From: Thomas Hellstrom <[email protected]> When SEV or SME is enabled and active, vm_get_page_prot() typically returns with the encryption bit set. This means that users of pgprot_modify(, vm_get_page_prot()) (mprotect_fixup, do_mmap) typically unintentionally sets encrypted page protection even on mmap'd coherent memory where the mmap callback has cleared the bit. Fix this by not allowing pgprot_modify() to change the encryption bit, similar to how it's done for PAT bits.
Cc: Dave Hansen <[email protected]> Cc: Andy Lutomirski <[email protected]> Cc: Peter Zijlstra <[email protected]> Cc: Thomas Gleixner <[email protected]> Cc: Ingo Molnar <[email protected]> Cc: Borislav Petkov <[email protected]> Cc: "H. Peter Anvin" <[email protected]> Cc: Christoph Hellwig <[email protected]> Cc: Christian König <[email protected]> Cc: Marek Szyprowski <[email protected]> Cc: Tom Lendacky <[email protected]> Signed-off-by: Thomas Hellstrom <[email protected]> --- arch/x86/include/asm/pgtable.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h index 0bc530c4eb13..8e507169fd90 100644 --- a/arch/x86/include/asm/pgtable.h +++ b/arch/x86/include/asm/pgtable.h @@ -624,12 +624,16 @@ static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot) return __pmd(val); } -/* mprotect needs to preserve PAT bits when updating vm_page_prot */ +/* + * mprotect needs to preserve PAT and encryption bits when updating + * vm_page_prot + */ #define pgprot_modify pgprot_modify static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot) { - pgprotval_t preservebits = pgprot_val(oldprot) & _PAGE_CHG_MASK; - pgprotval_t addbits = pgprot_val(newprot); + pgprotval_t preservebits = pgprot_val(oldprot) & + (_PAGE_CHG_MASK | sme_me_mask); + pgprotval_t addbits = pgprot_val(newprot) & ~sme_me_mask; return __pgprot(preservebits | addbits); } -- 2.20.1
