From a2be167dfee160d41c874485c5d653fbcc37d821 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Tue, 14 May 2019 12:41:11 +0100 Subject: [PATCH] Define md-clear CPUID bit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091 Signed-off-by: Daniel P. Berrangé --- ...ta-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch | 880 ++++++++++++++++++ 0002-cpu_map-Define-md-clear-CPUID-bit.patch | 117 +++ libvirt.spec | 9 +- 3 files changed, 1005 insertions(+), 1 deletion(-) create mode 100644 0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch create mode 100644 0002-cpu_map-Define-md-clear-CPUID-bit.patch diff --git a/0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch b/0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch new file mode 100644 index 0000000..a38ab5d --- /dev/null +++ b/0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch @@ -0,0 +1,880 @@ +From cfaf65ddb72aa9ddf7a27d9d315a679c4799aa97 Mon Sep 17 00:00:00 2001 +From: Jiri Denemark +Date: Tue, 9 Apr 2019 12:35:51 +0200 +Subject: [PATCH 1/2] cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Reviewed-by: Daniel P. Berrangé +Signed-off-by: Jiri Denemark +(cherry picked from commit 5cd9db3ac11e88846cbcf95fad9f6fae9d880dee) +--- + tests/cputest.c | 1 + + .../x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml | 7 + + .../x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 8 + + .../x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 28 + + .../x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 29 + + .../x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 11 + + .../x86_64-cpuid-Xeon-E3-1225-v5.json | 652 ++++++++++++++++++ + .../x86_64-cpuid-Xeon-E3-1225-v5.sig | 4 + + .../x86_64-cpuid-Xeon-E3-1225-v5.xml | 47 ++ + 9 files changed, 787 insertions(+) + create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml + create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml + create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml + create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml + create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml + create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json + create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig + create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml + +diff --git a/tests/cputest.c b/tests/cputest.c +index 1ade8091b2..e176739965 100644 +--- a/tests/cputest.c ++++ b/tests/cputest.c +@@ -1272,6 +1272,7 @@ mymain(void) + DO_TEST_CPUID(VIR_ARCH_X86_64, "Phenom-B95", JSON_HOST); + DO_TEST_CPUID(VIR_ARCH_X86_64, "Ryzen-7-1800X-Eight-Core", JSON_HOST); + DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-5110", JSON_NONE); ++ DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1225-v5", JSON_MODELS); + DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1245-v5", JSON_MODELS); + DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2609-v3", JSON_MODELS); + DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2623-v4", JSON_MODELS); +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml +new file mode 100644 +index 0000000000..ce51903e53 +--- /dev/null ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml +@@ -0,0 +1,7 @@ ++ ++ ++ ++ ++ ++ ++ +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml +new file mode 100644 +index 0000000000..0deca9fba6 +--- /dev/null ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml +@@ -0,0 +1,8 @@ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml +new file mode 100644 +index 0000000000..70a0fc3286 +--- /dev/null ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml +@@ -0,0 +1,28 @@ ++ ++ Skylake-Client-IBRS ++ Intel ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml +new file mode 100644 +index 0000000000..bbdfb6aa61 +--- /dev/null ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml +@@ -0,0 +1,29 @@ ++ ++ x86_64 ++ Skylake-Client-IBRS ++ Intel ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml +new file mode 100644 +index 0000000000..1f321db273 +--- /dev/null ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml +@@ -0,0 +1,11 @@ ++ ++ Skylake-Client-IBRS ++ Intel ++ ++ ++ ++ ++ ++ ++ ++ +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json +new file mode 100644 +index 0000000000..084747556b +--- /dev/null ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json +@@ -0,0 +1,652 @@ ++{ ++ "return": { ++ "model": { ++ "name": "base", ++ "props": { ++ "phys-bits": 0, ++ "core-id": -1, ++ "xlevel": 2147483656, ++ "cmov": true, ++ "ia64": false, ++ "aes": true, ++ "mmx": true, ++ "rdpid": false, ++ "arat": true, ++ "gfni": false, ++ "pause-filter": false, ++ "xsavec": true, ++ "intel-pt": false, ++ "osxsave": false, ++ "hv-frequencies": false, ++ "tsc-frequency": 0, ++ "xd": true, ++ "hv-vendor-id": "", ++ "kvm-asyncpf": true, ++ "kvm_asyncpf": true, ++ "perfctr_core": false, ++ "perfctr-core": false, ++ "mpx": true, ++ "pbe": false, ++ "decodeassists": false, ++ "avx512cd": false, ++ "sse4_1": true, ++ "sse4.1": true, ++ "sse4-1": true, ++ "family": 6, ++ "legacy-cache": true, ++ "vmware-cpuid-freq": true, ++ "avx512f": false, ++ "msr": true, ++ "mce": true, ++ "mca": true, ++ "hv-runtime": false, ++ "xcrypt": false, ++ "thread-id": -1, ++ "min-level": 13, ++ "xgetbv1": true, ++ "cid": false, ++ "hv-relaxed": false, ++ "hv-crash": false, ++ "ds": false, ++ "fxsr": true, ++ "xsaveopt": true, ++ "xtpr": false, ++ "avx512vl": false, ++ "avx512-vpopcntdq": false, ++ "phe": false, ++ "extapic": false, ++ "3dnowprefetch": true, ++ "avx512vbmi2": false, ++ "cr8legacy": false, ++ "stibp": true, ++ "cpuid-0xb": true, ++ "xcrypt-en": false, ++ "kvm_pv_eoi": true, ++ "apic-id": 4294967295, ++ "pn": false, ++ "dca": false, ++ "vendor": "GenuineIntel", ++ "pku": false, ++ "smx": false, ++ "cmp_legacy": false, ++ "cmp-legacy": false, ++ "node-id": -1, ++ "avx512-4fmaps": false, ++ "vmcb_clean": false, ++ "vmcb-clean": false, ++ "3dnowext": false, ++ "hle": true, ++ "npt": false, ++ "memory": "/machine/unattached/system[0]", ++ "clwb": false, ++ "lbrv": false, ++ "adx": true, ++ "ss": true, ++ "pni": true, ++ "svm_lock": false, ++ "svm-lock": false, ++ "pfthreshold": false, ++ "smep": true, ++ "smap": true, ++ "x2apic": true, ++ "avx512vbmi": false, ++ "avx512vnni": false, ++ "hv-stimer": false, ++ "i64": true, ++ "flushbyasid": false, ++ "f16c": true, ++ "ace2-en": false, ++ "pat": true, ++ "pae": true, ++ "sse": true, ++ "phe-en": false, ++ "kvm_nopiodelay": true, ++ "kvm-nopiodelay": true, ++ "tm": false, ++ "kvmclock-stable-bit": true, ++ "hypervisor": true, ++ "socket-id": -1, ++ "pcommit": false, ++ "syscall": true, ++ "level": 13, ++ "avx512dq": false, ++ "svm": false, ++ "full-cpuid-auto-level": true, ++ "hv-reset": false, ++ "invtsc": false, ++ "sse3": true, ++ "sse2": true, ++ "ssbd": true, ++ "est": false, ++ "avx512ifma": false, ++ "tm2": false, ++ "kvm-pv-eoi": true, ++ "cx8": true, ++ "kvm_mmu": false, ++ "kvm-mmu": false, ++ "sse4_2": true, ++ "sse4.2": true, ++ "sse4-2": true, ++ "pge": true, ++ "fill-mtrr-mask": true, ++ "avx512bitalg": false, ++ "nodeid_msr": false, ++ "pdcm": false, ++ "movbe": true, ++ "model": 94, ++ "nrip_save": false, ++ "nrip-save": false, ++ "kvm_pv_unhalt": true, ++ "ssse3": true, ++ "sse4a": false, ++ "invpcid": true, ++ "pdpe1gb": true, ++ "tsc-deadline": true, ++ "fma": true, ++ "cx16": true, ++ "de": true, ++ "enforce": false, ++ "stepping": 3, ++ "xsave": true, ++ "clflush": true, ++ "skinit": false, ++ "tsc": true, ++ "tce": false, ++ "fpu": true, ++ "ibs": false, ++ "ds_cpl": false, ++ "ds-cpl": false, ++ "host-phys-bits": true, ++ "fma4": false, ++ "la57": false, ++ "osvw": false, ++ "check": true, ++ "hv-spinlocks": -1, ++ "pmu": false, ++ "pmm": false, ++ "apic": true, ++ "spec-ctrl": true, ++ "min-xlevel2": 0, ++ "tsc-adjust": true, ++ "tsc_adjust": true, ++ "kvm-steal-time": true, ++ "kvm_steal_time": true, ++ "kvmclock": true, ++ "l3-cache": true, ++ "lwp": false, ++ "ibpb": false, ++ "xop": false, ++ "avx": true, ++ "ospke": false, ++ "ace2": false, ++ "avx512bw": false, ++ "acpi": false, ++ "hv-vapic": false, ++ "fsgsbase": true, ++ "ht": false, ++ "nx": true, ++ "pclmulqdq": true, ++ "mmxext": false, ++ "vaes": false, ++ "popcnt": true, ++ "xsaves": false, ++ "tcg-cpuid": true, ++ "lm": true, ++ "umip": false, ++ "pse": true, ++ "avx2": true, ++ "sep": true, ++ "pclmuldq": true, ++ "virt-ssbd": false, ++ "x-hv-max-vps": -1, ++ "nodeid-msr": false, ++ "md-clear": true, ++ "kvm": true, ++ "misalignsse": false, ++ "min-xlevel": 2147483656, ++ "kvm-pv-unhalt": true, ++ "bmi2": true, ++ "bmi1": true, ++ "realized": false, ++ "tsc_scale": false, ++ "tsc-scale": false, ++ "topoext": false, ++ "hv-vpindex": false, ++ "xlevel2": 0, ++ "clflushopt": true, ++ "kvm-no-smi-migration": false, ++ "monitor": false, ++ "avx512er": false, ++ "pmm-en": false, ++ "pcid": true, ++ "3dnow": false, ++ "erms": true, ++ "lahf-lm": true, ++ "lahf_lm": true, ++ "vpclmulqdq": false, ++ "fxsr-opt": false, ++ "hv-synic": false, ++ "xstore": false, ++ "fxsr_opt": false, ++ "kvm-hint-dedicated": false, ++ "rtm": true, ++ "lmce": true, ++ "hv-time": false, ++ "perfctr-nb": false, ++ "perfctr_nb": false, ++ "ffxsr": false, ++ "rdrand": true, ++ "rdseed": true, ++ "avx512-4vnniw": false, ++ "vmx": false, ++ "vme": true, ++ "dtes64": false, ++ "mtrr": true, ++ "rdtscp": true, ++ "pse36": true, ++ "kvm-pv-tlb-flush": false, ++ "tbm": false, ++ "wdt": false, ++ "pause_filter": false, ++ "sha-ni": false, ++ "model-id": "Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz", ++ "abm": true, ++ "avx512pf": false, ++ "xstore-en": false ++ } ++ } ++ }, ++ "id": "model-expansion" ++} ++ ++{ ++ "return": [ ++ { ++ "name": "max", ++ "typename": "max-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": false ++ }, ++ { ++ "name": "host", ++ "typename": "host-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": false ++ }, ++ { ++ "name": "base", ++ "typename": "base-x86_64-cpu", ++ "unavailable-features": [], ++ "static": true, ++ "migration-safe": true ++ }, ++ { ++ "name": "qemu64", ++ "typename": "qemu64-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "qemu32", ++ "typename": "qemu32-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "phenom", ++ "typename": "phenom-x86_64-cpu", ++ "unavailable-features": [ ++ "mmxext", ++ "fxsr-opt", ++ "3dnowext", ++ "3dnow", ++ "sse4a", ++ "npt" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "pentium3", ++ "typename": "pentium3-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "pentium2", ++ "typename": "pentium2-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "pentium", ++ "typename": "pentium-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "n270", ++ "typename": "n270-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "kvm64", ++ "typename": "kvm64-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "kvm32", ++ "typename": "kvm32-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "cpu64-rhel6", ++ "typename": "cpu64-rhel6-x86_64-cpu", ++ "unavailable-features": [ ++ "sse4a" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "coreduo", ++ "typename": "coreduo-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "core2duo", ++ "typename": "core2duo-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "athlon", ++ "typename": "athlon-x86_64-cpu", ++ "unavailable-features": [ ++ "mmxext", ++ "3dnowext", ++ "3dnow" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Westmere", ++ "typename": "Westmere-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Westmere-IBRS", ++ "typename": "Westmere-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Skylake-Server", ++ "typename": "Skylake-Server-x86_64-cpu", ++ "unavailable-features": [ ++ "avx512f", ++ "avx512dq", ++ "clwb", ++ "avx512cd", ++ "avx512bw", ++ "avx512vl", ++ "avx512f", ++ "avx512f", ++ "avx512f" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Skylake-Server-IBRS", ++ "typename": "Skylake-Server-IBRS-x86_64-cpu", ++ "unavailable-features": [ ++ "avx512f", ++ "avx512dq", ++ "clwb", ++ "avx512cd", ++ "avx512bw", ++ "avx512vl", ++ "avx512f", ++ "avx512f", ++ "avx512f" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Skylake-Client", ++ "typename": "Skylake-Client-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Skylake-Client-IBRS", ++ "typename": "Skylake-Client-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "SandyBridge", ++ "typename": "SandyBridge-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "SandyBridge-IBRS", ++ "typename": "SandyBridge-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Penryn", ++ "typename": "Penryn-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Opteron_G5", ++ "typename": "Opteron_G5-x86_64-cpu", ++ "unavailable-features": [ ++ "sse4a", ++ "misalignsse", ++ "xop", ++ "fma4", ++ "tbm" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Opteron_G4", ++ "typename": "Opteron_G4-x86_64-cpu", ++ "unavailable-features": [ ++ "sse4a", ++ "misalignsse", ++ "xop", ++ "fma4" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Opteron_G3", ++ "typename": "Opteron_G3-x86_64-cpu", ++ "unavailable-features": [ ++ "sse4a", ++ "misalignsse" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Opteron_G2", ++ "typename": "Opteron_G2-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Opteron_G1", ++ "typename": "Opteron_G1-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Nehalem", ++ "typename": "Nehalem-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Nehalem-IBRS", ++ "typename": "Nehalem-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "IvyBridge", ++ "typename": "IvyBridge-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "IvyBridge-IBRS", ++ "typename": "IvyBridge-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Haswell", ++ "typename": "Haswell-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Haswell-noTSX", ++ "typename": "Haswell-noTSX-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Haswell-noTSX-IBRS", ++ "typename": "Haswell-noTSX-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Haswell-IBRS", ++ "typename": "Haswell-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "EPYC", ++ "typename": "EPYC-x86_64-cpu", ++ "unavailable-features": [ ++ "sha-ni", ++ "mmxext", ++ "fxsr-opt", ++ "cr8legacy", ++ "sse4a", ++ "misalignsse", ++ "osvw" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "EPYC-IBPB", ++ "typename": "EPYC-IBPB-x86_64-cpu", ++ "unavailable-features": [ ++ "sha-ni", ++ "mmxext", ++ "fxsr-opt", ++ "cr8legacy", ++ "sse4a", ++ "misalignsse", ++ "osvw", ++ "ibpb" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Conroe", ++ "typename": "Conroe-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Broadwell", ++ "typename": "Broadwell-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Broadwell-noTSX", ++ "typename": "Broadwell-noTSX-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Broadwell-noTSX-IBRS", ++ "typename": "Broadwell-noTSX-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Broadwell-IBRS", ++ "typename": "Broadwell-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "486", ++ "typename": "486-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ } ++ ], ++ "id": "definitions" ++} +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig +new file mode 100644 +index 0000000000..7e57c2ded6 +--- /dev/null ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig +@@ -0,0 +1,4 @@ ++0506e3 ++family: 6 (0x06) ++model: 94 (0x5e) ++stepping: 3 (0x03) +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml +new file mode 100644 +index 0000000000..437429d61d +--- /dev/null ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml +@@ -0,0 +1,47 @@ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +-- +2.21.0 + diff --git a/0002-cpu_map-Define-md-clear-CPUID-bit.patch b/0002-cpu_map-Define-md-clear-CPUID-bit.patch new file mode 100644 index 0000000..5c80705 --- /dev/null +++ b/0002-cpu_map-Define-md-clear-CPUID-bit.patch @@ -0,0 +1,117 @@ +From 150b8cfaaf49d86f90187cbf071aa3fa55476ac1 Mon Sep 17 00:00:00 2001 +From: Jiri Denemark +Date: Tue, 9 Apr 2019 12:35:52 +0200 +Subject: [PATCH 2/2] cpu_map: Define md-clear CPUID bit +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091 + +The bit is set when microcode provides the mechanism to invoke a flush +of various exploitable CPU buffers by invoking the VERW instruction. + +Signed-off-by: Paolo Bonzini +Signed-off-by: Jiri Denemark +Reviewed-by: Daniel P. Berrangé +(cherry picked from commit 538d873571d7a682852dc1d70e5f4478f4d64e85) +--- + src/cpu_map/x86_features.xml | 3 +++ + tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 2 +- + tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 1 + + tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 1 + + tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 1 + + tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml | 1 + + tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml | 1 + + 7 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/src/cpu_map/x86_features.xml b/src/cpu_map/x86_features.xml +index efcc10b1ae..370807f88e 100644 +--- a/src/cpu_map/x86_features.xml ++++ b/src/cpu_map/x86_features.xml +@@ -320,6 +320,9 @@ + + + ++ ++ ++ + + + +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml +index 0deca9fba6..74763a462b 100644 +--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml +@@ -2,7 +2,7 @@ + + + +- ++ + + + +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml +index 70a0fc3286..867970d2c7 100644 +--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml +@@ -20,6 +20,7 @@ + + + ++ + + + +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml +index bbdfb6aa61..e7ced42797 100644 +--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml +@@ -21,6 +21,7 @@ + + + ++ + + + +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml +index 1f321db273..a5591278df 100644 +--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml +@@ -5,6 +5,7 @@ + + + ++ + + + +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml +index cc1fc90c45..c7e8a1fccf 100644 +--- a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml +@@ -23,6 +23,7 @@ + + + ++ + + + +diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml +index dfabdc57c7..d7482751b4 100644 +--- a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml ++++ b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml +@@ -24,6 +24,7 @@ + + + ++ + + + +-- +2.21.0 + diff --git a/libvirt.spec b/libvirt.spec index 7163632..e1ca9c3 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -216,7 +216,7 @@ Summary: Library providing a simple virtualization API Name: libvirt Version: 5.3.0 -Release: 1%{?dist} +Release: 2%{?dist} License: LGPLv2+ URL: https://libvirt.org/ @@ -224,6 +224,8 @@ URL: https://libvirt.org/ %define mainturl stable_updates/ %endif Source: https://libvirt.org/sources/%{?mainturl}libvirt-%{version}.tar.xz +Patch1: 0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch +Patch2: 0002-cpu_map-Define-md-clear-CPUID-bit.patch Requires: libvirt-daemon = %{version}-%{release} Requires: libvirt-daemon-config-network = %{version}-%{release} @@ -1887,6 +1889,11 @@ exit 0 %changelog +* Tue May 14 2019 Daniel P. Berrangé - 5.3.0-2 +- Define md-clear CPUID bit +- Resolves: rhbz #1709977 (CVE-2018-12126), rhbz #1709979 (CVE-2018-12127), + rhbz #1709997 (CVE-2018-12130), rhbz #1709984 (CVE-2019-11091) + * Tue May 7 2019 Daniel P. Berrangé - 5.3.0-1 - Update to 5.3.0 release