On Wed, 2023-11-08 at 11:17 +0000, Nicolas Saenz Julienne wrote:
> The upcoming per-VTL memory protections support needs to fault in
> non-executable memory. Introduce a new attribute in struct
> kvm_page_fault, map_executable, to control whether the gfn range should
> be mapped as executable.
>
> No functional change intended.
>
> Signed-off-by: Nicolas Saenz Julienne <[email protected]>
> ---
> arch/x86/kvm/mmu/mmu.c | 6 +++++-
> arch/x86/kvm/mmu/mmu_internal.h | 2 ++
> arch/x86/kvm/mmu/tdp_mmu.c | 8 ++++++--
> 3 files changed, 13 insertions(+), 3 deletions(-)
>
> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 2afef86863fb..4e02d506cc25 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -3245,6 +3245,7 @@ static int direct_map(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)
> struct kvm_mmu_page *sp;
> int ret;
> gfn_t base_gfn = fault->gfn;
> + unsigned access = ACC_ALL;
>
> kvm_mmu_hugepage_adjust(vcpu, fault);
>
> @@ -3274,7 +3275,10 @@ static int direct_map(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault)
> if (WARN_ON_ONCE(it.level != fault->goal_level))
> return -EFAULT;
>
> - ret = mmu_set_spte(vcpu, fault->slot, it.sptep, ACC_ALL,
> + if (!fault->map_executable)
> + access &= ~ACC_EXEC_MASK;
> +
> + ret = mmu_set_spte(vcpu, fault->slot, it.sptep, access,
> base_gfn, fault->pfn, fault);
> if (ret == RET_PF_SPURIOUS)
> return ret;
> diff --git a/arch/x86/kvm/mmu/mmu_internal.h b/arch/x86/kvm/mmu/mmu_internal.h
> index b66a7d47e0e4..bd62c4d5d5f1 100644
> --- a/arch/x86/kvm/mmu/mmu_internal.h
> +++ b/arch/x86/kvm/mmu/mmu_internal.h
> @@ -239,6 +239,7 @@ struct kvm_page_fault {
> kvm_pfn_t pfn;
> hva_t hva;
> bool map_writable;
> + bool map_executable;
>
> /*
> * Indicates the guest is trying to write a gfn that contains one or
> @@ -298,6 +299,7 @@ static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
> .req_level = PG_LEVEL_4K,
> .goal_level = PG_LEVEL_4K,
> .is_private = kvm_mem_is_private(vcpu->kvm, cr2_or_gpa >> PAGE_SHIFT),
> + .map_executable = true,
> };
> int r;
>
> diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c
> index 6cd4dd631a2f..46f3e72ab770 100644
> --- a/arch/x86/kvm/mmu/tdp_mmu.c
> +++ b/arch/x86/kvm/mmu/tdp_mmu.c
> @@ -957,14 +957,18 @@ static int tdp_mmu_map_handle_target_level(struct kvm_vcpu *vcpu,
> u64 new_spte;
> int ret = RET_PF_FIXED;
> bool wrprot = false;
> + unsigned access = ACC_ALL;
>
> if (WARN_ON_ONCE(sp->role.level != fault->goal_level))
> return RET_PF_RETRY;
>
> + if (!fault->map_executable)
> + access &= ~ACC_EXEC_MASK;
> +
> if (unlikely(!fault->slot))
> - new_spte = make_mmio_spte(vcpu, iter->gfn, ACC_ALL);
> + new_spte = make_mmio_spte(vcpu, iter->gfn, access);
> else
> - wrprot = make_spte(vcpu, sp, fault->slot, ACC_ALL, iter->gfn,
> + wrprot = make_spte(vcpu, sp, fault->slot, access, iter->gfn,
> fault->pfn, iter->old_spte, fault->prefetch, true,
> fault->map_writable, &new_spte);
Overall this patch makes sense but I don't know the mmu well enough to be sure
that there are no corner cases which are not handeled here.
>
Best regards,
Maxim Levitsky