This section describes issues related to kernel zones in Oracle Solaris 11.4.
A running kernel zone within an Oracle VM Server for SPARC domain blocks the live migration of the guest domain. A similar issue was described previously in Bug 18289196, which is superseded by this report. The following error message might be displayed:
Guest suspension failed due to the presence of active Kernel Zones. Stop Kernel Zones and retry the operation.
Workaround: Choose one of the following workarounds:
Shut down the running kernel zone.
# zoneadm -z zonename shutdown
Suspend the kernel zone.
# zoneadm -z zonename suspend
Live migrate the kernel zone to another system before migrating the guest domain.
See Chapter 5, Migrating an Oracle Solaris Kernel Zone in Creating and Using Oracle Solaris Kernel Zones.
A kernel zone that is migrated from a system that is running with Spectre V2 mitigations to a system that does not have Spectre V2 mitigations panics when the kernel zone is resumed on the unmitigated system. A message such as the following is seen when the kernel zone resumes and panics:
error: VCPU 0: VM exit for WRMSR: msr == 0x49 error: VCPU 0: unallowed WRMSR panic[cpu0]/thread=ffffe33000005b00: BAD TRAP: type=d (#gp General protection) rp=ffffe33000005950 due to access to a non-canonical address
The kernel zone will run after it reboots following the panic, but whatever was running at the time of the migration will be lost.
Workaround: Do not migrate a kernel zone with Spectre V2 mitigations to a system that is not running Spectre V2 mitigations. On x86 systems, migrate a Spectre V2 mitigated kernel zone to another Spectre V2 mitigated system, or migrate an unmitigated kernel zone to another unmitigated system.