From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935261AbcCJKC6 (ORCPT ); Thu, 10 Mar 2016 05:02:58 -0500 Received: from mx1.redhat.com ([209.132.183.28]:39787 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754117AbcCJKCv (ORCPT ); Thu, 10 Mar 2016 05:02:51 -0500 Subject: Re: [PATCH 2/2] KVM: MMU: fix reserved bit check for pte.u=0/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 To: Xiao Guangrong , linux-kernel@vger.kernel.org, kvm@vger.kernel.org References: <1457437467-65707-1-git-send-email-pbonzini@redhat.com> <1457437467-65707-3-git-send-email-pbonzini@redhat.com> <56E1322A.203@linux.intel.com> Cc: stable@vger.kernel.org From: Paolo Bonzini Message-ID: <56E14647.8040803@redhat.com> Date: Thu, 10 Mar 2016 11:02:47 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-Version: 1.0 In-Reply-To: <56E1322A.203@linux.intel.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/03/2016 09:36, Xiao Guangrong wrote: > > > On 03/08/2016 07:44 PM, Paolo Bonzini wrote: >> KVM handles supervisor writes of a pte.u=0/pte.w=0/CR0.WP=0 page by >> setting U=0 and W=1 in the shadow PTE. This will cause a user write >> to fault and a supervisor write to succeed (which is correct because >> CR0.WP=0). A user read instead will flip U=0 to 1 and W=1 back to 0. >> This enables user reads; it also disables supervisor writes, the next >> of which will then flip the bits again. >> >> When SMEP is in effect, however, pte.u=0 will enable kernel execution >> of this page. To avoid this, KVM also sets pte.nx=1. The reserved bit >> catches this because it only looks at the guest's EFER.NX bit. Teach it >> that smep_andnot_wp will also use the NX bit of SPTEs. >> >> Cc: stable@vger.kernel.org >> Cc: Xiao Guangrong > > As a redhat guy i am so proud. :) > >> Fixes: c258b62b264fdc469b6d3610a907708068145e3b > > Thanks for you fixing it, Paolo! > > Reviewed-by: Xiao Guangrong > >> Signed-off-by: Paolo Bonzini >> --- >> arch/x86/kvm/mmu.c | 4 +++- >> 1 file changed, 3 insertions(+), 1 deletion(-) >> >> diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c >> index 95a955de5964..0cd4ee01de94 100644 >> --- a/arch/x86/kvm/mmu.c >> +++ b/arch/x86/kvm/mmu.c >> @@ -3721,13 +3721,15 @@ static void reset_rsvds_bits_mask_ept(struct >> kvm_vcpu *vcpu, >> void >> reset_shadow_zero_bits_mask(struct kvm_vcpu *vcpu, struct kvm_mmu >> *context) >> { >> + int uses_nx = context->nx || context->base_role.smep_andnot_wp; > > It would be better if it is 'bool' Ok, will do. Paolo