> For the complete documentation index, see [llms.txt](https://platform9.com/kb/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://platform9.com/kb/pmo/solution/live-migration-fails-with-error-migration-pre-check-error-cpu-d.md).

# Live Migration Fails With Error: "Migration pre-check error: CPU doesn't have compatibility. internal error: Unknown CPU feature ssbd.

## Problem

Attempts to perform a live migration of an instance fails with the following error.

{% tabs %}
{% tab title="None" %}

```none
Migration pre-check error: CPU doesn't have compatibility. internal error: Unknown CPU feature ssbd Refer to http://libvirt.org/html/libvirt-libvirt-host.html#virCPUCompareResult
```

{% endtab %}
{% endtabs %}

## Environment

* Platform9 Managed OpenStack - All Versions
* Red Hat Enterprise Linux

## Cause

The instance being migrated may require a feature not available on the destination host. In this case, **ssbd** refers to "Speculative Store Bypass Disable", a Spectre vulnerability mitigation technique available in certain Red Hat kernels and presented as a CPU feature or capability on patched kernels.

When a virtual machine instance is created on a compute node with a kernel that is patched against a side-channel attack using speculative store bypass, subsequent migrations or resizes to other compute nodes may fail if that host has not been patched.

Required features for a virtual machine instance can be found using the **`virsh dumpxml [domain]`** command shown here.

{% tabs %}
{% tab title="None" %}

```none
[root@host1 ~]# virsh dumpxml 101 | grep require [feature policy='require' name='ss'/] [feature policy='require' name='stibp'/] [feature policy='require' name='ssbd'/] [feature policy='require' name='pdpe1gb'/] [feature policy='require' name='hypervisor'/]
```

{% endtab %}
{% endtabs %}

## Resolution

1. Verify that all hosts have the \*\*`ssbd`\*\*CPU flag present.

If patched, the output from *cat /proc/cpuinfo* will reflect **`ssbd`** as a CPU flag.

{% tabs %}
{% tab title="None" %}

```none
[root@host1 ~]# cat /proc/cpuinfoprocessor : 0vendor_id : GenuineIntelcpu family : 6model : 79model name : Intel(R) Xeon(R) CPU E5-2690 v4 @ 2.60GHzstepping : 1microcode : 0xb00002ecpu MHz : 3200.012cache size : 35840 KBphysical id : 0siblings : 28core id : 0cpu cores : 14apicid : 0initial apicid : 0fpu : yesfpu_exception : yescpuid level : 20wp : yesflags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc aperfmperf eagerfpu pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch epb cat_l3 cdp_l3 intel_ppin intel_pt ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm rdt_a rdseed adx smap xsaveopt cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm ida arat pln pts spec_ctrl intel_stibp flush_l1dbogomips : 5187.86clflush size : 64cache_alignment : 64address sizes : 46 bits physical, 48 bits virtualpower management:...
```

{% endtab %}
{% endtabs %}

If patched, the output from **`virsh capabilities`** will also reflect the **`ssbd`** feature.

{% tabs %}
{% tab title="None" %}

```none
[root@host1 ~]# virsh capabilities | grep ssbd [feature name='ssbd'/]
```

{% endtab %}
{% endtabs %}

Unpatched hosts will not reflect the feature.

{% tabs %}
{% tab title="None" %}

```none
[root@host2 ~]# virsh capabilities | grep ssbd[root@host2 ~]#
```

{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="None" %}

```none
If patched, a file system path can be used to determine the state of Speculative Store Bypass:[root@host1 ~]# cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypassMitigation: Speculative Store Bypass disabled via prctl and seccomp
```

{% endtab %}
{% endtabs %}

Unpatched hosts may reflect two different states, depending on the kernel version.

{% tabs %}
{% tab title="None" %}

```none
[root@host2 ~]# cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypasscat: /sys/devices/system/cpu/vulnerabilities/spec_store_bypass: No such file or directorynon-zero return code[root@host3 ~]# cat /sys/devices/system/cpu/vulnerabilities/spec_store_bypassVulnerable
```

{% endtab %}
{% endtabs %}

2. If necessary, upgrade the kernel to a patched version.

The following kernels have been observed as providing Speculative Store Bypass mitigation.

{% tabs %}
{% tab title="None" %}

```none
3.10.0-862.14.4.el7.x86_643.10.0-862.11.6.el7.x86_64
```

{% endtab %}
{% endtabs %}

Unpatched kernels may include the following.

{% tabs %}
{% tab title="None" %}

```none
3.10.0-693.el7.x86_643.10.0-693.21.1.el7.x86_64
```

{% endtab %}
{% endtabs %}

Patched kernels may be provided during RHEL upgrades or installed manually. Upgrading from Red Hat Enterprise Linux 7.4 to Red Hat Enterprise Linux 7.5 should provide a patched kernel and allow migrations and resizes that previously failed due to this issue to complete properly.

## Additional Information

For more information on how Red Hat addresses kernel side-channel attacks using Speculative Store Bypass, please refer to [Kernel Side-Channel Attack using Speculative Store Bypass - CVE-2018-3639.](https://access.redhat.com/security/vulnerabilities/ssbd)

If a kernel upgrade is not possible, or if the error is unrelated to the **ssbd** CPU feature, an instance's XML file can be modified manually to allow for a successful migration between hosts with different capabilities. Please refer to [Live Migration Fails With Error: "Unacceptable CPU Info: CPU Doesn't Have Compatibility."](https://support.platform9.com/hc/en-us/articles/360016894754-Live-Migration-Fails-With-Error-Unacceptable-CPU-Info-CPU-Doesn-t-Have-Compatibility-)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://platform9.com/kb/pmo/solution/live-migration-fails-with-error-migration-pre-check-error-cpu-d.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.