6.4-stable patches

added patches:
	x86-cpu-amd-do-not-leak-quotient-data-after-a-division-by-0.patch

diff --git a/queue-6.4/series b/queue-6.4/series
index 2dd9be77a1cea2f354a795f13ab4c16ce64ff4ef..2a43a624b97cc33505d5dae7a2cd9d09f70eaf3e 100644 (file)
--- a/queue-6.4/series
+++ b/queue-6.4/series
@@ -163,3 +163,4 @@ drm-i915-gt-rename-flags-with-bit_group_x-according-.patch
 drm-i915-gt-poll-aux-invalidation-register-bit-on-in.patch
 drm-i915-gt-support-aux-invalidation-on-all-engines.patch
 drm-i915-gt-enable-the-ccs_flush-bit-in-the-pipe-con.patch
+x86-cpu-amd-do-not-leak-quotient-data-after-a-division-by-0.patch

diff --git a/queue-6.4/x86-cpu-amd-do-not-leak-quotient-data-after-a-division-by-0.patch b/queue-6.4/x86-cpu-amd-do-not-leak-quotient-data-after-a-division-by-0.patch
new file mode 100644 (file)
index 0000000..542e37f
--- /dev/null
+++ b/queue-6.4/x86-cpu-amd-do-not-leak-quotient-data-after-a-division-by-0.patch
@@ -0,0 +1,100 @@
+From 77245f1c3c6495521f6a3af082696ee2f8ce3921 Mon Sep 17 00:00:00 2001
+From: "Borislav Petkov (AMD)" <bp@alien8.de>
+Date: Sat, 5 Aug 2023 00:06:43 +0200
+Subject: x86/CPU/AMD: Do not leak quotient data after a division by 0
+
+From: Borislav Petkov (AMD) <bp@alien8.de>
+
+commit 77245f1c3c6495521f6a3af082696ee2f8ce3921 upstream.
+
+Under certain circumstances, an integer division by 0 which faults, can
+leave stale quotient data from a previous division operation on Zen1
+microarchitectures.
+
+Do a dummy division 0/1 before returning from the #DE exception handler
+in order to avoid any leaks of potentially sensitive data.
+
+Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
+Cc: <stable@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/cpufeatures.h |    1 +
+ arch/x86/include/asm/processor.h   |    2 ++
+ arch/x86/kernel/cpu/amd.c          |   19 +++++++++++++++++++
+ arch/x86/kernel/traps.c            |    2 ++
+ 4 files changed, 24 insertions(+)
+
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -495,4 +495,5 @@
+ 
+ /* BUG word 2 */
+ #define X86_BUG_SRSO                  X86_BUG(1*32 + 0) /* AMD SRSO bug */
++#define X86_BUG_DIV0                  X86_BUG(1*32 + 1) /* AMD DIV0 speculation bug */
+ #endif /* _ASM_X86_CPUFEATURES_H */
+--- a/arch/x86/include/asm/processor.h
++++ b/arch/x86/include/asm/processor.h
+@@ -684,10 +684,12 @@ extern u16 get_llc_id(unsigned int cpu);
+ extern u32 amd_get_nodes_per_socket(void);
+ extern u32 amd_get_highest_perf(void);
+ extern bool cpu_has_ibpb_brtype_microcode(void);
++extern void amd_clear_divider(void);
+ #else
+ static inline u32 amd_get_nodes_per_socket(void)      { return 0; }
+ static inline u32 amd_get_highest_perf(void)          { return 0; }
+ static inline bool cpu_has_ibpb_brtype_microcode(void)        { return false; }
++static inline void amd_clear_divider(void)            { }
+ #endif
+ 
+ extern unsigned long arch_align_stack(unsigned long sp);
+--- a/arch/x86/kernel/cpu/amd.c
++++ b/arch/x86/kernel/cpu/amd.c
+@@ -75,6 +75,10 @@ static const int amd_zenbleed[] =
+                          AMD_MODEL_RANGE(0x17, 0x60, 0x0, 0x7f, 0xf),
+                          AMD_MODEL_RANGE(0x17, 0xa0, 0x0, 0xaf, 0xf));
+ 
++static const int amd_div0[] =
++      AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0x00, 0x0, 0x2f, 0xf),
++                         AMD_MODEL_RANGE(0x17, 0x50, 0x0, 0x5f, 0xf));
++
+ static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
+ {
+       int osvw_id = *erratum++;
+@@ -1130,6 +1134,11 @@ static void init_amd(struct cpuinfo_x86
+               WARN_ON_ONCE(msr_set_bit(MSR_EFER, _EFER_AUTOIBRS));
+ 
+       zenbleed_check(c);
++
++      if (cpu_has_amd_erratum(c, amd_div0)) {
++              pr_notice_once("AMD Zen1 DIV0 bug detected. Disable SMT for full protection.\n");
++              setup_force_cpu_bug(X86_BUG_DIV0);
++      }
+ }
+ 
+ #ifdef CONFIG_X86_32
+@@ -1309,3 +1318,13 @@ void amd_check_microcode(void)
+ {
+       on_each_cpu(zenbleed_check_cpu, NULL, 1);
+ }
++
++/*
++ * Issue a DIV 0/1 insn to clear any division data from previous DIV
++ * operations.
++ */
++void noinstr amd_clear_divider(void)
++{
++      asm volatile(ALTERNATIVE("", "div %2\n\t", X86_BUG_DIV0)
++                   :: "a" (0), "d" (0), "r" (1));
++}
+--- a/arch/x86/kernel/traps.c
++++ b/arch/x86/kernel/traps.c
+@@ -206,6 +206,8 @@ DEFINE_IDTENTRY(exc_divide_error)
+ {
+       do_error_trap(regs, 0, "divide error", X86_TRAP_DE, SIGFPE,
+                     FPE_INTDIV, error_get_trap_addr(regs));
++
++      amd_clear_divider();
+ }
+ 
+ DEFINE_IDTENTRY(exc_overflow)