Fix HVM domain crash

See patch description for details.

Fixes QubesOS/qubes-issues#6074

0001-xen-events-don-t-use-chip_data-for-legacy-IRQs.patch

@@ -0,0 +1,113 @@
+From 35b71ae9cc69cdd151cc3a4d587f67eb8d86007d Mon Sep 17 00:00:00 2001
+From: Juergen Gross <[email protected]>
+Date: Tue, 29 Sep 2020 15:47:21 +0200
+Subject: [PATCH] xen/events: don't use chip_data for legacy IRQs
+
+Storing Xen specific data via chip_data is fine, as long as this isn't
+done for a legacy IRQ.
+
+Use a local array for this purpose in case of legacy IRQs.
+
+Signed-off-by: Juergen Gross <[email protected]>
+---
+ drivers/xen/events/events_base.c | 29 +++++++++++++++++++++--------
+ 1 file changed, 21 insertions(+), 8 deletions(-)
+
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index 90b8f56fbadb..6f02c18fa65c 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -92,6 +92,8 @@ static bool (*pirq_needs_eoi)(unsigned irq);
+ /* Xen will never allocate port zero for any purpose. */
+ #define VALID_EVTCHN(chn)	((chn) != 0)
+
++static struct irq_info *legacy_info_ptrs[NR_IRQS_LEGACY];
++
+ static struct irq_chip xen_dynamic_chip;
+ static struct irq_chip xen_percpu_chip;
+ static struct irq_chip xen_pirq_chip;
+@@ -156,7 +158,18 @@ int get_evtchn_to_irq(evtchn_port_t evtchn)
+ /* Get info for IRQ */
+ struct irq_info *info_for_irq(unsigned irq)
+ {
+-	return irq_get_chip_data(irq);
++	if (irq < nr_legacy_irqs())
++		return legacy_info_ptrs[irq];
++	else
++		return irq_get_chip_data(irq);
++}
++
++static void set_info_for_irq(unsigned int irq, struct irq_info *info)
++{
++	if (irq < nr_legacy_irqs())
++		legacy_info_ptrs[irq] = info;
++	else
++		irq_set_chip_data(irq, info);
+ }
+
+ /* Constructors for packed IRQ information. */
+@@ -377,7 +390,7 @@ static void xen_irq_init(unsigned irq)
+ 	info->type = IRQT_UNBOUND;
+ 	info->refcnt = -1;
+
+-	irq_set_chip_data(irq, info);
++	set_info_for_irq(irq, info);
+
+ 	list_add_tail(&info->list, &xen_irq_list_head);
+ }
+@@ -426,14 +439,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi)
+
+ static void xen_free_irq(unsigned irq)
+ {
+-	struct irq_info *info = irq_get_chip_data(irq);
++	struct irq_info *info = info_for_irq(irq);
+
+ 	if (WARN_ON(!info))
+ 		return;
+
+ 	list_del(&info->list);
+
+-	irq_set_chip_data(irq, NULL);
++	set_info_for_irq(irq, NULL);
+
+ 	WARN_ON(info->refcnt > 0);
+
+@@ -603,7 +616,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
+ static void __unbind_from_irq(unsigned int irq)
+ {
+ 	int evtchn = evtchn_from_irq(irq);
+-	struct irq_info *info = irq_get_chip_data(irq);
++	struct irq_info *info = info_for_irq(irq);
+
+ 	if (info->refcnt > 0) {
+ 		info->refcnt--;
+@@ -1108,7 +1121,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
+
+ void unbind_from_irqhandler(unsigned int irq, void *dev_id)
+ {
+-	struct irq_info *info = irq_get_chip_data(irq);
++	struct irq_info *info = info_for_irq(irq);
+
+ 	if (WARN_ON(!info))
+ 		return;
+@@ -1142,7 +1155,7 @@ int evtchn_make_refcounted(evtchn_port_t evtchn)
+ 	if (irq == -1)
+ 		return -ENOENT;
+
+-	info = irq_get_chip_data(irq);
++	info = info_for_irq(irq);
+
+ 	if (!info)
+ 		return -ENOENT;
+@@ -1170,7 +1183,7 @@ int evtchn_get(evtchn_port_t evtchn)
+ 	if (irq == -1)
+ 		goto done;
+
+-	info = irq_get_chip_data(irq);
++	info = info_for_irq(irq);
+
+ 	if (!info)
+ 		goto done;
+-- 
+2.26.2
+

kernel.spec.in

@@ -135,6 +135,8 @@ Patch12: 0013-xen-pcifront-pciback-Update-pciif.h-with-err-and-res.patch
 Patch13: 0001-Create-uapi-power_supply-from-enums-and-power_supply.patch
 Patch14: 0002-uapi-linux-power_supply.h-add-power_supply_is_str_pr.patch
 
+Patch20: 0001-xen-events-don-t-use-chip_data-for-legacy-IRQs.patch
+
 %description
 Qubes Dom0 kernel.