Skip to content

Conversation

@h0nIg
Copy link
Contributor

@h0nIg h0nIg commented Dec 15, 2018

there is no capability to detect mitigation on xen based systems, since they are not exposed properly via /sys/devices/system/cpu/vulnerabilities/l1tf (unknown state -> "Mitigation: PTE Inversion") and /proc/cpuinfo (missing flush_l1d flag)

see https://www.suse.com/support/kb/doc/?id=7023078

improve pti checks for dom0
see https://www.suse.com/support/kb/doc/?id=7022546

@h0nIg h0nIg changed the title add mitigation detection for l1tf for xen based systems improvements for xen systems Dec 16, 2018
@speed47 speed47 merged commit 2e304ec into speed47:master May 7, 2019
@speed47
Copy link
Owner

speed47 commented May 7, 2019

Thanks for your PR, and sorry for the delay!
I've rebased it over current master to fix conflicts.
I don't use Xen but reading your changes and the documentation, it looks good.
Please test on some Xen systems if you can, it would be good to have confirmation that it works well before I tag the next release!

@werk21
Copy link

werk21 commented May 8, 2019

With Xen 4.12 on Ubuntu 18.04 the hypervisor is not recognized.
All pgrep-commands give empty results (line 3900ff).
Only the grep-command for "hypervisor" in /proc/cpuinfo gives an positive result, but is removed in new version. (dmesg is truncated and will not help).
Kelly.

@werk21
Copy link

werk21 commented May 8, 2019

Maybe pgrep for "xenstored" can help?

@speed47
Copy link
Owner

speed47 commented May 8, 2019

I tried to install Xen, after rebooting I had a qemu process so that's strange it's not catched on your system.
To be on the safe side, I added xenstored and xenconsoled, and also the 2 kthreads created by xen, xenbus and xenwatch.
Can you try with latest master?

@werk21
Copy link

werk21 commented May 8, 2019

Yes! Well done. Thank you very much:

  • This system is a host running a hypervisor: YES

@werk21
Copy link

werk21 commented May 13, 2019

You added in your grep also xenbus and xenwatch in lines 3902 and 3908 - but they are running on DomU either. So every Xen-Guest ist recognised as Xen-Dom0. Can you please remove these two search-items? Thank you.

@speed47
Copy link
Owner

speed47 commented May 14, 2019

@werk21 removed in latest commit.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants