Bug 1716402

Try to verify this bug with new build:

virt-manager-2.0.0-5.1.el8_0.noarch
virt-install-2.0.0-5.1.el8_0.noarch
virt-manager-common-2.0.0-5.1.el8_0.noarch
libvirt-4.5.0-23.module+el8+2800+2d311f65.x86_64
qemu-kvm-2.12.0-63.module+el8+2833+c7d6d092.x86_64


Steps:
1. Prepare a host which support ibpb(there is IBRS or IBPB keyword in cpu model):  

# virsh capabilities
<capabilities>

  <host>
    <uuid>4c4c4544-0037-3310-8044-cac04f345732</uuid>
    <cpu>
      <arch>x86_64</arch>
      <model>EPYC-IBPB</model>
      <vendor>AMD</vendor>
      <microcode version='134222384'/>
...

Scenario-1 Testing on virt-manager UI

1. Launch virt-manager
# virt-manager

2. Set 'Edit'->'Preferences'->'New VM defaults'->select 'CPU default' as 'Copy host CPU definition', then click 'Close'.

3. Install a vm.
3.1 Select the local connection: QEMU/KVM
3.2 Click NEW button at the top of Virtual Machine Manager dialogue.
3.3 Select Network Install(HTTP,FTP or NFS)", and Click "Forward" button.
3.4 Enter URL in "URL" field, such as "http://download.eng.pek2.redhat.com/pub/rhel/released/RHEL-8/8.0.0/BaseOS/x86_64/os/"
3.5 Check "Automatically detect operating system based on install media", then click 'Forward'.
3.6 Keep following pages as default setting, and click 'Forward' step by step until click "Finish" button.
Result: Installation finishes with no error.

4. Check "new checkbox to control CPU security features" works. Double click a VM, and turn to "Show virtual hardware details" page.
Result: 
4.1 Cpu Model shows "EYPC-IBPB".
4.2 New checkbox "Enable available CPU security flaw mitigations" is added and it is checked by default.
# virsh dumpxml rhel8.0
...
  <cpu mode='custom' match='exact' check='full'>
    <model fallback='forbid'>EPYC-IBPB</model>
    <vendor>AMD</vendor>
    <feature policy='require' name='x2apic'/>
    <feature policy='require' name='tsc-deadline'/>
    <feature policy='require' name='hypervisor'/>
    <feature policy='require' name='tsc_adjust'/>
    <feature policy='require' name='cmp_legacy'/>
    <feature policy='require' name='perfctr_core'/>
    <feature policy='require' name='virt-ssbd'/>
    <feature policy='disable' name='monitor'/>
    <feature policy='disable' name='svm'/>
    <feature policy='require' name='topoext'/>
  </cpu>

4.2.1 Login guest and check guest cpu feature have ibpb
# cat /proc/cpuinfo

fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm art rep_good nopl xtopology extd_apicid eagerfpu pni pclmulqdq ssse3 fma cx16 sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm cmp_legacy cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw topoext perfctr_core retpoline_amd ssbd ibpb vmmcall fsgsbase tsc_adjust bmi1 avx2 smep bmi2 rdseed adx smap clflushopt sha_ni xsaveopt xsavec xgetbv1 virt_ssbd arat


Result: CPU security features(virt_ssbd, ssbd, ibpb) are added.

4.3 Uncheck "Enable available CPU security flaw mitigations" and restart vm again.
# virsh dumpxml rhel8.0
...
  <cpu mode='custom' match='exact' check='full'>
    <model fallback='forbid'>EPYC-IBPB</model>
    <feature policy='disable' name='monitor'/>
    <feature policy='require' name='x2apic'/>
    <feature policy='require' name='hypervisor'/>
    <feature policy='disable' name='svm'/>
    <feature policy='require' name='topoext'/>
  </cpu>

4.3.1 Login guest and check guest cpu feature don't have security CPU security features: virt_ssbd and ssbd.
# cat /proc/cpuinfo

fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm art rep_good nopl xtopology extd_apicid eagerfpu pni pclmulqdq ssse3 fma cx16 sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand hypervisor lahf_lm cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw topoext retpoline_amd ibpb vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap clflushopt sha_ni xsaveopt xsavec xgetbv1 arat


As a summary, it works well on virt-manager UI.

Scenario-2 Testing with virt-install cml.
1. Enable CPU secure parameter
# virt-install --name cpu --memory 1024 --disk /vnc.qcow2  --import  --cpu EPYC-IBPB,secure=yes --noautoconsole --debug
...
  <cpu mode='custom' match='exact' check='full'>
    <model fallback='forbid'>EPYC-IBPB</model>
    <feature policy='require' name='ibpb'/>
    <feature policy='require' name='virt-ssbd'/>
    <feature policy='disable' name='monitor'/>
    <feature policy='require' name='x2apic'/>
    <feature policy='require' name='hypervisor'/>
    <feature policy='disable' name='svm'/>
    <feature policy='require' name='topoext'/>
  </cpu>

Result: CPU security features are enabled with "secure=yes" setting

2. Disable CPU secure parameter
# virt-install --name cpu --memory 1024 --disk /vnc.qcow2  --import  --cpu EPYC-IBPB,secure=no --noautoconsole --debug
...
  <cpu mode='custom' match='exact' check='full'>
    <model fallback='forbid'>EPYC-IBPB</model>
    <feature policy='disable' name='monitor'/>
    <feature policy='require' name='x2apic'/>
    <feature policy='require' name='hypervisor'/>
    <feature policy='disable' name='svm'/>
    <feature policy='require' name='topoext'/>
  </cpu>

Result: CPU security features are disabled with "secure=no" setting

As a summary, adding CPU security features work well, so I move this bug from ON_QA to VERIFIED, thanks.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:1533