From: "Eugenio Pérez" <eperezma@redhat.com>
To: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>,
"virtualization@lists.linux-foundation.org"
<virtualization@lists.linux-foundation.org>,
Stephen Rothwell <sfr@canb.auug.org.au>,
Linux Next Mailing List <linux-next@vger.kernel.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
kvm list <kvm@vger.kernel.org>, Halil Pasic <pasic@linux.ibm.com>,
Cornelia Huck <cohuck@redhat.com>
Subject: Re: vhost changes (batched) in linux-next after 12/13 trigger random crashes in KVM guests after reboot
Date: Thu, 13 Feb 2020 11:47:23 +0100 [thread overview]
Message-ID: <2364d0728c3bb4bcc0c13b591f774109a9274a30.camel@redhat.com> (raw)
In-Reply-To: <8fbbfb49-99d1-7fee-e713-d6d5790fe866@de.ibm.com>
On Thu, 2020-02-13 at 10:30 +0100, Christian Borntraeger wrote:
>
> On 12.02.20 17:34, Eugenio Pérez wrote:
> > On Tue, 2020-02-11 at 14:13 +0100, Christian Borntraeger wrote:
> > > On 11.02.20 14:04, Eugenio Pérez wrote:
> > > > On Mon, 2020-02-10 at 12:01 +0100, Christian Borntraeger wrote:
> > > > > On 10.02.20 10:47, Eugenio Perez Martin wrote:
> > > > > > Hi Christian.
> > > > > >
> > > > > > I'm not able to reproduce the failure with eccb852f1fe6bede630e2e4f1a121a81e34354ab commit. Could you add
> > > > > > more
> > > > > > data?
> > > > > > Your configuration (libvirt or qemu line), and host's dmesg output if any?
> > > > > >
> > > > > > Thanks!
> > > > >
> > > > > If it was not obvious, this is on s390x, a big endian system.
> > > > >
> > > >
> > > > Hi Christian. Thank you very much for your fast responses.
> > > >
> > > > Could you try this patch on top of eccb852f1fe6bede630e2e4f1a121a81e34354ab?
> > >
> > > I still get
> > > [ 43.665145] Guest moved used index from 0 to 289
> > > after some reboots.
> > >
> > >
> > > > Thanks!
> > > >
> > > > From 71d0f9108a18aa894cc0c0c1c7efbad39f465a27 Mon Sep 17 00:00:00 2001
> > > > From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <
> > > > eperezma@redhat.com>
> > > > Date: Tue, 11 Feb 2020 13:19:10 +0100
> > > > Subject: [PATCH] vhost: fix return value of vhost_get_vq_desc
> > > >
> > > > Before of the batch change, it was the chain's head. Need to keep that
> > > > way or we will not be able to free a chain of descriptors.
> > > >
> > > > Fixes: eccb852f1fe6 ("vhost: batching fetches")
> > > > ---
> > > > drivers/vhost/vhost.c | 3 +--
> > > > 1 file changed, 1 insertion(+), 2 deletions(-)
> > > >
> > > > diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
> > > > index b5a51b1f2e79..fc422c3e5c08 100644
> > > > --- a/drivers/vhost/vhost.c
> > > > +++ b/drivers/vhost/vhost.c
> > > > @@ -2409,12 +2409,11 @@ int vhost_get_vq_desc(struct vhost_virtqueue *vq,
> > > > *out_num += ret;
> > > > }
> > > >
> > > > - ret = desc->id;
> > > > -
> > > > if (!(desc->flags & VRING_DESC_F_NEXT))
> > > > break;
> > > > }
> > > >
> > > > + ret = vq->descs[vq->first_desc].id;
> > > > vq->first_desc = i + 1;
> > > >
> > > > return ret;
> > > >
> >
> > Sorry, still not able to reproduce the issue.
> >
> > Could we try to disable all the vhost features?
> >
> > Thanks!
> >
> > diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
> > index 661088ae6dc7..08f6d2ccb697 100644
> > --- a/drivers/vhost/vhost.h
> > +++ b/drivers/vhost/vhost.h
> > @@ -250,11 +250,11 @@ int vhost_init_device_iotlb(struct vhost_dev *d, bool enabled);
> > } while (0)
> >
> > enum {
> > - VHOST_FEATURES = (1ULL << VIRTIO_F_NOTIFY_ON_EMPTY) |
> > - (1ULL << VIRTIO_RING_F_INDIRECT_DESC) |
> > - (1ULL << VIRTIO_RING_F_EVENT_IDX) |
> > - (1ULL << VHOST_F_LOG_ALL) |
> > - (1ULL << VIRTIO_F_ANY_LAYOUT) |
> > + VHOST_FEATURES = /* (1ULL << VIRTIO_F_NOTIFY_ON_EMPTY) | */
> > + /* (1ULL << VIRTIO_RING_F_INDIRECT_DESC) | */
> > + /* (1ULL << VIRTIO_RING_F_EVENT_IDX) | */
> > + /* (1ULL << VHOST_F_LOG_ALL) | */
> > + /* (1ULL << VIRTIO_F_ANY_LAYOUT) | */
> > (1ULL << VIRTIO_F_VERSION_1)
> > };
> >
>
> I still get guest crashes with this on top of eccb852f1fe6. (The patch did not
> apply, I had to manually comment out these things)
>
Sorry about that, I C&P transformed tabs to spaces.
Can we try tracing last_avail_idx with the attached patch? Can you enable also line and thread id (dyndbg='+plt')?
Thanks!
From f7012e8b9db711b12d36e6e97411e7afa34bf768 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= <eperezma@redhat.com>
Date: Thu, 13 Feb 2020 11:26:06 +0100
Subject: [PATCH] vhost: disable all features and trace last_avail_idx
---
drivers/vhost/vhost.c | 13 +++++++++++--
drivers/vhost/vhost.h | 10 +++++-----
2 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index fc422c3e5c08..021d70bed015 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1645,6 +1645,9 @@ long vhost_vring_ioctl(struct vhost_dev *d, unsigned int ioctl, void __user *arg
vq->last_avail_idx = s.num;
/* Forget the cached index value. */
vq->avail_idx = vq->last_avail_idx;
+ pr_debug(
+ "VHOST_SET_VRING_BASE [vq=%p][vq->last_avail_idx=%u][vq->avail_idx=%u]",
+ vq, vq->last_avail_idx, vq->avail_idx);
break;
case VHOST_GET_VRING_BASE:
s.index = idx;
@@ -2239,8 +2242,8 @@ static int fetch_buf(struct vhost_virtqueue *vq)
vq->avail_idx = vhost16_to_cpu(vq, avail_idx);
if (unlikely((u16)(vq->avail_idx - last_avail_idx) > vq->num)) {
- vq_err(vq, "Guest moved used index from %u to %u",
- last_avail_idx, vq->avail_idx);
+ vq_err(vq, "Guest moved vq %p used index from %u to %u",
+ vq, last_avail_idx, vq->avail_idx);
return -EFAULT;
}
@@ -2316,6 +2319,9 @@ static int fetch_buf(struct vhost_virtqueue *vq)
BUG_ON(!(vq->used_flags & VRING_USED_F_NO_NOTIFY));
/* On success, increment avail index. */
+ pr_debug(
+ "[vq=%p][vq->last_avail_idx=%u][vq->avail_idx=%u][vq->ndescs=%d][vq->first_desc=%d]",
+ vq, vq->last_avail_idx, vq->avail_idx, vq->ndescs, vq->first_desc);
vq->last_avail_idx++;
return 0;
@@ -2431,6 +2437,9 @@ EXPORT_SYMBOL_GPL(vhost_get_vq_desc);
/* Reverse the effect of vhost_get_vq_desc. Useful for error handling. */
void vhost_discard_vq_desc(struct vhost_virtqueue *vq, int n)
{
+ pr_debug(
+ "DISCARD [vq=%p][vq->last_avail_idx=%u][vq->avail_idx=%u][n=%d]",
+ vq, vq->last_avail_idx, vq->avail_idx, n);
vq->last_avail_idx -= n;
}
EXPORT_SYMBOL_GPL(vhost_discard_vq_desc);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 661088ae6dc7..08f6d2ccb697 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -250,11 +250,11 @@ int vhost_init_device_iotlb(struct vhost_dev *d, bool enabled);
} while (0)
enum {
- VHOST_FEATURES = (1ULL << VIRTIO_F_NOTIFY_ON_EMPTY) |
- (1ULL << VIRTIO_RING_F_INDIRECT_DESC) |
- (1ULL << VIRTIO_RING_F_EVENT_IDX) |
- (1ULL << VHOST_F_LOG_ALL) |
- (1ULL << VIRTIO_F_ANY_LAYOUT) |
+ VHOST_FEATURES = /* (1ULL << VIRTIO_F_NOTIFY_ON_EMPTY) | */
+ /* (1ULL << VIRTIO_RING_F_INDIRECT_DESC) | */
+ /* (1ULL << VIRTIO_RING_F_EVENT_IDX) | */
+ /* (1ULL << VHOST_F_LOG_ALL) | */
+ /* (1ULL << VIRTIO_F_ANY_LAYOUT) | */
(1ULL << VIRTIO_F_VERSION_1)
};
--
2.18.1
next prev parent reply other threads:[~2020-02-13 10:47 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-12-18 14:43 vhost changes (batched) in linux-next after 12/13 trigger random crashes in KVM guests after reboot Christian Borntraeger
2019-12-18 15:10 ` Michael S. Tsirkin
2019-12-18 15:59 ` Christian Borntraeger
2020-01-06 10:50 ` Michael S. Tsirkin
2020-01-07 8:59 ` Christian Borntraeger
2020-01-07 9:39 ` Michael S. Tsirkin
2020-01-07 11:34 ` Christian Borntraeger
2020-01-07 11:47 ` Michael S. Tsirkin
2020-01-07 11:55 ` Michael S. Tsirkin
2020-01-07 12:16 ` Christian Borntraeger
2020-01-20 6:27 ` Michael S. Tsirkin
2020-01-22 19:32 ` Christian Borntraeger
2020-02-06 14:22 ` eperezma
2020-02-06 15:12 ` Christian Borntraeger
2020-02-06 22:17 ` Michael S. Tsirkin
2020-02-07 7:47 ` Christian Borntraeger
2020-02-07 7:58 ` Michael S. Tsirkin
2020-02-07 8:13 ` Christian Borntraeger
2020-02-07 8:53 ` Cornelia Huck
2020-02-07 10:07 ` Michael S. Tsirkin
[not found] ` <CAJaqyWfngzP4d01B6+Sqt8FXN6jX7kGegjx8ie4no_1Er3igQA@mail.gmail.com>
2020-02-10 10:09 ` Christian Borntraeger
2020-02-10 11:01 ` Christian Borntraeger
2020-02-11 9:33 ` Eugenio Pérez
2020-02-11 9:56 ` Christian Borntraeger
2020-02-11 10:07 ` Christian Borntraeger
2020-02-11 13:04 ` Eugenio Pérez
2020-02-11 13:13 ` Christian Borntraeger
2020-02-12 16:34 ` Eugenio Pérez
2020-02-13 9:30 ` Christian Borntraeger
2020-02-13 10:47 ` Eugenio Pérez [this message]
2020-02-13 13:09 ` Christian Borntraeger
2020-02-13 16:29 ` Eugenio Pérez
2020-02-13 16:32 ` Christian Borntraeger
2020-02-14 7:06 ` Eugenio Pérez
2020-02-14 7:33 ` Christian Borntraeger
2020-02-14 7:40 ` Eugenio Perez Martin
2020-02-14 7:43 ` Christian Borntraeger
2020-02-14 7:47 ` Christian Borntraeger
2020-02-14 12:17 ` Eugenio Pérez
2020-02-14 12:22 ` Christian Borntraeger
2020-02-14 12:26 ` Eugenio Pérez
2020-02-14 12:34 ` Christian Borntraeger
2020-03-27 11:08 ` Eugenio Pérez
2020-03-27 15:46 ` Christian Borntraeger
2020-02-11 13:57 ` Michael S. Tsirkin
2020-03-27 8:03 ` Eugenio Perez Martin
2020-02-06 22:07 ` Michael S. Tsirkin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2364d0728c3bb4bcc0c13b591f774109a9274a30.camel@redhat.com \
--to=eperezma@redhat.com \
--cc=borntraeger@de.ibm.com \
--cc=cohuck@redhat.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-next@vger.kernel.org \
--cc=mst@redhat.com \
--cc=pasic@linux.ibm.com \
--cc=sfr@canb.auug.org.au \
--cc=virtualization@lists.linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).