81501c15a5
23686-pygrub-solaris.patch 23697-pygrub-grub2.patch 23944-pygrub-debug.patch 23998-pygrub-GPT.patch 23999-pygrub-grub2.patch 24064-pygrub-HybridISO.patch 24401-pygrub-scrolling.patch 24402-pygrub-edit-fix.patch 24460-pygrub-extlinux.patch 24706-pygrub-extlinux.patch - Revised version of security patch and an additional patch for bnc#764077 x86_64-AMD-erratum-121.patch x86_64-allow-unsafe-adjust.patch - bnc#764077 - VUL-0: EMBARGOED: xen: XSA-9: denial of service on older AMD systems x86_64-AMD-erratum-121.patch - Revised version of security patch for bnc#757537 x86_64-sysret-canonical.patch - bnc#757537 - VUL-0: xen: CVE-2012-0217 PV guest escalation x86_64-sysret-canonical.patch - bnc#757970 - VUL-1: xen: guest denial of service on syscall GPF generation x86_64-trap-bounce-flags.patch OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=190
39 lines
1.3 KiB
Diff
39 lines
1.3 KiB
Diff
References: CVE-2012-2934, bnc#764077
|
|
|
|
--- a/xen/arch/x86/cpu/amd.c
|
|
+++ b/xen/arch/x86/cpu/amd.c
|
|
@@ -32,6 +32,9 @@
|
|
static char opt_famrev[14];
|
|
string_param("cpuid_mask_cpu", opt_famrev);
|
|
|
|
+static int opt_allow_unsafe;
|
|
+boolean_param("allow_unsafe", opt_allow_unsafe);
|
|
+
|
|
static inline void wrmsr_amd(unsigned int index, unsigned int lo,
|
|
unsigned int hi)
|
|
{
|
|
@@ -620,6 +623,11 @@ static void __devinit init_amd(struct cp
|
|
clear_bit(X86_FEATURE_MCE, c->x86_capability);
|
|
|
|
#ifdef __x86_64__
|
|
+ if (cpu_has_amd_erratum(c, AMD_ERRATUM_121) && !opt_allow_unsafe)
|
|
+ panic("Xen will not boot on this CPU for security reasons.\n"
|
|
+ "Pass \"allow_unsafe\" if you're trusting all your"
|
|
+ " (PV) guest kernels.\n");
|
|
+
|
|
/* AMD CPUs do not support SYSENTER outside of legacy mode. */
|
|
clear_bit(X86_FEATURE_SEP, c->x86_capability);
|
|
|
|
--- a/xen/include/asm-x86/amd.h
|
|
+++ b/xen/include/asm-x86/amd.h
|
|
@@ -127,6 +127,9 @@
|
|
#define AMD_MODEL_RANGE_START(range) (((range) >> 12) & 0xfff)
|
|
#define AMD_MODEL_RANGE_END(range) ((range) & 0xfff)
|
|
|
|
+#define AMD_ERRATUM_121 \
|
|
+ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x0f, 0x0, 0x0, 0x3f, 0xf))
|
|
+
|
|
#define AMD_ERRATUM_170 \
|
|
AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x0f, 0x0, 0x0, 0x67, 0xf))
|
|
|