[Xen-devel] [PATCH] unmap broken memory in EPT guest in MCA delayed handler

["Jiang, Yunhong" <yunhong.jiang@xxxxxxxxx>]

unmap broken memory in EPT guest in MCA delayed handler

When a memory owned by EPT guest is broken, we change the P2M type to be broken 
memory type, so that later access from the guest to the broken memory will be 
trapped as EPT violation.

Signed-off-by: Jiang, Yunhong <yunhong.jiang@xxxxxxxxx>
Acked-by: Tim Deegan <Tim.Deegan@xxxxxxxxxx>

diff -r 4c1a0317820b xen/arch/x86/cpu/mcheck/mce.h
--- a/xen/arch/x86/cpu/mcheck/mce.h     Tue Sep 14 00:23:48 2010 +0800
+++ b/xen/arch/x86/cpu/mcheck/mce.h     Tue Sep 14 00:24:36 2010 +0800
@@ -49,6 +49,7 @@ void amd_nonfatal_mcheck_init(struct cpu
 void amd_nonfatal_mcheck_init(struct cpuinfo_x86 *c);
 
 int is_vmce_ready(struct mcinfo_bank *bank, struct domain *d);
+int unmmap_broken_page(struct domain *d, mfn_t mfn, unsigned long gfn);
 
 u64 mce_cap_init(void);
 extern int firstbank;
diff -r 4c1a0317820b xen/arch/x86/cpu/mcheck/mce_intel.c
--- a/xen/arch/x86/cpu/mcheck/mce_intel.c       Tue Sep 14 00:23:48 2010 +0800
+++ b/xen/arch/x86/cpu/mcheck/mce_intel.c       Tue Sep 14 00:24:36 2010 +0800
@@ -654,16 +654,22 @@ static void intel_memerr_dhandler(int bn
             BUG_ON( result->owner == DOMID_COW );
             if ( result->owner != DOMID_XEN ) {
                 d = get_domain_by_id(result->owner);
+                ASSERT(d);
+                gfn = get_gpfn_from_mfn((bank->mc_addr) >> PAGE_SHIFT);
+
                 if ( !is_vmce_ready(bank, d) )
                 {
-                    /* Should not inject vMCE to guest */
-                    if ( d )
-                        put_domain(d);
-                    return;
+                    printk("DOM%d not ready for vMCE\n", d->domain_id);
+                    goto vmce_failed;
                 }
 
-                ASSERT(d);
-                gfn = get_gpfn_from_mfn((bank->mc_addr) >> PAGE_SHIFT);
+                if ( unmmap_broken_page(d, _mfn(mfn), gfn) )
+                {
+                    printk("Unmap broken memory %lx for DOM%d failed\n",
+                            mfn, d->domain_id);
+                    goto vmce_failed;
+                }
+
                 bank->mc_addr =  gfn << PAGE_SHIFT |
                   (bank->mc_addr & (PAGE_SIZE -1 ));
                 if ( fill_vmsr_data(bank, d,
@@ -671,18 +677,15 @@ static void intel_memerr_dhandler(int bn
                 {
                     mce_printk(MCE_QUIET, "Fill vMCE# data for DOM%d "
                       "failed\n", result->owner);
-                    put_domain(d);
-                    domain_crash(d);
-                    return;
+                    goto vmce_failed;
                 }
+
                 /* We will inject vMCE to DOMU*/
                 if ( inject_vmce(d) < 0 )
                 {
                     mce_printk(MCE_QUIET, "inject vMCE to DOM%d"
                       " failed\n", d->domain_id);
-                    put_domain(d);
-                    domain_crash(d);
-                    return;
+                    goto vmce_failed;
                 }
                 /* Impacted domain go on with domain's recovery job
                  * if the domain has its own MCA handler.
@@ -691,6 +694,11 @@ static void intel_memerr_dhandler(int bn
                  */
                 result->result = MCA_RECOVERED;
                 put_domain(d);
+
+                return;
+vmce_failed:
+                put_domain(d);
+                domain_crash(d);
             }
         }
     }
diff -r 4c1a0317820b xen/arch/x86/cpu/mcheck/vmce.c
--- a/xen/arch/x86/cpu/mcheck/vmce.c    Tue Sep 14 00:23:48 2010 +0800
+++ b/xen/arch/x86/cpu/mcheck/vmce.c    Tue Sep 14 00:25:42 2010 +0800
@@ -558,3 +558,51 @@ int is_vmce_ready(struct mcinfo_bank *ba
 
     return 0;
 }
+
+/* It's said some ram is setup as mmio_direct for UC cache attribute */
+#define P2M_UNMAP_TYPES (p2m_to_mask(p2m_ram_rw) \
+                                | p2m_to_mask(p2m_ram_logdirty) \
+                                | p2m_to_mask(p2m_ram_ro)       \
+                                | p2m_to_mask(p2m_mmio_direct))
+
+/*
+ * Currently all CPUs are redenzevous at the MCE softirq handler, no
+ * need to consider paging p2m type
+ * Currently only support HVM guest with EPT paging mode
+ * XXX following situation missed:
+ * PoD, Foreign mapped, Granted, Shared
+ */
+int unmmap_broken_page(struct domain *d, mfn_t mfn, unsigned long gfn)
+{
+    mfn_t r_mfn;
+    struct p2m_domain *p2m;
+    p2m_type_t pt;
+
+    /* Always trust dom0's MCE handler will prevent future access */
+    if ( d == dom0 )
+        return 0;
+
+    if (!mfn_valid(mfn_x(mfn)))
+        return -EINVAL;
+
+    if ( !is_hvm_domain(d) || !paging_mode_hap(d) )
+        return -ENOSYS;
+
+    p2m = p2m_get_hostp2m(d);
+    ASSERT(p2m);
+
+    /* This only happen for PoD memory, which should be handled seperetely */
+    if (gfn > p2m->max_mapped_pfn)
+        return -EINVAL;
+
+    r_mfn = gfn_to_mfn_query(p2m, gfn, &pt);
+    if ( p2m_to_mask(pt) & P2M_UNMAP_TYPES)
+    {
+        ASSERT(mfn_x(r_mfn) == mfn_x(mfn));
+        p2m_change_type(p2m, gfn, pt, p2m_ram_broken);
+        return 0;
+    }
+
+    return -1;
+}
+

mca_handler.patch
Description: mca_handler.patch

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel