Commit d0281a25 authored May 17, 2011 by Fenghua Yu Committed by H. Peter Anvin May 17, 2011

x86, cpufeature: Add cpufeature flag for SMEP



Add support for newly documented SMEP (Supervisor Mode Execution Protection) CPU
feature flag.

SMEP prevents the CPU in kernel-mode to jump to an executable page
that has the user flag set in the PTE.  This prevents the kernel from
executing user-space code accidentally or maliciously, so it for
example prevents kernel exploits from jumping to specially prepared
user-mode shell code.

[ hpa: added better description by Ingo Molnar ]

Signed-off-by: Fenghua Yu <fenghua.yu@intel.com>
LKML-Reference: <1305683069-25394-2-git-send-email-fenghua.yu@intel.com>
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>

parent 724a92ee

arch/x86/include/asm/cpufeature.h

+1 −0

Original line number	Diff line number	Diff line
		@@ -195,6 +195,7 @@

		/* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9 */
		#define X86_FEATURE_FSGSBASE (932+ 0) / {RD/WR}{FS/GS}BASE instructions*/
		#define X86_FEATURE_SMEP (932+ 7) / Supervisor Mode Execution Protection */
		#define X86_FEATURE_ERMS (932+ 9) / Enhanced REP MOVSB/STOSB */

		#if defined(__KERNEL__) && !defined(__ASSEMBLY__)