Messages in this thread | | | Date | Fri, 17 Aug 2018 07:39:34 -0700 | From | Andi Kleen <> | Subject | Re: [PATCH] x86/speculation/l1tf: Exempt zeroed PTEs from XOR conversion |
| |
On Thu, Aug 16, 2018 at 01:46:38PM -0700, Sean Christopherson wrote: > clear_page() does not undergo the XOR logic to invert the address > bits, i.e. PTE, PMD and PUD entries that have not been individually > written will have val=0 and so will trigger __pte_needs_invert(). > As a result, {pte,pmd,pud}_pfn() will return the wrong PFN value, > i.e. all ones (adjusted by the max PFN mask) instead of zero. > A zeroed entry is ok because the page at physical address 0 is > reserved early in boot specifically to mitigate L1TF, so explicitly > exempt them from the inversion when reading the PFN. > > Manifested as an unexpected mprotect(..., PROT_NONE) failure when > called on a VMA that has VM_PFNMAP and was mmap'd to as something > other than PROT_NONE but never used. mprotect() sends the PROT_NONE > request down prot_none_walk(), which walks the PTEs to check the PFNs. > prot_none_pte_entry() gets the bogus PFN from pte_pfn() and returns > -EACCES because it thinks mprotect() is trying to adjust a high MMIO > address.
Looks good to me. You're right that case was missed.
Reviewed-by: Andi Kleen <ak@linux.intel.com>
I think Thomas is still on vacation, copying Linus.
-Andi
| |