)]}'
{"/COMMIT_MSG":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0e4532f63b83ff56c6e367aa732a7210bfc6fd62","unresolved":false,"context_lines":[{"line_number":9,"context_line":"This adds two other flags to the whitelist of available options to"},{"line_number":10,"context_line":"the cpu_model_extra_flags variable related to further variants of"},{"line_number":11,"context_line":"Meltdown/Spectre recently published."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Change-Id: I72085016c8756ff88a4da722368f62359bcd7080"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":3,"id":"5f7c97a3_75c4d65f","line":12,"updated":"2018-05-23 22:59:11.000000000","message":"Add:\n\nRelated-Bug: #1750829","commit_id":"53aa5658f445727fa3641830371c947bb825a69c"},{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"5168a4f55bb87544be5d986120db45bf48e6ece0","unresolved":false,"context_lines":[{"line_number":4,"context_line":"Commit:     Dan Smith \u003cdansmith@redhat.com\u003e"},{"line_number":5,"context_line":"CommitDate: 2018-05-23 16:16:35 -0700"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Add ssdb and virt-ssdb flags to cpu_model_extra_flags whitelist"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"This adds two other flags to the whitelist of available options to"},{"line_number":10,"context_line":"the cpu_model_extra_flags variable related to further variants of"}],"source_content_type":"text/x-gerrit-commit-message","patch_set":5,"id":"5f7c97a3_3b4f28be","line":7,"range":{"start_line":7,"start_character":4,"end_line":7,"end_character":22},"updated":"2018-05-24 11:35:36.000000000","message":"Here too in case you miss it later.","commit_id":"6c3f96f18ac2884539617925d6d09ec50205c672"}],"nova/conf/libvirt.py":[{"author":{"_account_id":8768,"name":"Chris Friesen","email":"chris.friesen@windriver.com","username":"cbf123"},"change_message_id":"9408122ee9cfc1aa22b1a7437fa5ec8641e255c0","unresolved":false,"context_lines":[{"line_number":541,"context_line":""},{"line_number":542,"context_line":"Currently, the choice is restricted to a few options: ``pcid``,"},{"line_number":543,"context_line":"``ssdb``, and ``virt-ssdb`` (the options are case-insensitive, so"},{"line_number":544,"context_line":"``PCID`` is also valid, for example).  These flags are now required to"},{"line_number":545,"context_line":"address the guest performance degradation as a result of applying the"},{"line_number":546,"context_line":"\"Meltdown\" CVE fixes on certain Intel CPU models."},{"line_number":547,"context_line":""},{"line_number":548,"context_line":"Note that when using this config attribute to set the \u0027PCID\u0027 and"},{"line_number":549,"context_line":"related CPU flags, not all virtual (i.e. libvirt / QEMU) CPU models"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_f52a262a","line":546,"range":{"start_line":544,"start_character":39,"end_line":546,"end_character":49},"updated":"2018-05-23 22:38:19.000000000","message":"Is this description true of ssdb/virt-ssdb?  It sounds like enabling them may actually hurt performance but improve security.","commit_id":"7fce44c71b3c39e9dee81a0e74df1ffccbb0dae2"},{"author":{"_account_id":8768,"name":"Chris Friesen","email":"chris.friesen@windriver.com","username":"cbf123"},"change_message_id":"9408122ee9cfc1aa22b1a7437fa5ec8641e255c0","unresolved":false,"context_lines":[{"line_number":556,"context_line":"  and \"IvyBridge\" will _not_ expose the \u0027PCID\u0027 capability by default,"},{"line_number":557,"context_line":"  even if the host CPUs by the same name include it.  I.e.  \u0027PCID\u0027 needs"},{"line_number":558,"context_line":"  to be explicitly specified when using the said virtual CPU models."},{"line_number":559,"context_line":""},{"line_number":560,"context_line":"For now, the ``cpu_model_extra_flags`` config attribute is valid only in"},{"line_number":561,"context_line":"combination with ``cpu_mode`` + ``cpu_model`` options."},{"line_number":562,"context_line":""}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_5502fab5","line":559,"updated":"2018-05-23 22:38:19.000000000","message":"I think we should add a list of CPU models for ssdb/virt-ssdb as well.","commit_id":"7fce44c71b3c39e9dee81a0e74df1ffccbb0dae2"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0e4532f63b83ff56c6e367aa732a7210bfc6fd62","unresolved":false,"context_lines":[{"line_number":524,"context_line":"    cfg.ListOpt("},{"line_number":525,"context_line":"        \u0027cpu_model_extra_flags\u0027,"},{"line_number":526,"context_line":"        item_type\u003dtypes.String("},{"line_number":527,"context_line":"            choices\u003d[\u0027pcid\u0027, \u0027ssdb\u0027, \u0027virt-ssdb\u0027],"},{"line_number":528,"context_line":"            ignore_case\u003dTrue,"},{"line_number":529,"context_line":"        ),"},{"line_number":530,"context_line":"        default\u003d[],"}],"source_content_type":"text/x-python","patch_set":3,"id":"5f7c97a3_f5b466d3","line":527,"range":{"start_line":527,"start_character":38,"end_line":527,"end_character":47},"updated":"2018-05-23 22:59:11.000000000","message":"Not sure if we should link to https://www.redhat.com/archives/libvir-list/2018-May/msg01562.html for the virt-ssdb thing?","commit_id":"53aa5658f445727fa3641830371c947bb825a69c"},{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"5568f96b769d0e84f4094c63c195a3d4c83072b1","unresolved":false,"context_lines":[{"line_number":524,"context_line":"    cfg.ListOpt("},{"line_number":525,"context_line":"        \u0027cpu_model_extra_flags\u0027,"},{"line_number":526,"context_line":"        item_type\u003dtypes.String("},{"line_number":527,"context_line":"            choices\u003d[\u0027pcid\u0027, \u0027ssdb\u0027, \u0027virt-ssdb\u0027],"},{"line_number":528,"context_line":"            ignore_case\u003dTrue,"},{"line_number":529,"context_line":"        ),"},{"line_number":530,"context_line":"        default\u003d[],"}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_3bac088b","line":527,"range":{"start_line":527,"start_character":30,"end_line":527,"end_character":47},"updated":"2018-05-24 11:27:17.000000000","message":"Whoops! It\u0027s \u0027ssbd\u0027 and \u0027virt-ssbd\u0027.","commit_id":"6c3f96f18ac2884539617925d6d09ec50205c672"},{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"5568f96b769d0e84f4094c63c195a3d4c83072b1","unresolved":false,"context_lines":[{"line_number":561,"context_line":"For more information about ``ssdb`` and ``virt-ssdb`` applicability,"},{"line_number":562,"context_line":"please refer to the following security updates:"},{"line_number":563,"context_line":""},{"line_number":564,"context_line":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html"},{"line_number":565,"context_line":""},{"line_number":566,"context_line":"https://developer.amd.com/wp-content/resources/124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf"},{"line_number":567,"context_line":""},{"line_number":568,"context_line":"https://www.redhat.com/archives/libvir-list/2018-May/msg01562.html"},{"line_number":569,"context_line":""},{"line_number":570,"context_line":"For now, the ``cpu_model_extra_flags`` config attribute is valid only in"},{"line_number":571,"context_line":"combination with ``cpu_mode`` + ``cpu_model`` options."}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_db863414","line":568,"range":{"start_line":564,"start_character":0,"end_line":568,"end_character":66},"updated":"2018-05-24 11:27:17.000000000","message":"I think the CERT link in the release note is better than these for the intended audience (being operators deciding whether they need to enable these flags).","commit_id":"6c3f96f18ac2884539617925d6d09ec50205c672"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"6c0352ad1b4377fc01d2a7990df269e1a9618f58","unresolved":false,"context_lines":[{"line_number":561,"context_line":"For more information about ``ssdb`` and ``virt-ssdb`` applicability,"},{"line_number":562,"context_line":"please refer to the following security updates:"},{"line_number":563,"context_line":""},{"line_number":564,"context_line":"https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00115.html"},{"line_number":565,"context_line":""},{"line_number":566,"context_line":"https://developer.amd.com/wp-content/resources/124441_AMD64_SpeculativeStoreBypassDisable_Whitepaper_final.pdf"},{"line_number":567,"context_line":""},{"line_number":568,"context_line":"https://www.redhat.com/archives/libvir-list/2018-May/msg01562.html"},{"line_number":569,"context_line":""},{"line_number":570,"context_line":"For now, the ``cpu_model_extra_flags`` config attribute is valid only in"},{"line_number":571,"context_line":"combination with ``cpu_mode`` + ``cpu_model`` options."}],"source_content_type":"text/x-python","patch_set":5,"id":"5f7c97a3_d1b855e6","line":568,"range":{"start_line":564,"start_character":0,"end_line":568,"end_character":66},"in_reply_to":"5f7c97a3_db863414","updated":"2018-05-24 13:54:47.000000000","message":"I think the libvirt one is important, but the CERT one instead of the other two is cool.","commit_id":"6c3f96f18ac2884539617925d6d09ec50205c672"},{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"e7f645c47ad00b84212d8aea167bce88a4cb0a77","unresolved":false,"context_lines":[{"line_number":544,"context_line":"``PCID`` is also valid, for example).  These flags are now required to"},{"line_number":545,"context_line":"address the guest performance degradation as a result of applying the"},{"line_number":546,"context_line":"\"Meltdown\" CVE fixes (``pcid``) and exposure mitigation (``ssbd`` and"},{"line_number":547,"context_line":"``virt-ssbd``) on CPU models."},{"line_number":548,"context_line":""},{"line_number":549,"context_line":"Note that when using this config attribute to set the \u0027PCID\u0027 and"},{"line_number":550,"context_line":"related CPU flags, not all virtual (i.e. libvirt / QEMU) CPU models"}],"source_content_type":"text/x-python","patch_set":6,"id":"5f7c97a3_0cf31075","line":547,"range":{"start_line":547,"start_character":15,"end_line":547,"end_character":28},"updated":"2018-05-24 15:38:56.000000000","message":"nit: This doesn\u0027t read quite right any more.","commit_id":"f9925d2ed4cd181edb16374d850387d704932065"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d9e696f5f8aa50c3bc945ce3076ac14b17dffc1b","unresolved":false,"context_lines":[{"line_number":544,"context_line":"``PCID`` is also valid, for example).  These flags are now required to"},{"line_number":545,"context_line":"address the guest performance degradation as a result of applying the"},{"line_number":546,"context_line":"\"Meltdown\" CVE fixes (``pcid``) and exposure mitigation (``ssbd`` and"},{"line_number":547,"context_line":"``virt-ssbd``) on CPU models."},{"line_number":548,"context_line":""},{"line_number":549,"context_line":"Note that when using this config attribute to set the \u0027PCID\u0027 and"},{"line_number":550,"context_line":"related CPU flags, not all virtual (i.e. libvirt / QEMU) CPU models"}],"source_content_type":"text/x-python","patch_set":6,"id":"5f7c97a3_e736efb4","line":547,"range":{"start_line":547,"start_character":15,"end_line":547,"end_character":28},"in_reply_to":"5f7c97a3_0cf31075","updated":"2018-05-24 16:25:17.000000000","message":"Yeah, conference brain, thanks.","commit_id":"f9925d2ed4cd181edb16374d850387d704932065"},{"author":{"_account_id":9555,"name":"Matthew Booth","email":"mbooth@redhat.com","username":"MatthewBooth"},"change_message_id":"e7f645c47ad00b84212d8aea167bce88a4cb0a77","unresolved":false,"context_lines":[{"line_number":558,"context_line":"  even if the host CPUs by the same name include it.  I.e.  \u0027PCID\u0027 needs"},{"line_number":559,"context_line":"  to be explicitly specified when using the said virtual CPU models."},{"line_number":560,"context_line":""},{"line_number":561,"context_line":"For more information about ``ssbd`` and ``virt-ssbd`` applicability,"},{"line_number":562,"context_line":"please refer to the following security updates:"},{"line_number":563,"context_line":""},{"line_number":564,"context_line":"https://www.us-cert.gov/ncas/alerts/TA18-141A"},{"line_number":565,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"5f7c97a3_6cdac4e9","line":562,"range":{"start_line":561,"start_character":0,"end_line":562,"end_character":47},"updated":"2018-05-24 15:38:56.000000000","message":"I don\u0027t think this is the right place, but we should probably mention somewhere that qemu \u003e\u003d2.9.0 is required for virt-ssbd because it\u0027s a weird hypervisor-only thing. I\u0027m not currently aware of a public RH doc about this yet, but a link to something a bit more OpenStack-centric would be nice at some point if we can find one. I know Kashyap has been head down on this for a good while, so perhaps he can let us know if one becomes available.\n\nIn short, this whole situation is crazy complex and we can\u0027t possibly document it in a config option help text. Would be good to document it somewhere, though.","commit_id":"f9925d2ed4cd181edb16374d850387d704932065"},{"author":{"_account_id":6962,"name":"Kashyap Chamarthy","email":"kchamart@redhat.com","username":"kashyapc"},"change_message_id":"1fca45235d6cf05cf034753fd155674219cd04a6","unresolved":false,"context_lines":[{"line_number":558,"context_line":"  even if the host CPUs by the same name include it.  I.e.  \u0027PCID\u0027 needs"},{"line_number":559,"context_line":"  to be explicitly specified when using the said virtual CPU models."},{"line_number":560,"context_line":""},{"line_number":561,"context_line":"For more information about ``ssbd`` and ``virt-ssbd`` applicability,"},{"line_number":562,"context_line":"please refer to the following security updates:"},{"line_number":563,"context_line":""},{"line_number":564,"context_line":"https://www.us-cert.gov/ncas/alerts/TA18-141A"},{"line_number":565,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"5f7c97a3_ac3a1ce4","line":562,"range":{"start_line":561,"start_character":0,"end_line":562,"end_character":47},"in_reply_to":"5f7c97a3_6cdac4e9","updated":"2018-05-24 16:12:41.000000000","message":"FYI, for Compute nodes running on AMD hosts, the situation is a bit more\nsubtle and messy, as it depends on QEMU versions.  It needs to be\ndocumented in some form.  The complication is the following:\n\n  - If you are using \u0027host-model\u0027 CPU mode (which is the Nova libvirt\n    driver\u0027s default) and a QEMU version that is lower than 2.9.0, Nova\n    instances will _not_ get `virt-ssbd` CPU feature.  So for\n    deployments with QEMU version lower than 2.9.0, Nova _must_ (but it\n    will not; refer below) generate guest XML as below:\n\n        \u003cfeature policy\u003d\u0027force\u0027 name\u003d\u0027virt-ssbd\u0027/\u003e\n\n    But currently, there is no way Nova\u0027s LibvirtConfigGuestCPUFeature()\n    class can generate \"policy\u003d\u0027force\u0027\".  Nova can only generate\n    \"policy\u003d\u0027require\u0027\".  (There is a subtle functional difference\n    between \"force\" and \"require\", which you can read here, if you look\n    carefully: https://libvirt.org/formatdomain.html#elementsCPU)\n\n    Consequence: Instances will fail to boot on AMD Compute nodes if you\n    ask for `virt-ssbd`, and don\u0027t have QEMU 2.9.0 (and libvirt 3.10,\n    IIRC).\n\n  - However, if you are using Nova with a QEMU version that is 2.9.0 or\n    higher, then current Nova code that can only do \"policy\u003d\u0027require\u0027\",\n    as in:\n\n        \u003cfeature policy\u003d\u0027require\u0027 name\u003d\u0027virt-ssbd\u0027/\u003e\n\n    does the Right Thing.\n\n    (Detail: This is because, with QEMU 2.9.0, libvirt will use more\n    correct QEMU APIs (\u0027query-cpu-model-expansion\u0027 \u0026 friends) to fetch\n    CPU feature flag support status.)","commit_id":"f9925d2ed4cd181edb16374d850387d704932065"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"d9e696f5f8aa50c3bc945ce3076ac14b17dffc1b","unresolved":false,"context_lines":[{"line_number":558,"context_line":"  even if the host CPUs by the same name include it.  I.e.  \u0027PCID\u0027 needs"},{"line_number":559,"context_line":"  to be explicitly specified when using the said virtual CPU models."},{"line_number":560,"context_line":""},{"line_number":561,"context_line":"For more information about ``ssbd`` and ``virt-ssbd`` applicability,"},{"line_number":562,"context_line":"please refer to the following security updates:"},{"line_number":563,"context_line":""},{"line_number":564,"context_line":"https://www.us-cert.gov/ncas/alerts/TA18-141A"},{"line_number":565,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"5f7c97a3_073a0b97","line":562,"range":{"start_line":561,"start_character":0,"end_line":562,"end_character":47},"in_reply_to":"5f7c97a3_6cdac4e9","updated":"2018-05-24 16:25:17.000000000","message":"Okay, probably in the release note. Luckily we have a backport so we have a place to add a release note and communicate those sorts of details to our users :)","commit_id":"f9925d2ed4cd181edb16374d850387d704932065"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"6f2e652337bb863a500af4df4e9255ce3e69c125","unresolved":false,"context_lines":[{"line_number":558,"context_line":"  even if the host CPUs by the same name include it.  I.e.  \u0027PCID\u0027 needs"},{"line_number":559,"context_line":"  to be explicitly specified when using the said virtual CPU models."},{"line_number":560,"context_line":""},{"line_number":561,"context_line":"For more information about ``ssbd`` and ``virt-ssbd`` applicability,"},{"line_number":562,"context_line":"please refer to the following security updates:"},{"line_number":563,"context_line":""},{"line_number":564,"context_line":"https://www.us-cert.gov/ncas/alerts/TA18-141A"},{"line_number":565,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"5f7c97a3_e72d8f46","line":562,"range":{"start_line":561,"start_character":0,"end_line":562,"end_character":47},"in_reply_to":"5f7c97a3_ac3a1ce4","updated":"2018-05-24 17:58:17.000000000","message":"\u003e FYI, for Compute nodes running on AMD hosts, the situation is a bit\n \u003e more\n \u003e subtle and messy, as it depends on QEMU versions.  It needs to be\n \u003e documented in some form.  The complication is the following:\n \u003e \n \u003e - If you are using \u0027host-model\u0027 CPU mode (which is the Nova libvirt\n \u003e driver\u0027s default) and a QEMU version that is lower than 2.9.0, Nova\n \u003e instances will _not_ get `virt-ssbd` CPU feature.  So for\n \u003e deployments with QEMU version lower than 2.9.0, Nova _must_ (but it\n \u003e will not; refer below) generate guest XML as below:\n \u003e \n \u003e \u003cfeature policy\u003d\u0027force\u0027 name\u003d\u0027virt-ssbd\u0027/\u003e\n \u003e \n \u003e But currently, there is no way Nova\u0027s LibvirtConfigGuestCPUFeature()\n \u003e class can generate \"policy\u003d\u0027force\u0027\".  Nova can only generate\n \u003e \"policy\u003d\u0027require\u0027\".  (There is a subtle functional difference\n \u003e between \"force\" and \"require\", which you can read here, if you look\n \u003e carefully: https://libvirt.org/formatdomain.html#elementsCPU)\n \u003e \n \u003e Consequence: Instances will fail to boot on AMD Compute nodes if\n \u003e you\n \u003e ask for `virt-ssbd`, and don\u0027t have QEMU 2.9.0 (and libvirt 3.10,\n \u003e IIRC).\n \u003e \n \u003e - However, if you are using Nova with a QEMU version that is 2.9.0\n \u003e or\n \u003e higher, then current Nova code that can only do \"policy\u003d\u0027require\u0027\",\n \u003e as in:\n \u003e \n \u003e \u003cfeature policy\u003d\u0027require\u0027 name\u003d\u0027virt-ssbd\u0027/\u003e\n \u003e \n \u003e does the Right Thing.\n \u003e \n \u003e (Detail: This is because, with QEMU 2.9.0, libvirt will use more\n \u003e correct QEMU APIs (\u0027query-cpu-model-expansion\u0027 \u0026 friends) to fetch\n \u003e CPU feature flag support status.)\n\nI don\u0027t think the above is appropriate for a release note or config option documentation as it doesn\u0027t really contain actionable information for operators. If there are changes needed to what we do in the XML generation then that should be a different patch.","commit_id":"f9925d2ed4cd181edb16374d850387d704932065"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"e6cfe5f3cf8e75938f85ca854905a86981ffc6ce","unresolved":false,"context_lines":[{"line_number":558,"context_line":"  even if the host CPUs by the same name include it.  I.e.  \u0027PCID\u0027 needs"},{"line_number":559,"context_line":"  to be explicitly specified when using the said virtual CPU models."},{"line_number":560,"context_line":""},{"line_number":561,"context_line":"For more information about ``ssbd`` and ``virt-ssbd`` applicability,"},{"line_number":562,"context_line":"please refer to the following security updates:"},{"line_number":563,"context_line":""},{"line_number":564,"context_line":"https://www.us-cert.gov/ncas/alerts/TA18-141A"},{"line_number":565,"context_line":""}],"source_content_type":"text/x-python","patch_set":6,"id":"5f7c97a3_a2e9c580","line":562,"range":{"start_line":561,"start_character":0,"end_line":562,"end_character":47},"in_reply_to":"5f7c97a3_e72d8f46","updated":"2018-05-24 18:27:12.000000000","message":"We\u0027re linked to a bug. We could move this kind of information into the bug report and then the release note could link to that.","commit_id":"f9925d2ed4cd181edb16374d850387d704932065"}],"releasenotes/notes/libvirt-cpu-model-extra-flags-a23085f58bd22d27.yaml":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"0e4532f63b83ff56c6e367aa732a7210bfc6fd62","unresolved":false,"context_lines":[{"line_number":14,"context_line":"    CPU feature flag \u0027PCID\u0027 (\"Process-Context ID\") to the *guest* CPU,"},{"line_number":15,"context_line":"    assuming that it is available in the physical hardware itself."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"    Further, the \u0027SSDB\u0027 and \u0027VIRT-SSDB\u0027 flags were added to enable"},{"line_number":18,"context_line":"    mitigation of the Specture 3a and 4 CVEs."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    Note that besides ``custom``, Nova\u0027s libvirt driver has two other"},{"line_number":21,"context_line":"    CPU modes: ``host-model`` (which is the default), and"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5f7c97a3_35e09ecc","line":18,"range":{"start_line":17,"start_character":4,"end_line":18,"end_character":45},"updated":"2018-05-23 22:59:11.000000000","message":"This release note was already released, so adding this in could be confusing. In thinking about how CVE errata are done, this should probably be it\u0027s own new release note. We can reference this original change though:\n\nhttps://review.openstack.org/#/q/I6bb956808aa3df58747c865c92e5b276e61aff44\n\nAnd just mention additional choices were added to the config option list.","commit_id":"53aa5658f445727fa3641830371c947bb825a69c"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"9a9c8f041e5558b02945aeb9a0f8f299a06f4504","unresolved":false,"context_lines":[{"line_number":14,"context_line":"    CPU feature flag \u0027PCID\u0027 (\"Process-Context ID\") to the *guest* CPU,"},{"line_number":15,"context_line":"    assuming that it is available in the physical hardware itself."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"    Further, the \u0027SSDB\u0027 and \u0027VIRT-SSDB\u0027 flags were added to enable"},{"line_number":18,"context_line":"    mitigation of the Specture 3a and 4 CVEs."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    Note that besides ``custom``, Nova\u0027s libvirt driver has two other"},{"line_number":21,"context_line":"    CPU modes: ``host-model`` (which is the default), and"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5f7c97a3_75ee16b5","line":18,"range":{"start_line":17,"start_character":4,"end_line":18,"end_character":45},"in_reply_to":"5f7c97a3_35e09ecc","updated":"2018-05-23 23:02:21.000000000","message":"Should probably also reference the CVEs that are referenced in:\n\n  cpu: define the \u0027ssbd\u0027 CPUID feature bit (CVE-2018-3639)\n  cpu: define the \u0027virt-ssbd\u0027 CPUID feature bit (CVE-2018-3639)","commit_id":"53aa5658f445727fa3641830371c947bb825a69c"},{"author":{"_account_id":4393,"name":"Dan Smith","email":"dms@danplanet.com","username":"danms"},"change_message_id":"1e6971b73110d843de74b087dcefdf92536d7f27","unresolved":false,"context_lines":[{"line_number":14,"context_line":"    CPU feature flag \u0027PCID\u0027 (\"Process-Context ID\") to the *guest* CPU,"},{"line_number":15,"context_line":"    assuming that it is available in the physical hardware itself."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"    Further, the \u0027SSDB\u0027 and \u0027VIRT-SSDB\u0027 flags were added to enable"},{"line_number":18,"context_line":"    mitigation of the Specture 3a and 4 CVEs."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"    Note that besides ``custom``, Nova\u0027s libvirt driver has two other"},{"line_number":21,"context_line":"    CPU modes: ``host-model`` (which is the default), and"}],"source_content_type":"text/x-yaml","patch_set":3,"id":"5f7c97a3_f5d306d4","line":18,"range":{"start_line":17,"start_character":4,"end_line":18,"end_character":45},"in_reply_to":"5f7c97a3_75ee16b5","updated":"2018-05-23 23:12:25.000000000","message":"Okay I\u0027m linking to the US-CERT thing that covers the new CVEs (including these numbers) and also relates them to the previous one.","commit_id":"53aa5658f445727fa3641830371c947bb825a69c"}],"releasenotes/notes/libvirt-cpu-model-extra-flags-ssdb-fdbda6e4da495915.yaml":[{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"746c0722065cd546ff2c46c32a7241cf69d9e43c","unresolved":false,"context_lines":[{"line_number":2,"context_line":"security:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The \u0027SSDB\u0027 and \u0027VIRT-SSDB\u0027 cpu flags have been added to the list of available"},{"line_number":5,"context_line":"    options for the ``[libvirt]/cpu_model_extra_flags``. These are important for"},{"line_number":6,"context_line":"    proper mitigation of the Spectre 3a and 4 CVEs. For more information see"},{"line_number":7,"context_line":"    https://www.us-cert.gov/ncas/alerts/TA18-141A"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5f7c97a3_75f85648","line":5,"range":{"start_line":5,"start_character":4,"end_line":5,"end_character":11},"updated":"2018-05-23 23:15:19.000000000","message":"choices","commit_id":"b91f18793b7a0a037036fe8286558bb7ed045205"},{"author":{"_account_id":6873,"name":"Matt Riedemann","email":"mriedem.os@gmail.com","username":"mriedem"},"change_message_id":"746c0722065cd546ff2c46c32a7241cf69d9e43c","unresolved":false,"context_lines":[{"line_number":2,"context_line":"security:"},{"line_number":3,"context_line":"  - |"},{"line_number":4,"context_line":"    The \u0027SSDB\u0027 and \u0027VIRT-SSDB\u0027 cpu flags have been added to the list of available"},{"line_number":5,"context_line":"    options for the ``[libvirt]/cpu_model_extra_flags``. These are important for"},{"line_number":6,"context_line":"    proper mitigation of the Spectre 3a and 4 CVEs. For more information see"},{"line_number":7,"context_line":"    https://www.us-cert.gov/ncas/alerts/TA18-141A"}],"source_content_type":"text/x-yaml","patch_set":4,"id":"5f7c97a3_159562e4","line":5,"range":{"start_line":5,"start_character":55,"end_line":5,"end_character":56},"updated":"2018-05-23 23:15:19.000000000","message":"config option.","commit_id":"b91f18793b7a0a037036fe8286558bb7ed045205"}]}