Messages in this thread |  | | | Date | Tue, 17 May 2011 03:10:06 +0100 | | From | Matthew Garrett <> | | Subject | Re: [PATCH v2 3/4] x86, head_32/64.S: Enable SMEP |
| |
On Mon, May 16, 2011 at 02:34:44PM -0700, Fenghua Yu wrote: > From: Fenghua Yu <fenghua.yu@intel.com> > > Enable newly documented SMEP (Supervisor Mode Execution Protection) CPU > feature in kernel. > > SMEP prevents the CPU in kernel-mode to jump to an executable page that does > not have the kernel/system flag set in the pte. This prevents the kernel > from executing user-space code accidentally or maliciously, so it for example > prevents kernel exploits from jumping to specially prepared user-mode shell > code. The violation will cause page fault #PF and will have error code > identical to XD violation.
Are EFI runtime service pages currently set up appropriately?
-- Matthew Garrett | mjg59@srcf.ucam.org
|  |