aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorColin Percival <cperciva@FreeBSD.org>2006-04-19 07:03:14 +0000
committerColin Percival <cperciva@FreeBSD.org>2006-04-19 07:03:14 +0000
commit16bd853276cbaaea5922bca3bebd2452b4a985f7 (patch)
treeccf41a864908d613207f3964ae5a3d69edf6e3fd
parentbf41e5cc4c8f3887a854fa9e6ee42a8d53c3c228 (diff)
downloadsrc-16bd853276cbaaea5922bca3bebd2452b4a985f7.tar.gz
src-16bd853276cbaaea5922bca3bebd2452b4a985f7.zip
MFC: Correct a local information leakage bug affecting AMD FPUs.
Security: FreeBSD-SA-06:14.fpu Approved by: so (cperciva)
Notes
Notes: svn path=/releng/4.10/; revision=157863
-rw-r--r--UPDATING3
-rw-r--r--sys/conf/newvers.sh2
-rw-r--r--sys/i386/isa/npx.c42
3 files changed, 44 insertions, 3 deletions
diff --git a/UPDATING b/UPDATING
index ee09e13cfa78..8883ad7b41bd 100644
--- a/UPDATING
+++ b/UPDATING
@@ -17,6 +17,9 @@ minimal number of processes, if possible, for that patch. For those
updates that don't have an advisory, or to be safe, you can do a full
build and install as described in the COMMON ITEMS section.
+20060419: p23 FreeBSD-SA-06:14.fpu
+ Correct a local information leakage bug affecting AMD FPUs.
+
20060322: p22 FreeBSD-SA-06:11.ipsec, FreeBSD-SA-06:12.opie,
FreeBSD-SA-06:13.sendmail
Add missing code needed for the detection of IPSec packet
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index e2839bdbef27..1dca0aafd682 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -36,7 +36,7 @@
TYPE="FreeBSD"
REVISION="4.10"
-BRANCH="RELEASE-p22"
+BRANCH="RELEASE-p23"
RELEASE="${REVISION}-${BRANCH}"
VERSION="${TYPE} ${RELEASE}"
diff --git a/sys/i386/isa/npx.c b/sys/i386/isa/npx.c
index 9c08f57d8c03..2afc859ef8d2 100644
--- a/sys/i386/isa/npx.c
+++ b/sys/i386/isa/npx.c
@@ -137,6 +137,10 @@ void stop_emulating __P((void));
typedef u_char bool_t;
+#ifdef CPU_ENABLE_SSE
+static void fpu_clean_state(void);
+#endif
+
static int npx_attach __P((device_t dev));
void npx_intr __P((void *));
static void npx_identify __P((driver_t *driver, device_t parent));
@@ -914,15 +918,49 @@ fpusave(addr)
fnsave(addr);
}
+#ifdef CPU_ENABLE_SSE
+/*
+ * On AuthenticAMD processors, the fxrstor instruction does not restore
+ * the x87's stored last instruction pointer, last data pointer, and last
+ * opcode values, except in the rare case in which the exception summary
+ * (ES) bit in the x87 status word is set to 1.
+ *
+ * In order to avoid leaking this information across processes, we clean
+ * these values by performing a dummy load before executing fxrstor().
+ */
+static double dummy_variable = 0.0;
+static void
+fpu_clean_state(void)
+{
+ u_short status;
+
+ /*
+ * Clear the ES bit in the x87 status word if it is currently
+ * set, in order to avoid causing a fault in the upcoming load.
+ */
+ fnstsw(&status);
+ if (status & 0x80)
+ fnclex();
+
+ /*
+ * Load the dummy variable into the x87 stack. This mangles
+ * the x87 stack, but we don't care since we're about to call
+ * fxrstor() anyway.
+ */
+ __asm __volatile("ffree %%st(7); fld %0" : : "m" (dummy_variable));
+}
+#endif /* CPU_ENABLE_SSE */
+
static void
fpurstor(addr)
union savefpu *addr;
{
#ifdef CPU_ENABLE_SSE
- if (cpu_fxsr)
+ if (cpu_fxsr) {
+ fpu_clean_state();
fxrstor(addr);
- else
+ } else
#endif
frstor(addr);
}