* target/i386: optimize string instructions
* target/i386: new Sierra Forest and Clearwater Forest models * rust: type-safe vmstate implementation * rust: use interior mutability for PL011 * rust: clean ups * memtxattrs: remove usage of bitfields from MEMTXATTRS_UNSPECIFIED * gitlab-ci: enable Rust backtraces -----BEGIN PGP SIGNATURE----- iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmeZ6VYUHHBib256aW5p QHJlZGhhdC5jb20ACgkQv/vSX3jHroMjbQgApuooMOp0z/8Ky4/ux8M8/vrlcNCH V1Pm6WzrjEzd9TIMLGr6npOyLOkWI31Aa4o/TuW09SeKE3dpCf/7LYA5VDEtkH79 F57MgnSj56sMNgu+QZ/SiGvkKJXl+3091jIianrrI0dtX8hPonm6bt55woDvQt3z p94+4zzv5G0nc+ncITCDho8sn5itdZWVOjf9n6VCOumMjF4nRSoMkJKYIvjNht6n GtjMhYA70tzjkIi4bPyYkhFpMNlAqEDIp2TvPzp6klG5QoUErHIzdzoRTAtE4Dpb 7240r6jarQX41TBXGOFq0NrxES1cm5zO/6159D24qZGHGm2hG4nDx+t2jw== =ZKFy -----END PGP SIGNATURE----- Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging * target/i386: optimize string instructions * target/i386: new Sierra Forest and Clearwater Forest models * rust: type-safe vmstate implementation * rust: use interior mutability for PL011 * rust: clean ups * memtxattrs: remove usage of bitfields from MEMTXATTRS_UNSPECIFIED * gitlab-ci: enable Rust backtraces # -----BEGIN PGP SIGNATURE----- # # iQFIBAABCAAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmeZ6VYUHHBib256aW5p # QHJlZGhhdC5jb20ACgkQv/vSX3jHroMjbQgApuooMOp0z/8Ky4/ux8M8/vrlcNCH # V1Pm6WzrjEzd9TIMLGr6npOyLOkWI31Aa4o/TuW09SeKE3dpCf/7LYA5VDEtkH79 # F57MgnSj56sMNgu+QZ/SiGvkKJXl+3091jIianrrI0dtX8hPonm6bt55woDvQt3z # p94+4zzv5G0nc+ncITCDho8sn5itdZWVOjf9n6VCOumMjF4nRSoMkJKYIvjNht6n # GtjMhYA70tzjkIi4bPyYkhFpMNlAqEDIp2TvPzp6klG5QoUErHIzdzoRTAtE4Dpb # 7240r6jarQX41TBXGOFq0NrxES1cm5zO/6159D24qZGHGm2hG4nDx+t2jw== # =ZKFy # -----END PGP SIGNATURE----- # gpg: Signature made Wed 29 Jan 2025 03:39:50 EST # gpg: using RSA key F13338574B662389866C7682BFFBD25F78C7AE83 # gpg: issuer "pbonzini@redhat.com" # gpg: Good signature from "Paolo Bonzini <bonzini@gnu.org>" [full] # gpg: aka "Paolo Bonzini <pbonzini@redhat.com>" [full] # Primary key fingerprint: 46F5 9FBD 57D6 12E7 BFD4 E2F7 7E15 100C CD36 69B1 # Subkey fingerprint: F133 3857 4B66 2389 866C 7682 BFFB D25F 78C7 AE83 * tag 'for-upstream' of https://gitlab.com/bonzini/qemu: (49 commits) gitlab-ci: include full Rust backtraces in test runs rust: qemu-api: add sub-subclass to the integration tests rust/zeroable: Implement Zeroable with const_zero macro rust: qdev: make reset take a shared reference rust: pl011: drop use of ControlFlow rust: pl011: pull device-specific code out of MemoryRegionOps callbacks rust: pl011: remove duplicate definitions rust: pl011: wrap registers with BqlRefCell rust: pl011: extract PL011Registers rust: pl011: pull interrupt updates out of read/write ops rust: pl011: extract CharBackend receive logic into a separate function rust: pl011: extract conversion to RegisterOffset rust: pl011: hide unnecessarily "pub" items from outside pl011::device rust: pl011: remove unnecessary "extern crate" rust: prefer NonNull::new to assertions rust: vmstate: make order of parameters consistent in vmstate_clock rust: vmstate: remove translation of C vmstate macros rust: pl011: switch vmstate to new-style macros rust: qemu_api: add vmstate_struct rust: vmstate: add public utility macros to implement VMState ... Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
This commit is contained in:
Stefan Hajnoczi
commit
871af84dd5
18 changed files with 1423 additions and 855 deletions
|
|
@ -71,6 +71,16 @@ mixture of host CPU models between machines, if live migration
|
|||
compatibility is required, use the newest CPU model that is compatible
|
||||
across all desired hosts.
|
||||
|
||||
``ClearwaterForest``
|
||||
Intel Xeon Processor (ClearwaterForest, 2025)
|
||||
|
||||
``SierraForest``, ``SierraForest-v2``
|
||||
Intel Xeon Processor (SierraForest, 2024), SierraForest-v2 mitigates
|
||||
the GDS and RFDS vulnerabilities with stepping 3.
|
||||
|
||||
``GraniteRapids``, ``GraniteRapids-v2``
|
||||
Intel Xeon Processor (GraniteRapids, 2024)
|
||||
|
||||
``Cascadelake-Server``, ``Cascadelake-Server-noTSX``
|
||||
Intel Xeon Processor (Cascade Lake, 2019), with "stepping" levels 6
|
||||
or 7 only. (The Cascade Lake Xeon processor with *stepping 5 is
|
||||
|
|
@ -181,7 +191,7 @@ features are included if using "Host passthrough" or "Host model".
|
|||
CVE-2018-12127, [MSBDS] CVE-2018-12126).
|
||||
|
||||
This is an MSR (Model-Specific Register) feature rather than a CPUID feature,
|
||||
so it will not appear in the Linux ``/proc/cpuinfo`` in the host or
|
||||
therefore it will not appear in the Linux ``/proc/cpuinfo`` in the host or
|
||||
guest. Instead, the host kernel uses it to populate the MDS
|
||||
vulnerability file in ``sysfs``.
|
||||
|
||||
|
|
@ -189,10 +199,10 @@ features are included if using "Host passthrough" or "Host model".
|
|||
affected} in the ``/sys/devices/system/cpu/vulnerabilities/mds`` file.
|
||||
|
||||
``taa-no``
|
||||
Recommended to inform that the guest that the host is ``not``
|
||||
Recommended to inform the guest that the host is ``not``
|
||||
vulnerable to CVE-2019-11135, TSX Asynchronous Abort (TAA).
|
||||
|
||||
This too is an MSR feature, so it does not show up in the Linux
|
||||
This is also an MSR feature, therefore it does not show up in the Linux
|
||||
``/proc/cpuinfo`` in the host or guest.
|
||||
|
||||
It should only be enabled for VMs if the host reports ``Not affected``
|
||||
|
|
@ -214,7 +224,7 @@ features are included if using "Host passthrough" or "Host model".
|
|||
By disabling TSX, KVM-based guests can avoid paying the price of
|
||||
mitigating TSX-based attacks.
|
||||
|
||||
Note that ``tsx-ctrl`` too is an MSR feature, so it does not show
|
||||
Note that ``tsx-ctrl`` is also an MSR feature, therefore it does not show
|
||||
up in the Linux ``/proc/cpuinfo`` in the host or guest.
|
||||
|
||||
To validate that Intel TSX is indeed disabled for the guest, there are
|
||||
|
|
@ -223,6 +233,38 @@ features are included if using "Host passthrough" or "Host model".
|
|||
``/sys/devices/system/cpu/vulnerabilities/tsx_async_abort`` file in
|
||||
the guest should report ``Mitigation: TSX disabled``.
|
||||
|
||||
``bhi-no``
|
||||
Recommended to inform the guest that the host is ``not``
|
||||
vulnerable to CVE-2022-0001, Branch History Injection (BHI).
|
||||
|
||||
This is also an MSR feature, therefore it does not show up in the Linux
|
||||
``/proc/cpuinfo`` in the host or guest.
|
||||
|
||||
It should only be enabled for VMs if the host reports
|
||||
``BHI: Not affected`` in the
|
||||
``/sys/devices/system/cpu/vulnerabilities/spectre_v2`` file.
|
||||
|
||||
``gds-no``
|
||||
Recommended to inform the guest that the host is ``not``
|
||||
vulnerable to CVE-2022-40982, Gather Data Sampling (GDS).
|
||||
|
||||
This is also an MSR feature, therefore it does not show up in the Linux
|
||||
``/proc/cpuinfo`` in the host or guest.
|
||||
|
||||
It should only be enabled for VMs if the host reports ``Not affected``
|
||||
in the ``/sys/devices/system/cpu/vulnerabilities/gather_data_sampling``
|
||||
file.
|
||||
|
||||
``rfds-no``
|
||||
Recommended to inform the guest that the host is ``not``
|
||||
vulnerable to CVE-2023-28746, Register File Data Sampling (RFDS).
|
||||
|
||||
This is also an MSR feature, therefore it does not show up in the Linux
|
||||
``/proc/cpuinfo`` in the host or guest.
|
||||
|
||||
It should only be enabled for VMs if the host reports ``Not affected``
|
||||
in the ``/sys/devices/system/cpu/vulnerabilities/reg_file_data_sampling``
|
||||
file.
|
||||
|
||||
Preferred CPU models for AMD x86 hosts
|
||||
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue