[APPLIED] Re: [Oneiric][pull-request] Ivy Bridge: KVM support for SMEP (Supervisor Mode Execution Protection)

[Leann Ogasawara]

Applied to Oneiric.

Thanks,
Leann

On Thu, 2011-08-04 at 11:52 -0700, Leann Ogasawara wrote:
> BugLink: http://bugs.launchpad.net/bugs/796476
> 
> It's been requested that we pull the following upstream patches in order
> to enable KVM support for SMEP (Supervisor Mode Execution Protection)
> for Intel's Ivy Bridge.  SMEP prevents execution of user mode pages
> while in supervisor mode and addresses a class of exploits for hijacking
> kernel execution.  
> 
> All patches were clean cherry-picks with the minor exception of "KVM:
> Mask function7 ebx against host capability word9".
> 
> I unfortunately do not have access to Ivy Bridge hardware to test, but I
> have at least tested KVM on other hardware to confirm we're not
> introducing any regressions.  If anyone else is interested in testing,
> I've posted debs at:
> 
> http://people.canonical.com/~ogasawara/lp796476/
> 
> I just wanted to get this out to the mailing list for review before
> applying to Oneiric.  I feel it better to get this applied and tested
> well before we hit kernel freeze to 1) confirm any regressions, if any
> and 2) apply any additional patches if needed.
> 
> Thanks,
> Leann
> 
> The following changes since commit a5c2202c4ca41d438f0502fce3f67a8ab25b64e7:
> 
>   UBUNTU: [Config] Disable config IWLWIFI_DEVICE_SVTOOL (2011-08-02 11:08:28 -0700)
> 
> are available in the git repository at:
>   git://kernel.ubuntu.com/ogasawara/ubuntu-oneiric lp796476
> 
> Yang, Wei Y (4):
>       KVM: Remove SMEP bit from CR4_RESERVED_BITS
>       KVM: Add SMEP support when setting CR4
>       KVM: Mask function7 ebx against host capability word9
>       KVM: Add instruction fetch checking when walking guest page table
> 
>  arch/x86/include/asm/kvm_host.h |    2 +-
>  arch/x86/kvm/paging_tmpl.h      |    9 ++++++++-
>  arch/x86/kvm/x86.c              |   35 ++++++++++++++++++++++++++++++++---
>  3 files changed, 41 insertions(+), 5 deletions(-)
> 
>