Compare commits
10 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Daniel P. Berrangé
|
6aad33f3cc | ||
|
Daniel P. Berrangé
|
5b6591ed7d | ||
|
Daniel P. Berrangé
|
71c382a378 | ||
|
Cole Robinson
|
3ac26c9827 | ||
|
Cole Robinson
|
d8f5f4e2e9 | ||
|
Daniel P. Berrangé
|
7fa7c37eee | ||
|
Daniel P. Berrangé
|
398721ffd4 | ||
|
Daniel P. Berrangé
|
f6736a34a2 | ||
|
Daniel P. Berrangé
|
aa2d30880a | ||
|
Daniel P. Berrangé
|
b6cdf32170 |
@@ -1,31 +0,0 @@
|
||||
[suppress_function]
|
||||
symbol_version_regexp = LIBVIRT_PRIVATE.*
|
||||
soname_regexp = libvirt\\.so.*
|
||||
|
||||
[suppress_function]
|
||||
symbol_version_regexp = LIBVIRT_ADMIN_PRIVATE.*
|
||||
soname_regexp = libvirt-admin\\.so.*
|
||||
|
||||
[suppress_variable]
|
||||
symbol_version_regexp = LIBVIRT_PRIVATE.*
|
||||
soname_regexp = libvirt\\.so.*
|
||||
|
||||
[suppress_variable]
|
||||
symbol_version_regexp = LIBVIRT_ADMIN_PRIVATE.*
|
||||
soname_regexp = libvirt-admin\\.so.*
|
||||
|
||||
[suppress_function]
|
||||
symbol_version_regexp = .*
|
||||
soname_regexp = libvirt_storage_.*\\.so.*
|
||||
|
||||
[suppress_variable]
|
||||
symbol_version_regexp = .*
|
||||
soname_regexp = libvirt_storage_.*\\.so.*
|
||||
|
||||
[suppress_function]
|
||||
symbol_version_regexp = .*
|
||||
soname_regexp = libvirt_driver_.*\\.so.*
|
||||
|
||||
[suppress_variable]
|
||||
symbol_version_regexp = .*
|
||||
soname_regexp = libvirt_driver_.*\\.so.*
|
||||
@@ -0,0 +1,32 @@
|
||||
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
||||
Date: Mon, 21 May 2018 23:05:07 +0100
|
||||
Subject: [PATCH] cpu: define the 'ssbd' CPUID feature bit (CVE-2018-3639)
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
New microcode introduces the "Speculative Store Bypass Disable"
|
||||
CPUID feature bit. This needs to be exposed to guest OS to allow
|
||||
them to protect against CVE-2018-3639.
|
||||
|
||||
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
|
||||
(cherry picked from commit 1dbca2eccad58d91a5fd33962854f1a653638182)
|
||||
---
|
||||
src/cpu/cpu_map.xml | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/src/cpu/cpu_map.xml b/src/cpu/cpu_map.xml
|
||||
index 00a43b172c..245aec3309 100644
|
||||
--- a/src/cpu/cpu_map.xml
|
||||
+++ b/src/cpu/cpu_map.xml
|
||||
@@ -298,6 +298,9 @@
|
||||
<feature name='spec-ctrl'>
|
||||
<cpuid eax_in='0x07' ecx_in='0x00' edx='0x04000000'/>
|
||||
</feature>
|
||||
+ <feature name='ssbd'>
|
||||
+ <cpuid eax_in='0x07' ecx_in='0x00' edx='0x80000000'/>
|
||||
+ </feature>
|
||||
|
||||
<!-- Processor Extended State Enumeration sub leaf 1 -->
|
||||
<feature name='xsaveopt'>
|
||||
@@ -1,29 +0,0 @@
|
||||
From: Martin Kletzander <mkletzan@redhat.com>
|
||||
Date: Fri, 16 Aug 2024 13:56:51 +0200
|
||||
Subject: [PATCH] virarptable: Properly calculate rtattr length
|
||||
Content-type: text/plain
|
||||
|
||||
Use convenience macro which does almost the same thing we were doing,
|
||||
but also pads out the payload length to a multiple of NLMSG_ALIGNTO (4)
|
||||
bytes.
|
||||
|
||||
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
|
||||
Reviewed-by: Laine Stump <laine@redhat.com>
|
||||
---
|
||||
src/util/virarptable.c | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/util/virarptable.c b/src/util/virarptable.c
|
||||
index 299dddd664..d8e41c5a86 100644
|
||||
--- a/src/util/virarptable.c
|
||||
+++ b/src/util/virarptable.c
|
||||
@@ -102,8 +102,7 @@ virArpTableGet(void)
|
||||
return table;
|
||||
|
||||
VIR_WARNINGS_NO_CAST_ALIGN
|
||||
- parse_rtattr(tb, NDA_MAX, NDA_RTA(r),
|
||||
- nh->nlmsg_len - NLMSG_LENGTH(sizeof(*r)));
|
||||
+ parse_rtattr(tb, NDA_MAX, NDA_RTA(r), NLMSG_PAYLOAD(nh, sizeof(*r)));
|
||||
VIR_WARNINGS_RESET
|
||||
|
||||
if (tb[NDA_DST] == NULL || tb[NDA_LLADDR] == NULL)
|
||||
@@ -0,0 +1,65 @@
|
||||
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
||||
Date: Mon, 5 Mar 2018 12:46:16 +0000
|
||||
Subject: [PATCH] tests: force use of "NORMAL" TLS priority in test suite
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
When generating certificates we rely on GNUTLS' built-in default setup
|
||||
for the ciphers used in the certs. We then currently run with the distro
|
||||
specific TLS priority setup which can be much stronger, to the extent
|
||||
that the certificates we generate are considered untrustworthy. We don't
|
||||
care about the quality of the ciphers we use in the test suite, so just
|
||||
force the priority to "NORMAL" which should ensure our certs are
|
||||
accepted by GNUTLS.
|
||||
|
||||
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||
---
|
||||
tests/virnettlscontexttest.c | 4 ++--
|
||||
tests/virnettlssessiontest.c | 4 ++--
|
||||
2 files changed, 4 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/tests/virnettlscontexttest.c b/tests/virnettlscontexttest.c
|
||||
index 089c10e964..86647f3014 100644
|
||||
--- a/tests/virnettlscontexttest.c
|
||||
+++ b/tests/virnettlscontexttest.c
|
||||
@@ -72,7 +72,7 @@ static int testTLSContextInit(const void *opaque)
|
||||
data->crt,
|
||||
KEYFILE,
|
||||
NULL,
|
||||
- NULL,
|
||||
+ "NORMAL",
|
||||
true,
|
||||
true);
|
||||
} else {
|
||||
@@ -80,7 +80,7 @@ static int testTLSContextInit(const void *opaque)
|
||||
NULL,
|
||||
data->crt,
|
||||
KEYFILE,
|
||||
- NULL,
|
||||
+ "NORMAL",
|
||||
true,
|
||||
true);
|
||||
}
|
||||
diff --git a/tests/virnettlssessiontest.c b/tests/virnettlssessiontest.c
|
||||
index 6d639e5b16..7e85607181 100644
|
||||
--- a/tests/virnettlssessiontest.c
|
||||
+++ b/tests/virnettlssessiontest.c
|
||||
@@ -113,7 +113,7 @@ static int testTLSSessionInit(const void *opaque)
|
||||
data->servercrt,
|
||||
KEYFILE,
|
||||
data->wildcards,
|
||||
- NULL,
|
||||
+ "NORMAL",
|
||||
false,
|
||||
true);
|
||||
|
||||
@@ -121,7 +121,7 @@ static int testTLSSessionInit(const void *opaque)
|
||||
NULL,
|
||||
data->clientcrt,
|
||||
KEYFILE,
|
||||
- NULL,
|
||||
+ "NORMAL",
|
||||
false,
|
||||
true);
|
||||
|
||||
@@ -1,34 +0,0 @@
|
||||
From: Martin Kletzander <mkletzan@redhat.com>
|
||||
Date: Fri, 16 Aug 2024 13:59:15 +0200
|
||||
Subject: [PATCH] virarptable: Fix check for message length
|
||||
Content-type: text/plain
|
||||
|
||||
The previous check was all wrong since it calculated the how long would
|
||||
the netlink message be if the netlink header was the payload and then
|
||||
subtracted that from the whole message length, a variable that was not
|
||||
used later in the code. This check can fail if there are no additional
|
||||
payloads, struct rtattr in particular, which we are parsing later,
|
||||
however the RTA_OK macro would've caught that anyway.
|
||||
|
||||
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
|
||||
Reviewed-by: Laine Stump <laine@redhat.com>
|
||||
---
|
||||
src/util/virarptable.c | 3 +--
|
||||
1 file changed, 1 insertion(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/util/virarptable.c b/src/util/virarptable.c
|
||||
index d8e41c5a86..45ee76766f 100644
|
||||
--- a/src/util/virarptable.c
|
||||
+++ b/src/util/virarptable.c
|
||||
@@ -81,10 +81,9 @@ virArpTableGet(void)
|
||||
for (; NLMSG_OK(nh, msglen); nh = NLMSG_NEXT(nh, msglen)) {
|
||||
VIR_WARNINGS_RESET
|
||||
struct ndmsg *r = NLMSG_DATA(nh);
|
||||
- int len = nh->nlmsg_len;
|
||||
void *addr;
|
||||
|
||||
- if ((len -= NLMSG_LENGTH(sizeof(*nh))) < 0) {
|
||||
+ if (nh->nlmsg_len < NLMSG_SPACE(sizeof(*r))) {
|
||||
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
|
||||
_("wrong nlmsg len"));
|
||||
goto cleanup;
|
||||
@@ -0,0 +1,42 @@
|
||||
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
||||
Date: Mon, 21 May 2018 23:05:08 +0100
|
||||
Subject: [PATCH] cpu: define the 'virt-ssbd' CPUID feature bit (CVE-2018-3639)
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Some AMD processors only support a non-architectural means of
|
||||
enabling Speculative Store Bypass Disable. To allow simplified
|
||||
handling in virtual environments, hypervisors will expose an
|
||||
architectural definition through CPUID bit 0x80000008_EBX[25].
|
||||
This needs to be exposed to guest OS running on AMD x86 hosts to
|
||||
allow them to protect against CVE-2018-3639.
|
||||
|
||||
Note that since this CPUID bit won't be present in the host CPUID
|
||||
results on physical hosts, it will not be enabled automatically
|
||||
in guests configured with "host-model" CPU unless using QEMU
|
||||
version >= 2.9.0. Thus for older versions of QEMU, this feature
|
||||
must be manually enabled using policy=force. Guests using the
|
||||
"host-passthrough" CPU mode do not need special handling.
|
||||
|
||||
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||
Reviewed-by: Jiri Denemark <jdenemar@redhat.com>
|
||||
(cherry picked from commit 9267342206ce17f6933d57a3128cdc504d5945c9)
|
||||
---
|
||||
src/cpu/cpu_map.xml | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/src/cpu/cpu_map.xml b/src/cpu/cpu_map.xml
|
||||
index 245aec3309..96daa0f9af 100644
|
||||
--- a/src/cpu/cpu_map.xml
|
||||
+++ b/src/cpu/cpu_map.xml
|
||||
@@ -433,6 +433,9 @@
|
||||
<feature name='ibpb'>
|
||||
<cpuid eax_in='0x80000008' ebx='0x00001000'/>
|
||||
</feature>
|
||||
+ <feature name='virt-ssbd'>
|
||||
+ <cpuid eax_in='0x80000008' ebx='0x02000000'/>
|
||||
+ </feature>
|
||||
|
||||
<!-- models -->
|
||||
<model name='486'>
|
||||
@@ -1,46 +0,0 @@
|
||||
From: Martin Kletzander <mkletzan@redhat.com>
|
||||
Date: Fri, 16 Aug 2024 14:02:48 +0200
|
||||
Subject: [PATCH] virarptable: End parsing earlier in case of NLMSG_DONE
|
||||
Content-type: text/plain
|
||||
|
||||
Check for the last multipart message right as the first thing. The
|
||||
presumption probably was that the last message might still contain a
|
||||
payload we want to parse. However that cannot be true since that would
|
||||
have to be a type RTM_NEWNEIGH. This was not caught because older
|
||||
kernels were note sending NLMSG_DONE and probably relied on the fact
|
||||
that the parsing just stops after all the messages are walked through,
|
||||
which the NLMSG_OK macro successfully did.
|
||||
|
||||
Resolves: https://issues.redhat.com/browse/RHEL-52449
|
||||
Resolves: https://bugzilla.redhat.com/2302245
|
||||
Fixes: a176d67cdfaf5b8237a7e3a80d8be0e6bdf2d8fd
|
||||
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
|
||||
Reviewed-by: Laine Stump <laine@redhat.com>
|
||||
---
|
||||
src/util/virarptable.c | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/util/virarptable.c b/src/util/virarptable.c
|
||||
index 45ee76766f..20d11f97b0 100644
|
||||
--- a/src/util/virarptable.c
|
||||
+++ b/src/util/virarptable.c
|
||||
@@ -83,6 +83,9 @@ virArpTableGet(void)
|
||||
struct ndmsg *r = NLMSG_DATA(nh);
|
||||
void *addr;
|
||||
|
||||
+ if (nh->nlmsg_type == NLMSG_DONE)
|
||||
+ break;
|
||||
+
|
||||
if (nh->nlmsg_len < NLMSG_SPACE(sizeof(*r))) {
|
||||
virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
|
||||
_("wrong nlmsg len"));
|
||||
@@ -97,9 +100,6 @@ virArpTableGet(void)
|
||||
(!(r->ndm_state == NUD_STALE || r->ndm_state == NUD_REACHABLE)))
|
||||
continue;
|
||||
|
||||
- if (nh->nlmsg_type == NLMSG_DONE)
|
||||
- return table;
|
||||
-
|
||||
VIR_WARNINGS_NO_CAST_ALIGN
|
||||
parse_rtattr(tb, NDA_MAX, NDA_RTA(r), NLMSG_PAYLOAD(nh, sizeof(*r)));
|
||||
VIR_WARNINGS_RESET
|
||||
@@ -0,0 +1,31 @@
|
||||
From: Jim Fehlig <jfehlig@suse.com>
|
||||
Date: Wed, 14 Mar 2018 16:42:39 -0600
|
||||
Subject: [PATCH] lockd: fix typo in virtlockd-admin.socket
|
||||
|
||||
Commit ce7ae55ea1 introduced a typo in virtlockd-admin socket file
|
||||
|
||||
/usr/lib/systemd/system/virtlockd-admin.socket:7: Unknown lvalue
|
||||
'Server' in section 'Socket'
|
||||
|
||||
Change 'Server' to 'Service'.
|
||||
|
||||
Signed-off-by: Jim Fehlig <jfehlig@suse.com>
|
||||
Reviewed-by: Erik Skultety <eskultet@redhat.com>
|
||||
Signed-off-by: Cole Robinson <crobinso@redhat.com>
|
||||
---
|
||||
src/locking/virtlockd-admin.socket.in | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/locking/virtlockd-admin.socket.in b/src/locking/virtlockd-admin.socket.in
|
||||
index 1fa0a3dc33..2a7500f3d0 100644
|
||||
--- a/src/locking/virtlockd-admin.socket.in
|
||||
+++ b/src/locking/virtlockd-admin.socket.in
|
||||
@@ -4,7 +4,7 @@ Before=libvirtd.service
|
||||
|
||||
[Socket]
|
||||
ListenStream=@localstatedir@/run/libvirt/virtlockd-admin-sock
|
||||
-Server=virtlockd.service
|
||||
+Service=virtlockd.service
|
||||
|
||||
[Install]
|
||||
WantedBy=sockets.target
|
||||
@@ -1,315 +0,0 @@
|
||||
From 807e2670f2704c41f0a1dca81a5d2f2f9336137c Mon Sep 17 00:00:00 2001
|
||||
From: Laine Stump <laine@redhat.com>
|
||||
Date: Mon, 25 Nov 2024 22:24:44 -0500
|
||||
Subject: [PATCH 4/9] util: use a single flags arg for virNetDevBandwidthSet(),
|
||||
not multiple bools
|
||||
|
||||
Having two bools in the arg list is on the borderline of being
|
||||
confusing to anyone trying to read the code, but we're about to add a
|
||||
3rd. This patch replaces the two bools with a single flags argument
|
||||
which will instead have one or more bits from virNetDevBandwidthFlags
|
||||
set.
|
||||
|
||||
Signed-off-by: Laine Stump <laine@redhat.com>
|
||||
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
||||
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
||||
---
|
||||
src/lxc/lxc_driver.c | 8 ++++++--
|
||||
src/lxc/lxc_process.c | 8 ++++++--
|
||||
src/network/bridge_driver.c | 10 ++++++++--
|
||||
src/qemu/qemu_command.c | 11 ++++++++---
|
||||
src/qemu/qemu_driver.c | 29 ++++++++++++++-------------
|
||||
src/qemu/qemu_hotplug.c | 22 +++++++++++++++------
|
||||
src/util/virnetdevbandwidth.c | 36 ++++++++++++++++++++--------------
|
||||
src/util/virnetdevbandwidth.h | 9 +++++++--
|
||||
tests/virnetdevbandwidthtest.c | 8 +++++++-
|
||||
9 files changed, 94 insertions(+), 47 deletions(-)
|
||||
|
||||
diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
|
||||
index 534e257f30..b693980dbb 100644
|
||||
--- a/src/lxc/lxc_driver.c
|
||||
+++ b/src/lxc/lxc_driver.c
|
||||
@@ -3570,8 +3570,12 @@ lxcDomainAttachDeviceNetLive(virLXCDriver *driver,
|
||||
actualBandwidth = virDomainNetGetActualBandwidth(net);
|
||||
if (actualBandwidth) {
|
||||
if (virNetDevSupportsBandwidth(actualType)) {
|
||||
- if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
|
||||
- !virDomainNetTypeSharesHostView(net)) < 0)
|
||||
+ unsigned int flags = 0;
|
||||
+
|
||||
+ if (!virDomainNetTypeSharesHostView(net))
|
||||
+ flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
+
|
||||
+ if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
|
||||
goto cleanup;
|
||||
} else {
|
||||
VIR_WARN("setting bandwidth on interfaces of "
|
||||
diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c
|
||||
index f5eb5383ec..0e689fbb70 100644
|
||||
--- a/src/lxc/lxc_process.c
|
||||
+++ b/src/lxc/lxc_process.c
|
||||
@@ -605,8 +605,12 @@ virLXCProcessSetupInterfaces(virLXCDriver *driver,
|
||||
actualBandwidth = virDomainNetGetActualBandwidth(net);
|
||||
if (actualBandwidth) {
|
||||
if (virNetDevSupportsBandwidth(type)) {
|
||||
- if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
|
||||
- !virDomainNetTypeSharesHostView(net)) < 0)
|
||||
+ unsigned int flags = 0;
|
||||
+
|
||||
+ if (!virDomainNetTypeSharesHostView(net))
|
||||
+ flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
+
|
||||
+ if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
|
||||
goto cleanup;
|
||||
} else {
|
||||
VIR_WARN("setting bandwidth on interfaces of "
|
||||
diff --git a/src/network/bridge_driver.c b/src/network/bridge_driver.c
|
||||
index 32572c755f..1c53636450 100644
|
||||
--- a/src/network/bridge_driver.c
|
||||
+++ b/src/network/bridge_driver.c
|
||||
@@ -2058,8 +2058,11 @@ networkStartNetworkVirtual(virNetworkDriverState *driver,
|
||||
}
|
||||
}
|
||||
|
||||
- if (virNetDevBandwidthSet(def->bridge, def->bandwidth, true, true) < 0)
|
||||
+ if (virNetDevBandwidthSet(def->bridge, def->bandwidth,
|
||||
+ VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
|
||||
+ | VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) < 0) {
|
||||
goto error;
|
||||
+ }
|
||||
|
||||
return 0;
|
||||
|
||||
@@ -2141,8 +2144,11 @@ networkStartNetworkBridge(virNetworkObj *obj)
|
||||
* type BRIDGE, is started. On failure, undo anything you've done,
|
||||
* and return -1. On success return 0.
|
||||
*/
|
||||
- if (virNetDevBandwidthSet(def->bridge, def->bandwidth, true, true) < 0)
|
||||
+ if (virNetDevBandwidthSet(def->bridge, def->bandwidth,
|
||||
+ VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
|
||||
+ | VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) < 0) {
|
||||
goto error;
|
||||
+ }
|
||||
|
||||
if (networkStartHandleMACTableManagerMode(obj) < 0)
|
||||
goto error;
|
||||
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
|
||||
index f15e6bda1e..b4815e5e71 100644
|
||||
--- a/src/qemu/qemu_command.c
|
||||
+++ b/src/qemu/qemu_command.c
|
||||
@@ -8840,9 +8840,14 @@ qemuBuildInterfaceCommandLine(virQEMUDriver *driver,
|
||||
def->uuid,
|
||||
!virDomainNetTypeSharesHostView(net)) < 0)
|
||||
goto cleanup;
|
||||
- } else if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
|
||||
- !virDomainNetTypeSharesHostView(net)) < 0) {
|
||||
- goto cleanup;
|
||||
+ } else {
|
||||
+ unsigned int flags = 0;
|
||||
+
|
||||
+ if (!virDomainNetTypeSharesHostView(net))
|
||||
+ flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
+
|
||||
+ if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
|
||||
+ goto cleanup;
|
||||
}
|
||||
} else {
|
||||
VIR_WARN("setting bandwidth on interfaces of "
|
||||
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
|
||||
index 736602333e..14929616e5 100644
|
||||
--- a/src/qemu/qemu_driver.c
|
||||
+++ b/src/qemu/qemu_driver.c
|
||||
@@ -9941,21 +9941,22 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom,
|
||||
virErrorRestore(&orig_err);
|
||||
goto endjob;
|
||||
}
|
||||
- } else if (virNetDevBandwidthSet(net->ifname, newBandwidth, false,
|
||||
- !virDomainNetTypeSharesHostView(net)) < 0) {
|
||||
- virErrorPtr orig_err;
|
||||
-
|
||||
- virErrorPreserveLast(&orig_err);
|
||||
- ignore_value(virNetDevBandwidthSet(net->ifname,
|
||||
- net->bandwidth,
|
||||
- false,
|
||||
- !virDomainNetTypeSharesHostView(net)));
|
||||
- if (net->bandwidth) {
|
||||
- ignore_value(virDomainNetBandwidthUpdate(net,
|
||||
- net->bandwidth));
|
||||
+ } else {
|
||||
+ unsigned int bwflags = 0;
|
||||
+
|
||||
+ if (!virDomainNetTypeSharesHostView(net))
|
||||
+ bwflags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
+
|
||||
+ if (virNetDevBandwidthSet(net->ifname, newBandwidth, bwflags) < 0) {
|
||||
+ virErrorPtr orig_err;
|
||||
+
|
||||
+ virErrorPreserveLast(&orig_err);
|
||||
+ ignore_value(virNetDevBandwidthSet(net->ifname, net->bandwidth, bwflags));
|
||||
+ if (net->bandwidth)
|
||||
+ ignore_value(virDomainNetBandwidthUpdate(net, net->bandwidth));
|
||||
+ virErrorRestore(&orig_err);
|
||||
+ goto endjob;
|
||||
}
|
||||
- virErrorRestore(&orig_err);
|
||||
- goto endjob;
|
||||
}
|
||||
|
||||
/* If the old bandwidth was cleared out, restore qdisc. */
|
||||
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
|
||||
index 7cb1800504..d5e7e99359 100644
|
||||
--- a/src/qemu/qemu_hotplug.c
|
||||
+++ b/src/qemu/qemu_hotplug.c
|
||||
@@ -1279,9 +1279,14 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver,
|
||||
vm->def->uuid,
|
||||
!virDomainNetTypeSharesHostView(net)) < 0)
|
||||
goto cleanup;
|
||||
- } else if (virNetDevBandwidthSet(net->ifname, actualBandwidth, false,
|
||||
- !virDomainNetTypeSharesHostView(net)) < 0) {
|
||||
- goto cleanup;
|
||||
+ } else {
|
||||
+ int flags = 0;
|
||||
+
|
||||
+ if (!virDomainNetTypeSharesHostView(net))
|
||||
+ flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
+
|
||||
+ if (virNetDevBandwidthSet(net->ifname, actualBandwidth, flags) < 0)
|
||||
+ goto cleanup;
|
||||
}
|
||||
} else {
|
||||
VIR_WARN("setting bandwidth on interfaces of "
|
||||
@@ -4082,9 +4087,14 @@ qemuDomainChangeNet(virQEMUDriver *driver,
|
||||
vm->def->uuid,
|
||||
!virDomainNetTypeSharesHostView(newdev)) < 0)
|
||||
goto cleanup;
|
||||
- } else if (virNetDevBandwidthSet(newdev->ifname, newb, false,
|
||||
- !virDomainNetTypeSharesHostView(newdev)) < 0) {
|
||||
- goto cleanup;
|
||||
+ } else {
|
||||
+ int flags = 0;
|
||||
+
|
||||
+ if (!virDomainNetTypeSharesHostView(newdev))
|
||||
+ flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
+
|
||||
+ if (virNetDevBandwidthSet(newdev->ifname, newb, flags) < 0)
|
||||
+ goto cleanup;
|
||||
}
|
||||
} else {
|
||||
if (virDomainInterfaceClearQoS(vm->def, olddev) < 0)
|
||||
diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
|
||||
index 2b58c58d3e..1baad849c6 100644
|
||||
--- a/src/util/virnetdevbandwidth.c
|
||||
+++ b/src/util/virnetdevbandwidth.c
|
||||
@@ -173,30 +173,35 @@ virNetDevBandwidthManipulateFilter(const char *ifname,
|
||||
* virNetDevBandwidthSet:
|
||||
* @ifname: on which interface
|
||||
* @bandwidth: rates to set (may be NULL)
|
||||
- * @hierarchical_class: whether to create hierarchical class
|
||||
- * @swapped: true if IN/OUT should be set contrariwise
|
||||
+ * @flags: bits indicating certain optional actions
|
||||
*
|
||||
+
|
||||
* This function enables QoS on specified interface
|
||||
* and set given traffic limits for both, incoming
|
||||
- * and outgoing traffic. Any previous setting get
|
||||
- * overwritten. If @hierarchical_class is TRUE, create
|
||||
- * hierarchical class. It is used to guarantee minimal
|
||||
- * throughput ('floor' attribute in NIC).
|
||||
+ * and outgoing traffic.
|
||||
+ *
|
||||
+ * @flags bits and their meanings:
|
||||
+ *
|
||||
+ * VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS
|
||||
+ * whether to create a hierarchical class
|
||||
+ * A hiearchical class structure is used to implement a minimal
|
||||
+ * throughput guarantee ('floor' attribute in NIC).
|
||||
*
|
||||
- * If @swapped is set, the IN part of @bandwidth is set on
|
||||
- * @ifname's TX, and vice versa. If it is not set, IN is set on
|
||||
- * RX and OUT on TX. This is because for some types of interfaces
|
||||
- * domain and the host live on the same side of the interface (so
|
||||
- * domain's RX/TX is host's RX/TX), and for some it's swapped
|
||||
- * (domain's RX/TX is hosts's TX/RX).
|
||||
+ * VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED
|
||||
+ * set if IN/OUT should be set backwards from what's indicated in
|
||||
+ * the bandwidth, i.e. the IN part of @bandwidth is set on
|
||||
+ * @ifname's TX, and the OUT part of @bandwidth is set on
|
||||
+ * @ifname's RX. This is needed because for some types of
|
||||
+ * interfaces the domain and the host live on the same side of the
|
||||
+ * interface (so domain's RX/TX is host's RX/TX), and for some
|
||||
+ * it's swapped (domain's RX/TX is hosts's TX/RX).
|
||||
*
|
||||
* Return 0 on success, -1 otherwise.
|
||||
*/
|
||||
int
|
||||
virNetDevBandwidthSet(const char *ifname,
|
||||
const virNetDevBandwidth *bandwidth,
|
||||
- bool hierarchical_class,
|
||||
- bool swapped)
|
||||
+ unsigned int flags)
|
||||
{
|
||||
int ret = -1;
|
||||
virNetDevBandwidthRate *rx = NULL; /* From domain POV */
|
||||
@@ -205,6 +210,7 @@ virNetDevBandwidthSet(const char *ifname,
|
||||
char *average = NULL;
|
||||
char *peak = NULL;
|
||||
char *burst = NULL;
|
||||
+ bool hierarchical_class = flags & VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
|
||||
|
||||
if (!bandwidth) {
|
||||
/* nothing to be enabled */
|
||||
@@ -224,7 +230,7 @@ virNetDevBandwidthSet(const char *ifname,
|
||||
return -1;
|
||||
}
|
||||
|
||||
- if (swapped) {
|
||||
+ if (flags & VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED) {
|
||||
rx = bandwidth->out;
|
||||
tx = bandwidth->in;
|
||||
} else {
|
||||
diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
|
||||
index 6d268fb119..80dc654486 100644
|
||||
--- a/src/util/virnetdevbandwidth.h
|
||||
+++ b/src/util/virnetdevbandwidth.h
|
||||
@@ -39,11 +39,16 @@ void virNetDevBandwidthFree(virNetDevBandwidth *def);
|
||||
|
||||
G_DEFINE_AUTOPTR_CLEANUP_FUNC(virNetDevBandwidth, virNetDevBandwidthFree);
|
||||
|
||||
+typedef enum {
|
||||
+ VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS = (1 << 0),
|
||||
+ VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED = (1 << 1),
|
||||
+} virNetDevBandwidthSetFlags;
|
||||
+
|
||||
int virNetDevBandwidthSet(const char *ifname,
|
||||
const virNetDevBandwidth *bandwidth,
|
||||
- bool hierarchical_class,
|
||||
- bool swapped)
|
||||
+ unsigned int flags)
|
||||
G_GNUC_WARN_UNUSED_RESULT;
|
||||
+
|
||||
int virNetDevBandwidthClear(const char *ifname);
|
||||
int virNetDevBandwidthCopy(virNetDevBandwidth **dest,
|
||||
const virNetDevBandwidth *src)
|
||||
diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
|
||||
index f7c38faa2e..6529ff4026 100644
|
||||
--- a/tests/virnetdevbandwidthtest.c
|
||||
+++ b/tests/virnetdevbandwidthtest.c
|
||||
@@ -82,8 +82,14 @@ testVirNetDevBandwidthSet(const void *data)
|
||||
if (virNetDevOpenvswitchInterfaceSetQos(iface, band, info->uuid, true) < 0)
|
||||
return -1;
|
||||
} else {
|
||||
+ unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
+
|
||||
+ if (info->hierarchical_class)
|
||||
+ flags |= VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
|
||||
+
|
||||
exp_cmd = info->exp_cmd_tc;
|
||||
- if (virNetDevBandwidthSet(iface, band, info->hierarchical_class, true) < 0)
|
||||
+
|
||||
+ if (virNetDevBandwidthSet(iface, band, flags) < 0)
|
||||
return -1;
|
||||
}
|
||||
|
||||
--
|
||||
2.47.1
|
||||
|
||||
@@ -0,0 +1,105 @@
|
||||
From: Laine Stump <laine@laine.org>
|
||||
Date: Wed, 25 Apr 2018 17:12:03 -0400
|
||||
Subject: [PATCH] nwfilter: increase pcap buffer size to be compatible with
|
||||
TPACKET_V3
|
||||
|
||||
When an nwfilter rule sets the parameter CTRL_IP_LEARNING to "dhcp",
|
||||
this turns on the "dhcpsnoop" thread, which uses libpcap to monitor
|
||||
traffic on the domain's tap device and extract the IP address from the
|
||||
DHCP response.
|
||||
|
||||
If libpcap on the host is built with HAVE_TPACKET3 defined (to enable
|
||||
support for TPACKET_V3), the dhcpsnoop code's initialization of the
|
||||
libpcap socket would fail with the following error:
|
||||
|
||||
virNWFilterSnoopDHCPOpen:1134 : internal error: pcap_setfilter: can't remove kernel filter: Bad file descriptor
|
||||
|
||||
It turns out that this was because TPACKET_V3 requires a larger buffer
|
||||
size than libvirt was setting (we were setting it to 128k). Changing
|
||||
the buffer size to 256k eliminates the error, and the dhcpsnoop thread
|
||||
once again works properly.
|
||||
|
||||
A fuller explanation of why TPACKET_V3 requires such a large buffer,
|
||||
for future git spelunkers:
|
||||
|
||||
libpcap calls setsockopt(... SOL_PACKET, PACKET_RX_RING...) to setup a
|
||||
ring buffer for receiving packets; two of the attributes sent to this
|
||||
API are called tp_frame_size, and tp_frame_nr. If libpcap was built
|
||||
with HAVE_TPACKET3 defined, tp_trame_size is set to MAXIMUM_SNAPLEN
|
||||
(defined in libpcap sources as 262144) and tp_frame_nr is set to:
|
||||
|
||||
[the buffer size we set, i.e. PCAP_BUFFERSIZE i.e. 262144] / tp_frame_size.
|
||||
|
||||
So if PCAP_BUFFERSIZE < MAXIMUM_SNAPLEN, then tp_frame_nr (the number
|
||||
of frames in the ring buffer) is 0, which is nonsensical. This same
|
||||
value is later used as a multiplier to determine the size for a call
|
||||
to malloc() (which would also fail).
|
||||
|
||||
(NB: if HAVE_TPACKET3 is *not* defined, then tp_frame_size is set to
|
||||
the snaplen set by the user (in our case 576) plus a small amount to
|
||||
account for ethernet headers, so 256k is far more than adequate)
|
||||
|
||||
Since the TPACKET_V3 code in libpcap actually reads multiple packets
|
||||
into each frame, it's not a problem to have only a single frame
|
||||
(especially when we are monitoring such infrequent traffic), so it's
|
||||
okay to set this relatively small buffer size (in comparison to the
|
||||
default, which is 2MB), which is important since every guest using
|
||||
dhcp snooping in a nwfilter rule will hold 2 of these buffers for the
|
||||
entire life of the guest.
|
||||
|
||||
Thanks to Christian Ehrhardt for discovering that buffer size was the
|
||||
problem (this was not at all obvious from the error that was logged!)
|
||||
|
||||
Resolves: https://bugzilla.redhat.com/1547237
|
||||
Fixes: https://bugs.launchpad.net/libvirt/+bug/1758037
|
||||
|
||||
Signed-off-by: Laine Stump <laine@laine.org>
|
||||
Reviewed-by: Christian Ehrhardt <christian.ehrhardt@canonical.com> (V1)
|
||||
Reviewed-by: John Ferlan <jferlan@redhat.com>
|
||||
Tested-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
|
||||
Signed-off-by: Cole Robinson <crobinso@redhat.com>
|
||||
---
|
||||
src/nwfilter/nwfilter_dhcpsnoop.c | 22 +++++++++++++++++++---
|
||||
1 file changed, 19 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/src/nwfilter/nwfilter_dhcpsnoop.c b/src/nwfilter/nwfilter_dhcpsnoop.c
|
||||
index 6069e70460..50cfb944a2 100644
|
||||
--- a/src/nwfilter/nwfilter_dhcpsnoop.c
|
||||
+++ b/src/nwfilter/nwfilter_dhcpsnoop.c
|
||||
@@ -256,10 +256,21 @@ struct _virNWFilterDHCPDecodeJob {
|
||||
# define DHCP_BURST_INTERVAL_S 10 /* sec */
|
||||
|
||||
/*
|
||||
- * libpcap 1.5 requires a 128kb buffer
|
||||
- * 128 kb is bigger than (DHCP_PKT_BURST * PCAP_PBUFSIZE / 2)
|
||||
+ * NB: Any libpcap built with HAVE_TPACKET3 will require
|
||||
+ * PCAP_BUFFERSIZE to be at least 262144 (although
|
||||
+ * pcap_set_buffer_size() with a lower value will succeed, and the
|
||||
+ * error will only show up later when pcap_setfilter() is called).
|
||||
+ *
|
||||
+ * It is possible that in the future libpcap could increase the
|
||||
+ * minimum size even further, but due to the fact that each guest
|
||||
+ * using dhcp snooping keeps 2 pcap sockets open (and thus 2 buffers
|
||||
+ * allocated) for the life of the guest, we want to minimize the
|
||||
+ * length of the buffer, so instead of leaving it at the default size
|
||||
+ * (2MB), we are setting it to the minimum viable size and including
|
||||
+ * this clue in the source to help quickly resolve the problem when/if
|
||||
+ * it reoccurs.
|
||||
*/
|
||||
-# define PCAP_BUFFERSIZE (128 * 1024)
|
||||
+# define PCAP_BUFFERSIZE (256 * 1024)
|
||||
|
||||
# define MAX_QUEUED_JOBS (DHCP_PKT_BURST + 2 * DHCP_PKT_RATE)
|
||||
|
||||
@@ -1114,6 +1125,11 @@ virNWFilterSnoopDHCPOpen(const char *ifname, virMacAddr *mac,
|
||||
goto cleanup_nohandle;
|
||||
}
|
||||
|
||||
+ /* IMPORTANT: If there is any failure of *any* pcap_* function
|
||||
+ * during setup of the socket, look to the comment where
|
||||
+ * PCAP_BUFFERSIZE is defined. It may be too small, even if the
|
||||
+ * generated error doesn't imply that.
|
||||
+ */
|
||||
if (pcap_set_snaplen(handle, PCAP_PBUFSIZE) < 0 ||
|
||||
pcap_set_buffer_size(handle, PCAP_BUFFERSIZE) < 0 ||
|
||||
pcap_activate(handle) < 0) {
|
||||
@@ -1,185 +0,0 @@
|
||||
From 490f58382dca2a415a5f16b6133f298d853bb379 Mon Sep 17 00:00:00 2001
|
||||
From: Laine Stump <laine@redhat.com>
|
||||
Date: Mon, 25 Nov 2024 22:24:45 -0500
|
||||
Subject: [PATCH 5/9] util: make it optional to clear existing tc
|
||||
qdiscs/filters in virNetDevBandwidthSet()
|
||||
|
||||
virNetDevBandwidthSet() always clears all existing qdiscs and their
|
||||
subordinate filters before adding all the new qdiscs/filters. This is
|
||||
normally exactly what we want, but there is one case (the network
|
||||
driver) where the Qdisc added by virNetDevBandwidthSet() may already
|
||||
be in use by the nftables backend (which will add a rule to fix the
|
||||
checksum of dhcp packets); in that case, we *don't* want
|
||||
virNetDevBandwidthSet() to clear out the qdisc that was already added
|
||||
for nftables, and none of the bandwidth filters have been added yet,
|
||||
so there already aren't any "old" filters that need to be removed
|
||||
either - it is safe to just skip virNetDevBandwidthClear() in this
|
||||
case.
|
||||
|
||||
To allow the network driver to set bandwidth without first clearing
|
||||
it, this patch adds the flag VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL to the
|
||||
virNetDevBandwidthSetFlags enum, and recognizes it in
|
||||
virNetDevBandwidthSet() - if the flag is set, then
|
||||
virNetDevBandwidth() will call virNetDevBandwidthClear() just as it
|
||||
always has. But if the flag isn't set it *won't* call
|
||||
virNetDevBandwidthClear().
|
||||
|
||||
As suggested above, VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL is set for all
|
||||
calls to virNetdevBandwidthSet() except for two places in the network
|
||||
driver.
|
||||
|
||||
Signed-off-by: Laine Stump <laine@redhat.com>
|
||||
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
||||
---
|
||||
src/lxc/lxc_driver.c | 2 +-
|
||||
src/lxc/lxc_process.c | 2 +-
|
||||
src/qemu/qemu_command.c | 2 +-
|
||||
src/qemu/qemu_driver.c | 2 +-
|
||||
src/qemu/qemu_hotplug.c | 4 ++--
|
||||
src/util/virnetdevbandwidth.c | 21 ++++++++++++++++++++-
|
||||
src/util/virnetdevbandwidth.h | 1 +
|
||||
tests/virnetdevbandwidthtest.c | 3 ++-
|
||||
8 files changed, 29 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/src/lxc/lxc_driver.c b/src/lxc/lxc_driver.c
|
||||
index b693980dbb..81581c74df 100644
|
||||
--- a/src/lxc/lxc_driver.c
|
||||
+++ b/src/lxc/lxc_driver.c
|
||||
@@ -3570,7 +3570,7 @@ lxcDomainAttachDeviceNetLive(virLXCDriver *driver,
|
||||
actualBandwidth = virDomainNetGetActualBandwidth(net);
|
||||
if (actualBandwidth) {
|
||||
if (virNetDevSupportsBandwidth(actualType)) {
|
||||
- unsigned int flags = 0;
|
||||
+ unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
|
||||
|
||||
if (!virDomainNetTypeSharesHostView(net))
|
||||
flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
diff --git a/src/lxc/lxc_process.c b/src/lxc/lxc_process.c
|
||||
index 0e689fbb70..081ce03a57 100644
|
||||
--- a/src/lxc/lxc_process.c
|
||||
+++ b/src/lxc/lxc_process.c
|
||||
@@ -605,7 +605,7 @@ virLXCProcessSetupInterfaces(virLXCDriver *driver,
|
||||
actualBandwidth = virDomainNetGetActualBandwidth(net);
|
||||
if (actualBandwidth) {
|
||||
if (virNetDevSupportsBandwidth(type)) {
|
||||
- unsigned int flags = 0;
|
||||
+ unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
|
||||
|
||||
if (!virDomainNetTypeSharesHostView(net))
|
||||
flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
|
||||
index b4815e5e71..ed54fd4c5b 100644
|
||||
--- a/src/qemu/qemu_command.c
|
||||
+++ b/src/qemu/qemu_command.c
|
||||
@@ -8841,7 +8841,7 @@ qemuBuildInterfaceCommandLine(virQEMUDriver *driver,
|
||||
!virDomainNetTypeSharesHostView(net)) < 0)
|
||||
goto cleanup;
|
||||
} else {
|
||||
- unsigned int flags = 0;
|
||||
+ unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
|
||||
|
||||
if (!virDomainNetTypeSharesHostView(net))
|
||||
flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
|
||||
index 14929616e5..9549065b1f 100644
|
||||
--- a/src/qemu/qemu_driver.c
|
||||
+++ b/src/qemu/qemu_driver.c
|
||||
@@ -9942,7 +9942,7 @@ qemuDomainSetInterfaceParameters(virDomainPtr dom,
|
||||
goto endjob;
|
||||
}
|
||||
} else {
|
||||
- unsigned int bwflags = 0;
|
||||
+ unsigned int bwflags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
|
||||
|
||||
if (!virDomainNetTypeSharesHostView(net))
|
||||
bwflags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
|
||||
index d5e7e99359..ceda4119cd 100644
|
||||
--- a/src/qemu/qemu_hotplug.c
|
||||
+++ b/src/qemu/qemu_hotplug.c
|
||||
@@ -1280,7 +1280,7 @@ qemuDomainAttachNetDevice(virQEMUDriver *driver,
|
||||
!virDomainNetTypeSharesHostView(net)) < 0)
|
||||
goto cleanup;
|
||||
} else {
|
||||
- int flags = 0;
|
||||
+ int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
|
||||
|
||||
if (!virDomainNetTypeSharesHostView(net))
|
||||
flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
@@ -4088,7 +4088,7 @@ qemuDomainChangeNet(virQEMUDriver *driver,
|
||||
!virDomainNetTypeSharesHostView(newdev)) < 0)
|
||||
goto cleanup;
|
||||
} else {
|
||||
- int flags = 0;
|
||||
+ int flags = VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
|
||||
|
||||
if (!virDomainNetTypeSharesHostView(newdev))
|
||||
flags |= VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
|
||||
index 1baad849c6..9c48844c5d 100644
|
||||
--- a/src/util/virnetdevbandwidth.c
|
||||
+++ b/src/util/virnetdevbandwidth.c
|
||||
@@ -196,6 +196,21 @@ virNetDevBandwidthManipulateFilter(const char *ifname,
|
||||
* interface (so domain's RX/TX is host's RX/TX), and for some
|
||||
* it's swapped (domain's RX/TX is hosts's TX/RX).
|
||||
*
|
||||
+ * VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL
|
||||
+ * If VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL is set, then the root
|
||||
+ * qdisc is deleted before adding any new qdisc/class/filter,
|
||||
+ * which causes any pre-existing filters to also be deleted. If
|
||||
+ * not set, then it's assumed that there are no existing rules (or
|
||||
+ * that those already there need to be kept). The caller should
|
||||
+ * set this flag for an existing interface that is having its
|
||||
+ * bandwidth settings modified, but can leave it unset if the
|
||||
+ * interface was newly created and this is the first time
|
||||
+ * bandwidth has been set, but someone else might have already
|
||||
+ * added the qdisc (e.g. this is the case when the network driver
|
||||
+ * is setting bandwidth for a virtual network bridge device - the
|
||||
+ * nftables backend may have already added qdisc handle 1:0 and a
|
||||
+ * filter, and we don't want to delete them)
|
||||
+ *
|
||||
* Return 0 on success, -1 otherwise.
|
||||
*/
|
||||
int
|
||||
@@ -238,7 +253,11 @@ virNetDevBandwidthSet(const char *ifname,
|
||||
tx = bandwidth->out;
|
||||
}
|
||||
|
||||
- virNetDevBandwidthClear(ifname);
|
||||
+ /* Only if the caller requests, clear everything including root
|
||||
+ * qdisc and all filters before adding everything.
|
||||
+ */
|
||||
+ if (flags & VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL)
|
||||
+ virNetDevBandwidthClear(ifname);
|
||||
|
||||
if (tx && tx->average) {
|
||||
average = g_strdup_printf("%llukbps", tx->average);
|
||||
diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
|
||||
index 80dc654486..744aa4c826 100644
|
||||
--- a/src/util/virnetdevbandwidth.h
|
||||
+++ b/src/util/virnetdevbandwidth.h
|
||||
@@ -42,6 +42,7 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC(virNetDevBandwidth, virNetDevBandwidthFree);
|
||||
typedef enum {
|
||||
VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS = (1 << 0),
|
||||
VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED = (1 << 1),
|
||||
+ VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL = (1 << 2),
|
||||
} virNetDevBandwidthSetFlags;
|
||||
|
||||
int virNetDevBandwidthSet(const char *ifname,
|
||||
diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
|
||||
index 6529ff4026..6d5c847ad7 100644
|
||||
--- a/tests/virnetdevbandwidthtest.c
|
||||
+++ b/tests/virnetdevbandwidthtest.c
|
||||
@@ -82,7 +82,8 @@ testVirNetDevBandwidthSet(const void *data)
|
||||
if (virNetDevOpenvswitchInterfaceSetQos(iface, band, info->uuid, true) < 0)
|
||||
return -1;
|
||||
} else {
|
||||
- unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED;
|
||||
+ unsigned int flags = VIR_NETDEV_BANDWIDTH_SET_DIR_SWAPPED |
|
||||
+ VIR_NETDEV_BANDWIDTH_SET_CLEAR_ALL;
|
||||
|
||||
if (info->hierarchical_class)
|
||||
flags |= VIR_NETDEV_BANDWIDTH_SET_HIERARCHICAL_CLASS;
|
||||
--
|
||||
2.47.1
|
||||
|
||||
@@ -0,0 +1,253 @@
|
||||
From: Vincent Bernat <vincent@bernat.im>
|
||||
Date: Tue, 10 Apr 2018 08:27:15 +0200
|
||||
Subject: [PATCH] util: don't check for parallel iteration in hash-related
|
||||
functions
|
||||
|
||||
This is the responsability of the caller to apply the correct lock
|
||||
before using these functions. Moreover, the use of a simple boolean
|
||||
was still racy: two threads may check the boolean and "lock" it
|
||||
simultaneously.
|
||||
|
||||
Users of functions from src/util/virhash.c have to be checked for
|
||||
correctness. Lookups and iteration should hold a RO
|
||||
lock. Modifications should hold a RW lock.
|
||||
|
||||
Most important uses seem to be covered. Callers have now a greater
|
||||
responsability, notably the ability to execute some operations while
|
||||
iterating were reliably forbidden before are now accepted.
|
||||
|
||||
Signed-off-by: Vincent Bernat <vincent@bernat.im>
|
||||
(cherry picked from commit 4d7384eb9ddef2008cb0cc165eb808f74bc83d6b)
|
||||
---
|
||||
src/util/virhash.c | 37 --------------------
|
||||
tests/virhashtest.c | 83 ---------------------------------------------
|
||||
2 files changed, 120 deletions(-)
|
||||
|
||||
diff --git a/src/util/virhash.c b/src/util/virhash.c
|
||||
index 0ffbfcce2c..475c2b0281 100644
|
||||
--- a/src/util/virhash.c
|
||||
+++ b/src/util/virhash.c
|
||||
@@ -41,12 +41,6 @@ VIR_LOG_INIT("util.hash");
|
||||
|
||||
/* #define DEBUG_GROW */
|
||||
|
||||
-#define virHashIterationError(ret) \
|
||||
- do { \
|
||||
- VIR_ERROR(_("Hash operation not allowed during iteration")); \
|
||||
- return ret; \
|
||||
- } while (0)
|
||||
-
|
||||
/*
|
||||
* A single entry in the hash table
|
||||
*/
|
||||
@@ -66,10 +60,6 @@ struct _virHashTable {
|
||||
uint32_t seed;
|
||||
size_t size;
|
||||
size_t nbElems;
|
||||
- /* True iff we are iterating over hash entries. */
|
||||
- bool iterating;
|
||||
- /* Pointer to the current entry during iteration. */
|
||||
- virHashEntryPtr current;
|
||||
virHashDataFree dataFree;
|
||||
virHashKeyCode keyCode;
|
||||
virHashKeyEqual keyEqual;
|
||||
@@ -339,9 +329,6 @@ virHashAddOrUpdateEntry(virHashTablePtr table, const void *name,
|
||||
if ((table == NULL) || (name == NULL))
|
||||
return -1;
|
||||
|
||||
- if (table->iterating)
|
||||
- virHashIterationError(-1);
|
||||
-
|
||||
key = virHashComputeKey(table, name);
|
||||
|
||||
/* Check for duplicate entry */
|
||||
@@ -551,9 +538,6 @@ virHashRemoveEntry(virHashTablePtr table, const void *name)
|
||||
nextptr = table->table + virHashComputeKey(table, name);
|
||||
for (entry = *nextptr; entry; entry = entry->next) {
|
||||
if (table->keyEqual(entry->name, name)) {
|
||||
- if (table->iterating && table->current != entry)
|
||||
- virHashIterationError(-1);
|
||||
-
|
||||
if (table->dataFree)
|
||||
table->dataFree(entry->payload, entry->name);
|
||||
if (table->keyFree)
|
||||
@@ -593,18 +577,11 @@ virHashForEach(virHashTablePtr table, virHashIterator iter, void *data)
|
||||
if (table == NULL || iter == NULL)
|
||||
return -1;
|
||||
|
||||
- if (table->iterating)
|
||||
- virHashIterationError(-1);
|
||||
-
|
||||
- table->iterating = true;
|
||||
- table->current = NULL;
|
||||
for (i = 0; i < table->size; i++) {
|
||||
virHashEntryPtr entry = table->table[i];
|
||||
while (entry) {
|
||||
virHashEntryPtr next = entry->next;
|
||||
- table->current = entry;
|
||||
ret = iter(entry->payload, entry->name, data);
|
||||
- table->current = NULL;
|
||||
|
||||
if (ret < 0)
|
||||
goto cleanup;
|
||||
@@ -615,7 +592,6 @@ virHashForEach(virHashTablePtr table, virHashIterator iter, void *data)
|
||||
|
||||
ret = 0;
|
||||
cleanup:
|
||||
- table->iterating = false;
|
||||
return ret;
|
||||
}
|
||||
|
||||
@@ -643,11 +619,6 @@ virHashRemoveSet(virHashTablePtr table,
|
||||
if (table == NULL || iter == NULL)
|
||||
return -1;
|
||||
|
||||
- if (table->iterating)
|
||||
- virHashIterationError(-1);
|
||||
-
|
||||
- table->iterating = true;
|
||||
- table->current = NULL;
|
||||
for (i = 0; i < table->size; i++) {
|
||||
virHashEntryPtr *nextptr = table->table + i;
|
||||
|
||||
@@ -667,7 +638,6 @@ virHashRemoveSet(virHashTablePtr table,
|
||||
}
|
||||
}
|
||||
}
|
||||
- table->iterating = false;
|
||||
|
||||
return count;
|
||||
}
|
||||
@@ -723,23 +693,16 @@ void *virHashSearch(const virHashTable *ctable,
|
||||
if (table == NULL || iter == NULL)
|
||||
return NULL;
|
||||
|
||||
- if (table->iterating)
|
||||
- virHashIterationError(NULL);
|
||||
-
|
||||
- table->iterating = true;
|
||||
- table->current = NULL;
|
||||
for (i = 0; i < table->size; i++) {
|
||||
virHashEntryPtr entry;
|
||||
for (entry = table->table[i]; entry; entry = entry->next) {
|
||||
if (iter(entry->payload, entry->name, data)) {
|
||||
- table->iterating = false;
|
||||
if (name)
|
||||
*name = table->keyCopy(entry->name);
|
||||
return entry->payload;
|
||||
}
|
||||
}
|
||||
}
|
||||
- table->iterating = false;
|
||||
|
||||
return NULL;
|
||||
}
|
||||
diff --git a/tests/virhashtest.c b/tests/virhashtest.c
|
||||
index 3b85b62c30..e9c03c1afb 100644
|
||||
--- a/tests/virhashtest.c
|
||||
+++ b/tests/virhashtest.c
|
||||
@@ -221,32 +221,6 @@ testHashRemoveForEachAll(void *payload ATTRIBUTE_UNUSED,
|
||||
}
|
||||
|
||||
|
||||
-const int testHashCountRemoveForEachForbidden = ARRAY_CARDINALITY(uuids);
|
||||
-
|
||||
-static int
|
||||
-testHashRemoveForEachForbidden(void *payload ATTRIBUTE_UNUSED,
|
||||
- const void *name,
|
||||
- void *data)
|
||||
-{
|
||||
- virHashTablePtr hash = data;
|
||||
- size_t i;
|
||||
-
|
||||
- for (i = 0; i < ARRAY_CARDINALITY(uuids_subset); i++) {
|
||||
- if (STREQ(uuids_subset[i], name)) {
|
||||
- int next = (i + 1) % ARRAY_CARDINALITY(uuids_subset);
|
||||
-
|
||||
- if (virHashRemoveEntry(hash, uuids_subset[next]) == 0) {
|
||||
- VIR_TEST_VERBOSE(
|
||||
- "\nentry \"%s\" should not be allowed to be removed",
|
||||
- uuids_subset[next]);
|
||||
- }
|
||||
- break;
|
||||
- }
|
||||
- }
|
||||
- return 0;
|
||||
-}
|
||||
-
|
||||
-
|
||||
static int
|
||||
testHashRemoveForEach(const void *data)
|
||||
{
|
||||
@@ -303,61 +277,6 @@ testHashSteal(const void *data ATTRIBUTE_UNUSED)
|
||||
}
|
||||
|
||||
|
||||
-static int
|
||||
-testHashIter(void *payload ATTRIBUTE_UNUSED,
|
||||
- const void *name ATTRIBUTE_UNUSED,
|
||||
- void *data ATTRIBUTE_UNUSED)
|
||||
-{
|
||||
- return 0;
|
||||
-}
|
||||
-
|
||||
-static int
|
||||
-testHashForEachIter(void *payload ATTRIBUTE_UNUSED,
|
||||
- const void *name ATTRIBUTE_UNUSED,
|
||||
- void *data)
|
||||
-{
|
||||
- virHashTablePtr hash = data;
|
||||
-
|
||||
- if (virHashAddEntry(hash, uuids_new[0], NULL) == 0)
|
||||
- VIR_TEST_VERBOSE("\nadding entries in ForEach should be forbidden");
|
||||
-
|
||||
- if (virHashUpdateEntry(hash, uuids_new[0], NULL) == 0)
|
||||
- VIR_TEST_VERBOSE("\nupdating entries in ForEach should be forbidden");
|
||||
-
|
||||
- if (virHashSteal(hash, uuids_new[0]) != NULL)
|
||||
- VIR_TEST_VERBOSE("\nstealing entries in ForEach should be forbidden");
|
||||
-
|
||||
- if (virHashSteal(hash, uuids_new[0]) != NULL)
|
||||
- VIR_TEST_VERBOSE("\nstealing entries in ForEach should be forbidden");
|
||||
-
|
||||
- if (virHashForEach(hash, testHashIter, NULL) >= 0)
|
||||
- VIR_TEST_VERBOSE("\niterating through hash in ForEach"
|
||||
- " should be forbidden");
|
||||
- return 0;
|
||||
-}
|
||||
-
|
||||
-static int
|
||||
-testHashForEach(const void *data ATTRIBUTE_UNUSED)
|
||||
-{
|
||||
- virHashTablePtr hash;
|
||||
- int ret = -1;
|
||||
-
|
||||
- if (!(hash = testHashInit(0)))
|
||||
- return -1;
|
||||
-
|
||||
- if (virHashForEach(hash, testHashForEachIter, hash)) {
|
||||
- VIR_TEST_VERBOSE("\nvirHashForEach didn't go through all entries");
|
||||
- goto cleanup;
|
||||
- }
|
||||
-
|
||||
- ret = 0;
|
||||
-
|
||||
- cleanup:
|
||||
- virHashFree(hash);
|
||||
- return ret;
|
||||
-}
|
||||
-
|
||||
-
|
||||
static int
|
||||
testHashRemoveSetIter(const void *payload ATTRIBUTE_UNUSED,
|
||||
const void *name,
|
||||
@@ -628,9 +547,7 @@ mymain(void)
|
||||
DO_TEST("Remove", Remove);
|
||||
DO_TEST_DATA("Remove in ForEach", RemoveForEach, Some);
|
||||
DO_TEST_DATA("Remove in ForEach", RemoveForEach, All);
|
||||
- DO_TEST_DATA("Remove in ForEach", RemoveForEach, Forbidden);
|
||||
DO_TEST("Steal", Steal);
|
||||
- DO_TEST("Forbidden ops in ForEach", ForEach);
|
||||
DO_TEST("RemoveSet", RemoveSet);
|
||||
DO_TEST("Search", Search);
|
||||
DO_TEST("GetItems", GetItems);
|
||||
@@ -1,98 +0,0 @@
|
||||
From faebbbbfa3b1bd4120852b3f416c8073ab82d5c5 Mon Sep 17 00:00:00 2001
|
||||
From: Laine Stump <laine@redhat.com>
|
||||
Date: Mon, 25 Nov 2024 22:24:46 -0500
|
||||
Subject: [PATCH 6/9] util: put the command that adds a tx filter qdisc into a
|
||||
separate function
|
||||
|
||||
virNetDevBandwidthSet() adds a queue discipline (qdisc) for each
|
||||
interface that it will need to add tc transmit filters to, and the
|
||||
filters are then attached to the qdisc.
|
||||
|
||||
There are other circumstances where some other function will need to
|
||||
add tc transmit filters to an interface (in particular an upcoming
|
||||
patch to the network driver nftables backend that will use a tc tx
|
||||
filter to fix the checksum of dhcp packets), so that function will
|
||||
also need a qdisc for the tx filter. To assure both always use exactly
|
||||
the same qdisc, this patch puts the command that adds the tx filter
|
||||
qdisc into a separate helper function that can (and will) be called
|
||||
from either place
|
||||
|
||||
Signed-off-by: Laine Stump <laine@redhat.com>
|
||||
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
||||
---
|
||||
src/libvirt_private.syms | 1 +
|
||||
src/util/virnetdevbandwidth.c | 30 +++++++++++++++++++++++++-----
|
||||
src/util/virnetdevbandwidth.h | 3 +++
|
||||
3 files changed, 29 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/src/libvirt_private.syms b/src/libvirt_private.syms
|
||||
index d15d6a6a9d..0211cee967 100644
|
||||
--- a/src/libvirt_private.syms
|
||||
+++ b/src/libvirt_private.syms
|
||||
@@ -2859,6 +2859,7 @@ virNetDevVFInterfaceStats;
|
||||
|
||||
|
||||
# util/virnetdevbandwidth.h
|
||||
+virNetDevBandWidthAddTxFilterParentQdisc;
|
||||
virNetDevBandwidthClear;
|
||||
virNetDevBandwidthCopy;
|
||||
virNetDevBandwidthEqual;
|
||||
diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
|
||||
index 9c48844c5d..90eebe6576 100644
|
||||
--- a/src/util/virnetdevbandwidth.c
|
||||
+++ b/src/util/virnetdevbandwidth.c
|
||||
@@ -266,11 +266,7 @@ virNetDevBandwidthSet(const char *ifname,
|
||||
if (tx->burst)
|
||||
burst = g_strdup_printf("%llukb", tx->burst);
|
||||
|
||||
- cmd = virCommandNew(TC);
|
||||
- virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
|
||||
- "handle", "1:", "htb", "default",
|
||||
- hierarchical_class ? "2" : "1", NULL);
|
||||
- if (virCommandRun(cmd, NULL) < 0)
|
||||
+ if (virNetDevBandWidthAddTxFilterParentQdisc(ifname, hierarchical_class) < 0)
|
||||
goto cleanup;
|
||||
|
||||
/* If we are creating a hierarchical class, all non guaranteed traffic
|
||||
@@ -794,3 +790,27 @@ virNetDevBandwidthSetRootQDisc(const char *ifname,
|
||||
|
||||
return 0;
|
||||
}
|
||||
+
|
||||
+/**
|
||||
+ * virNetDevBandwidthAddTxFilterParentQdisc:
|
||||
+ * @ifname: name of interface that needs a qdisc to attach tx filters to
|
||||
+ * @hierarchical_class: true if hierarchical classes will be used on this interface
|
||||
+ *
|
||||
+ * Add a root Qdisc (Queueing Discipline) for attaching Tx filters to
|
||||
+ * @ifname.
|
||||
+ *
|
||||
+ * returns 0 on success, -1 on failure
|
||||
+ */
|
||||
+int
|
||||
+virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
|
||||
+ bool hierarchical_class)
|
||||
+{
|
||||
+ g_autoptr(virCommand) cmd = NULL;
|
||||
+
|
||||
+ cmd = virCommandNew(TC);
|
||||
+ virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
|
||||
+ "handle", "1:", "htb", "default",
|
||||
+ hierarchical_class ? "2" : "1", NULL);
|
||||
+
|
||||
+ return virCommandRun(cmd, NULL);
|
||||
+}
|
||||
diff --git a/src/util/virnetdevbandwidth.h b/src/util/virnetdevbandwidth.h
|
||||
index 744aa4c826..65c1500637 100644
|
||||
--- a/src/util/virnetdevbandwidth.h
|
||||
+++ b/src/util/virnetdevbandwidth.h
|
||||
@@ -84,3 +84,6 @@ int virNetDevBandwidthUpdateFilter(const char *ifname,
|
||||
int virNetDevBandwidthSetRootQDisc(const char *ifname,
|
||||
const char *qdisc)
|
||||
G_NO_INLINE;
|
||||
+
|
||||
+int virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
|
||||
+ bool hierarchical_class);
|
||||
--
|
||||
2.47.1
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
From: Matthias Bolte <matthias.bolte@googlemail.com>
|
||||
Date: Thu, 2 Aug 2018 17:33:37 +0200
|
||||
Subject: [PATCH] esx: Fix double-free and freeing static strings in
|
||||
esxDomainSetAutostart
|
||||
|
||||
Since commit ae83e02f3dd7fe99fed5d8159a35b666fafeafd5#l3393 the
|
||||
newPowerInfo pointer itself is used to track the ownership of the
|
||||
AutoStartPowerInfo object to make Coverity understand the code better.
|
||||
This broke the code that unset some members of the AutoStartPowerInfo
|
||||
object that should not be freed the normal way.
|
||||
|
||||
Instead, transfer ownership of the AutoStartPowerInfo object to the
|
||||
HostAutoStartManagerConfig object before filling in the values that
|
||||
need special handling. This allows to free the AutoStartPowerInfo
|
||||
directly without having to deal with the special values, or to let
|
||||
the old (now restored) logic handle the special values again.
|
||||
|
||||
Signed-off-by: Matthias Bolte <matthias.bolte@googlemail.com>
|
||||
Tested-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
|
||||
Reviewed-by: John Ferlan <jferlan@redhat.com>
|
||||
(cherry picked from commit 3ad77f853230f870efa396636e008292c7f2b1c0)
|
||||
---
|
||||
src/esx/esx_driver.c | 14 ++++----------
|
||||
1 file changed, 4 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/src/esx/esx_driver.c b/src/esx/esx_driver.c
|
||||
index b065cdc513..9a7006c6e5 100644
|
||||
--- a/src/esx/esx_driver.c
|
||||
+++ b/src/esx/esx_driver.c
|
||||
@@ -3422,7 +3422,10 @@ esxDomainSetAutostart(virDomainPtr domain, int autostart)
|
||||
if (esxVI_AutoStartPowerInfo_Alloc(&newPowerInfo) < 0 ||
|
||||
esxVI_Int_Alloc(&newPowerInfo->startOrder) < 0 ||
|
||||
esxVI_Int_Alloc(&newPowerInfo->startDelay) < 0 ||
|
||||
- esxVI_Int_Alloc(&newPowerInfo->stopDelay) < 0) {
|
||||
+ esxVI_Int_Alloc(&newPowerInfo->stopDelay) < 0 ||
|
||||
+ esxVI_AutoStartPowerInfo_AppendToList(&spec->powerInfo,
|
||||
+ newPowerInfo) < 0) {
|
||||
+ esxVI_AutoStartPowerInfo_Free(&newPowerInfo);
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
@@ -3434,13 +3437,6 @@ esxDomainSetAutostart(virDomainPtr domain, int autostart)
|
||||
newPowerInfo->stopDelay->value = -1; /* use system default */
|
||||
newPowerInfo->stopAction = (char *)"none";
|
||||
|
||||
- if (esxVI_AutoStartPowerInfo_AppendToList(&spec->powerInfo,
|
||||
- newPowerInfo) < 0) {
|
||||
- goto cleanup;
|
||||
- }
|
||||
-
|
||||
- newPowerInfo = NULL;
|
||||
-
|
||||
if (esxVI_ReconfigureAutostart
|
||||
(priv->primary,
|
||||
priv->primary->hostSystem->configManager->autoStartManager,
|
||||
@@ -3462,8 +3458,6 @@ esxDomainSetAutostart(virDomainPtr domain, int autostart)
|
||||
esxVI_AutoStartDefaults_Free(&defaults);
|
||||
esxVI_AutoStartPowerInfo_Free(&powerInfoList);
|
||||
|
||||
- esxVI_AutoStartPowerInfo_Free(&newPowerInfo);
|
||||
-
|
||||
return result;
|
||||
}
|
||||
|
||||
@@ -1,107 +0,0 @@
|
||||
From 73c0fb19ce5b816ee81ede691252855c75391c9a Mon Sep 17 00:00:00 2001
|
||||
From: Laine Stump <laine@redhat.com>
|
||||
Date: Mon, 25 Nov 2024 22:24:47 -0500
|
||||
Subject: [PATCH 7/9] util: don't re-add the qdisc used for tx filters if it
|
||||
already exists
|
||||
|
||||
There will soon be two separate users of tc on virtual networks, and
|
||||
both will use the "qdisc root handle 1: htb" to add tx filters. One or the
|
||||
other could get the first chance to add the qdisc, and then if at a
|
||||
later time the other decides to use it, we need to prevent the 2nd
|
||||
user from attempting to re-add the qdisc (because that just generates
|
||||
an error).
|
||||
|
||||
We do this by running "tc qdisc show dev $bridge handle 1:" then
|
||||
checking if the output of that command contains both "qdisc" and " 1:
|
||||
".[*] If it does then the qdisc has already been added. If not then we
|
||||
need to add it now.
|
||||
|
||||
[*]As of this writing, the output more exactly starts with "qdisc
|
||||
htb 1: root", but our comparison is made purposefully generous to
|
||||
increase the chances that it will continue to work properly if tc
|
||||
modifies the format of its output.
|
||||
|
||||
Signed-off-by: Laine Stump <laine@redhat.com>
|
||||
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
||||
---
|
||||
src/util/virnetdevbandwidth.c | 35 ++++++++++++++++++++++++++++------
|
||||
tests/virnetdevbandwidthtest.c | 3 +++
|
||||
2 files changed, 32 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/src/util/virnetdevbandwidth.c b/src/util/virnetdevbandwidth.c
|
||||
index 90eebe6576..5c6a65528c 100644
|
||||
--- a/src/util/virnetdevbandwidth.c
|
||||
+++ b/src/util/virnetdevbandwidth.c
|
||||
@@ -805,12 +805,35 @@ int
|
||||
virNetDevBandWidthAddTxFilterParentQdisc(const char *ifname,
|
||||
bool hierarchical_class)
|
||||
{
|
||||
- g_autoptr(virCommand) cmd = NULL;
|
||||
+ g_autoptr(virCommand) testCmd = NULL;
|
||||
+ g_autofree char *testResult = NULL;
|
||||
|
||||
- cmd = virCommandNew(TC);
|
||||
- virCommandAddArgList(cmd, "qdisc", "add", "dev", ifname, "root",
|
||||
- "handle", "1:", "htb", "default",
|
||||
- hierarchical_class ? "2" : "1", NULL);
|
||||
+ /* first check it the qdisc with handle 1: was already added for
|
||||
+ * this interface by someone else
|
||||
+ */
|
||||
+ testCmd = virCommandNew(TC);
|
||||
+ virCommandAddArgList(testCmd, "qdisc", "show", "dev", ifname,
|
||||
+ "handle", "1:", NULL);
|
||||
+ virCommandSetOutputBuffer(testCmd, &testResult);
|
||||
|
||||
- return virCommandRun(cmd, NULL);
|
||||
+ if (virCommandRun(testCmd, NULL) < 0)
|
||||
+ return -1;
|
||||
+
|
||||
+ /* output will be something like: "qdisc htb 1: root refcnt ..."
|
||||
+ * if the qdisc was already added. We just search for "qdisc" and
|
||||
+ * " 1: " anywhere in the output to allow for tc changing its
|
||||
+ * output format.
|
||||
+ */
|
||||
+ if (!(testResult && strstr(testResult, "qdisc") && strstr(testResult, " 1: "))) {
|
||||
+ /* didn't find qdisc in output, so we need to add one */
|
||||
+ g_autoptr(virCommand) addCmd = virCommandNew(TC);
|
||||
+
|
||||
+ virCommandAddArgList(addCmd, "qdisc", "add", "dev", ifname, "root",
|
||||
+ "handle", "1:", "htb", "default",
|
||||
+ hierarchical_class ? "2" : "1", NULL);
|
||||
+
|
||||
+ return virCommandRun(addCmd, NULL);
|
||||
+ }
|
||||
+
|
||||
+ return 0;
|
||||
}
|
||||
diff --git a/tests/virnetdevbandwidthtest.c b/tests/virnetdevbandwidthtest.c
|
||||
index 6d5c847ad7..31aa7f469d 100644
|
||||
--- a/tests/virnetdevbandwidthtest.c
|
||||
+++ b/tests/virnetdevbandwidthtest.c
|
||||
@@ -147,6 +147,7 @@ mymain(void)
|
||||
"</bandwidth>",
|
||||
TC " qdisc del dev eth0 root\n"
|
||||
TC " qdisc del dev eth0 ingress\n"
|
||||
+ TC " qdisc show dev eth0 handle 1:\n"
|
||||
TC " qdisc add dev eth0 root handle 1: htb default 1\n"
|
||||
TC " class add dev eth0 parent 1: classid 1:1 htb rate 1024kbps quantum 87\n"
|
||||
TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
|
||||
@@ -177,6 +178,7 @@ mymain(void)
|
||||
"</bandwidth>",
|
||||
TC " qdisc del dev eth0 root\n"
|
||||
TC " qdisc del dev eth0 ingress\n"
|
||||
+ TC " qdisc show dev eth0 handle 1:\n"
|
||||
TC " qdisc add dev eth0 root handle 1: htb default 1\n"
|
||||
TC " class add dev eth0 parent 1: classid 1:1 htb rate 1kbps ceil 2kbps burst 4kb quantum 1\n"
|
||||
TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
|
||||
@@ -199,6 +201,7 @@ mymain(void)
|
||||
"</bandwidth>",
|
||||
TC " qdisc del dev eth0 root\n"
|
||||
TC " qdisc del dev eth0 ingress\n"
|
||||
+ TC " qdisc show dev eth0 handle 1:\n"
|
||||
TC " qdisc add dev eth0 root handle 1: htb default 1\n"
|
||||
TC " class add dev eth0 parent 1: classid 1:1 htb rate 4294967295kbps quantum 366503875\n"
|
||||
TC " qdisc add dev eth0 parent 1:1 handle 2: sfq perturb 10\n"
|
||||
--
|
||||
2.47.1
|
||||
|
||||
@@ -0,0 +1,55 @@
|
||||
From 8d6ab7976fa691763fc05a154f2bab865d435b00 Mon Sep 17 00:00:00 2001
|
||||
From: Jiri Denemark <jdenemar@redhat.com>
|
||||
Date: Fri, 5 Apr 2019 11:33:32 +0200
|
||||
Subject: [PATCH 1/4] cpu_x86: Do not cache microcode version
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
The microcode version checks are used to invalidate cached CPU data we
|
||||
get from QEMU. To minimize /proc/cpuinfo parsing the microcode version
|
||||
was only read when libvirtd started and cached for the daemon's
|
||||
lifetime. However, the CPU microcode can change anytime (updating the
|
||||
microcode package can automatically upload it to the CPU) and we need to
|
||||
stop caching it to avoid using stale CPU model data.
|
||||
|
||||
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
||||
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
||||
(cherry picked from commit be46f613261d3b655a1f15afd635087e68a9c39b)
|
||||
---
|
||||
src/cpu/cpu_x86.c | 5 +----
|
||||
1 file changed, 1 insertion(+), 4 deletions(-)
|
||||
|
||||
diff --git a/src/cpu/cpu_x86.c b/src/cpu/cpu_x86.c
|
||||
index b2398c5ad2..38cab15c59 100644
|
||||
--- a/src/cpu/cpu_x86.c
|
||||
+++ b/src/cpu/cpu_x86.c
|
||||
@@ -154,7 +154,6 @@ struct _virCPUx86Map {
|
||||
};
|
||||
|
||||
static virCPUx86MapPtr cpuMap;
|
||||
-static unsigned int microcodeVersion;
|
||||
|
||||
int virCPUx86DriverOnceInit(void);
|
||||
VIR_ONCE_GLOBAL_INIT(virCPUx86Driver);
|
||||
@@ -1413,8 +1412,6 @@ virCPUx86DriverOnceInit(void)
|
||||
if (!(cpuMap = virCPUx86LoadMap()))
|
||||
return -1;
|
||||
|
||||
- microcodeVersion = virHostCPUGetMicrocodeVersion();
|
||||
-
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -2454,7 +2451,7 @@ virCPUx86GetHost(virCPUDefPtr cpu,
|
||||
goto cleanup;
|
||||
|
||||
ret = x86DecodeCPUData(cpu, cpuData, models);
|
||||
- cpu->microcodeVersion = microcodeVersion;
|
||||
+ cpu->microcodeVersion = virHostCPUGetMicrocodeVersion();
|
||||
|
||||
cleanup:
|
||||
virCPUx86DataFree(cpuData);
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@@ -1,171 +0,0 @@
|
||||
From dac9cb9030ac03d18f59884864a0a253e3c9f8f1 Mon Sep 17 00:00:00 2001
|
||||
From: Laine Stump <laine@redhat.com>
|
||||
Date: Mon, 25 Nov 2024 22:24:48 -0500
|
||||
Subject: [PATCH 8/9] util: add new "tc" layer for virFirewallCmd objects
|
||||
|
||||
If the layer of a virFirewallCmd is "tc", then the "tc" utility will
|
||||
be executed using the arguments that had been added to the
|
||||
virFirewallCmd
|
||||
|
||||
tc layer doesn't support auto-rollback command creation (any rollback
|
||||
needs to be added manually with virFirewallAddRollbackCmd()), and also
|
||||
tc layer isn't supported by the iptables backend (it would have been
|
||||
straightforward to add, but the iptables backend doesn't need it, and
|
||||
I didn't want to take the chance of causing a regression in that
|
||||
code for no good reason).
|
||||
|
||||
Signed-off-by: Laine Stump <laine@redhat.com>
|
||||
Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
|
||||
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
||||
---
|
||||
src/network/network_nftables.c | 1 +
|
||||
src/util/virfirewall.c | 66 +++++++++++++++++++++-------------
|
||||
src/util/virfirewall.h | 1 +
|
||||
src/util/virfirewalld.c | 1 +
|
||||
4 files changed, 44 insertions(+), 25 deletions(-)
|
||||
|
||||
diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c
|
||||
index 268d1f12ca..cc184105c3 100644
|
||||
--- a/src/network/network_nftables.c
|
||||
+++ b/src/network/network_nftables.c
|
||||
@@ -73,6 +73,7 @@ VIR_ENUM_IMPL(nftablesLayer,
|
||||
"",
|
||||
"ip",
|
||||
"ip6",
|
||||
+ "",
|
||||
);
|
||||
|
||||
|
||||
diff --git a/src/util/virfirewall.c b/src/util/virfirewall.c
|
||||
index 811b787ecc..9389bcf541 100644
|
||||
--- a/src/util/virfirewall.c
|
||||
+++ b/src/util/virfirewall.c
|
||||
@@ -47,6 +47,7 @@ VIR_ENUM_IMPL(virFirewallLayer,
|
||||
"ethernet",
|
||||
"ipv4",
|
||||
"ipv6",
|
||||
+ "tc",
|
||||
);
|
||||
|
||||
typedef struct _virFirewallGroup virFirewallGroup;
|
||||
@@ -57,6 +58,7 @@ VIR_ENUM_IMPL(virFirewallLayerCommand,
|
||||
EBTABLES,
|
||||
IPTABLES,
|
||||
IP6TABLES,
|
||||
+ TC,
|
||||
);
|
||||
|
||||
struct _virFirewallCmd {
|
||||
@@ -591,6 +593,7 @@ virFirewallCmdIptablesApply(virFirewall *firewall,
|
||||
case VIR_FIREWALL_LAYER_IPV6:
|
||||
virCommandAddArg(cmd, "-w");
|
||||
break;
|
||||
+ case VIR_FIREWALL_LAYER_TC:
|
||||
case VIR_FIREWALL_LAYER_LAST:
|
||||
break;
|
||||
}
|
||||
@@ -672,39 +675,52 @@ virFirewallCmdNftablesApply(virFirewall *firewall G_GNUC_UNUSED,
|
||||
size_t i;
|
||||
int status;
|
||||
|
||||
- cmd = virCommandNew(NFT);
|
||||
+ if (fwCmd->layer == VIR_FIREWALL_LAYER_TC) {
|
||||
|
||||
- if ((virFirewallTransactionGetFlags(firewall) & VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK) &&
|
||||
- fwCmd->argsLen > 1) {
|
||||
- /* skip any leading options to get to command verb */
|
||||
- for (i = 0; i < fwCmd->argsLen - 1; i++) {
|
||||
- if (fwCmd->args[i][0] != '-')
|
||||
- break;
|
||||
- }
|
||||
+ /* for VIR_FIREWALL_LAYER_TC, we run the 'tc' (traffic control) command with
|
||||
+ * the supplied args.
|
||||
+ */
|
||||
+ cmd = virCommandNew(TC);
|
||||
|
||||
- if (i + 1 < fwCmd->argsLen &&
|
||||
- VIR_NFTABLES_ARG_IS_CREATE(fwCmd->args[i])) {
|
||||
+ /* NB: RAW commands don't support auto-rollback command creation */
|
||||
|
||||
- cmdIdx = i;
|
||||
- objectType = fwCmd->args[i + 1];
|
||||
+ } else {
|
||||
|
||||
- /* we currently only handle auto-rollback for rules,
|
||||
- * chains, and tables, and those all can be "rolled
|
||||
- * back" by a delete command using the handle that is
|
||||
- * returned when "-ae" is added to the add/insert
|
||||
- * command.
|
||||
- */
|
||||
- if (STREQ_NULLABLE(objectType, "rule") ||
|
||||
- STREQ_NULLABLE(objectType, "chain") ||
|
||||
- STREQ_NULLABLE(objectType, "table")) {
|
||||
+ cmd = virCommandNew(NFT);
|
||||
|
||||
- needRollback = true;
|
||||
- /* this option to nft instructs it to add the
|
||||
- * "handle" of the created object to stdout
|
||||
+ if ((virFirewallTransactionGetFlags(firewall) & VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK) &&
|
||||
+ fwCmd->argsLen > 1) {
|
||||
+ /* skip any leading options to get to command verb */
|
||||
+ for (i = 0; i < fwCmd->argsLen - 1; i++) {
|
||||
+ if (fwCmd->args[i][0] != '-')
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
+ if (i + 1 < fwCmd->argsLen &&
|
||||
+ VIR_NFTABLES_ARG_IS_CREATE(fwCmd->args[i])) {
|
||||
+
|
||||
+ cmdIdx = i;
|
||||
+ objectType = fwCmd->args[i + 1];
|
||||
+
|
||||
+ /* we currently only handle auto-rollback for rules,
|
||||
+ * chains, and tables, and those all can be "rolled
|
||||
+ * back" by a delete command using the handle that is
|
||||
+ * returned when "-ae" is added to the add/insert
|
||||
+ * command.
|
||||
*/
|
||||
- virCommandAddArg(cmd, "-ae");
|
||||
+ if (STREQ_NULLABLE(objectType, "rule") ||
|
||||
+ STREQ_NULLABLE(objectType, "chain") ||
|
||||
+ STREQ_NULLABLE(objectType, "table")) {
|
||||
+
|
||||
+ needRollback = true;
|
||||
+ /* this option to nft instructs it to add the
|
||||
+ * "handle" of the created object to stdout
|
||||
+ */
|
||||
+ virCommandAddArg(cmd, "-ae");
|
||||
+ }
|
||||
}
|
||||
}
|
||||
+
|
||||
}
|
||||
|
||||
for (i = 0; i < fwCmd->argsLen; i++)
|
||||
diff --git a/src/util/virfirewall.h b/src/util/virfirewall.h
|
||||
index bce51259d2..d42e60884b 100644
|
||||
--- a/src/util/virfirewall.h
|
||||
+++ b/src/util/virfirewall.h
|
||||
@@ -39,6 +39,7 @@ typedef enum {
|
||||
VIR_FIREWALL_LAYER_ETHERNET,
|
||||
VIR_FIREWALL_LAYER_IPV4,
|
||||
VIR_FIREWALL_LAYER_IPV6,
|
||||
+ VIR_FIREWALL_LAYER_TC,
|
||||
|
||||
VIR_FIREWALL_LAYER_LAST,
|
||||
} virFirewallLayer;
|
||||
diff --git a/src/util/virfirewalld.c b/src/util/virfirewalld.c
|
||||
index 827e201dbb..124523c420 100644
|
||||
--- a/src/util/virfirewalld.c
|
||||
+++ b/src/util/virfirewalld.c
|
||||
@@ -43,6 +43,7 @@ VIR_LOG_INIT("util.firewalld");
|
||||
VIR_ENUM_DECL(virFirewallLayerFirewallD);
|
||||
VIR_ENUM_IMPL(virFirewallLayerFirewallD,
|
||||
VIR_FIREWALL_LAYER_LAST,
|
||||
+ "",
|
||||
"eb",
|
||||
"ipv4",
|
||||
"ipv6",
|
||||
--
|
||||
2.47.1
|
||||
|
||||
@@ -1,687 +0,0 @@
|
||||
From b1e2318a0d609fcdff04fcf88953ea87cdd02b95 Mon Sep 17 00:00:00 2001
|
||||
From: Laine Stump <laine@redhat.com>
|
||||
Date: Mon, 25 Nov 2024 22:24:49 -0500
|
||||
Subject: [PATCH 9/9] network: add tc filter rule to nftables backend to fix
|
||||
checksum of DHCP responses
|
||||
|
||||
Please see the commit log for commit v10.9.0-rc1-1-g42ab0148dd for the
|
||||
history and explanation of the problem that this patch is fixing.
|
||||
|
||||
A shorter explanation is that when a guest is connected to a libvirt
|
||||
virtual network using a virtio-net adapter with in-kernel "vhost-net"
|
||||
packet processing enabled, it will fail to acquire an IP address from
|
||||
a DHCP seever running on the host.
|
||||
|
||||
In commit v10.9.0-rc1-1-g42ab0148dd we tried fixing this by *zeroing
|
||||
out* the checksums of these packets with an nftables rule (nftables
|
||||
can't recompute the checksum, but it can set it to 0) . This
|
||||
*appeared* to work initially, but it turned out that zeroing the
|
||||
checksum ends up breaking dhcp packets on *non* virtio/vhost-net guest
|
||||
interfaces. That attempt was reverted in commit v10.9.0-rc2.
|
||||
|
||||
Fortunately, there is an existing way to recompute the checksum of a
|
||||
packet as it leaves an interface - the "tc" (traffic control) utility
|
||||
that libvirt already uses for bandwidth management. This patch uses a
|
||||
tc filter rule to match dhcp response packets on the bridge and
|
||||
recompute their checksum.
|
||||
|
||||
The filter rule must be attached to a tc qdisc, which may also have a
|
||||
filter attached for bandwidth management (in the <bandwidth> element
|
||||
of the network config). Not only must we add the qdisc only once
|
||||
(which was already handled by the patch two prior to this one), but
|
||||
also the filter rule for checksum fixing and the filter rule for
|
||||
bandwidth management must be different priorities so they don't clash;
|
||||
this is solved by adding the checksum-fix filter with "priority 2",
|
||||
while the bandwidth management filter remains "priority 1" (both will
|
||||
always be evaluated anyway, it's just a matter of which is evaluated
|
||||
first).
|
||||
|
||||
So far this method has worked with every different guest we could
|
||||
throw at it, including several that failed with the previous method.
|
||||
|
||||
Fixes: b89c4991daa0ee9371f10937fab3b03c5ffdabc6
|
||||
Reported-by: Rich Jones <rjones@redhat.com>
|
||||
Reported-by: Andrea Bolognani <abologna@redhat.com>
|
||||
Fix-Suggested-by: Eric Garver <egarver@redhat.com>
|
||||
Fix-Suggested-by: Phil Sutter <psutter@redhat.com>
|
||||
Signed-off-by: Laine Stump <laine@redhat.com>
|
||||
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
|
||||
---
|
||||
src/network/network_nftables.c | 68 +++++++++++++++++++
|
||||
.../forward-dev-linux.nftables | 40 +++++++++++
|
||||
.../isolated-linux.nftables | 40 +++++++++++
|
||||
.../nat-default-linux.nftables | 40 +++++++++++
|
||||
.../nat-ipv6-linux.nftables | 40 +++++++++++
|
||||
.../nat-ipv6-masquerade-linux.nftables | 40 +++++++++++
|
||||
.../nat-many-ips-linux.nftables | 40 +++++++++++
|
||||
.../nat-no-dhcp-linux.nftables | 40 +++++++++++
|
||||
.../nat-port-range-ipv6-linux.nftables | 40 +++++++++++
|
||||
.../nat-port-range-linux.nftables | 40 +++++++++++
|
||||
.../nat-tftp-linux.nftables | 40 +++++++++++
|
||||
.../route-default-linux.nftables | 40 +++++++++++
|
||||
12 files changed, 508 insertions(+)
|
||||
|
||||
diff --git a/src/network/network_nftables.c b/src/network/network_nftables.c
|
||||
index cc184105c3..748edb0273 100644
|
||||
--- a/src/network/network_nftables.c
|
||||
+++ b/src/network/network_nftables.c
|
||||
@@ -29,6 +29,7 @@
|
||||
|
||||
#include "internal.h"
|
||||
#include "virfirewalld.h"
|
||||
+#include "vircommand.h"
|
||||
#include "virerror.h"
|
||||
#include "virlog.h"
|
||||
#include "virhash.h"
|
||||
@@ -924,6 +925,67 @@ nftablesAddIPSpecificFirewallRules(virFirewall *fw,
|
||||
}
|
||||
|
||||
|
||||
+/**
|
||||
+ * nftablesAddUdpChecksumFixWithTC:
|
||||
+ *
|
||||
+ * Add a tc filter rule to @ifname (the bridge device of this network)
|
||||
+ * that will recompute the checksum of udp packets output from @iface with
|
||||
+ * destination port @port.
|
||||
+ *
|
||||
+ * Normally the checksum should be filled by some part of the basic
|
||||
+ * network stack, but there are cases (e.g. DHCP response packets sent
|
||||
+ * from virtualization host to a QEMU guest when the guest NIC uses
|
||||
+ * vhost-net packet processing) when the host (sender) thinks that
|
||||
+ * packet checksums will be computed elsewhere (and so leaves a
|
||||
+ * partially computed checksum in the packet header) while the guest
|
||||
+ * (receiver) thinks that the checksum has already been fully
|
||||
+ * computed; in the meantime none of the code in between has actually
|
||||
+ * finished computing the checksum.
|
||||
+ *
|
||||
+ * An example of this is DHCP response packets from host to guest. If
|
||||
+ * the checksum of each of these packets isn't properly computed, then
|
||||
+ * many guests (e.g. FreeBSD) will drop them with reason BAD CHECKSUM;
|
||||
+ * this tc filter rule will fix the ip and udp checksums, and the
|
||||
+ * FreeBSD dhcp client will happily accept the packet.
|
||||
+ *
|
||||
+ * (NB: if you're wondering how the tc qdisc and filter are removed
|
||||
+ * when the network is destroyed, the answer is that the kernel
|
||||
+ * automatically (and properly) removes them for us, so we don't need
|
||||
+ * to worry about keeping track/deleting as we do with nftables rules)
|
||||
+ */
|
||||
+static int
|
||||
+nftablesAddUdpChecksumFixWithTC(virFirewall *fw,
|
||||
+ const char *iface,
|
||||
+ int port)
|
||||
+{
|
||||
+ g_autofree char *portstr = g_strdup_printf("%d", port);
|
||||
+
|
||||
+ /* this will add the qdisc (that the filter below is attached to)
|
||||
+ * unless it already exists
|
||||
+ */
|
||||
+ if (virNetDevBandWidthAddTxFilterParentQdisc(iface, true) < 0)
|
||||
+ return -1;
|
||||
+
|
||||
+ /* add a filter to catch all udp packets with dst "port" and
|
||||
+ * recompute their checksum
|
||||
+ */
|
||||
+ virFirewallAddCmd(fw, VIR_FIREWALL_LAYER_TC,
|
||||
+ "filter", "add", "dev", iface,
|
||||
+ "prio", "2", "protocol", "ip", "parent", "1:",
|
||||
+ "u32", "match", "ip", "dport", portstr, "ffff",
|
||||
+ "action", "csum", "ip", "and", "udp",
|
||||
+ NULL);
|
||||
+
|
||||
+ virFirewallAddRollbackCmd(fw, VIR_FIREWALL_LAYER_TC,
|
||||
+ "filter", "del", "dev", iface,
|
||||
+ "prio", "2", "protocol", "ip", "parent", "1:",
|
||||
+ "u32", "match", "ip", "dport", portstr, "ffff",
|
||||
+ "action", "csum", "ip", "and", "udp",
|
||||
+ NULL);
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+
|
||||
/* nftablesAddFirewallrules:
|
||||
*
|
||||
* @def - the network that needs an nftables firewall added
|
||||
@@ -944,6 +1006,12 @@ nftablesAddFirewallRules(virNetworkDef *def, virFirewall **fwRemoval)
|
||||
|
||||
virFirewallStartTransaction(fw, VIR_FIREWALL_TRANSACTION_AUTO_ROLLBACK);
|
||||
|
||||
+ /* add the tc filter rule needed to fixup the checksum of dhcp
|
||||
+ * response packets going from host to guest.
|
||||
+ */
|
||||
+ if (nftablesAddUdpChecksumFixWithTC(fw, def->bridge, 68) < 0)
|
||||
+ return -1;
|
||||
+
|
||||
nftablesAddGeneralFirewallRules(fw, def);
|
||||
|
||||
for (i = 0;
|
||||
diff --git a/tests/networkxml2firewalldata/forward-dev-linux.nftables b/tests/networkxml2firewalldata/forward-dev-linux.nftables
|
||||
index 8badb74beb..6772383b37 100644
|
||||
--- a/tests/networkxml2firewalldata/forward-dev-linux.nftables
|
||||
+++ b/tests/networkxml2firewalldata/forward-dev-linux.nftables
|
||||
@@ -1,3 +1,43 @@
|
||||
+tc \
|
||||
+qdisc \
|
||||
+show \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+handle \
|
||||
+1:
|
||||
+tc \
|
||||
+qdisc \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+root \
|
||||
+handle \
|
||||
+1: \
|
||||
+htb \
|
||||
+default \
|
||||
+2
|
||||
+tc \
|
||||
+filter \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+prio \
|
||||
+2 \
|
||||
+protocol \
|
||||
+ip \
|
||||
+parent \
|
||||
+1: \
|
||||
+u32 \
|
||||
+match \
|
||||
+ip \
|
||||
+dport \
|
||||
+68 \
|
||||
+ffff \
|
||||
+action \
|
||||
+csum \
|
||||
+ip \
|
||||
+and \
|
||||
+udp
|
||||
nft \
|
||||
-ae insert \
|
||||
rule \
|
||||
diff --git a/tests/networkxml2firewalldata/isolated-linux.nftables b/tests/networkxml2firewalldata/isolated-linux.nftables
|
||||
index d1b4dac178..546a18b75a 100644
|
||||
--- a/tests/networkxml2firewalldata/isolated-linux.nftables
|
||||
+++ b/tests/networkxml2firewalldata/isolated-linux.nftables
|
||||
@@ -1,3 +1,43 @@
|
||||
+tc \
|
||||
+qdisc \
|
||||
+show \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+handle \
|
||||
+1:
|
||||
+tc \
|
||||
+qdisc \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+root \
|
||||
+handle \
|
||||
+1: \
|
||||
+htb \
|
||||
+default \
|
||||
+2
|
||||
+tc \
|
||||
+filter \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+prio \
|
||||
+2 \
|
||||
+protocol \
|
||||
+ip \
|
||||
+parent \
|
||||
+1: \
|
||||
+u32 \
|
||||
+match \
|
||||
+ip \
|
||||
+dport \
|
||||
+68 \
|
||||
+ffff \
|
||||
+action \
|
||||
+csum \
|
||||
+ip \
|
||||
+and \
|
||||
+udp
|
||||
nft \
|
||||
-ae insert \
|
||||
rule \
|
||||
diff --git a/tests/networkxml2firewalldata/nat-default-linux.nftables b/tests/networkxml2firewalldata/nat-default-linux.nftables
|
||||
index 28508292f9..08623c1381 100644
|
||||
--- a/tests/networkxml2firewalldata/nat-default-linux.nftables
|
||||
+++ b/tests/networkxml2firewalldata/nat-default-linux.nftables
|
||||
@@ -1,3 +1,43 @@
|
||||
+tc \
|
||||
+qdisc \
|
||||
+show \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+handle \
|
||||
+1:
|
||||
+tc \
|
||||
+qdisc \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+root \
|
||||
+handle \
|
||||
+1: \
|
||||
+htb \
|
||||
+default \
|
||||
+2
|
||||
+tc \
|
||||
+filter \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+prio \
|
||||
+2 \
|
||||
+protocol \
|
||||
+ip \
|
||||
+parent \
|
||||
+1: \
|
||||
+u32 \
|
||||
+match \
|
||||
+ip \
|
||||
+dport \
|
||||
+68 \
|
||||
+ffff \
|
||||
+action \
|
||||
+csum \
|
||||
+ip \
|
||||
+and \
|
||||
+udp
|
||||
nft \
|
||||
-ae insert \
|
||||
rule \
|
||||
diff --git a/tests/networkxml2firewalldata/nat-ipv6-linux.nftables b/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
|
||||
index d8a9ba706d..3fd6b94eef 100644
|
||||
--- a/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
|
||||
+++ b/tests/networkxml2firewalldata/nat-ipv6-linux.nftables
|
||||
@@ -1,3 +1,43 @@
|
||||
+tc \
|
||||
+qdisc \
|
||||
+show \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+handle \
|
||||
+1:
|
||||
+tc \
|
||||
+qdisc \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+root \
|
||||
+handle \
|
||||
+1: \
|
||||
+htb \
|
||||
+default \
|
||||
+2
|
||||
+tc \
|
||||
+filter \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+prio \
|
||||
+2 \
|
||||
+protocol \
|
||||
+ip \
|
||||
+parent \
|
||||
+1: \
|
||||
+u32 \
|
||||
+match \
|
||||
+ip \
|
||||
+dport \
|
||||
+68 \
|
||||
+ffff \
|
||||
+action \
|
||||
+csum \
|
||||
+ip \
|
||||
+and \
|
||||
+udp
|
||||
nft \
|
||||
-ae insert \
|
||||
rule \
|
||||
diff --git a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
|
||||
index a7f09cda59..2811e098d1 100644
|
||||
--- a/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
|
||||
+++ b/tests/networkxml2firewalldata/nat-ipv6-masquerade-linux.nftables
|
||||
@@ -1,3 +1,43 @@
|
||||
+tc \
|
||||
+qdisc \
|
||||
+show \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+handle \
|
||||
+1:
|
||||
+tc \
|
||||
+qdisc \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+root \
|
||||
+handle \
|
||||
+1: \
|
||||
+htb \
|
||||
+default \
|
||||
+2
|
||||
+tc \
|
||||
+filter \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+prio \
|
||||
+2 \
|
||||
+protocol \
|
||||
+ip \
|
||||
+parent \
|
||||
+1: \
|
||||
+u32 \
|
||||
+match \
|
||||
+ip \
|
||||
+dport \
|
||||
+68 \
|
||||
+ffff \
|
||||
+action \
|
||||
+csum \
|
||||
+ip \
|
||||
+and \
|
||||
+udp
|
||||
nft \
|
||||
-ae insert \
|
||||
rule \
|
||||
diff --git a/tests/networkxml2firewalldata/nat-many-ips-linux.nftables b/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
|
||||
index b826fe6134..5409d5b552 100644
|
||||
--- a/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
|
||||
+++ b/tests/networkxml2firewalldata/nat-many-ips-linux.nftables
|
||||
@@ -1,3 +1,43 @@
|
||||
+tc \
|
||||
+qdisc \
|
||||
+show \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+handle \
|
||||
+1:
|
||||
+tc \
|
||||
+qdisc \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+root \
|
||||
+handle \
|
||||
+1: \
|
||||
+htb \
|
||||
+default \
|
||||
+2
|
||||
+tc \
|
||||
+filter \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+prio \
|
||||
+2 \
|
||||
+protocol \
|
||||
+ip \
|
||||
+parent \
|
||||
+1: \
|
||||
+u32 \
|
||||
+match \
|
||||
+ip \
|
||||
+dport \
|
||||
+68 \
|
||||
+ffff \
|
||||
+action \
|
||||
+csum \
|
||||
+ip \
|
||||
+and \
|
||||
+udp
|
||||
nft \
|
||||
-ae insert \
|
||||
rule \
|
||||
diff --git a/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables b/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
|
||||
index d8a9ba706d..3fd6b94eef 100644
|
||||
--- a/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
|
||||
+++ b/tests/networkxml2firewalldata/nat-no-dhcp-linux.nftables
|
||||
@@ -1,3 +1,43 @@
|
||||
+tc \
|
||||
+qdisc \
|
||||
+show \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+handle \
|
||||
+1:
|
||||
+tc \
|
||||
+qdisc \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+root \
|
||||
+handle \
|
||||
+1: \
|
||||
+htb \
|
||||
+default \
|
||||
+2
|
||||
+tc \
|
||||
+filter \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+prio \
|
||||
+2 \
|
||||
+protocol \
|
||||
+ip \
|
||||
+parent \
|
||||
+1: \
|
||||
+u32 \
|
||||
+match \
|
||||
+ip \
|
||||
+dport \
|
||||
+68 \
|
||||
+ffff \
|
||||
+action \
|
||||
+csum \
|
||||
+ip \
|
||||
+and \
|
||||
+udp
|
||||
nft \
|
||||
-ae insert \
|
||||
rule \
|
||||
diff --git a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
|
||||
index ceaed6fa40..d74417cdb3 100644
|
||||
--- a/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
|
||||
+++ b/tests/networkxml2firewalldata/nat-port-range-ipv6-linux.nftables
|
||||
@@ -1,3 +1,43 @@
|
||||
+tc \
|
||||
+qdisc \
|
||||
+show \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+handle \
|
||||
+1:
|
||||
+tc \
|
||||
+qdisc \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+root \
|
||||
+handle \
|
||||
+1: \
|
||||
+htb \
|
||||
+default \
|
||||
+2
|
||||
+tc \
|
||||
+filter \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+prio \
|
||||
+2 \
|
||||
+protocol \
|
||||
+ip \
|
||||
+parent \
|
||||
+1: \
|
||||
+u32 \
|
||||
+match \
|
||||
+ip \
|
||||
+dport \
|
||||
+68 \
|
||||
+ffff \
|
||||
+action \
|
||||
+csum \
|
||||
+ip \
|
||||
+and \
|
||||
+udp
|
||||
nft \
|
||||
-ae insert \
|
||||
rule \
|
||||
diff --git a/tests/networkxml2firewalldata/nat-port-range-linux.nftables b/tests/networkxml2firewalldata/nat-port-range-linux.nftables
|
||||
index 1dc37a26ec..b55bb287a9 100644
|
||||
--- a/tests/networkxml2firewalldata/nat-port-range-linux.nftables
|
||||
+++ b/tests/networkxml2firewalldata/nat-port-range-linux.nftables
|
||||
@@ -1,3 +1,43 @@
|
||||
+tc \
|
||||
+qdisc \
|
||||
+show \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+handle \
|
||||
+1:
|
||||
+tc \
|
||||
+qdisc \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+root \
|
||||
+handle \
|
||||
+1: \
|
||||
+htb \
|
||||
+default \
|
||||
+2
|
||||
+tc \
|
||||
+filter \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+prio \
|
||||
+2 \
|
||||
+protocol \
|
||||
+ip \
|
||||
+parent \
|
||||
+1: \
|
||||
+u32 \
|
||||
+match \
|
||||
+ip \
|
||||
+dport \
|
||||
+68 \
|
||||
+ffff \
|
||||
+action \
|
||||
+csum \
|
||||
+ip \
|
||||
+and \
|
||||
+udp
|
||||
nft \
|
||||
-ae insert \
|
||||
rule \
|
||||
diff --git a/tests/networkxml2firewalldata/nat-tftp-linux.nftables b/tests/networkxml2firewalldata/nat-tftp-linux.nftables
|
||||
index 28508292f9..08623c1381 100644
|
||||
--- a/tests/networkxml2firewalldata/nat-tftp-linux.nftables
|
||||
+++ b/tests/networkxml2firewalldata/nat-tftp-linux.nftables
|
||||
@@ -1,3 +1,43 @@
|
||||
+tc \
|
||||
+qdisc \
|
||||
+show \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+handle \
|
||||
+1:
|
||||
+tc \
|
||||
+qdisc \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+root \
|
||||
+handle \
|
||||
+1: \
|
||||
+htb \
|
||||
+default \
|
||||
+2
|
||||
+tc \
|
||||
+filter \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+prio \
|
||||
+2 \
|
||||
+protocol \
|
||||
+ip \
|
||||
+parent \
|
||||
+1: \
|
||||
+u32 \
|
||||
+match \
|
||||
+ip \
|
||||
+dport \
|
||||
+68 \
|
||||
+ffff \
|
||||
+action \
|
||||
+csum \
|
||||
+ip \
|
||||
+and \
|
||||
+udp
|
||||
nft \
|
||||
-ae insert \
|
||||
rule \
|
||||
diff --git a/tests/networkxml2firewalldata/route-default-linux.nftables b/tests/networkxml2firewalldata/route-default-linux.nftables
|
||||
index 282c9542a5..76d6902517 100644
|
||||
--- a/tests/networkxml2firewalldata/route-default-linux.nftables
|
||||
+++ b/tests/networkxml2firewalldata/route-default-linux.nftables
|
||||
@@ -1,3 +1,43 @@
|
||||
+tc \
|
||||
+qdisc \
|
||||
+show \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+handle \
|
||||
+1:
|
||||
+tc \
|
||||
+qdisc \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+root \
|
||||
+handle \
|
||||
+1: \
|
||||
+htb \
|
||||
+default \
|
||||
+2
|
||||
+tc \
|
||||
+filter \
|
||||
+add \
|
||||
+dev \
|
||||
+virbr0 \
|
||||
+prio \
|
||||
+2 \
|
||||
+protocol \
|
||||
+ip \
|
||||
+parent \
|
||||
+1: \
|
||||
+u32 \
|
||||
+match \
|
||||
+ip \
|
||||
+dport \
|
||||
+68 \
|
||||
+ffff \
|
||||
+action \
|
||||
+csum \
|
||||
+ip \
|
||||
+and \
|
||||
+udp
|
||||
nft \
|
||||
-ae insert \
|
||||
rule \
|
||||
--
|
||||
2.47.1
|
||||
|
||||
@@ -0,0 +1,155 @@
|
||||
From cb6bcb0312a33a0b6a48d0ee1f368c9080e4a13d Mon Sep 17 00:00:00 2001
|
||||
From: Jiri Denemark <jdenemar@redhat.com>
|
||||
Date: Fri, 12 Apr 2019 21:21:05 +0200
|
||||
Subject: [PATCH 2/4] qemu: Don't cache microcode version
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
My earlier commit be46f61326 was incomplete. It removed caching of
|
||||
microcode version in the CPU driver, which means the capabilities XML
|
||||
will see the correct microcode version. But it is also cached in the
|
||||
QEMU capabilities cache where it is used to detect whether we need to
|
||||
reprobe QEMU. By missing the second place, the original commit
|
||||
be46f61326 made the situation even worse since libvirt would report
|
||||
correct microcode version while still using the old host CPU model
|
||||
(visible in domain capabilities XML).
|
||||
|
||||
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
||||
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
||||
(cherry picked from commit 673c62a3b7855a0685d8f116e227c402720b9ee9)
|
||||
|
||||
CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
|
||||
|
||||
Conflicts:
|
||||
src/qemu/qemu_capabilities.c
|
||||
- virQEMUCapsCacheLookupByArch refactoring (commits
|
||||
7948ad4129a and 1a3de67001c) are missing
|
||||
- commit a7424faff0f "Force QMP capability probing" is
|
||||
missing downstream
|
||||
|
||||
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||
---
|
||||
src/qemu/qemu_capabilities.c | 12 ++++++++----
|
||||
src/qemu/qemu_capabilities.h | 3 +--
|
||||
src/qemu/qemu_driver.c | 9 +--------
|
||||
tests/testutilsqemu.c | 2 +-
|
||||
4 files changed, 11 insertions(+), 15 deletions(-)
|
||||
|
||||
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
|
||||
index b5eb8cf46a..17eb6579bf 100644
|
||||
--- a/src/qemu/qemu_capabilities.c
|
||||
+++ b/src/qemu/qemu_capabilities.c
|
||||
@@ -5343,7 +5343,7 @@ virQEMUCapsNewData(const char *binary,
|
||||
priv->libDir,
|
||||
priv->runUid,
|
||||
priv->runGid,
|
||||
- priv->microcodeVersion,
|
||||
+ virHostCPUGetMicrocodeVersion(),
|
||||
priv->kernelVersion,
|
||||
false);
|
||||
}
|
||||
@@ -5427,8 +5427,7 @@ virFileCachePtr
|
||||
virQEMUCapsCacheNew(const char *libDir,
|
||||
const char *cacheDir,
|
||||
uid_t runUid,
|
||||
- gid_t runGid,
|
||||
- unsigned int microcodeVersion)
|
||||
+ gid_t runGid)
|
||||
{
|
||||
char *capsCacheDir = NULL;
|
||||
virFileCachePtr cache = NULL;
|
||||
@@ -5452,7 +5451,6 @@ virQEMUCapsCacheNew(const char *libDir,
|
||||
|
||||
priv->runUid = runUid;
|
||||
priv->runGid = runGid;
|
||||
- priv->microcodeVersion = microcodeVersion;
|
||||
|
||||
if (uname(&uts) == 0 &&
|
||||
virAsprintf(&priv->kernelVersion, "%s %s", uts.release, uts.version) < 0)
|
||||
@@ -5473,8 +5471,11 @@ virQEMUCapsPtr
|
||||
virQEMUCapsCacheLookup(virFileCachePtr cache,
|
||||
const char *binary)
|
||||
{
|
||||
+ virQEMUCapsCachePrivPtr priv = virFileCacheGetPriv(cache);
|
||||
virQEMUCapsPtr ret = NULL;
|
||||
|
||||
+ priv->microcodeVersion = virHostCPUGetMicrocodeVersion();
|
||||
+
|
||||
ret = virFileCacheLookup(cache, binary);
|
||||
|
||||
VIR_DEBUG("Returning caps %p for %s", ret, binary);
|
||||
@@ -5520,10 +5521,13 @@ virQEMUCapsPtr
|
||||
virQEMUCapsCacheLookupByArch(virFileCachePtr cache,
|
||||
virArch arch)
|
||||
{
|
||||
+ virQEMUCapsCachePrivPtr priv = virFileCacheGetPriv(cache);
|
||||
virQEMUCapsPtr ret = NULL;
|
||||
virArch target;
|
||||
struct virQEMUCapsSearchData data = { .arch = arch };
|
||||
|
||||
+ priv->microcodeVersion = virHostCPUGetMicrocodeVersion();
|
||||
+
|
||||
ret = virFileCacheLookupByFunc(cache, virQEMUCapsCompareArch, &data);
|
||||
if (!ret) {
|
||||
/* If the first attempt at finding capabilities has failed, try
|
||||
diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
|
||||
index c2ec2be193..7fd51f5fa0 100644
|
||||
--- a/src/qemu/qemu_capabilities.h
|
||||
+++ b/src/qemu/qemu_capabilities.h
|
||||
@@ -524,8 +524,7 @@ void virQEMUCapsFilterByMachineType(virQEMUCapsPtr qemuCaps,
|
||||
virFileCachePtr virQEMUCapsCacheNew(const char *libDir,
|
||||
const char *cacheDir,
|
||||
uid_t uid,
|
||||
- gid_t gid,
|
||||
- unsigned int microcodeVersion);
|
||||
+ gid_t gid);
|
||||
virQEMUCapsPtr virQEMUCapsCacheLookup(virFileCachePtr cache,
|
||||
const char *binary);
|
||||
virQEMUCapsPtr virQEMUCapsCacheLookupCopy(virFileCachePtr cache,
|
||||
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
|
||||
index 96454c17c0..bb38904090 100644
|
||||
--- a/src/qemu/qemu_driver.c
|
||||
+++ b/src/qemu/qemu_driver.c
|
||||
@@ -610,8 +610,6 @@ qemuStateInitialize(bool privileged,
|
||||
char *hugepagePath = NULL;
|
||||
char *memoryBackingPath = NULL;
|
||||
size_t i;
|
||||
- virCPUDefPtr hostCPU = NULL;
|
||||
- unsigned int microcodeVersion = 0;
|
||||
|
||||
if (VIR_ALLOC(qemu_driver) < 0)
|
||||
return -1;
|
||||
@@ -831,15 +829,10 @@ qemuStateInitialize(bool privileged,
|
||||
run_gid = cfg->group;
|
||||
}
|
||||
|
||||
- if ((hostCPU = virCPUProbeHost(virArchFromHost())))
|
||||
- microcodeVersion = hostCPU->microcodeVersion;
|
||||
- virCPUDefFree(hostCPU);
|
||||
-
|
||||
qemu_driver->qemuCapsCache = virQEMUCapsCacheNew(cfg->libDir,
|
||||
cfg->cacheDir,
|
||||
run_uid,
|
||||
- run_gid,
|
||||
- microcodeVersion);
|
||||
+ run_gid);
|
||||
if (!qemu_driver->qemuCapsCache)
|
||||
goto error;
|
||||
|
||||
diff --git a/tests/testutilsqemu.c b/tests/testutilsqemu.c
|
||||
index f8182033fc..2c7124bf26 100644
|
||||
--- a/tests/testutilsqemu.c
|
||||
+++ b/tests/testutilsqemu.c
|
||||
@@ -603,7 +603,7 @@ int qemuTestDriverInit(virQEMUDriver *driver)
|
||||
|
||||
/* Using /dev/null for libDir and cacheDir automatically produces errors
|
||||
* upon attempt to use any of them */
|
||||
- driver->qemuCapsCache = virQEMUCapsCacheNew("/dev/null", "/dev/null", 0, 0, 0);
|
||||
+ driver->qemuCapsCache = virQEMUCapsCacheNew("/dev/null", "/dev/null", 0, 0);
|
||||
if (!driver->qemuCapsCache)
|
||||
goto error;
|
||||
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@@ -0,0 +1,886 @@
|
||||
From 36151b10d3e1f8f92f4ad6b8200ce5355b7f96f0 Mon Sep 17 00:00:00 2001
|
||||
From: Jiri Denemark <jdenemar@redhat.com>
|
||||
Date: Fri, 5 Apr 2019 11:19:30 +0200
|
||||
Subject: [PATCH 3/4] cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
||||
(cherry picked from commit 5cd9db3ac11e88846cbcf95fad9f6fae9d880dee)
|
||||
|
||||
CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
|
||||
|
||||
Conflicts:
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
|
||||
- intel-pt feature is missing
|
||||
|
||||
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||
---
|
||||
tests/cputest.c | 1 +
|
||||
.../x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml | 7 +
|
||||
.../x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 8 +
|
||||
.../x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 27 +
|
||||
.../x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 28 +
|
||||
.../x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 11 +
|
||||
.../x86_64-cpuid-Xeon-E3-1225-v5.json | 652 ++++++++++++++++++
|
||||
.../x86_64-cpuid-Xeon-E3-1225-v5.sig | 4 +
|
||||
.../x86_64-cpuid-Xeon-E3-1225-v5.xml | 47 ++
|
||||
9 files changed, 785 insertions(+)
|
||||
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
|
||||
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
|
||||
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
|
||||
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
|
||||
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
|
||||
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
|
||||
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
|
||||
create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
|
||||
|
||||
diff --git a/tests/cputest.c b/tests/cputest.c
|
||||
index 1e79edbef7..2df1d28e39 100644
|
||||
--- a/tests/cputest.c
|
||||
+++ b/tests/cputest.c
|
||||
@@ -1189,6 +1189,7 @@ mymain(void)
|
||||
DO_TEST_CPUID(VIR_ARCH_X86_64, "Phenom-B95", JSON_HOST);
|
||||
DO_TEST_CPUID(VIR_ARCH_X86_64, "Ryzen-7-1800X-Eight-Core", JSON_HOST);
|
||||
DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-5110", JSON_NONE);
|
||||
+ DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1225-v5", JSON_MODELS);
|
||||
DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1245-v5", JSON_MODELS);
|
||||
DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2609-v3", JSON_MODELS);
|
||||
DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2623-v4", JSON_MODELS);
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
|
||||
new file mode 100644
|
||||
index 0000000000..ce51903e53
|
||||
--- /dev/null
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
|
||||
@@ -0,0 +1,7 @@
|
||||
+<!-- Features disabled by QEMU -->
|
||||
+<cpudata arch='x86'>
|
||||
+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1fc' edx='0xb0600000'/>
|
||||
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000008' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
|
||||
+</cpudata>
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
|
||||
new file mode 100644
|
||||
index 0000000000..0deca9fba6
|
||||
--- /dev/null
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
|
||||
@@ -0,0 +1,8 @@
|
||||
+<!-- Features enabled by QEMU -->
|
||||
+<cpudata arch='x86'>
|
||||
+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0xf7fa3203' edx='0x0f8bfbff'/>
|
||||
+ <cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x00000004' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000000'/>
|
||||
+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000007' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
|
||||
+</cpudata>
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
|
||||
new file mode 100644
|
||||
index 0000000000..141c01c841
|
||||
--- /dev/null
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
|
||||
@@ -0,0 +1,27 @@
|
||||
+<cpu mode='custom' match='exact'>
|
||||
+ <model fallback='forbid'>Skylake-Client-IBRS</model>
|
||||
+ <vendor>Intel</vendor>
|
||||
+ <feature policy='require' name='ds'/>
|
||||
+ <feature policy='require' name='acpi'/>
|
||||
+ <feature policy='require' name='ss'/>
|
||||
+ <feature policy='require' name='ht'/>
|
||||
+ <feature policy='require' name='tm'/>
|
||||
+ <feature policy='require' name='pbe'/>
|
||||
+ <feature policy='require' name='dtes64'/>
|
||||
+ <feature policy='require' name='monitor'/>
|
||||
+ <feature policy='require' name='ds_cpl'/>
|
||||
+ <feature policy='require' name='vmx'/>
|
||||
+ <feature policy='require' name='smx'/>
|
||||
+ <feature policy='require' name='est'/>
|
||||
+ <feature policy='require' name='tm2'/>
|
||||
+ <feature policy='require' name='xtpr'/>
|
||||
+ <feature policy='require' name='pdcm'/>
|
||||
+ <feature policy='require' name='osxsave'/>
|
||||
+ <feature policy='require' name='tsc_adjust'/>
|
||||
+ <feature policy='require' name='clflushopt'/>
|
||||
+ <feature policy='require' name='stibp'/>
|
||||
+ <feature policy='require' name='ssbd'/>
|
||||
+ <feature policy='require' name='xsaves'/>
|
||||
+ <feature policy='require' name='pdpe1gb'/>
|
||||
+ <feature policy='require' name='invtsc'/>
|
||||
+</cpu>
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
|
||||
new file mode 100644
|
||||
index 0000000000..53bfc9728d
|
||||
--- /dev/null
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
|
||||
@@ -0,0 +1,28 @@
|
||||
+<cpu>
|
||||
+ <arch>x86_64</arch>
|
||||
+ <model>Skylake-Client-IBRS</model>
|
||||
+ <vendor>Intel</vendor>
|
||||
+ <feature name='ds'/>
|
||||
+ <feature name='acpi'/>
|
||||
+ <feature name='ss'/>
|
||||
+ <feature name='ht'/>
|
||||
+ <feature name='tm'/>
|
||||
+ <feature name='pbe'/>
|
||||
+ <feature name='dtes64'/>
|
||||
+ <feature name='monitor'/>
|
||||
+ <feature name='ds_cpl'/>
|
||||
+ <feature name='vmx'/>
|
||||
+ <feature name='smx'/>
|
||||
+ <feature name='est'/>
|
||||
+ <feature name='tm2'/>
|
||||
+ <feature name='xtpr'/>
|
||||
+ <feature name='pdcm'/>
|
||||
+ <feature name='osxsave'/>
|
||||
+ <feature name='tsc_adjust'/>
|
||||
+ <feature name='clflushopt'/>
|
||||
+ <feature name='stibp'/>
|
||||
+ <feature name='ssbd'/>
|
||||
+ <feature name='xsaves'/>
|
||||
+ <feature name='pdpe1gb'/>
|
||||
+ <feature name='invtsc'/>
|
||||
+</cpu>
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
|
||||
new file mode 100644
|
||||
index 0000000000..1f321db273
|
||||
--- /dev/null
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
|
||||
@@ -0,0 +1,11 @@
|
||||
+<cpu mode='custom' match='exact'>
|
||||
+ <model fallback='forbid'>Skylake-Client-IBRS</model>
|
||||
+ <vendor>Intel</vendor>
|
||||
+ <feature policy='require' name='ss'/>
|
||||
+ <feature policy='require' name='hypervisor'/>
|
||||
+ <feature policy='require' name='tsc_adjust'/>
|
||||
+ <feature policy='require' name='clflushopt'/>
|
||||
+ <feature policy='require' name='stibp'/>
|
||||
+ <feature policy='require' name='ssbd'/>
|
||||
+ <feature policy='require' name='pdpe1gb'/>
|
||||
+</cpu>
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
|
||||
new file mode 100644
|
||||
index 0000000000..084747556b
|
||||
--- /dev/null
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
|
||||
@@ -0,0 +1,652 @@
|
||||
+{
|
||||
+ "return": {
|
||||
+ "model": {
|
||||
+ "name": "base",
|
||||
+ "props": {
|
||||
+ "phys-bits": 0,
|
||||
+ "core-id": -1,
|
||||
+ "xlevel": 2147483656,
|
||||
+ "cmov": true,
|
||||
+ "ia64": false,
|
||||
+ "aes": true,
|
||||
+ "mmx": true,
|
||||
+ "rdpid": false,
|
||||
+ "arat": true,
|
||||
+ "gfni": false,
|
||||
+ "pause-filter": false,
|
||||
+ "xsavec": true,
|
||||
+ "intel-pt": false,
|
||||
+ "osxsave": false,
|
||||
+ "hv-frequencies": false,
|
||||
+ "tsc-frequency": 0,
|
||||
+ "xd": true,
|
||||
+ "hv-vendor-id": "",
|
||||
+ "kvm-asyncpf": true,
|
||||
+ "kvm_asyncpf": true,
|
||||
+ "perfctr_core": false,
|
||||
+ "perfctr-core": false,
|
||||
+ "mpx": true,
|
||||
+ "pbe": false,
|
||||
+ "decodeassists": false,
|
||||
+ "avx512cd": false,
|
||||
+ "sse4_1": true,
|
||||
+ "sse4.1": true,
|
||||
+ "sse4-1": true,
|
||||
+ "family": 6,
|
||||
+ "legacy-cache": true,
|
||||
+ "vmware-cpuid-freq": true,
|
||||
+ "avx512f": false,
|
||||
+ "msr": true,
|
||||
+ "mce": true,
|
||||
+ "mca": true,
|
||||
+ "hv-runtime": false,
|
||||
+ "xcrypt": false,
|
||||
+ "thread-id": -1,
|
||||
+ "min-level": 13,
|
||||
+ "xgetbv1": true,
|
||||
+ "cid": false,
|
||||
+ "hv-relaxed": false,
|
||||
+ "hv-crash": false,
|
||||
+ "ds": false,
|
||||
+ "fxsr": true,
|
||||
+ "xsaveopt": true,
|
||||
+ "xtpr": false,
|
||||
+ "avx512vl": false,
|
||||
+ "avx512-vpopcntdq": false,
|
||||
+ "phe": false,
|
||||
+ "extapic": false,
|
||||
+ "3dnowprefetch": true,
|
||||
+ "avx512vbmi2": false,
|
||||
+ "cr8legacy": false,
|
||||
+ "stibp": true,
|
||||
+ "cpuid-0xb": true,
|
||||
+ "xcrypt-en": false,
|
||||
+ "kvm_pv_eoi": true,
|
||||
+ "apic-id": 4294967295,
|
||||
+ "pn": false,
|
||||
+ "dca": false,
|
||||
+ "vendor": "GenuineIntel",
|
||||
+ "pku": false,
|
||||
+ "smx": false,
|
||||
+ "cmp_legacy": false,
|
||||
+ "cmp-legacy": false,
|
||||
+ "node-id": -1,
|
||||
+ "avx512-4fmaps": false,
|
||||
+ "vmcb_clean": false,
|
||||
+ "vmcb-clean": false,
|
||||
+ "3dnowext": false,
|
||||
+ "hle": true,
|
||||
+ "npt": false,
|
||||
+ "memory": "/machine/unattached/system[0]",
|
||||
+ "clwb": false,
|
||||
+ "lbrv": false,
|
||||
+ "adx": true,
|
||||
+ "ss": true,
|
||||
+ "pni": true,
|
||||
+ "svm_lock": false,
|
||||
+ "svm-lock": false,
|
||||
+ "pfthreshold": false,
|
||||
+ "smep": true,
|
||||
+ "smap": true,
|
||||
+ "x2apic": true,
|
||||
+ "avx512vbmi": false,
|
||||
+ "avx512vnni": false,
|
||||
+ "hv-stimer": false,
|
||||
+ "i64": true,
|
||||
+ "flushbyasid": false,
|
||||
+ "f16c": true,
|
||||
+ "ace2-en": false,
|
||||
+ "pat": true,
|
||||
+ "pae": true,
|
||||
+ "sse": true,
|
||||
+ "phe-en": false,
|
||||
+ "kvm_nopiodelay": true,
|
||||
+ "kvm-nopiodelay": true,
|
||||
+ "tm": false,
|
||||
+ "kvmclock-stable-bit": true,
|
||||
+ "hypervisor": true,
|
||||
+ "socket-id": -1,
|
||||
+ "pcommit": false,
|
||||
+ "syscall": true,
|
||||
+ "level": 13,
|
||||
+ "avx512dq": false,
|
||||
+ "svm": false,
|
||||
+ "full-cpuid-auto-level": true,
|
||||
+ "hv-reset": false,
|
||||
+ "invtsc": false,
|
||||
+ "sse3": true,
|
||||
+ "sse2": true,
|
||||
+ "ssbd": true,
|
||||
+ "est": false,
|
||||
+ "avx512ifma": false,
|
||||
+ "tm2": false,
|
||||
+ "kvm-pv-eoi": true,
|
||||
+ "cx8": true,
|
||||
+ "kvm_mmu": false,
|
||||
+ "kvm-mmu": false,
|
||||
+ "sse4_2": true,
|
||||
+ "sse4.2": true,
|
||||
+ "sse4-2": true,
|
||||
+ "pge": true,
|
||||
+ "fill-mtrr-mask": true,
|
||||
+ "avx512bitalg": false,
|
||||
+ "nodeid_msr": false,
|
||||
+ "pdcm": false,
|
||||
+ "movbe": true,
|
||||
+ "model": 94,
|
||||
+ "nrip_save": false,
|
||||
+ "nrip-save": false,
|
||||
+ "kvm_pv_unhalt": true,
|
||||
+ "ssse3": true,
|
||||
+ "sse4a": false,
|
||||
+ "invpcid": true,
|
||||
+ "pdpe1gb": true,
|
||||
+ "tsc-deadline": true,
|
||||
+ "fma": true,
|
||||
+ "cx16": true,
|
||||
+ "de": true,
|
||||
+ "enforce": false,
|
||||
+ "stepping": 3,
|
||||
+ "xsave": true,
|
||||
+ "clflush": true,
|
||||
+ "skinit": false,
|
||||
+ "tsc": true,
|
||||
+ "tce": false,
|
||||
+ "fpu": true,
|
||||
+ "ibs": false,
|
||||
+ "ds_cpl": false,
|
||||
+ "ds-cpl": false,
|
||||
+ "host-phys-bits": true,
|
||||
+ "fma4": false,
|
||||
+ "la57": false,
|
||||
+ "osvw": false,
|
||||
+ "check": true,
|
||||
+ "hv-spinlocks": -1,
|
||||
+ "pmu": false,
|
||||
+ "pmm": false,
|
||||
+ "apic": true,
|
||||
+ "spec-ctrl": true,
|
||||
+ "min-xlevel2": 0,
|
||||
+ "tsc-adjust": true,
|
||||
+ "tsc_adjust": true,
|
||||
+ "kvm-steal-time": true,
|
||||
+ "kvm_steal_time": true,
|
||||
+ "kvmclock": true,
|
||||
+ "l3-cache": true,
|
||||
+ "lwp": false,
|
||||
+ "ibpb": false,
|
||||
+ "xop": false,
|
||||
+ "avx": true,
|
||||
+ "ospke": false,
|
||||
+ "ace2": false,
|
||||
+ "avx512bw": false,
|
||||
+ "acpi": false,
|
||||
+ "hv-vapic": false,
|
||||
+ "fsgsbase": true,
|
||||
+ "ht": false,
|
||||
+ "nx": true,
|
||||
+ "pclmulqdq": true,
|
||||
+ "mmxext": false,
|
||||
+ "vaes": false,
|
||||
+ "popcnt": true,
|
||||
+ "xsaves": false,
|
||||
+ "tcg-cpuid": true,
|
||||
+ "lm": true,
|
||||
+ "umip": false,
|
||||
+ "pse": true,
|
||||
+ "avx2": true,
|
||||
+ "sep": true,
|
||||
+ "pclmuldq": true,
|
||||
+ "virt-ssbd": false,
|
||||
+ "x-hv-max-vps": -1,
|
||||
+ "nodeid-msr": false,
|
||||
+ "md-clear": true,
|
||||
+ "kvm": true,
|
||||
+ "misalignsse": false,
|
||||
+ "min-xlevel": 2147483656,
|
||||
+ "kvm-pv-unhalt": true,
|
||||
+ "bmi2": true,
|
||||
+ "bmi1": true,
|
||||
+ "realized": false,
|
||||
+ "tsc_scale": false,
|
||||
+ "tsc-scale": false,
|
||||
+ "topoext": false,
|
||||
+ "hv-vpindex": false,
|
||||
+ "xlevel2": 0,
|
||||
+ "clflushopt": true,
|
||||
+ "kvm-no-smi-migration": false,
|
||||
+ "monitor": false,
|
||||
+ "avx512er": false,
|
||||
+ "pmm-en": false,
|
||||
+ "pcid": true,
|
||||
+ "3dnow": false,
|
||||
+ "erms": true,
|
||||
+ "lahf-lm": true,
|
||||
+ "lahf_lm": true,
|
||||
+ "vpclmulqdq": false,
|
||||
+ "fxsr-opt": false,
|
||||
+ "hv-synic": false,
|
||||
+ "xstore": false,
|
||||
+ "fxsr_opt": false,
|
||||
+ "kvm-hint-dedicated": false,
|
||||
+ "rtm": true,
|
||||
+ "lmce": true,
|
||||
+ "hv-time": false,
|
||||
+ "perfctr-nb": false,
|
||||
+ "perfctr_nb": false,
|
||||
+ "ffxsr": false,
|
||||
+ "rdrand": true,
|
||||
+ "rdseed": true,
|
||||
+ "avx512-4vnniw": false,
|
||||
+ "vmx": false,
|
||||
+ "vme": true,
|
||||
+ "dtes64": false,
|
||||
+ "mtrr": true,
|
||||
+ "rdtscp": true,
|
||||
+ "pse36": true,
|
||||
+ "kvm-pv-tlb-flush": false,
|
||||
+ "tbm": false,
|
||||
+ "wdt": false,
|
||||
+ "pause_filter": false,
|
||||
+ "sha-ni": false,
|
||||
+ "model-id": "Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz",
|
||||
+ "abm": true,
|
||||
+ "avx512pf": false,
|
||||
+ "xstore-en": false
|
||||
+ }
|
||||
+ }
|
||||
+ },
|
||||
+ "id": "model-expansion"
|
||||
+}
|
||||
+
|
||||
+{
|
||||
+ "return": [
|
||||
+ {
|
||||
+ "name": "max",
|
||||
+ "typename": "max-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": false
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "host",
|
||||
+ "typename": "host-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": false
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "base",
|
||||
+ "typename": "base-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": true,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "qemu64",
|
||||
+ "typename": "qemu64-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "qemu32",
|
||||
+ "typename": "qemu32-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "phenom",
|
||||
+ "typename": "phenom-x86_64-cpu",
|
||||
+ "unavailable-features": [
|
||||
+ "mmxext",
|
||||
+ "fxsr-opt",
|
||||
+ "3dnowext",
|
||||
+ "3dnow",
|
||||
+ "sse4a",
|
||||
+ "npt"
|
||||
+ ],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "pentium3",
|
||||
+ "typename": "pentium3-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "pentium2",
|
||||
+ "typename": "pentium2-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "pentium",
|
||||
+ "typename": "pentium-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "n270",
|
||||
+ "typename": "n270-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "kvm64",
|
||||
+ "typename": "kvm64-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "kvm32",
|
||||
+ "typename": "kvm32-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "cpu64-rhel6",
|
||||
+ "typename": "cpu64-rhel6-x86_64-cpu",
|
||||
+ "unavailable-features": [
|
||||
+ "sse4a"
|
||||
+ ],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "coreduo",
|
||||
+ "typename": "coreduo-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "core2duo",
|
||||
+ "typename": "core2duo-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "athlon",
|
||||
+ "typename": "athlon-x86_64-cpu",
|
||||
+ "unavailable-features": [
|
||||
+ "mmxext",
|
||||
+ "3dnowext",
|
||||
+ "3dnow"
|
||||
+ ],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Westmere",
|
||||
+ "typename": "Westmere-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Westmere-IBRS",
|
||||
+ "typename": "Westmere-IBRS-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Skylake-Server",
|
||||
+ "typename": "Skylake-Server-x86_64-cpu",
|
||||
+ "unavailable-features": [
|
||||
+ "avx512f",
|
||||
+ "avx512dq",
|
||||
+ "clwb",
|
||||
+ "avx512cd",
|
||||
+ "avx512bw",
|
||||
+ "avx512vl",
|
||||
+ "avx512f",
|
||||
+ "avx512f",
|
||||
+ "avx512f"
|
||||
+ ],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Skylake-Server-IBRS",
|
||||
+ "typename": "Skylake-Server-IBRS-x86_64-cpu",
|
||||
+ "unavailable-features": [
|
||||
+ "avx512f",
|
||||
+ "avx512dq",
|
||||
+ "clwb",
|
||||
+ "avx512cd",
|
||||
+ "avx512bw",
|
||||
+ "avx512vl",
|
||||
+ "avx512f",
|
||||
+ "avx512f",
|
||||
+ "avx512f"
|
||||
+ ],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Skylake-Client",
|
||||
+ "typename": "Skylake-Client-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Skylake-Client-IBRS",
|
||||
+ "typename": "Skylake-Client-IBRS-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "SandyBridge",
|
||||
+ "typename": "SandyBridge-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "SandyBridge-IBRS",
|
||||
+ "typename": "SandyBridge-IBRS-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Penryn",
|
||||
+ "typename": "Penryn-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Opteron_G5",
|
||||
+ "typename": "Opteron_G5-x86_64-cpu",
|
||||
+ "unavailable-features": [
|
||||
+ "sse4a",
|
||||
+ "misalignsse",
|
||||
+ "xop",
|
||||
+ "fma4",
|
||||
+ "tbm"
|
||||
+ ],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Opteron_G4",
|
||||
+ "typename": "Opteron_G4-x86_64-cpu",
|
||||
+ "unavailable-features": [
|
||||
+ "sse4a",
|
||||
+ "misalignsse",
|
||||
+ "xop",
|
||||
+ "fma4"
|
||||
+ ],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Opteron_G3",
|
||||
+ "typename": "Opteron_G3-x86_64-cpu",
|
||||
+ "unavailable-features": [
|
||||
+ "sse4a",
|
||||
+ "misalignsse"
|
||||
+ ],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Opteron_G2",
|
||||
+ "typename": "Opteron_G2-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Opteron_G1",
|
||||
+ "typename": "Opteron_G1-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Nehalem",
|
||||
+ "typename": "Nehalem-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Nehalem-IBRS",
|
||||
+ "typename": "Nehalem-IBRS-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "IvyBridge",
|
||||
+ "typename": "IvyBridge-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "IvyBridge-IBRS",
|
||||
+ "typename": "IvyBridge-IBRS-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Haswell",
|
||||
+ "typename": "Haswell-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Haswell-noTSX",
|
||||
+ "typename": "Haswell-noTSX-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Haswell-noTSX-IBRS",
|
||||
+ "typename": "Haswell-noTSX-IBRS-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Haswell-IBRS",
|
||||
+ "typename": "Haswell-IBRS-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "EPYC",
|
||||
+ "typename": "EPYC-x86_64-cpu",
|
||||
+ "unavailable-features": [
|
||||
+ "sha-ni",
|
||||
+ "mmxext",
|
||||
+ "fxsr-opt",
|
||||
+ "cr8legacy",
|
||||
+ "sse4a",
|
||||
+ "misalignsse",
|
||||
+ "osvw"
|
||||
+ ],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "EPYC-IBPB",
|
||||
+ "typename": "EPYC-IBPB-x86_64-cpu",
|
||||
+ "unavailable-features": [
|
||||
+ "sha-ni",
|
||||
+ "mmxext",
|
||||
+ "fxsr-opt",
|
||||
+ "cr8legacy",
|
||||
+ "sse4a",
|
||||
+ "misalignsse",
|
||||
+ "osvw",
|
||||
+ "ibpb"
|
||||
+ ],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Conroe",
|
||||
+ "typename": "Conroe-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Broadwell",
|
||||
+ "typename": "Broadwell-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Broadwell-noTSX",
|
||||
+ "typename": "Broadwell-noTSX-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Broadwell-noTSX-IBRS",
|
||||
+ "typename": "Broadwell-noTSX-IBRS-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "Broadwell-IBRS",
|
||||
+ "typename": "Broadwell-IBRS-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ },
|
||||
+ {
|
||||
+ "name": "486",
|
||||
+ "typename": "486-x86_64-cpu",
|
||||
+ "unavailable-features": [],
|
||||
+ "static": false,
|
||||
+ "migration-safe": true
|
||||
+ }
|
||||
+ ],
|
||||
+ "id": "definitions"
|
||||
+}
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
|
||||
new file mode 100644
|
||||
index 0000000000..7e57c2ded6
|
||||
--- /dev/null
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
|
||||
@@ -0,0 +1,4 @@
|
||||
+0506e3
|
||||
+family: 6 (0x06)
|
||||
+model: 94 (0x5e)
|
||||
+stepping: 3 (0x03)
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
|
||||
new file mode 100644
|
||||
index 0000000000..437429d61d
|
||||
--- /dev/null
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
|
||||
@@ -0,0 +1,47 @@
|
||||
+<!-- Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz -->
|
||||
+<cpudata arch='x86'>
|
||||
+ <cpuid eax_in='0x00000000' ecx_in='0x00' eax='0x00000016' ebx='0x756e6547' ecx='0x6c65746e' edx='0x49656e69'/>
|
||||
+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x000506e3' ebx='0x06100800' ecx='0x7ffafbff' edx='0xbfebfbff'/>
|
||||
+ <cpuid eax_in='0x00000002' ecx_in='0x00' eax='0x76036301' ebx='0x00f0b6ff' ecx='0x00000000' edx='0x00c30000'/>
|
||||
+ <cpuid eax_in='0x00000003' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000004' ecx_in='0x00' eax='0x1c004121' ebx='0x01c0003f' ecx='0x0000003f' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000004' ecx_in='0x01' eax='0x1c004122' ebx='0x01c0003f' ecx='0x0000003f' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000004' ecx_in='0x02' eax='0x1c004143' ebx='0x00c0003f' ecx='0x000003ff' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000004' ecx_in='0x03' eax='0x1c03c163' ebx='0x03c0003f' ecx='0x00001fff' edx='0x00000006'/>
|
||||
+ <cpuid eax_in='0x00000005' ecx_in='0x00' eax='0x00000040' ebx='0x00000040' ecx='0x00000003' edx='0x00142120'/>
|
||||
+ <cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x000027f7' ebx='0x00000002' ecx='0x00000009' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x029c6fbf' ecx='0x00000000' edx='0x9c002400'/>
|
||||
+ <cpuid eax_in='0x00000008' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000009' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x0000000a' ecx_in='0x00' eax='0x07300804' ebx='0x00000000' ecx='0x00000000' edx='0x00000603'/>
|
||||
+ <cpuid eax_in='0x0000000b' ecx_in='0x00' eax='0x00000001' ebx='0x00000001' ecx='0x00000100' edx='0x00000006'/>
|
||||
+ <cpuid eax_in='0x0000000b' ecx_in='0x01' eax='0x00000004' ebx='0x00000004' ecx='0x00000201' edx='0x00000006'/>
|
||||
+ <cpuid eax_in='0x0000000c' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x0000000d' ecx_in='0x00' eax='0x0000001f' ebx='0x00000440' ecx='0x00000440' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x0000000f' ebx='0x000003c0' ecx='0x00000100' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x0000000d' ecx_in='0x02' eax='0x00000100' ebx='0x00000240' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x0000000d' ecx_in='0x03' eax='0x00000040' ebx='0x000003c0' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x0000000d' ecx_in='0x04' eax='0x00000040' ebx='0x00000400' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x0000000d' ecx_in='0x08' eax='0x00000080' ebx='0x00000000' ecx='0x00000001' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x0000000e' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x0000000f' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000010' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000011' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000012' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000013' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000014' ecx_in='0x00' eax='0x00000001' ebx='0x0000000f' ecx='0x00000007' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000014' ecx_in='0x01' eax='0x02490002' ebx='0x003f3fff' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000015' ecx_in='0x00' eax='0x00000002' ebx='0x00000114' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x00000016' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x80000000' ecx_in='0x00' eax='0x80000008' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
|
||||
+ <cpuid eax_in='0x80000002' ecx_in='0x00' eax='0x65746e49' ebx='0x2952286c' ecx='0x6f655820' edx='0x2952286e'/>
|
||||
+ <cpuid eax_in='0x80000003' ecx_in='0x00' eax='0x55504320' ebx='0x2d334520' ecx='0x35323231' edx='0x20357620'/>
|
||||
+ <cpuid eax_in='0x80000004' ecx_in='0x00' eax='0x2e332040' ebx='0x48473033' ecx='0x0000007a' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x80000005' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x80000006' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x01006040' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
|
||||
+ <cpuid eax_in='0x80000008' ecx_in='0x00' eax='0x00003027' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0x80860000' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
|
||||
+ <cpuid eax_in='0xc0000000' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
|
||||
+</cpudata>
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@@ -1,51 +0,0 @@
|
||||
From 114c0ec656e879ab4d67919914bb24cf5993106d Mon Sep 17 00:00:00 2001
|
||||
Message-ID: <114c0ec656e879ab4d67919914bb24cf5993106d.1734201785.git.crobinso@redhat.com>
|
||||
From: Laine Stump <laine@redhat.com>
|
||||
Date: Mon, 2 Sep 2024 16:13:08 -0400
|
||||
Subject: [PATCH] network: permit <forward mode='open'/> when a network has no
|
||||
IP address
|
||||
Content-type: text/plain
|
||||
|
||||
The whole point of <forward mode='open'/> is to supress libvirt from
|
||||
adding any firewall rules for a network, and someone might want to
|
||||
create a network with no IP address (i.e. they don't want the guests
|
||||
to have connectivity to the host via this interface) and no firewall
|
||||
rules (they don't want any, or they want to add their own). So there's
|
||||
no reason to fail when a network has <forward mode='open'/> and also
|
||||
has no IP address.
|
||||
|
||||
Kind-of-Resolves: https://gitlab.com/libvirt/libvirt/-/issues/588
|
||||
Signed-off-by: Laine Stump <laine@redhat.com>
|
||||
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
|
||||
Signed-off-by: Cole Robinson <crobinso@redhat.com>
|
||||
---
|
||||
src/conf/network_conf.c | 5 +++--
|
||||
1 file changed, 3 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/src/conf/network_conf.c b/src/conf/network_conf.c
|
||||
index 5cf419acf1..320e1b089a 100644
|
||||
--- a/src/conf/network_conf.c
|
||||
+++ b/src/conf/network_conf.c
|
||||
@@ -1789,7 +1789,6 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt,
|
||||
|
||||
case VIR_NETWORK_FORWARD_ROUTE:
|
||||
case VIR_NETWORK_FORWARD_NAT:
|
||||
- case VIR_NETWORK_FORWARD_OPEN:
|
||||
/* It's pointless to specify L3 forwarding without specifying
|
||||
* the network we're on.
|
||||
*/
|
||||
@@ -1806,8 +1805,10 @@ virNetworkDefParseXML(xmlXPathContextPtr ctxt,
|
||||
def->name);
|
||||
return NULL;
|
||||
}
|
||||
+ break;
|
||||
|
||||
- if (def->forward.type == VIR_NETWORK_FORWARD_OPEN && def->forward.nifs) {
|
||||
+ case VIR_NETWORK_FORWARD_OPEN:
|
||||
+ if (def->forward.nifs) {
|
||||
/* an open network by definition can't place any restrictions
|
||||
* on what traffic is allowed or where it goes, so specifying
|
||||
* a forwarding device is nonsensical.
|
||||
--
|
||||
2.47.1
|
||||
|
||||
@@ -0,0 +1,105 @@
|
||||
From 7bde733e906a9eb513448fd58201a333a1793811 Mon Sep 17 00:00:00 2001
|
||||
From: Jiri Denemark <jdenemar@redhat.com>
|
||||
Date: Fri, 5 Apr 2019 15:11:20 +0200
|
||||
Subject: [PATCH 4/4] cpu_map: Define md-clear CPUID bit
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
CVE-2018-12126, CVE-2018-12127, CVE-2018-12130
|
||||
|
||||
The bit is set when microcode provides the mechanism to invoke a flush
|
||||
of various exploitable CPU buffers by invoking the VERW instruction.
|
||||
|
||||
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
||||
Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
|
||||
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||
(cherry picked from commit 538d873571d7a682852dc1d70e5f4478f4d64e85)
|
||||
|
||||
Conflicts:
|
||||
src/cpu_map/x86_features.xml
|
||||
- no CPU map split downstream
|
||||
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml
|
||||
- test data missing downstream
|
||||
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
|
||||
- intel-pt feature is missing downstream
|
||||
|
||||
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||
---
|
||||
src/cpu/cpu_map.xml | 3 +++
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 2 +-
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 1 +
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 1 +
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 1 +
|
||||
5 files changed, 7 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/cpu/cpu_map.xml b/src/cpu/cpu_map.xml
|
||||
index 96daa0f9af..250e241df9 100644
|
||||
--- a/src/cpu/cpu_map.xml
|
||||
+++ b/src/cpu/cpu_map.xml
|
||||
@@ -295,6 +295,9 @@
|
||||
<feature name='avx512-4fmaps'>
|
||||
<cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000008'/>
|
||||
</feature>
|
||||
+ <feature name='md-clear'> <!-- md_clear -->
|
||||
+ <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000400'/>
|
||||
+ </feature>
|
||||
<feature name='spec-ctrl'>
|
||||
<cpuid eax_in='0x07' ecx_in='0x00' edx='0x04000000'/>
|
||||
</feature>
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
|
||||
index 0deca9fba6..74763a462b 100644
|
||||
--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
|
||||
@@ -2,7 +2,7 @@
|
||||
<cpudata arch='x86'>
|
||||
<cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0xf7fa3203' edx='0x0f8bfbff'/>
|
||||
<cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x00000004' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000000'/>
|
||||
+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000400'/>
|
||||
<cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000007' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
|
||||
<cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
|
||||
</cpudata>
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
|
||||
index 141c01c841..3b3472742e 100644
|
||||
--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
|
||||
@@ -19,6 +19,7 @@
|
||||
<feature policy='require' name='osxsave'/>
|
||||
<feature policy='require' name='tsc_adjust'/>
|
||||
<feature policy='require' name='clflushopt'/>
|
||||
+ <feature policy='require' name='md-clear'/>
|
||||
<feature policy='require' name='stibp'/>
|
||||
<feature policy='require' name='ssbd'/>
|
||||
<feature policy='require' name='xsaves'/>
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
|
||||
index 53bfc9728d..df4f97417c 100644
|
||||
--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
|
||||
@@ -20,6 +20,7 @@
|
||||
<feature name='osxsave'/>
|
||||
<feature name='tsc_adjust'/>
|
||||
<feature name='clflushopt'/>
|
||||
+ <feature name='md-clear'/>
|
||||
<feature name='stibp'/>
|
||||
<feature name='ssbd'/>
|
||||
<feature name='xsaves'/>
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
|
||||
index 1f321db273..a5591278df 100644
|
||||
--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
|
||||
@@ -5,6 +5,7 @@
|
||||
<feature policy='require' name='hypervisor'/>
|
||||
<feature policy='require' name='tsc_adjust'/>
|
||||
<feature policy='require' name='clflushopt'/>
|
||||
+ <feature policy='require' name='md-clear'/>
|
||||
<feature policy='require' name='stibp'/>
|
||||
<feature policy='require' name='ssbd'/>
|
||||
<feature policy='require' name='pdpe1gb'/>
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@@ -1,64 +0,0 @@
|
||||
From d51179fa82448f4720f1645f0b7100df80508cc4 Mon Sep 17 00:00:00 2001
|
||||
From: Pavel Hrdina <phrdina@redhat.com>
|
||||
Date: Thu, 9 Jan 2025 16:23:44 +0100
|
||||
Subject: [PATCH] qemu: snapshot: delete disk image only if parent snapshot is
|
||||
external
|
||||
Content-type: text/plain
|
||||
|
||||
When we are deleting external snapshot that is not active we only need
|
||||
to delete overlay disk image of the parent snapshot. This works
|
||||
correctly even if parent snapshot is external and active as it will have
|
||||
another overlay created when user reverted to that snapshot.
|
||||
|
||||
In case the parent snapshot is internal there are no overlay disk images
|
||||
created as everything is stored internally within the disk image. In
|
||||
this case we would delete the actual disk image storing internal
|
||||
snapshots and most likely the original disk image as well resulting in
|
||||
data loss once the VM is shutoff.
|
||||
|
||||
Fixes: https://gitlab.com/libvirt/libvirt/-/issues/734
|
||||
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
|
||||
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
|
||||
---
|
||||
src/qemu/qemu_snapshot.c | 14 ++++++++------
|
||||
1 file changed, 8 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/src/qemu/qemu_snapshot.c b/src/qemu/qemu_snapshot.c
|
||||
index 18b2e478f6..80cd54bf33 100644
|
||||
--- a/src/qemu/qemu_snapshot.c
|
||||
+++ b/src/qemu/qemu_snapshot.c
|
||||
@@ -3144,6 +3144,8 @@ qemuSnapshotDeleteExternalPrepareData(virDomainObj *vm,
|
||||
return -1;
|
||||
}
|
||||
|
||||
+ data->parentSnap = qemuSnapshotFindParentSnapForDisk(snap, data->snapDisk);
|
||||
+
|
||||
if (data->merge) {
|
||||
virStorageSource *snapDiskSrc = NULL;
|
||||
|
||||
@@ -3185,8 +3187,6 @@ qemuSnapshotDeleteExternalPrepareData(virDomainObj *vm,
|
||||
qemuSnapshotGetDisksWithBackingStore(vm, snap, data);
|
||||
}
|
||||
|
||||
- data->parentSnap = qemuSnapshotFindParentSnapForDisk(snap, data->snapDisk);
|
||||
-
|
||||
if (data->parentSnap && !virDomainSnapshotIsExternal(data->parentSnap)) {
|
||||
virReportError(VIR_ERR_OPERATION_UNSUPPORTED, "%s",
|
||||
_("deleting external snapshot that has internal snapshot as parent not supported"));
|
||||
@@ -3642,10 +3642,12 @@ qemuSnapshotDiscardExternal(virDomainObj *vm,
|
||||
if (!data->job)
|
||||
goto error;
|
||||
} else {
|
||||
- if (virStorageSourceInit(data->parentDomDisk->src) < 0 ||
|
||||
- virStorageSourceUnlink(data->parentDomDisk->src) < 0) {
|
||||
- VIR_WARN("Failed to remove snapshot image '%s'",
|
||||
- data->snapDisk->name);
|
||||
+ if (data->parentSnap && virDomainSnapshotIsExternal(data->parentSnap)) {
|
||||
+ if (virStorageSourceInit(data->parentDomDisk->src) < 0 ||
|
||||
+ virStorageSourceUnlink(data->parentDomDisk->src) < 0) {
|
||||
+ VIR_WARN("Failed to remove snapshot image '%s'",
|
||||
+ data->snapDisk->name);
|
||||
+ }
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
From 4cb90fa2335b75a0fc39440853bd681955b326a4 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
||||
Date: Tue, 14 May 2019 21:09:59 +0100
|
||||
Subject: [PATCH] cputest: remove stibp flag from test data
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
stibp flag doesn't exist in this maint branch.
|
||||
|
||||
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||
---
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 1 -
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 1 -
|
||||
tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 1 -
|
||||
3 files changed, 3 deletions(-)
|
||||
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
|
||||
index 3b3472742e..29c1fdb80a 100644
|
||||
--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
|
||||
@@ -20,7 +20,6 @@
|
||||
<feature policy='require' name='tsc_adjust'/>
|
||||
<feature policy='require' name='clflushopt'/>
|
||||
<feature policy='require' name='md-clear'/>
|
||||
- <feature policy='require' name='stibp'/>
|
||||
<feature policy='require' name='ssbd'/>
|
||||
<feature policy='require' name='xsaves'/>
|
||||
<feature policy='require' name='pdpe1gb'/>
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
|
||||
index df4f97417c..2003ca9ef6 100644
|
||||
--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
|
||||
@@ -21,7 +21,6 @@
|
||||
<feature name='tsc_adjust'/>
|
||||
<feature name='clflushopt'/>
|
||||
<feature name='md-clear'/>
|
||||
- <feature name='stibp'/>
|
||||
<feature name='ssbd'/>
|
||||
<feature name='xsaves'/>
|
||||
<feature name='pdpe1gb'/>
|
||||
diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
|
||||
index a5591278df..d6529c59a3 100644
|
||||
--- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
|
||||
+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
|
||||
@@ -6,7 +6,6 @@
|
||||
<feature policy='require' name='tsc_adjust'/>
|
||||
<feature policy='require' name='clflushopt'/>
|
||||
<feature policy='require' name='md-clear'/>
|
||||
- <feature policy='require' name='stibp'/>
|
||||
<feature policy='require' name='ssbd'/>
|
||||
<feature policy='require' name='pdpe1gb'/>
|
||||
</cpu>
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@@ -0,0 +1,58 @@
|
||||
From 39fb5ab3125d1669344bab94ccb71bce814d9ae2 Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
||||
Date: Tue, 30 Apr 2019 17:26:13 +0100
|
||||
Subject: [PATCH 1/3] admin: reject clients unless their UID matches the
|
||||
current UID
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
The admin protocol RPC messages are only intended for use by the user
|
||||
running the daemon. As such they should not be allowed for any client
|
||||
UID that does not match the server UID.
|
||||
|
||||
Fixes CVE-2019-10132
|
||||
|
||||
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
||||
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||
(cherry picked from commit 96f41cd765c9e525fe28ee5abbfbf4a79b3720c7)
|
||||
---
|
||||
src/admin/admin_server_dispatch.c | 22 ++++++++++++++++++++++
|
||||
1 file changed, 22 insertions(+)
|
||||
|
||||
diff --git a/src/admin/admin_server_dispatch.c b/src/admin/admin_server_dispatch.c
|
||||
index b78ff902c0..9f25813ae3 100644
|
||||
--- a/src/admin/admin_server_dispatch.c
|
||||
+++ b/src/admin/admin_server_dispatch.c
|
||||
@@ -66,6 +66,28 @@ remoteAdmClientNew(virNetServerClientPtr client ATTRIBUTE_UNUSED,
|
||||
void *opaque)
|
||||
{
|
||||
struct daemonAdmClientPrivate *priv;
|
||||
+ uid_t clientuid;
|
||||
+ gid_t clientgid;
|
||||
+ pid_t clientpid;
|
||||
+ unsigned long long timestamp;
|
||||
+
|
||||
+ if (virNetServerClientGetUNIXIdentity(client,
|
||||
+ &clientuid,
|
||||
+ &clientgid,
|
||||
+ &clientpid,
|
||||
+ ×tamp) < 0)
|
||||
+ return NULL;
|
||||
+
|
||||
+ VIR_DEBUG("New client pid %lld uid %lld",
|
||||
+ (long long)clientpid,
|
||||
+ (long long)clientuid);
|
||||
+
|
||||
+ if (geteuid() != clientuid) {
|
||||
+ virReportRestrictedError(_("Disallowing client %lld with uid %lld"),
|
||||
+ (long long)clientpid,
|
||||
+ (long long)clientuid);
|
||||
+ return NULL;
|
||||
+ }
|
||||
|
||||
if (VIR_ALLOC(priv) < 0)
|
||||
return NULL;
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
From 41f06e6095e17b61b2af35821d204afc5c34777c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
||||
Date: Tue, 30 Apr 2019 16:51:37 +0100
|
||||
Subject: [PATCH 2/3] locking: restrict sockets to mode 0600
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
The virtlockd daemon's only intended client is the libvirtd daemon. As
|
||||
such it should never allow clients from other user accounts to connect.
|
||||
The code already enforces this and drops clients from other UIDs, but
|
||||
we can get earlier (and thus stronger) protection against DoS by setting
|
||||
the socket permissions to 0600
|
||||
|
||||
Fixes CVE-2019-10132
|
||||
|
||||
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
||||
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||
(cherry picked from commit f111e09468693909b1f067aa575efdafd9a262a1)
|
||||
---
|
||||
src/locking/virtlockd-admin.socket.in | 1 +
|
||||
src/locking/virtlockd.socket.in | 1 +
|
||||
2 files changed, 2 insertions(+)
|
||||
|
||||
diff --git a/src/locking/virtlockd-admin.socket.in b/src/locking/virtlockd-admin.socket.in
|
||||
index 2a7500f3d0..f674c492f7 100644
|
||||
--- a/src/locking/virtlockd-admin.socket.in
|
||||
+++ b/src/locking/virtlockd-admin.socket.in
|
||||
@@ -5,6 +5,7 @@ Before=libvirtd.service
|
||||
[Socket]
|
||||
ListenStream=@localstatedir@/run/libvirt/virtlockd-admin-sock
|
||||
Service=virtlockd.service
|
||||
+SocketMode=0600
|
||||
|
||||
[Install]
|
||||
WantedBy=sockets.target
|
||||
diff --git a/src/locking/virtlockd.socket.in b/src/locking/virtlockd.socket.in
|
||||
index 45e0f20235..d701b27516 100644
|
||||
--- a/src/locking/virtlockd.socket.in
|
||||
+++ b/src/locking/virtlockd.socket.in
|
||||
@@ -4,6 +4,7 @@ Before=libvirtd.service
|
||||
|
||||
[Socket]
|
||||
ListenStream=@localstatedir@/run/libvirt/virtlockd-sock
|
||||
+SocketMode=0600
|
||||
|
||||
[Install]
|
||||
WantedBy=sockets.target
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
From f0e014133104cdb5af5c7d96a7aa6dc0f1bbb03c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
||||
Date: Tue, 30 Apr 2019 17:27:41 +0100
|
||||
Subject: [PATCH 3/3] logging: restrict sockets to mode 0600
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
The virtlogd daemon's only intended client is the libvirtd daemon. As
|
||||
such it should never allow clients from other user accounts to connect.
|
||||
The code already enforces this and drops clients from other UIDs, but
|
||||
we can get earlier (and thus stronger) protection against DoS by setting
|
||||
the socket permissions to 0600
|
||||
|
||||
Fixes CVE-2019-10132
|
||||
|
||||
Reviewed-by: Ján Tomko <jtomko@redhat.com>
|
||||
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
||||
(cherry picked from commit e37bd65f9948c1185456b2cdaa3bd6e875af680f)
|
||||
---
|
||||
src/logging/virtlogd-admin.socket.in | 1 +
|
||||
src/logging/virtlogd.socket.in | 1 +
|
||||
2 files changed, 2 insertions(+)
|
||||
|
||||
diff --git a/src/logging/virtlogd-admin.socket.in b/src/logging/virtlogd-admin.socket.in
|
||||
index 595e6c4c4b..5c41dfeb7b 100644
|
||||
--- a/src/logging/virtlogd-admin.socket.in
|
||||
+++ b/src/logging/virtlogd-admin.socket.in
|
||||
@@ -5,6 +5,7 @@ Before=libvirtd.service
|
||||
[Socket]
|
||||
ListenStream=@localstatedir@/run/libvirt/virtlogd-admin-sock
|
||||
Service=virtlogd.service
|
||||
+SocketMode=0600
|
||||
|
||||
[Install]
|
||||
WantedBy=sockets.target
|
||||
diff --git a/src/logging/virtlogd.socket.in b/src/logging/virtlogd.socket.in
|
||||
index 22b9360c8d..ae48cdab9a 100644
|
||||
--- a/src/logging/virtlogd.socket.in
|
||||
+++ b/src/logging/virtlogd.socket.in
|
||||
@@ -4,6 +4,7 @@ Before=libvirtd.service
|
||||
|
||||
[Socket]
|
||||
ListenStream=@localstatedir@/run/libvirt/virtlogd-sock
|
||||
+SocketMode=0600
|
||||
|
||||
[Install]
|
||||
WantedBy=sockets.target
|
||||
--
|
||||
2.21.0
|
||||
|
||||
@@ -0,0 +1,21 @@
|
||||
# Makefile for source rpm: libvirt
|
||||
# $Id$
|
||||
NAME := libvirt
|
||||
SPECFILE = $(firstword $(wildcard *.spec))
|
||||
|
||||
define find-makefile-common
|
||||
for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$d/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
|
||||
endef
|
||||
|
||||
MAKEFILE_COMMON := $(shell $(find-makefile-common))
|
||||
|
||||
ifeq ($(MAKEFILE_COMMON),)
|
||||
# attempt a checkout
|
||||
define checkout-makefile-common
|
||||
test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
|
||||
endef
|
||||
|
||||
MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
|
||||
endif
|
||||
|
||||
include $(MAKEFILE_COMMON)
|
||||
+1317
-1906
File diff suppressed because it is too large
Load Diff
@@ -1 +1 @@
|
||||
SHA512 (libvirt-10.6.0.tar.xz) = edec79e89669d5e9a46be35e0d6334a6ed3bbf32426679549bd998bde24cba52b0378843f41a3abb5d781ad53e2a6a54619a0bad3f168c11fb41736cc6af6568
|
||||
SHA512 (libvirt-4.1.0.tar.xz) = 62d1a228adf3270cc6defe3cbf92dac8c4ce2c434c4d97219571ccef799a4f6304cfd1ba9938338356641285f53ac71145d7b398523021c5ea1dc8e3d49cf894
|
||||
|
||||
Reference in New Issue
Block a user