Bug 711317 - Mask dangerous features on xen hvm, even if the HV doesn't
Summary: Mask dangerous features on xen hvm, even if the HV doesn't
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: kernel
Version: 6.2
Hardware: x86_64
OS: Linux
medium
medium
Target Milestone: rc
: ---
Assignee: Igor Mammedov
QA Contact: Virtualization Bugs
URL:
Whiteboard:
Depends On: 709856
Blocks: 653816
TreeView+ depends on / blocked
 
Reported: 2011-06-07 07:38 UTC by Igor Mammedov
Modified: 2013-01-09 23:55 UTC (History)
19 users (show)

Fixed In Version: kernel-2.6.32-165.el6
Doc Type: Bug Fix
Doc Text:
Clone Of: 709856
Environment:
Last Closed: 2011-12-06 13:32:58 UTC
Target Upstream Version:


Attachments (Terms of Use)
[RHEL6.2 Xen PATCH] Mask dangerous features when running as xen guest hvm V2 (3.30 KB, patch)
2011-06-22 12:58 UTC, Igor Mammedov
no flags Details | Diff
[RHEL6.2 Xen PATCH V2] Mask dangerous features when running as xen guest hvm (3.22 KB, patch)
2011-06-22 16:25 UTC, Igor Mammedov
no flags Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1530 0 normal SHIPPED_LIVE Moderate: Red Hat Enterprise Linux 6 kernel security, bug fix and enhancement update 2011-12-06 01:45:35 UTC

Comment 2 Andrew Jones 2011-06-07 07:45:09 UTC
We should defend xen hvm guests against any unforeseen issues with constant_tsc
and nonstop_tsc as well. This is lower priority than the xenpv guest fix
though, since analysis and testing hasn't yet found issues with hvm guests.

Comment 3 RHEL Program Management 2011-06-07 08:01:16 UTC
This request was evaluated by Red Hat Product Management for inclusion
in a Red Hat Enterprise Linux maintenance release. Product Management has 
requested further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed 
products. This request is not yet committed for inclusion in an Update release.

Comment 4 Igor Mammedov 2011-06-22 12:58:51 UTC
Created attachment 505997 [details]
[RHEL6.2 Xen PATCH] Mask dangerous features when running as xen guest hvm V2

Comment 5 Igor Mammedov 2011-06-22 16:25:29 UTC
Created attachment 506055 [details]
[RHEL6.2 Xen PATCH V2] Mask dangerous features when running as xen guest hvm

Comment 6 Aristeu Rozanski 2011-07-08 21:57:56 UTC
Patch(es) available on kernel-2.6.32-165.el6

Comment 9 Qixiang Wan 2011-09-06 11:52:46 UTC
Verified with kernel-2.6.32-193.el6.

Tested with:

[1] Host : Intel Quad CPU Q9400, kernel-xen-2.6.18-259.el5 (which hasn't mask some of the features like pdpe1gb in hypervisor).

Before fix : HVM guest with RHEL6.1 GA kernel

# cat /proc/cpuinfo
...
flags		: fpu tsc msr pae cx8 cmov pat pse36 clflush dts mmx fxsr sse sse2 ss ht pbe syscall nx lm constant_tsc up arch_perfmon pebs bts rep_good aperfmperf pni dtes64 monitor ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm sse4_1 lahf_lm tpr_shadow vnmi flexpriority

After fix: HVM guest with kernel-2.6.32-193.el6
# cat /proc/cpuinfo
...
flags		: fpu tsc msr pae cx8 cmov pat pse36 clflush dts mmx fxsr sse sse2 ss ht pbe syscall nx lm up arch_perfmon pebs bts rep_good aperfmperf pni dtes64 ds_cpl vmx smx est tm2 ssse3 cx16 xtpr pdcm sse4_1 lahf_lm dts tpr_shadow vnmi flexpriority
...

# dmesg
...
CPU: CPU feature constant_tsc disabled on xen guest
...

[2] Host: AMD Opteron(tm) Processor 6168,  kernel-xen-2.6.18-259.el5

RHEL6.1 HVM guest with kernel-2.6.32-193.el6:

# cat /proc/cpuinfo
...
flags		: fpu vme de pse tsc msr pae mce cx8 apic mtrr pge mca cmov pat clflush mmx fxsr sse sse2 syscall nx mmxext lm up rep_good extd_apicid unfair_spinlock pni cx16 hypervisor lahf_lm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ibs skinit wdt
...

# dmesg
...
CPU: CPU feature pdpe1gb disabled on xen guest
CPU: CPU feature rdtscp disabled on xen guest

So the features are masked in the guest after fix, change this bug to VERIFIED.

Comment 10 errata-xmlrpc 2011-12-06 13:32:58 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1530.html


Note You need to log in before you can comment on or make changes to this bug.