Commit f19f5c49 authored by Sean Christopherson's avatar Sean Christopherson Committed by Linus Torvalds
Browse files

x86/speculation/l1tf: Exempt zeroed PTEs from inversion

It turns out that we should *not* invert all not-present mappings,
because the all zeroes case is obviously special.

clear_page() does not undergo the XOR logic to invert the address bits,
i.e. PTE, PMD and PUD entries that have not been individually written
will have val=0 and so will trigger __pte_needs_invert(). As a result,
{pte,pmd,pud}_pfn() will return the wrong PFN value, i.e. all ones
(adjusted by the max PFN mask) instead of zero. A zeroed entry is ok
because the page at physical address 0 is reserved early in boot
specifically to mitigate L1TF, so explicitly exempt them from the
inversion when reading the PFN.

Manifested as an unexpected mprotect(..., PROT_NONE) failure when called
on a VMA that has VM_PFNMAP and was mmap'd to as something other than
PROT_NONE but never used. mprotect() sends the PROT_NONE request down
prot_none_walk(), which walks the PTEs to check the PFNs.
prot_none_pte_entry() gets the bogus PFN from pte_pfn() and returns
-EACCES because it thinks mprotect() is trying to adjust a high MMIO

[ This is a very modified version of Sean's original patch, but all
  credit goes to Sean for doing this and also pointing out that
  sometimes the __pte_needs_invert() function only gets the protection
  bits, not the full eventual pte.  But zero remains special even in
  just protection bits, so that's ok.   - Linus ]

Fixes: f22cc87f

 ("x86/speculation/l1tf: Invert all not present mappings")
Signed-off-by: default avatarSean Christopherson <>
Acked-by: default avatarAndi Kleen <>
Cc: Thomas Gleixner <>
Cc: Josh Poimboeuf <>
Cc: Michal Hocko <>
Cc: Vlastimil Babka <>
Cc: Dave Hansen <>
Cc: Greg Kroah-Hartman <>
Signed-off-by: default avatarLinus Torvalds <>
parent b0e5c294
......@@ -4,9 +4,18 @@
#ifndef __ASSEMBLY__
* A clear pte value is special, and doesn't get inverted.
* Note that even users that only pass a pgprot_t (rather
* than a full pte) won't trigger the special zero case,
* set. So the all zero case really is limited to just the
* cleared page table entry case.
static inline bool __pte_needs_invert(u64 val)
return !(val & _PAGE_PRESENT);
return val && !(val & _PAGE_PRESENT);
/* Get a mask to xor with the page table entry to get the correct pfn. */
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment