Veröffentlicht am von ron

ESXi 6.7u2 and later – SCAv2 (Side Channel aware Scheduler v2)

While the „old“ SCAv1 built a virtual fence around all virtual processors („Intra VM Security Boundary“), SCAv2 lets processors of one virtual machine (VM) to run within a „common fence“ („Inter VM Security Boundary“) which balances security and performance for most workloads.

See https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/techpaper/performance/scheduler-options-vsphere67u2-perf.pdf for performance analysis.

Configure

esxcli system settings kernel set -s hyperthreadingMitigation -v TRUE
esxcli system settings kernel set -s hyperthreadingMitigationIntraVM -v FALSE

Verify

esxcli system settings kernel list -o hyperthreadingMitigation
esxcli system settings kernel list -o hyperthreadingMitigationIntraVM

[root@esx:~] esxcli system settings kernel list -o hyperthreadingMitigation
Name                      Type  Configured  Runtime  Default  Description
------------------------  ----  ----------  -------  -------  ----------------------------------------------------------------
hyperthreadingMitigation  Bool  TRUE        TRUE     FALSE    Restrict the simultaneous use of logical processors from the
                                                              same hyperthreaded core as necessary to mitigate a security
                                                              vulnerability.
[root@esx:~] esxcli system settings kernel list -o hyperthreadingMitigationIntraVM
Name                             Type  Configured  Runtime  Default  Description
-------------------------------  ----  ----------  -------  -------  ---------------------------------------------------------
hyperthreadingMitigationIntraVM  Bool  FALSE       FALSE    TRUE     Restrict the simultaneous use of logical processors from
                                                                     the same hyperthreaded core as necessary to mitigate a
                                                                     security vulnerability within a single VM.

Configure SCAv1

esxcli system settings kernel set -s hyperthreadingMitigation -v TRUE
esxcli system settings kernel set -s hyperthreadingMitigationIntraVM -v TRUE

Schreibe einen Kommentar