summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--recipes-extended/libvirt/libvirt/0001-cpu_x86-Do-not-cache-microcode-version.patch59
-rw-r--r--recipes-extended/libvirt/libvirt/0002-qemu-Don-t-cache-microcode-version.patch155
-rw-r--r--recipes-extended/libvirt/libvirt/CVE-2018-12126_CVE-2018-12127_CVE-2018-12130_CVE-2019-11091_p1.patch894
-rw-r--r--recipes-extended/libvirt/libvirt/CVE-2018-12126_CVE-2018-12127_CVE-2018-12130_CVE-2019-11091_p2.patch116
-rw-r--r--recipes-extended/libvirt/libvirt/CVE-2019-10132_p1.patch63
-rw-r--r--recipes-extended/libvirt/libvirt/CVE-2019-10132_p2.patch56
-rw-r--r--recipes-extended/libvirt/libvirt/CVE-2019-10132_p3.patch56
-rw-r--r--recipes-extended/libvirt/libvirt/CVE-2019-10161.patch99
-rw-r--r--recipes-extended/libvirt/libvirt/CVE-2019-10166.patch43
-rw-r--r--recipes-extended/libvirt/libvirt/CVE-2019-10167.patch41
-rw-r--r--recipes-extended/libvirt/libvirt/CVE-2019-10168.patch49
-rw-r--r--recipes-extended/libvirt/libvirt_4.7.0.bb11
12 files changed, 1642 insertions, 0 deletions
diff --git a/recipes-extended/libvirt/libvirt/0001-cpu_x86-Do-not-cache-microcode-version.patch b/recipes-extended/libvirt/libvirt/0001-cpu_x86-Do-not-cache-microcode-version.patch
new file mode 100644
index 00000000..4413d5fb
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/0001-cpu_x86-Do-not-cache-microcode-version.patch
@@ -0,0 +1,59 @@
1From 33998cdd47300fc3ca6cb8f85714c149440b9c8b Mon Sep 17 00:00:00 2001
2From: Jiri Denemark <jdenemar@redhat.com>
3Date: Fri, 5 Apr 2019 11:33:32 +0200
4Subject: [PATCH 01/11] cpu_x86: Do not cache microcode version
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9The microcode version checks are used to invalidate cached CPU data we
10get from QEMU. To minimize /proc/cpuinfo parsing the microcode version
11was only read when libvirtd started and cached for the daemon's
12lifetime. However, the CPU microcode can change anytime (updating the
13microcode package can automatically upload it to the CPU) and we need to
14stop caching it to avoid using stale CPU model data.
15
16Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
17Reviewed-by: Ján Tomko <jtomko@redhat.com>
18(cherry picked from commit be46f613261d3b655a1f15afd635087e68a9c39b)
19
20Upstream-Status: Backport
21Signed-off-by: Armin Kuster <akuster@mvista.com>
22
23---
24 src/cpu/cpu_x86.c | 5 +----
25 1 file changed, 1 insertion(+), 4 deletions(-)
26
27diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c
28index cb27550..ce48ca6 100644
29--- a/src/cpu/cpu_x86.c
30+++ b/src/cpu/cpu_x86.c
31@@ -163,7 +163,6 @@ struct _virCPUx86Map {
32 };
33
34 static virCPUx86MapPtr cpuMap;
35-static unsigned int microcodeVersion;
36
37 int virCPUx86DriverOnceInit(void);
38 VIR_ONCE_GLOBAL_INIT(virCPUx86Driver);
39@@ -1331,8 +1330,6 @@ virCPUx86DriverOnceInit(void)
40 if (!(cpuMap = virCPUx86LoadMap()))
41 return -1;
42
43- microcodeVersion = virHostCPUGetMicrocodeVersion();
44-
45 return 0;
46 }
47
48@@ -2372,7 +2369,7 @@ virCPUx86GetHost(virCPUDefPtr cpu,
49 goto cleanup;
50
51 ret = x86DecodeCPUData(cpu, cpuData, models);
52- cpu->microcodeVersion = microcodeVersion;
53+ cpu->microcodeVersion = virHostCPUGetMicrocodeVersion();
54
55 cleanup:
56 virCPUx86DataFree(cpuData);
57--
582.7.4
59
diff --git a/recipes-extended/libvirt/libvirt/0002-qemu-Don-t-cache-microcode-version.patch b/recipes-extended/libvirt/libvirt/0002-qemu-Don-t-cache-microcode-version.patch
new file mode 100644
index 00000000..6d0f2986
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/0002-qemu-Don-t-cache-microcode-version.patch
@@ -0,0 +1,155 @@
1From d606ac113007901522dab6c4b3979686d43eaa87 Mon Sep 17 00:00:00 2001
2From: Jiri Denemark <jdenemar@redhat.com>
3Date: Fri, 12 Apr 2019 21:21:05 +0200
4Subject: [PATCH 02/11] qemu: Don't cache microcode version
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9My earlier commit be46f61326 was incomplete. It removed caching of
10microcode version in the CPU driver, which means the capabilities XML
11will see the correct microcode version. But it is also cached in the
12QEMU capabilities cache where it is used to detect whether we need to
13reprobe QEMU. By missing the second place, the original commit
14be46f61326 made the situation even worse since libvirt would report
15correct microcode version while still using the old host CPU model
16(visible in domain capabilities XML).
17
18Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
19Reviewed-by: Ján Tomko <jtomko@redhat.com>
20(cherry picked from commit 673c62a3b7855a0685d8f116e227c402720b9ee9)
21
22Conflicts:
23 src/qemu/qemu_capabilities.c
24 - virQEMUCapsCacheLookupByArch refactoring (commits
25 7948ad4129a and 1a3de67001c) are missing
26
27Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
28
29Upstream-Status: Backport
30Signed-off-by: Armin Kuster <akuster@mvista.com>
31
32---
33 src/qemu/qemu_capabilities.c | 12 ++++++++----
34 src/qemu/qemu_capabilities.h | 3 +--
35 src/qemu/qemu_driver.c | 9 +--------
36 tests/testutilsqemu.c | 2 +-
37 4 files changed, 11 insertions(+), 15 deletions(-)
38
39diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
40index a075677..eaf369f 100644
41--- a/src/qemu/qemu_capabilities.c
42+++ b/src/qemu/qemu_capabilities.c
43@@ -4700,7 +4700,7 @@ virQEMUCapsNewData(const char *binary,
44 priv->libDir,
45 priv->runUid,
46 priv->runGid,
47- priv->microcodeVersion,
48+ virHostCPUGetMicrocodeVersion(),
49 priv->kernelVersion);
50 }
51
52@@ -4783,8 +4783,7 @@ virFileCachePtr
53 virQEMUCapsCacheNew(const char *libDir,
54 const char *cacheDir,
55 uid_t runUid,
56- gid_t runGid,
57- unsigned int microcodeVersion)
58+ gid_t runGid)
59 {
60 char *capsCacheDir = NULL;
61 virFileCachePtr cache = NULL;
62@@ -4808,7 +4807,6 @@ virQEMUCapsCacheNew(const char *libDir,
63
64 priv->runUid = runUid;
65 priv->runGid = runGid;
66- priv->microcodeVersion = microcodeVersion;
67
68 if (uname(&uts) == 0 &&
69 virAsprintf(&priv->kernelVersion, "%s %s", uts.release, uts.version) < 0)
70@@ -4829,8 +4827,11 @@ virQEMUCapsPtr
71 virQEMUCapsCacheLookup(virFileCachePtr cache,
72 const char *binary)
73 {
74+ virQEMUCapsCachePrivPtr priv = virFileCacheGetPriv(cache);
75 virQEMUCapsPtr ret = NULL;
76
77+ priv->microcodeVersion = virHostCPUGetMicrocodeVersion();
78+
79 ret = virFileCacheLookup(cache, binary);
80
81 VIR_DEBUG("Returning caps %p for %s", ret, binary);
82@@ -4876,10 +4877,13 @@ virQEMUCapsPtr
83 virQEMUCapsCacheLookupByArch(virFileCachePtr cache,
84 virArch arch)
85 {
86+ virQEMUCapsCachePrivPtr priv = virFileCacheGetPriv(cache);
87 virQEMUCapsPtr ret = NULL;
88 virArch target;
89 struct virQEMUCapsSearchData data = { .arch = arch };
90
91+ priv->microcodeVersion = virHostCPUGetMicrocodeVersion();
92+
93 ret = virFileCacheLookupByFunc(cache, virQEMUCapsCompareArch, &data);
94 if (!ret) {
95 /* If the first attempt at finding capabilities has failed, try
96diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
97index 3d3a978..956babc 100644
98--- a/src/qemu/qemu_capabilities.h
99+++ b/src/qemu/qemu_capabilities.h
100@@ -574,8 +574,7 @@ void virQEMUCapsFilterByMachineType(virQEMUCapsPtr qemuCaps,
101 virFileCachePtr virQEMUCapsCacheNew(const char *libDir,
102 const char *cacheDir,
103 uid_t uid,
104- gid_t gid,
105- unsigned int microcodeVersion);
106+ gid_t gid);
107 virQEMUCapsPtr virQEMUCapsCacheLookup(virFileCachePtr cache,
108 const char *binary);
109 virQEMUCapsPtr virQEMUCapsCacheLookupCopy(virFileCachePtr cache,
110diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
111index a0f7c71..75f8699 100644
112--- a/src/qemu/qemu_driver.c
113+++ b/src/qemu/qemu_driver.c
114@@ -592,8 +592,6 @@ qemuStateInitialize(bool privileged,
115 char *hugepagePath = NULL;
116 char *memoryBackingPath = NULL;
117 size_t i;
118- virCPUDefPtr hostCPU = NULL;
119- unsigned int microcodeVersion = 0;
120
121 if (VIR_ALLOC(qemu_driver) < 0)
122 return -1;
123@@ -813,15 +811,10 @@ qemuStateInitialize(bool privileged,
124 run_gid = cfg->group;
125 }
126
127- if ((hostCPU = virCPUProbeHost(virArchFromHost())))
128- microcodeVersion = hostCPU->microcodeVersion;
129- virCPUDefFree(hostCPU);
130-
131 qemu_driver->qemuCapsCache = virQEMUCapsCacheNew(cfg->libDir,
132 cfg->cacheDir,
133 run_uid,
134- run_gid,
135- microcodeVersion);
136+ run_gid);
137 if (!qemu_driver->qemuCapsCache)
138 goto error;
139
140diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c
141index 8438613..4e53f03 100644
142--- a/tests/testutilsqemu.c
143+++ b/tests/testutilsqemu.c
144@@ -707,7 +707,7 @@ int qemuTestDriverInit(virQEMUDriver *driver)
145
146 /* Using /dev/null for libDir and cacheDir automatically produces errors
147 * upon attempt to use any of them */
148- driver->qemuCapsCache = virQEMUCapsCacheNew("/dev/null", "/dev/null", 0, 0, 0);
149+ driver->qemuCapsCache = virQEMUCapsCacheNew("/dev/null", "/dev/null", 0, 0);
150 if (!driver->qemuCapsCache)
151 goto error;
152
153--
1542.7.4
155
diff --git a/recipes-extended/libvirt/libvirt/CVE-2018-12126_CVE-2018-12127_CVE-2018-12130_CVE-2019-11091_p1.patch b/recipes-extended/libvirt/libvirt/CVE-2018-12126_CVE-2018-12127_CVE-2018-12130_CVE-2019-11091_p1.patch
new file mode 100644
index 00000000..45f51d4a
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2018-12126_CVE-2018-12127_CVE-2018-12130_CVE-2019-11091_p1.patch
@@ -0,0 +1,894 @@
1From b15a3c9f9bd24d12082b5a6ea505eb3ea48137cb Mon Sep 17 00:00:00 2001
2From: Jiri Denemark <jdenemar@redhat.com>
3Date: Fri, 5 Apr 2019 11:19:30 +0200
4Subject: [PATCH 03/11] cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
10(cherry picked from commit 5cd9db3ac11e88846cbcf95fad9f6fae9d880dee)
11
12CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
13
14Conflicts:
15 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
16 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
17 - intel-pt feature is missing
18 - stibp feature is missing
19
20Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
21
22Upstream-Status: Backport
23
24CVE: CVE-2018-12126
25CVE: CVE-2018-12127
26CVE: CVE-2018-12130
27CVE: CVE-2019-11091
28
29Signed-off-by: Armin Kuster <akuster@mvista.com>
30
31---
32 tests/cputest.c | 1 +
33 .../x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml | 7 +
34 .../x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 8 +
35 .../x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 26 +
36 .../x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 27 +
37 .../x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 10 +
38 .../cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json | 652 +++++++++++++++++++++
39 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig | 4 +
40 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml | 47 ++
41 9 files changed, 782 insertions(+)
42 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
43 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
44 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
45 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
46 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
47 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
48 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
49 create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
50
51diff --git a/tests/cputest.c b/tests/cputest.c
52index baf2b3c..fbb2a86 100644
53--- a/tests/cputest.c
54+++ b/tests/cputest.c
55@@ -1190,6 +1190,7 @@ mymain(void)
56 DO_TEST_CPUID(VIR_ARCH_X86_64, "Phenom-B95", JSON_HOST);
57 DO_TEST_CPUID(VIR_ARCH_X86_64, "Ryzen-7-1800X-Eight-Core", JSON_HOST);
58 DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-5110", JSON_NONE);
59+ DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1225-v5", JSON_MODELS);
60 DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1245-v5", JSON_MODELS);
61 DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2609-v3", JSON_MODELS);
62 DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2623-v4", JSON_MODELS);
63diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
64new file mode 100644
65index 0000000..ce51903
66--- /dev/null
67+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
68@@ -0,0 +1,7 @@
69+<!-- Features disabled by QEMU -->
70+<cpudata arch='x86'>
71+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1fc' edx='0xb0600000'/>
72+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x00000000' edx='0x00000000'/>
73+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000008' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
74+ <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
75+</cpudata>
76diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
77new file mode 100644
78index 0000000..0deca9f
79--- /dev/null
80+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
81@@ -0,0 +1,8 @@
82+<!-- Features enabled by QEMU -->
83+<cpudata arch='x86'>
84+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0xf7fa3203' edx='0x0f8bfbff'/>
85+ <cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x00000004' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
86+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000000'/>
87+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000007' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
88+ <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
89+</cpudata>
90diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
91new file mode 100644
92index 0000000..993db80
93--- /dev/null
94+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
95@@ -0,0 +1,26 @@
96+<cpu mode='custom' match='exact'>
97+ <model fallback='forbid'>Skylake-Client-IBRS</model>
98+ <vendor>Intel</vendor>
99+ <feature policy='require' name='ds'/>
100+ <feature policy='require' name='acpi'/>
101+ <feature policy='require' name='ss'/>
102+ <feature policy='require' name='ht'/>
103+ <feature policy='require' name='tm'/>
104+ <feature policy='require' name='pbe'/>
105+ <feature policy='require' name='dtes64'/>
106+ <feature policy='require' name='monitor'/>
107+ <feature policy='require' name='ds_cpl'/>
108+ <feature policy='require' name='vmx'/>
109+ <feature policy='require' name='smx'/>
110+ <feature policy='require' name='est'/>
111+ <feature policy='require' name='tm2'/>
112+ <feature policy='require' name='xtpr'/>
113+ <feature policy='require' name='pdcm'/>
114+ <feature policy='require' name='osxsave'/>
115+ <feature policy='require' name='tsc_adjust'/>
116+ <feature policy='require' name='clflushopt'/>
117+ <feature policy='require' name='ssbd'/>
118+ <feature policy='require' name='xsaves'/>
119+ <feature policy='require' name='pdpe1gb'/>
120+ <feature policy='require' name='invtsc'/>
121+</cpu>
122diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
123new file mode 100644
124index 0000000..074a39b
125--- /dev/null
126+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
127@@ -0,0 +1,27 @@
128+<cpu>
129+ <arch>x86_64</arch>
130+ <model>Skylake-Client-IBRS</model>
131+ <vendor>Intel</vendor>
132+ <feature name='ds'/>
133+ <feature name='acpi'/>
134+ <feature name='ss'/>
135+ <feature name='ht'/>
136+ <feature name='tm'/>
137+ <feature name='pbe'/>
138+ <feature name='dtes64'/>
139+ <feature name='monitor'/>
140+ <feature name='ds_cpl'/>
141+ <feature name='vmx'/>
142+ <feature name='smx'/>
143+ <feature name='est'/>
144+ <feature name='tm2'/>
145+ <feature name='xtpr'/>
146+ <feature name='pdcm'/>
147+ <feature name='osxsave'/>
148+ <feature name='tsc_adjust'/>
149+ <feature name='clflushopt'/>
150+ <feature name='ssbd'/>
151+ <feature name='xsaves'/>
152+ <feature name='pdpe1gb'/>
153+ <feature name='invtsc'/>
154+</cpu>
155diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
156new file mode 100644
157index 0000000..1984bd4
158--- /dev/null
159+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
160@@ -0,0 +1,10 @@
161+<cpu mode='custom' match='exact'>
162+ <model fallback='forbid'>Skylake-Client-IBRS</model>
163+ <vendor>Intel</vendor>
164+ <feature policy='require' name='ss'/>
165+ <feature policy='require' name='hypervisor'/>
166+ <feature policy='require' name='tsc_adjust'/>
167+ <feature policy='require' name='clflushopt'/>
168+ <feature policy='require' name='ssbd'/>
169+ <feature policy='require' name='pdpe1gb'/>
170+</cpu>
171diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
172new file mode 100644
173index 0000000..0847475
174--- /dev/null
175+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
176@@ -0,0 +1,652 @@
177+{
178+ "return": {
179+ "model": {
180+ "name": "base",
181+ "props": {
182+ "phys-bits": 0,
183+ "core-id": -1,
184+ "xlevel": 2147483656,
185+ "cmov": true,
186+ "ia64": false,
187+ "aes": true,
188+ "mmx": true,
189+ "rdpid": false,
190+ "arat": true,
191+ "gfni": false,
192+ "pause-filter": false,
193+ "xsavec": true,
194+ "intel-pt": false,
195+ "osxsave": false,
196+ "hv-frequencies": false,
197+ "tsc-frequency": 0,
198+ "xd": true,
199+ "hv-vendor-id": "",
200+ "kvm-asyncpf": true,
201+ "kvm_asyncpf": true,
202+ "perfctr_core": false,
203+ "perfctr-core": false,
204+ "mpx": true,
205+ "pbe": false,
206+ "decodeassists": false,
207+ "avx512cd": false,
208+ "sse4_1": true,
209+ "sse4.1": true,
210+ "sse4-1": true,
211+ "family": 6,
212+ "legacy-cache": true,
213+ "vmware-cpuid-freq": true,
214+ "avx512f": false,
215+ "msr": true,
216+ "mce": true,
217+ "mca": true,
218+ "hv-runtime": false,
219+ "xcrypt": false,
220+ "thread-id": -1,
221+ "min-level": 13,
222+ "xgetbv1": true,
223+ "cid": false,
224+ "hv-relaxed": false,
225+ "hv-crash": false,
226+ "ds": false,
227+ "fxsr": true,
228+ "xsaveopt": true,
229+ "xtpr": false,
230+ "avx512vl": false,
231+ "avx512-vpopcntdq": false,
232+ "phe": false,
233+ "extapic": false,
234+ "3dnowprefetch": true,
235+ "avx512vbmi2": false,
236+ "cr8legacy": false,
237+ "stibp": true,
238+ "cpuid-0xb": true,
239+ "xcrypt-en": false,
240+ "kvm_pv_eoi": true,
241+ "apic-id": 4294967295,
242+ "pn": false,
243+ "dca": false,
244+ "vendor": "GenuineIntel",
245+ "pku": false,
246+ "smx": false,
247+ "cmp_legacy": false,
248+ "cmp-legacy": false,
249+ "node-id": -1,
250+ "avx512-4fmaps": false,
251+ "vmcb_clean": false,
252+ "vmcb-clean": false,
253+ "3dnowext": false,
254+ "hle": true,
255+ "npt": false,
256+ "memory": "/machine/unattached/system[0]",
257+ "clwb": false,
258+ "lbrv": false,
259+ "adx": true,
260+ "ss": true,
261+ "pni": true,
262+ "svm_lock": false,
263+ "svm-lock": false,
264+ "pfthreshold": false,
265+ "smep": true,
266+ "smap": true,
267+ "x2apic": true,
268+ "avx512vbmi": false,
269+ "avx512vnni": false,
270+ "hv-stimer": false,
271+ "i64": true,
272+ "flushbyasid": false,
273+ "f16c": true,
274+ "ace2-en": false,
275+ "pat": true,
276+ "pae": true,
277+ "sse": true,
278+ "phe-en": false,
279+ "kvm_nopiodelay": true,
280+ "kvm-nopiodelay": true,
281+ "tm": false,
282+ "kvmclock-stable-bit": true,
283+ "hypervisor": true,
284+ "socket-id": -1,
285+ "pcommit": false,
286+ "syscall": true,
287+ "level": 13,
288+ "avx512dq": false,
289+ "svm": false,
290+ "full-cpuid-auto-level": true,
291+ "hv-reset": false,
292+ "invtsc": false,
293+ "sse3": true,
294+ "sse2": true,
295+ "ssbd": true,
296+ "est": false,
297+ "avx512ifma": false,
298+ "tm2": false,
299+ "kvm-pv-eoi": true,
300+ "cx8": true,
301+ "kvm_mmu": false,
302+ "kvm-mmu": false,
303+ "sse4_2": true,
304+ "sse4.2": true,
305+ "sse4-2": true,
306+ "pge": true,
307+ "fill-mtrr-mask": true,
308+ "avx512bitalg": false,
309+ "nodeid_msr": false,
310+ "pdcm": false,
311+ "movbe": true,
312+ "model": 94,
313+ "nrip_save": false,
314+ "nrip-save": false,
315+ "kvm_pv_unhalt": true,
316+ "ssse3": true,
317+ "sse4a": false,
318+ "invpcid": true,
319+ "pdpe1gb": true,
320+ "tsc-deadline": true,
321+ "fma": true,
322+ "cx16": true,
323+ "de": true,
324+ "enforce": false,
325+ "stepping": 3,
326+ "xsave": true,
327+ "clflush": true,
328+ "skinit": false,
329+ "tsc": true,
330+ "tce": false,
331+ "fpu": true,
332+ "ibs": false,
333+ "ds_cpl": false,
334+ "ds-cpl": false,
335+ "host-phys-bits": true,
336+ "fma4": false,
337+ "la57": false,
338+ "osvw": false,
339+ "check": true,
340+ "hv-spinlocks": -1,
341+ "pmu": false,
342+ "pmm": false,
343+ "apic": true,
344+ "spec-ctrl": true,
345+ "min-xlevel2": 0,
346+ "tsc-adjust": true,
347+ "tsc_adjust": true,
348+ "kvm-steal-time": true,
349+ "kvm_steal_time": true,
350+ "kvmclock": true,
351+ "l3-cache": true,
352+ "lwp": false,
353+ "ibpb": false,
354+ "xop": false,
355+ "avx": true,
356+ "ospke": false,
357+ "ace2": false,
358+ "avx512bw": false,
359+ "acpi": false,
360+ "hv-vapic": false,
361+ "fsgsbase": true,
362+ "ht": false,
363+ "nx": true,
364+ "pclmulqdq": true,
365+ "mmxext": false,
366+ "vaes": false,
367+ "popcnt": true,
368+ "xsaves": false,
369+ "tcg-cpuid": true,
370+ "lm": true,
371+ "umip": false,
372+ "pse": true,
373+ "avx2": true,
374+ "sep": true,
375+ "pclmuldq": true,
376+ "virt-ssbd": false,
377+ "x-hv-max-vps": -1,
378+ "nodeid-msr": false,
379+ "md-clear": true,
380+ "kvm": true,
381+ "misalignsse": false,
382+ "min-xlevel": 2147483656,
383+ "kvm-pv-unhalt": true,
384+ "bmi2": true,
385+ "bmi1": true,
386+ "realized": false,
387+ "tsc_scale": false,
388+ "tsc-scale": false,
389+ "topoext": false,
390+ "hv-vpindex": false,
391+ "xlevel2": 0,
392+ "clflushopt": true,
393+ "kvm-no-smi-migration": false,
394+ "monitor": false,
395+ "avx512er": false,
396+ "pmm-en": false,
397+ "pcid": true,
398+ "3dnow": false,
399+ "erms": true,
400+ "lahf-lm": true,
401+ "lahf_lm": true,
402+ "vpclmulqdq": false,
403+ "fxsr-opt": false,
404+ "hv-synic": false,
405+ "xstore": false,
406+ "fxsr_opt": false,
407+ "kvm-hint-dedicated": false,
408+ "rtm": true,
409+ "lmce": true,
410+ "hv-time": false,
411+ "perfctr-nb": false,
412+ "perfctr_nb": false,
413+ "ffxsr": false,
414+ "rdrand": true,
415+ "rdseed": true,
416+ "avx512-4vnniw": false,
417+ "vmx": false,
418+ "vme": true,
419+ "dtes64": false,
420+ "mtrr": true,
421+ "rdtscp": true,
422+ "pse36": true,
423+ "kvm-pv-tlb-flush": false,
424+ "tbm": false,
425+ "wdt": false,
426+ "pause_filter": false,
427+ "sha-ni": false,
428+ "model-id": "Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz",
429+ "abm": true,
430+ "avx512pf": false,
431+ "xstore-en": false
432+ }
433+ }
434+ },
435+ "id": "model-expansion"
436+}
437+
438+{
439+ "return": [
440+ {
441+ "name": "max",
442+ "typename": "max-x86_64-cpu",
443+ "unavailable-features": [],
444+ "static": false,
445+ "migration-safe": false
446+ },
447+ {
448+ "name": "host",
449+ "typename": "host-x86_64-cpu",
450+ "unavailable-features": [],
451+ "static": false,
452+ "migration-safe": false
453+ },
454+ {
455+ "name": "base",
456+ "typename": "base-x86_64-cpu",
457+ "unavailable-features": [],
458+ "static": true,
459+ "migration-safe": true
460+ },
461+ {
462+ "name": "qemu64",
463+ "typename": "qemu64-x86_64-cpu",
464+ "unavailable-features": [],
465+ "static": false,
466+ "migration-safe": true
467+ },
468+ {
469+ "name": "qemu32",
470+ "typename": "qemu32-x86_64-cpu",
471+ "unavailable-features": [],
472+ "static": false,
473+ "migration-safe": true
474+ },
475+ {
476+ "name": "phenom",
477+ "typename": "phenom-x86_64-cpu",
478+ "unavailable-features": [
479+ "mmxext",
480+ "fxsr-opt",
481+ "3dnowext",
482+ "3dnow",
483+ "sse4a",
484+ "npt"
485+ ],
486+ "static": false,
487+ "migration-safe": true
488+ },
489+ {
490+ "name": "pentium3",
491+ "typename": "pentium3-x86_64-cpu",
492+ "unavailable-features": [],
493+ "static": false,
494+ "migration-safe": true
495+ },
496+ {
497+ "name": "pentium2",
498+ "typename": "pentium2-x86_64-cpu",
499+ "unavailable-features": [],
500+ "static": false,
501+ "migration-safe": true
502+ },
503+ {
504+ "name": "pentium",
505+ "typename": "pentium-x86_64-cpu",
506+ "unavailable-features": [],
507+ "static": false,
508+ "migration-safe": true
509+ },
510+ {
511+ "name": "n270",
512+ "typename": "n270-x86_64-cpu",
513+ "unavailable-features": [],
514+ "static": false,
515+ "migration-safe": true
516+ },
517+ {
518+ "name": "kvm64",
519+ "typename": "kvm64-x86_64-cpu",
520+ "unavailable-features": [],
521+ "static": false,
522+ "migration-safe": true
523+ },
524+ {
525+ "name": "kvm32",
526+ "typename": "kvm32-x86_64-cpu",
527+ "unavailable-features": [],
528+ "static": false,
529+ "migration-safe": true
530+ },
531+ {
532+ "name": "cpu64-rhel6",
533+ "typename": "cpu64-rhel6-x86_64-cpu",
534+ "unavailable-features": [
535+ "sse4a"
536+ ],
537+ "static": false,
538+ "migration-safe": true
539+ },
540+ {
541+ "name": "coreduo",
542+ "typename": "coreduo-x86_64-cpu",
543+ "unavailable-features": [],
544+ "static": false,
545+ "migration-safe": true
546+ },
547+ {
548+ "name": "core2duo",
549+ "typename": "core2duo-x86_64-cpu",
550+ "unavailable-features": [],
551+ "static": false,
552+ "migration-safe": true
553+ },
554+ {
555+ "name": "athlon",
556+ "typename": "athlon-x86_64-cpu",
557+ "unavailable-features": [
558+ "mmxext",
559+ "3dnowext",
560+ "3dnow"
561+ ],
562+ "static": false,
563+ "migration-safe": true
564+ },
565+ {
566+ "name": "Westmere",
567+ "typename": "Westmere-x86_64-cpu",
568+ "unavailable-features": [],
569+ "static": false,
570+ "migration-safe": true
571+ },
572+ {
573+ "name": "Westmere-IBRS",
574+ "typename": "Westmere-IBRS-x86_64-cpu",
575+ "unavailable-features": [],
576+ "static": false,
577+ "migration-safe": true
578+ },
579+ {
580+ "name": "Skylake-Server",
581+ "typename": "Skylake-Server-x86_64-cpu",
582+ "unavailable-features": [
583+ "avx512f",
584+ "avx512dq",
585+ "clwb",
586+ "avx512cd",
587+ "avx512bw",
588+ "avx512vl",
589+ "avx512f",
590+ "avx512f",
591+ "avx512f"
592+ ],
593+ "static": false,
594+ "migration-safe": true
595+ },
596+ {
597+ "name": "Skylake-Server-IBRS",
598+ "typename": "Skylake-Server-IBRS-x86_64-cpu",
599+ "unavailable-features": [
600+ "avx512f",
601+ "avx512dq",
602+ "clwb",
603+ "avx512cd",
604+ "avx512bw",
605+ "avx512vl",
606+ "avx512f",
607+ "avx512f",
608+ "avx512f"
609+ ],
610+ "static": false,
611+ "migration-safe": true
612+ },
613+ {
614+ "name": "Skylake-Client",
615+ "typename": "Skylake-Client-x86_64-cpu",
616+ "unavailable-features": [],
617+ "static": false,
618+ "migration-safe": true
619+ },
620+ {
621+ "name": "Skylake-Client-IBRS",
622+ "typename": "Skylake-Client-IBRS-x86_64-cpu",
623+ "unavailable-features": [],
624+ "static": false,
625+ "migration-safe": true
626+ },
627+ {
628+ "name": "SandyBridge",
629+ "typename": "SandyBridge-x86_64-cpu",
630+ "unavailable-features": [],
631+ "static": false,
632+ "migration-safe": true
633+ },
634+ {
635+ "name": "SandyBridge-IBRS",
636+ "typename": "SandyBridge-IBRS-x86_64-cpu",
637+ "unavailable-features": [],
638+ "static": false,
639+ "migration-safe": true
640+ },
641+ {
642+ "name": "Penryn",
643+ "typename": "Penryn-x86_64-cpu",
644+ "unavailable-features": [],
645+ "static": false,
646+ "migration-safe": true
647+ },
648+ {
649+ "name": "Opteron_G5",
650+ "typename": "Opteron_G5-x86_64-cpu",
651+ "unavailable-features": [
652+ "sse4a",
653+ "misalignsse",
654+ "xop",
655+ "fma4",
656+ "tbm"
657+ ],
658+ "static": false,
659+ "migration-safe": true
660+ },
661+ {
662+ "name": "Opteron_G4",
663+ "typename": "Opteron_G4-x86_64-cpu",
664+ "unavailable-features": [
665+ "sse4a",
666+ "misalignsse",
667+ "xop",
668+ "fma4"
669+ ],
670+ "static": false,
671+ "migration-safe": true
672+ },
673+ {
674+ "name": "Opteron_G3",
675+ "typename": "Opteron_G3-x86_64-cpu",
676+ "unavailable-features": [
677+ "sse4a",
678+ "misalignsse"
679+ ],
680+ "static": false,
681+ "migration-safe": true
682+ },
683+ {
684+ "name": "Opteron_G2",
685+ "typename": "Opteron_G2-x86_64-cpu",
686+ "unavailable-features": [],
687+ "static": false,
688+ "migration-safe": true
689+ },
690+ {
691+ "name": "Opteron_G1",
692+ "typename": "Opteron_G1-x86_64-cpu",
693+ "unavailable-features": [],
694+ "static": false,
695+ "migration-safe": true
696+ },
697+ {
698+ "name": "Nehalem",
699+ "typename": "Nehalem-x86_64-cpu",
700+ "unavailable-features": [],
701+ "static": false,
702+ "migration-safe": true
703+ },
704+ {
705+ "name": "Nehalem-IBRS",
706+ "typename": "Nehalem-IBRS-x86_64-cpu",
707+ "unavailable-features": [],
708+ "static": false,
709+ "migration-safe": true
710+ },
711+ {
712+ "name": "IvyBridge",
713+ "typename": "IvyBridge-x86_64-cpu",
714+ "unavailable-features": [],
715+ "static": false,
716+ "migration-safe": true
717+ },
718+ {
719+ "name": "IvyBridge-IBRS",
720+ "typename": "IvyBridge-IBRS-x86_64-cpu",
721+ "unavailable-features": [],
722+ "static": false,
723+ "migration-safe": true
724+ },
725+ {
726+ "name": "Haswell",
727+ "typename": "Haswell-x86_64-cpu",
728+ "unavailable-features": [],
729+ "static": false,
730+ "migration-safe": true
731+ },
732+ {
733+ "name": "Haswell-noTSX",
734+ "typename": "Haswell-noTSX-x86_64-cpu",
735+ "unavailable-features": [],
736+ "static": false,
737+ "migration-safe": true
738+ },
739+ {
740+ "name": "Haswell-noTSX-IBRS",
741+ "typename": "Haswell-noTSX-IBRS-x86_64-cpu",
742+ "unavailable-features": [],
743+ "static": false,
744+ "migration-safe": true
745+ },
746+ {
747+ "name": "Haswell-IBRS",
748+ "typename": "Haswell-IBRS-x86_64-cpu",
749+ "unavailable-features": [],
750+ "static": false,
751+ "migration-safe": true
752+ },
753+ {
754+ "name": "EPYC",
755+ "typename": "EPYC-x86_64-cpu",
756+ "unavailable-features": [
757+ "sha-ni",
758+ "mmxext",
759+ "fxsr-opt",
760+ "cr8legacy",
761+ "sse4a",
762+ "misalignsse",
763+ "osvw"
764+ ],
765+ "static": false,
766+ "migration-safe": true
767+ },
768+ {
769+ "name": "EPYC-IBPB",
770+ "typename": "EPYC-IBPB-x86_64-cpu",
771+ "unavailable-features": [
772+ "sha-ni",
773+ "mmxext",
774+ "fxsr-opt",
775+ "cr8legacy",
776+ "sse4a",
777+ "misalignsse",
778+ "osvw",
779+ "ibpb"
780+ ],
781+ "static": false,
782+ "migration-safe": true
783+ },
784+ {
785+ "name": "Conroe",
786+ "typename": "Conroe-x86_64-cpu",
787+ "unavailable-features": [],
788+ "static": false,
789+ "migration-safe": true
790+ },
791+ {
792+ "name": "Broadwell",
793+ "typename": "Broadwell-x86_64-cpu",
794+ "unavailable-features": [],
795+ "static": false,
796+ "migration-safe": true
797+ },
798+ {
799+ "name": "Broadwell-noTSX",
800+ "typename": "Broadwell-noTSX-x86_64-cpu",
801+ "unavailable-features": [],
802+ "static": false,
803+ "migration-safe": true
804+ },
805+ {
806+ "name": "Broadwell-noTSX-IBRS",
807+ "typename": "Broadwell-noTSX-IBRS-x86_64-cpu",
808+ "unavailable-features": [],
809+ "static": false,
810+ "migration-safe": true
811+ },
812+ {
813+ "name": "Broadwell-IBRS",
814+ "typename": "Broadwell-IBRS-x86_64-cpu",
815+ "unavailable-features": [],
816+ "static": false,
817+ "migration-safe": true
818+ },
819+ {
820+ "name": "486",
821+ "typename": "486-x86_64-cpu",
822+ "unavailable-features": [],
823+ "static": false,
824+ "migration-safe": true
825+ }
826+ ],
827+ "id": "definitions"
828+}
829diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
830new file mode 100644
831index 0000000..7e57c2d
832--- /dev/null
833+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
834@@ -0,0 +1,4 @@
835+0506e3
836+family: 6 (0x06)
837+model: 94 (0x5e)
838+stepping: 3 (0x03)
839diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
840new file mode 100644
841index 0000000..437429d
842--- /dev/null
843+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
844@@ -0,0 +1,47 @@
845+<!-- Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz -->
846+<cpudata arch='x86'>
847+ <cpuid eax_in='0x00000000' ecx_in='0x00' eax='0x00000016' ebx='0x756e6547' ecx='0x6c65746e' edx='0x49656e69'/>
848+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x000506e3' ebx='0x06100800' ecx='0x7ffafbff' edx='0xbfebfbff'/>
849+ <cpuid eax_in='0x00000002' ecx_in='0x00' eax='0x76036301' ebx='0x00f0b6ff' ecx='0x00000000' edx='0x00c30000'/>
850+ <cpuid eax_in='0x00000003' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
851+ <cpuid eax_in='0x00000004' ecx_in='0x00' eax='0x1c004121' ebx='0x01c0003f' ecx='0x0000003f' edx='0x00000000'/>
852+ <cpuid eax_in='0x00000004' ecx_in='0x01' eax='0x1c004122' ebx='0x01c0003f' ecx='0x0000003f' edx='0x00000000'/>
853+ <cpuid eax_in='0x00000004' ecx_in='0x02' eax='0x1c004143' ebx='0x00c0003f' ecx='0x000003ff' edx='0x00000000'/>
854+ <cpuid eax_in='0x00000004' ecx_in='0x03' eax='0x1c03c163' ebx='0x03c0003f' ecx='0x00001fff' edx='0x00000006'/>
855+ <cpuid eax_in='0x00000005' ecx_in='0x00' eax='0x00000040' ebx='0x00000040' ecx='0x00000003' edx='0x00142120'/>
856+ <cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x000027f7' ebx='0x00000002' ecx='0x00000009' edx='0x00000000'/>
857+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x029c6fbf' ecx='0x00000000' edx='0x9c002400'/>
858+ <cpuid eax_in='0x00000008' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
859+ <cpuid eax_in='0x00000009' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
860+ <cpuid eax_in='0x0000000a' ecx_in='0x00' eax='0x07300804' ebx='0x00000000' ecx='0x00000000' edx='0x00000603'/>
861+ <cpuid eax_in='0x0000000b' ecx_in='0x00' eax='0x00000001' ebx='0x00000001' ecx='0x00000100' edx='0x00000006'/>
862+ <cpuid eax_in='0x0000000b' ecx_in='0x01' eax='0x00000004' ebx='0x00000004' ecx='0x00000201' edx='0x00000006'/>
863+ <cpuid eax_in='0x0000000c' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
864+ <cpuid eax_in='0x0000000d' ecx_in='0x00' eax='0x0000001f' ebx='0x00000440' ecx='0x00000440' edx='0x00000000'/>
865+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x0000000f' ebx='0x000003c0' ecx='0x00000100' edx='0x00000000'/>
866+ <cpuid eax_in='0x0000000d' ecx_in='0x02' eax='0x00000100' ebx='0x00000240' ecx='0x00000000' edx='0x00000000'/>
867+ <cpuid eax_in='0x0000000d' ecx_in='0x03' eax='0x00000040' ebx='0x000003c0' ecx='0x00000000' edx='0x00000000'/>
868+ <cpuid eax_in='0x0000000d' ecx_in='0x04' eax='0x00000040' ebx='0x00000400' ecx='0x00000000' edx='0x00000000'/>
869+ <cpuid eax_in='0x0000000d' ecx_in='0x08' eax='0x00000080' ebx='0x00000000' ecx='0x00000001' edx='0x00000000'/>
870+ <cpuid eax_in='0x0000000e' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
871+ <cpuid eax_in='0x0000000f' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
872+ <cpuid eax_in='0x00000010' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
873+ <cpuid eax_in='0x00000011' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
874+ <cpuid eax_in='0x00000012' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
875+ <cpuid eax_in='0x00000013' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
876+ <cpuid eax_in='0x00000014' ecx_in='0x00' eax='0x00000001' ebx='0x0000000f' ecx='0x00000007' edx='0x00000000'/>
877+ <cpuid eax_in='0x00000014' ecx_in='0x01' eax='0x02490002' ebx='0x003f3fff' ecx='0x00000000' edx='0x00000000'/>
878+ <cpuid eax_in='0x00000015' ecx_in='0x00' eax='0x00000002' ebx='0x00000114' ecx='0x00000000' edx='0x00000000'/>
879+ <cpuid eax_in='0x00000016' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
880+ <cpuid eax_in='0x80000000' ecx_in='0x00' eax='0x80000008' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
881+ <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
882+ <cpuid eax_in='0x80000002' ecx_in='0x00' eax='0x65746e49' ebx='0x2952286c' ecx='0x6f655820' edx='0x2952286e'/>
883+ <cpuid eax_in='0x80000003' ecx_in='0x00' eax='0x55504320' ebx='0x2d334520' ecx='0x35323231' edx='0x20357620'/>
884+ <cpuid eax_in='0x80000004' ecx_in='0x00' eax='0x2e332040' ebx='0x48473033' ecx='0x0000007a' edx='0x00000000'/>
885+ <cpuid eax_in='0x80000005' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
886+ <cpuid eax_in='0x80000006' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x01006040' edx='0x00000000'/>
887+ <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
888+ <cpuid eax_in='0x80000008' ecx_in='0x00' eax='0x00003027' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
889+ <cpuid eax_in='0x80860000' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
890+ <cpuid eax_in='0xc0000000' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
891+</cpudata>
892--
8932.7.4
894
diff --git a/recipes-extended/libvirt/libvirt/CVE-2018-12126_CVE-2018-12127_CVE-2018-12130_CVE-2019-11091_p2.patch b/recipes-extended/libvirt/libvirt/CVE-2018-12126_CVE-2018-12127_CVE-2018-12130_CVE-2019-11091_p2.patch
new file mode 100644
index 00000000..b39e8662
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2018-12126_CVE-2018-12127_CVE-2018-12130_CVE-2019-11091_p2.patch
@@ -0,0 +1,116 @@
1From c811c618c114c4a6493ede602bdca22d33c1972a Mon Sep 17 00:00:00 2001
2From: Jiri Denemark <jdenemar@redhat.com>
3Date: Tue, 9 Apr 2019 12:35:52 +0200
4Subject: [PATCH 04/11] cpu_map: Define md-clear CPUID bit
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
10
11The bit is set when microcode provides the mechanism to invoke a flush
12of various exploitable CPU buffers by invoking the VERW instruction.
13
14Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
15Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
16Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
17(cherry picked from commit 538d873571d7a682852dc1d70e5f4478f4d64e85)
18
19Conflicts:
20 src/cpu_map/x86_features.xml
21 - missing pconfig feature
22
23 tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml
24 tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml
25 - test data missing downstream
26
27 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
28 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
29 - intel-pt feature is missing
30 - stibp feature is missing
31
32Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
33
34Upstream-Status: Backport
35
36CVE: CVE-2018-12126
37CVE: CVE-2018-12127
38CVE: CVE-2018-12130
39CVE: CVE-2019-11091
40
41Signed-off-by: Armin Kuster <akuster@mvista.com>
42
43---
44 src/cpu_map/x86_features.xml | 3 +++
45 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 2 +-
46 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 1 +
47 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 1 +
48 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 1 +
49 5 files changed, 7 insertions(+), 1 deletion(-)
50
51diff --git a/src/cpu_map/x86_features.xml b/src/cpu_map/x86_features.xml
52index 109c653..c8ae540 100644
53--- a/src/cpu_map/x86_features.xml
54+++ b/src/cpu_map/x86_features.xml
55@@ -290,6 +290,9 @@
56 <feature name='avx512-4fmaps'>
57 <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000008'/>
58 </feature>
59+ <feature name='md-clear'> <!-- md_clear -->
60+ <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000400'/>
61+ </feature>
62 <feature name='spec-ctrl'>
63 <cpuid eax_in='0x07' ecx_in='0x00' edx='0x04000000'/>
64 </feature>
65diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
66index 0deca9f..74763a4 100644
67--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
68+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
69@@ -2,7 +2,7 @@
70 <cpudata arch='x86'>
71 <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0xf7fa3203' edx='0x0f8bfbff'/>
72 <cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x00000004' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
73- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000000'/>
74+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000400'/>
75 <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000007' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
76 <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
77 </cpudata>
78diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
79index 993db80..29c1fdb 100644
80--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
81+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
82@@ -19,6 +19,7 @@
83 <feature policy='require' name='osxsave'/>
84 <feature policy='require' name='tsc_adjust'/>
85 <feature policy='require' name='clflushopt'/>
86+ <feature policy='require' name='md-clear'/>
87 <feature policy='require' name='ssbd'/>
88 <feature policy='require' name='xsaves'/>
89 <feature policy='require' name='pdpe1gb'/>
90diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
91index 074a39b..2003ca9 100644
92--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
93+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
94@@ -20,6 +20,7 @@
95 <feature name='osxsave'/>
96 <feature name='tsc_adjust'/>
97 <feature name='clflushopt'/>
98+ <feature name='md-clear'/>
99 <feature name='ssbd'/>
100 <feature name='xsaves'/>
101 <feature name='pdpe1gb'/>
102diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
103index 1984bd4..d6529c5 100644
104--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
105+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
106@@ -5,6 +5,7 @@
107 <feature policy='require' name='hypervisor'/>
108 <feature policy='require' name='tsc_adjust'/>
109 <feature policy='require' name='clflushopt'/>
110+ <feature policy='require' name='md-clear'/>
111 <feature policy='require' name='ssbd'/>
112 <feature policy='require' name='pdpe1gb'/>
113 </cpu>
114--
1152.7.4
116
diff --git a/recipes-extended/libvirt/libvirt/CVE-2019-10132_p1.patch b/recipes-extended/libvirt/libvirt/CVE-2019-10132_p1.patch
new file mode 100644
index 00000000..11c1c5df
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2019-10132_p1.patch
@@ -0,0 +1,63 @@
1From dfd22fc50f8f268b9810d2ef21adada021f740eb Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
3Date: Tue, 30 Apr 2019 17:26:13 +0100
4Subject: [PATCH 05/11] admin: reject clients unless their UID matches the
5 current UID
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10The admin protocol RPC messages are only intended for use by the user
11running the daemon. As such they should not be allowed for any client
12UID that does not match the server UID.
13
14Fixes CVE-2019-10132
15
16Reviewed-by: Ján Tomko <jtomko@redhat.com>
17Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
18(cherry picked from commit 96f41cd765c9e525fe28ee5abbfbf4a79b3720c7)
19
20Upstream-Status: Backport
21CVE: CVE-2019-10132
22Signed-off-by: Armin Kuster <akuster@mvista.com>
23
24---
25 src/admin/admin_server_dispatch.c | 22 ++++++++++++++++++++++
26 1 file changed, 22 insertions(+)
27
28diff --git a/src/admin/admin_server_dispatch.c b/src/admin/admin_server_dispatch.c
29index b78ff90..9f25813 100644
30--- a/src/admin/admin_server_dispatch.c
31+++ b/src/admin/admin_server_dispatch.c
32@@ -66,6 +66,28 @@ remoteAdmClientNew(virNetServerClientPtr client ATTRIBUTE_UNUSED,
33 void *opaque)
34 {
35 struct daemonAdmClientPrivate *priv;
36+ uid_t clientuid;
37+ gid_t clientgid;
38+ pid_t clientpid;
39+ unsigned long long timestamp;
40+
41+ if (virNetServerClientGetUNIXIdentity(client,
42+ &clientuid,
43+ &clientgid,
44+ &clientpid,
45+ &timestamp) < 0)
46+ return NULL;
47+
48+ VIR_DEBUG("New client pid %lld uid %lld",
49+ (long long)clientpid,
50+ (long long)clientuid);
51+
52+ if (geteuid() != clientuid) {
53+ virReportRestrictedError(_("Disallowing client %lld with uid %lld"),
54+ (long long)clientpid,
55+ (long long)clientuid);
56+ return NULL;
57+ }
58
59 if (VIR_ALLOC(priv) < 0)
60 return NULL;
61--
622.7.4
63
diff --git a/recipes-extended/libvirt/libvirt/CVE-2019-10132_p2.patch b/recipes-extended/libvirt/libvirt/CVE-2019-10132_p2.patch
new file mode 100644
index 00000000..860c1e53
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2019-10132_p2.patch
@@ -0,0 +1,56 @@
1From 54005b84b0165b62b2ef88c7df229bddbaa29e76 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
3Date: Tue, 30 Apr 2019 16:51:37 +0100
4Subject: [PATCH 06/11] locking: restrict sockets to mode 0600
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9The virtlockd daemon's only intended client is the libvirtd daemon. As
10such it should never allow clients from other user accounts to connect.
11The code already enforces this and drops clients from other UIDs, but
12we can get earlier (and thus stronger) protection against DoS by setting
13the socket permissions to 0600
14
15Fixes CVE-2019-10132
16
17Reviewed-by: Ján Tomko <jtomko@redhat.com>
18Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
19(cherry picked from commit f111e09468693909b1f067aa575efdafd9a262a1)
20
21Upstream-Status: Backport
22CVE: CVE-2019-10132
23Signed-off-by: Armin Kuster <akuster@mvista.com>
24
25---
26 src/locking/virtlockd-admin.socket.in | 1 +
27 src/locking/virtlockd.socket.in | 1 +
28 2 files changed, 2 insertions(+)
29
30diff --git a/src/locking/virtlockd-admin.socket.in b/src/locking/virtlockd-admin.socket.in
31index 2a7500f..f674c49 100644
32--- a/src/locking/virtlockd-admin.socket.in
33+++ b/src/locking/virtlockd-admin.socket.in
34@@ -5,6 +5,7 @@ Before=libvirtd.service
35 [Socket]
36 ListenStream=@localstatedir@/run/libvirt/virtlockd-admin-sock
37 Service=virtlockd.service
38+SocketMode=0600
39
40 [Install]
41 WantedBy=sockets.target
42diff --git a/src/locking/virtlockd.socket.in b/src/locking/virtlockd.socket.in
43index 45e0f20..d701b27 100644
44--- a/src/locking/virtlockd.socket.in
45+++ b/src/locking/virtlockd.socket.in
46@@ -4,6 +4,7 @@ Before=libvirtd.service
47
48 [Socket]
49 ListenStream=@localstatedir@/run/libvirt/virtlockd-sock
50+SocketMode=0600
51
52 [Install]
53 WantedBy=sockets.target
54--
552.7.4
56
diff --git a/recipes-extended/libvirt/libvirt/CVE-2019-10132_p3.patch b/recipes-extended/libvirt/libvirt/CVE-2019-10132_p3.patch
new file mode 100644
index 00000000..ddd0740e
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2019-10132_p3.patch
@@ -0,0 +1,56 @@
1From 030fdf57255f97289a407529194bf26c77548acb Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
3Date: Tue, 30 Apr 2019 17:27:41 +0100
4Subject: [PATCH 07/11] logging: restrict sockets to mode 0600
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9The virtlogd daemon's only intended client is the libvirtd daemon. As
10such it should never allow clients from other user accounts to connect.
11The code already enforces this and drops clients from other UIDs, but
12we can get earlier (and thus stronger) protection against DoS by setting
13the socket permissions to 0600
14
15Fixes CVE-2019-10132
16
17Reviewed-by: Ján Tomko <jtomko@redhat.com>
18Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
19(cherry picked from commit e37bd65f9948c1185456b2cdaa3bd6e875af680f)
20
21Upstream-Status: Backport
22CVE: CVE-2019-10132
23Signed-off-by: Armin Kuster <akuster@mvista.com>
24
25---
26 src/logging/virtlogd-admin.socket.in | 1 +
27 src/logging/virtlogd.socket.in | 1 +
28 2 files changed, 2 insertions(+)
29
30diff --git a/src/logging/virtlogd-admin.socket.in b/src/logging/virtlogd-admin.socket.in
31index 595e6c4..5c41dfe 100644
32--- a/src/logging/virtlogd-admin.socket.in
33+++ b/src/logging/virtlogd-admin.socket.in
34@@ -5,6 +5,7 @@ Before=libvirtd.service
35 [Socket]
36 ListenStream=@localstatedir@/run/libvirt/virtlogd-admin-sock
37 Service=virtlogd.service
38+SocketMode=0600
39
40 [Install]
41 WantedBy=sockets.target
42diff --git a/src/logging/virtlogd.socket.in b/src/logging/virtlogd.socket.in
43index 22b9360..ae48cda 100644
44--- a/src/logging/virtlogd.socket.in
45+++ b/src/logging/virtlogd.socket.in
46@@ -4,6 +4,7 @@ Before=libvirtd.service
47
48 [Socket]
49 ListenStream=@localstatedir@/run/libvirt/virtlogd-sock
50+SocketMode=0600
51
52 [Install]
53 WantedBy=sockets.target
54--
552.7.4
56
diff --git a/recipes-extended/libvirt/libvirt/CVE-2019-10161.patch b/recipes-extended/libvirt/libvirt/CVE-2019-10161.patch
new file mode 100644
index 00000000..118ece4c
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2019-10161.patch
@@ -0,0 +1,99 @@
1From 3352c8af264a7b9b741208790ecca0bbc6733f42 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
3Date: Fri, 14 Jun 2019 08:47:42 +0200
4Subject: [PATCH 08/11] api: disallow virDomainSaveImageGetXMLDesc on read-only
5 connections
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10The virDomainSaveImageGetXMLDesc API is taking a path parameter,
11which can point to any path on the system. This file will then be
12read and parsed by libvirtd running with root privileges.
13
14Forbid it on read-only connections.
15
16Fixes: CVE-2019-10161
17Reported-by: Matthias Gerstner <mgerstner@suse.de>
18Signed-off-by: Ján Tomko <jtomko@redhat.com>
19Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
20(cherry picked from commit aed6a032cead4386472afb24b16196579e239580)
21Signed-off-by: Ján Tomko <jtomko@redhat.com>
22
23Conflicts:
24 src/libvirt-domain.c
25 src/remote/remote_protocol.x
26
27Upstream commit 12a51f372 which introduced the VIR_DOMAIN_SAVE_IMAGE_XML_SECURE
28alias for VIR_DOMAIN_XML_SECURE is not backported.
29Just skip the commit since we now disallow the whole API on read-only
30connections, regardless of the flag.
31
32Signed-off-by: Ján Tomko <jtomko@redhat.com>
33
34Upstream-Status: Backport
35CVE: CVE-2019-10161
36Signed-off-by: Armin Kuster <akuster@mvista.com>
37
38---
39 src/libvirt-domain.c | 11 ++---------
40 src/qemu/qemu_driver.c | 2 +-
41 src/remote/remote_protocol.x | 3 +--
42 3 files changed, 4 insertions(+), 12 deletions(-)
43
44Index: libvirt-4.7.0/src/libvirt-domain.c
45===================================================================
46--- libvirt-4.7.0.orig/src/libvirt-domain.c
47+++ libvirt-4.7.0/src/libvirt-domain.c
48@@ -1073,9 +1073,7 @@ virDomainRestoreFlags(virConnectPtr conn
49 * previously by virDomainSave() or virDomainSaveFlags().
50 *
51 * No security-sensitive data will be included unless @flags contains
52- * VIR_DOMAIN_XML_SECURE; this flag is rejected on read-only
53- * connections. For this API, @flags should not contain either
54- * VIR_DOMAIN_XML_INACTIVE or VIR_DOMAIN_XML_UPDATE_CPU.
55+ * VIR_DOMAIN_XML_SECURE.
56 *
57 * Returns a 0 terminated UTF-8 encoded XML instance, or NULL in case of
58 * error. The caller must free() the returned value.
59@@ -1091,12 +1089,7 @@ virDomainSaveImageGetXMLDesc(virConnectP
60
61 virCheckConnectReturn(conn, NULL);
62 virCheckNonNullArgGoto(file, error);
63-
64- if ((conn->flags & VIR_CONNECT_RO) && (flags & VIR_DOMAIN_XML_SECURE)) {
65- virReportError(VIR_ERR_OPERATION_DENIED, "%s",
66- _("virDomainSaveImageGetXMLDesc with secure flag"));
67- goto error;
68- }
69+ virCheckReadOnlyGoto(conn->flags, error);
70
71 if (conn->driver->domainSaveImageGetXMLDesc) {
72 char *ret;
73Index: libvirt-4.7.0/src/qemu/qemu_driver.c
74===================================================================
75--- libvirt-4.7.0.orig/src/qemu/qemu_driver.c
76+++ libvirt-4.7.0/src/qemu/qemu_driver.c
77@@ -6791,7 +6791,7 @@ qemuDomainSaveImageGetXMLDesc(virConnect
78 if (fd < 0)
79 goto cleanup;
80
81- if (virDomainSaveImageGetXMLDescEnsureACL(conn, def, flags) < 0)
82+ if (virDomainSaveImageGetXMLDescEnsureACL(conn, def) < 0)
83 goto cleanup;
84
85 ret = qemuDomainDefFormatXML(driver, def, flags);
86Index: libvirt-4.7.0/src/remote/remote_protocol.x
87===================================================================
88--- libvirt-4.7.0.orig/src/remote/remote_protocol.x
89+++ libvirt-4.7.0/src/remote/remote_protocol.x
90@@ -5226,8 +5226,7 @@ enum remote_procedure {
91 /**
92 * @generate: both
93 * @priority: high
94- * @acl: domain:read
95- * @acl: domain:read_secure:VIR_DOMAIN_XML_SECURE
96+ * @acl: domain:write
97 */
98 REMOTE_PROC_DOMAIN_SAVE_IMAGE_GET_XML_DESC = 235,
99
diff --git a/recipes-extended/libvirt/libvirt/CVE-2019-10166.patch b/recipes-extended/libvirt/libvirt/CVE-2019-10166.patch
new file mode 100644
index 00000000..12ab5436
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2019-10166.patch
@@ -0,0 +1,43 @@
1From 6da721ea37bf3624ff9922637cfa657d2dcb20f9 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
3Date: Fri, 14 Jun 2019 09:14:53 +0200
4Subject: [PATCH 09/11] api: disallow virDomainManagedSaveDefineXML on
5 read-only connections
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10The virDomainManagedSaveDefineXML can be used to alter the domain's
11config used for managedsave or even execute arbitrary emulator binaries.
12Forbid it on read-only connections.
13
14Fixes: CVE-2019-10166
15Reported-by: Matthias Gerstner <mgerstner@suse.de>
16Signed-off-by: Ján Tomko <jtomko@redhat.com>
17Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
18(cherry picked from commit db0b78457f183e4c7ac45bc94de86044a1e2056a)
19Signed-off-by: Ján Tomko <jtomko@redhat.com>
20
21Upstream-Status: Backport
22CVE: CVE-2019-10166
23Signed-off-by: Armin Kuster <akuster@mvista.com>
24
25---
26 src/libvirt-domain.c | 1 +
27 1 file changed, 1 insertion(+)
28
29diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
30index 270e10e..5c764aa 100644
31--- a/src/libvirt-domain.c
32+++ b/src/libvirt-domain.c
33@@ -9482,6 +9482,7 @@ virDomainManagedSaveDefineXML(virDomainPtr domain, const char *dxml,
34
35 virCheckDomainReturn(domain, -1);
36 conn = domain->conn;
37+ virCheckReadOnlyGoto(conn->flags, error);
38
39 if (conn->driver->domainManagedSaveDefineXML) {
40 int ret;
41--
422.7.4
43
diff --git a/recipes-extended/libvirt/libvirt/CVE-2019-10167.patch b/recipes-extended/libvirt/libvirt/CVE-2019-10167.patch
new file mode 100644
index 00000000..576f46c7
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2019-10167.patch
@@ -0,0 +1,41 @@
1From 5441f05a42a90779b0df86518286bf527e94aafb Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
3Date: Fri, 14 Jun 2019 09:16:14 +0200
4Subject: [PATCH 10/11] api: disallow virConnectGetDomainCapabilities on
5 read-only connections
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10This API can be used to execute arbitrary emulators.
11Forbid it on read-only connections.
12
13Fixes: CVE-2019-10167
14Signed-off-by: Ján Tomko <jtomko@redhat.com>
15Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
16(cherry picked from commit 8afa68bac0cf99d1f8aaa6566685c43c22622f26)
17Signed-off-by: Ján Tomko <jtomko@redhat.com>
18
19Upstream-Status: Backport
20CVE: CVE-2019-10167
21Signed-off-by: Armin Kuster <akuster@mvista.com>
22
23---
24 src/libvirt-domain.c | 1 +
25 1 file changed, 1 insertion(+)
26
27diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
28index 5c764aa..9862a5d 100644
29--- a/src/libvirt-domain.c
30+++ b/src/libvirt-domain.c
31@@ -11274,6 +11274,7 @@ virConnectGetDomainCapabilities(virConnectPtr conn,
32 virResetLastError();
33
34 virCheckConnectReturn(conn, NULL);
35+ virCheckReadOnlyGoto(conn->flags, error);
36
37 if (conn->driver->connectGetDomainCapabilities) {
38 char *ret;
39--
402.7.4
41
diff --git a/recipes-extended/libvirt/libvirt/CVE-2019-10168.patch b/recipes-extended/libvirt/libvirt/CVE-2019-10168.patch
new file mode 100644
index 00000000..16f1a6d9
--- /dev/null
+++ b/recipes-extended/libvirt/libvirt/CVE-2019-10168.patch
@@ -0,0 +1,49 @@
1From f5ace9c05d59b70d4899199a187cb32ec6f600d8 Mon Sep 17 00:00:00 2001
2From: =?UTF-8?q?J=C3=A1n=20Tomko?= <jtomko@redhat.com>
3Date: Fri, 14 Jun 2019 09:17:39 +0200
4Subject: [PATCH 11/11] api: disallow virConnect*HypervisorCPU on read-only
5 connections
6MIME-Version: 1.0
7Content-Type: text/plain; charset=UTF-8
8Content-Transfer-Encoding: 8bit
9
10These APIs can be used to execute arbitrary emulators.
11Forbid them on read-only connections.
12
13Fixes: CVE-2019-10168
14Signed-off-by: Ján Tomko <jtomko@redhat.com>
15Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
16(cherry picked from commit bf6c2830b6c338b1f5699b095df36f374777b291)
17Signed-off-by: Ján Tomko <jtomko@redhat.com>
18
19Upstream-Status: Backport
20CVE: CVE-2019-10168
21Signed-off-by: Armin Kuster <akuster@mvista.com>
22
23---
24 src/libvirt-host.c | 2 ++
25 1 file changed, 2 insertions(+)
26
27diff --git a/src/libvirt-host.c b/src/libvirt-host.c
28index e20d6ee..2978825 100644
29--- a/src/libvirt-host.c
30+++ b/src/libvirt-host.c
31@@ -1041,6 +1041,7 @@ virConnectCompareHypervisorCPU(virConnectPtr conn,
32
33 virCheckConnectReturn(conn, VIR_CPU_COMPARE_ERROR);
34 virCheckNonNullArgGoto(xmlCPU, error);
35+ virCheckReadOnlyGoto(conn->flags, error);
36
37 if (conn->driver->connectCompareHypervisorCPU) {
38 int ret;
39@@ -1234,6 +1235,7 @@ virConnectBaselineHypervisorCPU(virConnectPtr conn,
40
41 virCheckConnectReturn(conn, NULL);
42 virCheckNonNullArgGoto(xmlCPUs, error);
43+ virCheckReadOnlyGoto(conn->flags, error);
44
45 if (conn->driver->connectBaselineHypervisorCPU) {
46 char *cpu;
47--
482.7.4
49
diff --git a/recipes-extended/libvirt/libvirt_4.7.0.bb b/recipes-extended/libvirt/libvirt_4.7.0.bb
index 270dc725..1d3b48e8 100644
--- a/recipes-extended/libvirt/libvirt_4.7.0.bb
+++ b/recipes-extended/libvirt/libvirt_4.7.0.bb
@@ -37,6 +37,17 @@ SRC_URI = "http://libvirt.org/sources/libvirt-${PV}.tar.xz;name=libvirt \
37 file://configure.ac-search-for-rpc-rpc.h-in-the-sysroot.patch \ 37 file://configure.ac-search-for-rpc-rpc.h-in-the-sysroot.patch \
38 file://lxc_monitor-Avoid-AB-BA-lock-race.patch \ 38 file://lxc_monitor-Avoid-AB-BA-lock-race.patch \
39 file://CVE-2019-3840.patch \ 39 file://CVE-2019-3840.patch \
40 file://0001-cpu_x86-Do-not-cache-microcode-version.patch \
41 file://0002-qemu-Don-t-cache-microcode-version.patch \
42 file://CVE-2018-12126_CVE-2018-12127_CVE-2018-12130_CVE-2019-11091_p1.patch \
43 file://CVE-2018-12126_CVE-2018-12127_CVE-2018-12130_CVE-2019-11091_p2.patch \
44 file://CVE-2019-10132_p1.patch \
45 file://CVE-2019-10132_p2.patch \
46 file://CVE-2019-10132_p3.patch \
47 file://CVE-2019-10161.patch \
48 file://CVE-2019-10166.patch \
49 file://CVE-2019-10167.patch \
50 file://CVE-2019-10168.patch \
40 " 51 "
41 52
42SRC_URI[libvirt.md5sum] = "38da6c33250dcbc0a6d68de5c758262b" 53SRC_URI[libvirt.md5sum] = "38da6c33250dcbc0a6d68de5c758262b"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-12-03 19:47:15 +0000