mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
Andrew Cooper
070e8ce9d3
To protect against the TSX Async Abort speculative vulnerability, Intel have released new microcode for affected parts which introduce the MSR_TSX_CTRL control, which allows TSX to be turned off. This will be architectural on future parts. Introduce tsx= to provide a global on/off for TSX, including its enumeration via CPUID. Provide stub virtualisation of this MSR, as it is not exposed to guests at the moment. VMs may have booted before microcode is loaded, or before hosts have rebooted, and they still want to migrate freely. A VM which booted seeing TSX can migrate safely to hosts with TSX disabled - TSX will start unconditionally aborting, but still behave in a manner compatible with the ABI. The guest-visible behaviour is equivalent to late loading the microcode and setting the RTM_DISABLE bit in the course of live patching. This is part of XSA-305 / CVE-2019-11135 Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Reviewed-by: Jan Beulich <jbeulich@suse.com>
Remus provides fault tolerance for virtual machines by sending continuous checkpoints to a backup, which will activate if the target VM fails. See the website at http://wiki.xen.org/wiki/Remus for details. Using Remus with libxl on Xen 4.5 and higher: To enable network buffering, you need libnl 3.2.8 or higher along with the development headers and command line utilities. If your distro does not have the appropriate libnl3 version, you can find the latest source tarball of libnl3 at http://www.carisma.slowglass.com/~tgr/libnl/ Disk replication: VMs protected by Remus need to use DRBD based disk backends. Specifically, you need a compile and install a custom version of DRBD, that is available publicly at https://github.com/rshriram/remus-drbd This code is based on DRBD 8.3.11 and uses a new replication protocol (named protocol D) for asynchronous disk checkpoint replication. A protected VM's DRBD disks on the primary and backup hosts need to be configured to use protocol D as the replication protocol. An example resource configuration file can be found in the aforementioned github repository.