lkml.org 
[lkml]   [2010]   [Apr]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 2/2] KVM, Fix QEMU-KVM is killed by guest SRAO MCE
(please copy kvm@vger.kernel.org on kvm patches)


On 04/27/2010 10:04 AM, Huang Ying wrote:
> In common cases, guest SRAO MCE will cause corresponding poisoned page
> be un-mapped and SIGBUS be sent to QEMU-KVM, then QEMU-KVM will relay
> the MCE to guest OS.
>
> But it is reported that if the poisoned page is accessed in guest
> after un-mapped and before MCE is relayed to guest OS, QEMU-KVM will
> be killed.
>
> The reason is as follow. Because poisoned page has been un-mapped,
> guest access will cause guest exit and kvm_mmu_page_fault will be
> called. kvm_mmu_page_fault can not get the poisoned page for fault
> address, so kernel and user space MMIO processing is tried in turn. In
> user MMIO processing, poisoned page is accessed again, then QEMU-KVM
> is killed by force_sig_info.
>
> To fix the bug, kvm_mmu_page_fault send HWPOISON signal to QEMU-KVM
> and do not try kernel and user space MMIO processing for poisoned
> page.
>
>
>
> --- a/arch/x86/kvm/mmu.c
> +++ b/arch/x86/kvm/mmu.c
> @@ -32,6 +32,7 @@
> #include<linux/compiler.h>
> #include<linux/srcu.h>
> #include<linux/slab.h>
> +#include<linux/uaccess.h>
>
> #include<asm/page.h>
> #include<asm/cmpxchg.h>
> @@ -1972,6 +1973,17 @@ static int __direct_map(struct kvm_vcpu
> return pt_write;
> }
>
> +static void kvm_send_hwpoison_signal(struct kvm *kvm, gfn_t gfn)
> +{
> + char buf[1];
> + void __user *hva;
> + int r;
> +
> + /* Touch the page, so send SIGBUS */
> + hva = (void __user *)gfn_to_hva(kvm, gfn);
> + r = copy_from_user(buf, hva, 1);
>

No error check? What will a copy_from_user() of poisoned page expected
to return?

Best to return -EFAULT on failure for consistency.

> +}
> +
> static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, int write, gfn_t gfn)
> {
> int r;
> @@ -1997,7 +2009,11 @@ static int nonpaging_map(struct kvm_vcpu
> /* mmio */
> if (is_error_pfn(pfn)) {
> kvm_release_pfn_clean(pfn);
> - return 1;
> + if (is_hwpoison_pfn(pfn)) {
> + kvm_send_hwpoison_signal(vcpu->kvm, gfn);
> + return 0;
> + } else
> + return 1;
> }
>

This is duplicated several times. Please introduce a kvm_handle_bad_page():

if (is_error_pfn(pfn))
return kvm_handle_bad_page(vcpu->kvm, gfn, pfn);

--
Do not meddle in the internals of kernels, for they are subtle and quick to panic.



\
 
 \ /
  Last update: 2010-04-27 09:51    [W:0.038 / U:3.344 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site