Learning about Xen Server: why is virtualization disabled?

First looking at the architecture of Xen Server:

So dom0 is the frontend to the hypervisor, which is running as the kernel, and thus is headless.   Now before install Xen Orchestra, one of the requirements is the VMX or SVM must be detected in the /proc/cpuinfo CPU flags.

But checking /proc/cpuinfo in dom0 revealed it has VMX and SVM all disabled.

https://www.cyberciti.biz/faq/linux-xen-vmware-kvm-intel-vt-amd-v-support/

https://www.tecmint.com/check-linux-cpu-information/

https://xenbits.xen.org/docs/4.7-testing/misc/xen-command-line.html

https://wiki.xenproject.org/wiki/Xen_Common_Problems

This is the output when we do a “lscpu” in dom0:   “Virtualization type” is none, and “svm” and “vmx” are not shown in the CPU flags.   At first I thought “hypervisor” mode not enabled in BIOS, but it is not, it has been enabled.

https://discussions.citrix.com/topic/390487-virtualization-type-none/

And so it is a dom0 problem:   VMX/SVM has been explicitly disabled in dom0.   But the underlying host is still virtualization-enabled:

xe host-list params=capabilities
capabilities (SRO) : xen-3.0-x86_64; xen-3.0-x86_32p; hvm-3.0-x86_32; hvm-3.0-x86_32p; hvm-3.0-x86_64;

https://www.cyberciti.biz/faq/linux-xen-vmware-kvm-intel-vt-amd-v-support/

egrep -wo 'vmx|ept|vpid|npt|tpr_shadow|flexpriority|vnmi|lm|aes' /proc/cpuinfo | sort | uniq

aes
lm

cat /sys/hypervisor/properties/capabilities

xen-3.0-x86_64 xen-3.0-x86_32p hvm-3.0-x86_32 hvm-3.0-x86_32p hvm-3.0-x86_64

Finally, as confirmed with “xl dmesg”, the Xen server indeed bootup with virtualization detected successfully:

(XEN) [    2.003723] ENABLING IO-APIC IRQs
(XEN) [    2.013342] -> Using new ACK method
(XEN) [    2.022265] ..TIMER: vector=0xF0 apic1=0 pin1=2 apic2=-1 pin2=-1
(XEN) [    2.422363] Defaulting to alternative key handling; send 'A' to switch to normal mode.
(XEN) [    2.432696] Allocated console ring of 128 KiB.
(XEN) [    2.441887] HVM: ASIDs enabled.
(XEN) [    2.450694] SVM: Supported advanced features:
(XEN) [    2.459927] - Nested Page Tables (NPT)
(XEN) [    2.468485] - Last Branch Record (LBR) Virtualisation
(XEN) [    2.477635] - Next-RIP Saved on #VMEXIT
(XEN) [    2.486049] - VMCB Clean Bits
(XEN) [    2.495104] - DecodeAssists
(XEN) [    2.503332] - Virtual VMLOAD/VMSAVE
(XEN) [    2.512256] - Virtual GIF
(XEN) [    2.520327] - Pause-Intercept Filter
(XEN) [    2.529088] - Pause-Intercept Filter Threshold
(XEN) [    2.537102] - TSC Rate MSR
(XEN) [    2.545735] HVM: SVM enabled
(XEN) [    2.553541] HVM: Hardware Assisted Paging (HAP) detected
(XEN) [    2.562176] HVM: HAP page sizes: 4kB, 2MB, 1GB
(XEN) [    2.570291] alt table ffff82d08044bed0 -> ffff82d080459d9c
(XEN) [    3.331164] Brought up 24 CPUs
(XEN) [    3.341236] Testing NMI watchdog on all CPUs: ok
(XEN) [    3.391432] mcheck_poll: Machine check polling timer started.
(XEN) [    3.401379] xenoprof: Initialization failed. AMD processor family 23 is not supported
(XEN) [    3.410792] Dom0 has maximum 1016 PIRQs
(XEN) [    3.420018] csched_alloc_domdata: setting dom 0 as the privileged domain
(XEN) [    3.429372] NX (Execute Disable) protection active
(XEN) [    3.438655] *** Building a PV Dom0 ***
(XEN) [    1.622367] AMD-Vi: IOMMU Extended Features:
(XEN) [    1.634936] - Peripheral Page Service Request
(XEN) [    1.646719] - x2APIC
(XEN) [    1.657599] - NX bit
(XEN) [    1.669069] - Invalidate All Command
(XEN) [    1.680503] - Guest APIC
(XEN) [    1.691099] - Performance Counters
(XEN) [    1.702436] - Host Address Translation Size: 0x2
(XEN) [    1.713747] - Guest Address Translation Size: 0
(XEN) [    1.724247] - Guest CR3 Root Table Level: 0x1
(XEN) [    1.735408] - Maximum PASID: 0xf
(XEN) [    1.746568] - SMI Filter Register: 0x1
(XEN) [    1.756882] - SMI Filter Register Count: 0x2
(XEN) [    1.767980] - Guest Virtual APIC Modes: 0x1
(XEN) [    1.778847] - Dual PPR Log: 0x2
(XEN) [    1.789039] - Dual Event Log: 0x2
(XEN) [    1.799796] - User / Supervisor Page Protection
(XEN) [    1.809834] - Device Table Segmentation: 0x3
(XEN) [    1.820567] - PPR Log Overflow Early Warning
(XEN) [    1.831308] - PPR Automatic Response
(XEN) [    1.841139] - Memory Access Routing and Control: 0x1
(XEN) [    1.851692] - Block StopMark Message
(XEN) [    1.862185] - Performance Optimization
(XEN) [    1.871928] - MSI Capability MMIO Access
(XEN) [    1.882845] - Guest I/O Protection
(XEN) [    1.892389] - Host Access
(XEN) [    1.902549] - Enhanced PPR Handling
(XEN) [    1.912846] - Attribute Forward
(XEN) [    1.922137] - Virtualized IOMMU
(XEN) [    1.932082] - VMGuard I/O Support
(XEN) [    1.941250] - VM Table Size: 0x2
(XEN) [    1.964466] AMD-Vi: IOMMU 0 Enabled.
(XEN) [    1.974743] I/O virtualisation enabled



(XEN) [    3.429372] NX (Execute Disable) protection active

(XEN) [    1.974743] I/O virtualisation enabled
(XEN) [    1.984439] - Dom0 mode: Relaxed
(XEN) [    1.993952] Interrupt remapping enabled
(XEN) [    2.003723] ENABLING IO-APIC IRQs
(XEN) [    2.013342] -> Using new ACK method
(XEN) [    2.022265] ..TIMER: vector=0xF0 apic1=0 pin1=2 apic2=-1 pin2=-1
(XEN) [    2.422363] Defaulting to alternative key handling; send 'A' to switch to normal mode.
(XEN) [    2.432696] Allocated console ring of 128 KiB.
(XEN) [    2.441887] HVM: ASIDs enabled.

(XEN) [    3.420018] csched_alloc_domdata: setting dom 0 as the privileged domain
(XEN) [    3.429372] NX (Execute Disable) protection active
(XEN) [    3.438655] *** Building a PV Dom0 ***
(XEN) [    3.598258] Xen kernel: 64-bit, lsb, compat32
(XEN) [    3.607564] Dom0 kernel: 64-bit, PAE, lsb, paddr 0x1000000 -> 0x302c000
(XEN) [    3.616031] PHYSICAL MEMORY ARRANGEMENT:
(XEN) [    3.624107] Dom0 alloc.: 0000000fe8000000->0000000fec000000 (1080651 pages to be allocated)
(XEN) [    3.632720] Init. ramdisk: 000000101df4b000->000000101f1ff7f1
(XEN) [    3.641122] VIRTUAL MEMORY ARRANGEMENT:
(XEN) [    3.649228] Loaded kernel: ffffffff81000000->ffffffff8302c000
(XEN) [    3.657668] Init. ramdisk: 0000000000000000->0000000000000000
(XEN) [    3.666057] Phys-Mach map: 0000008000000000->0000008000868000
(XEN) [    3.674731] Start info: ffffffff8302c000->ffffffff8302c4b8
(XEN) [    3.683416] Xenstore ring: 0000000000000000->0000000000000000
(XEN) [    3.692761] Console ring: 0000000000000000->0000000000000000
(XEN) [    3.701352] Page tables: ffffffff8302d000->ffffffff8304a000
(XEN) [    3.710315] Boot stack: ffffffff8304a000->ffffffff8304b000
(XEN) [    3.718818] TOTAL: ffffffff80000000->ffffffff83400000
(XEN) [    3.728002] ENTRY ADDRESS: ffffffff8242a180
(XEN) [    3.737824] Dom0 has maximum 16 VCPUs
(XEN) [    5.033103] Initial low memory virq threshold set at 0x4000 pages.
(XEN) [    5.043716] Scrubbing Free RAM in background
(XEN) [    5.054023] Std. Loglevel: Errors, warnings and info
(XEN) [    5.064475] Guest Loglevel: Nothing (Rate-limited: Errors and warnings)
(XEN) [    5.074753] Xen is relinquishing VGA console.
(XEN) [    5.206616] *** Serial input to DOM0 (type 'CTRL-a' three times to switch input)
(XEN) [    5.207461] Freed 600kB init memory

and other useful information from  “xl info“:

xl info|grep -i xen
xen_major : 4
xen_minor : 13
xen_extra : .0-8.3.xcpng8.1
xen_version : 4.13.0-8.3.xcpng8.1
xen_caps : xen-3.0-x86_64 xen-3.0-x86_32p hvm-3.0-x86_32 hvm-3.0-x86_32p hvm-3.0-x86_64
xen_scheduler : credit
xen_pagesize : 4096
xen_changeset : 85e1424de2dd, pq bcf9a0b5da2d
xen_commandline : dom0_mem=4304M,max:4304M watchdog ucode=scan dom0_max_vcpus=1-16 crashkernel=256M,below=4G console=vga vga=mode-0x0311
xend_config_format : 4


Leave a comment

Vickblöm

Research scattered with thoughts, ideas, and dreams

Penetration Testing Lab

Offensive Techniques & Methodologies

Astr0baby's not so random thoughts _____ rand() % 100;

@astr0baby on Twitter for fresh randomness

The Data Explorer

playing around with open data to learn some cool stuff about data analysis and the world

Conorsblog

Data | ML | NLP | Python | R

quyv

Just a thought

IFT6266 - H2017 Deep Learning

A Graduate Course Offered at Université de Montréal

Deep Learning IFT6266-H2017 UdeM

Philippe Paradis - My solutions to the image inpainting problem

IFT6266 – H2017 DEEP LEARNING

Pulkit's thoughts on the course project

Thomas Dinsmore's Blog

No man but a blockhead ever wrote except for money -- Samuel Johnson

the morning paper

a random walk through Computer Science research, by Adrian Colyer

The Spectator

Shakir's Machine Learning Blog