Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
openSUSE:Evergreen:Maintenance:114
xen.openSUSE_Evergreen_11.4
25481-x86_64-AMD-erratum-121.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 25481-x86_64-AMD-erratum-121.patch of Package xen.openSUSE_Evergreen_11.4
References: CVE-2012-2934, bnc#764077 # HG changeset patch # User Jan Beulich <JBeulich@suse.com> # Date 1339497222 -3600 # Node ID bc2f3a848f9a7c23b4a3736d0215732b1f039219 # Parent 76eaf5966c05a4a10fd29eee6968977fd9d4ce6d x86-64: detect processors subject to AMD erratum #121 and refuse to boot Processors with this erratum are subject to a DoS attack by unprivileged guest users. This is XSA-9 / CVE-2012-2934. Signed-off-by: Jan Beulich <JBeulich@suse.com> Signed-off-by: Ian Campbell <ian.campbell@citrix.com> Committed-by: Ian Jackson <ian.jackson@eu.citrix.com> --- a/xen/arch/x86/cpu/amd.c +++ b/xen/arch/x86/cpu/amd.c @@ -33,6 +33,9 @@ void start_svm(struct cpuinfo_x86 *c); static char opt_famrev[14]; string_param("cpuid_mask_cpu", opt_famrev); +static int opt_allow_unsafe; +boolean_param("allow_unsafe", opt_allow_unsafe); + static inline void wrmsr_amd(unsigned int index, unsigned int lo, unsigned int hi) { @@ -603,6 +606,11 @@ static void __devinit init_amd(struct cp clear_bit(X86_FEATURE_MCE, c->x86_capability); #ifdef __x86_64__ + if (cpu_has_amd_erratum(c, AMD_ERRATUM_121) && !opt_allow_unsafe) + panic("Xen will not boot on this CPU for security reasons.\n" + "Pass \"allow_unsafe\" if you're trusting all your" + " (PV) guest kernels.\n"); + /* AMD CPUs do not support SYSENTER outside of legacy mode. */ clear_bit(X86_FEATURE_SEP, c->x86_capability); #endif --- a/xen/include/asm-x86/amd.h +++ b/xen/include/asm-x86/amd.h @@ -127,6 +127,9 @@ #define AMD_MODEL_RANGE_START(range) (((range) >> 12) & 0xfff) #define AMD_MODEL_RANGE_END(range) ((range) & 0xfff) +#define AMD_ERRATUM_121 \ + AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x0f, 0x0, 0x0, 0x3f, 0xf)) + #define AMD_ERRATUM_170 \ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x0f, 0x0, 0x0, 0x67, 0xf))
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor