[Devel] double faults in Virtuozzo KVM

[Denis Kirjanov]

On Thursday, September 28, 2017, Roman Kagan <rkagan at virtuozzo.com> wrote:

> On Thu, Sep 28, 2017 at 05:55:51PM +0300, Denis Kirjanov wrote:
> > Hi, we're seeing double faults in async_page_fault.
>
> async_page_fault is the #PF handler in KVM guests.  It filters out
> specially crafted #PF's from the host; the rest fall through to the
> regular #PF handler.  So most likely you're seeing genuine #PFs,
> unrelated to virtualization.
>
> > _Some_ of them related to the fact that during the faults RSP points
> > to userspace and it leads to double-fault scenario.
>
> The postmortem you quote doesn't support that.


I'll post a relevant trace

>
> > Is it known problem?
>
> There used to be a bug in async pagefault machinery which caused L0
> hypervisor to inject async pagefaults into L2 guest instead of L1.  This
> must've been fixed in sufficiently recent


Yep, I saw the patch and it's imho about the different thing. The patch
fixes the wrong PF injected to an unrelated guest and thus a guest ends up
with the 'CPU stuck' messages since it can't get the requested page

I'd guess the problem is with your kernel.  Doesn't it reproduce on bare
> metal?
>
>
> > [11587.895394] Hardware name: Virtuozzo KVM, BIOS 1.9.1-5.3.2.vz7.6
> 04/01/2014
> > [11587.895394] task: ffff88020bee0000 ti: ffff880204b60000 task.ti:
> > ffff880204b60000
> > [11587.895394] RIP: 0010:[<ffffffff816a1bdd>]  [<ffffffff816a1bdd>]
> > async_page_fault+0xd/0x30
> > [11587.895394] RSP: 002b:ffff880234f61fd8  EFLAGS: 00010096
> > [11587.895394] RAX: 00000000816a192c RBX: 0000000000000001 RCX:
> ffffffff816a192c
> > [11587.895394] RDX: ffff88023fc03fc0 RSI: 0000000000000000 RDI:
> ffff880234f62098
> > [11587.895394] RBP: ffff880234f62088 R08: ffff88023fbfffc0 R09:
> ffff88003642af00
> > [11587.895394] R10: 0000000000008000 R11: 0000000000000000 R12:
> ffff88023fc04f58
> > [11587.895394] R13: 0000000000000028 R14: 0000000000000000 R15:
> 0000000000000000
> > [11587.895394] FS:  00007ff80ffc1880(0000) GS:ffff88023fc00000(0000)
> > knlGS:0000000000000000
> > [11587.895394] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> > [11587.895394] CR2: ffff880234f61fc8 CR3: 00000000b9436000 CR4:
> 00000000000007f0
> > [11587.895394] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
> 0000000000000000
> > [11587.895394] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7:
> 0000000000000400
> > [11587.895394] Stack:
> > [11587.895394]  0000c7e9e11c7f44 0000270f05836600 906666906666fb02
> > be00000001b9d231
> > [11587.895394]  e8df8948ffffffff 0000000231a6fba8 0001000000000008
> > 0000000000000000
> > [11587.895394]  0002000000000000 0000000000000000 0003000000000000
> > 0000000000000000
> > [11587.895394] Call Trace:
> > [11587.895394] Code: 48 89 e7 48 8b 74 24 78 48 c7 44 24 78 ff ff ff
> > ff e8 78 3d 00 00 e9 33 02 00 00 0f 1f 00 66 66 90 66 66 90 66 66 90
> > 48 83 ec 78 <e8> 7e 01 00 00 48 89 e7 48 8b 74 24 78 48 c7 44 24 78 ff
> > ff ff
> > [11587.895394] RIP  [<ffffffff816a1bdd>] async_page_fault+0xd/0x30
> > [11587.895394]  RSP <ffff880234f61fd8>
>
> Roman.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openvz.org/pipermail/devel/attachments/20170929/2136f1cd/attachment.html>