Fix CVE-2010-0742

[oweals/openssl.git] / crypto / x86cpuid.pl

diff --git a/crypto/x86cpuid.pl b/crypto/x86cpuid.pl
index d4066e8858270217b6e4f1969c14004d9f2d203c..4408ef2936ecff908d7965e2fa9ed718ccfe6331 100644 (file)
--- a/crypto/x86cpuid.pl
+++ b/crypto/x86cpuid.pl
@@ -19,13 +19,41 @@ for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); }
        &pop    ("eax");
        &xor    ("ecx","eax");
        &bt     ("ecx",21);
-       &jnc    (&label("nocpuid"));
+       &jnc    (&label("done"));
+       &xor    ("eax","eax");
+       &cpuid  ();
+       &xor    ("eax","eax");
+       &cmp    ("ebx",0x756e6547);     # "Genu"
+       &data_byte(0x0f,0x95,0xc0);     #&setne (&LB("eax"));
+       &mov    ("ebp","eax");
+       &cmp    ("edx",0x49656e69);     # "ineI"
+       &data_byte(0x0f,0x95,0xc0);     #&setne (&LB("eax"));
+       &or     ("ebp","eax");
+       &cmp    ("ecx",0x6c65746e);     # "ntel"
+       &data_byte(0x0f,0x95,0xc0);     #&setne (&LB("eax"));
+       &or     ("ebp","eax");
        &mov    ("eax",1);
        &cpuid  ();
-&set_label("nocpuid");
+       &cmp    ("ebp",0);
+       &jne    (&label("notP4"));
+       &and    ("eax",15<<8);          # familiy ID
+       &cmp    ("eax",15<<8);          # P4?
+       &jne    (&label("notP4"));
+       &or     ("edx",1<<20);          # use reserved bit to engage RC4_CHAR
+&set_label("notP4");
+       &bt     ("edx",28);             # test hyper-threading bit
+       &jnc    (&label("done"));
+       &shr    ("ebx",16);
+       &and    ("ebx",0xff);
+       &cmp    ("ebx",1);              # see if cache is shared(*)
+       &ja     (&label("done"));
+       &and    ("edx",0xefffffff);     # clear hyper-threading bit if not
+&set_label("done");
        &mov    ("eax","edx");
        &mov    ("edx","ecx");
 &function_end("OPENSSL_ia32_cpuid");
+# (*)  on Core2 this value is set to 2 denoting the fact that L2
+#      cache is shared between cores.
 
 &external_label("OPENSSL_ia32cap_P");
 
@@ -183,7 +211,7 @@ for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); }
                &mov    ("eax",&DWP(12+$i*4,"ebp"));
                &mov    (&DWP(0+$i*4,"esp"),"eax");
                }
-       &call   (&DWP(8,"ebp"));# make the call...
+       &call_ptr       (&DWP(8,"ebp"));# make the call...
        &mov    ("esp","ebp");  # ... and just restore the stack pointer
                                # without paying attention to what we called,
                                # (__cdecl *func) or (__stdcall *one).