Re: [PATCH 1/3] x86/HVM: permit CLFLUSH{,OPT} on execute-only code segments

[Andrew Cooper <amc96@xxxxxxxx>]

On 03/12/2021 11:21, Jan Beulich wrote:
> The SDM explicitly permits this, and since that's sensible behavior
> don't special case AMD (where the PM doesn't explicitly say so).

APM explicitly says so too.

"The CLFLUSH instruction executes at any privilege level. CLFLUSH
performs all the segmentation and paging checks that a 1-byte read would
perform, except that it also allows references to execute-only segments."

and

"The CLFLUSHOPT instruction executes at any privilege level. CLFLUSHOPT
performs all the segmentation and paging checks that a 1-byte read would
perform, except that it also allows references to execute-only segments."

> Fixes: 52dba7bd0b36 ("x86emul: generalize wbinvd() hook")
> Reported-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>

With the commit message tweaked, Reviewed-by: Andrew Cooper
<andrew.cooper3@xxxxxxxxxx>.  Far less invasive than I was fearing.

~Andrew