[Bug 1882774] Re: issues with secondary VMX execution controls

[Matthew Ruffell]

Also verifying this on Azure Cloud.

I enabled -proposed and installed qemu 4.2-3ubuntu6.3 on a Focal
instance.

$ sudo apt-cache policy qemu-kvm | grep Installed
  Installed: 1:4.2-3ubuntu6.3

>From there I executed the following:

$ sudo -s
# apt install qemu-kvm bridge-utils
# BR_NAME="br0"
# BR_ADDR="192.168.1.10"
# ip link add "$BR_NAME" type bridge
# ip addr add "$BR_ADDR"/24 dev "$BR_NAME"
# ip link set "$BR_NAME" up
# tap_name="tap1"
# br_name=$BR_NAME
# ip tuntap add $tap_name mode tap user $(whoami) multi_queue
# ip link set $tap_name up
# ip link set $tap_name master $br_name

Download a guest VM:

# wget https://cloud-images.ubuntu.com/focal/current/focal-server-
cloudimg-amd64-disk-kvm.img

Launch the VM:
# /usr/bin/qemu-system-x86_64 -cpu host -smp 2 -m 2048 -hda focal-server-cloudimg-amd64-disk-kvm.img -device virtio-net-pci,netdev=net0,mac=52:54:00:f5:be:83 -netdev user,id=net0,hostfwd=tcp::60022-:22 -device virtio-net-pci,netdev=net1,mac=52:54:00:c6:29:dc,mq=on,vectors=10 -netdev tap,id=net1,ifname=tap1,script=no,vhost=on,queues=4 -display none -enable-kvm -daemonize

QEMU successfully starts without error, and checking ps and logs shows
the QEMU VM is alive and well:

2500 ?        Sl     0:31 /usr/bin/qemu-system-x86_64 -cpu host -smp 2
-m 2048 -hda focal-server-cloudimg-amd64-disk-kvm.img -device virtio-
net-pci,netdev=net0,mac=52:54:00:f5:be:83 -netdev user,id=

I can ping the VM and ssh in.

I am happy to also say this bug is verified.

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1882774

Title:
  issues with secondary VMX execution controls

Status in Ubuntu Cloud Archive:
  New
Status in qemu package in Ubuntu:
  Fix Released
Status in qemu source package in Focal:
  Fix Committed

Bug description:
  [Impact]

  In qemu 4.2 was a change [1] meant to improve the handling of MSRs vs CPUID.
  It was later identified [2] as an issue and fixed.
  This has to be backported to Focal to resolve that issue on several platforms.

  An example where this occurs is:
  - Azure instances with nested virt
  - GCP instances with nested virt

  We have seen a bunch of qemu named CPU types that can expose similar behavior when used on chips that pretend to be of some type e.g. Skylake but miss some of their features to be settable.
  It isn't entirely sure thou that this will be fixed by the same - yet worth to mention.

  The impact is that qemu 4.2 as in Ubuntu 20.04 doesn't work on those
  platforms bailing out.

  [1]: https://github.com/qemu/qemu/commit/048c95163b472ed737a2f0dca4f4e23a82ac2f8a
  [2]: https://github.com/qemu/qemu/commit/4a910e1f6ab4155ec8b24c49b2585cc486916985

  [Test Case]

   * Get a GCP or Azure instance with nested virtualization enabled
   * Spawn a KVM guest on it e.g. by using uvtool-libvirt using a named type 
     matching the cpu
     e.g. if the host reports as skylake use such a type.
     You can use `virsh domcapabilities` to check what the host is
     detected as.

  [Regression Potential]

   * It is a bit hard to guess, but it should not make things worse. But if I'd expect one then the
     VMX subfeatures could change on cases not intended to. Yet we should have one of two cases:
     a) the common one is that the host can set this and has done so, it will continue as before
     b) host was unable to set these and failed, this should now work with the fix in place
     Both seem ok to me.

  [Other Info]

   * there might be a local (non cloud) way to reproduce but I don't
  know it yet

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1882774/+subscriptions