kvm, MCE, Send SRAR SIGBUS directly

Originally, SRAR SIGBUS is sent to QEMU-KVM via touching the poisoned page. But commit 96054569190bdec375fe824e48ca1f4e3b53dd36 prevents the signal from being sent. So now the signal is sent via force_sig_info_fault directly.

Reported-by Dean Nelson <[email protected]>

Signed-off-by Huang Ying <[email protected]>

---
 arch/x86/include/asm/signal.h |    3 +++
 arch/x86/kvm/mmu.c            |   15 +++------------
 arch/x86/mm/fault.c           |    6 +++---
 3 files changed, 9 insertions(+), 15 deletions(-)

arch/x86/include/asm/signal.h +3 -0

@@ -258,6 +258,9 @@ struct pt_regs;
 
 #define ptrace_signal_deliver(regs, cookie) do { } while (0)
 
+void force_sig_info_fault(int si_signo, int si_code, unsigned long address,
+			  struct task_struct *tsk);
+
 #endif /* __KERNEL__ */
 #endif /* __ASSEMBLY__ */
 

arch/x86/mm/fault.c +3 -3

@@ -158,9 +158,8 @@ is_prefetch(struct pt_regs *regs, unsign
 	return prefetch;
 }
 
-static void
-force_sig_info_fault(int si_signo, int si_code, unsigned long address,
-		     struct task_struct *tsk)
+void force_sig_info_fault(int si_signo, int si_code, unsigned long address,
+			  struct task_struct *tsk)
 {
 	siginfo_t info;
 

@@ -172,6 +171,7 @@ force_sig_info_fault(int si_signo, int s
 
 	force_sig_info(si_signo, &info, tsk);
 }
+EXPORT_SYMBOL_GPL(force_sig_info_fault);
 
 DEFINE_SPINLOCK(pgd_lock);
 LIST_HEAD(pgd_list);

arch/x86/kvm/mmu.c +1 -11

@@ -39,6 +39,7 @@
 #include <asm/cmpxchg.h>
 #include <asm/io.h>
 #include <asm/vmx.h>
+#include <asm/signal.h>
 
 /*
  * When setting this variable to true it enables Two-Dimensional-Paging

@@ -2104,22 +2105,12 @@ static int __direct_map(struct kvm_vcpu
 	return pt_write;
 }
 
-static void kvm_send_hwpoison_signal(struct kvm *kvm, gfn_t gfn)
-{
-	char buf[1];
-	void __user *hva;
-	int r;
-
-	/* Touch the page, so send SIGBUS */
-	hva = (void __user *)gfn_to_hva(kvm, gfn);
-	r = copy_from_user(buf, hva, 1);
-}
-

Quoted 13 lines · Huang Ying

Originally, SRAR SIGBUS is sent to QEMU-KVM via touching the poisoned page. But commit 96054569190bdec375fe824e48ca1f4e3b53dd36 prevents the signal from being sent. So now the signal is sent via force_sig_info_fault directly.

Reported-by Dean Nelson <[email protected]>

Signed-off-by Huang Ying <[email protected]>

---
 arch/x86/include/asm/signal.h |    3 +++
 arch/x86/kvm/mmu.c            |   15 +++------------
 arch/x86/mm/fault.c           |    6 +++---
 3 files changed, 9 insertions(+), 15 deletions(-)

arch/x86/kvm/mmu.c static int __direct_map(struct kvm_vcpu · line 2116

Quoted 10 lines

static int kvm_handle_bad_page(struct kvm *kvm, gfn_t gfn, pfn_t pfn) {

arch/x86/kvm/mmu.c +2 -1

 	kvm_release_pfn_clean(pfn);
 	if (is_hwpoison_pfn(pfn)) {
-		kvm_send_hwpoison_signal(kvm, gfn);
+		force_sig_info_fault(SIGBUS, BUS_MCEERR_AR,
+				     gfn_to_hva(kvm, gfn), current);
 		return 0;
 	} else if (is_fault_pfn(pfn))
 		return -EFAULT;

Better fill siginfo and use force_sig_info, which is already exported.

Quoted 76 lines · Huang Ying

Originally, SRAR SIGBUS is sent to QEMU-KVM via touching the poisoned page. But commit 96054569190bdec375fe824e48ca1f4e3b53dd36 prevents the signal from being sent. So now the signal is sent via force_sig_info_fault directly.

Reported-by Dean Nelson <[email protected]>

Signed-off-by Huang Ying <[email protected]>

---
 arch/x86/include/asm/signal.h |    3 +++
 arch/x86/kvm/mmu.c            |   15 +++------------
 arch/x86/mm/fault.c           |    6 +++---
 3 files changed, 9 insertions(+), 15 deletions(-)

arch/x86/include/asm/signal.h +3 -0

@@ -258,6 +258,9 @@ struct pt_regs;
 
 #define ptrace_signal_deliver(regs, cookie) do { } while (0)
 
+void force_sig_info_fault(int si_signo, int si_code, unsigned long address,
+			  struct task_struct *tsk);
+
 #endif /* __KERNEL__ */
 #endif /* __ASSEMBLY__ */
 

arch/x86/mm/fault.c +3 -3

@@ -158,9 +158,8 @@ is_prefetch(struct pt_regs *regs, unsign
 	return prefetch;
 }
 
-static void
-force_sig_info_fault(int si_signo, int si_code, unsigned long address,
-		     struct task_struct *tsk)
+void force_sig_info_fault(int si_signo, int si_code, unsigned long address,
+			  struct task_struct *tsk)
 {
 	siginfo_t info;
 

@@ -172,6 +171,7 @@ force_sig_info_fault(int si_signo, int s
 
 	force_sig_info(si_signo, &info, tsk);
 }
+EXPORT_SYMBOL_GPL(force_sig_info_fault);
 
 DEFINE_SPINLOCK(pgd_lock);
 LIST_HEAD(pgd_list);

arch/x86/kvm/mmu.c +1 -11

@@ -39,6 +39,7 @@
 #include <asm/cmpxchg.h>
 #include <asm/io.h>
 #include <asm/vmx.h>
+#include <asm/signal.h>
 
 /*
  * When setting this variable to true it enables Two-Dimensional-Paging

@@ -2104,22 +2105,12 @@ static int __direct_map(struct kvm_vcpu
 	return pt_write;
 }
 
-static void kvm_send_hwpoison_signal(struct kvm *kvm, gfn_t gfn)
-{
-	char buf[1];
-	void __user *hva;
-	int r;
-
-	/* Touch the page, so send SIGBUS */
-	hva = (void __user *)gfn_to_hva(kvm, gfn);
-	r = copy_from_user(buf, hva, 1);
-}
-
 static int kvm_handle_bad_page(struct kvm *kvm, gfn_t gfn, pfn_t pfn)
 {
 	kvm_release_pfn_clean(pfn);
 	if (is_hwpoison_pfn(pfn)) {

arch/x86/kvm/mmu.c static int __direct_map(struct kvm_vcpu · line 2116

Quoted 6 lines

arch/x86/kvm/mmu.c +2 -1

-		kvm_send_hwpoison_signal(kvm, gfn);
+		force_sig_info_fault(SIGBUS, BUS_MCEERR_AR,
+				     gfn_to_hva(kvm, gfn), current);
 		return 0;
 	} else if (is_fault_pfn(pfn))
 		return -EFAULT;

Better fill siginfo and use force_sig_info, which is already exported.