forked fromtorvalds/linux
- Notifications
You must be signed in to change notification settings - Fork0
Commitf19f5c4
x86/speculation/l1tf: Exempt zeroed PTEs from inversion
It turns out that we should *not* invert all not-present mappings,because the all zeroes case is obviously special.clear_page() does not undergo the XOR logic to invert the address bits,i.e. PTE, PMD and PUD entries that have not been individually writtenwill have val=0 and so will trigger __pte_needs_invert(). As a result,{pte,pmd,pud}_pfn() will return the wrong PFN value, i.e. all ones(adjusted by the max PFN mask) instead of zero. A zeroed entry is okbecause the page at physical address 0 is reserved early in bootspecifically to mitigate L1TF, so explicitly exempt them from theinversion when reading the PFN.Manifested as an unexpected mprotect(..., PROT_NONE) failure when calledon a VMA that has VM_PFNMAP and was mmap'd to as something other thanPROT_NONE but never used. mprotect() sends the PROT_NONE request downprot_none_walk(), which walks the PTEs to check the PFNs.prot_none_pte_entry() gets the bogus PFN from pte_pfn() and returns-EACCES because it thinks mprotect() is trying to adjust a high MMIOaddress.[ This is a very modified version of Sean's original patch, but all credit goes to Sean for doing this and also pointing out that sometimes the __pte_needs_invert() function only gets the protection bits, not the full eventual pte. But zero remains special even in just protection bits, so that's ok. - Linus ]Fixes:f22cc87 ("x86/speculation/l1tf: Invert all not present mappings")Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>Acked-by: Andi Kleen <ak@linux.intel.com>Cc: Thomas Gleixner <tglx@linutronix.de>Cc: Josh Poimboeuf <jpoimboe@redhat.com>Cc: Michal Hocko <mhocko@suse.com>Cc: Vlastimil Babka <vbabka@suse.cz>Cc: Dave Hansen <dave.hansen@intel.com>Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>1 parentb0e5c29 commitf19f5c4
1 file changed
+10
-1
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
7 | 16 | | |
8 | 17 | | |
9 | | - | |
| 18 | + | |
10 | 19 | | |
11 | 20 | | |
12 | 21 | | |
| |||
0 commit comments
Comments
(0)