I have recently been doing some research into kernel exploitation on X86_64. A problem I have run into is that I have found Intel's SMEP to be killing my contrived example of a kernel NULL pointer dereference which I have been working on.
My question: can you/how do you disable SMEP on linux? I have managed to remove SMAP (Security Mode Access Protection) on Linux kernel 3.8.x by disabling the functionality in the .config file but my problem still persists. I assume SMEP must be disabled differently from SMAP, given that after disabling it, execution of my mapped NULL page is still instantly killed as soon as execution is diverted within kernel-space.
Any help would be much appreciated.
P.S I have already set mmap_min_addr to 0 so please no comments telling me to alter this value in /proc/sys/vm :).