Re: [PATCH v2] x86-64/Xen: eliminate W+X mappings

From: Joe Perches
Date: Mon Dec 18 2017 - 10:52:53 EST


On Mon, 2017-12-18 at 13:28 +0100, Ingo Molnar wrote:
> * Jan Beulich <JBeulich@xxxxxxxx> wrote:
>
> > A few thousand such pages are usually left around due to the re-use of
> > L1 tables having been provided by the hypervisor (Dom0) or tool stack
> > (DomU). Set NX in the direct map variant, which needs to be done in L2
> > due to the dual use of the re-used L1s.
> >
> > For x86_configure_nx() to actually do what it is supposed to do, call
> > get_cpu_cap() first. This was broken by commit 4763ed4d45 ("x86, mm:
> > Clean up and simplify NX enablement") when switching away from the
> > direct EFER read.
[]
> > --- 4.15-rc4/arch/x86/xen/mmu_pv.c
> > +++ 4.15-rc4-x86_64-Xen-avoid-W+X/arch/x86/xen/mmu_pv.c
> > @@ -1902,6 +1902,18 @@ void __init xen_setup_kernel_pagetable(p
> > /* Graft it onto L4[511][510] */
> > copy_page(level2_kernel_pgt, l2);
> >
> > + /*
> > + * Zap execute permission from the ident map. Due to the sharing of
> > + * L1 entries we need to do this in the L2.
> > + */
> > + if (__supported_pte_mask & _PAGE_NX)
> > + for (i = 0; i < PTRS_PER_PMD; ++i) {
> > + if (pmd_none(level2_ident_pgt[i]))
> > + continue;
> > + level2_ident_pgt[i] = pmd_set_flags(level2_ident_pgt[i],
> > + _PAGE_NX);
> > + }
> > +
>
> This chunk has two stylistic problems:
>
> - Curly braces need to be added
> - Line broken in an ugly fashion: just make it long and ignore the checkpatch col80 warning
>
> looks good otherwise.

stylistic trivia:

Instead of repeating level2_ident_pgt[i] multiple times,
it might be nicer to use temporaries and not use i at all.

Something like:

if (__supported_pte_mask & _PAGE_NX) {
pmd_t *pmd = level2_ident_pgt;
pmd_t *end = pmd + PTRS_PER_PMD;

for (; pmd < end; pmd++) {
if (!pmd_none(pmd))
*pmd = pmd_set_flags(pmd, _PAGE_NX);
}
}