mirror of
https://gitlab.com/libvirt/libvirt.git
synced 2024-07-06 09:55:46 +00:00
dd17a4eba8
One of the mitigation methods for TAA[1] is to disable TSX
support on the host system. Linux added a mechanism to disable
TSX globally through the kernel command line, and many Linux
distributions now default to tsx=off. This makes existing CPU
models that have HLE and RTM enabled not usable anymore.
Add new versions of all CPU models that have the HLE and RTM
features enabled, that can be used when TSX is disabled in the
host system.
On systems disabling the features without those types defined
in cpu-maps users end up without modern CPU types in the list
of usable CPUs to use in the likes of virsh domcapabilities
or tools higher in the stack like virt-manager.
This adds:
-Cascadelake-Server-noTSX
-Icelake-Client-noTSX
-Icelake-Server-noTSX
-Skylake-Server-noTSX-IBRS
-Skylake-Client-noTSX-IBRS
Introduced in QEMU by commit v4.2.0-rc2-3-g9ab2237f19 (function)
and commit v4.2.0-rc2-4-g02fa60d101 (names)
References:
[1] TAA, TSX asynchronous Abort:
https://software.intel.com/security-software-guidance/insights/deep-dive-intel-transactional-synchronization-extensions-intel-tsx-asynchronous-abort
https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/tsx_async_abort.html
Fixes: https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1853200
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
Message-Id: <20200310104806.2723-2-christian.ehrhardt@canonical.com>
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
188 lines
6.1 KiB
XML
188 lines
6.1 KiB
XML
<domainCapabilities>
|
|
<path>/usr/bin/qemu-system-x86_64</path>
|
|
<domain>kvm</domain>
|
|
<machine>pc-q35-5.0</machine>
|
|
<arch>x86_64</arch>
|
|
<vcpu max='288'/>
|
|
<iothreads supported='yes'/>
|
|
<os supported='yes'>
|
|
<enum name='firmware'>
|
|
<value>bios</value>
|
|
<value>efi</value>
|
|
</enum>
|
|
<loader supported='yes'>
|
|
<value>/usr/share/AAVMF/AAVMF_CODE.fd</value>
|
|
<value>/usr/share/AAVMF/AAVMF32_CODE.fd</value>
|
|
<value>/usr/share/OVMF/OVMF_CODE.fd</value>
|
|
<enum name='type'>
|
|
<value>rom</value>
|
|
<value>pflash</value>
|
|
</enum>
|
|
<enum name='readonly'>
|
|
<value>yes</value>
|
|
<value>no</value>
|
|
</enum>
|
|
<enum name='secure'>
|
|
<value>yes</value>
|
|
<value>no</value>
|
|
</enum>
|
|
</loader>
|
|
</os>
|
|
<cpu>
|
|
<mode name='host-passthrough' supported='yes'/>
|
|
<mode name='host-model' supported='yes'>
|
|
<model fallback='forbid'>Skylake-Client-IBRS</model>
|
|
<vendor>Intel</vendor>
|
|
<feature policy='require' name='ss'/>
|
|
<feature policy='require' name='vmx'/>
|
|
<feature policy='require' name='hypervisor'/>
|
|
<feature policy='require' name='tsc_adjust'/>
|
|
<feature policy='require' name='clflushopt'/>
|
|
<feature policy='require' name='umip'/>
|
|
<feature policy='require' name='md-clear'/>
|
|
<feature policy='require' name='stibp'/>
|
|
<feature policy='require' name='arch-capabilities'/>
|
|
<feature policy='require' name='ssbd'/>
|
|
<feature policy='require' name='xsaves'/>
|
|
<feature policy='require' name='pdpe1gb'/>
|
|
<feature policy='require' name='invtsc'/>
|
|
<feature policy='require' name='skip-l1dfl-vmentry'/>
|
|
</mode>
|
|
<mode name='custom' supported='yes'>
|
|
<model usable='yes'>qemu64</model>
|
|
<model usable='yes'>qemu32</model>
|
|
<model usable='no'>phenom</model>
|
|
<model usable='yes'>pentium3</model>
|
|
<model usable='yes'>pentium2</model>
|
|
<model usable='yes'>pentium</model>
|
|
<model usable='yes'>n270</model>
|
|
<model usable='yes'>kvm64</model>
|
|
<model usable='yes'>kvm32</model>
|
|
<model usable='yes'>coreduo</model>
|
|
<model usable='yes'>core2duo</model>
|
|
<model usable='no'>athlon</model>
|
|
<model usable='yes'>Westmere-IBRS</model>
|
|
<model usable='yes'>Westmere</model>
|
|
<model usable='no'>Skylake-Server-noTSX-IBRS</model>
|
|
<model usable='no'>Skylake-Server-IBRS</model>
|
|
<model usable='no'>Skylake-Server</model>
|
|
<model usable='yes'>Skylake-Client-noTSX-IBRS</model>
|
|
<model usable='yes'>Skylake-Client-IBRS</model>
|
|
<model usable='yes'>Skylake-Client</model>
|
|
<model usable='yes'>SandyBridge-IBRS</model>
|
|
<model usable='yes'>SandyBridge</model>
|
|
<model usable='yes'>Penryn</model>
|
|
<model usable='no'>Opteron_G5</model>
|
|
<model usable='no'>Opteron_G4</model>
|
|
<model usable='no'>Opteron_G3</model>
|
|
<model usable='yes'>Opteron_G2</model>
|
|
<model usable='yes'>Opteron_G1</model>
|
|
<model usable='yes'>Nehalem-IBRS</model>
|
|
<model usable='yes'>Nehalem</model>
|
|
<model usable='yes'>IvyBridge-IBRS</model>
|
|
<model usable='yes'>IvyBridge</model>
|
|
<model usable='no'>Icelake-Server-noTSX</model>
|
|
<model usable='no'>Icelake-Server</model>
|
|
<model usable='no'>Icelake-Client-noTSX</model>
|
|
<model usable='no'>Icelake-Client</model>
|
|
<model usable='yes'>Haswell-noTSX-IBRS</model>
|
|
<model usable='yes'>Haswell-noTSX</model>
|
|
<model usable='yes'>Haswell-IBRS</model>
|
|
<model usable='yes'>Haswell</model>
|
|
<model usable='no'>EPYC-IBPB</model>
|
|
<model usable='no'>EPYC</model>
|
|
<model usable='no'>Dhyana</model>
|
|
<model usable='yes'>Conroe</model>
|
|
<model usable='no'>Cascadelake-Server-noTSX</model>
|
|
<model usable='no'>Cascadelake-Server</model>
|
|
<model usable='yes'>Broadwell-noTSX-IBRS</model>
|
|
<model usable='yes'>Broadwell-noTSX</model>
|
|
<model usable='yes'>Broadwell-IBRS</model>
|
|
<model usable='yes'>Broadwell</model>
|
|
<model usable='yes'>486</model>
|
|
</mode>
|
|
</cpu>
|
|
<devices>
|
|
<disk supported='yes'>
|
|
<enum name='diskDevice'>
|
|
<value>disk</value>
|
|
<value>cdrom</value>
|
|
<value>floppy</value>
|
|
<value>lun</value>
|
|
</enum>
|
|
<enum name='bus'>
|
|
<value>fdc</value>
|
|
<value>scsi</value>
|
|
<value>virtio</value>
|
|
<value>usb</value>
|
|
<value>sata</value>
|
|
</enum>
|
|
<enum name='model'>
|
|
<value>virtio</value>
|
|
<value>virtio-transitional</value>
|
|
<value>virtio-non-transitional</value>
|
|
</enum>
|
|
</disk>
|
|
<graphics supported='yes'>
|
|
<enum name='type'>
|
|
<value>sdl</value>
|
|
<value>vnc</value>
|
|
<value>spice</value>
|
|
</enum>
|
|
</graphics>
|
|
<video supported='yes'>
|
|
<enum name='modelType'>
|
|
<value>vga</value>
|
|
<value>cirrus</value>
|
|
<value>vmvga</value>
|
|
<value>qxl</value>
|
|
<value>virtio</value>
|
|
<value>none</value>
|
|
<value>bochs</value>
|
|
<value>ramfb</value>
|
|
</enum>
|
|
</video>
|
|
<hostdev supported='yes'>
|
|
<enum name='mode'>
|
|
<value>subsystem</value>
|
|
</enum>
|
|
<enum name='startupPolicy'>
|
|
<value>default</value>
|
|
<value>mandatory</value>
|
|
<value>requisite</value>
|
|
<value>optional</value>
|
|
</enum>
|
|
<enum name='subsysType'>
|
|
<value>usb</value>
|
|
<value>pci</value>
|
|
<value>scsi</value>
|
|
</enum>
|
|
<enum name='capsType'/>
|
|
<enum name='pciBackend'>
|
|
<value>default</value>
|
|
<value>vfio</value>
|
|
</enum>
|
|
</hostdev>
|
|
<rng supported='yes'>
|
|
<enum name='model'>
|
|
<value>virtio</value>
|
|
<value>virtio-transitional</value>
|
|
<value>virtio-non-transitional</value>
|
|
</enum>
|
|
<enum name='backendModel'>
|
|
<value>random</value>
|
|
<value>egd</value>
|
|
<value>builtin</value>
|
|
</enum>
|
|
</rng>
|
|
</devices>
|
|
<features>
|
|
<gic supported='no'/>
|
|
<vmcoreinfo supported='yes'/>
|
|
<genid supported='yes'/>
|
|
<backingStoreInput supported='yes'/>
|
|
<backup supported='no'/>
|
|
<sev supported='no'/>
|
|
</features>
|
|
</domainCapabilities>
|