[src-draft/trunk]: src/sys/arch/x86/x86 Zero the fpu registers on fpu_kern_le...

[Taylor R Campbell <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src-all/rev/74bfad1c2e83
branches:  trunk
changeset: 934463:74bfad1c2e83
user:      Taylor R Campbell <riastradh%NetBSD.org@localhost>
date:      Thu Jun 04 03:30:18 2020 +0000

description:
Zero the fpu registers on fpu_kern_leave.

Avoid Spectre-class attacks on any values left in them.

diffstat:

 sys/arch/x86/x86/fpu.c |  9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diffs (26 lines):

diff -r d0dc4b9eb047 -r 74bfad1c2e83 sys/arch/x86/x86/fpu.c
--- a/sys/arch/x86/x86/fpu.c    Fri May 29 20:34:04 2020 +0000
+++ b/sys/arch/x86/x86/fpu.c    Thu Jun 04 03:30:18 2020 +0000
@@ -378,6 +378,7 @@
 void
 fpu_kern_leave(void)
 {
+       union savefpu zero_fpu __aligned(64);
        struct cpu_info *ci = curcpu();
        int s;
 
@@ -385,6 +386,14 @@
        KASSERT(ci->ci_kfpu_spl != -1);
 
        /*
+        * Zero the fpu registers; otherwise we might leak secrets
+        * through Spectre-class attacks to userland, even if there are
+        * no bugs in fpu state management.
+        */
+       memset(&zero_fpu, 0, sizeof(zero_fpu));
+       fpu_area_restore(&zero_fpu, x86_xsave_features);
+
+       /*
         * Set CR0_TS again so that the kernel can't accidentally use
         * the FPU.
         */