Spectre / Meltdown CPU bugs - short notice reboots will be needed, little other info yet
4 Jan
2018
4 Jan
'18
3:23 p.m.
Hello,
As you're probably aware, it turns out that pretty much every CPU
made in the last 10 years is broken, and while this affects almost
all computers, this is going to have a particularly nasty effect on
virtualisation providers such as BitFolk.
The Xen project last night released the first version of their
advisory which is XSA-254:
https://xenbits.xen.org/xsa/advisory-254.html
This is with no embargo, because the original embargo had to be
abandoned by the discoverers of the bugs.
As you can see, unfortunately the Xen project have no resolutions
for any of this available as yet.
There's three different issues here:
1. SP1/Spectre (CVE-2017-5753)
2. SP2/Spectre (CVE-2017-5715)
3. SP3/Meltdown (CVE-2017-5754)
There isn't any known resolution for (1) yet.
Xen are working on mitigations for (2).
It's possible to avoid (3) by going to HVM mode, but that is a huge
change that brings other problems with it. It can also be avoided by
running in PVH mode, but very few guest kernels will be new enough
to support that. Xen are hoping to come up with a way to run
PV-inside-PVH but they're not ready with that yet.
There will likely be other strategies to fix or mitigate these
issues in the coming days.
So I'm afraid there currently is no concrete plan because there is
very little information available yet. All I can tell you is that
there will be a need for short-notice reboots to apply relevant
fixes. I will post again when there is any useful information.
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
_______________________________________________
announce mailing list
announce(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/announce
11 Jan
11 Jan
9:39 p.m.
On Thu, Jan 04, 2018 at 03:23:45PM +0000, Andy Smith wrote:
I will post again when there is any useful
information.
https://xenbits.xen.org/xsa/advisory-254.html
A technical update follows. The non-technical version of it is:
The Xen Project have released a mitigation for one of the three bugs
("Meltdown") which I will be reviewing over the next couple of days.
They also have a different mitigation for the same bug, which they
aren't quite ready with, but I do like the sound of that one a bit
more so might end up going with that one.
It seems likely that there will be some required reboots early next
week.
The more technical version:
The Xen Project have updated the XSA notice with a mitigation for
Meltdown that involves converting all the guests so they still run
as PV mode but inside HVM containers ("Vixen"). That would mitigate
the Meltdown bug for Xen, although the guests would still need their
KPTI patches.
I don't like the HVM aspect of it but as it is what is available
now, I will spend the next couple of days looking into it, and it
may get deployed over the weekend or early next week.
The other resolution is to backport the PVHv2 Xen mode back from Xen
4.10 to 4.8 and then either use that directly (PVHv2 requires
reasonably new guest kernels) or else again run them as PV-in-PVH.
Although I prefer the sound of this, they aren't ready with it yet,
and it hasn't received as much testing yet. Vixen comes from Amazon
and is apparently what every PV-mode AWS VM is running under.
If we end up going with Vixen then host reboots won't initially be
required, as it is something that guests reboot into.
Please be aware however that on BitFolk's side there are going to be
both BIOS updates and CPU microcode updates to come, which will be
necessary for later kernel-based fixes to work, so there will
definitely be at least one set of host reboots some time soon.
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
_______________________________________________
announce mailing list
announce(a)lists.bitfolk.com
https://lists.bitfolk.com/mailman/listinfo/announce
12 Jan
12 Jan
1:35 p.m.
New subject: Spectre / Meltdown CPU bugs - short notice reboots will be needed, little other info yet
I, like many others I am sure, really appreciate your clear communication on this subject
Andy, sensible consideration of options and plans for moving forward.
Cheers,
Richard.
On 11 January 2018 22:39:44 CET, Andy Smith <andy(a)bitfolk.com> wrote:
On Thu, Jan 04, 2018 at 03:23:45PM +0000, Andy Smith
wrote:
I will post again when there is any useful
information.
https://xenbits.xen.org/xsa/advisory-254.html
A technical update follows. The non-technical version of it is:
The Xen Project have released a mitigation for one of the three bugs
("Meltdown") which I will be reviewing over the next couple of days.
They also have a different mitigation for the same bug, which they
aren't quite ready with, but I do like the sound of that one a bit
more so might end up going with that one.
It seems likely that there will be some required reboots early next
week.
The more technical version:
The Xen Project have updated the XSA notice with a mitigation for
Meltdown that involves converting all the guests so they still run
as PV mode but inside HVM containers ("Vixen"). That would mitigate
the Meltdown bug for Xen, although the guests would still need their
KPTI patches.
I don't like the HVM aspect of it but as it is what is available
now, I will spend the next couple of days looking into it, and it
may get deployed over the weekend or early next week.
The other resolution is to backport the PVHv2 Xen mode back from Xen
4.10 to 4.8 and then either use that directly (PVHv2 requires
reasonably new guest kernels) or else again run them as PV-in-PVH.
Although I prefer the sound of this, they aren't ready with it yet,
and it hasn't received as much testing yet. Vixen comes from Amazon
and is apparently what every PV-mode AWS VM is running under.
If we end up going with Vixen then host reboots won't initially be
required, as it is something that guests reboot into.
Please be aware however that on BitFolk's side there are going to be
both BIOS updates and CPU microcode updates to come, which will be
necessary for later kernel-based fixes to work, so there will
definitely be at least one set of host reboots some time soon.
Cheers,
Andy
--
https://bitfolk.com/ -- No-nonsense VPS hosting
2535
days inactive
2543
days old
2 comments
2 participants
participants (2)
-
Andy Smith -
Richard Glynos