On Mon, May 18, 2020 at 11:26:29AM -0700, Luck, Tony wrote: > Maybe it isn't pretty. But I don't see another practical solution. > > The VMM is doing exactly the right thing here. It should not trust > that the guest will behave and not touch the poison location again. > If/when the guest does touch the poison, the right action is > for the VMM to fake a new machine check to the guest. > > Theoretlcally the VMM could decode the instruction that the guest > was trying to use on the poison page and decide "oh, this is that > weird case in Linux where it's just trying to CLFLUSH the page. I'll > just step the return IP past the CLFLUSH and let the guest continue".
That's actually doable in KVM, e.g. a hack could be done in <10 lines of code. A proper fix that integrates with KVM's emulator would be substantially more code and effort though. > But that doesn't sound at all reasonable to me (especially as the > next step is to realize that Linux is going to repeat that for every > cache line in the page, so you also want to VMM to fudge the register > contents to skip to the end of the loop and avoid another 63 VMEXITs). Eh, 63 VM-Exits is peanuts in the grand scheme. Even with the host-side gup() that's probably less than 50us. > N.B. Linux wants to switch the page to uncacheable so that in the > persistant memory case the filesytem code can continue to access > the other "blocks" in the page, rather than lose all of them. That's > futile in the case where the VMM took the whole 4K away. Maybe Dan > needs to think about the guest case too. This is where I'm unclear as to the guest behavior. Is it doing *just* CLFLUSH, or is it doing CLFLUSH followed by other accesses to the poisoned page? If it's the former, then it's probably worth at least exploring a KVM fix. If it's the latter, then yeah, emulating CLFLUSH for a poisoned #MC is pointless. I assume it's the latter since the goal is to recover data? Oh, and FWIW, the guest won't actually get UC for that page.