https://github.com/torvalds/linux
Revision 844a5fe219cf472060315971e15cbf97674a3324 authored by Paolo Bonzini on 08 March 2016, 11:13:39 UTC, committed by Paolo Bonzini on 10 March 2016, 10:26:07 UTC
Yes, all of these are needed. :) This is admittedly a bit odd, but kvm-unit-tests access.flat tests this if you run it with "-cpu host" and of course ept=0. KVM runs the guest with CR0.WP=1, so it must handle supervisor writes specially when pte.u=1/pte.w=0/CR0.WP=0. Such writes cause a fault when U=1 and W=0 in the SPTE, but they must succeed because CR0.WP=0. When KVM gets the fault, it sets U=0 and W=1 in the shadow PTE and restarts execution. This will still cause a user write to fault, while supervisor writes will succeed. User reads will fault spuriously now, and KVM will then flip U and W again in the SPTE (U=1, W=0). User reads will be enabled and supervisor writes disabled, going back to the originary situation where supervisor writes fault spuriously. When SMEP is in effect, however, U=0 will enable kernel execution of this page. To avoid this, KVM also sets NX=1 in the shadow PTE together with U=0. If the guest has not enabled NX, the result is a continuous stream of page faults due to the NX bit being reserved. The fix is to force EFER.NX=1 even if the CPU is taking care of the EFER switch. (All machines with SMEP have the CPU_LOAD_IA32_EFER vm-entry control, so they do not use user-return notifiers for EFER---if they did, EFER.NX would be forced to the same value as the host). There is another bug in the reserved bit check, which I've split to a separate patch for easier application to stable kernels. Cc: stable@vger.kernel.org Cc: Andy Lutomirski <luto@amacapital.net> Reviewed-by: Xiao Guangrong <guangrong.xiao@linux.intel.com> Fixes: f6577a5fa15d82217ca73c74cd2dcbc0f6c781dd Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
1 parent 313f636
Tip revision: 844a5fe219cf472060315971e15cbf97674a3324 authored by Paolo Bonzini on 08 March 2016, 11:13:39 UTC
KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo
KVM: MMU: fix ept=0/pte.u=1/pte.w=0/CR0.WP=0/CR4.SMEP=1/EFER.NX=0 combo
Tip revision: 844a5fe
File | Mode | Size |
---|---|---|
9p | ||
adfs | ||
affs | ||
afs | ||
autofs4 | ||
befs | ||
bfs | ||
btrfs | ||
cachefiles | ||
ceph | ||
cifs | ||
coda | ||
configfs | ||
cramfs | ||
debugfs | ||
devpts | ||
dlm | ||
ecryptfs | ||
efivarfs | ||
efs | ||
exofs | ||
exportfs | ||
ext2 | ||
ext4 | ||
f2fs | ||
fat | ||
freevxfs | ||
fscache | ||
fuse | ||
gfs2 | ||
hfs | ||
hfsplus | ||
hostfs | ||
hpfs | ||
hugetlbfs | ||
isofs | ||
jbd2 | ||
jffs2 | ||
jfs | ||
kernfs | ||
lockd | ||
logfs | ||
minix | ||
ncpfs | ||
nfs | ||
nfs_common | ||
nfsd | ||
nilfs2 | ||
nls | ||
notify | ||
ntfs | ||
ocfs2 | ||
omfs | ||
openpromfs | ||
overlayfs | ||
proc | ||
pstore | ||
qnx4 | ||
qnx6 | ||
quota | ||
ramfs | ||
reiserfs | ||
romfs | ||
squashfs | ||
sysfs | ||
sysv | ||
tracefs | ||
ubifs | ||
udf | ||
ufs | ||
xfs | ||
Kconfig | -rw-r--r-- | 6.9 KB |
Kconfig.binfmt | -rw-r--r-- | 7.0 KB |
Makefile | -rw-r--r-- | 4.1 KB |
aio.c | -rw-r--r-- | 43.0 KB |
anon_inodes.c | -rw-r--r-- | 4.9 KB |
attr.c | -rw-r--r-- | 7.9 KB |
bad_inode.c | -rw-r--r-- | 4.7 KB |
binfmt_aout.c | -rw-r--r-- | 10.8 KB |
binfmt_elf.c | -rw-r--r-- | 60.7 KB |
binfmt_elf_fdpic.c | -rw-r--r-- | 47.8 KB |
binfmt_em86.c | -rw-r--r-- | 2.8 KB |
binfmt_flat.c | -rw-r--r-- | 26.4 KB |
binfmt_misc.c | -rw-r--r-- | 17.4 KB |
binfmt_script.c | -rw-r--r-- | 3.0 KB |
block_dev.c | -rw-r--r-- | 48.5 KB |
buffer.c | -rw-r--r-- | 88.8 KB |
char_dev.c | -rw-r--r-- | 13.3 KB |
compat.c | -rw-r--r-- | 37.1 KB |
compat_binfmt_elf.c | -rw-r--r-- | 3.7 KB |
compat_ioctl.c | -rw-r--r-- | 45.9 KB |
coredump.c | -rw-r--r-- | 19.9 KB |
dax.c | -rw-r--r-- | 31.8 KB |
dcache.c | -rw-r--r-- | 89.1 KB |
dcookies.c | -rw-r--r-- | 6.9 KB |
direct-io.c | -rw-r--r-- | 38.3 KB |
drop_caches.c | -rw-r--r-- | 1.6 KB |
eventfd.c | -rw-r--r-- | 11.2 KB |
eventpoll.c | -rw-r--r-- | 60.1 KB |
exec.c | -rw-r--r-- | 40.7 KB |
fcntl.c | -rw-r--r-- | 16.7 KB |
fhandle.c | -rw-r--r-- | 6.5 KB |
file.c | -rw-r--r-- | 23.5 KB |
file_table.c | -rw-r--r-- | 8.5 KB |
filesystems.c | -rw-r--r-- | 6.4 KB |
fs-writeback.c | -rw-r--r-- | 68.4 KB |
fs_pin.c | -rw-r--r-- | 2.0 KB |
fs_struct.c | -rw-r--r-- | 3.3 KB |
inode.c | -rw-r--r-- | 53.1 KB |
internal.h | -rw-r--r-- | 3.8 KB |
ioctl.c | -rw-r--r-- | 17.1 KB |
libfs.c | -rw-r--r-- | 30.3 KB |
locks.c | -rw-r--r-- | 71.5 KB |
mbcache.c | -rw-r--r-- | 24.1 KB |
mount.h | -rw-r--r-- | 3.5 KB |
mpage.c | -rw-r--r-- | 20.3 KB |
namei.c | -rw-r--r-- | 115.9 KB |
namespace.c | -rw-r--r-- | 81.6 KB |
no-block.c | -rw-r--r-- | 688 bytes |
nsfs.c | -rw-r--r-- | 3.7 KB |
open.c | -rw-r--r-- | 26.8 KB |
pipe.c | -rw-r--r-- | 26.3 KB |
pnode.c | -rw-r--r-- | 11.3 KB |
pnode.h | -rw-r--r-- | 1.8 KB |
posix_acl.c | -rw-r--r-- | 19.6 KB |
proc_namespace.c | -rw-r--r-- | 7.7 KB |
read_write.c | -rw-r--r-- | 36.4 KB |
readdir.c | -rw-r--r-- | 6.9 KB |
select.c | -rw-r--r-- | 25.3 KB |
seq_file.c | -rw-r--r-- | 22.4 KB |
signalfd.c | -rw-r--r-- | 9.2 KB |
splice.c | -rw-r--r-- | 46.2 KB |
stack.c | -rw-r--r-- | 2.5 KB |
stat.c | -rw-r--r-- | 11.9 KB |
statfs.c | -rw-r--r-- | 5.3 KB |
super.c | -rw-r--r-- | 35.0 KB |
sync.c | -rw-r--r-- | 9.9 KB |
timerfd.c | -rw-r--r-- | 13.0 KB |
userfaultfd.c | -rw-r--r-- | 35.1 KB |
utimes.c | -rw-r--r-- | 5.9 KB |
xattr.c | -rw-r--r-- | 23.2 KB |
Computing file changes ...