XPTI (Xen Page Table Isolation) was introduced to mitigate Meltdown
(CVE-2017-5754, one aspect of XSA-254). This involves copying 64-bit PV
guest page table entries from guest-chosen root page tables to the Xen-
chosen one which is in actual use by hardware. To read the guest root
page table, the directmap is used. PV guests, however, have a directmap
which may not cover all memory; in particular this is the case if any
memory extends beyond the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) address
boundary.
All versions of Xen with the XPTI work backported to are affected. In
upstream these are Xen 4.7.5 and onwards, Xen 4.8.3 and onwards, Xen 4.9.2
and onwards, Xen 4.10.1 and onwards, and all major releases from 4.11
onwards.
Only 64-bit PV guests can leverage the vulnerability. HVM and PVH guests
cannot leverage the vulnerability. 32-bit PV guests haven't been security
supported anymore.
Only x86 systems are affected. Arm systems are not affected.
Only systems with RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5 TiB) boundary
are affected. Systems with no RAM above the 5 TiB (CONFIG_BIGMEM=y: 3.5
TiB) boundary are not affected.
Not running 64-bit PV guests will avoid the vulnerability.
The "mem=" hypervisor command line option may be used to limit the amount
of memory Xen is going to use. That would be "mem=5T" for the
CONFIG_BIGMEM=n case and "mem=3584G" for the CONFIG_BIGMEM=y one.