From mboxrd@z Thu Jan  1 00:00:00 1970
From: Huang Ying <ying.huang@intel.com>
Subject: Re: [PATCH] QEMU-KVM: MCE: Relay UCR MCE to guest
Date: Tue, 08 Sep 2009 14:46:53 +0800
Message-ID: <1252392413.14648.982.camel@yhuang-dev.sh.intel.com>
References: <1252312353.14648.731.camel@yhuang-dev.sh.intel.com>
	 <4AA57187.5020502@us.ibm.com>  <4AA5FC81.7040802@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Cc: Anthony Liguori <aliguori@us.ibm.com>,
	Andi Kleen <andi@firstfloor.org>,
	"kvm@vger.kernel.org" <kvm@vger.kernel.org>
To: Avi Kivity <avi@redhat.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mga01.intel.com ([192.55.52.88]:18645 "EHLO mga01.intel.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1753467AbZIHGqw (ORCPT <rfc822;kvm@vger.kernel.org>);
	Tue, 8 Sep 2009 02:46:52 -0400
In-Reply-To: <4AA5FC81.7040802@redhat.com>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

On Tue, 2009-09-08 at 14:41 +0800, Avi Kivity wrote: 
> On 09/07/2009 11:48 PM, Anthony Liguori wrote:
> >
> >>  #ifdef KVM_CAP_IRQCHIP
> >>
> >>  int kvm_set_irq_level(kvm_context_t kvm, int irq, int level, int 
> >> *status)
> >> @@ -1515,6 +1546,38 @@ static void sig_ipi_handler(int n)
> >>  {
> >>  }
> >>
> >> +static void sigbus_handler(int n, struct signalfd_siginfo *siginfo, 
> >> void *ctx)
> >> +{
> >> +    if (siginfo->ssi_code == BUS_MCEERR_AO) {
> >> +        uint64_t status;
> >> +        unsigned long paddr;
> >> +        CPUState *cenv;
> >> +
> >> +        /* Hope we are lucky for AO MCE */
> >
> > Even if the error was limited to guest memory, it could have been 
> > generated by either the kernel or userspace reading guest memory, no?
> >
> > Does this potentially open a security hole for us?  Consider the 
> > following:
> >
> > 1) We happen to read guest memory and that causes an MCE.  For 
> > instance, say we're in virtio.c and we read the virtio ring.
> > 2) That should trigger the kernel to generate a sigbus.
> > 3) We catch sigbus, and queue an MCE for delivery.
> > 4) After sigbus handler completes, we're back in virtio.c, what was 
> > the value of the memory operation we just completed?
> >
> > If the instruction gets skipped, we may be leaking host memory because 
> > the access never happened.
> >
> 
> I think it's a lot safer to only report guest mode accesses to the 
> guest, and let user mode accesses terminate qemu.  The guest wouldn't 
> expect 100% recovery; for example if an uncorrectable error hit a vital 
> kernel data structure.

Yes, this is the current behavior. If MCE is caused by user mode
accessing, the KVM will be killed by force_sig_info, only MCE caused by
guest mode accessing will be captured by SIGBUS signal handler.

Best Regards,
Huang Ying