XCP 8.3 coretemp module doesn't detect any sensors

[mikhail-shevtsov-wiregate]

When installed XCP-NG 8.2 with coretemp-module-alt I was able to check CPU temperature using lm_sensors package.
CPU: Intel(R) Xeon(R) CPU E5-2689 0 @ 2.60GHz
But when I reinstalled from scratch XCP-NG 8.3 with same package it cannot longer detect any sensors on motherboard.

Any hint would be appreciated.

[olivierlambert]

Pinging @gduperrey

[SlashQuit]

Same/similar as per;
#415
#249
... and then one in the "Feedback" section at;
https://xcp-ng.org/forum/topic/9765/coretemp-alt-no-longer-works-with-8-3

This includes with a rebuilt coretemp.ko from;
https://github.com/rushikeshjadhav/coretemp
(Using 8.3 instead of 8.0, and a 8.3 xcp-ng-build-env from ...)
https://github.com/xcp-ng/xcp-ng-build-env

[wechka53]

Same here. No sensors found from release 8.3.
8.2 and even 8.3 betas were working fine

[tescande]

Access to these CPU registers (MSRs) is actually not allowed in the context of a virtual machine, even in dom0. The fact that it was previously possible is more accidental and access is now disabled in the hypervisor. One reason for that is https://xenbits.xen.org/xsa/advisory-351.html

So even with the modifications done to the coretemp alt driver to work on 8.2, it is not possible to get it working on 8.3. And I suppose it was working on 8.3 beta prior to the introduction of Xen 4.17.

[rwjack]

Sooo... We were okay with no per thread temp readings, but no temp readings at all is straight up wack.

[stormi]

In the short term, would reading from IPMI be an acceptable workaround?

[rwjack]

damn, no love for homelabbers and consumer hardware. Anyways, I do have a single dell 5820 available, unsure if it has IPMI though.

[olivierlambert]

It's not a question of preferring some users vs others, it's really a Xen security/isolation problem in the first place. A solution is to not requesting the CPU capability directly from the Dom0 but going via an IPMI. I hope you understand we cannot leave a big security hole wide open and we had to fix it.

[rwjack]

Of course, I absolutely understand what you're saying. I'm a security guy myself, but on the other hand, I won't have much to secure if my servers die due to me not being able to monitor their health status (temps) ((yes, it's far fetched, but monitoring the temps gives me, and I think others, peace of mind)).

Do you think there any other potential solutions to this problem, other than buying enterprise level hardware? Perhaps getting an external pluggable device that could monitor the temps on consumer hardware? (If such a thing even exists)

Not sure if, for example, JetKVM could do the job? In theory it acts as an IPMI (kvm over IP + power control), but I'm doubtful it can read the temps as well.

This issue is literally the only thing barring me from jumping from 8.2.1, and testing 8.3.

[mikhail-shevtsov-wiregate]

@olivierlambert Just an idea. Maybe this security feature could be turned off during boot time with some boot flag?
Or it is impossible to do that due to hardcode in XEN hypervisor source?

[stormi]

That's something that is to be improved in Xen itself, to provide a way to access safely such data from the control domain which currently can't access that.

[rwjack]

So now that 8.3 is the LTS release, and 8.2.1 will be deprecated soon, is there any way at all to monitor cpu temps on non-enterprise hardware?

[olivierlambert]

I'm not aware of a trivial way to do it. I will make sure it's in the next XCP-ng team discussion so we have an idea of what can be done and where to put it in our backlog.

[olivierlambert]

Okay I asked internally, and it was already in the pipes for studying our different possibilities. So we'll come back here in few weeks (months tops) with the output of our investigation.

[bugsyb]

Amazing! Thank you @olivierlambert - there are more of us, using xcp-ng at home and spreading out the word to where we have influence to help XCP-ng take over VMware deployments.