[PATCH v6 39/44] x86/mpx: Map/unmap xsave area in read_bndcfgu()

[George Dunlap <gwd@xxxxxxxxxxxxxx>]

From: Alejandro Vallejo <alejandro.vallejo@xxxxxxxxx>

The BNDCSR read executes XSAVE into the local idle vCPU's save area as
scratch space and pulls BNDCFGU out of the result.  Fetch that buffer
through the VCPU_MAP_XSAVE_AREA() seam rather than a raw dereference,
so the function is indifferent to where vCPU save areas live.  This
was the last raw access to another vCPU's save-area pointer outside
the seam.

No functional change.

Signed-off-by: Alejandro Vallejo <alejandro.vallejo@xxxxxxxxx>
Assisted-by: Claude Code:claude-fable-5
Signed-off-by: George Dunlap <gwd@xxxxxxxxxxxxxx>

---
Revived from "x86: Address Space Isolation FPU preparations" v3 patch
09/12 (<20250110132823.24348-10-alejandro.vallejo@xxxxxxxxx>; no v4
was ever posted).

Changes in v5:
- New in this version.

Changes since the previously posted version:
 - Constified the vcpu pointer, as requested by Jan Beulich on the
   original thread (the xstate pointer itself stays mutable: the
   asm()s write through it, as Jan noted in withdrawing that half of
   the request).
 - Expanded the commit message.
---
 xen/arch/x86/xstate.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/xstate.c b/xen/arch/x86/xstate.c
index 8336414c52..2eae3f098d 100644
--- a/xen/arch/x86/xstate.c
+++ b/xen/arch/x86/xstate.c
@@ -1023,9 +1023,10 @@ int handle_xsetbv(u32 index, u64 new_bv)
 
 uint64_t read_bndcfgu(void)
 {
+    uint64_t bndcfgu = 0;
     unsigned long cr0 = read_cr0();
-    struct xsave_struct *xstate
-        = idle_vcpu[smp_processor_id()]->arch.xsave_area;
+    const struct vcpu *v = idle_vcpu[smp_processor_id()];
+    struct xsave_struct *xstate = VCPU_MAP_XSAVE_AREA(v);
     const struct xstate_bndcsr *bndcsr;
 
     ASSERT(cpu_has_mpx);
@@ -1051,7 +1052,12 @@ uint64_t read_bndcfgu(void)
     if ( cr0 & X86_CR0_TS )
         write_cr0(cr0);
 
-    return xstate->xsave_hdr.xstate_bv & X86_XCR0_BNDCSR ? bndcsr->bndcfgu : 0;
+    if ( xstate->xsave_hdr.xstate_bv & X86_XCR0_BNDCSR )
+        bndcfgu = bndcsr->bndcfgu;
+
+    VCPU_UNMAP_XSAVE_AREA(v, xstate);
+
+    return bndcfgu;
 }
 
 void xstate_set_init(uint64_t mask)
-- 
2.56.0