Whitelist two more SSBD-related CPU flags for AMD ('amd-ssbd', 'amd-no-ssb')

[Kashyap Chamarthy]

In addition to the existing 'virt-ssbd', future AMD CPUs will have
another (architectural) way to deal with SSBD (Speculative Store Bypass
Disable), via the CPU flag: 'amd-ssbd'.

Furthermore, future AMD CPUs also will expose a mechanism to tell the
guest that the "Speculative Store Bypass Disable" (SSBD) is not needed
and that the CPU is all good. This is via the CPU flag: 'amd-no-ssb'

In summary, two new flags are[1][2]:

    amd-ssbd
    amd-no-ssb

It is recommended to add the above two flags to the whitelist of Nova's
`cpu_model_extra_flags` config attribute -- for stable branches (Queens,
Pike and Ocata).

For Rocky and above release, no such white-listing is required, since we
allow free-form CPU flags[3].

    * * *

Additional notes (from the QEMU mailing list thread[4]) related to
performance and live migration:

  - tl;dr: On an AMD Compute node, a guest should be presented with
    'amd-ssbd', if available, in preference to 'virt-ssbd'.

    Details: Tom Lendacky from AMD writes[4] -- "The idea behind
    'virt-ssbd' was to provide an architectural method for a guest to do
    SSBD when 'amd-ssbd' isn't present. The 'amd-ssbd' feature will use
    SPEC_CTRL which is intended to not be intercepted and will be fast.
    The use of 'virt-ssbd' will always be intercepted and therefore will
    not be as fast. So a guest should be presented with 'amd-ssbd', if
    available, in preference to 'virt-ssbd'."

  - It is safe to use 'amd-ssbd' (it is an architectural method for
    guest to do SSBD) in a guest which can be live migrated between
    different generations/families of AMD CPU.

[1] libvirt patch:
    https://www.redhat.com/archives/libvir-list/2018-June/msg01111.html
[2] QEMU patch:
    https://lists.nongnu.org/archive/html/qemu-devel/2018-06/msg00222.html
[3] http://git.openstack.org/cgit/openstack/nova/commit/?id=cc27a20 --
    libvirt: Lift the restriction of choices for `cpu_model_extra_flags`
[4] https://lists.nongnu.org/archive/html/qemu-devel/2018-06/msg02301.html

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/queens
Review: https://review.openstack.org/576270

[Matt Riedemann (mriedem)]

Typo in the bug description, it's not "amdb-no-ssb" it's amd-no-ssb.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/576270
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=f8aca778f704983bc7ebb0a75d42914fee2dac06
Submitter: Zuul
Branch: stable/queens

commit f8aca778f704983bc7ebb0a75d42914fee2dac06
Author: Dan Smith <email address hidden>
Date: Mon Jun 18 14:13:29 2018 -0700

    [Stable Only] Add amd-ssbd and amd-no-ssb CPU flags

    Update the whitelist for the latest new CPU flags for mitigation
    of recent security issues.

    Change-Id: I8686a4755777c8c720c40d4111cc469676d2a5fd
    Closes-Bug: #1777460

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/pike
Review: https://review.openstack.org/577548

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/577548
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=682ee60803c0e6a468e701282a18cee1c118c9df
Submitter: Zuul
Branch: stable/pike

commit 682ee60803c0e6a468e701282a18cee1c118c9df
Author: Dan Smith <email address hidden>
Date: Mon Jun 18 14:13:29 2018 -0700

    [Stable Only] Add amd-ssbd and amd-no-ssb CPU flags

    Update the whitelist for the latest new CPU flags for mitigation
    of recent security issues.

    Change-Id: I8686a4755777c8c720c40d4111cc469676d2a5fd
    Closes-Bug: #1777460
    (cherry picked from commit f8aca778f704983bc7ebb0a75d42914fee2dac06)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/nova 16.1.5 release.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/nova 17.0.6 release.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/ocata
Review: https://review.openstack.org/607296

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/607296
Committed: https://git.openstack.org/cgit/openstack/nova/commit/?id=c85f5e22e1cb8afd756341517bd7284ffc8e505b
Submitter: Zuul
Branch: stable/ocata

commit c85f5e22e1cb8afd756341517bd7284ffc8e505b
Author: Dan Smith <email address hidden>
Date: Mon Jun 18 14:13:29 2018 -0700

    [Stable Only] Add amd-ssbd and amd-no-ssb CPU flags

    Update the whitelist for the latest new CPU flags for mitigation
    of recent security issues.

    Change-Id: I8686a4755777c8c720c40d4111cc469676d2a5fd
    Closes-Bug: #1777460
    (cherry picked from commit f8aca778f704983bc7ebb0a75d42914fee2dac06)
    (cherry picked from commit 682ee60803c0e6a468e701282a18cee1c118c9df)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/nova 15.1.5 release.