diff --git a/0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch b/0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch
deleted file mode 100644
index a38ab5d..0000000
--- a/0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch
+++ /dev/null
@@ -1,880 +0,0 @@
-From cfaf65ddb72aa9ddf7a27d9d315a679c4799aa97 Mon Sep 17 00:00:00 2001
-From: Jiri Denemark <jdenemar@redhat.com>
-Date: Tue, 9 Apr 2019 12:35:51 +0200
-Subject: [PATCH 1/2] cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
-(cherry picked from commit 5cd9db3ac11e88846cbcf95fad9f6fae9d880dee)
----
- tests/cputest.c | 1 +
- .../x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml | 7 +
- .../x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 8 +
- .../x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 28 +
- .../x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 29 +
- .../x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 11 +
- .../x86_64-cpuid-Xeon-E3-1225-v5.json | 652 ++++++++++++++++++
- .../x86_64-cpuid-Xeon-E3-1225-v5.sig | 4 +
- .../x86_64-cpuid-Xeon-E3-1225-v5.xml | 47 ++
- 9 files changed, 787 insertions(+)
- create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
- create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
- create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
- create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
- create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
- create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
- create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
- create mode 100644 tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
-
-diff --git a/tests/cputest.c b/tests/cputest.c
-index 1ade8091b2..e176739965 100644
---- a/tests/cputest.c
-+++ b/tests/cputest.c
-@@ -1272,6 +1272,7 @@ mymain(void)
- DO_TEST_CPUID(VIR_ARCH_X86_64, "Phenom-B95", JSON_HOST);
- DO_TEST_CPUID(VIR_ARCH_X86_64, "Ryzen-7-1800X-Eight-Core", JSON_HOST);
- DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-5110", JSON_NONE);
-+ DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1225-v5", JSON_MODELS);
- DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E3-1245-v5", JSON_MODELS);
- DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2609-v3", JSON_MODELS);
- DO_TEST_CPUID(VIR_ARCH_X86_64, "Xeon-E5-2623-v4", JSON_MODELS);
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
-new file mode 100644
-index 0000000000..ce51903e53
---- /dev/null
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-disabled.xml
-@@ -0,0 +1,7 @@
-+<!-- Features disabled by QEMU -->
-+<cpudata arch='x86'>
-+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x0800c1fc' edx='0xb0600000'/>
-+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x02000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000008' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
-+</cpudata>
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
-new file mode 100644
-index 0000000000..0deca9fba6
---- /dev/null
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
-@@ -0,0 +1,8 @@
-+<!-- Features enabled by QEMU -->
-+<cpudata arch='x86'>
-+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0xf7fa3203' edx='0x0f8bfbff'/>
-+ <cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x00000004' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000000'/>
-+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000007' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
-+</cpudata>
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
-new file mode 100644
-index 0000000000..70a0fc3286
---- /dev/null
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
-@@ -0,0 +1,28 @@
-+<cpu mode='custom' match='exact'>
-+ <model fallback='forbid'>Skylake-Client-IBRS</model>
-+ <vendor>Intel</vendor>
-+ <feature policy='require' name='ds'/>
-+ <feature policy='require' name='acpi'/>
-+ <feature policy='require' name='ss'/>
-+ <feature policy='require' name='ht'/>
-+ <feature policy='require' name='tm'/>
-+ <feature policy='require' name='pbe'/>
-+ <feature policy='require' name='dtes64'/>
-+ <feature policy='require' name='monitor'/>
-+ <feature policy='require' name='ds_cpl'/>
-+ <feature policy='require' name='vmx'/>
-+ <feature policy='require' name='smx'/>
-+ <feature policy='require' name='est'/>
-+ <feature policy='require' name='tm2'/>
-+ <feature policy='require' name='xtpr'/>
-+ <feature policy='require' name='pdcm'/>
-+ <feature policy='require' name='osxsave'/>
-+ <feature policy='require' name='tsc_adjust'/>
-+ <feature policy='require' name='clflushopt'/>
-+ <feature policy='require' name='intel-pt'/>
-+ <feature policy='require' name='stibp'/>
-+ <feature policy='require' name='ssbd'/>
-+ <feature policy='require' name='xsaves'/>
-+ <feature policy='require' name='pdpe1gb'/>
-+ <feature policy='require' name='invtsc'/>
-+</cpu>
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
-new file mode 100644
-index 0000000000..bbdfb6aa61
---- /dev/null
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
-@@ -0,0 +1,29 @@
-+<cpu>
-+ <arch>x86_64</arch>
-+ <model>Skylake-Client-IBRS</model>
-+ <vendor>Intel</vendor>
-+ <feature name='ds'/>
-+ <feature name='acpi'/>
-+ <feature name='ss'/>
-+ <feature name='ht'/>
-+ <feature name='tm'/>
-+ <feature name='pbe'/>
-+ <feature name='dtes64'/>
-+ <feature name='monitor'/>
-+ <feature name='ds_cpl'/>
-+ <feature name='vmx'/>
-+ <feature name='smx'/>
-+ <feature name='est'/>
-+ <feature name='tm2'/>
-+ <feature name='xtpr'/>
-+ <feature name='pdcm'/>
-+ <feature name='osxsave'/>
-+ <feature name='tsc_adjust'/>
-+ <feature name='clflushopt'/>
-+ <feature name='intel-pt'/>
-+ <feature name='stibp'/>
-+ <feature name='ssbd'/>
-+ <feature name='xsaves'/>
-+ <feature name='pdpe1gb'/>
-+ <feature name='invtsc'/>
-+</cpu>
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
-new file mode 100644
-index 0000000000..1f321db273
---- /dev/null
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
-@@ -0,0 +1,11 @@
-+<cpu mode='custom' match='exact'>
-+ <model fallback='forbid'>Skylake-Client-IBRS</model>
-+ <vendor>Intel</vendor>
-+ <feature policy='require' name='ss'/>
-+ <feature policy='require' name='hypervisor'/>
-+ <feature policy='require' name='tsc_adjust'/>
-+ <feature policy='require' name='clflushopt'/>
-+ <feature policy='require' name='stibp'/>
-+ <feature policy='require' name='ssbd'/>
-+ <feature policy='require' name='pdpe1gb'/>
-+</cpu>
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
-new file mode 100644
-index 0000000000..084747556b
---- /dev/null
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.json
-@@ -0,0 +1,652 @@
-+{
-+ "return": {
-+ "model": {
-+ "name": "base",
-+ "props": {
-+ "phys-bits": 0,
-+ "core-id": -1,
-+ "xlevel": 2147483656,
-+ "cmov": true,
-+ "ia64": false,
-+ "aes": true,
-+ "mmx": true,
-+ "rdpid": false,
-+ "arat": true,
-+ "gfni": false,
-+ "pause-filter": false,
-+ "xsavec": true,
-+ "intel-pt": false,
-+ "osxsave": false,
-+ "hv-frequencies": false,
-+ "tsc-frequency": 0,
-+ "xd": true,
-+ "hv-vendor-id": "",
-+ "kvm-asyncpf": true,
-+ "kvm_asyncpf": true,
-+ "perfctr_core": false,
-+ "perfctr-core": false,
-+ "mpx": true,
-+ "pbe": false,
-+ "decodeassists": false,
-+ "avx512cd": false,
-+ "sse4_1": true,
-+ "sse4.1": true,
-+ "sse4-1": true,
-+ "family": 6,
-+ "legacy-cache": true,
-+ "vmware-cpuid-freq": true,
-+ "avx512f": false,
-+ "msr": true,
-+ "mce": true,
-+ "mca": true,
-+ "hv-runtime": false,
-+ "xcrypt": false,
-+ "thread-id": -1,
-+ "min-level": 13,
-+ "xgetbv1": true,
-+ "cid": false,
-+ "hv-relaxed": false,
-+ "hv-crash": false,
-+ "ds": false,
-+ "fxsr": true,
-+ "xsaveopt": true,
-+ "xtpr": false,
-+ "avx512vl": false,
-+ "avx512-vpopcntdq": false,
-+ "phe": false,
-+ "extapic": false,
-+ "3dnowprefetch": true,
-+ "avx512vbmi2": false,
-+ "cr8legacy": false,
-+ "stibp": true,
-+ "cpuid-0xb": true,
-+ "xcrypt-en": false,
-+ "kvm_pv_eoi": true,
-+ "apic-id": 4294967295,
-+ "pn": false,
-+ "dca": false,
-+ "vendor": "GenuineIntel",
-+ "pku": false,
-+ "smx": false,
-+ "cmp_legacy": false,
-+ "cmp-legacy": false,
-+ "node-id": -1,
-+ "avx512-4fmaps": false,
-+ "vmcb_clean": false,
-+ "vmcb-clean": false,
-+ "3dnowext": false,
-+ "hle": true,
-+ "npt": false,
-+ "memory": "/machine/unattached/system[0]",
-+ "clwb": false,
-+ "lbrv": false,
-+ "adx": true,
-+ "ss": true,
-+ "pni": true,
-+ "svm_lock": false,
-+ "svm-lock": false,
-+ "pfthreshold": false,
-+ "smep": true,
-+ "smap": true,
-+ "x2apic": true,
-+ "avx512vbmi": false,
-+ "avx512vnni": false,
-+ "hv-stimer": false,
-+ "i64": true,
-+ "flushbyasid": false,
-+ "f16c": true,
-+ "ace2-en": false,
-+ "pat": true,
-+ "pae": true,
-+ "sse": true,
-+ "phe-en": false,
-+ "kvm_nopiodelay": true,
-+ "kvm-nopiodelay": true,
-+ "tm": false,
-+ "kvmclock-stable-bit": true,
-+ "hypervisor": true,
-+ "socket-id": -1,
-+ "pcommit": false,
-+ "syscall": true,
-+ "level": 13,
-+ "avx512dq": false,
-+ "svm": false,
-+ "full-cpuid-auto-level": true,
-+ "hv-reset": false,
-+ "invtsc": false,
-+ "sse3": true,
-+ "sse2": true,
-+ "ssbd": true,
-+ "est": false,
-+ "avx512ifma": false,
-+ "tm2": false,
-+ "kvm-pv-eoi": true,
-+ "cx8": true,
-+ "kvm_mmu": false,
-+ "kvm-mmu": false,
-+ "sse4_2": true,
-+ "sse4.2": true,
-+ "sse4-2": true,
-+ "pge": true,
-+ "fill-mtrr-mask": true,
-+ "avx512bitalg": false,
-+ "nodeid_msr": false,
-+ "pdcm": false,
-+ "movbe": true,
-+ "model": 94,
-+ "nrip_save": false,
-+ "nrip-save": false,
-+ "kvm_pv_unhalt": true,
-+ "ssse3": true,
-+ "sse4a": false,
-+ "invpcid": true,
-+ "pdpe1gb": true,
-+ "tsc-deadline": true,
-+ "fma": true,
-+ "cx16": true,
-+ "de": true,
-+ "enforce": false,
-+ "stepping": 3,
-+ "xsave": true,
-+ "clflush": true,
-+ "skinit": false,
-+ "tsc": true,
-+ "tce": false,
-+ "fpu": true,
-+ "ibs": false,
-+ "ds_cpl": false,
-+ "ds-cpl": false,
-+ "host-phys-bits": true,
-+ "fma4": false,
-+ "la57": false,
-+ "osvw": false,
-+ "check": true,
-+ "hv-spinlocks": -1,
-+ "pmu": false,
-+ "pmm": false,
-+ "apic": true,
-+ "spec-ctrl": true,
-+ "min-xlevel2": 0,
-+ "tsc-adjust": true,
-+ "tsc_adjust": true,
-+ "kvm-steal-time": true,
-+ "kvm_steal_time": true,
-+ "kvmclock": true,
-+ "l3-cache": true,
-+ "lwp": false,
-+ "ibpb": false,
-+ "xop": false,
-+ "avx": true,
-+ "ospke": false,
-+ "ace2": false,
-+ "avx512bw": false,
-+ "acpi": false,
-+ "hv-vapic": false,
-+ "fsgsbase": true,
-+ "ht": false,
-+ "nx": true,
-+ "pclmulqdq": true,
-+ "mmxext": false,
-+ "vaes": false,
-+ "popcnt": true,
-+ "xsaves": false,
-+ "tcg-cpuid": true,
-+ "lm": true,
-+ "umip": false,
-+ "pse": true,
-+ "avx2": true,
-+ "sep": true,
-+ "pclmuldq": true,
-+ "virt-ssbd": false,
-+ "x-hv-max-vps": -1,
-+ "nodeid-msr": false,
-+ "md-clear": true,
-+ "kvm": true,
-+ "misalignsse": false,
-+ "min-xlevel": 2147483656,
-+ "kvm-pv-unhalt": true,
-+ "bmi2": true,
-+ "bmi1": true,
-+ "realized": false,
-+ "tsc_scale": false,
-+ "tsc-scale": false,
-+ "topoext": false,
-+ "hv-vpindex": false,
-+ "xlevel2": 0,
-+ "clflushopt": true,
-+ "kvm-no-smi-migration": false,
-+ "monitor": false,
-+ "avx512er": false,
-+ "pmm-en": false,
-+ "pcid": true,
-+ "3dnow": false,
-+ "erms": true,
-+ "lahf-lm": true,
-+ "lahf_lm": true,
-+ "vpclmulqdq": false,
-+ "fxsr-opt": false,
-+ "hv-synic": false,
-+ "xstore": false,
-+ "fxsr_opt": false,
-+ "kvm-hint-dedicated": false,
-+ "rtm": true,
-+ "lmce": true,
-+ "hv-time": false,
-+ "perfctr-nb": false,
-+ "perfctr_nb": false,
-+ "ffxsr": false,
-+ "rdrand": true,
-+ "rdseed": true,
-+ "avx512-4vnniw": false,
-+ "vmx": false,
-+ "vme": true,
-+ "dtes64": false,
-+ "mtrr": true,
-+ "rdtscp": true,
-+ "pse36": true,
-+ "kvm-pv-tlb-flush": false,
-+ "tbm": false,
-+ "wdt": false,
-+ "pause_filter": false,
-+ "sha-ni": false,
-+ "model-id": "Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz",
-+ "abm": true,
-+ "avx512pf": false,
-+ "xstore-en": false
-+ }
-+ }
-+ },
-+ "id": "model-expansion"
-+}
-+
-+{
-+ "return": [
-+ {
-+ "name": "max",
-+ "typename": "max-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": false
-+ },
-+ {
-+ "name": "host",
-+ "typename": "host-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": false
-+ },
-+ {
-+ "name": "base",
-+ "typename": "base-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": true,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "qemu64",
-+ "typename": "qemu64-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "qemu32",
-+ "typename": "qemu32-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "phenom",
-+ "typename": "phenom-x86_64-cpu",
-+ "unavailable-features": [
-+ "mmxext",
-+ "fxsr-opt",
-+ "3dnowext",
-+ "3dnow",
-+ "sse4a",
-+ "npt"
-+ ],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "pentium3",
-+ "typename": "pentium3-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "pentium2",
-+ "typename": "pentium2-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "pentium",
-+ "typename": "pentium-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "n270",
-+ "typename": "n270-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "kvm64",
-+ "typename": "kvm64-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "kvm32",
-+ "typename": "kvm32-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "cpu64-rhel6",
-+ "typename": "cpu64-rhel6-x86_64-cpu",
-+ "unavailable-features": [
-+ "sse4a"
-+ ],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "coreduo",
-+ "typename": "coreduo-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "core2duo",
-+ "typename": "core2duo-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "athlon",
-+ "typename": "athlon-x86_64-cpu",
-+ "unavailable-features": [
-+ "mmxext",
-+ "3dnowext",
-+ "3dnow"
-+ ],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Westmere",
-+ "typename": "Westmere-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Westmere-IBRS",
-+ "typename": "Westmere-IBRS-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Skylake-Server",
-+ "typename": "Skylake-Server-x86_64-cpu",
-+ "unavailable-features": [
-+ "avx512f",
-+ "avx512dq",
-+ "clwb",
-+ "avx512cd",
-+ "avx512bw",
-+ "avx512vl",
-+ "avx512f",
-+ "avx512f",
-+ "avx512f"
-+ ],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Skylake-Server-IBRS",
-+ "typename": "Skylake-Server-IBRS-x86_64-cpu",
-+ "unavailable-features": [
-+ "avx512f",
-+ "avx512dq",
-+ "clwb",
-+ "avx512cd",
-+ "avx512bw",
-+ "avx512vl",
-+ "avx512f",
-+ "avx512f",
-+ "avx512f"
-+ ],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Skylake-Client",
-+ "typename": "Skylake-Client-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Skylake-Client-IBRS",
-+ "typename": "Skylake-Client-IBRS-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "SandyBridge",
-+ "typename": "SandyBridge-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "SandyBridge-IBRS",
-+ "typename": "SandyBridge-IBRS-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Penryn",
-+ "typename": "Penryn-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Opteron_G5",
-+ "typename": "Opteron_G5-x86_64-cpu",
-+ "unavailable-features": [
-+ "sse4a",
-+ "misalignsse",
-+ "xop",
-+ "fma4",
-+ "tbm"
-+ ],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Opteron_G4",
-+ "typename": "Opteron_G4-x86_64-cpu",
-+ "unavailable-features": [
-+ "sse4a",
-+ "misalignsse",
-+ "xop",
-+ "fma4"
-+ ],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Opteron_G3",
-+ "typename": "Opteron_G3-x86_64-cpu",
-+ "unavailable-features": [
-+ "sse4a",
-+ "misalignsse"
-+ ],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Opteron_G2",
-+ "typename": "Opteron_G2-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Opteron_G1",
-+ "typename": "Opteron_G1-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Nehalem",
-+ "typename": "Nehalem-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Nehalem-IBRS",
-+ "typename": "Nehalem-IBRS-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "IvyBridge",
-+ "typename": "IvyBridge-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "IvyBridge-IBRS",
-+ "typename": "IvyBridge-IBRS-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Haswell",
-+ "typename": "Haswell-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Haswell-noTSX",
-+ "typename": "Haswell-noTSX-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Haswell-noTSX-IBRS",
-+ "typename": "Haswell-noTSX-IBRS-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Haswell-IBRS",
-+ "typename": "Haswell-IBRS-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "EPYC",
-+ "typename": "EPYC-x86_64-cpu",
-+ "unavailable-features": [
-+ "sha-ni",
-+ "mmxext",
-+ "fxsr-opt",
-+ "cr8legacy",
-+ "sse4a",
-+ "misalignsse",
-+ "osvw"
-+ ],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "EPYC-IBPB",
-+ "typename": "EPYC-IBPB-x86_64-cpu",
-+ "unavailable-features": [
-+ "sha-ni",
-+ "mmxext",
-+ "fxsr-opt",
-+ "cr8legacy",
-+ "sse4a",
-+ "misalignsse",
-+ "osvw",
-+ "ibpb"
-+ ],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Conroe",
-+ "typename": "Conroe-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Broadwell",
-+ "typename": "Broadwell-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Broadwell-noTSX",
-+ "typename": "Broadwell-noTSX-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Broadwell-noTSX-IBRS",
-+ "typename": "Broadwell-noTSX-IBRS-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "Broadwell-IBRS",
-+ "typename": "Broadwell-IBRS-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ },
-+ {
-+ "name": "486",
-+ "typename": "486-x86_64-cpu",
-+ "unavailable-features": [],
-+ "static": false,
-+ "migration-safe": true
-+ }
-+ ],
-+ "id": "definitions"
-+}
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
-new file mode 100644
-index 0000000000..7e57c2ded6
---- /dev/null
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.sig
-@@ -0,0 +1,4 @@
-+0506e3
-+family: 6 (0x06)
-+model: 94 (0x5e)
-+stepping: 3 (0x03)
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
-new file mode 100644
-index 0000000000..437429d61d
---- /dev/null
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5.xml
-@@ -0,0 +1,47 @@
-+<!-- Intel(R) Xeon(R) CPU E3-1225 v5 @ 3.30GHz -->
-+<cpudata arch='x86'>
-+ <cpuid eax_in='0x00000000' ecx_in='0x00' eax='0x00000016' ebx='0x756e6547' ecx='0x6c65746e' edx='0x49656e69'/>
-+ <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x000506e3' ebx='0x06100800' ecx='0x7ffafbff' edx='0xbfebfbff'/>
-+ <cpuid eax_in='0x00000002' ecx_in='0x00' eax='0x76036301' ebx='0x00f0b6ff' ecx='0x00000000' edx='0x00c30000'/>
-+ <cpuid eax_in='0x00000003' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000004' ecx_in='0x00' eax='0x1c004121' ebx='0x01c0003f' ecx='0x0000003f' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000004' ecx_in='0x01' eax='0x1c004122' ebx='0x01c0003f' ecx='0x0000003f' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000004' ecx_in='0x02' eax='0x1c004143' ebx='0x00c0003f' ecx='0x000003ff' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000004' ecx_in='0x03' eax='0x1c03c163' ebx='0x03c0003f' ecx='0x00001fff' edx='0x00000006'/>
-+ <cpuid eax_in='0x00000005' ecx_in='0x00' eax='0x00000040' ebx='0x00000040' ecx='0x00000003' edx='0x00142120'/>
-+ <cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x000027f7' ebx='0x00000002' ecx='0x00000009' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x029c6fbf' ecx='0x00000000' edx='0x9c002400'/>
-+ <cpuid eax_in='0x00000008' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000009' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x0000000a' ecx_in='0x00' eax='0x07300804' ebx='0x00000000' ecx='0x00000000' edx='0x00000603'/>
-+ <cpuid eax_in='0x0000000b' ecx_in='0x00' eax='0x00000001' ebx='0x00000001' ecx='0x00000100' edx='0x00000006'/>
-+ <cpuid eax_in='0x0000000b' ecx_in='0x01' eax='0x00000004' ebx='0x00000004' ecx='0x00000201' edx='0x00000006'/>
-+ <cpuid eax_in='0x0000000c' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x0000000d' ecx_in='0x00' eax='0x0000001f' ebx='0x00000440' ecx='0x00000440' edx='0x00000000'/>
-+ <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x0000000f' ebx='0x000003c0' ecx='0x00000100' edx='0x00000000'/>
-+ <cpuid eax_in='0x0000000d' ecx_in='0x02' eax='0x00000100' ebx='0x00000240' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x0000000d' ecx_in='0x03' eax='0x00000040' ebx='0x000003c0' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x0000000d' ecx_in='0x04' eax='0x00000040' ebx='0x00000400' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x0000000d' ecx_in='0x08' eax='0x00000080' ebx='0x00000000' ecx='0x00000001' edx='0x00000000'/>
-+ <cpuid eax_in='0x0000000e' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x0000000f' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000010' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000011' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000012' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000013' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000014' ecx_in='0x00' eax='0x00000001' ebx='0x0000000f' ecx='0x00000007' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000014' ecx_in='0x01' eax='0x02490002' ebx='0x003f3fff' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000015' ecx_in='0x00' eax='0x00000002' ebx='0x00000114' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x00000016' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
-+ <cpuid eax_in='0x80000000' ecx_in='0x00' eax='0x80000008' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
-+ <cpuid eax_in='0x80000002' ecx_in='0x00' eax='0x65746e49' ebx='0x2952286c' ecx='0x6f655820' edx='0x2952286e'/>
-+ <cpuid eax_in='0x80000003' ecx_in='0x00' eax='0x55504320' ebx='0x2d334520' ecx='0x35323231' edx='0x20357620'/>
-+ <cpuid eax_in='0x80000004' ecx_in='0x00' eax='0x2e332040' ebx='0x48473033' ecx='0x0000007a' edx='0x00000000'/>
-+ <cpuid eax_in='0x80000005' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x80000006' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x01006040' edx='0x00000000'/>
-+ <cpuid eax_in='0x80000007' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000000' edx='0x00000100'/>
-+ <cpuid eax_in='0x80000008' ecx_in='0x00' eax='0x00003027' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-+ <cpuid eax_in='0x80860000' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
-+ <cpuid eax_in='0xc0000000' ecx_in='0x00' eax='0x00000ce4' ebx='0x00000e74' ecx='0x00000064' edx='0x00000000'/>
-+</cpudata>
---
-2.21.0
-
diff --git a/0002-cpu_map-Define-md-clear-CPUID-bit.patch b/0002-cpu_map-Define-md-clear-CPUID-bit.patch
deleted file mode 100644
index 5c80705..0000000
--- a/0002-cpu_map-Define-md-clear-CPUID-bit.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-From 150b8cfaaf49d86f90187cbf071aa3fa55476ac1 Mon Sep 17 00:00:00 2001
-From: Jiri Denemark <jdenemar@redhat.com>
-Date: Tue, 9 Apr 2019 12:35:52 +0200
-Subject: [PATCH 2/2] cpu_map: Define md-clear CPUID bit
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, CVE-2019-11091
-
-The bit is set when microcode provides the mechanism to invoke a flush
-of various exploitable CPU buffers by invoking the VERW instruction.
-
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: Jiri Denemark <jdenemar@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 538d873571d7a682852dc1d70e5f4478f4d64e85)
----
- src/cpu_map/x86_features.xml | 3 +++
- tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml | 2 +-
- tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml | 1 +
- tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml | 1 +
- tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml | 1 +
- tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml | 1 +
- tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml | 1 +
- 7 files changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/src/cpu_map/x86_features.xml b/src/cpu_map/x86_features.xml
-index efcc10b1ae..370807f88e 100644
---- a/src/cpu_map/x86_features.xml
-+++ b/src/cpu_map/x86_features.xml
-@@ -320,6 +320,9 @@
- <feature name='avx512-4fmaps'>
- <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000008'/>
- </feature>
-+ <feature name='md-clear'> <!-- md_clear -->
-+ <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00000400'/>
-+ </feature>
- <feature name='pconfig'>
- <cpuid eax_in='0x07' ecx_in='0x00' edx='0x00040000'/>
- </feature>
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
-index 0deca9fba6..74763a462b 100644
---- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-enabled.xml
-@@ -2,7 +2,7 @@
- <cpudata arch='x86'>
- <cpuid eax_in='0x00000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0xf7fa3203' edx='0x0f8bfbff'/>
- <cpuid eax_in='0x00000006' ecx_in='0x00' eax='0x00000004' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
-- <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000000'/>
-+ <cpuid eax_in='0x00000007' ecx_in='0x00' eax='0x00000000' ebx='0x009c4fbb' ecx='0x00000000' edx='0x8c000400'/>
- <cpuid eax_in='0x0000000d' ecx_in='0x01' eax='0x00000007' ebx='0x00000000' ecx='0x00000000' edx='0x00000000'/>
- <cpuid eax_in='0x80000001' ecx_in='0x00' eax='0x00000000' ebx='0x00000000' ecx='0x00000121' edx='0x2c100800'/>
- </cpudata>
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
-index 70a0fc3286..867970d2c7 100644
---- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-guest.xml
-@@ -20,6 +20,7 @@
- <feature policy='require' name='tsc_adjust'/>
- <feature policy='require' name='clflushopt'/>
- <feature policy='require' name='intel-pt'/>
-+ <feature policy='require' name='md-clear'/>
- <feature policy='require' name='stibp'/>
- <feature policy='require' name='ssbd'/>
- <feature policy='require' name='xsaves'/>
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
-index bbdfb6aa61..e7ced42797 100644
---- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-host.xml
-@@ -21,6 +21,7 @@
- <feature name='tsc_adjust'/>
- <feature name='clflushopt'/>
- <feature name='intel-pt'/>
-+ <feature name='md-clear'/>
- <feature name='stibp'/>
- <feature name='ssbd'/>
- <feature name='xsaves'/>
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
-index 1f321db273..a5591278df 100644
---- a/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-E3-1225-v5-json.xml
-@@ -5,6 +5,7 @@
- <feature policy='require' name='hypervisor'/>
- <feature policy='require' name='tsc_adjust'/>
- <feature policy='require' name='clflushopt'/>
-+ <feature policy='require' name='md-clear'/>
- <feature policy='require' name='stibp'/>
- <feature policy='require' name='ssbd'/>
- <feature policy='require' name='pdpe1gb'/>
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml
-index cc1fc90c45..c7e8a1fccf 100644
---- a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-guest.xml
-@@ -23,6 +23,7 @@
- <feature policy='require' name='intel-pt'/>
- <feature policy='require' name='pku'/>
- <feature policy='require' name='ospke'/>
-+ <feature policy='require' name='md-clear'/>
- <feature policy='require' name='stibp'/>
- <feature policy='require' name='arch-capabilities'/>
- <feature policy='require' name='xsaves'/>
-diff --git a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml
-index dfabdc57c7..d7482751b4 100644
---- a/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml
-+++ b/tests/cputestdata/x86_64-cpuid-Xeon-Platinum-8268-host.xml
-@@ -24,6 +24,7 @@
- <feature name='intel-pt'/>
- <feature name='pku'/>
- <feature name='ospke'/>
-+ <feature name='md-clear'/>
- <feature name='stibp'/>
- <feature name='arch-capabilities'/>
- <feature name='xsaves'/>
---
-2.21.0
-
diff --git a/0003-admin-reject-clients-unless-their-UID-matches-the-cu.patch b/0003-admin-reject-clients-unless-their-UID-matches-the-cu.patch
deleted file mode 100644
index c9e27df..0000000
--- a/0003-admin-reject-clients-unless-their-UID-matches-the-cu.patch
+++ /dev/null
@@ -1,58 +0,0 @@
-From fd48a871a9dcdb8b8b1eb39612e5df870a7e2c3c Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 30 Apr 2019 17:26:13 +0100
-Subject: [PATCH 1/3] admin: reject clients unless their UID matches the
- current UID
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The admin protocol RPC messages are only intended for use by the user
-running the daemon. As such they should not be allowed for any client
-UID that does not match the server UID.
-
-Fixes CVE-2019-10132
-
-Reviewed-by: Ján Tomko <jtomko@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit 96f41cd765c9e525fe28ee5abbfbf4a79b3720c7)
----
- src/admin/admin_server_dispatch.c | 22 ++++++++++++++++++++++
- 1 file changed, 22 insertions(+)
-
-diff --git a/src/admin/admin_server_dispatch.c b/src/admin/admin_server_dispatch.c
-index 85e693d76c..6e3b99f97d 100644
---- a/src/admin/admin_server_dispatch.c
-+++ b/src/admin/admin_server_dispatch.c
-@@ -64,6 +64,28 @@ remoteAdmClientNew(virNetServerClientPtr client ATTRIBUTE_UNUSED,
- void *opaque)
- {
- struct daemonAdmClientPrivate *priv;
-+ uid_t clientuid;
-+ gid_t clientgid;
-+ pid_t clientpid;
-+ unsigned long long timestamp;
-+
-+ if (virNetServerClientGetUNIXIdentity(client,
-+ &clientuid,
-+ &clientgid,
-+ &clientpid,
-+ ×tamp) < 0)
-+ return NULL;
-+
-+ VIR_DEBUG("New client pid %lld uid %lld",
-+ (long long)clientpid,
-+ (long long)clientuid);
-+
-+ if (geteuid() != clientuid) {
-+ virReportRestrictedError(_("Disallowing client %lld with uid %lld"),
-+ (long long)clientpid,
-+ (long long)clientuid);
-+ return NULL;
-+ }
-
- if (VIR_ALLOC(priv) < 0)
- return NULL;
---
-2.21.0
-
diff --git a/0004-locking-restrict-sockets-to-mode-0600.patch b/0004-locking-restrict-sockets-to-mode-0600.patch
deleted file mode 100644
index 2d3fc27..0000000
--- a/0004-locking-restrict-sockets-to-mode-0600.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 8c2c611df31d3b37f149385e4597c47300ae1489 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 30 Apr 2019 16:51:37 +0100
-Subject: [PATCH 2/3] locking: restrict sockets to mode 0600
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The virtlockd daemon's only intended client is the libvirtd daemon. As
-such it should never allow clients from other user accounts to connect.
-The code already enforces this and drops clients from other UIDs, but
-we can get earlier (and thus stronger) protection against DoS by setting
-the socket permissions to 0600
-
-Fixes CVE-2019-10132
-
-Reviewed-by: Ján Tomko <jtomko@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit f111e09468693909b1f067aa575efdafd9a262a1)
----
- src/locking/virtlockd-admin.socket.in | 1 +
- src/locking/virtlockd.socket.in | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/src/locking/virtlockd-admin.socket.in b/src/locking/virtlockd-admin.socket.in
-index 2a7500f3d0..f674c492f7 100644
---- a/src/locking/virtlockd-admin.socket.in
-+++ b/src/locking/virtlockd-admin.socket.in
-@@ -5,6 +5,7 @@ Before=libvirtd.service
- [Socket]
- ListenStream=@localstatedir@/run/libvirt/virtlockd-admin-sock
- Service=virtlockd.service
-+SocketMode=0600
-
- [Install]
- WantedBy=sockets.target
-diff --git a/src/locking/virtlockd.socket.in b/src/locking/virtlockd.socket.in
-index 45e0f20235..d701b27516 100644
---- a/src/locking/virtlockd.socket.in
-+++ b/src/locking/virtlockd.socket.in
-@@ -4,6 +4,7 @@ Before=libvirtd.service
-
- [Socket]
- ListenStream=@localstatedir@/run/libvirt/virtlockd-sock
-+SocketMode=0600
-
- [Install]
- WantedBy=sockets.target
---
-2.21.0
-
diff --git a/0005-logging-restrict-sockets-to-mode-0600.patch b/0005-logging-restrict-sockets-to-mode-0600.patch
deleted file mode 100644
index a4c01a9..0000000
--- a/0005-logging-restrict-sockets-to-mode-0600.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From a968b3103c503db8a9fb6c9d64f0dd49d3b6f2a3 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
-Date: Tue, 30 Apr 2019 17:27:41 +0100
-Subject: [PATCH 3/3] logging: restrict sockets to mode 0600
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-The virtlogd daemon's only intended client is the libvirtd daemon. As
-such it should never allow clients from other user accounts to connect.
-The code already enforces this and drops clients from other UIDs, but
-we can get earlier (and thus stronger) protection against DoS by setting
-the socket permissions to 0600
-
-Fixes CVE-2019-10132
-
-Reviewed-by: Ján Tomko <jtomko@redhat.com>
-Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
-(cherry picked from commit e37bd65f9948c1185456b2cdaa3bd6e875af680f)
----
- src/logging/virtlogd-admin.socket.in | 1 +
- src/logging/virtlogd.socket.in | 1 +
- 2 files changed, 2 insertions(+)
-
-diff --git a/src/logging/virtlogd-admin.socket.in b/src/logging/virtlogd-admin.socket.in
-index 595e6c4c4b..5c41dfeb7b 100644
---- a/src/logging/virtlogd-admin.socket.in
-+++ b/src/logging/virtlogd-admin.socket.in
-@@ -5,6 +5,7 @@ Before=libvirtd.service
- [Socket]
- ListenStream=@localstatedir@/run/libvirt/virtlogd-admin-sock
- Service=virtlogd.service
-+SocketMode=0600
-
- [Install]
- WantedBy=sockets.target
-diff --git a/src/logging/virtlogd.socket.in b/src/logging/virtlogd.socket.in
-index 22b9360c8d..ae48cdab9a 100644
---- a/src/logging/virtlogd.socket.in
-+++ b/src/logging/virtlogd.socket.in
-@@ -4,6 +4,7 @@ Before=libvirtd.service
-
- [Socket]
- ListenStream=@localstatedir@/run/libvirt/virtlogd-sock
-+SocketMode=0600
-
- [Install]
- WantedBy=sockets.target
---
-2.21.0
-
diff --git a/libvirt.spec b/libvirt.spec
index c6a9f23..5819ccb 100644
--- a/libvirt.spec
+++ b/libvirt.spec
@@ -215,8 +215,8 @@
Summary: Library providing a simple virtualization API
Name: libvirt
-Version: 5.3.0
-Release: 3%{?dist}
+Version: 5.4.0
+Release: 1%{?dist}
License: LGPLv2+
URL: https://libvirt.org/
@@ -224,12 +224,6 @@ URL: https://libvirt.org/
%define mainturl stable_updates/
%endif
Source: https://libvirt.org/sources/%{?mainturl}libvirt-%{version}.tar.xz
-Patch1: 0001-cputest-Add-data-for-Intel-R-Xeon-R-CPU-E3-1225-v5.patch
-Patch2: 0002-cpu_map-Define-md-clear-CPUID-bit.patch
-# Fix systemd socket permissions (CVE-2019-10132)
-Patch3: 0003-admin-reject-clients-unless-their-UID-matches-the-cu.patch
-Patch4: 0004-locking-restrict-sockets-to-mode-0600.patch
-Patch5: 0005-logging-restrict-sockets-to-mode-0600.patch
Requires: libvirt-daemon = %{version}-%{release}
Requires: libvirt-daemon-config-network = %{version}-%{release}
@@ -726,9 +720,6 @@ parted and more.
Summary: QEMU driver plugin for the libvirtd daemon
Requires: libvirt-daemon = %{version}-%{release}
Requires: libvirt-libs = %{version}-%{release}
-# There really is a hard cross-driver dependency here
-Requires: libvirt-daemon-driver-network = %{version}-%{release}
-Requires: libvirt-daemon-driver-storage-core = %{version}-%{release}
Requires: /usr/bin/qemu-img
# For image compression
Requires: gzip
@@ -1238,8 +1229,6 @@ export SOURCE_DATE_EPOCH=$(stat --printf='%Y' %{_specdir}/%{name}.spec)
%make_install %{?_smp_mflags} SYSTEMD_UNIT_DIR=%{_unitdir} V=1
-make %{?_smp_mflags} -C examples distclean V=1
-
rm -f $RPM_BUILD_ROOT%{_libdir}/*.la
rm -f $RPM_BUILD_ROOT%{_libdir}/*.a
rm -f $RPM_BUILD_ROOT%{_libdir}/libvirt/lock-driver/*.la
@@ -1261,8 +1250,8 @@ install -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/lib/libvirt/dnsmasq/
install -d -m 0755 $RPM_BUILD_ROOT%{_datadir}/libvirt/networks/
cp $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml \
$RPM_BUILD_ROOT%{_datadir}/libvirt/networks/default.xml
-rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml
-rm -f $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml
+# libvirt saves this file with mode 0600
+chmod 0600 $RPM_BUILD_ROOT%{_sysconfdir}/libvirt/qemu/networks/default.xml
# nwfilter files are installed in /usr/share/libvirt and copied to /etc in %post
# to avoid verification errors on changed files in /etc
@@ -1306,7 +1295,7 @@ rm -f $RPM_BUILD_ROOT%{_datadir}/augeas/lenses/tests/test_libvirtd_libxl.aug
%endif
# Copied into libvirt-docs subpackage eventually
-mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt-%{version} libvirt-docs
+mv $RPM_BUILD_ROOT%{_datadir}/doc/libvirt libvirt-docs
%ifarch %{power64} s390x x86_64 ia64 alpha sparc64
mv $RPM_BUILD_ROOT%{_datadir}/systemtap/tapset/libvirt_probes.stp \
@@ -1438,6 +1427,8 @@ if test $1 -eq 1 && test ! -f %{_sysconfdir}/libvirt/qemu/networks/default.xml ;
< %{_datadir}/libvirt/networks/default.xml \
> %{_sysconfdir}/libvirt/qemu/networks/default.xml
ln -s ../default.xml %{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml
+ # libvirt saves this file with mode 0600
+ chmod 0600 %{_sysconfdir}/libvirt/qemu/networks/default.xml
# Make sure libvirt picks up the new network defininiton
mkdir -p %{_localstatedir}/lib/rpm-state/libvirt || :
@@ -1452,6 +1443,8 @@ rm -rf %{_localstatedir}/lib/rpm-state/libvirt || :
%post daemon-config-nwfilter
cp %{_datadir}/libvirt/nwfilter/*.xml %{_sysconfdir}/libvirt/nwfilter/
+# libvirt saves these files with mode 600
+chmod 600 %{_sysconfdir}/libvirt/nwfilter/*.xml
# Make sure libvirt picks up the new nwfilter defininitons
mkdir -p %{_localstatedir}/lib/rpm-state/libvirt || :
touch %{_localstatedir}/lib/rpm-state/libvirt/restart || :
@@ -1490,14 +1483,6 @@ exit 0
%postun client
%systemd_postun libvirt-guests.service
-%if %{with_sanlock}
-%post lock-sanlock
-if getent group sanlock > /dev/null ; then
- chmod 0770 %{_localstatedir}/lib/libvirt/sanlock
- chown root:sanlock %{_localstatedir}/lib/libvirt/sanlock
-fi
-%endif
-
%if %{with_lxc}
%pre login-shell
getent group virtlogin >/dev/null || groupadd -r virtlogin
@@ -1516,16 +1501,6 @@ exit 0
%doc %{_datadir}/gtk-doc/html/libvirt/*.html
%doc %{_datadir}/gtk-doc/html/libvirt/*.png
%doc %{_datadir}/gtk-doc/html/libvirt/*.css
-%doc examples/hellolibvirt
-%doc examples/object-events
-%doc examples/dominfo
-%doc examples/domsuspend
-%doc examples/dommigrate
-%doc examples/openauth
-%doc examples/xml
-%doc examples/rename
-%doc examples/systemtap
-%doc examples/admin
%files daemon
@@ -1598,6 +1573,8 @@ exit 0
%files daemon-config-network
%dir %{_datadir}/libvirt/networks/
%{_datadir}/libvirt/networks/default.xml
+%ghost %{_sysconfdir}/libvirt/qemu/networks/default.xml
+%ghost %{_sysconfdir}/libvirt/qemu/networks/autostart/default.xml
%files daemon-config-nwfilter
%dir %{_datadir}/libvirt/nwfilter/
@@ -1688,7 +1665,7 @@ exit 0
%config(noreplace) %{_sysconfdir}/libvirt/qemu.conf
%config(noreplace) %{_sysconfdir}/libvirt/qemu-lockd.conf
%config(noreplace) %{_sysconfdir}/logrotate.d/libvirtd.qemu
-%ghost %dir %attr(0700, root, root) %{_localstatedir}/run/libvirt/qemu/
+%ghost %dir %{_localstatedir}/run/libvirt/qemu/
%dir %attr(0751, %{qemu_user}, %{qemu_group}) %{_localstatedir}/lib/libvirt/qemu/
%dir %attr(0750, %{qemu_user}, %{qemu_group}) %{_localstatedir}/cache/libvirt/qemu/
%{_datadir}/augeas/lenses/libvirtd_qemu.aug
@@ -1760,7 +1737,7 @@ exit 0
%attr(0755, root, root) %{_libdir}/libvirt/lock-driver/sanlock.so
%{_datadir}/augeas/lenses/libvirt_sanlock.aug
%{_datadir}/augeas/lenses/tests/test_libvirt_sanlock.aug
-%dir %attr(0700, root, root) %{_localstatedir}/lib/libvirt/sanlock
+%dir %attr(0770, root, sanlock) %{_localstatedir}/lib/libvirt/sanlock
%{_sbindir}/virt-sanlock-cleanup
%{_mandir}/man8/virt-sanlock-cleanup.8*
%attr(0755, root, root) %{_libexecdir}/libvirt_sanlock_helper
@@ -1893,6 +1870,9 @@ exit 0
%changelog
+* Wed Jun 12 2019 Daniel P. Berrangé <berrange@redhat.com> - 5.4.0-1
+- Update to 5.4.0 release
+
* Tue May 21 2019 Daniel P. Berrangé <berrange@redhat.com> - 5.3.0-3
- Fix systemd socket permissions
- Resolves: rhbz #1712498 (CVE-2019-10132)
diff --git a/sources b/sources
index 99d3cdf..c4025da 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (libvirt-5.3.0.tar.xz) = de3888d448463ff1d981e8dcf1aaed39c8215c368d133ed03b8cc5d7e05a77d385287d388d9db109df21df9bf348a14e7c654ca509d41addaadaa199d16b162e
+SHA512 (libvirt-5.4.0.tar.xz) = 03fa932d041d147cab79eab200bb33f8db72579be72ec7cbff3305f4a8d574835a80f1b99936eddf67f83d21cc5567f45c86e555209de6cd702f43f91197cfd0