Module Name: src
Committed By: maxv
Date: Sat Jul 14 14:46:41 UTC 2018
Modified Files:
src/sys/arch/x86/x86: via_padlock.c
Log Message:
Add splhigh() around the FPU code, we don't want to be preempted in the
middle, this could corrupt the FPU state and trigger undefined behavior.
Intentionally use splhigh and not kpreempt_disable, to match the generic
x86 FPU code.
Compile-tested only (I don't have VIA).
Found by Maya almost a year ago.
To generate a diff of this commit:
cvs rdiff -u -r1.25 -r1.26 src/sys/arch/x86/x86/via_padlock.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/arch/x86/x86/via_padlock.c
diff -u src/sys/arch/x86/x86/via_padlock.c:1.25 src/sys/arch/x86/x86/via_padlock.c:1.26
--- src/sys/arch/x86/x86/via_padlock.c:1.25 Sat Feb 27 00:54:59 2016
+++ src/sys/arch/x86/x86/via_padlock.c Sat Jul 14 14:46:41 2018
@@ -1,5 +1,5 @@
/* $OpenBSD: via.c,v 1.8 2006/11/17 07:47:56 tom Exp $ */
-/* $NetBSD: via_padlock.c,v 1.25 2016/02/27 00:54:59 tls Exp $ */
+/* $NetBSD: via_padlock.c,v 1.26 2018/07/14 14:46:41 maxv Exp $ */
/*-
* Copyright (c) 2003 Jason Wright
@@ -20,7 +20,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: via_padlock.c,v 1.25 2016/02/27 00:54:59 tls Exp $");
+__KERNEL_RCSID(0, "$NetBSD: via_padlock.c,v 1.26 2018/07/14 14:46:41 maxv Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -332,10 +332,13 @@ static __inline void
via_padlock_cbc(void *cw, void *src, void *dst, void *key, int rep,
void *iv)
{
- unsigned int creg0;
+ unsigned int cr0;
+ int s;
- creg0 = rcr0(); /* Permit access to SIMD/FPU path */
- lcr0(creg0 & ~(CR0_EM|CR0_TS));
+ s = splhigh();
+
+ cr0 = rcr0(); /* Permit access to SIMD/FPU path */
+ lcr0(cr0 & ~(CR0_EM|CR0_TS));
/* Do the deed */
__asm __volatile("pushfl; popfl"); /* force key reload */
@@ -343,7 +346,9 @@ via_padlock_cbc(void *cw, void *src, voi
: "a" (iv), "b" (key), "c" (rep), "d" (cw), "S" (src), "D" (dst)
: "memory", "cc");
- lcr0(creg0);
+ lcr0(cr0);
+
+ splx(s);
}
int
