x86/hvm: Perform a user instruction fetch for a FEP in userspace

This matches hardware behaviour, and prevents erroneous failures when a guest
has SMEP/SMAP active and issues a FEP from userspace.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
master commit: 0831e99446121636045cf6f616a1991d6ef22071
master date: 2016-09-08 16:39:46 +0100

diff --git a/xen/arch/x86/hvm/svm/svm.c b/xen/arch/x86/hvm/svm/svm.c
index 07ccae3bbd55e50c6a4498f08846f0bce1794875..74aa075ba1849d9ecfbe37a4774e42ab4ff9d9c4 100644 (file)
--- a/xen/arch/x86/hvm/svm/svm.c
+++ b/xen/arch/x86/hvm/svm/svm.c
@@ -2131,10 +2131,12 @@ static void svm_vmexit_ud_intercept(struct cpu_user_regs *regs)
 
     if ( opt_hvm_fep )
     {
+        uint32_t walk = (ctxt.seg_reg[x86_seg_ss].attr.fields.dpl == 3)
+            ? PFEC_user_mode : 0;
         char sig[5]; /* ud2; .ascii "xen" */
 
         if ( (hvm_fetch_from_guest_virt_nofault(
-                  sig, regs->eip, sizeof(sig), 0) == HVMCOPY_okay) &&
+                  sig, regs->eip, sizeof(sig), walk) == HVMCOPY_okay) &&
              (memcmp(sig, "\xf\xbxen", sizeof(sig)) == 0) )
         {
             regs->eip += sizeof(sig);

diff --git a/xen/arch/x86/hvm/vmx/vmx.c b/xen/arch/x86/hvm/vmx/vmx.c
index 698c90663ed1eb5711d0e5c43ad7c379cbecd747..7f96ad64e5f753f1b7178e9530f7372823a4079c 100644 (file)
--- a/xen/arch/x86/hvm/vmx/vmx.c
+++ b/xen/arch/x86/hvm/vmx/vmx.c
@@ -2763,10 +2763,12 @@ static void vmx_vmexit_ud_intercept(struct cpu_user_regs *regs)
 
     if ( opt_hvm_fep )
     {
+        uint32_t walk = (ctxt.seg_reg[x86_seg_ss].attr.fields.dpl == 3)
+            ? PFEC_user_mode : 0;
         char sig[5]; /* ud2; .ascii "xen" */
 
         if ( (hvm_fetch_from_guest_virt_nofault(
-                  sig, regs->eip, sizeof(sig), 0) == HVMCOPY_okay) &&
+                  sig, regs->eip, sizeof(sig), walk) == HVMCOPY_okay) &&
              (memcmp(sig, "\xf\xbxen", sizeof(sig)) == 0) )
         {
             regs->eip += sizeof(sig);