Bug 1533125
| Summary: | Libvirt may prefer $CPUModel over $CPUModel-IBRS when reporting host CPU model | |||
|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Jiri Denemark <jdenemar> | |
| Component: | libvirt | Assignee: | Jiri Denemark <jdenemar> | |
| Status: | CLOSED ERRATA | QA Contact: | Luyao Huang <lhuang> | |
| Severity: | unspecified | Docs Contact: | ||
| Priority: | high | |||
| Version: | 7.5 | CC: | dyuan, Jan.van.Eldik, jherrman, klaas, lhuang, mtessun, rbalakri, xuzhang, yalzhang | |
| Target Milestone: | rc | Keywords: | ZStream | |
| Target Release: | --- | |||
| Hardware: | Unspecified | |||
| OS: | Unspecified | |||
| Whiteboard: | ||||
| Fixed In Version: | libvirt-3.9.0-8.el7 | Doc Type: | Bug Fix | |
| Doc Text: |
As a part of security update CVE-2017-5715, the libvirt service is expected to report whether the host CPU model was secured against the Kernel Side-channel Attacks exploit. However, in certain cases, libvirt incorrectly reported secured CPU models as unsecured. This problem has been fixed, and libvirt now reports the security status of the host CPU correctly.
|
Story Points: | --- | |
| Clone Of: | ||||
| : | 1533415 1533418 (view as bug list) | Environment: | ||
| Last Closed: | 2018-04-10 11:04:21 UTC | Type: | Bug | |
| Regression: | --- | Mount Type: | --- | |
| Documentation: | --- | CRM: | ||
| Verified Versions: | Category: | --- | ||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
| Cloudforms Team: | --- | Target Upstream Version: | ||
| Embargoed: | ||||
| Bug Depends On: | ||||
| Bug Blocks: | 1533415, 1533418 | |||
|
Description
Jiri Denemark
2018-01-10 14:08:52 UTC
Fixed upstream by commit:
commit b427cf4831d0ea7aac9dd1a3aa7682478356a483
Refs: v3.10.0-154-gb427cf4831
Author: Jiri Denemark <jdenemar>
AuthorDate: Fri Jan 5 17:43:03 2018 +0100
Commit: Jiri Denemark <jdenemar>
CommitDate: Wed Jan 10 11:07:23 2018 +0100
cpu_x86: Copy CPU signature from ancestor
When specifying a new CPU model in cpu_map.xml as an extension to an
existing model, we forgot to copy the signature (family + model) from
the original CPU model.
We don't use this way of specifying CPU models, but it's still supported
and it becomes useful when someone wants to quickly hack up a CPU model
for testing or when creating additional variants of existing models to
help with fixing some spectral issues.
Signed-off-by: Jiri Denemark <jdenemar>
Reviewed-by: Pavel Hrdina <phrdina>
Verify this bug with libvirt-3.9.0-8.el7.x86_64 on Skylake-server and EPYC host.
1.
# lscpu
Architecture: x86_64
...
Vendor ID: GenuineIntel
CPU family: 6
Model: 85
...
Flags: ...spec_ctrl ibpb_support...
2.
virsh # capabilities
...
<cpu>
<arch>x86_64</arch>
<model>Skylake-Server-IBRS</model>
<vendor>Intel</vendor>
<microcode version='33554492'/>
...
3. start a guest with host-model
# virsh start vm1
Domain vm1 started
4. check the guest xml and qemu cmdline:
<cpu mode='custom' match='exact' check='full'>
<model fallback='forbid'>Skylake-Server-IBRS</model>
<vendor>Intel</vendor>
<feature policy='require' name='ss'/>
<feature policy='require' name='hypervisor'/>
<feature policy='require' name='tsc_adjust'/>
<feature policy='require' name='clflushopt'/>
<feature policy='require' name='pku'/>
<feature policy='disable' name='arat'/>
<numa>
<cell id='0' cpus='0-1' memory='512000' unit='KiB'/>
<cell id='1' cpus='2-3' memory='512000' unit='KiB'/>
</numa>
</cpu>
# ps aux|grep qemu
... -cpu Skylake-Server-IBRS,ss=on,hypervisor=on,tsc_adjust=on,clflushopt=on,pku=on
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:0704 |