Meltdown and Spectre Linux Kernel fixes

[Inglebard]

Hi,

Here is a newbie question.
Are proxmox updates self-suffisant to protect against meltdown and spectre or it is necessary to install intel microcode from debian repository ?

 

[fabian]

PVE updates are enough to fix Meltdown. the Spectre fixes / mitigations are still in preparation, the first round will likely only support CPUs with updated microcodes, a later iteration will then have the fallback for all CPUs. check the changelogs once they are available.

 

[Inglebard]

So should I need to enable debian non-free and install intel-microcode (yes or no) ?

 

[aderumier]

So should I need to enable debian non-free and install intel-microcode (yes or no) ?

don't install microcode for now, it's known to be buggy and do instability

 

[Inglebard]

Ok, thanks.

 

[speedbird]

Installed the updates from pve-enterprise with active subscription but there's no checkbox for PCID anywhere to be seen. What did I do wrong?

 

[JustDanMan]

Installed the updates from pve-enterprise with active subscription but there's no checkbox for PCID anywhere to be seen. What did I do wrong?

In this moment, the updates only available in pve-no-subscription.

 

[scaa]

Das habe ich gar nicht mitbekommen. Gibt es einen Schalter in der Gui womit man PCID ein-/ausschalten kann?

 

[stef1777]

Hi!

Compatibility and stability problems with mitigation codes continue and rise.

Spectre and Meltdown patches causing trouble as realistic attacks get closer
https://arstechnica.com/gadgets/201...sing-trouble-as-realistic-attacks-get-closer/

Meltdown/Spectre fixes made AWS CPUs cry, says SolarWinds
https://www.theregister.co.uk/2018/01/15/solarwinds_aws_meltdown_fix_analysis/

Meltdown-Spectre: More businesses warned off patching over stability issues
http://www.zdnet.com/article/meltdo...es-warned-off-patching-over-stability-issues/

 

[fabian]

In this moment, the updates only available in pve-no-subscription.

now on pve-enterprise as well

 

[fabian]

there are new kernel versions for both 4.4 and 5.1 available:

pve-kernel (4.13.13-36) unstable; urgency=medium

* cherry-pick (partial) SPECTRE fixes for CPUs supporting IBRS/IBPB
* follow-up fixes for KPTI

pve-kernel (4.4.98-104) unstable; urgency=medium

* cherry-pick (partial) SPECTRE fixes for CPUs supporting IBRS/IBPB
* follow-up fixes for KPTI

most of the SPECTRE fixes require having a compatible CPU microcode update enabling IBRS/IBPB support.

updated pve-qemu-kvm packages which allows passing the spec-ctrl CPU flag to guest VMs are also available in pve-no-subscription (this only works for VMs with CPU type 'host' at the moment, updated qemu-server and pve-manager packages which allow setting this CPU flag for other CPU types are in the works).

 

[fireon]

I didn't read here Windows, so PCID has only effect with linux vm's?

 

[fabian]

I didn't read here Windows, so PCID has only effect with linux vm's?

you'd have to ask Microsoft to know how they implemented their Meltdown mitigation, and whether they use PCID to limit the performance impact..

 

[fireon]

you'd have to ask Microsoft to know how they implemented their Meltdown mitigation, and whether they use PCID to limit the performance impact..

Ok, thank you. Will do an support ticket

 

[bladux]

Hi,

Any idea of when the patched kernels will leave pvetest ? 'Kinda worried to switch to pvetest on production servers...

 

[fabian]

Hi,

Any idea of when the patched kernels will leave pvetest ? 'Kinda worried to switch to pvetest on production servers...

the latest round of kernel updates are available up to pve-no-subscription, the Meltdown / KPTI kernels are in pve-enterprise already for a while.

 

[bladux]

I'm on pve-entreprise, I see the pve-manager and qemu-server upgrades.

I must have missed something but is it worth installing without installing a patched kernel ? (If new kernels leaves the pvetest/pve-no-subscription zone to a stable one soon, then I probably should wait and install all at once).

 

[fabian]

I'm on pve-entreprise, I see the pve-manager and qemu-server upgrades.

I must have missed something but is it worth installing without installing a patched kernel ? (If new kernels leaves the pvetest/pve-no-subscription zone to a stable one soon, then I probably should wait and install all at once).

there have been two rounds of pve-manager and qemu-server packages, so yes - the ones in pve-enterprise match the kernel and pve-qemu in pve-enterprise, the later ones match later updates. we always move packages such that they match (e.g., a pve-manager package exposing a new feature should never be available without the backend package that provides the feature).

 

[stef1777]

Hi!

Found a guy who tried Meltdown patch with Virtuozzo Container on a SSD HP blade.

Nice result.



https://communities.intel.com/thread/121555?wapkw=meltdown

 

[scaa]

Host:
4.13.13-3-pve #1 SMP PVE 4.13.13-34 (Sun, 7 Jan 2018 13:19:58 +0100) x86_64 GNU/Linux
1x Intel Xeon E3-1240v6
Supermicro X11SSL-F
16GB ECC DDR-4
Adaptec 8405 RAID Controller
2x Samsung SM863 SSD with Raid-1

only one VM:
3.16.0-5-amd64 #1 SMP Debian 3.16.51-3+deb8u1 (2018-01-08) x86_64 GNU/Linux
KVM, Debian 8

After that we install again tho old kernel...
3.16.0-4-amd64 #1 SMP Debian 3.16.51-3 (2017-12-13) x86_64 GNU/Linux