From 0831e99446121636045cf6f616a1991d6ef22071 Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Thu, 16 Jun 2016 14:36:44 +0100 Subject: [PATCH] x86/hvm: Perform a user instruction fetch for a FEP in userspace This matches hardware behaviour, and prevents erroneous failures when a guest has SMEP/SMAP active and issues a FEP from userspace. Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- xen/arch/x86/hvm/hvm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index 89539287d7..ca966438cd 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -3978,6 +3978,8 @@ void hvm_ud_intercept(struct cpu_user_regs *regs) { struct vcpu *cur = current; const struct segment_register *cs = &ctxt.seg_reg[x86_seg_cs]; + uint32_t walk = (ctxt.seg_reg[x86_seg_ss].attr.fields.dpl == 3) + ? PFEC_user_mode : 0; unsigned long addr; char sig[5]; /* ud2; .ascii "xen" */ @@ -3987,7 +3989,7 @@ void hvm_ud_intercept(struct cpu_user_regs *regs) cs->attr.fields.l) ? 64 : cs->attr.fields.db ? 32 : 16, &addr) && (hvm_fetch_from_guest_virt_nofault(sig, addr, sizeof(sig), - 0) == HVMCOPY_okay) && + walk) == HVMCOPY_okay) && (memcmp(sig, "\xf\xbxen", sizeof(sig)) == 0) ) { regs->eip += sizeof(sig); -- 2.30.2