Bug 1533415
| Summary: | Libvirt may prefer $CPUModel over $CPUModel-IBRS when reporting host CPU model [rhel-7.3.z] | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Oneata Mircea Teodor <toneata> |
| Component: | libvirt | Assignee: | Jiri Denemark <jdenemar> |
| Status: | CLOSED ERRATA | QA Contact: | Luyao Huang <lhuang> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | high | ||
| Version: | 7.5 | CC: | dyuan, jdenemar, jherrman, klaas, lhuang, mtessun, rbalakri, xuzhang, yalzhang |
| Target Milestone: | rc | Keywords: | ZStream |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | libvirt-2.0.0-10.el7_3.11 | Doc Type: | Bug Fix |
| Doc Text: |
As a part of security update CVE-2017-5715, the libvirt service is expected to report whether the host CPU model was secured against the Kernel Side-channel Attacks exploit. However, in certain cases, libvirt incorrectly reported secured CPU models as unsecured. This problem has been fixed, and libvirt now reports the security status of the host CPU correctly.
|
Story Points: | --- |
| Clone Of: | 1533125 | Environment: | |
| Last Closed: | 2018-01-25 12:59:10 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1533125 | ||
| Bug Blocks: | |||
|
Description
Oneata Mircea Teodor
2018-01-11 10:04:02 UTC
Reproduce this issue on libvirt-2.0.0-10.el7_3.10.x86_64:
0. prepare a skylake cpu host which have update the microcode and can see the spec_ctrl in cpu flags:
# cat /proc/cpuinfo
flags : ... spec_ctrl ibpb_support ...
1. change the skylake client cpu model number to match host cpu model in cpu_map.xml if needed (this help to reproduce this issue):
2. restart libvirtd and recheck host caps:
virsh # capabilities
...
<arch>x86_64</arch>
<model>Skylake-Client</model>
...
<feature name='spec-ctrl'/>
...
3. start a guest with host-model cpu and recheck qemu cmd line and xml:
# virsh dumpxml vm1 --update-cpu
...
<cpu mode='host-model' match='exact'>
<model fallback='forbid'>Skylake-Client</model>
<vendor>Intel</vendor>
...
<feature policy='require' name='spec-ctrl'/>
...
# ps aux|grep qemu
-cpu Skylake-Client, ...+spec-ctrl...
And verify this bug with libvirt-2.0.0-10.el7_3.11.x86_64:
1. change the skylake client cpu model number to match host cpu model in cpu_map.xml if needed (this help to reproduce this issue):
2. restart libvirtd and recheck host caps:
virsh # capabilities
<capabilities>
...
<model>Skylake-Client-IBRS</model>
<vendor>Intel</vendor>
...
3. start a guest with host-model cpu and recheck qemu cmd line and xml:
# virsh dumpxml vm1 --update-cpu
...
<cpu mode='host-model' match='exact'>
<model fallback='forbid'>Skylake-Client-IBRS</model>
<vendor>Intel</vendor>
# ps aux|grep qemu
-cpu Skylake-Client-IBRS,..(no spec-ctrl)...
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0188 |