Re: [Xen-users] "Booted on L1TF-vulnerable hardware with SMT/Hyperthreading enabled" .. or not?

[Hans van Kranenburg <hans@xxxxxxxxxxx>]

On 08/31/2018 02:09 AM, Hans van Kranenburg wrote:
> I have some HP ProLiant DL360 G7 (P68) servers here, and I just put this
> BIOS update on them:
> 
> https://support.hpe.com/hpsc/swd/public/detail?swItemId=MTX_23267b7aabb6489a8332d06919#tab3
> 
> Version: 2018.05.21(2 Jul 2018)
> 
> The release notes contain a whole story about "This revision of the
> System ROM includes the latest revision of the Intel microcode which, in
> combination with operating system and hypervisor updates, provides
> mitigation for the L1 Terminal Fault – OS/SMM (CVE-2018-3620) and L1
> Terminal Fault – VMM (CVE-2018-3646) security vulnerabilities."
> 
> In the BIOS cpu settings, hyperthreading is disabled. This server
> contains 2x 6-core Intel(R) Xeon(R) CPU X5675 @ 3.07GHz
> 
> From xen info: (4.11, built from stable-4.11 commit 733450b39b)
> 
> -# xen info
> host                   : rho
> release                : 4.17.0-0.bpo.3-amd64
> version                : #1 SMP Debian 4.17.17-1~bpo9+1 (2018-08-27)
> machine                : x86_64
> nr_cpus                : 12
> max_cpu_id             : 31
> nr_nodes               : 2
> cores_per_socket       : 6
> threads_per_core       : 1
> 
> Still, xl dmesg shows me:
> 
> (XEN) ***************************************************
> (XEN) Booted on L1TF-vulnerable hardware with SMT/Hyperthreading
> (XEN) enabled.  Please assess your configuration and choose an
> (XEN) explicit 'smt=<bool>' setting.  See XSA-273.
> (XEN) ***************************************************
> 
> What's wrong here?

Additionally:

-# cat /proc/cpuinfo
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 44
model name      : Intel(R) Xeon(R) CPU           X5675  @ 3.07GHz
stepping        : 2
microcode       : 0x1f
cpu MHz         : 3066.788
cache size      : 12288 KB
physical id     : 0
siblings        : 4
core id         : 0
cpu cores       : 1
apicid          : 0
initial apicid  : 0
fpu             : yes
fpu_exception   : yes
cpuid level     : 11
wp              : yes
flags           : fpu de tsc msr pae mce cx8 apic sep mca cmov pat clflush acpi
mmx fxsr sse sse2 ss ht syscall nx lm constant_tsc rep_good nopl
nonstop_tsc cpuid pni pclmulqdq monitor est ssse3 cx16 sse4_1 sse4_2
popcnt aes hypervisor lahf_lm ssbd ibrs ibpb stibp
bugs            : null_seg cpu_meltdown spectre_v1 spectre_v2 spec_store_bypass 
l1tf
bogomips        : 6133.57
clflush size    : 64
cache_alignment : 64
address sizes   : 40 bits physical, 48 bits virtual
power management:

(identical for all cpus listed)

Thanks,
Hans

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-users