ba5dde9750
53a199d7-x86-EFI-allow-FPU-XMM-use-in-runtime-service-functions.patch - Upstream patches from Jan 538c338f-x86-amd_ucode-flip-revision-numbers-in-printk.patch 538ee637-ACPI-Prevent-acpi_table_entries-from-falling-into-a-infinite-loop.patch 5390917a-VT-d-honor-APEI-firmware-first-mode-in-XSA-59-workaround-code.patch 53909259-x86-domctl-two-functional-fixes-to-XEN_DOMCTL_-gs-etvcpuextstate.patch 5390927f-x86-fix-reboot-shutdown-with-running-HVM-guests.patch 5396d818-avoid-crash-on-HVM-domain-destroy-with-PCI-passthrough.patch 5396e805-x86-HVM-refine-SMEP-test-in-HVM_CR4_GUEST_RESERVED_BITS.patch 539ebe62-x86-EFI-improve-boot-time-diagnostics.patch 539ec004-x86-mce-don-t-spam-the-console-with-CPUx-Temperature-z.patch 53a040c6-page-alloc-scrub-pages-used-by-hypervisor-upon-freeing.patch (replaces xsa100.patch) 53a1990a-IOMMU-prevent-VT-d-device-IOTLB-operations-on-wrong-IOMMU.patch - Replace 'domUloader' with 'pygrub' when converting or importing Xen domains into libvirt with xen2libvirt. domUloader is no longer provided in xen-tools. Modified: xen2libvirt.py Thu Jun 13 15:50:19 MDT 2014 - cyliu@suse.com - fate#310956: Support Direct Kernel Boot for FV guests patches would go to upstream: qemu side: qemu-support-xen-hvm-direct-kernel-boot.patch xen side: xen-pass-kernel-initrd-to-qemu.patch - bnc#880751 - VUL-0: xen: Hypervisor heap contents leaked to guests xsa100.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=320
109 lines
4.1 KiB
Diff
109 lines
4.1 KiB
Diff
# Commit 39ede234d1fd683430ffb1784d6d35b096f16457
|
|
# Date 2014-06-05 17:53:35 +0200
|
|
# Author Roger Pau Monné <roger.pau@citrix.com>
|
|
# Committer Jan Beulich <jbeulich@suse.com>
|
|
x86: fix reboot/shutdown with running HVM guests
|
|
|
|
If there's a guest using VMX/SVM when the hypervisor shuts down, it
|
|
can lead to the following crash due to VMX/SVM functions being called
|
|
after hvm_cpu_down has been called. In order to prevent that, check in
|
|
{svm/vmx}_ctxt_switch_from that the cpu virtualization extensions are
|
|
still enabled.
|
|
|
|
(XEN) Domain 0 shutdown: rebooting machine.
|
|
(XEN) Assertion 'read_cr0() & X86_CR0_TS' failed at vmx.c:644
|
|
(XEN) ----[ Xen-4.5-unstable x86_64 debug=y Tainted: C ]----
|
|
(XEN) CPU: 0
|
|
(XEN) RIP: e008:[<ffff82d0801d90ce>] vmx_ctxt_switch_from+0x1e/0x14c
|
|
...
|
|
(XEN) Xen call trace:
|
|
(XEN) [<ffff82d0801d90ce>] vmx_ctxt_switch_from+0x1e/0x14c
|
|
(XEN) [<ffff82d08015d129>] __context_switch+0x127/0x462
|
|
(XEN) [<ffff82d080160acf>] __sync_local_execstate+0x6a/0x8b
|
|
(XEN) [<ffff82d080160af9>] sync_local_execstate+0x9/0xb
|
|
(XEN) [<ffff82d080161728>] map_domain_page+0x88/0x4de
|
|
(XEN) [<ffff82d08014e721>] map_vtd_domain_page+0xd/0xf
|
|
(XEN) [<ffff82d08014cda2>] io_apic_read_remap_rte+0x158/0x29f
|
|
(XEN) [<ffff82d0801448a8>] iommu_read_apic_from_ire+0x27/0x29
|
|
(XEN) [<ffff82d080165625>] io_apic_read+0x17/0x65
|
|
(XEN) [<ffff82d080166143>] __ioapic_read_entry+0x38/0x61
|
|
(XEN) [<ffff82d080166aa8>] clear_IO_APIC_pin+0x1a/0xf3
|
|
(XEN) [<ffff82d080166bae>] clear_IO_APIC+0x2d/0x60
|
|
(XEN) [<ffff82d080166f63>] disable_IO_APIC+0xd/0x81
|
|
(XEN) [<ffff82d08018228b>] smp_send_stop+0x58/0x68
|
|
(XEN) [<ffff82d080181aa7>] machine_restart+0x80/0x20a
|
|
(XEN) [<ffff82d080181c3c>] __machine_restart+0xb/0xf
|
|
(XEN) [<ffff82d080128fb9>] smp_call_function_interrupt+0x99/0xc0
|
|
(XEN) [<ffff82d080182330>] call_function_interrupt+0x33/0x43
|
|
(XEN) [<ffff82d08016bd89>] do_IRQ+0x9e/0x63a
|
|
(XEN) [<ffff82d08016406f>] common_interrupt+0x5f/0x70
|
|
(XEN) [<ffff82d0801a8600>] mwait_idle+0x29c/0x2f7
|
|
(XEN) [<ffff82d08015cf67>] idle_loop+0x58/0x76
|
|
(XEN)
|
|
(XEN)
|
|
(XEN) ****************************************
|
|
(XEN) Panic on CPU 0:
|
|
(XEN) Assertion 'read_cr0() & X86_CR0_TS' failed at vmx.c:644
|
|
(XEN) ****************************************
|
|
|
|
Suggested-by: Jan Beulich <jbeulich@suse.com>
|
|
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
|
|
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
|
|
|
|
--- a/xen/arch/x86/hvm/svm/svm.c
|
|
+++ b/xen/arch/x86/hvm/svm/svm.c
|
|
@@ -861,6 +861,14 @@ static void svm_ctxt_switch_from(struct
|
|
{
|
|
int cpu = smp_processor_id();
|
|
|
|
+ /*
|
|
+ * Return early if trying to do a context switch without SVM enabled,
|
|
+ * this can happen when the hypervisor shuts down with HVM guests
|
|
+ * still running.
|
|
+ */
|
|
+ if ( unlikely((read_efer() & EFER_SVME) == 0) )
|
|
+ return;
|
|
+
|
|
svm_fpu_leave(v);
|
|
|
|
svm_save_dr(v);
|
|
--- a/xen/arch/x86/hvm/vmx/vmcs.c
|
|
+++ b/xen/arch/x86/hvm/vmx/vmcs.c
|
|
@@ -74,7 +74,7 @@ u64 vmx_ept_vpid_cap __read_mostly;
|
|
static DEFINE_PER_CPU_READ_MOSTLY(struct vmcs_struct *, vmxon_region);
|
|
static DEFINE_PER_CPU(struct vmcs_struct *, current_vmcs);
|
|
static DEFINE_PER_CPU(struct list_head, active_vmcs_list);
|
|
-static DEFINE_PER_CPU(bool_t, vmxon);
|
|
+DEFINE_PER_CPU(bool_t, vmxon);
|
|
|
|
static u32 vmcs_revision_id __read_mostly;
|
|
u64 __read_mostly vmx_basic_msr;
|
|
--- a/xen/arch/x86/hvm/vmx/vmx.c
|
|
+++ b/xen/arch/x86/hvm/vmx/vmx.c
|
|
@@ -617,6 +617,14 @@ static void vmx_fpu_leave(struct vcpu *v
|
|
|
|
static void vmx_ctxt_switch_from(struct vcpu *v)
|
|
{
|
|
+ /*
|
|
+ * Return early if trying to do a context switch without VMX enabled,
|
|
+ * this can happen when the hypervisor shuts down with HVM guests
|
|
+ * still running.
|
|
+ */
|
|
+ if ( unlikely(!this_cpu(vmxon)) )
|
|
+ return;
|
|
+
|
|
vmx_fpu_leave(v);
|
|
vmx_save_guest_msrs(v);
|
|
vmx_restore_host_msrs();
|
|
--- a/xen/include/asm-x86/hvm/vmx/vmcs.h
|
|
+++ b/xen/include/asm-x86/hvm/vmx/vmcs.h
|
|
@@ -483,6 +483,8 @@ void virtual_vmcs_exit(void *vvmcs);
|
|
u64 virtual_vmcs_vmread(void *vvmcs, u32 vmcs_encoding);
|
|
void virtual_vmcs_vmwrite(void *vvmcs, u32 vmcs_encoding, u64 val);
|
|
|
|
+DECLARE_PER_CPU(bool_t, vmxon);
|
|
+
|
|
#endif /* ASM_X86_HVM_VMX_VMCS_H__ */
|
|
|
|
/*
|