From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57438) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W5G5n-0004Ld-Cn for qemu-devel@nongnu.org; Mon, 20 Jan 2014 09:44:51 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1W5G5h-0006FY-F1 for qemu-devel@nongnu.org; Mon, 20 Jan 2014 09:44:47 -0500 Received: from mx1.redhat.com ([209.132.183.28]:34543) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1W5G5h-0006FC-5a for qemu-devel@nongnu.org; Mon, 20 Jan 2014 09:44:41 -0500 From: Paolo Bonzini Date: Mon, 20 Jan 2014 15:44:05 +0100 Message-Id: <1390229051-28635-4-git-send-email-pbonzini@redhat.com> In-Reply-To: <1390229051-28635-1-git-send-email-pbonzini@redhat.com> References: <1390229051-28635-1-git-send-email-pbonzini@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PULL 3/9] target-i386: clear guest TSC on reset List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: gleb@kernel.org, Will Auld , mtosatti@redhat.com, Fernando Luis Vazquez Cao , =?UTF-8?q?Fernando=20Luis=20V=C3=A1zquez=20Cao?= From: Fernando Luis V=C3=A1zquez Cao VCPU TSC is not cleared by a warm reset (*), which leaves some types of L= inux guests (non-pvops guests and those with the kernel parameter no-kvmclock= set) vulnerable to the overflow in cyc2ns_offset fixed by upstream commit 9993bc635d01a6ee7f6b833b4ee65ce7c06350b1 ("sched/x86: Fix overflow in cyc2ns_offset"). To put it in a nutshell, if such a Linux guest without the patch above ap= plied has been up more than 208 days and attempts a warm reset chances are that the newly booted kernel will panic or hang. (*) Intel Xeon E5 processors show the same broken behavior due to the errata "TSC is Not Affected by Warm Reset" (Intel=C2=AE Xeon=C2=AE Processor E5 Family Specification Update - August 2013): "The TSC (Time Stamp Counter MSR 10H) should be cleared on reset. Due to this erratum the TSC is not affected by warm reset." Cc: Will Auld Cc: Marcelo Tosatti Signed-off-by: Fernando Luis Vazquez Cao Signed-off-by: Paolo Bonzini Signed-off-by: Fernando Luis V=C3=A1zquez Cao --- target-i386/cpu.c | 3 +++ target-i386/kvm.c | 4 +--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/target-i386/cpu.c b/target-i386/cpu.c index 5076a94..bc4cb9d 100644 --- a/target-i386/cpu.c +++ b/target-i386/cpu.c @@ -2450,6 +2450,9 @@ static void x86_cpu_reset(CPUState *s) cpu_breakpoint_remove_all(env, BP_CPU); cpu_watchpoint_remove_all(env, BP_CPU); =20 + env->tsc_adjust =3D 0; + env->tsc =3D 0; + #if !defined(CONFIG_USER_ONLY) /* We hard-wire the BSP to the first CPU. */ if (s->cpu_index =3D=3D 0) { diff --git a/target-i386/kvm.c b/target-i386/kvm.c index 312a46b..285e1a3 100644 --- a/target-i386/kvm.c +++ b/target-i386/kvm.c @@ -1150,14 +1150,12 @@ static int kvm_put_msrs(X86CPU *cpu, int level) kvm_msr_entry_set(&msrs[n++], MSR_LSTAR, env->lstar); } #endif - if (level =3D=3D KVM_PUT_FULL_STATE) { - kvm_msr_entry_set(&msrs[n++], MSR_IA32_TSC, env->tsc); - } /* * The following MSRs have side effects on the guest or are too heav= y * for normal writeback. Limit them to reset or full state updates. */ if (level >=3D KVM_PUT_RESET_STATE) { + kvm_msr_entry_set(&msrs[n++], MSR_IA32_TSC, env->tsc); kvm_msr_entry_set(&msrs[n++], MSR_KVM_SYSTEM_TIME, env->system_time_msr); kvm_msr_entry_set(&msrs[n++], MSR_KVM_WALL_CLOCK, env->wall_cloc= k_msr); --=20 1.8.3.1