[Bug 1882774] Re: issues with secondary VMX execution controls

[Christian Ehrhardt ]

@Neil - it isn't too easy, but I was able to confirm myself in the
meantime and it works well.

The usual flow is that I bring this fix into the affected Groovy and Focal and then the cloud-archive would rebase onto those versions.
But I'll add a ubuntu-cloud-archive task.
Maybe they can pre-build you something based on the PPA that is linked here - which you then can test on Bionic as well - just so we can be sure that the different older VMX controls on the bionic kernel will work the same way.
@James / Corey - could you do so?

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1882774

Title:
  issues with secondary VMX execution controls

Status in Ubuntu Cloud Archive:
  New
Status in qemu package in Ubuntu:
  In Progress
Status in qemu source package in Focal:
  Triaged

Bug description:
  [Impact]

  In qemu 4.2 was a change [1] meant to improve the handling of MSRs vs CPUID.
  It was later identified [2] as an issue and fixed.
  This has to be backported to Focal to resolve that issue on several platforms.

  An example where this occurs is:
  - Azure instances with nested virt
  - GCP instances with nested virt

  We have seen a bunch of qemu named CPU types that can expose similar behavior when used on chips that pretend to be of some type e.g. Skylake but miss some of their features to be settable.
  It isn't entirely sure thou that this will be fixed by the same - yet worth to mention.

  The impact is that qemu 4.2 as in Ubuntu 20.04 doesn't work on those
  platforms bailing out.

  [1]: https://github.com/qemu/qemu/commit/048c95163b472ed737a2f0dca4f4e23a82ac2f8a
  [2]: https://github.com/qemu/qemu/commit/4a910e1f6ab4155ec8b24c49b2585cc486916985

  [Test Case]

   * Get a GCP or Azure instance with nested virtualization enabled
   * Spawn a KVM guest on it e.g. by using uvtool-libvirt using a named type 
     matching the cpu
     e.g. if the host reports as skylake use such a type.
     You can use `virsh domcapabilities` to check what the host is
     detected as.

  [Regression Potential]

   * It is a bit hard to guess, but it should not make things worse. But if I'd expect one then the
     VMX subfeatures could change on cases not intended to. Yet we should have one of two cases:
     a) the common one is that the host can set this and has done so, it will continue as before
     b) host was unable to set these and failed, this should now work with the fix in place
     Both seem ok to me.

  [Other Info]

   * there might be a local (non cloud) way to reproduce but I don't
  know it yet

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1882774/+subscriptions