Description
On a cluster configured with a CPU model such as cpu-model.node.kubevirt.io/Cascadelake-Server=true, virtual machines may no longer start after an upgrade to Harvester v1.7.3.
The mitigation for CVE-2019-11135 disables TSX on affected CPUs. As a result, the hle and rtm CPU features are missing on those nodes, and virtual machines that require them cannot start.
For details about CVE-2019-11135, see the Intel Security Advisory. To check whether a processor is affected, refer to Intel's list of affected processors and search for CVE-2019-11135.
Resolution
Following the check described in Red Hat's TAA advisory, check the TAA status on each node by running:
cat /sys/devices/system/cpu/vulnerabilities/tsx_async_abort
If the output reports Vulnerable, use the corresponding CPU model ending in -noTSX (for example, Skylake-Server-noTSX or Cascadelake-Server-noTSX) to disable TSX for the virtual machine. Interpret other output according to your operating system's security guidance. Make sure the selected model is supported by every node where the virtual machine may run.
Alternatively, configure Cascadelake-Server-v3 or a later version as the CPU model. After changing the CPU model, restart all affected virtual machines.
For more information about choosing and configuring a common CPU model, see Setting up a common CPU model for virtual machine migration.