mirror of
https://git.proxmox.com/git/pve-qemu
synced 2025-08-27 15:23:20 +00:00
d2ced986db
cherry-picks mds mitigation related commits from upstream qemu, some commits are taken to ensure easy backport. fixes included for: * CVE-2018-12126 * CVE-2018-12127 * CVE-2018-12130 * CVE-2019-11091 adds the md-clear cpuflag. Not included by default in any Intel CPU model. Must be explicitly turned on for all Intel CPU models. Requires the host CPU microcode to support this feature before it can be used for guest CPUs. Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
49 lines
1.6 KiB
Diff
49 lines
1.6 KiB
Diff
From 2d0ca4591b568544b4a8da6e1f4d573048d5fab5 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
|
Date: Wed, 15 May 2019 15:10:11 +0100
|
|
Subject: [PATCH] docs: recommend use of md-clear feature on all Intel
|
|
CPUs
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Update x86 CPU model guidance to recommend that the md-clear feature is
|
|
manually enabled with all Intel CPU models, when supported by the host
|
|
microcode.
|
|
|
|
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
Message-Id: <20190515141011.5315-3-berrange@redhat.com>
|
|
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
|
|
(cherry picked from commit 2c7e82a30774730100da9dbe68d2360459030d91)
|
|
Signed-off-by: Oguz Bektas <o.bektas@proxmox.com>
|
|
---
|
|
docs/qemu-cpu-models.texi | 12 ++++++++++++
|
|
1 file changed, 12 insertions(+)
|
|
|
|
diff --git a/docs/qemu-cpu-models.texi b/docs/qemu-cpu-models.texi
|
|
index 1935f98c63..5cb3d8b939 100644
|
|
--- a/docs/qemu-cpu-models.texi
|
|
+++ b/docs/qemu-cpu-models.texi
|
|
@@ -189,6 +189,18 @@ Not included by default in any Intel CPU model.
|
|
Should be explicitly turned on for all Intel CPU models.
|
|
|
|
Note that not all CPU hardware will support this feature.
|
|
+
|
|
+@item @code{md-clear}
|
|
+
|
|
+Required to confirm the MDS (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130,
|
|
+CVE-2019-11091) fixes.
|
|
+
|
|
+Not included by default in any Intel CPU model.
|
|
+
|
|
+Must be explicitly turned on for all Intel CPU models.
|
|
+
|
|
+Requires the host CPU microcode to support this feature before it
|
|
+can be used for guest CPUs.
|
|
@end table
|
|
|
|
|
|
--
|
|
2.11.0
|
|
|