From c2c89ec6a30baa3f857c43004b8bd358ce9d2da1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Wed, 12 Jun 2019 11:28:43 +0200 Subject: [PATCH] Update to 5.4.0 release MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Daniel P. Berrangé --- ...ta-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch | 880 ------------------ 0002-cpu_map-Define-md-clear-CPUID-bit.patch | 117 --- ...ents-unless-their-UID-matches-the-cu.patch | 58 -- ...ocking-restrict-sockets-to-mode-0600.patch | 51 - ...ogging-restrict-sockets-to-mode-0600.patch | 51 - libvirt.spec | 52 +- sources | 2 +- 7 files changed, 17 insertions(+), 1194 deletions(-) delete mode 100644 0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch delete mode 100644 0002-cpu_map-Define-md-clear-CPUID-bit.patch delete mode 100644 0003-admin-reject-clients-unless-their-UID-matches-the-cu.patch delete mode 100644 0004-locking-restrict-sockets-to-mode-0600.patch delete mode 100644 0005-logging-restrict-sockets-to-mode-0600.patch diff --git a/0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch b/0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch deleted file mode 100644 index a38ab5d..0000000 --- a/0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch +++ /dev/null @@ -1,880 +0,0 @@ -From cfaf65ddb72aa9ddf7a27d9d315a679c4799aa97 Mon Sep 17 00:00:00 2001 -From: Jiri Denemark -Date: Tue, 9 Apr 2019 12:35:51 +0200 -Subject: [PATCH 1/2] cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Reviewed-by: Daniel P. Berrangé -Signed-off-by: Jiri Denemark -(cherry picked from commit 5cd9db3ac11e88846cbcf95fad9f6fae9d880dee) ---- - tests/cputest.c | 1 + - .../x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml | 7 + - .../x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 8 + - .../x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 28 + - .../x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 29 + - .../x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 11 + - .../x86_64-cpuid-Xeon-E3-1225-v5.json | 652 ++++++++++++++++++ - .../x86_64-cpuid-Xeon-E3-1225-v5.sig | 4 + - .../x86_64-cpuid-Xeon-E3-1225-v5.xml | 47 ++ - 9 files changed, 787 insertions(+) - create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml - create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml - create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml - create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml - create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml - create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json - create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig - create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml - -diff --git a/tests/cputest.c b/tests/cputest.c -index 1ade8091b2..e176739965 100644 ---- a/tests/cputest.c -+++ b/tests/cputest.c -@@ -1272,6 +1272,7 @@ mymain(void) - DO_TEST_CPUID(VIR_ARCH_X86_64, "Phenom-B95", JSON_HOST); - DO_TEST_CPUID(VIR_ARCH_X86_64, "Ryzen-7-1800X-Eight-Core", JSON_HOST); - DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-5110", JSON_NONE); -+ DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1225-v5", JSON_MODELS); - DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1245-v5", JSON_MODELS); - DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2609-v3", JSON_MODELS); - DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2623-v4", JSON_MODELS); -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml -new file mode 100644 -index 0000000000..ce51903e53 ---- /dev/null -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml -@@ -0,0 +1,7 @@ -+ -+ -+ -+ -+ -+ -+ -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml -new file mode 100644 -index 0000000000..0deca9fba6 ---- /dev/null -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml -@@ -0,0 +1,8 @@ -+ -+ -+ -+ -+ -+ -+ -+ -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml -new file mode 100644 -index 0000000000..70a0fc3286 ---- /dev/null -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml -@@ -0,0 +1,28 @@ -+ -+ Skylake-Client-IBRS -+ Intel -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml -new file mode 100644 -index 0000000000..bbdfb6aa61 ---- /dev/null -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml -@@ -0,0 +1,29 @@ -+ -+ x86_64 -+ Skylake-Client-IBRS -+ Intel -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml -new file mode 100644 -index 0000000000..1f321db273 ---- /dev/null -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml -@@ -0,0 +1,11 @@ -+ -+ Skylake-Client-IBRS -+ Intel -+ -+ -+ -+ -+ -+ -+ -+ -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json -new file mode 100644 -index 0000000000..084747556b ---- /dev/null -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json -@@ -0,0 +1,652 @@ -+{ -+ "return": { -+ "model": { -+ "name": "base", -+ "props": { -+ "phys-bits": 0, -+ "core-id": -1, -+ "xlevel": 2147483656, -+ "cmov": true, -+ "ia64": false, -+ "aes": true, -+ "mmx": true, -+ "rdpid": false, -+ "arat": true, -+ "gfni": false, -+ "pause-filter": false, -+ "xsavec": true, -+ "intel-pt": false, -+ "osxsave": false, -+ "hv-frequencies": false, -+ "tsc-frequency": 0, -+ "xd": true, -+ "hv-vendor-id": "", -+ "kvm-asyncpf": true, -+ "kvm_asyncpf": true, -+ "perfctr_core": false, -+ "perfctr-core": false, -+ "mpx": true, -+ "pbe": false, -+ "decodeassists": false, -+ "avx512cd": false, -+ "sse4_1": true, -+ "sse4.1": true, -+ "sse4-1": true, -+ "family": 6, -+ "legacy-cache": true, -+ "vmware-cpuid-freq": true, -+ "avx512f": false, -+ "msr": true, -+ "mce": true, -+ "mca": true, -+ "hv-runtime": false, -+ "xcrypt": false, -+ "thread-id": -1, -+ "min-level": 13, -+ "xgetbv1": true, -+ "cid": false, -+ "hv-relaxed": false, -+ "hv-crash": false, -+ "ds": false, -+ "fxsr": true, -+ "xsaveopt": true, -+ "xtpr": false, -+ "avx512vl": false, -+ "avx512-vpopcntdq": false, -+ "phe": false, -+ "extapic": false, -+ "3dnowprefetch": true, -+ "avx512vbmi2": false, -+ "cr8legacy": false, -+ "stibp": true, -+ "cpuid-0xb": true, -+ "xcrypt-en": false, -+ "kvm_pv_eoi": true, -+ "apic-id": 4294967295, -+ "pn": false, -+ "dca": false, -+ "vendor": "GenuineIntel", -+ "pku": false, -+ "smx": false, -+ "cmp_legacy": false, -+ "cmp-legacy": false, -+ "node-id": -1, -+ "avx512-4fmaps": false, -+ "vmcb_clean": false, -+ "vmcb-clean": false, -+ "3dnowext": false, -+ "hle": true, -+ "npt": false, -+ "memory": "/machine/unattached/system[0]", -+ "clwb": false, -+ "lbrv": false, -+ "adx": true, -+ "ss": true, -+ "pni": true, -+ "svm_lock": false, -+ "svm-lock": false, -+ "pfthreshold": false, -+ "smep": true, -+ "smap": true, -+ "x2apic": true, -+ "avx512vbmi": false, -+ "avx512vnni": false, -+ "hv-stimer": false, -+ "i64": true, -+ "flushbyasid": false, -+ "f16c": true, -+ "ace2-en": false, -+ "pat": true, -+ "pae": true, -+ "sse": true, -+ "phe-en": false, -+ "kvm_nopiodelay": true, -+ "kvm-nopiodelay": true, -+ "tm": false, -+ "kvmclock-stable-bit": true, -+ "hypervisor": true, -+ "socket-id": -1, -+ "pcommit": false, -+ "syscall": true, -+ "level": 13, -+ "avx512dq": false, -+ "svm": false, -+ "full-cpuid-auto-level": true, -+ "hv-reset": false, -+ "invtsc": false, -+ "sse3": true, -+ "sse2": true, -+ "ssbd": true, -+ "est": false, -+ "avx512ifma": false, -+ "tm2": false, -+ "kvm-pv-eoi": true, -+ "cx8": true, -+ "kvm_mmu": false, -+ "kvm-mmu": false, -+ "sse4_2": true, -+ "sse4.2": true, -+ "sse4-2": true, -+ "pge": true, -+ "fill-mtrr-mask": true, -+ "avx512bitalg": false, -+ "nodeid_msr": false, -+ "pdcm": false, -+ "movbe": true, -+ "model": 94, -+ "nrip_save": false, -+ "nrip-save": false, -+ "kvm_pv_unhalt": true, -+ "ssse3": true, -+ "sse4a": false, -+ "invpcid": true, -+ "pdpe1gb": true, -+ "tsc-deadline": true, -+ "fma": true, -+ "cx16": true, -+ "de": true, -+ "enforce": false, -+ "stepping": 3, -+ "xsave": true, -+ "clflush": true, -+ "skinit": false, -+ "tsc": true, -+ "tce": false, -+ "fpu": true, -+ "ibs": false, -+ "ds_cpl": false, -+ "ds-cpl": false, -+ "host-phys-bits": true, -+ "fma4": false, -+ "la57": false, -+ "osvw": false, -+ "check": true, -+ "hv-spinlocks": -1, -+ "pmu": false, -+ "pmm": false, -+ "apic": true, -+ "spec-ctrl": true, -+ "min-xlevel2": 0, -+ "tsc-adjust": true, -+ "tsc_adjust": true, -+ "kvm-steal-time": true, -+ "kvm_steal_time": true, -+ "kvmclock": true, -+ "l3-cache": true, -+ "lwp": false, -+ "ibpb": false, -+ "xop": false, -+ "avx": true, -+ "ospke": false, -+ "ace2": false, -+ "avx512bw": false, -+ "acpi": false, -+ "hv-vapic": false, -+ "fsgsbase": true, -+ "ht": false, -+ "nx": true, -+ "pclmulqdq": true, -+ "mmxext": false, -+ "vaes": false, -+ "popcnt": true, -+ "xsaves": false, -+ "tcg-cpuid": true, -+ "lm": true, -+ "umip": false, -+ "pse": true, -+ "avx2": true, -+ "sep": true, -+ "pclmuldq": true, -+ "virt-ssbd": false, -+ "x-hv-max-vps": -1, -+ "nodeid-msr": false, -+ "md-clear": true, -+ "kvm": true, -+ "misalignsse": false, -+ "min-xlevel": 2147483656, -+ "kvm-pv-unhalt": true, -+ "bmi2": true, -+ "bmi1": true, -+ "realized": false, -+ "tsc_scale": false, -+ "tsc-scale": false, -+ "topoext": false, -+ "hv-vpindex": false, -+ "xlevel2": 0, -+ "clflushopt": true, -+ "kvm-no-smi-migration": false, -+ "monitor": false, -+ "avx512er": false, -+ "pmm-en": false, -+ "pcid": true, -+ "3dnow": false, -+ "erms": true, -+ "lahf-lm": true, -+ "lahf_lm": true, -+ "vpclmulqdq": false, -+ "fxsr-opt": false, -+ "hv-synic": false, -+ "xstore": false, -+ "fxsr_opt": false, -+ "kvm-hint-dedicated": false, -+ "rtm": true, -+ "lmce": true, -+ "hv-time": false, -+ "perfctr-nb": false, -+ "perfctr_nb": false, -+ "ffxsr": false, -+ "rdrand": true, -+ "rdseed": true, -+ "avx512-4vnniw": false, -+ "vmx": false, -+ "vme": true, -+ "dtes64": false, -+ "mtrr": true, -+ "rdtscp": true, -+ "pse36": true, -+ "kvm-pv-tlb-flush": false, -+ "tbm": false, -+ "wdt": false, -+ "pause_filter": false, -+ "sha-ni": false, -+ "model-id": "Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz", -+ "abm": true, -+ "avx512pf": false, -+ "xstore-en": false -+ } -+ } -+ }, -+ "id": "model-expansion" -+} -+ -+{ -+ "return": [ -+ { -+ "name": "max", -+ "typename": "max-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": false -+ }, -+ { -+ "name": "host", -+ "typename": "host-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": false -+ }, -+ { -+ "name": "base", -+ "typename": "base-x86_64-cpu", -+ "unavailable-features": [], -+ "static": true, -+ "migration-safe": true -+ }, -+ { -+ "name": "qemu64", -+ "typename": "qemu64-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "qemu32", -+ "typename": "qemu32-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "phenom", -+ "typename": "phenom-x86_64-cpu", -+ "unavailable-features": [ -+ "mmxext", -+ "fxsr-opt", -+ "3dnowext", -+ "3dnow", -+ "sse4a", -+ "npt" -+ ], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "pentium3", -+ "typename": "pentium3-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "pentium2", -+ "typename": "pentium2-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "pentium", -+ "typename": "pentium-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "n270", -+ "typename": "n270-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "kvm64", -+ "typename": "kvm64-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "kvm32", -+ "typename": "kvm32-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "cpu64-rhel6", -+ "typename": "cpu64-rhel6-x86_64-cpu", -+ "unavailable-features": [ -+ "sse4a" -+ ], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "coreduo", -+ "typename": "coreduo-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "core2duo", -+ "typename": "core2duo-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "athlon", -+ "typename": "athlon-x86_64-cpu", -+ "unavailable-features": [ -+ "mmxext", -+ "3dnowext", -+ "3dnow" -+ ], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Westmere", -+ "typename": "Westmere-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Westmere-IBRS", -+ "typename": "Westmere-IBRS-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Skylake-Server", -+ "typename": "Skylake-Server-x86_64-cpu", -+ "unavailable-features": [ -+ "avx512f", -+ "avx512dq", -+ "clwb", -+ "avx512cd", -+ "avx512bw", -+ "avx512vl", -+ "avx512f", -+ "avx512f", -+ "avx512f" -+ ], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Skylake-Server-IBRS", -+ "typename": "Skylake-Server-IBRS-x86_64-cpu", -+ "unavailable-features": [ -+ "avx512f", -+ "avx512dq", -+ "clwb", -+ "avx512cd", -+ "avx512bw", -+ "avx512vl", -+ "avx512f", -+ "avx512f", -+ "avx512f" -+ ], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Skylake-Client", -+ "typename": "Skylake-Client-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Skylake-Client-IBRS", -+ "typename": "Skylake-Client-IBRS-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "SandyBridge", -+ "typename": "SandyBridge-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "SandyBridge-IBRS", -+ "typename": "SandyBridge-IBRS-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Penryn", -+ "typename": "Penryn-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Opteron_G5", -+ "typename": "Opteron_G5-x86_64-cpu", -+ "unavailable-features": [ -+ "sse4a", -+ "misalignsse", -+ "xop", -+ "fma4", -+ "tbm" -+ ], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Opteron_G4", -+ "typename": "Opteron_G4-x86_64-cpu", -+ "unavailable-features": [ -+ "sse4a", -+ "misalignsse", -+ "xop", -+ "fma4" -+ ], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Opteron_G3", -+ "typename": "Opteron_G3-x86_64-cpu", -+ "unavailable-features": [ -+ "sse4a", -+ "misalignsse" -+ ], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Opteron_G2", -+ "typename": "Opteron_G2-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Opteron_G1", -+ "typename": "Opteron_G1-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Nehalem", -+ "typename": "Nehalem-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Nehalem-IBRS", -+ "typename": "Nehalem-IBRS-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "IvyBridge", -+ "typename": "IvyBridge-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "IvyBridge-IBRS", -+ "typename": "IvyBridge-IBRS-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Haswell", -+ "typename": "Haswell-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Haswell-noTSX", -+ "typename": "Haswell-noTSX-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Haswell-noTSX-IBRS", -+ "typename": "Haswell-noTSX-IBRS-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Haswell-IBRS", -+ "typename": "Haswell-IBRS-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "EPYC", -+ "typename": "EPYC-x86_64-cpu", -+ "unavailable-features": [ -+ "sha-ni", -+ "mmxext", -+ "fxsr-opt", -+ "cr8legacy", -+ "sse4a", -+ "misalignsse", -+ "osvw" -+ ], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "EPYC-IBPB", -+ "typename": "EPYC-IBPB-x86_64-cpu", -+ "unavailable-features": [ -+ "sha-ni", -+ "mmxext", -+ "fxsr-opt", -+ "cr8legacy", -+ "sse4a", -+ "misalignsse", -+ "osvw", -+ "ibpb" -+ ], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Conroe", -+ "typename": "Conroe-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Broadwell", -+ "typename": "Broadwell-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Broadwell-noTSX", -+ "typename": "Broadwell-noTSX-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Broadwell-noTSX-IBRS", -+ "typename": "Broadwell-noTSX-IBRS-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "Broadwell-IBRS", -+ "typename": "Broadwell-IBRS-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ }, -+ { -+ "name": "486", -+ "typename": "486-x86_64-cpu", -+ "unavailable-features": [], -+ "static": false, -+ "migration-safe": true -+ } -+ ], -+ "id": "definitions" -+} -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig -new file mode 100644 -index 0000000000..7e57c2ded6 ---- /dev/null -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig -@@ -0,0 +1,4 @@ -+0506e3 -+family: 6 (0x06) -+model: 94 (0x5e) -+stepping: 3 (0x03) -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml -new file mode 100644 -index 0000000000..437429d61d ---- /dev/null -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml -@@ -0,0 +1,47 @@ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ -+ --- -2.21.0 - diff --git a/0002-cpu_map-Define-md-clear-CPUID-bit.patch b/0002-cpu_map-Define-md-clear-CPUID-bit.patch deleted file mode 100644 index 5c80705..0000000 --- a/0002-cpu_map-Define-md-clear-CPUID-bit.patch +++ /dev/null @@ -1,117 +0,0 @@ -From 150b8cfaaf49d86f90187cbf071aa3fa55476ac1 Mon Sep 17 00:00:00 2001 -From: Jiri Denemark -Date: Tue, 9 Apr 2019 12:35:52 +0200 -Subject: [PATCH 2/2] cpu_map: Define md-clear CPUID bit -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091 - -The bit is set when microcode provides the mechanism to invoke a flush -of various exploitable CPU buffers by invoking the VERW instruction. - -Signed-off-by: Paolo Bonzini -Signed-off-by: Jiri Denemark -Reviewed-by: Daniel P. Berrangé -(cherry picked from commit 538d873571d7a682852dc1d70e5f4478f4d64e85) ---- - src/cpu_map/x86_features.xml | 3 +++ - tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 2 +- - tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 1 + - tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 1 + - tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 1 + - tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml | 1 + - tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml | 1 + - 7 files changed, 9 insertions(+), 1 deletion(-) - -diff --git a/src/cpu_map/x86_features.xml b/src/cpu_map/x86_features.xml -index efcc10b1ae..370807f88e 100644 ---- a/src/cpu_map/x86_features.xml -+++ b/src/cpu_map/x86_features.xml -@@ -320,6 +320,9 @@ - - - -+ -+ -+ - - - -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml -index 0deca9fba6..74763a462b 100644 ---- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml -@@ -2,7 +2,7 @@ - - - -- -+ - - - -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml -index 70a0fc3286..867970d2c7 100644 ---- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml -@@ -20,6 +20,7 @@ - - - -+ - - - -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml -index bbdfb6aa61..e7ced42797 100644 ---- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml -@@ -21,6 +21,7 @@ - - - -+ - - - -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml -index 1f321db273..a5591278df 100644 ---- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml -@@ -5,6 +5,7 @@ - - - -+ - - - -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml -index cc1fc90c45..c7e8a1fccf 100644 ---- a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml -@@ -23,6 +23,7 @@ - - - -+ - - - -diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml -index dfabdc57c7..d7482751b4 100644 ---- a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml -+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml -@@ -24,6 +24,7 @@ - - - -+ - - - --- -2.21.0 - diff --git a/0003-admin-reject-clients-unless-their-UID-matches-the-cu.patch b/0003-admin-reject-clients-unless-their-UID-matches-the-cu.patch deleted file mode 100644 index c9e27df..0000000 --- a/0003-admin-reject-clients-unless-their-UID-matches-the-cu.patch +++ /dev/null @@ -1,58 +0,0 @@ -From fd48a871a9dcdb8b8b1eb39612e5df870a7e2c3c Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Tue, 30 Apr 2019 17:26:13 +0100 -Subject: [PATCH 1/3] admin: reject clients unless their UID matches the - current UID -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The admin protocol RPC messages are only intended for use by the user -running the daemon. As such they should not be allowed for any client -UID that does not match the server UID. - -Fixes CVE-2019-10132 - -Reviewed-by: Ján Tomko -Signed-off-by: Daniel P. Berrangé -(cherry picked from commit 96f41cd765c9e525fe28ee5abbfbf4a79b3720c7) ---- - src/admin/admin_server_dispatch.c | 22 ++++++++++++++++++++++ - 1 file changed, 22 insertions(+) - -diff --git a/src/admin/admin_server_dispatch.c b/src/admin/admin_server_dispatch.c -index 85e693d76c..6e3b99f97d 100644 ---- a/src/admin/admin_server_dispatch.c -+++ b/src/admin/admin_server_dispatch.c -@@ -64,6 +64,28 @@ remoteAdmClientNew(virNetServerClientPtr client ATTRIBUTE_UNUSED, - void *opaque) - { - struct daemonAdmClientPrivate *priv; -+ uid_t clientuid; -+ gid_t clientgid; -+ pid_t clientpid; -+ unsigned long long timestamp; -+ -+ if (virNetServerClientGetUNIXIdentity(client, -+ &clientuid, -+ &clientgid, -+ &clientpid, -+ ×tamp) < 0) -+ return NULL; -+ -+ VIR_DEBUG("New client pid %lld uid %lld", -+ (long long)clientpid, -+ (long long)clientuid); -+ -+ if (geteuid() != clientuid) { -+ virReportRestrictedError(_("Disallowing client %lld with uid %lld"), -+ (long long)clientpid, -+ (long long)clientuid); -+ return NULL; -+ } - - if (VIR_ALLOC(priv) < 0) - return NULL; --- -2.21.0 - diff --git a/0004-locking-restrict-sockets-to-mode-0600.patch b/0004-locking-restrict-sockets-to-mode-0600.patch deleted file mode 100644 index 2d3fc27..0000000 --- a/0004-locking-restrict-sockets-to-mode-0600.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 8c2c611df31d3b37f149385e4597c47300ae1489 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Tue, 30 Apr 2019 16:51:37 +0100 -Subject: [PATCH 2/3] locking: restrict sockets to mode 0600 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The virtlockd daemon's only intended client is the libvirtd daemon. As -such it should never allow clients from other user accounts to connect. -The code already enforces this and drops clients from other UIDs, but -we can get earlier (and thus stronger) protection against DoS by setting -the socket permissions to 0600 - -Fixes CVE-2019-10132 - -Reviewed-by: Ján Tomko -Signed-off-by: Daniel P. Berrangé -(cherry picked from commit f111e09468693909b1f067aa575efdafd9a262a1) ---- - src/locking/virtlockd-admin.socket.in | 1 + - src/locking/virtlockd.socket.in | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/src/locking/virtlockd-admin.socket.in b/src/locking/virtlockd-admin.socket.in -index 2a7500f3d0..f674c492f7 100644 ---- a/src/locking/virtlockd-admin.socket.in -+++ b/src/locking/virtlockd-admin.socket.in -@@ -5,6 +5,7 @@ Before=libvirtd.service - [Socket] - ListenStream=@localstatedir@/run/libvirt/virtlockd-admin-sock - Service=virtlockd.service -+SocketMode=0600 - - [Install] - WantedBy=sockets.target -diff --git a/src/locking/virtlockd.socket.in b/src/locking/virtlockd.socket.in -index 45e0f20235..d701b27516 100644 ---- a/src/locking/virtlockd.socket.in -+++ b/src/locking/virtlockd.socket.in -@@ -4,6 +4,7 @@ Before=libvirtd.service - - [Socket] - ListenStream=@localstatedir@/run/libvirt/virtlockd-sock -+SocketMode=0600 - - [Install] - WantedBy=sockets.target --- -2.21.0 - diff --git a/0005-logging-restrict-sockets-to-mode-0600.patch b/0005-logging-restrict-sockets-to-mode-0600.patch deleted file mode 100644 index a4c01a9..0000000 --- a/0005-logging-restrict-sockets-to-mode-0600.patch +++ /dev/null @@ -1,51 +0,0 @@ -From a968b3103c503db8a9fb6c9d64f0dd49d3b6f2a3 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= -Date: Tue, 30 Apr 2019 17:27:41 +0100 -Subject: [PATCH 3/3] logging: restrict sockets to mode 0600 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The virtlogd daemon's only intended client is the libvirtd daemon. As -such it should never allow clients from other user accounts to connect. -The code already enforces this and drops clients from other UIDs, but -we can get earlier (and thus stronger) protection against DoS by setting -the socket permissions to 0600 - -Fixes CVE-2019-10132 - -Reviewed-by: Ján Tomko -Signed-off-by: Daniel P. Berrangé -(cherry picked from commit e37bd65f9948c1185456b2cdaa3bd6e875af680f) ---- - src/logging/virtlogd-admin.socket.in | 1 + - src/logging/virtlogd.socket.in | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/src/logging/virtlogd-admin.socket.in b/src/logging/virtlogd-admin.socket.in -index 595e6c4c4b..5c41dfeb7b 100644 ---- a/src/logging/virtlogd-admin.socket.in -+++ b/src/logging/virtlogd-admin.socket.in -@@ -5,6 +5,7 @@ Before=libvirtd.service - [Socket] - ListenStream=@localstatedir@/run/libvirt/virtlogd-admin-sock - Service=virtlogd.service -+SocketMode=0600 - - [Install] - WantedBy=sockets.target -diff --git a/src/logging/virtlogd.socket.in b/src/logging/virtlogd.socket.in -index 22b9360c8d..ae48cdab9a 100644 ---- a/src/logging/virtlogd.socket.in -+++ b/src/logging/virtlogd.socket.in -@@ -4,6 +4,7 @@ Before=libvirtd.service - - [Socket] - ListenStream=@localstatedir@/run/libvirt/virtlogd-sock -+SocketMode=0600 - - [Install] - WantedBy=sockets.target --- -2.21.0 - diff --git a/libvirt.spec b/libvirt.spec index c6a9f23..5819ccb 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -215,8 +215,8 @@ Summary: Library providing a simple virtualization API Name: libvirt -Version: 5.3.0 -Release: 3%{?dist} +Version: 5.4.0 +Release: 1%{?dist} License: LGPLv2+ URL: https://libvirt.org/ @@ -224,12 +224,6 @@ URL: https://libvirt.org/ %define mainturl stable_updates/ %endif Source: https://libvirt.org/sources/%{?mainturl}libvirt-%{version}.tar.xz -Patch1: 0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch -Patch2: 0002-cpu_map-Define-md-clear-CPUID-bit.patch -# Fix systemd socket permissions (CVE-2019-10132) -Patch3: 0003-admin-reject-clients-unless-their-UID-matches-the-cu.patch -Patch4: 0004-locking-restrict-sockets-to-mode-0600.patch -Patch5: 0005-logging-restrict-sockets-to-mode-0600.patch Requires: libvirt-daemon = %{version}-%{release} Requires: libvirt-daemon-config-network = %{version}-%{release} @@ -726,9 +720,6 @@ parted and more. Summary: QEMU driver plugin for the libvirtd daemon Requires: libvirt-daemon = %{version}-%{release} Requires: libvirt-libs = %{version}-%{release} -# There really is a hard cross-driver dependency here -Requires: libvirt-daemon-driver-network = %{version}-%{release} -Requires: libvirt-daemon-driver-storage-core = %{version}-%{release} Requires: /usr/bin/qemu-img # For image compression Requires: gzip @@ -1238,8 +1229,6 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec) %make_install %{?_smp_mflags} SYSTEMD_UNIT_DIR=%{_unitdir} V=1 -make %{?_smp_mflags} -C examples distclean V=1 - rm -f $RPM_BUILD_ROOT%{_libdir}/*.la rm -f $RPM_BUILD_ROOT%{_libdir}/*.a rm -f $RPM_BUILD_ROOT%{_libdir}/libvirt/lock-driver/*.la @@ -1261,8 +1250,8 @@ install -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/lib/libvirt/dnsmasq/ install -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/libvirt/networks/ cp $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml \ $RPM_BUILD_ROOT%{_datadir}/libvirt/networks/default.xml -rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml -rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml +# libvirt saves this file with mode 0600 +chmod 0600 $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml # nwfilter files are installed in /usr/share/libvirt and copied to /etc in %post # to avoid verification errors on changed files in /etc @@ -1306,7 +1295,7 @@ rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_libxl.aug %endif # Copied into libvirt-docs subpackage eventually -mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt-%{version} libvirt-docs +mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt libvirt-docs %ifarch %{power64} s390x x86_64 ia64 alpha sparc64 mv $RPM_BUILD_ROOT%{_datadir}/systemtap/tapset/libvirt_probes.stp \ @@ -1438,6 +1427,8 @@ if test $1 -eq 1 && test ! -f %{_sysconfdir}/libvirt/qemu/networks/default.xml ; < %{_datadir}/libvirt/networks/default.xml \ > %{_sysconfdir}/libvirt/qemu/networks/default.xml ln -s ../default.xml %{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml + # libvirt saves this file with mode 0600 + chmod 0600 %{_sysconfdir}/libvirt/qemu/networks/default.xml # Make sure libvirt picks up the new network defininiton mkdir -p %{_localstatedir}/lib/rpm-state/libvirt || : @@ -1452,6 +1443,8 @@ rm -rf %{_localstatedir}/lib/rpm-state/libvirt || : %post daemon-config-nwfilter cp %{_datadir}/libvirt/nwfilter/*.xml %{_sysconfdir}/libvirt/nwfilter/ +# libvirt saves these files with mode 600 +chmod 600 %{_sysconfdir}/libvirt/nwfilter/*.xml # Make sure libvirt picks up the new nwfilter defininitons mkdir -p %{_localstatedir}/lib/rpm-state/libvirt || : touch %{_localstatedir}/lib/rpm-state/libvirt/restart || : @@ -1490,14 +1483,6 @@ exit 0 %postun client %systemd_postun libvirt-guests.service -%if %{with_sanlock} -%post lock-sanlock -if getent group sanlock > /dev/null ; then - chmod 0770 %{_localstatedir}/lib/libvirt/sanlock - chown root:sanlock %{_localstatedir}/lib/libvirt/sanlock -fi -%endif - %if %{with_lxc} %pre login-shell getent group virtlogin >/dev/null || groupadd -r virtlogin @@ -1516,16 +1501,6 @@ exit 0 %doc %{_datadir}/gtk-doc/html/libvirt/*.html %doc %{_datadir}/gtk-doc/html/libvirt/*.png %doc %{_datadir}/gtk-doc/html/libvirt/*.css -%doc examples/hellolibvirt -%doc examples/object-events -%doc examples/dominfo -%doc examples/domsuspend -%doc examples/dommigrate -%doc examples/openauth -%doc examples/xml -%doc examples/rename -%doc examples/systemtap -%doc examples/admin %files daemon @@ -1598,6 +1573,8 @@ exit 0 %files daemon-config-network %dir %{_datadir}/libvirt/networks/ %{_datadir}/libvirt/networks/default.xml +%ghost %{_sysconfdir}/libvirt/qemu/networks/default.xml +%ghost %{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml %files daemon-config-nwfilter %dir %{_datadir}/libvirt/nwfilter/ @@ -1688,7 +1665,7 @@ exit 0 %config(noreplace) %{_sysconfdir}/libvirt/qemu.conf %config(noreplace) %{_sysconfdir}/libvirt/qemu-lockd.conf %config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd.qemu -%ghost %dir %attr(0700, root, root) %{_localstatedir}/run/libvirt/qemu/ +%ghost %dir %{_localstatedir}/run/libvirt/qemu/ %dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/ %dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/cache/libvirt/qemu/ %{_datadir}/augeas/lenses/libvirtd_qemu.aug @@ -1760,7 +1737,7 @@ exit 0 %attr(0755, root, root) %{_libdir}/libvirt/lock-driver/sanlock.so %{_datadir}/augeas/lenses/libvirt_sanlock.aug %{_datadir}/augeas/lenses/tests/test_libvirt_sanlock.aug -%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/sanlock +%dir %attr(0770, root, sanlock) %{_localstatedir}/lib/libvirt/sanlock %{_sbindir}/virt-sanlock-cleanup %{_mandir}/man8/virt-sanlock-cleanup.8* %attr(0755, root, root) %{_libexecdir}/libvirt_sanlock_helper @@ -1893,6 +1870,9 @@ exit 0 %changelog +* Wed Jun 12 2019 Daniel P. Berrangé - 5.4.0-1 +- Update to 5.4.0 release + * Tue May 21 2019 Daniel P. Berrangé - 5.3.0-3 - Fix systemd socket permissions - Resolves: rhbz #1712498 (CVE-2019-10132) diff --git a/sources b/sources index 99d3cdf..c4025da 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (libvirt-5.3.0.tar.xz) = de3888d448463ff1d981e8dcf1aaed39c8215c368d133ed03b8cc5d7e05a77d385287d388d9db109df21df9bf348a14e7c654ca509d41addaadaa199d16b162e +SHA512 (libvirt-5.4.0.tar.xz) = 03fa932d041d147cab79eab200bb33f8db72579be72ec7cbff3305f4a8d574835a80f1b99936eddf67f83d21cc5567f45c86e555209de6cd702f43f91197cfd0