Re: How to correctly configure mitigation of CVE-2018-3646 'Foreshadow-NG (VMM)' on Xen Dom0 host?

--=-b+1UIyc7fcjR4LJuTI9W
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Mon, 2019-04-15 at 07:17 -0700, PGNet Dev wrote:
> On 4/15/19 3:08 AM, Dario Faggioli wrote:
> > >=20
> > > What's missing in my config to mitigate/remove the CVE-2018-3646
> > > vulnerability?
> > >=20
> > There's nothing you're missing, as far as I can tell. What the
> > problem
> > seems to be, is that spectre-and-meltdown-checker.sh does not treat
> > the
> > case of this check being made within a Xen (PV) guest properly.
> >=20
> > I'll check whether this is actually the case, and I'll to see about
> > fixing that, as soon as I find a minute.
>=20
> Thanks.
>=20
So, I finally gave a look at the spectre-meltdown-checker.sh source.

IMO, figuring out whether or not we're running on a system which we can
call "an hypervisor", is kind of broken, for both Xen and KVM.

This affects the meaningfulness of what the tool reports about L1TF
quite a bit.

I had a go at fixing a few things, mostly for KVM, though. I have a
branch here:
https://github.com/dfaggioli/spectre-meltdown-checker/tree/l1tf-host

(and I did send the pull request... let's see if the author likes my
changes).

I started to look at the Xen side of things, but then found this:
https://github.com/h0nIg/spectre-meltdown-checker/tree/xen

I still haven't tried, nor checked the patches thoroughly, but I'll
give it a look and see if we they're fine (and, probably, base any
future work on at least some of them).

But that won't happen before the end of next week.

Regards
--=20
Dario Faggioli, Ph.D
http://about.me/dario.faggioli
Virtualization Software Engineer
SUSE Labs, SUSE https://www.suse.com/
-------------------------------------------------------------------
<<This happens because _I_ choose it to happen!>> (Raistlin Majere)


--=-b+1UIyc7fcjR4LJuTI9W
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: This is a digitally signed message part
Content-Transfer-Encoding: 7bit

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEES5ssOj3Vhr0WPnOLFkJ4iaW4c+4FAly6BKUACgkQFkJ4iaW4
c+7Q5g/+IKJzflEzbsUyx/2Rbrkb5IOdx4cI1Jf7SsVkpbBx627NaOvjhXvuStDI
oMY0wM4ssfEVOAwDhu0AnLNyeRBBeadi46U1VfOgFF/5RXODwbStIeuvKmLJ4eCD
Op//wugyDbUXswABaxnpVblUu+CQZfGzNUBUUTl/0uwM+CSEwp/OmQIKF5hardMN
KGGDKZonOR3uZa0zaBXYdoGEwHchXR4fWwNzOjs9KWkE3vWC2DYA+PsOGANty84n
FsTGXungEoVqaT3R6XmQu7c5nkxyJAGvpX9EnYCAXaK9xfW7Y420c6O4fknmp81v
Tv/kLWQWjbLRInH0Rsz70jd3HcS/PqZvkTTcNnP+eUY/1VvXkP2miSHNqpS4ZfmP
C3Z5Ft9IVomLVzIyAxcMmeLPxupkZ+rL/eKmgWSrav3k/vcVBaeG77RoM+J2kADh
HSesMZS+dF+S6MiaT3p3zmS2G4drGLjCaDQ/7xg/YsSTpLVAIwqHsVlAyaM7/NVK
Zld57TV/l+QdseA/W9Vx+GKDZ+j6B9bwA+KAsuwqT2XOgxv9vIwKCcozbdzBEcwz
U/tLNJo2BCuqabyd/qbTJDkiqze/sQBlviemrETXn+RMaxTei0QVLEArx30sri6n
OYZrnlB6C0VwfwAsbqeIOXdqoBd5sAFdVXqxc3sfkfZ0jmyhHXE=
=Jg5K
-----END PGP SIGNATURE-----

--=-b+1UIyc7fcjR4LJuTI9W--