Messages in this thread Patch in this message | | | From | Thomas Hellström (VMware) <> | Subject | [RFC PATCH 1/2] x86: Don't let pgprot_modify() change the page encryption bit | Date | Thu, 5 Sep 2019 12:35:40 +0200 |
| |
From: Thomas Hellstrom <thellstrom@vmware.com>
When SEV or SME is enabled and active, vm_get_page_prot() typically returns with the encryption bit set. This means that users of pgprot_modify(, vm_get_page_prot()) (mprotect_fixup, do_mmap) typically unintentionally sets encrypted page protection even on mmap'd coherent memory where the mmap callback has cleared the bit. Fix this by not allowing pgprot_modify() to change the encryption bit, similar to how it's done for PAT bits.
Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Borislav Petkov <bp@alien8.de> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Christoph Hellwig <hch@infradead.org> Cc: Christian König <christian.koenig@amd.com> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com> --- arch/x86/include/asm/pgtable.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h index 0bc530c4eb13..8e507169fd90 100644 --- a/arch/x86/include/asm/pgtable.h +++ b/arch/x86/include/asm/pgtable.h @@ -624,12 +624,16 @@ static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot) return __pmd(val); } -/* mprotect needs to preserve PAT bits when updating vm_page_prot */ +/* + * mprotect needs to preserve PAT and encryption bits when updating + * vm_page_prot + */ #define pgprot_modify pgprot_modify static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot) { - pgprotval_t preservebits = pgprot_val(oldprot) & _PAGE_CHG_MASK; - pgprotval_t addbits = pgprot_val(newprot); + pgprotval_t preservebits = pgprot_val(oldprot) & + (_PAGE_CHG_MASK | sme_me_mask); + pgprotval_t addbits = pgprot_val(newprot) & ~sme_me_mask; return __pgprot(preservebits | addbits); } -- 2.20.1
| |