x86, ept: remove execute permission for granted pages' P2M entries

When backporting c/s 20026 I noticed that granted pages get execute
permission, which doesn't seem desirable (and has been avoided for PV
guests for quite a while).

Even for p2m_mmio_direct is seems suspicious to allow execution, but
me being less certain here I left it as is for the time being.

Signed-off-by: Jan Beulich <jbeulich@novell.com>

diff --git a/xen/arch/x86/mm/hap/p2m-ept.c b/xen/arch/x86/mm/hap/p2m-ept.c
index 91a8b40911197944a376203d1ed344a1b5a13ceb..1aa0a6ff376d85bdb5735fe4aee6b9fb628526e6 100644 (file)
--- a/xen/arch/x86/mm/hap/p2m-ept.c
+++ b/xen/arch/x86/mm/hap/p2m-ept.c
@@ -40,15 +40,21 @@ static void ept_p2m_type_to_flags(ept_entry_t *entry, p2m_type_t type)
             return;
         case p2m_ram_rw:
         case p2m_mmio_direct:
-        case p2m_grant_map_rw:
             entry->r = entry->w = entry->x = 1;
             return;
         case p2m_ram_logdirty:
         case p2m_ram_ro:
-        case p2m_grant_map_ro:
             entry->r = entry->x = 1;
             entry->w = 0;
             return;
+        case p2m_grant_map_rw:
+            entry->r = entry->w = 1;
+            entry->x = 0;
+            return;
+        case p2m_grant_map_ro:
+            entry->r = 1;
+            entry->w = entry->x = 0;
+            return;
     }
 }