patchbot at xen
Jun 15, 2012, 3:55 PM
Post #1 of 1
(36 views)
Permalink
|
|
[xen-4.0-testing] x86-64: detect processors subject to AMD erratum #121 and refuse to boot
|
|
# HG changeset patch
# User Jan Beulich <JBeulich [at] suse>
# Date 1339497777 -3600
# Node ID e35c8bb532559864faae2d640c1f668ce3ed967c
# Parent adb943a387c8397709d411c191234de8d97dddbb
x86-64: detect processors subject to AMD erratum #121 and refuse to boot
Processors with this erratum are subject to a DoS attack by unprivileged
guest users.
This is XSA-9 / CVE-2012-2934.
Signed-off-by: Jan Beulich <JBeulich [at] suse>
Signed-off-by: Ian Campbell <ian.campbell [at] citrix>
Committed-by: Ian Jackson <ian.jackson [at] eu>
xen-unstable changeset: 25481:422880dc94a4
xen-unstable date: Tue Jun 12 11:33:42 2012 +0100
Committed-by: Ian Jackson <ian.jackson [at] eu>
---
diff -r adb943a387c8 -r e35c8bb53255 xen/arch/x86/cpu/amd.c
--- a/xen/arch/x86/cpu/amd.c Tue Jun 12 11:39:34 2012 +0100
+++ b/xen/arch/x86/cpu/amd.c Tue Jun 12 11:42:57 2012 +0100
@@ -41,6 +41,9 @@ static unsigned int opt_cpuid_mask_ext_e
integer_param("cpuid_mask_ext_ecx", opt_cpuid_mask_ext_ecx);
integer_param("cpuid_mask_ext_edx", opt_cpuid_mask_ext_edx);
+static int opt_allow_unsafe;
+boolean_param("allow_unsafe", opt_allow_unsafe);
+
static inline void wrmsr_amd(unsigned int index, unsigned int lo,
unsigned int hi)
{
@@ -640,6 +643,11 @@ static void __devinit init_amd(struct cp
clear_bit(X86_FEATURE_MCE, c->x86_capability);
#ifdef __x86_64__
+ if (cpu_has_amd_erratum(c, AMD_ERRATUM_121) && !opt_allow_unsafe)
+ panic("Xen will not boot on this CPU for security reasons.\n"
+ "Pass \"allow_unsafe\" if you're trusting all your"
+ " (PV) guest kernels.\n");
+
/* AMD CPUs do not support SYSENTER outside of legacy mode. */
clear_bit(X86_FEATURE_SEP, c->x86_capability);
#endif
diff -r adb943a387c8 -r e35c8bb53255 xen/include/asm-x86/amd.h
--- a/xen/include/asm-x86/amd.h Tue Jun 12 11:39:34 2012 +0100
+++ b/xen/include/asm-x86/amd.h Tue Jun 12 11:42:57 2012 +0100
@@ -127,6 +127,9 @@
#define AMD_MODEL_RANGE_START(range) (((range) >> 12) & 0xfff)
#define AMD_MODEL_RANGE_END(range) ((range) & 0xfff)
+#define AMD_ERRATUM_121 \
+ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x0f, 0x0, 0x0, 0x3f, 0xf))
+
#define AMD_ERRATUM_170 \
AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x0f, 0x0, 0x0, 0x67, 0xf))
_______________________________________________
Xen-changelog mailing list
Xen-changelog [at] lists
http://lists.xensource.com/xen-changelog
|
