[Xen-changelog] [xen-4.1-testing] x86-64: detect processors subject to AMD erratum #121 and refuse to boot

[Xen patchbot-4.1-testing <patchbot@xxxxxxx>]

# HG changeset patch
# User Jan Beulich <JBeulich@xxxxxxxx>
# Date 1339497777 -3600
# Node ID a9c0a89c08f2a1c92f64f001b653d7c02fbc852c
# Parent  0fec1afa463808d91defa43f12cb744d3258a868
x86-64: detect processors subject to AMD erratum #121 and refuse to boot

Processors with this erratum are subject to a DoS attack by unprivileged
guest users.

This is XSA-9 / CVE-2012-2934.

Signed-off-by: Jan Beulich <JBeulich@xxxxxxxx>
Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
Committed-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>

xen-unstable changeset:   25481:422880dc94a4
xen-unstable date:        Tue Jun 12 11:33:42 2012 +0100
Committed-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
---


diff -r 0fec1afa4638 -r a9c0a89c08f2 xen/arch/x86/cpu/amd.c
--- a/xen/arch/x86/cpu/amd.c    Tue Jun 12 11:46:11 2012 +0100
+++ b/xen/arch/x86/cpu/amd.c    Tue Jun 12 11:42:57 2012 +0100
@@ -32,6 +32,9 @@
 static char opt_famrev[14];
 string_param("cpuid_mask_cpu", opt_famrev);
 
+static int opt_allow_unsafe;
+boolean_param("allow_unsafe", opt_allow_unsafe);
+
 static inline void wrmsr_amd(unsigned int index, unsigned int lo, 
                unsigned int hi)
 {
@@ -620,6 +623,11 @@ static void __devinit init_amd(struct cp
                clear_bit(X86_FEATURE_MCE, c->x86_capability);
 
 #ifdef __x86_64__
+       if (cpu_has_amd_erratum(c, AMD_ERRATUM_121) && !opt_allow_unsafe)
+               panic("Xen will not boot on this CPU for security reasons.\n"
+                     "Pass \"allow_unsafe\" if you're trusting all your"
+                     " (PV) guest kernels.\n");
+
        /* AMD CPUs do not support SYSENTER outside of legacy mode. */
        clear_bit(X86_FEATURE_SEP, c->x86_capability);
 
diff -r 0fec1afa4638 -r a9c0a89c08f2 xen/include/asm-x86/amd.h
--- a/xen/include/asm-x86/amd.h Tue Jun 12 11:46:11 2012 +0100
+++ b/xen/include/asm-x86/amd.h Tue Jun 12 11:42:57 2012 +0100
@@ -127,6 +127,9 @@
 #define AMD_MODEL_RANGE_START(range)    (((range) >> 12) & 0xfff)
 #define AMD_MODEL_RANGE_END(range)      ((range) & 0xfff)
 
+#define AMD_ERRATUM_121                                                 \
+    AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x0f, 0x0, 0x0, 0x3f, 0xf))
+
 #define AMD_ERRATUM_170                                                 \
     AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x0f, 0x0, 0x0, 0x67, 0xf))
 

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog