[src/netbsd-2]: src/sys/arch Pull up following revision(s) (requested by adri...

[tron <tron%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/c2159fdc6660
branches:  netbsd-2
changeset: 564472:c2159fdc6660
user:      tron <tron%NetBSD.org@localhost>
date:      Fri May 12 15:47:39 2006 +0000

description:
Pull up following revision(s) (requested by adrianp in ticket #10553):
        sys/arch/amd64/amd64/fpu.c: revision 1.14
        sys/arch/i386/isa/npx.c: revision 1.112
Apply fix from FreeBSD's advisory: fxrstor on AMD FPU's does not restore
FIP,FDP,FOP thus leaking other process's execution history.

diffstat:

 sys/arch/amd64/amd64/fpu.c |  31 +++++++++++++++++++++++++++----
 sys/arch/i386/isa/npx.c    |  24 ++++++++++++++++++++++--
 2 files changed, 49 insertions(+), 6 deletions(-)

diffs (104 lines):

diff -r 3c56503ac37a -r c2159fdc6660 sys/arch/amd64/amd64/fpu.c
--- a/sys/arch/amd64/amd64/fpu.c        Tue May 09 12:09:50 2006 +0000
+++ b/sys/arch/amd64/amd64/fpu.c        Fri May 12 15:47:39 2006 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: fpu.c,v 1.11 2004/03/05 21:21:14 drochner Exp $        */
+/*     $NetBSD: fpu.c,v 1.11.4.1 2006/05/12 15:47:39 tron Exp $        */
 
 /*-
  * Copyright (c) 1991 The Regents of the University of California.
@@ -71,7 +71,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: fpu.c,v 1.11 2004/03/05 21:21:14 drochner Exp $");
+__KERNEL_RCSID(0, "$NetBSD: fpu.c,v 1.11.4.1 2006/05/12 15:47:39 tron Exp $");
 
 #include "opt_multiprocessor.h"
 
@@ -119,6 +119,8 @@
 
 #define        fninit()                __asm("fninit")
 #define fwait()                        __asm("fwait")
+#define fnclex()               __asm("fnclex")
+#define        fnstsw(addr)            __asm("fnstsw %0" : "=m" (*addr))
 #define        fxsave(addr)            __asm("fxsave %0" : "=m" (*addr))
 #define        fxrstor(addr)           __asm("fxrstor %0" : : "m" (*addr))
 #define fldcw(addr)            __asm("fldcw %0" : : "m" (*addr))
@@ -276,8 +278,29 @@
                mxcsr = l->l_addr->u_pcb.pcb_savefpu.fp_fxsave.fx_mxcsr;
                ldmxcsr(&mxcsr);
                l->l_md.md_flags |= MDP_USEDFPU;
-       } else
-               fxrstor(&l->l_addr->u_pcb.pcb_savefpu);
+       } else {
+               /*
+                * AMD FPU's do not restore FIP, FDP, and FOP on fxrstor,
+                * leaking other process's execution history. Clear them
+                * manually.
+                */
+               static const double zero = 0.0;
+               int status;
+               /*
+                * Clear the ES bit in the x87 status word if it is currently
+                * set, in order to avoid causing a fault in the upcoming load.
+                */
+               fnstsw(&status);
+               if (status & 0x80)
+                       fnclex();
+               /*
+                * Load the dummy variable into the x87 stack.  This mangles
+                * the x87 stack, but we don't care since we're about to call
+                * fxrstor() anyway.
+                */
+               __asm __volatile("ffree %%st(7)\n\tfld %0" : : "m" (zero));
+               fxrstor(&l->l_addr->u_pcb.pcb_savefpu.sv_xmm);
+       }
 }
 
 
diff -r 3c56503ac37a -r c2159fdc6660 sys/arch/i386/isa/npx.c
--- a/sys/arch/i386/isa/npx.c   Tue May 09 12:09:50 2006 +0000
+++ b/sys/arch/i386/isa/npx.c   Fri May 12 15:47:39 2006 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: npx.c,v 1.103.2.2 2004/07/07 17:10:16 tron Exp $       */
+/*     $NetBSD: npx.c,v 1.103.2.2.2.1 2006/05/12 15:47:39 tron Exp $   */
 
 /*-
  * Copyright (c) 1991 The Regents of the University of California.
@@ -67,7 +67,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: npx.c,v 1.103.2.2 2004/07/07 17:10:16 tron Exp $");
+__KERNEL_RCSID(0, "$NetBSD: npx.c,v 1.103.2.2.2.1 2006/05/12 15:47:39 tron Exp $");
 
 #if 0
 #define IPRINTF(x)     printf x
@@ -565,6 +565,26 @@
                fldcw(&l->l_addr->u_pcb.pcb_savefpu.sv_xmm.sv_env.en_cw);
                l->l_md.md_flags |= MDL_USEDFPU;
        } else {
+               /*
+                * AMD FPU's do not restore FIP, FDP, and FOP on fxrstor,
+                * leaking other process's execution history. Clear them
+                * manually.
+                */
+               static const double zero = 0.0;
+               int status;
+               /*
+                * Clear the ES bit in the x87 status word if it is currently
+                * set, in order to avoid causing a fault in the upcoming load.
+                */
+               fnstsw(&status);
+               if (status & 0x80)
+                       fnclex();
+               /*
+                * Load the dummy variable into the x87 stack.  This mangles
+                * the x87 stack, but we don't care since we're about to call
+                * fxrstor() anyway.
+                */
+               __asm __volatile("ffree %%st(7)\n\tfld %0" : : "m" (zero));
                fxrstor(&l->l_addr->u_pcb.pcb_savefpu.sv_xmm);
        }