2 files changed, 37 insertions, 0 deletions
diff --git a/sys/arch/amd64/amd64/machdep.c b/sys/arch/amd64/amd64/machdep.c
index 408ac95..5acacb4 100644
--- a/sys/arch/amd64/amd64/machdep.c
+++ b/sys/arch/amd64/amd64/machdep.c
@@ -314,6 +314,39 @@ md_sync_all(void)
 }
 
 void
+cpu_enable_smep(void)
+{
+    struct cpu_info *ci;
+    uint64_t cr4;
+
+    ci = this_cpu();
+    if (!ISSET(ci->feat, CPU_FEAT_SMEP)) {
+        pr_trace_bsp("SMEP not supported\n");
+        return;
+    }
+
+    cr4 = amd64_read_cr4();
+    cr4 |= BIT(20);         /* CR4.SMEP */
+    amd64_write_cr4(cr4);
+}
+
+void
+cpu_disable_smep(void)
+{
+    struct cpu_info *ci;
+    uint64_t cr4;
+
+    ci = this_cpu();
+    if (!ISSET(ci->feat, CPU_FEAT_SMEP)) {
+        return;
+    }
+
+    cr4 = amd64_read_cr4();
+    cr4 &= ~BIT(20);    /* CR4.SMEP */
+    amd64_write_cr4(cr4);
+}
+
+void
 cpu_startup(struct cpu_info *ci)
 {
     ci->self = ci;
@@ -328,6 +361,7 @@ cpu_startup(struct cpu_info *ci)
     try_mitigate_spectre();
 
     cpu_check_feat(ci);
+    cpu_enable_smep();
 
     enable_simd();
     lapic_init();
diff --git a/sys/include/arch/amd64/cpu.h b/sys/include/arch/amd64/cpu.h
index fe8fc8a..46e5df7 100644
--- a/sys/include/arch/amd64/cpu.h
+++ b/sys/include/arch/amd64/cpu.h
@@ -61,6 +61,9 @@ __dead void cpu_halt_all(void);
 void cpu_halt_others(void);
 void cpu_startup(struct cpu_info *ci);
 
+void cpu_enable_smep(void);
+void cpu_disable_smep(void);
+
 struct cpu_info *cpu_get(uint32_t index);
 uint32_t cpu_count(void);
 void cpu_shootdown_tlb(vaddr_t va);