From 75608795b0036708a949328f442cb8150a53f17c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?=
 <marmarek@invisiblethingslab.com>
Date: Mon, 3 Jul 2017 23:25:43 +0200
Subject: [PATCH] Disable SMAP in VMs

Linux kernel bug cause hypercall fails from HVM userspace (see
referenced issue). As a simple workaround, do not advertise SMAP to VMs
- but still use it as hypervisor level.

Fixes QubesOS/qubes-issues#2881
---
 templates/libvirt/xen.xml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/templates/libvirt/xen.xml b/templates/libvirt/xen.xml
index 393f670d..e3ff31ac 100644
--- a/templates/libvirt/xen.xml
+++ b/templates/libvirt/xen.xml
@@ -10,6 +10,15 @@
         <currentMemory unit="MiB">{{ vm.memory }}</currentMemory>
         <vcpu placement="static">{{ vm.vcpus }}</vcpu>
     {% endblock %}
+    {% block cpu %}
+        <cpu mode='host-passthrough'>
+            <!-- disable nested HVM -->
+            <feature name='vmx' policy='disable'/>
+            <feature name='svm' policy='disable'/>
+            <!-- disable SMAP inside VM, because of Linux bug -->
+            <feature name='smap' policy='disable'/>
+        </cpu>
+    {% endblock %}
     <os>
         {% block os %}
             {% if vm.hvm %}