1 files changed, 15 insertions, 3 deletions

diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index d2fec9c12d22..72558f8ff3f5 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -273,9 +273,13 @@ static void FNAME(update_pte)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *page,
         if (mmu_notifier_retry(vcpu, vcpu->arch.update_pte.mmu_seq))
                 return;
         kvm_get_pfn(pfn);
+        /*
+         * we call mmu_set_spte() with reset_host_protection = true beacuse that
+         * vcpu->arch.update_pte.pfn was fetched from get_user_pages(write = 1).
+         */
         mmu_set_spte(vcpu, spte, page->role.access, pte_access, 0, 0,
                      gpte & PT_DIRTY_MASK, NULL, PT_PAGE_TABLE_LEVEL,
-                     gpte_to_gfn(gpte), pfn, true);
+                     gpte_to_gfn(gpte), pfn, true, true);
 }
 
 /*
@@ -308,7 +312,7 @@ static u64 *FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr,
                                      user_fault, write_fault,
                                      gw->ptes[gw->level-1] & PT_DIRTY_MASK,
                                      ptwrite, level,
-                                     gw->gfn, pfn, false);
+                                     gw->gfn, pfn, false, true);
                         break;
                 }
 
@@ -558,6 +562,7 @@ static void FNAME(prefetch_page)(struct kvm_vcpu *vcpu,
 static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
 {
         int i, offset, nr_present;
+        bool reset_host_protection;
 
         offset = nr_present = 0;
 
@@ -595,9 +600,16 @@ static int FNAME(sync_page)(struct kvm_vcpu *vcpu, struct kvm_mmu_page *sp)
 
                 nr_present++;
                 pte_access = sp->role.access & FNAME(gpte_access)(vcpu, gpte);
+                if (!(sp->spt[i] & SPTE_HOST_WRITEABLE)) {
+                        pte_access &= ~ACC_WRITE_MASK;
+                        reset_host_protection = 0;
+                } else {
+                        reset_host_protection = 1;
+                }
                 set_spte(vcpu, &sp->spt[i], pte_access, 0, 0,
                          is_dirty_gpte(gpte), PT_PAGE_TABLE_LEVEL, gfn,
-                         spte_to_pfn(sp->spt[i]), true, false);
+                         spte_to_pfn(sp->spt[i]), true, false,
+                         reset_host_protection);
         }
 
         return !nr_present;