CentOS virt - Jan 2018 - Xen 4.6.6-9 (with XPTI meltdown mitigation) packages making their way to centos-virt-xen-testing

I've built & tagged packages for CentOS 6 and 7 4.6.6-9, with XPTI
"stage 1" Meltdown mitigation.

This will allow 64-bit PV guests to run safely (with a few caveats),
but incurs a fairly significant slowdown for 64-bit PV guests on Intel
boxes (including domain 0).

If you prefer using Vixen / Comet, you can turn it off by adding
'xpti=0' to your Xen command-line.

Detailed information can be found in the XSA-254 advisory:

https://xenbits.xen.org/xsa/advisory-254.html

Please test and report any issues you have.  I'll probably tag then
with -release tomorrow.

4.8 packages should be coming to buildlogs soon.

 -George

Thanks George.

As there are now quite many options to choose from, what would be the
best option performance wise for running 32bit domUs under xen-4.6?

Best,
Peter


On Wed, Jan 17, 2018 at 7:14 PM, George Dunlap <dunlapg at umich.edu>
wrote:
> I've built & tagged packages for CentOS 6 and 7 4.6.6-9, with XPTI
> "stage 1" Meltdown mitigation.
>
> This will allow 64-bit PV guests to run safely (with a few caveats),
> but incurs a fairly significant slowdown for 64-bit PV guests on Intel
> boxes (including domain 0).
>
> If you prefer using Vixen / Comet, you can turn it off by adding
> 'xpti=0' to your Xen command-line.
>
> Detailed information can be found in the XSA-254 advisory:
>
> https://xenbits.xen.org/xsa/advisory-254.html
>
> Please test and report any issues you have.  I'll probably tag then
> with -release tomorrow.
>
> 4.8 packages should be coming to buildlogs soon.
>
>  -George
> _______________________________________________
> CentOS-virt mailing list
> CentOS-virt at centos.org
> https://lists.centos.org/mailman/listinfo/centos-virt

> -----Original Message-----
> From: CentOS-virt [mailto:centos-virt-bounces at centos.org] On Behalf Of
> Peter Peltonen
> Sent: Thursday, January 18, 2018 11:19 AM
> To: Discussion about the virtualization on CentOS <centos-virt at
centos.org>
> Subject: Re: [CentOS-virt] Xen 4.6.6-9 (with XPTI meltdown mitigation)
> packages making their way to centos-virt-xen-testing
> 
> Thanks George.
> 
> As there are now quite many options to choose from, what would be the
> best option performance wise for running 32bit domUs under xen-4.6?
> 
> Best,
> Peter
> 
It's worth taking a look at the table in the latest XSA, it helps clarify a
fair bit:

https://xenbits.xen.org/xsa/advisory-254.html

Cheers,
Nathan

Just a heads up that I'm seeing major stability problems on these builds.
Didn't have  console capture setup unfortunately, but have seen my test
hypervisor hard lock twice over the weekend.

This is with xpti being used, rather than the shim.

Cheers,
Nathan

> -----Original Message-----
> From: CentOS-virt [mailto:centos-virt-bounces at centos.org] On Behalf Of
> George Dunlap
> Sent: Wednesday, January 17, 2018 9:14 AM
> To: Discussion about the virtualization on CentOS <centos-virt at
centos.org>
> Subject: [CentOS-virt] Xen 4.6.6-9 (with XPTI meltdown mitigation)
packages
> making their way to centos-virt-xen-testing
> 
> I've built & tagged packages for CentOS 6 and 7 4.6.6-9, with XPTI
> "stage 1" Meltdown mitigation.
> 
> This will allow 64-bit PV guests to run safely (with a few caveats),
> but incurs a fairly significant slowdown for 64-bit PV guests on Intel
> boxes (including domain 0).
> 
> If you prefer using Vixen / Comet, you can turn it off by adding
> 'xpti=0' to your Xen command-line.
> 
> Detailed information can be found in the XSA-254 advisory:
> 
> https://xenbits.xen.org/xsa/advisory-254.html
> 
> Please test and report any issues you have.  I'll probably tag then
> with -release tomorrow.
> 
> 4.8 packages should be coming to buildlogs soon.
> 
>  -George
> _______________________________________________
> CentOS-virt mailing list
> CentOS-virt at centos.org
> https://lists.centos.org/mailman/listinfo/centos-virt

On Mon, Jan 22, 2018 at 10:38 PM, Nathan March <nathan at gt.net>
wrote:
> Just a heads up that I'm seeing major stability problems on these
builds.
> Didn't have  console capture setup unfortunately, but have seen my test
> hypervisor hard lock twice over the weekend.
>
> This is with xpti being used, rather than the shim.
Thanks for the heads-up.  It's been running through XenServer's tests
as well as the XenProject's "osstest" -- I haven't heard of
any
additional issues, but I'll ask.

It's possible also that it's some interaction between the specific
CentOS environment -- the gcc version, the particular dom0 kernel, &c.
I'll ask Anthony if he can run the CentOS packages through osstest and
see if anything comes up.

 -George