Vmware Side-channel-aware Scheduler V2
According to VMware the mitigation for this warning is to enable the 'ESXi Side-Channel-Aware Scheduler' which 'may impose a non-trivial performance impact' - see Has anyone seen the affect of this 'non-trivial' performance impact? The ESXi Side-Channel-Aware Scheduler Version 2 introduced in 6.7u2 does NOT mitigate MDS Intra-VM Concurrent-context attack vectors at the Virtual Machine layer. These options may impose a non-trivial performance impact and are not enabled by default. Picking up another blog post that I had in my drafts waiting to be finished, and I never did. In this Change ESXi host to use ESXi Side-Channel-Aware Scheduler v2 (SCAv2), I will explain how to change your VMware infrastructure to use SCAV2 instead of SCAv1. A quick explanation about ESXi Side-Channel-Aware Scheduler v2 (SCAv2).
The ESXi Side-Channel-Aware Scheduler is generally compatible with existing vSphere CPU resource management settings. For example, enablement of the ESXi Side-Channel-Aware Scheduler will not impact existing CPU allocation specified by CPU reservations, limits, and shares on VMs or resource pools. ESXi Side-Channel-Aware Scheduler impact. Enabling the ESXi Side-Channel-Aware Scheduler, you may experience some performance issues with a service degradation. Before enabling this parameter read carefully the KB55767. Due to these limitations, the ESXi Side-Channel-Aware Scheduler is disabled by default and it's up to the administrators/organizations to enable this parameter.
VMware vSphere ESXi 6.7U2 is just released so my eagerness told me to upgrade the lab asap.
If you are interested in what's changed. The release notes are here.
What's New
- Solarflare native driver: ESXi 6.7 Update 2 adds Solarflare native driver (sfvmk) support for Solarflare 10G and 40G network adaptor devices, such as SFN8542 and SFN8522.
- Virtual Hardware Version 15: ESXi 6.7 Update 2 introduces Virtual Hardware Version 15 which adds support for creating virtual machines with up to 256 virtual CPUs. For more information, see VMware knowledge base articles 1003746 and 2007240.
- Standalone ESXCLI command package: ESXi 6.7 Update 2 provides a new Standalone ESXCLI package for Linux, separate from the vSphere Command Line Interface (vSphere CLI) installation package. The ESXCLI, which is a part of the vSphere CLI, is not updated for ESXi 6.7 Update 2. Although the vSphere CLI installation package is deprecated for this release and is still available for download, you must not install it together with the new Standalone ESXCLI for Linux package. For information about downloading and installing the Standalone ESXCLI package, see VMware {code}.
- In ESXi 6.7 Update 2, the Side-Channel-Aware Scheduler is updated to enhance the compute performance for ESXi hosts that are mitigated for speculative execution hardware vulnerabilities. For more information, see VMware knowledge base article 55806.
- ESXi 6.7 update 2 adds support for VMFS6 automatic unmap processing on storage arrays and devices that report to ESXi hosts an unmap granularity value greater than 1 MB. On arrays that report granularity of 1 MB and less, the unmap operation is supported if the granularity is a factor of 1 MB.
- ESXi 6.7 update 2 adds VMFS6 to the list of supported file systems by the vSphere On-disk Metadata Analyzer (VOMA) to allow you to check and fix issues with VMFS volumes metadata, LVM metadata, and partition table inconsistencies.
You can upgrade in many ways.
The most common are:
- VMware Update Manager
- Via ISO, boot it and in place upgrade your host
- Or via esxcli using online or offline depot.
I will be showing the offline depot method here since that is my preferred way to do it since I have a single host lab and no way to do it via VUM or IPMI 🙂
Upgrade via ESXCLI
First, download the offline depot (update-from-esxi6.7-6.7_update02.zip) from My VMware and upload that bundle to one of your local storage disks in your host.
After uploading the file to your datastore, log in as root with ssh to your host.
Now to find out what profile to use run the following command:
Be aware that you need to change the datastore name to match your datastore where you uploaded your offline bundle. In my case this is SSD_01
As you see, the image profile you need to use is ESXi-6.7.0-20190402001-standard
Vmware Side Channel Aware Scheduler Tool
Vmware Side-channel-aware Scheduler V2
According to VMware the mitigation for this warning is to enable the 'ESXi Side-Channel-Aware Scheduler' which 'may impose a non-trivial performance impact' - see Has anyone seen the affect of this 'non-trivial' performance impact? The ESXi Side-Channel-Aware Scheduler Version 2 introduced in 6.7u2 does NOT mitigate MDS Intra-VM Concurrent-context attack vectors at the Virtual Machine layer. These options may impose a non-trivial performance impact and are not enabled by default. Picking up another blog post that I had in my drafts waiting to be finished, and I never did. In this Change ESXi host to use ESXi Side-Channel-Aware Scheduler v2 (SCAv2), I will explain how to change your VMware infrastructure to use SCAV2 instead of SCAv1. A quick explanation about ESXi Side-Channel-Aware Scheduler v2 (SCAv2).
The ESXi Side-Channel-Aware Scheduler is generally compatible with existing vSphere CPU resource management settings. For example, enablement of the ESXi Side-Channel-Aware Scheduler will not impact existing CPU allocation specified by CPU reservations, limits, and shares on VMs or resource pools. ESXi Side-Channel-Aware Scheduler impact. Enabling the ESXi Side-Channel-Aware Scheduler, you may experience some performance issues with a service degradation. Before enabling this parameter read carefully the KB55767. Due to these limitations, the ESXi Side-Channel-Aware Scheduler is disabled by default and it's up to the administrators/organizations to enable this parameter.
VMware vSphere ESXi 6.7U2 is just released so my eagerness told me to upgrade the lab asap.
If you are interested in what's changed. The release notes are here.
What's New
- Solarflare native driver: ESXi 6.7 Update 2 adds Solarflare native driver (sfvmk) support for Solarflare 10G and 40G network adaptor devices, such as SFN8542 and SFN8522.
- Virtual Hardware Version 15: ESXi 6.7 Update 2 introduces Virtual Hardware Version 15 which adds support for creating virtual machines with up to 256 virtual CPUs. For more information, see VMware knowledge base articles 1003746 and 2007240.
- Standalone ESXCLI command package: ESXi 6.7 Update 2 provides a new Standalone ESXCLI package for Linux, separate from the vSphere Command Line Interface (vSphere CLI) installation package. The ESXCLI, which is a part of the vSphere CLI, is not updated for ESXi 6.7 Update 2. Although the vSphere CLI installation package is deprecated for this release and is still available for download, you must not install it together with the new Standalone ESXCLI for Linux package. For information about downloading and installing the Standalone ESXCLI package, see VMware {code}.
- In ESXi 6.7 Update 2, the Side-Channel-Aware Scheduler is updated to enhance the compute performance for ESXi hosts that are mitigated for speculative execution hardware vulnerabilities. For more information, see VMware knowledge base article 55806.
- ESXi 6.7 update 2 adds support for VMFS6 automatic unmap processing on storage arrays and devices that report to ESXi hosts an unmap granularity value greater than 1 MB. On arrays that report granularity of 1 MB and less, the unmap operation is supported if the granularity is a factor of 1 MB.
- ESXi 6.7 update 2 adds VMFS6 to the list of supported file systems by the vSphere On-disk Metadata Analyzer (VOMA) to allow you to check and fix issues with VMFS volumes metadata, LVM metadata, and partition table inconsistencies.
You can upgrade in many ways.
The most common are:
- VMware Update Manager
- Via ISO, boot it and in place upgrade your host
- Or via esxcli using online or offline depot.
I will be showing the offline depot method here since that is my preferred way to do it since I have a single host lab and no way to do it via VUM or IPMI 🙂
Upgrade via ESXCLI
First, download the offline depot (update-from-esxi6.7-6.7_update02.zip) from My VMware and upload that bundle to one of your local storage disks in your host.
After uploading the file to your datastore, log in as root with ssh to your host.
Now to find out what profile to use run the following command:
Be aware that you need to change the datastore name to match your datastore where you uploaded your offline bundle. In my case this is SSD_01
As you see, the image profile you need to use is ESXi-6.7.0-20190402001-standard
Vmware Side Channel Aware Scheduler Tool
Now to upgrade your host use the following command:
You will see after a minute that all vibs are updated and that you need to reboot your host.
Reboot it and you are done! you just upgraded from 6.7U1 to 6.7U2
