From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 27 May 2014 11:24:54 +0000 (+0200)
Subject: target-i386: fix protection bits in the TLB for SMEP
X-Git-Tag: v2.1.0-rc0~85^2~1
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b09481de91cce94342bac3327bb7633c39ff8bf6;p=thirdparty%2Fqemu.git

target-i386: fix protection bits in the TLB for SMEP

User pages must be marked as non-executable when running under SMEP;
otherwise, fetching the page first and then calling it will fail.

With this patch, all SMEP testcases in kvm-unit-tests now pass.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---

diff --git a/target-i386/helper.c b/target-i386/helper.c
index 2b917ad28d9..04beaebc98d 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -749,8 +749,10 @@ do_check_protect_pse36:
 
     /* the page can be put in the TLB */
     prot = PAGE_READ;
-    if (!(ptep & PG_NX_MASK))
+    if (!(ptep & PG_NX_MASK) &&
+        !((env->cr[4] & CR4_SMEP_MASK) && (ptep & PG_USER_MASK))) {
         prot |= PAGE_EXEC;
+    }
     if (pte & PG_DIRTY_MASK) {
         /* only set write access if already dirty... otherwise wait
            for dirty access */