Whitelist two more SSBD-related CPU flags for AMD ('amd-ssbd', 'amd-no-ssb')

Bug #1777460 reported by Kashyap Chamarthy on 2018-06-18
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
OpenStack Compute (nova)
Undecided
Unassigned
Ocata
High
Elod Illes
Pike
High
Dan Smith
Queens
High
Dan Smith

Bug Description

In addition to the existing 'virt-ssbd', future AMD CPUs will have
another (architectural) way to deal with SSBD (Speculative Store Bypass
Disable), via the CPU flag: 'amd-ssbd'.

Furthermore, future AMD CPUs also will expose a mechanism to tell the
guest that the "Speculative Store Bypass Disable" (SSBD) is not needed
and that the CPU is all good. This is via the CPU flag: 'amd-no-ssb'

In summary, two new flags are[1][2]:

    amd-ssbd
    amd-no-ssb

It is recommended to add the above two flags to the whitelist of Nova's
`cpu_model_extra_flags` config attribute -- for stable branches (Queens,
Pike and Ocata).

For Rocky and above release, no such white-listing is required, since we
allow free-form CPU flags[3].

    * * *

Additional notes (from the QEMU mailing list thread[4]) related to
performance and live migration:

  - tl;dr: On an AMD Compute node, a guest should be presented with
    'amd-ssbd', if available, in preference to 'virt-ssbd'.

    Details: Tom Lendacky from AMD writes[4] -- "The idea behind
    'virt-ssbd' was to provide an architectural method for a guest to do
    SSBD when 'amd-ssbd' isn't present. The 'amd-ssbd' feature will use
    SPEC_CTRL which is intended to not be intercepted and will be fast.
    The use of 'virt-ssbd' will always be intercepted and therefore will
    not be as fast. So a guest should be presented with 'amd-ssbd', if
    available, in preference to 'virt-ssbd'."

  - It is safe to use 'amd-ssbd' (it is an architectural method for
    guest to do SSBD) in a guest which can be live migrated between
    different generations/families of AMD CPU.

[1] libvirt patch:
    https://www.redhat.com/archives/libvir-list/2018-June/msg01111.html
[2] QEMU patch:
    https://lists.nongnu.org/archive/html/qemu-devel/2018-06/msg00222.html
[3] http://git.openstack.org/cgit/openstack/nova/commit/?id=cc27a20 --
    libvirt: Lift the restriction of choices for `cpu_model_extra_flags`
[4] https://lists.nongnu.org/archive/html/qemu-devel/2018-06/msg02301.html

tags: added: queens-backport-potential
tags: added: security
tags: added: pike-backport-potential
description: updated
Matt Riedemann (mriedem) wrote :

Typo in the bug description, it's not "amdb-no-ssb" it's amd-no-ssb.

Changed in nova:
status: New → Won't Fix
description: updated
summary: - Whitelist two more SSBD-related CPU flags for AMD ('amd-ssbd', 'amd-no-
+ Whitelist two more SSBD-related CPU flags for AMD ('amd-ssb', 'amd-no-
ssb')
summary: - Whitelist two more SSBD-related CPU flags for AMD ('amd-ssb', 'amd-no-
+ Whitelist two more SSBD-related CPU flags for AMD ('amd-ssbd', 'amd-no-
ssb')
description: updated

Reviewed: https://review.openstack.org/576270
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=f8aca778f704983bc7ebb0a75d42914fee2dac06
Submitter: Zuul
Branch: stable/queens

commit f8aca778f704983bc7ebb0a75d42914fee2dac06
Author: Dan Smith <email address hidden>
Date: Mon Jun 18 14:13:29 2018 -0700

    [Stable Only] Add amd-ssbd and amd-no-ssb CPU flags

    Update the whitelist for the latest new CPU flags for mitigation
    of recent security issues.

    Change-Id: I8686a4755777c8c720c40d4111cc469676d2a5fd
    Closes-Bug: #1777460

Reviewed: https://review.openstack.org/577548
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=682ee60803c0e6a468e701282a18cee1c118c9df
Submitter: Zuul
Branch: stable/pike

commit 682ee60803c0e6a468e701282a18cee1c118c9df
Author: Dan Smith <email address hidden>
Date: Mon Jun 18 14:13:29 2018 -0700

    [Stable Only] Add amd-ssbd and amd-no-ssb CPU flags

    Update the whitelist for the latest new CPU flags for mitigation
    of recent security issues.

    Change-Id: I8686a4755777c8c720c40d4111cc469676d2a5fd
    Closes-Bug: #1777460
    (cherry picked from commit f8aca778f704983bc7ebb0a75d42914fee2dac06)

This issue was fixed in the openstack/nova 16.1.5 release.

This issue was fixed in the openstack/nova 17.0.6 release.

Reviewed: https://review.openstack.org/607296
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=c85f5e22e1cb8afd756341517bd7284ffc8e505b
Submitter: Zuul
Branch: stable/ocata

commit c85f5e22e1cb8afd756341517bd7284ffc8e505b
Author: Dan Smith <email address hidden>
Date: Mon Jun 18 14:13:29 2018 -0700

    [Stable Only] Add amd-ssbd and amd-no-ssb CPU flags

    Update the whitelist for the latest new CPU flags for mitigation
    of recent security issues.

    Change-Id: I8686a4755777c8c720c40d4111cc469676d2a5fd
    Closes-Bug: #1777460
    (cherry picked from commit f8aca778f704983bc7ebb0a75d42914fee2dac06)
    (cherry picked from commit 682ee60803c0e6a468e701282a18cee1c118c9df)

This issue was fixed in the openstack/nova 15.1.5 release.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers