Nested virt is still experimental, and requires explicitly opting in to at domain create time. The VMX/SVM features should not be visible by default.
Also correct them from all HVM guests, to just HAP-enabled guests. This has been the restriction for SVM right from the outset (c/s e006a0e0aaa), while VMX was first introduced supporting shadow mode (c/s 9122c69c8d3) but later adjusted to HAP-only (c/s 77751ed79e3). There is deliberately no adjustment to xc_cpuid_apply_policy() for pre-4.14 migration compatibility. The migration stream doesn't contain the required architectural state for either VMX/SVM, and a nested virt VM which migrates will explode in weird and wonderful ways. Signed-off-by: Andrew Cooper <andrew.coop...@citrix.com> --- CC: Jan Beulich <jbeul...@suse.com> CC: Roger Pau Monné <roger....@citrix.com> CC: Wei Liu <w...@xen.org> --- xen/include/public/arch-x86/cpufeatureset.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/include/public/arch-x86/cpufeatureset.h b/xen/include/public/arch-x86/cpufeatureset.h index abd18722ee..ef7cca334d 100644 --- a/xen/include/public/arch-x86/cpufeatureset.h +++ b/xen/include/public/arch-x86/cpufeatureset.h @@ -127,7 +127,7 @@ XEN_CPUFEATURE(PCLMULQDQ, 1*32+ 1) /*A Carry-less multiplication */ XEN_CPUFEATURE(DTES64, 1*32+ 2) /* 64-bit Debug Store */ XEN_CPUFEATURE(MONITOR, 1*32+ 3) /* Monitor/Mwait support */ XEN_CPUFEATURE(DSCPL, 1*32+ 4) /* CPL Qualified Debug Store */ -XEN_CPUFEATURE(VMX, 1*32+ 5) /*S Virtual Machine Extensions */ +XEN_CPUFEATURE(VMX, 1*32+ 5) /*h Virtual Machine Extensions */ XEN_CPUFEATURE(SMX, 1*32+ 6) /* Safer Mode Extensions */ XEN_CPUFEATURE(EIST, 1*32+ 7) /* Enhanced SpeedStep */ XEN_CPUFEATURE(TM2, 1*32+ 8) /* Thermal Monitor 2 */ @@ -166,7 +166,7 @@ XEN_CPUFEATURE(3DNOW, 2*32+31) /*A 3DNow! */ /* AMD-defined CPU features, CPUID level 0x80000001.ecx, word 3 */ XEN_CPUFEATURE(LAHF_LM, 3*32+ 0) /*A LAHF/SAHF in long mode */ XEN_CPUFEATURE(CMP_LEGACY, 3*32+ 1) /*!A If yes HyperThreading not valid */ -XEN_CPUFEATURE(SVM, 3*32+ 2) /*S Secure virtual machine */ +XEN_CPUFEATURE(SVM, 3*32+ 2) /*h Secure virtual machine */ XEN_CPUFEATURE(EXTAPIC, 3*32+ 3) /* Extended APIC space */ XEN_CPUFEATURE(CR8_LEGACY, 3*32+ 4) /*S CR8 in 32-bit mode */ XEN_CPUFEATURE(ABM, 3*32+ 5) /*A Advanced bit manipulation */ -- 2.11.0
