On 09/13/2012 03:09 PM, Xiao Guangrong wrote:
>>
>> The result is short, branch-free code.
>>
>> Signed-off-by: Avi Kivity <avi@xxxxxxxxxx>
>
>> +static void update_permission_bitmask(struct kvm_vcpu *vcpu, struct kvm_mmu *mmu)
>> +{
>> + unsigned bit, byte, pfec;
>> + u8 map;
>> + bool fault, x, w, u, wf, uf, ff, smep;
>> +
>> + smep = kvm_read_cr4_bits(vcpu, X86_CR4_SMEP);
>> + for (byte = 0; byte < ARRAY_SIZE(mmu->permissions); ++byte) {
>> + pfec = byte << 1;
>> + map = 0;
>> + wf = pfec & PFERR_WRITE_MASK;
>> + uf = pfec & PFERR_USER_MASK;
>> + ff = pfec & PFERR_FETCH_MASK;
>> + for (bit = 0; bit < 8; ++bit) {
>> + x = bit & ACC_EXEC_MASK;
>> + w = bit & ACC_WRITE_MASK;
>> + u = bit & ACC_USER_MASK;
>> +
>> + /* Not really needed: !nx will cause pte.nx to fault */
>> + x |= !mmu->nx;
>> + /* Allow supervisor writes if !cr0.wp */
>> + w |= !is_write_protection(vcpu) && !uf;
>> + /* Disallow supervisor fetches if cr4.smep */
>> + x &= !(smep && !uf);
>
> In the case of smep, supervisor mode can fetch the memory if pte.u == 0,
> so, it should be x &= !(smep && !uf && u)?
Good catch, will fix.
>
>> @@ -3672,20 +3672,18 @@ static int vcpu_mmio_gva_to_gpa(struct kvm_vcpu *vcpu, unsigned long gva,
>> gpa_t *gpa, struct x86_exception *exception,
>> bool write)
>> {
>> - u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0;
>> + u32 access = ((kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0)
>> + | (write ? PFERR_WRITE_MASK : 0);
>> + u8 bit = vcpu->arch.access;
>>
>> - if (vcpu_match_mmio_gva(vcpu, gva) &&
>> - check_write_user_access(vcpu, write, access,
>> - vcpu->arch.access)) {
>> + if (vcpu_match_mmio_gva(vcpu, gva)
>> + && ((vcpu->arch.walk_mmu->permissions[access >> 1] >> bit) & 1)) {
>
> !((vcpu->arch.walk_mmu->permissions[access >> 1] >> bit) & 1) ?
>
> It is better introducing a function to do the permission check?
>
Probably, I'll rethink it.
--
error compiling committee.c: too many arguments to function
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
