diff options
author | cperciva <cperciva@FreeBSD.org> | 2006-04-19 07:00:19 +0000 |
---|---|---|
committer | cperciva <cperciva@FreeBSD.org> | 2006-04-19 07:00:19 +0000 |
commit | 51d1ca0f6e57fd46aed0662d117beda3ff711169 (patch) | |
tree | 8a1262dea16e61c2e1b2ec392e89fc6b521fe7f4 /sys/i386/isa/npx.c | |
parent | 8d6d5b29e89c7071eac8b6c61b6678de76a1ea14 (diff) | |
download | FreeBSD-src-51d1ca0f6e57fd46aed0662d117beda3ff711169.zip FreeBSD-src-51d1ca0f6e57fd46aed0662d117beda3ff711169.tar.gz |
Correct a local information leakage bug affecting AMD FPUs.
Security: FreeBSD-SA-06:14.fpu
Diffstat (limited to 'sys/i386/isa/npx.c')
-rw-r--r-- | sys/i386/isa/npx.c | 42 |
1 files changed, 40 insertions, 2 deletions
diff --git a/sys/i386/isa/npx.c b/sys/i386/isa/npx.c index 18fc4a7..4121e3f 100644 --- a/sys/i386/isa/npx.c +++ b/sys/i386/isa/npx.c @@ -142,6 +142,10 @@ void stop_emulating(void); typedef u_char bool_t; +#ifdef CPU_ENABLE_SSE +static void fpu_clean_state(void); +#endif + static void fpusave(union savefpu *); static void fpurstor(union savefpu *); static int npx_attach(device_t dev); @@ -952,15 +956,49 @@ fpusave(addr) fnsave(addr); } +#ifdef CPU_ENABLE_SSE +/* + * On AuthenticAMD processors, the fxrstor instruction does not restore + * the x87's stored last instruction pointer, last data pointer, and last + * opcode values, except in the rare case in which the exception summary + * (ES) bit in the x87 status word is set to 1. + * + * In order to avoid leaking this information across processes, we clean + * these values by performing a dummy load before executing fxrstor(). + */ +static double dummy_variable = 0.0; +static void +fpu_clean_state(void) +{ + u_short status; + + /* + * Clear the ES bit in the x87 status word if it is currently + * set, in order to avoid causing a fault in the upcoming load. + */ + fnstsw(&status); + if (status & 0x80) + fnclex(); + + /* + * Load the dummy variable into the x87 stack. This mangles + * the x87 stack, but we don't care since we're about to call + * fxrstor() anyway. + */ + __asm __volatile("ffree %%st(7); fld %0" : : "m" (dummy_variable)); +} +#endif /* CPU_ENABLE_SSE */ + static void fpurstor(addr) union savefpu *addr; { #ifdef CPU_ENABLE_SSE - if (cpu_fxsr) + if (cpu_fxsr) { + fpu_clean_state(); fxrstor(addr); - else + } else #endif frstor(addr); } |