Re: [PATCH v1 3/6] KVM: VMX: Add new ops in kvm_x86_ops for LASS violation check

[Zeng Guang]

On 6/5/2023 10:07 PM, Yuan Yao wrote:
> On Thu, Jun 01, 2023 at 10:23:06PM +0800, Zeng Guang wrote:
> > Intel introduces LASS (Linear Address Separation) feature providing
> > an independent mechanism to achieve the mode-based protection.
> >
> > LASS partitions 64-bit linear address space into two halves, user-mode
> > address (LA[bit 63]=0) and supervisor-mode address (LA[bit 63]=1). It
> > stops any code execution or conditional data access[1]
> >      1. from user mode to supervisor-mode address space
> >      2. from supervisor mode to user-mode address space
> > and generates LASS violation fault accordingly.
> >
> > +/*
> > + * Determine whether an access to the linear address causes a LASS violation.
> > + * LASS protection is only effective in long mode. As a prerequisite, caller
> > + * should make sure vCPU running in long mode and invoke this api to do LASS
> > + * violation check.
> > + */
> > +bool vmx_check_lass(struct kvm_vcpu *vcpu, u64 access, u64 la, u32 flags)
> > +{
> > +	bool user_mode, user_as, rflags_ac;
> > +
> > +	if (!!(flags & X86EMUL_F_SKIPLASS) ||
> > +	    !kvm_is_cr4_bit_set(vcpu, X86_CR4_LASS))
> > +		return false;
> > +
> > +	WARN_ON_ONCE(!is_long_mode(vcpu));
> > +
> > +	user_as = !(la >> 63);
> > +
> > +	/*
> > +	 * An access is a supervisor-mode access if CPL < 3 or if it implicitly
> > +	 * accesses a system data structure. For implicit accesses to system
> > +	 * data structure, the processor acts as if RFLAGS.AC is clear.
> > +	 */
> > +	if (access & PFERR_IMPLICIT_ACCESS) {
> > +		user_mode = false;
> > +		rflags_ac = false;
> > +	} else {
> > +		user_mode = vmx_get_cpl(vcpu) == 3;
> > +		if (!user_mode)
> > +			rflags_ac = !!(kvm_get_rflags(vcpu) & X86_EFLAGS_AC);
> > +	}
> > +
> > +	if (user_mode == user_as)
> Confused by user_as, it's role of address(U/S) so how about
> "user_addr" ? "if (user_mode == user_addr)" looks more clear
> to me.
Actually "as" stands for "address space". I suppose it more precise. :)