On 6/5/2023 10:07 PM, Yuan Yao wrote:
On Thu, Jun 01, 2023 at 10:23:06PM +0800, Zeng Guang wrote:Intel introduces LASS (Linear Address Separation) feature providing an independent mechanism to achieve the mode-based protection. LASS partitions 64-bit linear address space into two halves, user-mode address (LA[bit 63]=0) and supervisor-mode address (LA[bit 63]=1). It stops any code execution or conditional data access[1] 1. from user mode to supervisor-mode address space 2. from supervisor mode to user-mode address space and generates LASS violation fault accordingly. +/* + * Determine whether an access to the linear address causes a LASS violation. + * LASS protection is only effective in long mode. As a prerequisite, caller + * should make sure vCPU running in long mode and invoke this api to do LASS + * violation check. + */ +bool vmx_check_lass(struct kvm_vcpu *vcpu, u64 access, u64 la, u32 flags) +{ + bool user_mode, user_as, rflags_ac; + + if (!!(flags & X86EMUL_F_SKIPLASS) || + !kvm_is_cr4_bit_set(vcpu, X86_CR4_LASS)) + return false; + + WARN_ON_ONCE(!is_long_mode(vcpu)); + + user_as = !(la >> 63); + + /* + * An access is a supervisor-mode access if CPL < 3 or if it implicitly + * accesses a system data structure. For implicit accesses to system + * data structure, the processor acts as if RFLAGS.AC is clear. + */ + if (access & PFERR_IMPLICIT_ACCESS) { + user_mode = false; + rflags_ac = false; + } else { + user_mode = vmx_get_cpl(vcpu) == 3; + if (!user_mode) + rflags_ac = !!(kvm_get_rflags(vcpu) & X86_EFLAGS_AC); + } + + if (user_mode == user_as)Confused by user_as, it's role of address(U/S) so how about "user_addr" ? "if (user_mode == user_addr)" looks more clear to me.
Actually "as" stands for "address space". I suppose it more precise. :)
