Comment 4 for bug 1771679

Kamal Mostafa (kamalmostafa) wrote :

This is documented and fixed by mainline commit:

commit d1ecfa9d1f402366b1776fbf84e635678a51414f
Author: van der Linden, Frank <email address hidden>
Date: Fri May 4 16:11:00 2018 -0400

    x86/xen: Reset VCPU0 info pointer after shared_info remap

    This patch fixes crashes during boot for HVM guests on older (pre HVM
    vector callback) Xen versions. Without this, current kernels will always
    fail to boot on those Xen versions.

    Sample stack trace:

       BUG: unable to handle kernel paging request at ffffffffff200000
       IP: __xen_evtchn_do_upcall+0x1e/0x80
       PGD 1e0e067 P4D 1e0e067 PUD 1e10067 PMD 235c067 PTE 0
        Oops: 0002 [#1] SMP PTI
       Modules linked in:
       CPU: 0 PID: 512 Comm: kworker/u2:0 Not tainted 4.14.33-52.13.amzn1.x86_64
       Hardware name: Xen HVM domU, BIOS 11/11/2016
       task: ffff88002531d700 task.stack: ffffc90000480000
       RIP: 0010:__xen_evtchn_do_upcall+0x1e/0x80
       RSP: 0000:ffff880025403ef0 EFLAGS: 00010046
       RAX: ffffffff813cc760 RBX: ffffffffff200000 RCX: ffffc90000483ef0
       RDX: ffff880020540a00 RSI: ffff880023c78000 RDI: 000000000000001c
       RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
       R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
       R13: ffff880025403f5c R14: 0000000000000000 R15: 0000000000000000
       FS: 0000000000000000(0000) GS:ffff880025400000(0000) knlGS:0000000000000
       CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: ffffffffff200000 CR3: 0000000001e0a000 CR4: 00000000000006f0
        Call Trace:

    During boot, the HYPERVISOR_shared_info page gets remapped to make it work
    with KASLR. This means that any pointer derived from it needs to be

    The only value that this applies to is the vcpu_info pointer for VCPU 0.
    For PV and HVM with the callback vector feature, this gets done via the
    smp_ops prepare_boot_cpu callback. Older Xen versions do not support the
    HVM callback vector, so there is no Xen-specific smp_ops set up in that
    scenario. So, the vcpu_info pointer for VCPU 0 never gets set to the proper
    value, and the first reference of it will be bad. Fix this by resetting it
    immediately after the remap.

    Signed-off-by: Frank van der Linden <email address hidden>
    Reviewed-by: Eduardo Valentin <email address hidden>
    Reviewed-by: Alakesh Haloi <email address hidden>
    Reviewed-by: Vallish Vaidyeshwara <email address hidden>
    Reviewed-by: Boris Ostrovsky <email address hidden>
    Cc: Juergen Gross <email address hidden>
    Cc: Boris Ostrovsky <email address hidden>
    Cc: <email address hidden>
    Signed-off-by: Boris Ostrovsky <email address hidden>