aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMaxim Konovalov <maxim@FreeBSD.org>2006-04-21 18:48:36 +0000
committerMaxim Konovalov <maxim@FreeBSD.org>2006-04-21 18:48:36 +0000
commitd16c3bfa464da08e5e61ac8fd762a2d864fa2e34 (patch)
tree96b10b74ecaaef5ac4c29dff03957d5e2a9871ed
parentd8a1588b136706dda2f0772f7270e8773c282361 (diff)
downloadsrc-releng/4.9.tar.gz
src-releng/4.9.zip
o Merge FreeBSD-SA-06:14.fpu.releng/4.9
Approved by: so (cperciva)
Notes
Notes: svn path=/releng/4.9/; revision=157946
-rw-r--r--UPDATING3
-rw-r--r--sys/conf/newvers.sh2
-rw-r--r--sys/i386/isa/npx.c42
3 files changed, 44 insertions, 3 deletions
diff --git a/UPDATING b/UPDATING
index 675511faa740..0b0a018ee8af 100644
--- a/UPDATING
+++ b/UPDATING
@@ -17,6 +17,9 @@ minimal number of processes, if possible, for that patch. For those
updates that don't have an advisory, or to be safe, you can do a full
build and install as described in the COMMON ITEMS section.
+20060421: p25 FreeBSD-SA-06:14.fpu
+ Correct a local information leakage bug affecting AMD FPUs.
+
20060323: p24 FreeBSD-SA-06:11.ipsec, FreeBSD-SA-06:12.opie
Add missing code needed for the detection of IPSec packet
replays. [06:11]
diff --git a/sys/conf/newvers.sh b/sys/conf/newvers.sh
index 47f07e32f26d..0d80f475a5bb 100644
--- a/sys/conf/newvers.sh
+++ b/sys/conf/newvers.sh
@@ -36,7 +36,7 @@
TYPE="FreeBSD"
REVISION="4.9"
-BRANCH="RELEASE-p24"
+BRANCH="RELEASE-p25"
RELEASE="${REVISION}-${BRANCH}"
VERSION="${TYPE} ${RELEASE}"
diff --git a/sys/i386/isa/npx.c b/sys/i386/isa/npx.c
index 9c08f57d8c03..2afc859ef8d2 100644
--- a/sys/i386/isa/npx.c
+++ b/sys/i386/isa/npx.c
@@ -137,6 +137,10 @@ void stop_emulating __P((void));
typedef u_char bool_t;
+#ifdef CPU_ENABLE_SSE
+static void fpu_clean_state(void);
+#endif
+
static int npx_attach __P((device_t dev));
void npx_intr __P((void *));
static void npx_identify __P((driver_t *driver, device_t parent));
@@ -914,15 +918,49 @@ fpusave(addr)
fnsave(addr);
}
+#ifdef CPU_ENABLE_SSE
+/*
+ * On AuthenticAMD processors, the fxrstor instruction does not restore
+ * the x87's stored last instruction pointer, last data pointer, and last
+ * opcode values, except in the rare case in which the exception summary
+ * (ES) bit in the x87 status word is set to 1.
+ *
+ * In order to avoid leaking this information across processes, we clean
+ * these values by performing a dummy load before executing fxrstor().
+ */
+static double dummy_variable = 0.0;
+static void
+fpu_clean_state(void)
+{
+ u_short status;
+
+ /*
+ * Clear the ES bit in the x87 status word if it is currently
+ * set, in order to avoid causing a fault in the upcoming load.
+ */
+ fnstsw(&status);
+ if (status & 0x80)
+ fnclex();
+
+ /*
+ * Load the dummy variable into the x87 stack. This mangles
+ * the x87 stack, but we don't care since we're about to call
+ * fxrstor() anyway.
+ */
+ __asm __volatile("ffree %%st(7); fld %0" : : "m" (dummy_variable));
+}
+#endif /* CPU_ENABLE_SSE */
+
static void
fpurstor(addr)
union savefpu *addr;
{
#ifdef CPU_ENABLE_SSE
- if (cpu_fxsr)
+ if (cpu_fxsr) {
+ fpu_clean_state();
fxrstor(addr);
- else
+ } else
#endif
frstor(addr);
}