RAS（四）Intel MCA-Uncorrected Recoverable

C++/* * The actual machine check handler. This only handles real exceptions when * something got corrupted coming in through int 18. * * This is executed in #MC context not subject to normal locking rules. * This implies that most kernel services cannot be safely used. Don't even * think about putting a printk in there! * * On Intel systems this is entered on all CPUs in parallel through * MCE broadcast. However some CPUs might be broken beyond repair, * so be always careful when synchronizing with others. * * Tracing and kprobes are disabled: if we interrupted a kernel context * with IF=1, we need to minimize stack usage. There are also recursion * issues: if the machine check was due to a failure of the memory * backing the user stack, tracing that reads the user stack will cause * potentially infinite recursion. * * Currently, the #MC handler calls out to a number of external facilities * and, therefore, allows instrumentation around them. The optimal thing to * have would be to do the absolutely minimal work required in #MC context * and have instrumentation disabled only around that. Further processing can * then happen in process context where instrumentation is allowed. Achieving * that requires careful auditing and modifications. Until then, the code * allows instrumentation temporarily, where required. * */noinstr void do_machine_check(struct pt_regs *regs){

C++noinstr void do_machine_check(struct pt_regs *regs){... this_cpu_inc(mce_exception_count); mce_gather_info(&m, regs); m.tsc = rdtsc(); final = this_cpu_ptr(&mces_seen); *final = m; no_way_out = mce_no_way_out(&m, &msg, valid_banks, regs); barrier();

C++struct mce { __u64 status; /* Bank's MCi_STATUS MSR */ __u64 misc; /* Bank's MCi_MISC MSR */ __u64 addr; /* Bank's MCi_ADDR MSR */ __u64 mcgstatus; /* Machine Check Global Status MSR */ __u64 ip; /* Instruction Pointer when the error happened */ __u64 tsc; /* CPU time stamp counter */ __u64 time; /* Wall time_t when error was detected */

C++static __always_inline int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp, struct pt_regs *regs){... for (i = 0; i < this_cpu_read(mce_num_banks); i++) { 。 ... m->bank = i; if (mce_severity(m, regs, &tmp, true) >= MCE_PANIC_SEVERITY) { mce_read_aux(m, i); *msg = tmp; return 1; } } return 0;}

C++enum severity_level { MCE_NO_SEVERITY, MCE_DEFERRED_SEVERITY, MCE_UCNA_SEVERITY = MCE_DEFERRED_SEVERITY, MCE_KEEP_SEVERITY, MCE_SOME_SEVERITY, MCE_AO_SEVERITY, MCE_UC_SEVERITY, MCE_AR_SEVERITY, MCE_PANIC_SEVERITY,};

C++/* * Local machine check may already know that we have to panic. * Broadcast machine check begins rendezvous in mce_start() * Go through all banks in exclusion of the other CPUs. This way we * don't report duplicated events on shared banks because the first one * to see it will clear it. */ if (lmce) { if (no_way_out) mce_panic("Fatal local machine check", &m, msg); } else { order = mce_start(&no_way_out); }

C++static noinstr int mce_start(int *no_way_out){ /* * 等待所有CPU就绪，执行到这里 */ while (arch_atomic_read(&mce_callin) != num_online_cpus()) { if (mce_timed_out(&timeout, "Timeout: Not all CPUs entered broadcast exception handler")) { arch_atomic_set(&global_nwo, 0); goto out; } ndelay(SPINUNIT); }... if (order == 1) { /* * Monarch CPU开始向下执行，并设置mce_executing=1. */ arch_atomic_set(&mce_executing, 1); } else { /* * Subject CPU等待 */ while (arch_atomic_read(&mce_executing) < order) { if (mce_timed_out(&timeout, "Timeout: Subject CPUs unable to finish machine check processing")) { arch_atomic_set(&global_nwo, 0); goto out; } ndelay(SPINUNIT); } }

C++ taint = __mc_scan_banks(&m, regs, final, toclear, valid_banks, no_way_out, &worst); if (!no_way_out) mce_clear_state(toclear); /* * Do most of the synchronization with other CPUs. * When there's any problem use only local no_way_out state. */ if (!lmce) { if (mce_end(order) < 0) { if (!no_way_out) no_way_out = worst >= MCE_PANIC_SEVERITY; if (no_way_out) mce_panic("Fatal machine check on current CPU", &m, msg); }

C++static void mce_reign(void){... /* * This CPU is the Monarch and the other CPUs have run * through their handlers. * Grade the severity of the errors of all the CPUs. */ for_each_possible_cpu(cpu) { struct mce *mtmp = &per_cpu(mces_seen, cpu); if (mtmp->severity > global_worst) { global_worst = mtmp->severity; m = &per_cpu(mces_seen, cpu); } } /* * 如果无法恢复则直接Panic. */ if (m && global_worst >= MCE_PANIC_SEVERITY) { /* call mce_severity() to get "msg" for panic */ mce_severity(m, NULL, &msg, true); mce_panic("Fatal machine check", m, msg); } ... if (global_worst <= MCE_KEEP_SEVERITY) mce_panic("Fatal machine check from unknown source", NULL, NULL);

C++/* * Allow others to run. */ atomic_inc(&mce_executing);

C++ /* * Now clear all the mces_seen so that they don't reappear on * the next mce. */ for_each_possible_cpu(cpu) memset(&per_cpu(mces_seen, cpu), 0, sizeof(struct mce));

C++/* Fault was in user mode and we need to take some action */ if ((m.cs & 3) == 3) { /* If this triggers there is no way to recover. Die hard. */ BUG_ON(!on_thread_stack() || !user_mode(regs)); if (kill_current_task) queue_task_work(&m, msg, kill_me_now); else queue_task_work(&m, msg, kill_me_maybe); } else { if (m.kflags & MCE_IN_KERNEL_RECOV) { if (!fixup_exception(regs, X86_TRAP_MC, 0, 0)) mce_panic("Failed kernel mode recovery", &m, msg); } if (m.kflags & MCE_IN_KERNEL_COPYIN) queue_task_work(&m, msg, kill_me_never); }