svn commit: r273573 - stable/10/sys/amd64/amd64

[Neel Natu]

Author: neel
Date: Fri Oct 24 03:48:54 2014
New Revision: 273573
URL: https://svnweb.freebsd.org/changeset/base/273573

Log:
  MFC r273356:
  Fix a race in pmap_emulate_accessed_dirty() that could trigger a EPT
  misconfiguration VM-exit.

Modified:
  stable/10/sys/amd64/amd64/pmap.c
Directory Properties:
  stable/10/   (props changed)

Modified: stable/10/sys/amd64/amd64/pmap.c
==============================================================================
--- stable/10/sys/amd64/amd64/pmap.c	Fri Oct 24 03:42:37 2014	(r273572)
+++ stable/10/sys/amd64/amd64/pmap.c	Fri Oct 24 03:48:54 2014	(r273573)
@@ -6791,9 +6791,19 @@ retry:
 	if (ftype == VM_PROT_WRITE) {
 		if ((*pte & PG_RW) == 0)
 			goto done;
-		*pte |= PG_M;
+		/*
+		 * Set the modified and accessed bits simultaneously.
+		 *
+		 * Intel EPT PTEs that do software emulation of A/D bits map
+		 * PG_A and PG_M to EPT_PG_READ and EPT_PG_WRITE respectively.
+		 * An EPT misconfiguration is triggered if the PTE is writable
+		 * but not readable (WR=10). This is avoided by setting PG_A
+		 * and PG_M simultaneously.
+		 */
+		*pte |= PG_M | PG_A;
+	} else {
+		*pte |= PG_A;
 	}
-	*pte |= PG_A;
 
 	/* try to promote the mapping */
 	if (va < VM_MAXUSER_ADDRESS)