From 57d0a39d98b0d0e4712e736084667bcb5aed3474 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Tue, 12 Mar 2013 00:31:41 +0000 Subject: [PATCH] mmu-hash64: Factor SLB N bit into permissions bits BEHAVIOUR CHANGE Currently, for 64-bit hash mmu, the execute protection bit placed into the qemu tlb is based only on the N (No execute) bit from the PTE. However, No Execute can also be set at the segment level. We do check this on execute faults, but this still means we could incorrectly allow execution of code from a No Execute segment, if a prior read or write fault caused the page to be loaded into the qemu tlb with PROT_EXEC set. To correct this, we (re-)check the segment level no execute permission when generating the protection bits for the qemu tlb. Signed-off-by: David Gibson Signed-off-by: Alexander Graf --- target-ppc/mmu-hash64.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/target-ppc/mmu-hash64.c b/target-ppc/mmu-hash64.c index 1458f15dd2..5607ce8dec 100644 --- a/target-ppc/mmu-hash64.c +++ b/target-ppc/mmu-hash64.c @@ -272,7 +272,8 @@ static int ppc_hash64_pte_prot(CPUPPCState *env, } /* No execute if either noexec or guarded bits set */ - if (!(pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G)) { + if (!(pte.pte1 & HPTE64_R_N) || (pte.pte1 & HPTE64_R_G) + || (slb->vsid & SLB_VSID_N)) { prot |= PAGE_EXEC; }