x86-64: detect processors subject to AMD erratum #121 and refuse to boot

Processors with this erratum are subject to a DoS attack by unprivileged
guest users.

This is XSA-9 / CVE-2012-2934.

Signed-off-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Committed-by: Ian Jackson <ian.jackson@eu.citrix.com>

diff --git a/docs/misc/xen-command-line.markdown b/docs/misc/xen-command-line.markdown
index 1f3faaa6de6377a0fead2c73b809e19a8a8bf055..7ceaa3b5557ea25c5341fdff3e1ba859cb052b74 100644 (file)
--- a/docs/misc/xen-command-line.markdown
+++ b/docs/misc/xen-command-line.markdown
@@ -126,6 +126,16 @@ Override Xen's logic for choosing the APIC driver.  By default, if
 there are more than 8 CPUs, Xen will switch to `bigsmp` over
 `default`.
 
+### allow\_unsafe
+> `= <boolean>`
+
+Force boot on potentially unsafe systems. By default Xen will refuse to boot on
+systems with the following errata:
+
+* AMD Erratum 121. Processors with this erratum are subject to a guest
+  triggerable Denial of Service. Override only if you trust all of your PV
+  guests.
+
 ### apic\_verbosity
 > `= verbose | debug`
 

diff --git a/xen/arch/x86/cpu/amd.c b/xen/arch/x86/cpu/amd.c
index b8c3a324805eacb26613a51abad2598920b7acd0..81f719682734d8719736192264ae0214cf97939f 100644 (file)
--- a/xen/arch/x86/cpu/amd.c
+++ b/xen/arch/x86/cpu/amd.c
@@ -32,6 +32,9 @@
 static char opt_famrev[14];
 string_param("cpuid_mask_cpu", opt_famrev);
 
+static bool_t opt_allow_unsafe;
+boolean_param("allow_unsafe", opt_allow_unsafe);
+
 static inline void wrmsr_amd(unsigned int index, unsigned int lo, 
                unsigned int hi)
 {
@@ -493,6 +496,11 @@ static void __devinit init_amd(struct cpuinfo_x86 *c)
                clear_bit(X86_FEATURE_MWAIT, c->x86_capability);
 
 #ifdef __x86_64__
+       if (cpu_has_amd_erratum(c, AMD_ERRATUM_121) && !opt_allow_unsafe)
+               panic("Xen will not boot on this CPU for security reasons.\n"
+                     "Pass \"allow_unsafe\" if you're trusting all your"
+                     " (PV) guest kernels.\n");
+
        /* AMD CPUs do not support SYSENTER outside of legacy mode. */
        clear_bit(X86_FEATURE_SEP, c->x86_capability);
 

diff --git a/xen/include/asm-x86/amd.h b/xen/include/asm-x86/amd.h
index 9a7fa3be655f193d81b49473a5a72ecfca0867c7..94bd9cce09f3c8fcbfddd2253064a00a9b965086 100644 (file)
--- a/xen/include/asm-x86/amd.h
+++ b/xen/include/asm-x86/amd.h
@@ -127,6 +127,9 @@
 #define AMD_MODEL_RANGE_START(range)    (((range) >> 12) & 0xfff)
 #define AMD_MODEL_RANGE_END(range)      ((range) & 0xfff)
 
+#define AMD_ERRATUM_121                                                 \
+    AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x0f, 0x0, 0x0, 0x3f, 0xf))
+
 #define AMD_ERRATUM_170                                                 \
     AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x0f, 0x0, 0x0, 0x67, 0xf))