archive mirror
 help / color / mirror / Atom feed
From: Sean Christopherson <>
To: Thomas Gleixner <>,
	Ingo Molnar <>,
Cc: "H. Peter Anvin" <>,,
	Sean Christopherson <>,
	Andi Kleen <>,
	Josh Poimboeuf <>,
	Michal Hocko <>, Vlastimil Babka <>,
	Dave Hansen <>,
	Greg Kroah-Hartman <>
Subject: [PATCH] x86/speculation/l1tf: Exempt zeroed PTEs from XOR conversion
Date: Thu, 16 Aug 2018 13:46:38 -0700	[thread overview]
Message-ID: <> (raw)

clear_page() does not undergo the XOR logic to invert the address
bits, i.e. PTE, PMD and PUD entries that have not been individually
written will have val=0 and so will trigger __pte_needs_invert().
As a result, {pte,pmd,pud}_pfn() will return the wrong PFN value,
i.e. all ones (adjusted by the max PFN mask) instead of zero.
A zeroed entry is ok because the page at physical address 0 is
reserved early in boot specifically to mitigate L1TF, so explicitly
exempt them from the inversion when reading the PFN.

Manifested as an unexpected mprotect(..., PROT_NONE) failure when
called on a VMA that has VM_PFNMAP and was mmap'd to as something
other than PROT_NONE but never used.  mprotect() sends the PROT_NONE
request down prot_none_walk(), which walks the PTEs to check the PFNs.
prot_none_pte_entry() gets the bogus PFN from pte_pfn() and returns
-EACCES because it thinks mprotect() is trying to adjust a high MMIO

Fixes: 6b28baca9b1f ("x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation")
Signed-off-by: Sean Christopherson <>
Cc: Andi Kleen <>
Cc: Thomas Gleixner <>
Cc: Josh Poimboeuf <>
Cc: Michal Hocko <>
Cc: Vlastimil Babka <>
Cc: Dave Hansen <>
Cc: Greg Kroah-Hartman <>
 arch/x86/include/asm/pgtable.h | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index e4ffa565a69f..f21a1df4ca89 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -195,21 +195,24 @@ static inline u64 protnone_mask(u64 val);
 static inline unsigned long pte_pfn(pte_t pte)
 	phys_addr_t pfn = pte_val(pte);
-	pfn ^= protnone_mask(pfn);
+	if (pfn)
+		pfn ^= protnone_mask(pfn);
 	return (pfn & PTE_PFN_MASK) >> PAGE_SHIFT;
 static inline unsigned long pmd_pfn(pmd_t pmd)
 	phys_addr_t pfn = pmd_val(pmd);
-	pfn ^= protnone_mask(pfn);
+	if (pfn)
+		pfn ^= protnone_mask(pfn);
 	return (pfn & pmd_pfn_mask(pmd)) >> PAGE_SHIFT;
 static inline unsigned long pud_pfn(pud_t pud)
 	phys_addr_t pfn = pud_val(pud);
-	pfn ^= protnone_mask(pfn);
+	if (pfn)
+		pfn ^= protnone_mask(pfn);
 	return (pfn & pud_pfn_mask(pud)) >> PAGE_SHIFT;

             reply	other threads:[~2018-08-16 20:47 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-08-16 20:46 Sean Christopherson [this message]
2018-08-17 14:39 ` [PATCH] x86/speculation/l1tf: Exempt zeroed PTEs from XOR conversion Andi Kleen
2018-08-17 16:13 ` Linus Torvalds
2018-08-17 16:54   ` Andi Kleen
2018-08-17 17:01   ` Sean Christopherson
2018-08-17 17:05     ` Linus Torvalds

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).