) Date: Fri, 8 Jun 2018 09:27:02 +0800 Subject: [PATCH v2 1/2] KVM: arm/arm64: add WARN_ON if size is not PAGE_SIZE aligned in unmap_stage2_range In-Reply-To: <1526635630-18917-1-git-send-email-hejianet@gmail.com> References: <1526635630-18917-1-git-send-email-hejianet@gmail.com> Message-ID: To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org Ping?thanks -- Cheers, Jia On 5/18/2018 5:27 PM, Jia He Wrote: > There is a panic in armv8a server(QDF2400) under memory pressure tests > (start 20 guests and run memhog in the host). > > ---------------------------------begin-------------------------------- > [35380.800950] BUG: Bad page state in process qemu-kvm pfn:dd0b6 > [35380.805825] page:ffff7fe003742d80 count:-4871 mapcount:-2126053375 > mapping: (null) index:0x0 > [35380.815024] flags: 0x1fffc00000000000() > [35380.818845] raw: 1fffc00000000000 0000000000000000 0000000000000000 > ffffecf981470000 > [35380.826569] raw: dead000000000100 dead000000000200 ffff8017c001c000 > 0000000000000000 > [35380.805825] page:ffff7fe003742d80 count:-4871 mapcount:-2126053375 > mapping: (null) index:0x0 > [35380.815024] flags: 0x1fffc00000000000() > [35380.818845] raw: 1fffc00000000000 0000000000000000 0000000000000000 > ffffecf981470000 > [35380.826569] raw: dead000000000100 dead000000000200 ffff8017c001c000 > 0000000000000000 > [35380.834294] page dumped because: nonzero _refcount > [35380.839069] Modules linked in: vhost_net vhost tap ebtable_filter > ebtables ip6table_filter ip6_tables iptable_filter fcoe libfcoe libfc > 8021q garp mrp stp llc scsi_transport_fc openvswitch nf_conntrack_ipv6 > nf_nat_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_defrag_ipv6 > nf_nat nf_conntrack vfat fat rpcrdma ib_isert iscsi_target_mod ib_iser > libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp > scsi_transport_srp ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm > ib_cm iw_cm mlx5_ib ib_core crc32_ce ipmi_ssif tpm_tis tpm_tis_core sg > nfsd auth_rpcgss nfs_acl lockd grace sunrpc dm_multipath ip_tables xfs > libcrc32c mlx5_core mlxfw devlink ahci_platform libahci_platform libahci > qcom_emac sdhci_acpi sdhci hdma mmc_core hdma_mgmt i2c_qup dm_mirror > dm_region_hash dm_log dm_mod > [35380.908341] CPU: 29 PID: 18323 Comm: qemu-kvm Tainted: G W > 4.14.15-5.hxt.aarch64 #1 > [35380.917107] Hardware name: > [35380.930909] Call trace: > [35380.933345] [] dump_backtrace+0x0/0x22c > [35380.938723] [] show_stack+0x24/0x2c > [35380.943759] [] dump_stack+0x8c/0xb0 > [35380.948794] [] bad_page+0xf4/0x154 > [35380.953740] [] free_pages_check_bad+0x90/0x9c > [35380.959642] [] free_pcppages_bulk+0x464/0x518 > [35380.965545] [] free_hot_cold_page+0x22c/0x300 > [35380.971448] [] __put_page+0x54/0x60 > [35380.976484] [] unmap_stage2_range+0x170/0x2b4 > [35380.982385] [] kvm_unmap_hva_handler+0x30/0x40 > [35380.988375] [] handle_hva_to_gpa+0xb0/0xec > [35380.994016] [] kvm_unmap_hva_range+0x5c/0xd0 > [35380.999833] [] > kvm_mmu_notifier_invalidate_range_start+0x60/0xb0 > [35381.007387] [] > __mmu_notifier_invalidate_range_start+0x64/0x8c > [35381.014765] [] try_to_unmap_one+0x78c/0x7a4 > [35381.020493] [] rmap_walk_ksm+0x124/0x1a0 > [35381.025961] [] rmap_walk+0x94/0x98 > [35381.030909] [] try_to_unmap+0x100/0x124 > [35381.036293] [] unmap_and_move+0x480/0x6fc > [35381.041847] [] migrate_pages+0x10c/0x288 > [35381.047318] [] compact_zone+0x238/0x954 > [35381.052697] [] compact_zone_order+0xc4/0xe8 > [35381.058427] [] try_to_compact_pages+0x160/0x294 > [35381.064503] [] > __alloc_pages_direct_compact+0x68/0x194 > [35381.071187] [] __alloc_pages_nodemask+0xc20/0xf7c > [35381.077437] [] alloc_pages_vma+0x1a4/0x1c0 > [35381.083080] [] > do_huge_pmd_anonymous_page+0x128/0x324 > [35381.089677] [] __handle_mm_fault+0x71c/0x7e8 > [35381.095492] [] handle_mm_fault+0xf8/0x194 > [35381.101049] [] __get_user_pages+0x124/0x34c > [35381.106777] [] populate_vma_page_range+0x90/0x9c > [35381.112941] [] __mm_populate+0xc4/0x15c > [35381.118322] [] SyS_mlockall+0x100/0x164 > [35381.123705] Exception stack(0xffff800dce5f3ec0 to 0xffff800dce5f4000) > [35381.130128] 3ec0: 0000000000000003 d6e6024cc9b87e00 0000aaaabe94f000 > 0000000000000000 > [35381.137940] 3ee0: 0000000000000002 0000000000000000 0000000000000000 > 0000aaaacf6fc3c0 > [35381.145753] 3f00: 00000000000000e6 0000aaaacf6fc490 0000ffffeeeab0f0 > d6e6024cc9b87e00 > [35381.153565] 3f20: 0000000000000000 0000aaaabe81b3c0 0000000000000020 > 00009e53eff806b5 > [35381.161379] 3f40: 0000aaaabe94de48 0000ffffa7c269b0 0000000000000011 > 0000ffffeeeabf68 > [35381.169190] 3f60: 0000aaaaceacfe60 0000aaaabe94f000 0000aaaabe9ba358 > 0000aaaabe7ffb80 > [35381.177003] 3f80: 0000aaaabe9ba000 0000aaaabe959f64 0000000000000000 > 0000aaaabe94f000 > [35381.184815] 3fa0: 0000000000000000 0000ffffeeeabdb0 0000aaaabe5f3bf8 > 0000ffffeeeabdb0 > [35381.192628] 3fc0: 0000ffffa7c269b8 0000000060000000 0000000000000003 > 00000000000000e6 > [35381.200440] 3fe0: 0000000000000000 0000000000000000 0000000000000000 > 0000000000000000 > [35381.208254] [] __sys_trace_return+0x0/0x4 > [35381.213809] Disabling lock debugging due to kernel taint > --------------------------------end-------------------------------------- > > The root cause might be what I fixed at [1]. But from arm kvm points of > view, it would be better we caught the exception earlier and clearer. > > If the size is not PAGE_SIZE aligned, unmap_stage2_range might unmap the > wrong(more or less) page range. Hence it caused the "BUG: Bad page > state" > > [1] https://lkml.org/lkml/2018/5/3/1042 > > Signed-off-by: jia.he at hxt-semitech.com > Reviewed-by: Suzuki K Poulose > --- > v2: refine the commit log > > virt/kvm/arm/mmu.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c > index 7f6a944..8dac311 100644 > --- a/virt/kvm/arm/mmu.c > +++ b/virt/kvm/arm/mmu.c > @@ -297,6 +297,8 @@ static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size) > phys_addr_t next; > > assert_spin_locked(&kvm->mmu_lock); > + WARN_ON(size & ~PAGE_MASK); > + > pgd = kvm->arch.pgd + stage2_pgd_index(addr); > do { > /* >