x86/hvm: Perform a user instruction fetch for a FEP in userspace

This matches hardware behaviour, and prevents erroneous failures when a guest
has SMEP/SMAP active and issues a FEP from userspace.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
master commit: 0831e99446121636045cf6f616a1991d6ef22071
master date: 2016-09-08 16:39:46 +0100

diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c
index d8ab74dfd0bde17f16a7ab6e86adbd3aa93a74e7..63c6a6b127efc47962e0fff9eadf2995acb188c1 100644 (file)
--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -2128,10 +2128,12 @@ static void svm_vmexit_ud_intercept(struct cpu_user_regs *regs)
 
     if ( opt_hvm_fep )
     {
+        uint32_t walk = (ctxt.seg_reg[x86_seg_ss].attr.fields.dpl == 3)
+            ? PFEC_user_mode : 0;
         char sig[5]; /* ud2; .ascii "xen" */
 
         if ( (hvm_fetch_from_guest_virt_nofault(
-                  sig, regs->eip, sizeof(sig), 0) == HVMCOPY_okay) &&
+                  sig, regs->eip, sizeof(sig), walk) == HVMCOPY_okay) &&
              (memcmp(sig, "\xf\xbxen", sizeof(sig)) == 0) )
         {
             regs->eip += sizeof(sig);

diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index 072ac6c0f1b09a2d13be38c6a6dc4b2b692e06ee..498221d1907ea1f3713f9a20dbe37e6992092a10 100644 (file)
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -2546,10 +2546,12 @@ static void vmx_vmexit_ud_intercept(struct cpu_user_regs *regs)
 
     if ( opt_hvm_fep )
     {
+        uint32_t walk = (ctxt.seg_reg[x86_seg_ss].attr.fields.dpl == 3)
+            ? PFEC_user_mode : 0;
         char sig[5]; /* ud2; .ascii "xen" */
 
         if ( (hvm_fetch_from_guest_virt_nofault(
-                  sig, regs->eip, sizeof(sig), 0) == HVMCOPY_okay) &&
+                  sig, regs->eip, sizeof(sig), walk) == HVMCOPY_okay) &&
              (memcmp(sig, "\xf\xbxen", sizeof(sig)) == 0) )
         {
             regs->eip += sizeof(sig);