rpms
/
libvirt
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Update to 5.4.0 release 

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
This commit is contained in:
Daniel P. Berrangé 2019-06-12 11:28:43 +02:00
parent d61e2404ba
commit c2c89ec6a3
7 changed files with 17 additions and 1194 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

880
0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch
View File

@ -1,880 +0,0 @@
From cfaf65ddb72aa9ddf7a27d9d315a679c4799aa97 Mon Sep 17 00:00:00 2001
From: Jiri Denemark <jdenemar@redhat.com>
Date: Tue, 9 Apr 2019 12:35:51 +0200
Subject: [PATCH 1/2] cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
(cherry picked from commit 5cd9db3ac11e88846cbcf95fad9f6fae9d880dee)
---
tests/cputest.c | 1 +
.../x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml | 7 +
.../x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 8 +
.../x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 28 +
.../x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 29 +
.../x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 11 +
.../x86_64-cpuid-Xeon-E3-1225-v5.json | 652 ++++++++++++++++++
.../x86_64-cpuid-Xeon-E3-1225-v5.sig | 4 +
.../x86_64-cpuid-Xeon-E3-1225-v5.xml | 47 ++
9 files changed, 787 insertions(+)
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
diff --git a/tests/cputest.c b/tests/cputest.c
index 1ade8091b2..e176739965 100644
--- a/tests/cputest.c
+++ b/tests/cputest.c
@@ -1272,6 +1272,7 @@ mymain(void)
DO_TEST_CPUID(VIR_ARCH_X86_64, "Phenom-B95", JSON_HOST);
DO_TEST_CPUID(VIR_ARCH_X86_64, "Ryzen-7-1800X-Eight-Core", JSON_HOST);
DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-5110", JSON_NONE);
+ DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1225-v5", JSON_MODELS);
DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1245-v5", JSON_MODELS);
DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2609-v3", JSON_MODELS);
DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2623-v4", JSON_MODELS);
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
new file mode 100644
index 0000000000..ce51903e53
--- /dev/null
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
@@ -0,0 +1,7 @@
+<!-- Features disabled by QEMU -->
+<cpudata arch='x86'>
+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1fc' edx='0xb0600000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000008' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+</cpudata>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
new file mode 100644
index 0000000000..0deca9fba6
--- /dev/null
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
@@ -0,0 +1,8 @@
+<!-- Features enabled by QEMU -->
+<cpudata arch='x86'>
+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0xf7fa3203' edx='0x0f8bfbff'/>
+ <cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x00000004' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000000'/>
+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000007' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
+</cpudata>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
new file mode 100644
index 0000000000..70a0fc3286
--- /dev/null
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
@@ -0,0 +1,28 @@
+<cpu mode='custom' match='exact'>
+ <model fallback='forbid'>Skylake-Client-IBRS</model>
+ <vendor>Intel</vendor>
+ <feature policy='require' name='ds'/>
+ <feature policy='require' name='acpi'/>
+ <feature policy='require' name='ss'/>
+ <feature policy='require' name='ht'/>
+ <feature policy='require' name='tm'/>
+ <feature policy='require' name='pbe'/>
+ <feature policy='require' name='dtes64'/>
+ <feature policy='require' name='monitor'/>
+ <feature policy='require' name='ds_cpl'/>
+ <feature policy='require' name='vmx'/>
+ <feature policy='require' name='smx'/>
+ <feature policy='require' name='est'/>
+ <feature policy='require' name='tm2'/>
+ <feature policy='require' name='xtpr'/>
+ <feature policy='require' name='pdcm'/>
+ <feature policy='require' name='osxsave'/>
+ <feature policy='require' name='tsc_adjust'/>
+ <feature policy='require' name='clflushopt'/>
+ <feature policy='require' name='intel-pt'/>
+ <feature policy='require' name='stibp'/>
+ <feature policy='require' name='ssbd'/>
+ <feature policy='require' name='xsaves'/>
+ <feature policy='require' name='pdpe1gb'/>
+ <feature policy='require' name='invtsc'/>
+</cpu>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
new file mode 100644
index 0000000000..bbdfb6aa61
--- /dev/null
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
@@ -0,0 +1,29 @@
+<cpu>
+ <arch>x86_64</arch>
+ <model>Skylake-Client-IBRS</model>
+ <vendor>Intel</vendor>
+ <feature name='ds'/>
+ <feature name='acpi'/>
+ <feature name='ss'/>
+ <feature name='ht'/>
+ <feature name='tm'/>
+ <feature name='pbe'/>
+ <feature name='dtes64'/>
+ <feature name='monitor'/>
+ <feature name='ds_cpl'/>
+ <feature name='vmx'/>
+ <feature name='smx'/>
+ <feature name='est'/>
+ <feature name='tm2'/>
+ <feature name='xtpr'/>
+ <feature name='pdcm'/>
+ <feature name='osxsave'/>
+ <feature name='tsc_adjust'/>
+ <feature name='clflushopt'/>
+ <feature name='intel-pt'/>
+ <feature name='stibp'/>
+ <feature name='ssbd'/>
+ <feature name='xsaves'/>
+ <feature name='pdpe1gb'/>
+ <feature name='invtsc'/>
+</cpu>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
new file mode 100644
index 0000000000..1f321db273
--- /dev/null
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
@@ -0,0 +1,11 @@
+<cpu mode='custom' match='exact'>
+ <model fallback='forbid'>Skylake-Client-IBRS</model>
+ <vendor>Intel</vendor>
+ <feature policy='require' name='ss'/>
+ <feature policy='require' name='hypervisor'/>
+ <feature policy='require' name='tsc_adjust'/>
+ <feature policy='require' name='clflushopt'/>
+ <feature policy='require' name='stibp'/>
+ <feature policy='require' name='ssbd'/>
+ <feature policy='require' name='pdpe1gb'/>
+</cpu>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
new file mode 100644
index 0000000000..084747556b
--- /dev/null
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
@@ -0,0 +1,652 @@
+{
+ "return": {
+ "model": {
+ "name": "base",
+ "props": {
+ "phys-bits": 0,
+ "core-id": -1,
+ "xlevel": 2147483656,
+ "cmov": true,
+ "ia64": false,
+ "aes": true,
+ "mmx": true,
+ "rdpid": false,
+ "arat": true,
+ "gfni": false,
+ "pause-filter": false,
+ "xsavec": true,
+ "intel-pt": false,
+ "osxsave": false,
+ "hv-frequencies": false,
+ "tsc-frequency": 0,
+ "xd": true,
+ "hv-vendor-id": "",
+ "kvm-asyncpf": true,
+ "kvm_asyncpf": true,
+ "perfctr_core": false,
+ "perfctr-core": false,
+ "mpx": true,
+ "pbe": false,
+ "decodeassists": false,
+ "avx512cd": false,
+ "sse4_1": true,
+ "sse4.1": true,
+ "sse4-1": true,
+ "family": 6,
+ "legacy-cache": true,
+ "vmware-cpuid-freq": true,
+ "avx512f": false,
+ "msr": true,
+ "mce": true,
+ "mca": true,
+ "hv-runtime": false,
+ "xcrypt": false,
+ "thread-id": -1,
+ "min-level": 13,
+ "xgetbv1": true,
+ "cid": false,
+ "hv-relaxed": false,
+ "hv-crash": false,
+ "ds": false,
+ "fxsr": true,
+ "xsaveopt": true,
+ "xtpr": false,
+ "avx512vl": false,
+ "avx512-vpopcntdq": false,
+ "phe": false,
+ "extapic": false,
+ "3dnowprefetch": true,
+ "avx512vbmi2": false,
+ "cr8legacy": false,
+ "stibp": true,
+ "cpuid-0xb": true,
+ "xcrypt-en": false,
+ "kvm_pv_eoi": true,
+ "apic-id": 4294967295,
+ "pn": false,
+ "dca": false,
+ "vendor": "GenuineIntel",
+ "pku": false,
+ "smx": false,
+ "cmp_legacy": false,
+ "cmp-legacy": false,
+ "node-id": -1,
+ "avx512-4fmaps": false,
+ "vmcb_clean": false,
+ "vmcb-clean": false,
+ "3dnowext": false,
+ "hle": true,
+ "npt": false,
+ "memory": "/machine/unattached/system[0]",
+ "clwb": false,
+ "lbrv": false,
+ "adx": true,
+ "ss": true,
+ "pni": true,
+ "svm_lock": false,
+ "svm-lock": false,
+ "pfthreshold": false,
+ "smep": true,
+ "smap": true,
+ "x2apic": true,
+ "avx512vbmi": false,
+ "avx512vnni": false,
+ "hv-stimer": false,
+ "i64": true,
+ "flushbyasid": false,
+ "f16c": true,
+ "ace2-en": false,
+ "pat": true,
+ "pae": true,
+ "sse": true,
+ "phe-en": false,
+ "kvm_nopiodelay": true,
+ "kvm-nopiodelay": true,
+ "tm": false,
+ "kvmclock-stable-bit": true,
+ "hypervisor": true,
+ "socket-id": -1,
+ "pcommit": false,
+ "syscall": true,
+ "level": 13,
+ "avx512dq": false,
+ "svm": false,
+ "full-cpuid-auto-level": true,
+ "hv-reset": false,
+ "invtsc": false,
+ "sse3": true,
+ "sse2": true,
+ "ssbd": true,
+ "est": false,
+ "avx512ifma": false,
+ "tm2": false,
+ "kvm-pv-eoi": true,
+ "cx8": true,
+ "kvm_mmu": false,
+ "kvm-mmu": false,
+ "sse4_2": true,
+ "sse4.2": true,
+ "sse4-2": true,
+ "pge": true,
+ "fill-mtrr-mask": true,
+ "avx512bitalg": false,
+ "nodeid_msr": false,
+ "pdcm": false,
+ "movbe": true,
+ "model": 94,
+ "nrip_save": false,
+ "nrip-save": false,
+ "kvm_pv_unhalt": true,
+ "ssse3": true,
+ "sse4a": false,
+ "invpcid": true,
+ "pdpe1gb": true,
+ "tsc-deadline": true,
+ "fma": true,
+ "cx16": true,
+ "de": true,
+ "enforce": false,
+ "stepping": 3,
+ "xsave": true,
+ "clflush": true,
+ "skinit": false,
+ "tsc": true,
+ "tce": false,
+ "fpu": true,
+ "ibs": false,
+ "ds_cpl": false,
+ "ds-cpl": false,
+ "host-phys-bits": true,
+ "fma4": false,
+ "la57": false,
+ "osvw": false,
+ "check": true,
+ "hv-spinlocks": -1,
+ "pmu": false,
+ "pmm": false,
+ "apic": true,
+ "spec-ctrl": true,
+ "min-xlevel2": 0,
+ "tsc-adjust": true,
+ "tsc_adjust": true,
+ "kvm-steal-time": true,
+ "kvm_steal_time": true,
+ "kvmclock": true,
+ "l3-cache": true,
+ "lwp": false,
+ "ibpb": false,
+ "xop": false,
+ "avx": true,
+ "ospke": false,
+ "ace2": false,
+ "avx512bw": false,
+ "acpi": false,
+ "hv-vapic": false,
+ "fsgsbase": true,
+ "ht": false,
+ "nx": true,
+ "pclmulqdq": true,
+ "mmxext": false,
+ "vaes": false,
+ "popcnt": true,
+ "xsaves": false,
+ "tcg-cpuid": true,
+ "lm": true,
+ "umip": false,
+ "pse": true,
+ "avx2": true,
+ "sep": true,
+ "pclmuldq": true,
+ "virt-ssbd": false,
+ "x-hv-max-vps": -1,
+ "nodeid-msr": false,
+ "md-clear": true,
+ "kvm": true,
+ "misalignsse": false,
+ "min-xlevel": 2147483656,
+ "kvm-pv-unhalt": true,
+ "bmi2": true,
+ "bmi1": true,
+ "realized": false,
+ "tsc_scale": false,
+ "tsc-scale": false,
+ "topoext": false,
+ "hv-vpindex": false,
+ "xlevel2": 0,
+ "clflushopt": true,
+ "kvm-no-smi-migration": false,
+ "monitor": false,
+ "avx512er": false,
+ "pmm-en": false,
+ "pcid": true,
+ "3dnow": false,
+ "erms": true,
+ "lahf-lm": true,
+ "lahf_lm": true,
+ "vpclmulqdq": false,
+ "fxsr-opt": false,
+ "hv-synic": false,
+ "xstore": false,
+ "fxsr_opt": false,
+ "kvm-hint-dedicated": false,
+ "rtm": true,
+ "lmce": true,
+ "hv-time": false,
+ "perfctr-nb": false,
+ "perfctr_nb": false,
+ "ffxsr": false,
+ "rdrand": true,
+ "rdseed": true,
+ "avx512-4vnniw": false,
+ "vmx": false,
+ "vme": true,
+ "dtes64": false,
+ "mtrr": true,
+ "rdtscp": true,
+ "pse36": true,
+ "kvm-pv-tlb-flush": false,
+ "tbm": false,
+ "wdt": false,
+ "pause_filter": false,
+ "sha-ni": false,
+ "model-id": "Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz",
+ "abm": true,
+ "avx512pf": false,
+ "xstore-en": false
+ }
+ }
+ },
+ "id": "model-expansion"
+}
+
+{
+ "return": [
+ {
+ "name": "max",
+ "typename": "max-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": false
+ },
+ {
+ "name": "host",
+ "typename": "host-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": false
+ },
+ {
+ "name": "base",
+ "typename": "base-x86_64-cpu",
+ "unavailable-features": [],
+ "static": true,
+ "migration-safe": true
+ },
+ {
+ "name": "qemu64",
+ "typename": "qemu64-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "qemu32",
+ "typename": "qemu32-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "phenom",
+ "typename": "phenom-x86_64-cpu",
+ "unavailable-features": [
+ "mmxext",
+ "fxsr-opt",
+ "3dnowext",
+ "3dnow",
+ "sse4a",
+ "npt"
+ ],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "pentium3",
+ "typename": "pentium3-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "pentium2",
+ "typename": "pentium2-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "pentium",
+ "typename": "pentium-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "n270",
+ "typename": "n270-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "kvm64",
+ "typename": "kvm64-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "kvm32",
+ "typename": "kvm32-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "cpu64-rhel6",
+ "typename": "cpu64-rhel6-x86_64-cpu",
+ "unavailable-features": [
+ "sse4a"
+ ],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "coreduo",
+ "typename": "coreduo-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "core2duo",
+ "typename": "core2duo-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "athlon",
+ "typename": "athlon-x86_64-cpu",
+ "unavailable-features": [
+ "mmxext",
+ "3dnowext",
+ "3dnow"
+ ],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Westmere",
+ "typename": "Westmere-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Westmere-IBRS",
+ "typename": "Westmere-IBRS-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Skylake-Server",
+ "typename": "Skylake-Server-x86_64-cpu",
+ "unavailable-features": [
+ "avx512f",
+ "avx512dq",
+ "clwb",
+ "avx512cd",
+ "avx512bw",
+ "avx512vl",
+ "avx512f",
+ "avx512f",
+ "avx512f"
+ ],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Skylake-Server-IBRS",
+ "typename": "Skylake-Server-IBRS-x86_64-cpu",
+ "unavailable-features": [
+ "avx512f",
+ "avx512dq",
+ "clwb",
+ "avx512cd",
+ "avx512bw",
+ "avx512vl",
+ "avx512f",
+ "avx512f",
+ "avx512f"
+ ],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Skylake-Client",
+ "typename": "Skylake-Client-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Skylake-Client-IBRS",
+ "typename": "Skylake-Client-IBRS-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "SandyBridge",
+ "typename": "SandyBridge-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "SandyBridge-IBRS",
+ "typename": "SandyBridge-IBRS-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Penryn",
+ "typename": "Penryn-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Opteron_G5",
+ "typename": "Opteron_G5-x86_64-cpu",
+ "unavailable-features": [
+ "sse4a",
+ "misalignsse",
+ "xop",
+ "fma4",
+ "tbm"
+ ],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Opteron_G4",
+ "typename": "Opteron_G4-x86_64-cpu",
+ "unavailable-features": [
+ "sse4a",
+ "misalignsse",
+ "xop",
+ "fma4"
+ ],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Opteron_G3",
+ "typename": "Opteron_G3-x86_64-cpu",
+ "unavailable-features": [
+ "sse4a",
+ "misalignsse"
+ ],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Opteron_G2",
+ "typename": "Opteron_G2-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Opteron_G1",
+ "typename": "Opteron_G1-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Nehalem",
+ "typename": "Nehalem-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Nehalem-IBRS",
+ "typename": "Nehalem-IBRS-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "IvyBridge",
+ "typename": "IvyBridge-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "IvyBridge-IBRS",
+ "typename": "IvyBridge-IBRS-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Haswell",
+ "typename": "Haswell-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Haswell-noTSX",
+ "typename": "Haswell-noTSX-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Haswell-noTSX-IBRS",
+ "typename": "Haswell-noTSX-IBRS-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Haswell-IBRS",
+ "typename": "Haswell-IBRS-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "EPYC",
+ "typename": "EPYC-x86_64-cpu",
+ "unavailable-features": [
+ "sha-ni",
+ "mmxext",
+ "fxsr-opt",
+ "cr8legacy",
+ "sse4a",
+ "misalignsse",
+ "osvw"
+ ],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "EPYC-IBPB",
+ "typename": "EPYC-IBPB-x86_64-cpu",
+ "unavailable-features": [
+ "sha-ni",
+ "mmxext",
+ "fxsr-opt",
+ "cr8legacy",
+ "sse4a",
+ "misalignsse",
+ "osvw",
+ "ibpb"
+ ],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Conroe",
+ "typename": "Conroe-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Broadwell",
+ "typename": "Broadwell-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Broadwell-noTSX",
+ "typename": "Broadwell-noTSX-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Broadwell-noTSX-IBRS",
+ "typename": "Broadwell-noTSX-IBRS-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "Broadwell-IBRS",
+ "typename": "Broadwell-IBRS-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ },
+ {
+ "name": "486",
+ "typename": "486-x86_64-cpu",
+ "unavailable-features": [],
+ "static": false,
+ "migration-safe": true
+ }
+ ],
+ "id": "definitions"
+}
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
new file mode 100644
index 0000000000..7e57c2ded6
--- /dev/null
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
@@ -0,0 +1,4 @@
+0506e3
+family: 6 (0x06)
+model: 94 (0x5e)
+stepping: 3 (0x03)
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
new file mode 100644
index 0000000000..437429d61d
--- /dev/null
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
@@ -0,0 +1,47 @@
+<!-- Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz -->
+<cpudata arch='x86'>
+ <cpuid eax_in='0x00000000' ecx_in='0x00' eax='0x00000016' ebx='0x756e6547' ecx='0x6c65746e' edx='0x49656e69'/>
+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x000506e3' ebx='0x06100800' ecx='0x7ffafbff' edx='0xbfebfbff'/>
+ <cpuid eax_in='0x00000002' ecx_in='0x00' eax='0x76036301' ebx='0x00f0b6ff' ecx='0x00000000' edx='0x00c30000'/>
+ <cpuid eax_in='0x00000003' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x00000004' ecx_in='0x00' eax='0x1c004121' ebx='0x01c0003f' ecx='0x0000003f' edx='0x00000000'/>
+ <cpuid eax_in='0x00000004' ecx_in='0x01' eax='0x1c004122' ebx='0x01c0003f' ecx='0x0000003f' edx='0x00000000'/>
+ <cpuid eax_in='0x00000004' ecx_in='0x02' eax='0x1c004143' ebx='0x00c0003f' ecx='0x000003ff' edx='0x00000000'/>
+ <cpuid eax_in='0x00000004' ecx_in='0x03' eax='0x1c03c163' ebx='0x03c0003f' ecx='0x00001fff' edx='0x00000006'/>
+ <cpuid eax_in='0x00000005' ecx_in='0x00' eax='0x00000040' ebx='0x00000040' ecx='0x00000003' edx='0x00142120'/>
+ <cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x000027f7' ebx='0x00000002' ecx='0x00000009' edx='0x00000000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x029c6fbf' ecx='0x00000000' edx='0x9c002400'/>
+ <cpuid eax_in='0x00000008' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x00000009' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x0000000a' ecx_in='0x00' eax='0x07300804' ebx='0x00000000' ecx='0x00000000' edx='0x00000603'/>
+ <cpuid eax_in='0x0000000b' ecx_in='0x00' eax='0x00000001' ebx='0x00000001' ecx='0x00000100' edx='0x00000006'/>
+ <cpuid eax_in='0x0000000b' ecx_in='0x01' eax='0x00000004' ebx='0x00000004' ecx='0x00000201' edx='0x00000006'/>
+ <cpuid eax_in='0x0000000c' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x0000000d' ecx_in='0x00' eax='0x0000001f' ebx='0x00000440' ecx='0x00000440' edx='0x00000000'/>
+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x0000000f' ebx='0x000003c0' ecx='0x00000100' edx='0x00000000'/>
+ <cpuid eax_in='0x0000000d' ecx_in='0x02' eax='0x00000100' ebx='0x00000240' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x0000000d' ecx_in='0x03' eax='0x00000040' ebx='0x000003c0' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x0000000d' ecx_in='0x04' eax='0x00000040' ebx='0x00000400' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x0000000d' ecx_in='0x08' eax='0x00000080' ebx='0x00000000' ecx='0x00000001' edx='0x00000000'/>
+ <cpuid eax_in='0x0000000e' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x0000000f' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x00000010' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x00000011' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x00000012' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x00000013' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x00000014' ecx_in='0x00' eax='0x00000001' ebx='0x0000000f' ecx='0x00000007' edx='0x00000000'/>
+ <cpuid eax_in='0x00000014' ecx_in='0x01' eax='0x02490002' ebx='0x003f3fff' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x00000015' ecx_in='0x00' eax='0x00000002' ebx='0x00000114' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x00000016' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
+ <cpuid eax_in='0x80000000' ecx_in='0x00' eax='0x80000008' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
+ <cpuid eax_in='0x80000002' ecx_in='0x00' eax='0x65746e49' ebx='0x2952286c' ecx='0x6f655820' edx='0x2952286e'/>
+ <cpuid eax_in='0x80000003' ecx_in='0x00' eax='0x55504320' ebx='0x2d334520' ecx='0x35323231' edx='0x20357620'/>
+ <cpuid eax_in='0x80000004' ecx_in='0x00' eax='0x2e332040' ebx='0x48473033' ecx='0x0000007a' edx='0x00000000'/>
+ <cpuid eax_in='0x80000005' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x80000006' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x01006040' edx='0x00000000'/>
+ <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
+ <cpuid eax_in='0x80000008' ecx_in='0x00' eax='0x00003027' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
+ <cpuid eax_in='0x80860000' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
+ <cpuid eax_in='0xc0000000' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
+</cpudata>
--
2.21.0

117
0002-cpu_map-Define-md-clear-CPUID-bit.patch
View File

@ -1,117 +0,0 @@
From 150b8cfaaf49d86f90187cbf071aa3fa55476ac1 Mon Sep 17 00:00:00 2001
From: Jiri Denemark <jdenemar@redhat.com>
Date: Tue, 9 Apr 2019 12:35:52 +0200
Subject: [PATCH 2/2] cpu_map: Define md-clear CPUID bit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
The bit is set when microcode provides the mechanism to invoke a flush
of various exploitable CPU buffers by invoking the VERW instruction.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 538d873571d7a682852dc1d70e5f4478f4d64e85)
---
src/cpu_map/x86_features.xml | 3 +++
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 2 +-
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 1 +
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 1 +
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 1 +
tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml | 1 +
tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml | 1 +
7 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/src/cpu_map/x86_features.xml b/src/cpu_map/x86_features.xml
index efcc10b1ae..370807f88e 100644
--- a/src/cpu_map/x86_features.xml
+++ b/src/cpu_map/x86_features.xml
@@ -320,6 +320,9 @@
<feature name='avx512-4fmaps'>
<cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000008'/>
</feature>
+ <feature name='md-clear'> <!-- md_clear -->
+ <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000400'/>
+ </feature>
<feature name='pconfig'>
<cpuid eax_in='0x07' ecx_in='0x00' edx='0x00040000'/>
</feature>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
index 0deca9fba6..74763a462b 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
@@ -2,7 +2,7 @@
<cpudata arch='x86'>
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0xf7fa3203' edx='0x0f8bfbff'/>
<cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x00000004' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000000'/>
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000400'/>
<cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000007' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
<cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
</cpudata>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
index 70a0fc3286..867970d2c7 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
@@ -20,6 +20,7 @@
<feature policy='require' name='tsc_adjust'/>
<feature policy='require' name='clflushopt'/>
<feature policy='require' name='intel-pt'/>
+ <feature policy='require' name='md-clear'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='ssbd'/>
<feature policy='require' name='xsaves'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
index bbdfb6aa61..e7ced42797 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
@@ -21,6 +21,7 @@
<feature name='tsc_adjust'/>
<feature name='clflushopt'/>
<feature name='intel-pt'/>
+ <feature name='md-clear'/>
<feature name='stibp'/>
<feature name='ssbd'/>
<feature name='xsaves'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
index 1f321db273..a5591278df 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
@@ -5,6 +5,7 @@
<feature policy='require' name='hypervisor'/>
<feature policy='require' name='tsc_adjust'/>
<feature policy='require' name='clflushopt'/>
+ <feature policy='require' name='md-clear'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='ssbd'/>
<feature policy='require' name='pdpe1gb'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml
index cc1fc90c45..c7e8a1fccf 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml
@@ -23,6 +23,7 @@
<feature policy='require' name='intel-pt'/>
<feature policy='require' name='pku'/>
<feature policy='require' name='ospke'/>
+ <feature policy='require' name='md-clear'/>
<feature policy='require' name='stibp'/>
<feature policy='require' name='arch-capabilities'/>
<feature policy='require' name='xsaves'/>
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml
index dfabdc57c7..d7482751b4 100644
--- a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml
@@ -24,6 +24,7 @@
<feature name='intel-pt'/>
<feature name='pku'/>
<feature name='ospke'/>
+ <feature name='md-clear'/>
<feature name='stibp'/>
<feature name='arch-capabilities'/>
<feature name='xsaves'/>
--
2.21.0

58
0003-admin-reject-clients-unless-their-UID-matches-the-cu.patch
View File

@ -1,58 +0,0 @@
From fd48a871a9dcdb8b8b1eb39612e5df870a7e2c3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 30 Apr 2019 17:26:13 +0100
Subject: [PATCH 1/3] admin: reject clients unless their UID matches the
current UID
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The admin protocol RPC messages are only intended for use by the user
running the daemon. As such they should not be allowed for any client
UID that does not match the server UID.
Fixes CVE-2019-10132
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit 96f41cd765c9e525fe28ee5abbfbf4a79b3720c7)
---
src/admin/admin_server_dispatch.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/src/admin/admin_server_dispatch.c b/src/admin/admin_server_dispatch.c
index 85e693d76c..6e3b99f97d 100644
--- a/src/admin/admin_server_dispatch.c
+++ b/src/admin/admin_server_dispatch.c
@@ -64,6 +64,28 @@ remoteAdmClientNew(virNetServerClientPtr client ATTRIBUTE_UNUSED,
void *opaque)
{
struct daemonAdmClientPrivate *priv;
+ uid_t clientuid;
+ gid_t clientgid;
+ pid_t clientpid;
+ unsigned long long timestamp;
+
+ if (virNetServerClientGetUNIXIdentity(client,
+ &clientuid,
+ &clientgid,
+ &clientpid,
+ &timestamp) < 0)
+ return NULL;
+
+ VIR_DEBUG("New client pid %lld uid %lld",
+ (long long)clientpid,
+ (long long)clientuid);
+
+ if (geteuid() != clientuid) {
+ virReportRestrictedError(_("Disallowing client %lld with uid %lld"),
+ (long long)clientpid,
+ (long long)clientuid);
+ return NULL;
+ }
if (VIR_ALLOC(priv) < 0)
return NULL;
--
2.21.0

51
0004-locking-restrict-sockets-to-mode-0600.patch
View File

@ -1,51 +0,0 @@
From 8c2c611df31d3b37f149385e4597c47300ae1489 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 30 Apr 2019 16:51:37 +0100
Subject: [PATCH 2/3] locking: restrict sockets to mode 0600
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The virtlockd daemon's only intended client is the libvirtd daemon. As
such it should never allow clients from other user accounts to connect.
The code already enforces this and drops clients from other UIDs, but
we can get earlier (and thus stronger) protection against DoS by setting
the socket permissions to 0600
Fixes CVE-2019-10132
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit f111e09468693909b1f067aa575efdafd9a262a1)
---
src/locking/virtlockd-admin.socket.in | 1 +
src/locking/virtlockd.socket.in | 1 +
2 files changed, 2 insertions(+)
diff --git a/src/locking/virtlockd-admin.socket.in b/src/locking/virtlockd-admin.socket.in
index 2a7500f3d0..f674c492f7 100644
--- a/src/locking/virtlockd-admin.socket.in
+++ b/src/locking/virtlockd-admin.socket.in
@@ -5,6 +5,7 @@ Before=libvirtd.service
[Socket]
ListenStream=@localstatedir@/run/libvirt/virtlockd-admin-sock
Service=virtlockd.service
+SocketMode=0600
[Install]
WantedBy=sockets.target
diff --git a/src/locking/virtlockd.socket.in b/src/locking/virtlockd.socket.in
index 45e0f20235..d701b27516 100644
--- a/src/locking/virtlockd.socket.in
+++ b/src/locking/virtlockd.socket.in
@@ -4,6 +4,7 @@ Before=libvirtd.service
[Socket]
ListenStream=@localstatedir@/run/libvirt/virtlockd-sock
+SocketMode=0600
[Install]
WantedBy=sockets.target
--
2.21.0

51
0005-logging-restrict-sockets-to-mode-0600.patch
View File

@ -1,51 +0,0 @@
From a968b3103c503db8a9fb6c9d64f0dd49d3b6f2a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 30 Apr 2019 17:27:41 +0100
Subject: [PATCH 3/3] logging: restrict sockets to mode 0600
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The virtlogd daemon's only intended client is the libvirtd daemon. As
such it should never allow clients from other user accounts to connect.
The code already enforces this and drops clients from other UIDs, but
we can get earlier (and thus stronger) protection against DoS by setting
the socket permissions to 0600
Fixes CVE-2019-10132
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
(cherry picked from commit e37bd65f9948c1185456b2cdaa3bd6e875af680f)
---
src/logging/virtlogd-admin.socket.in | 1 +
src/logging/virtlogd.socket.in | 1 +
2 files changed, 2 insertions(+)
diff --git a/src/logging/virtlogd-admin.socket.in b/src/logging/virtlogd-admin.socket.in
index 595e6c4c4b..5c41dfeb7b 100644
--- a/src/logging/virtlogd-admin.socket.in
+++ b/src/logging/virtlogd-admin.socket.in
@@ -5,6 +5,7 @@ Before=libvirtd.service
[Socket]
ListenStream=@localstatedir@/run/libvirt/virtlogd-admin-sock
Service=virtlogd.service
+SocketMode=0600
[Install]
WantedBy=sockets.target
diff --git a/src/logging/virtlogd.socket.in b/src/logging/virtlogd.socket.in
index 22b9360c8d..ae48cdab9a 100644
--- a/src/logging/virtlogd.socket.in
+++ b/src/logging/virtlogd.socket.in
@@ -4,6 +4,7 @@ Before=libvirtd.service
[Socket]
ListenStream=@localstatedir@/run/libvirt/virtlogd-sock
+SocketMode=0600
[Install]
WantedBy=sockets.target
--
2.21.0

52
libvirt.spec
View File

@ -215,8 +215,8 @@
Summary: Library providing a simple virtualization API
Name: libvirt
Version: 5.3.0
Release: 3%{?dist}
Version: 5.4.0
Release: 1%{?dist}
License: LGPLv2+
URL: https://libvirt.org/
@ -224,12 +224,6 @@ URL: https://libvirt.org/
%define mainturl stable_updates/
%endif
Source: https://libvirt.org/sources/%{?mainturl}libvirt-%{version}.tar.xz
Patch1: 0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch
Patch2: 0002-cpu_map-Define-md-clear-CPUID-bit.patch
# Fix systemd socket permissions (CVE-2019-10132)
Patch3: 0003-admin-reject-clients-unless-their-UID-matches-the-cu.patch
Patch4: 0004-locking-restrict-sockets-to-mode-0600.patch
Patch5: 0005-logging-restrict-sockets-to-mode-0600.patch
Requires: libvirt-daemon = %{version}-%{release}
Requires: libvirt-daemon-config-network = %{version}-%{release}
@ -726,9 +720,6 @@ parted and more.
Summary: QEMU driver plugin for the libvirtd daemon
Requires: libvirt-daemon = %{version}-%{release}
Requires: libvirt-libs = %{version}-%{release}
# There really is a hard cross-driver dependency here
Requires: libvirt-daemon-driver-network = %{version}-%{release}
Requires: libvirt-daemon-driver-storage-core = %{version}-%{release}
Requires: /usr/bin/qemu-img
# For image compression
Requires: gzip
@ -1238,8 +1229,6 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec)
%make_install %{?_smp_mflags} SYSTEMD_UNIT_DIR=%{_unitdir} V=1
make %{?_smp_mflags} -C examples distclean V=1
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
rm -f $RPM_BUILD_ROOT%{_libdir}/*.a
rm -f $RPM_BUILD_ROOT%{_libdir}/libvirt/lock-driver/*.la
@ -1261,8 +1250,8 @@ install -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/lib/libvirt/dnsmasq/
install -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/libvirt/networks/
cp $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml \
$RPM_BUILD_ROOT%{_datadir}/libvirt/networks/default.xml
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml
rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml
# libvirt saves this file with mode 0600
chmod 0600 $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml
# nwfilter files are installed in /usr/share/libvirt and copied to /etc in %post
# to avoid verification errors on changed files in /etc
@ -1306,7 +1295,7 @@ rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_libxl.aug
%endif
# Copied into libvirt-docs subpackage eventually
mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt-%{version} libvirt-docs
mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt libvirt-docs
%ifarch %{power64} s390x x86_64 ia64 alpha sparc64
mv $RPM_BUILD_ROOT%{_datadir}/systemtap/tapset/libvirt_probes.stp \
@ -1438,6 +1427,8 @@ if test $1 -eq 1 && test ! -f %{_sysconfdir}/libvirt/qemu/networks/default.xml ;
< %{_datadir}/libvirt/networks/default.xml \
> %{_sysconfdir}/libvirt/qemu/networks/default.xml
ln -s ../default.xml %{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml
# libvirt saves this file with mode 0600
chmod 0600 %{_sysconfdir}/libvirt/qemu/networks/default.xml
# Make sure libvirt picks up the new network defininiton
mkdir -p %{_localstatedir}/lib/rpm-state/libvirt || :
@ -1452,6 +1443,8 @@ rm -rf %{_localstatedir}/lib/rpm-state/libvirt || :
%post daemon-config-nwfilter
cp %{_datadir}/libvirt/nwfilter/*.xml %{_sysconfdir}/libvirt/nwfilter/
# libvirt saves these files with mode 600
chmod 600 %{_sysconfdir}/libvirt/nwfilter/*.xml
# Make sure libvirt picks up the new nwfilter defininitons
mkdir -p %{_localstatedir}/lib/rpm-state/libvirt || :
touch %{_localstatedir}/lib/rpm-state/libvirt/restart || :
@ -1490,14 +1483,6 @@ exit 0
%postun client
%systemd_postun libvirt-guests.service
%if %{with_sanlock}
%post lock-sanlock
if getent group sanlock > /dev/null ; then
chmod 0770 %{_localstatedir}/lib/libvirt/sanlock
chown root:sanlock %{_localstatedir}/lib/libvirt/sanlock
fi
%endif
%if %{with_lxc}
%pre login-shell
getent group virtlogin >/dev/null || groupadd -r virtlogin
@ -1516,16 +1501,6 @@ exit 0
%doc %{_datadir}/gtk-doc/html/libvirt/*.html
%doc %{_datadir}/gtk-doc/html/libvirt/*.png
%doc %{_datadir}/gtk-doc/html/libvirt/*.css
%doc examples/hellolibvirt
%doc examples/object-events
%doc examples/dominfo
%doc examples/domsuspend
%doc examples/dommigrate
%doc examples/openauth
%doc examples/xml
%doc examples/rename
%doc examples/systemtap
%doc examples/admin
%files daemon
@ -1598,6 +1573,8 @@ exit 0
%files daemon-config-network
%dir %{_datadir}/libvirt/networks/
%{_datadir}/libvirt/networks/default.xml
%ghost %{_sysconfdir}/libvirt/qemu/networks/default.xml
%ghost %{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml
%files daemon-config-nwfilter
%dir %{_datadir}/libvirt/nwfilter/
@ -1688,7 +1665,7 @@ exit 0
%config(noreplace) %{_sysconfdir}/libvirt/qemu.conf
%config(noreplace) %{_sysconfdir}/libvirt/qemu-lockd.conf
%config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd.qemu
%ghost %dir %attr(0700, root, root) %{_localstatedir}/run/libvirt/qemu/
%ghost %dir %{_localstatedir}/run/libvirt/qemu/
%dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/
%dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/cache/libvirt/qemu/
%{_datadir}/augeas/lenses/libvirtd_qemu.aug
@ -1760,7 +1737,7 @@ exit 0
%attr(0755, root, root) %{_libdir}/libvirt/lock-driver/sanlock.so
%{_datadir}/augeas/lenses/libvirt_sanlock.aug
%{_datadir}/augeas/lenses/tests/test_libvirt_sanlock.aug
%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/sanlock
%dir %attr(0770, root, sanlock) %{_localstatedir}/lib/libvirt/sanlock
%{_sbindir}/virt-sanlock-cleanup
%{_mandir}/man8/virt-sanlock-cleanup.8*
%attr(0755, root, root) %{_libexecdir}/libvirt_sanlock_helper
@ -1893,6 +1870,9 @@ exit 0
%changelog
* Wed Jun 12 2019 Daniel P. Berrangé <berrange@redhat.com> - 5.4.0-1
- Update to 5.4.0 release
* Tue May 21 2019 Daniel P. Berrangé <berrange@redhat.com> - 5.3.0-3
- Fix systemd socket permissions
- Resolves: rhbz #1712498 (CVE-2019-10132)

2
sources
View File

@ -1 +1 @@
SHA512 (libvirt-5.3.0.tar.xz) = de3888d448463ff1d981e8dcf1aaed39c8215c368d133ed03b8cc5d7e05a77d385287d388d9db109df21df9bf348a14e7c654ca509d41addaadaa199d16b162e
SHA512 (libvirt-5.4.0.tar.xz) = 03fa932d041d147cab79eab200bb33f8db72579be72ec7cbff3305f4a8d574835a80f1b99936eddf67f83d21cc5567f45c86e555209de6cd702f43f91197cfd0