Sono in esecuzione macchine virtuali in kvm/qemu hypervisor. L'hypervisor ha la mitigazione Meltdown / Spectre abilitata nel kernel.
È necessario che le macchine virtuali abbiano abilitato anche la mitigazione Meltdown / Spectre o la protezione fornita dall'hypervisor sia sufficiente?
In altre parole, l'host e il guest devono avere abilitato la mitigazione Meltdown / Spectre?
Q: .. do the host as well as the guest need to have Meltdown/Spectre mitigation enabled?
Sì
Quando queste vulnerabilità sono state annunciate, QEMU ha pubblicato su " QEMU e gli attacchi Spectre e Meltdown ":
Right now, there are no public patches to KVM that expose the new CPUID bits and MSRs to the virtual machines, therefore there is no urgent need to update QEMU; remember that updating the host kernel is enough to protect the host from malicious guests. Nevertheless, updates will be posted to the qemu-devel mailing list in the next few days, and a 2.11.1 patch release will be released with the fix.
Once updates are provided, live migration to an updated version of QEMU will not be enough to protect guest kernel from guest userspace. Because the virtual CPU has to be changed to one with the new CPUID bits, the guest will have to be restarted.
(05/01/18 — by Paolo Bonzini and Eduardo Habkost: source)
Gli aggiornamenti sono stati disponibili, quindi dovresti procedere con loro e abilitare la mitigazione anche sugli ospiti.
In base all'articolo QEMU " QEMU 2.11.1 e uso della mitigazione Spectre / fusione per ospiti KVM ":
What is being addressed here is enabling a guest operating system to enable the same (or similar) mitigations to protect itself from unprivileged guest processes running under the guest operating system.
Enabling mitigation features for x86 KVM guests:
For x86 guests there are 2 additional CPU flags associated with Spectre/Meltdown mitigation:
spec-ctrl, andibpb:
spec-ctrl: exposes Indirect Branch Restricted Speculation (IBRS)ibpb: exposes Indirect Branch Prediction BarriersUtilizing this functionality requires guest/host kernel updates, as well as microcode updates for Intel and recent AMD processors. The status of these kernel patches upstream is still in flux, but most supported distros have some form of the patches that is sufficient to make use of the functionality. The current status/availability of microcode updates depends on your CPU architecture/model. Please check with your vendor/distro to confirm these prerequisites are available/installed.
(14/02/18 — by Michael Roth: source)
Leggi altre domande sui tag virtualization kernel kvm meltdown spectre