On Thu, Oct 3, 2019 at 2:38 PM Rick Edgecombe <rick.p.edgecombe@xxxxxxxxx> wrote: > > This patchset enables the ability for KVM guests to create execute-only (XO) > memory by utilizing EPT based XO permissions. XO memory is currently supported > on Intel hardware natively for CPU's with PKU, but this enables it on older > platforms, and can support XO for kernel memory as well. The patchset seems to sometimes call this feature "XO" and sometimes call it "NR". To me, XO implies no-read and no-write, whereas NR implies just no-read. Can you please clarify *exactly* what the new bit does and be consistent? I suggest that you make it NR, which allows for PROT_EXEC and PROT_EXEC|PROT_WRITE and plain PROT_WRITE. WX is of dubious value, but I can imagine plain W being genuinely useful for logging and for JITs that could maintain a W and a separate X mapping of some code. In other words, with an NR bit, all 8 logical access modes are possible. Also, keeping the paging bits more orthogonal seems nice -- we already have a bit that controls write access.
