Enable newly documented SMEP (Supervisor Mode Execution Protection) CPU feature in KVM module. Intel new CPU supports SMEP (Supervisor Mode Execution Protection). SMEP prevents kernel from executing code in application. Updated Intel SDM describes this CPU feature. The document will be published soon. This patch is based on Fenghua's SMEP patch series, as referred by: https://lkml.org/lkml/2011/5/17/523 This patch enables guests' usage of SMEP. Currently, we don't enable this feature for guests with shadow page tables. Signed-off-by: Yang Wei <wei.y.yang@xxxxxxxxx> diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 5b4cdcb..7b88e76 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -2743,8 +2743,11 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx) vmcs_writel(CR0_GUEST_HOST_MASK, ~0UL); vmx->vcpu.arch.cr4_guest_owned_bits = KVM_CR4_GUEST_OWNED_BITS; - if (enable_ept) + if (enable_ept) { + if (boot_cpu_has(X86_FEATURE_SMEP)) + vmx->vcpu.arch.cr4_guest_owned_bits |= X86_CR4_SMEP; vmx->vcpu.arch.cr4_guest_owned_bits |= X86_CR4_PGE; + } vmcs_writel(CR4_GUEST_HOST_MASK, ~vmx->vcpu.arch.cr4_guest_owned_bits); kvm_write_tsc(&vmx->vcpu, 0); @@ -4366,6 +4369,12 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu) static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry) { + switch (func) { + case 7: + if (!enable_ept) + entry->ebx &= ~(1U << 7); /* Clear SMEP bit */ + break; + } } static struct kvm_x86_ops vmx_x86_ops = { diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 934b4c6..64ad4f6 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -68,7 +68,7 @@ (~(unsigned long)(X86_CR4_VME | X86_CR4_PVI | X86_CR4_TSD | X86_CR4_DE\ | X86_CR4_PSE | X86_CR4_PAE | X86_CR4_MCE \ | X86_CR4_PGE | X86_CR4_PCE | X86_CR4_OSFXSR \ - | X86_CR4_OSXSAVE \ + | X86_CR4_OSXSAVE | X86_CR4_SMEP \ | X86_CR4_OSXMMEXCPT | X86_CR4_VMXE)) #define CR8_RESERVED_BITS (~(unsigned long)X86_CR8_TPR)
Attachment:
kvm-smep.patch
Description: kvm-smep.patch
