Re: [PATCH v7 0/9] Enable Sub-Page Write Protection Support

[Yang Weijiang]

On Thu, Nov 21, 2019 at 11:43:17AM +0100, Paolo Bonzini wrote:
> On 19/11/19 09:49, Yang Weijiang wrote:
> > EPT-Based Sub-Page write Protection(SPP) allows Virtual Machine Monitor(VMM)
> > specify write-permission for guest physical memory at a sub-page(128 byte)
> > granularity. When SPP works, HW enforces write-access check for sub-pages
> > within a protected 4KB page.
> > 
> > The feature targets to provide fine-grained memory protection for
> > usages such as memory guard and VM introspection etc.
> > 
> > SPP is active when the "sub-page write protection" (bit 23) is 1 in
> > Secondary VM-Execution Controls. The feature is backed with a Sub-Page
> > Permission Table(SPPT), and subpage permission vector is stored in the
> > leaf entry of SPPT. The root page is referenced via a Sub-Page Permission
> > Table Pointer (SPPTP) in VMCS.
> > 
> > To enable SPP for guest memory, the guest page should be first mapped
> > to a 4KB EPT entry, then set SPP bit 61 of the corresponding entry. 
> > While HW walks EPT, it traverses SPPT with the gpa to look up the sub-page
> > permission vector within SPPT leaf entry. If the corresponding bit is set,
> > write to sub-page is permitted, otherwise, SPP induced EPT violation is generated.
> > 
> > This patch serial passed SPP function test and selftest on Ice-Lake platform.
> > 
> > Please refer to the SPP introduction document in this patch set and
> > Intel SDM for details:
> > 
> > Intel SDM:
> > https://software.intel.com/sites/default/files/managed/39/c5/325462-sdm-vol-1-2abcd-3abcd.pdf
> > 
> > SPP selftest patch:
> > https://lkml.org/lkml/2019/6/18/1197
> 
> On top of the changes I sent for the individual patches, please move
> vmx/spp.c to mmu/spp.c, and vmx/spp.h to spp.h (I've just sent a patch
> to create the mmu/ directory).  Also, please include the selftest in
> this series.
> 
> Paolo
> 
Thanks Paolo! Will follow it.