From 30cdfb8caee1d792a33f876b793d9a4aec00a2a6430fd997e9dff41dc0d5c0a3 Mon Sep 17 00:00:00 2001 From: James Fehlig Date: Mon, 20 May 2019 22:23:44 +0000 Subject: [PATCH] Accepting request 704322 from home:jfehlig:branches:Virtualization libvirt side of Intel Group 4 mitigations. - cpu_map: add cpu feature md-clear. CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091 5cd9db3a-cputest-add-data-E3-1225-v5.patch, 538d8735-cpu_map-Define-md-clear-CPUID-bit.patch bsc#1111331, bsc#1135273 OBS-URL: https://build.opensuse.org/request/show/704322 OBS-URL: https://build.opensuse.org/package/show/Virtualization/libvirt?expand=0&rev=754 --- ...35-cpu_map-Define-md-clear-CPUID-bit.patch | 102 +++ 5cd9db3a-cputest-add-data-E3-1225-v5.patch | 847 ++++++++++++++++++ libvirt.changes | 9 + libvirt.spec | 4 + 4 files changed, 962 insertions(+) create mode 100644 538d8735-cpu_map-Define-md-clear-CPUID-bit.patch create mode 100644 5cd9db3a-cputest-add-data-E3-1225-v5.patch diff --git a/538d8735-cpu_map-Define-md-clear-CPUID-bit.patch b/538d8735-cpu_map-Define-md-clear-CPUID-bit.patch new file mode 100644 index 0000000..e0c21ed --- /dev/null +++ b/538d8735-cpu_map-Define-md-clear-CPUID-bit.patch @@ -0,0 +1,102 @@ +commit 538d873571d7a682852dc1d70e5f4478f4d64e85 +Author: Jiri Denemark +Date: Fri Apr 5 15:11:20 2019 +0200 + + cpu_map: Define md-clear CPUID bit + + CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091 + + The bit is set when microcode provides the mechanism to invoke a flush + of various exploitable CPU buffers by invoking the VERW instruction. + + Signed-off-by: Paolo Bonzini + Signed-off-by: Jiri Denemark + Reviewed-by: Daniel P. Berrangé + +Index: libvirt-5.3.0/src/cpu_map/x86_features.xml +=================================================================== +--- libvirt-5.3.0.orig/src/cpu_map/x86_features.xml ++++ libvirt-5.3.0/src/cpu_map/x86_features.xml +@@ -320,6 +320,9 @@ + + + ++ ++ ++ + + + +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml +=================================================================== +--- libvirt-5.3.0.orig/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml +@@ -2,7 +2,7 @@ + + + +- ++ + + + +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml +=================================================================== +--- libvirt-5.3.0.orig/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml +@@ -20,6 +20,7 @@ + + + ++ + + + +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml +=================================================================== +--- libvirt-5.3.0.orig/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml +@@ -21,6 +21,7 @@ + + + ++ + + + +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml +=================================================================== +--- libvirt-5.3.0.orig/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml +@@ -5,6 +5,7 @@ + + + ++ + + + +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml +=================================================================== +--- libvirt-5.3.0.orig/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml +@@ -23,6 +23,7 @@ + + + ++ + + + +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml +=================================================================== +--- libvirt-5.3.0.orig/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml +@@ -24,6 +24,7 @@ + + + ++ + + + diff --git a/5cd9db3a-cputest-add-data-E3-1225-v5.patch b/5cd9db3a-cputest-add-data-E3-1225-v5.patch new file mode 100644 index 0000000..d3a3884 --- /dev/null +++ b/5cd9db3a-cputest-add-data-E3-1225-v5.patch @@ -0,0 +1,847 @@ +commit 5cd9db3ac11e88846cbcf95fad9f6fae9d880dee +Author: Jiri Denemark +Date: Fri Apr 5 11:19:30 2019 +0200 + + cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 + + Signed-off-by: Jiri Denemark + Reviewed-by: Daniel P. Berrangé + +Index: libvirt-5.3.0/tests/cputest.c +=================================================================== +--- libvirt-5.3.0.orig/tests/cputest.c ++++ libvirt-5.3.0/tests/cputest.c +@@ -1272,6 +1272,7 @@ mymain(void) + DO_TEST_CPUID(VIR_ARCH_X86_64, "Phenom-B95", JSON_HOST); + DO_TEST_CPUID(VIR_ARCH_X86_64, "Ryzen-7-1800X-Eight-Core", JSON_HOST); + DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-5110", JSON_NONE); ++ DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1225-v5", JSON_MODELS); + DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1245-v5", JSON_MODELS); + DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2609-v3", JSON_MODELS); + DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2623-v4", JSON_MODELS); +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml +=================================================================== +--- /dev/null ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml +@@ -0,0 +1,7 @@ ++ ++ ++ ++ ++ ++ ++ +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml +=================================================================== +--- /dev/null ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml +@@ -0,0 +1,8 @@ ++ ++ ++ ++ ++ ++ ++ ++ +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml +=================================================================== +--- /dev/null ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml +@@ -0,0 +1,28 @@ ++ ++ Skylake-Client-IBRS ++ Intel ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml +=================================================================== +--- /dev/null ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml +@@ -0,0 +1,29 @@ ++ ++ x86_64 ++ Skylake-Client-IBRS ++ Intel ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml +=================================================================== +--- /dev/null ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml +@@ -0,0 +1,11 @@ ++ ++ Skylake-Client-IBRS ++ Intel ++ ++ ++ ++ ++ ++ ++ ++ +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json +=================================================================== +--- /dev/null ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json +@@ -0,0 +1,652 @@ ++{ ++ "return": { ++ "model": { ++ "name": "base", ++ "props": { ++ "phys-bits": 0, ++ "core-id": -1, ++ "xlevel": 2147483656, ++ "cmov": true, ++ "ia64": false, ++ "aes": true, ++ "mmx": true, ++ "rdpid": false, ++ "arat": true, ++ "gfni": false, ++ "pause-filter": false, ++ "xsavec": true, ++ "intel-pt": false, ++ "osxsave": false, ++ "hv-frequencies": false, ++ "tsc-frequency": 0, ++ "xd": true, ++ "hv-vendor-id": "", ++ "kvm-asyncpf": true, ++ "kvm_asyncpf": true, ++ "perfctr_core": false, ++ "perfctr-core": false, ++ "mpx": true, ++ "pbe": false, ++ "decodeassists": false, ++ "avx512cd": false, ++ "sse4_1": true, ++ "sse4.1": true, ++ "sse4-1": true, ++ "family": 6, ++ "legacy-cache": true, ++ "vmware-cpuid-freq": true, ++ "avx512f": false, ++ "msr": true, ++ "mce": true, ++ "mca": true, ++ "hv-runtime": false, ++ "xcrypt": false, ++ "thread-id": -1, ++ "min-level": 13, ++ "xgetbv1": true, ++ "cid": false, ++ "hv-relaxed": false, ++ "hv-crash": false, ++ "ds": false, ++ "fxsr": true, ++ "xsaveopt": true, ++ "xtpr": false, ++ "avx512vl": false, ++ "avx512-vpopcntdq": false, ++ "phe": false, ++ "extapic": false, ++ "3dnowprefetch": true, ++ "avx512vbmi2": false, ++ "cr8legacy": false, ++ "stibp": true, ++ "cpuid-0xb": true, ++ "xcrypt-en": false, ++ "kvm_pv_eoi": true, ++ "apic-id": 4294967295, ++ "pn": false, ++ "dca": false, ++ "vendor": "GenuineIntel", ++ "pku": false, ++ "smx": false, ++ "cmp_legacy": false, ++ "cmp-legacy": false, ++ "node-id": -1, ++ "avx512-4fmaps": false, ++ "vmcb_clean": false, ++ "vmcb-clean": false, ++ "3dnowext": false, ++ "hle": true, ++ "npt": false, ++ "memory": "/machine/unattached/system[0]", ++ "clwb": false, ++ "lbrv": false, ++ "adx": true, ++ "ss": true, ++ "pni": true, ++ "svm_lock": false, ++ "svm-lock": false, ++ "pfthreshold": false, ++ "smep": true, ++ "smap": true, ++ "x2apic": true, ++ "avx512vbmi": false, ++ "avx512vnni": false, ++ "hv-stimer": false, ++ "i64": true, ++ "flushbyasid": false, ++ "f16c": true, ++ "ace2-en": false, ++ "pat": true, ++ "pae": true, ++ "sse": true, ++ "phe-en": false, ++ "kvm_nopiodelay": true, ++ "kvm-nopiodelay": true, ++ "tm": false, ++ "kvmclock-stable-bit": true, ++ "hypervisor": true, ++ "socket-id": -1, ++ "pcommit": false, ++ "syscall": true, ++ "level": 13, ++ "avx512dq": false, ++ "svm": false, ++ "full-cpuid-auto-level": true, ++ "hv-reset": false, ++ "invtsc": false, ++ "sse3": true, ++ "sse2": true, ++ "ssbd": true, ++ "est": false, ++ "avx512ifma": false, ++ "tm2": false, ++ "kvm-pv-eoi": true, ++ "cx8": true, ++ "kvm_mmu": false, ++ "kvm-mmu": false, ++ "sse4_2": true, ++ "sse4.2": true, ++ "sse4-2": true, ++ "pge": true, ++ "fill-mtrr-mask": true, ++ "avx512bitalg": false, ++ "nodeid_msr": false, ++ "pdcm": false, ++ "movbe": true, ++ "model": 94, ++ "nrip_save": false, ++ "nrip-save": false, ++ "kvm_pv_unhalt": true, ++ "ssse3": true, ++ "sse4a": false, ++ "invpcid": true, ++ "pdpe1gb": true, ++ "tsc-deadline": true, ++ "fma": true, ++ "cx16": true, ++ "de": true, ++ "enforce": false, ++ "stepping": 3, ++ "xsave": true, ++ "clflush": true, ++ "skinit": false, ++ "tsc": true, ++ "tce": false, ++ "fpu": true, ++ "ibs": false, ++ "ds_cpl": false, ++ "ds-cpl": false, ++ "host-phys-bits": true, ++ "fma4": false, ++ "la57": false, ++ "osvw": false, ++ "check": true, ++ "hv-spinlocks": -1, ++ "pmu": false, ++ "pmm": false, ++ "apic": true, ++ "spec-ctrl": true, ++ "min-xlevel2": 0, ++ "tsc-adjust": true, ++ "tsc_adjust": true, ++ "kvm-steal-time": true, ++ "kvm_steal_time": true, ++ "kvmclock": true, ++ "l3-cache": true, ++ "lwp": false, ++ "ibpb": false, ++ "xop": false, ++ "avx": true, ++ "ospke": false, ++ "ace2": false, ++ "avx512bw": false, ++ "acpi": false, ++ "hv-vapic": false, ++ "fsgsbase": true, ++ "ht": false, ++ "nx": true, ++ "pclmulqdq": true, ++ "mmxext": false, ++ "vaes": false, ++ "popcnt": true, ++ "xsaves": false, ++ "tcg-cpuid": true, ++ "lm": true, ++ "umip": false, ++ "pse": true, ++ "avx2": true, ++ "sep": true, ++ "pclmuldq": true, ++ "virt-ssbd": false, ++ "x-hv-max-vps": -1, ++ "nodeid-msr": false, ++ "md-clear": true, ++ "kvm": true, ++ "misalignsse": false, ++ "min-xlevel": 2147483656, ++ "kvm-pv-unhalt": true, ++ "bmi2": true, ++ "bmi1": true, ++ "realized": false, ++ "tsc_scale": false, ++ "tsc-scale": false, ++ "topoext": false, ++ "hv-vpindex": false, ++ "xlevel2": 0, ++ "clflushopt": true, ++ "kvm-no-smi-migration": false, ++ "monitor": false, ++ "avx512er": false, ++ "pmm-en": false, ++ "pcid": true, ++ "3dnow": false, ++ "erms": true, ++ "lahf-lm": true, ++ "lahf_lm": true, ++ "vpclmulqdq": false, ++ "fxsr-opt": false, ++ "hv-synic": false, ++ "xstore": false, ++ "fxsr_opt": false, ++ "kvm-hint-dedicated": false, ++ "rtm": true, ++ "lmce": true, ++ "hv-time": false, ++ "perfctr-nb": false, ++ "perfctr_nb": false, ++ "ffxsr": false, ++ "rdrand": true, ++ "rdseed": true, ++ "avx512-4vnniw": false, ++ "vmx": false, ++ "vme": true, ++ "dtes64": false, ++ "mtrr": true, ++ "rdtscp": true, ++ "pse36": true, ++ "kvm-pv-tlb-flush": false, ++ "tbm": false, ++ "wdt": false, ++ "pause_filter": false, ++ "sha-ni": false, ++ "model-id": "Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz", ++ "abm": true, ++ "avx512pf": false, ++ "xstore-en": false ++ } ++ } ++ }, ++ "id": "model-expansion" ++} ++ ++{ ++ "return": [ ++ { ++ "name": "max", ++ "typename": "max-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": false ++ }, ++ { ++ "name": "host", ++ "typename": "host-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": false ++ }, ++ { ++ "name": "base", ++ "typename": "base-x86_64-cpu", ++ "unavailable-features": [], ++ "static": true, ++ "migration-safe": true ++ }, ++ { ++ "name": "qemu64", ++ "typename": "qemu64-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "qemu32", ++ "typename": "qemu32-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "phenom", ++ "typename": "phenom-x86_64-cpu", ++ "unavailable-features": [ ++ "mmxext", ++ "fxsr-opt", ++ "3dnowext", ++ "3dnow", ++ "sse4a", ++ "npt" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "pentium3", ++ "typename": "pentium3-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "pentium2", ++ "typename": "pentium2-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "pentium", ++ "typename": "pentium-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "n270", ++ "typename": "n270-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "kvm64", ++ "typename": "kvm64-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "kvm32", ++ "typename": "kvm32-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "cpu64-rhel6", ++ "typename": "cpu64-rhel6-x86_64-cpu", ++ "unavailable-features": [ ++ "sse4a" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "coreduo", ++ "typename": "coreduo-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "core2duo", ++ "typename": "core2duo-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "athlon", ++ "typename": "athlon-x86_64-cpu", ++ "unavailable-features": [ ++ "mmxext", ++ "3dnowext", ++ "3dnow" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Westmere", ++ "typename": "Westmere-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Westmere-IBRS", ++ "typename": "Westmere-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Skylake-Server", ++ "typename": "Skylake-Server-x86_64-cpu", ++ "unavailable-features": [ ++ "avx512f", ++ "avx512dq", ++ "clwb", ++ "avx512cd", ++ "avx512bw", ++ "avx512vl", ++ "avx512f", ++ "avx512f", ++ "avx512f" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Skylake-Server-IBRS", ++ "typename": "Skylake-Server-IBRS-x86_64-cpu", ++ "unavailable-features": [ ++ "avx512f", ++ "avx512dq", ++ "clwb", ++ "avx512cd", ++ "avx512bw", ++ "avx512vl", ++ "avx512f", ++ "avx512f", ++ "avx512f" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Skylake-Client", ++ "typename": "Skylake-Client-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Skylake-Client-IBRS", ++ "typename": "Skylake-Client-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "SandyBridge", ++ "typename": "SandyBridge-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "SandyBridge-IBRS", ++ "typename": "SandyBridge-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Penryn", ++ "typename": "Penryn-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Opteron_G5", ++ "typename": "Opteron_G5-x86_64-cpu", ++ "unavailable-features": [ ++ "sse4a", ++ "misalignsse", ++ "xop", ++ "fma4", ++ "tbm" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Opteron_G4", ++ "typename": "Opteron_G4-x86_64-cpu", ++ "unavailable-features": [ ++ "sse4a", ++ "misalignsse", ++ "xop", ++ "fma4" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Opteron_G3", ++ "typename": "Opteron_G3-x86_64-cpu", ++ "unavailable-features": [ ++ "sse4a", ++ "misalignsse" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Opteron_G2", ++ "typename": "Opteron_G2-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Opteron_G1", ++ "typename": "Opteron_G1-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Nehalem", ++ "typename": "Nehalem-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Nehalem-IBRS", ++ "typename": "Nehalem-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "IvyBridge", ++ "typename": "IvyBridge-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "IvyBridge-IBRS", ++ "typename": "IvyBridge-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Haswell", ++ "typename": "Haswell-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Haswell-noTSX", ++ "typename": "Haswell-noTSX-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Haswell-noTSX-IBRS", ++ "typename": "Haswell-noTSX-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Haswell-IBRS", ++ "typename": "Haswell-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "EPYC", ++ "typename": "EPYC-x86_64-cpu", ++ "unavailable-features": [ ++ "sha-ni", ++ "mmxext", ++ "fxsr-opt", ++ "cr8legacy", ++ "sse4a", ++ "misalignsse", ++ "osvw" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "EPYC-IBPB", ++ "typename": "EPYC-IBPB-x86_64-cpu", ++ "unavailable-features": [ ++ "sha-ni", ++ "mmxext", ++ "fxsr-opt", ++ "cr8legacy", ++ "sse4a", ++ "misalignsse", ++ "osvw", ++ "ibpb" ++ ], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Conroe", ++ "typename": "Conroe-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Broadwell", ++ "typename": "Broadwell-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Broadwell-noTSX", ++ "typename": "Broadwell-noTSX-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Broadwell-noTSX-IBRS", ++ "typename": "Broadwell-noTSX-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "Broadwell-IBRS", ++ "typename": "Broadwell-IBRS-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ }, ++ { ++ "name": "486", ++ "typename": "486-x86_64-cpu", ++ "unavailable-features": [], ++ "static": false, ++ "migration-safe": true ++ } ++ ], ++ "id": "definitions" ++} +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig +=================================================================== +--- /dev/null ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig +@@ -0,0 +1,4 @@ ++0506e3 ++family: 6 (0x06) ++model: 94 (0x5e) ++stepping: 3 (0x03) +Index: libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml +=================================================================== +--- /dev/null ++++ libvirt-5.3.0/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml +@@ -0,0 +1,47 @@ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ ++ diff --git a/libvirt.changes b/libvirt.changes index 686413e..bff1a46 100644 --- a/libvirt.changes +++ b/libvirt.changes @@ -1,3 +1,12 @@ +------------------------------------------------------------------- +Mon May 20 21:50:28 UTC 2019 - James Fehlig + +- cpu_map: add cpu feature md-clear. CVE-2018-12126, + CVE-2018-12127, CVE-2018-12130, CVE-2019-11091 + 5cd9db3a-cputest-add-data-E3-1225-v5.patch, + 538d8735-cpu_map-Define-md-clear-CPUID-bit.patch + bsc#1111331, bsc#1135273 + ------------------------------------------------------------------- Wed May 8 17:03:43 UTC 2019 - James Fehlig diff --git a/libvirt.spec b/libvirt.spec index 671fcb3..970be91 100644 --- a/libvirt.spec +++ b/libvirt.spec @@ -337,6 +337,8 @@ Source6: libvirtd-relocation-server.xml Source99: baselibs.conf Source100: %{name}-rpmlintrc # Upstream patches +Patch0: 5cd9db3a-cputest-add-data-E3-1225-v5.patch +Patch1: 538d8735-cpu_map-Define-md-clear-CPUID-bit.patch # Patches pending upstream review Patch100: libxl-dom-reset.patch Patch101: network-don-t-use-dhcp-authoritative-on-static-netwo.patch @@ -870,6 +872,8 @@ libvirt plugin for NSS for translating domain names into IP addresses. %prep %setup -q +%patch0 -p1 +%patch1 -p1 %patch100 -p1 %patch101 -p1 %patch150 -p1