[Qemu-devel] Simulating Soft Error with MCE Injection method

[Naftaly Avadiaev]

Hi,

 

QEMU has a build in mechanism for MCE injection. 

However the mechanism is not perfect, QEMU just fills MCA registers with
partial data and then triggers MCE.

I want to add a real corruption before triggering MCE.

The first thing which I tried is to add all MSRs as described in Intel
Software Developer's Manual [now qemu implements 3 of 4 general status
registers and 4 of 5 error reporting registers in a bank], however it seems
that the guest OS is still not aware of the new registers that I have add.

I did the following: 

1. Added the MSRs in CPUX86State. 

2. Added support for reading the new MSRs in helper_rdmsr & helper_wrmsr.

Why the guest OS still unaware of these MSRs?

I also tried to corrupt the EIP before triggering MCE, but the guest OS just
crashed without arriving to MCE handler.

In my understanding the MCE handler is exactly to deal with such errors.
What I'm I missing?

 

Thanks,

Naftaly