So far, the HYP mappings have been fairly relaxed: everything is RWX. Oddly enough, not everybody is fond of this kind of permissions at the highest exception level. This small series tightens it a bit by making: - the text mapping read-only - the rodata mapping read-only + no-exec - everything else read-write + no-exec Of course, that's only valid when VHE is not in action. Tested on Seattle and Cubietruck, based on 4.7-rc2. Thanks, M. Marc Zyngier (5): arm/arm64: KVM: Add a protection parameter to create_hyp_mappings arm64: Add PTE_HYP_XN page table flag arm/arm64: KVM: Enforce HYP read-only mapping of the kernel's rodata section arm/arm64: KVM: Map the HYP text as read-only arm/arm64: KVM: Make default HYP mappings non-excutable arch/arm/include/asm/kvm_mmu.h | 2 +- arch/arm/include/asm/pgtable.h | 4 +++- arch/arm/kvm/arm.c | 13 +++++++------ arch/arm/kvm/mmu.c | 7 ++++--- arch/arm64/include/asm/kvm_mmu.h | 2 +- arch/arm64/include/asm/pgtable-hwdef.h | 1 + arch/arm64/include/asm/pgtable-prot.h | 4 +++- 7 files changed, 20 insertions(+), 13 deletions(-) -- 2.1.4 -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html