[src/trunk]: src/sys/arch/x86/x86 Zero the fpu registers on fpu_kern_leave.

[riastradh <riastradh%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/1fa793bc70f0
branches:  trunk
changeset: 1010954:1fa793bc70f0
user:      riastradh <riastradh%NetBSD.org@localhost>
date:      Sat Jun 13 19:00:18 2020 +0000

description:
Zero the fpu registers on fpu_kern_leave.

Avoid Spectre-class attacks on any values left in them.

diffstat:

 sys/arch/x86/x86/fpu.c |  13 +++++++++++--
 1 files changed, 11 insertions(+), 2 deletions(-)

diffs (41 lines):

diff -r 56183fcbb8fa -r 1fa793bc70f0 sys/arch/x86/x86/fpu.c
--- a/sys/arch/x86/x86/fpu.c    Sat Jun 13 18:58:26 2020 +0000
+++ b/sys/arch/x86/x86/fpu.c    Sat Jun 13 19:00:18 2020 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: fpu.c,v 1.62 2020/06/04 19:53:55 riastradh Exp $       */
+/*     $NetBSD: fpu.c,v 1.63 2020/06/13 19:00:18 riastradh Exp $       */
 
 /*
  * Copyright (c) 2008, 2019 The NetBSD Foundation, Inc.  All
@@ -96,7 +96,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: fpu.c,v 1.62 2020/06/04 19:53:55 riastradh Exp $");
+__KERNEL_RCSID(0, "$NetBSD: fpu.c,v 1.63 2020/06/13 19:00:18 riastradh Exp $");
 
 #include "opt_multiprocessor.h"
 
@@ -378,6 +378,7 @@
 void
 fpu_kern_leave(void)
 {
+       union savefpu zero_fpu __aligned(64);
        struct cpu_info *ci = curcpu();
        int s;
 
@@ -385,6 +386,14 @@
        KASSERT(ci->ci_kfpu_spl != -1);
 
        /*
+        * Zero the fpu registers; otherwise we might leak secrets
+        * through Spectre-class attacks to userland, even if there are
+        * no bugs in fpu state management.
+        */
+       memset(&zero_fpu, 0, sizeof(zero_fpu));
+       fpu_area_restore(&zero_fpu, x86_xsave_features);
+
+       /*
         * Set CR0_TS again so that the kernel can't accidentally use
         * the FPU.
         */