From: Greg Kroah-Hartman Date: Fri, 11 Aug 2023 08:54:06 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v4.14.322~4 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bd4d8189967cb4db9350967d48f14a47c9eca941;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: x86-cpu-amd-do-not-leak-quotient-data-after-a-division-by-0.patch --- diff --git a/queue-5.10/series b/queue-5.10/series index e7f03966460..571990fb0f4 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -199,3 +199,4 @@ wifi-mt76-mt7615-do-not-advertise-5-ghz-on-first-phy.patch arm-dts-imx-add-usb-alias.patch arm-dts-imx6sll-fixup-of-operating-points.patch arm-dts-nxp-imx6sll-fix-wrong-property-name-in-usbph.patch +x86-cpu-amd-do-not-leak-quotient-data-after-a-division-by-0.patch diff --git a/queue-5.10/x86-cpu-amd-do-not-leak-quotient-data-after-a-division-by-0.patch b/queue-5.10/x86-cpu-amd-do-not-leak-quotient-data-after-a-division-by-0.patch new file mode 100644 index 00000000000..b90e990f24e --- /dev/null +++ b/queue-5.10/x86-cpu-amd-do-not-leak-quotient-data-after-a-division-by-0.patch @@ -0,0 +1,100 @@ +From 77245f1c3c6495521f6a3af082696ee2f8ce3921 Mon Sep 17 00:00:00 2001 +From: "Borislav Petkov (AMD)" +Date: Sat, 5 Aug 2023 00:06:43 +0200 +Subject: x86/CPU/AMD: Do not leak quotient data after a division by 0 + +From: Borislav Petkov (AMD) + +commit 77245f1c3c6495521f6a3af082696ee2f8ce3921 upstream. + +Under certain circumstances, an integer division by 0 which faults, can +leave stale quotient data from a previous division operation on Zen1 +microarchitectures. + +Do a dummy division 0/1 before returning from the #DE exception handler +in order to avoid any leaks of potentially sensitive data. + +Signed-off-by: Borislav Petkov (AMD) +Cc: +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/include/asm/cpufeatures.h | 1 + + arch/x86/include/asm/processor.h | 2 ++ + arch/x86/kernel/cpu/amd.c | 19 +++++++++++++++++++ + arch/x86/kernel/traps.c | 2 ++ + 4 files changed, 24 insertions(+) + +--- a/arch/x86/include/asm/cpufeatures.h ++++ b/arch/x86/include/asm/cpufeatures.h +@@ -451,4 +451,5 @@ + + /* BUG word 2 */ + #define X86_BUG_SRSO X86_BUG(1*32 + 0) /* AMD SRSO bug */ ++#define X86_BUG_DIV0 X86_BUG(1*32 + 1) /* AMD DIV0 speculation bug */ + #endif /* _ASM_X86_CPUFEATURES_H */ +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -809,10 +809,12 @@ DECLARE_PER_CPU(u64, msr_misc_features_s + extern u16 amd_get_nb_id(int cpu); + extern u32 amd_get_nodes_per_socket(void); + extern bool cpu_has_ibpb_brtype_microcode(void); ++extern void amd_clear_divider(void); + #else + static inline u16 amd_get_nb_id(int cpu) { return 0; } + static inline u32 amd_get_nodes_per_socket(void) { return 0; } + static inline bool cpu_has_ibpb_brtype_microcode(void) { return false; } ++static inline void amd_clear_divider(void) { } + #endif + + static inline uint32_t hypervisor_cpuid_base(const char *sig, uint32_t leaves) +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -76,6 +76,10 @@ static const int amd_zenbleed[] = + AMD_MODEL_RANGE(0x17, 0x60, 0x0, 0x7f, 0xf), + AMD_MODEL_RANGE(0x17, 0xa0, 0x0, 0xaf, 0xf)); + ++static const int amd_div0[] = ++ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0x00, 0x0, 0x2f, 0xf), ++ AMD_MODEL_RANGE(0x17, 0x50, 0x0, 0x5f, 0xf)); ++ + static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum) + { + int osvw_id = *erratum++; +@@ -1168,6 +1172,11 @@ static void init_amd(struct cpuinfo_x86 + check_null_seg_clears_base(c); + + zenbleed_check(c); ++ ++ if (cpu_has_amd_erratum(c, amd_div0)) { ++ pr_notice_once("AMD Zen1 DIV0 bug detected. Disable SMT for full protection.\n"); ++ setup_force_cpu_bug(X86_BUG_DIV0); ++ } + } + + #ifdef CONFIG_X86_32 +@@ -1312,3 +1321,13 @@ void amd_check_microcode(void) + { + on_each_cpu(zenbleed_check_cpu, NULL, 1); + } ++ ++/* ++ * Issue a DIV 0/1 insn to clear any division data from previous DIV ++ * operations. ++ */ ++void noinstr amd_clear_divider(void) ++{ ++ asm volatile(ALTERNATIVE("", "div %2\n\t", X86_BUG_DIV0) ++ :: "a" (0), "d" (0), "r" (1)); ++} +--- a/arch/x86/kernel/traps.c ++++ b/arch/x86/kernel/traps.c +@@ -198,6 +198,8 @@ DEFINE_IDTENTRY(exc_divide_error) + { + do_error_trap(regs, 0, "divide error", X86_TRAP_DE, SIGFPE, + FPE_INTDIV, error_get_trap_addr(regs)); ++ ++ amd_clear_divider(); + } + + DEFINE_IDTENTRY(exc_overflow)