From: rail5 <[email protected]> The LoongArch ISA defines NX at bit 62 in the page table entry. Under TCG, NX is checked during translation, but the software page-walk helpers (LDDIR / LDPTE) were masking the whole PTE value with the PALEN mask. This clears upper permission bits (including NX), allowing execution from NX mappings.
Fix this by masking only the PPN/address field and preserving permission bits. Once NX is enforced, instruction fetches from NX pages correctly raise PNX, but taking PNX could end up looping because loongarch_cpu_do_interrupt() tried to fetch the faulting instruction to populate CSR_BADI, which faults with PNX again. Treat PNX like other instruction-fetch exceptions and skip the CSR_BADI fetch. Reported at: https://gitlab.com/qemu-project/qemu/-/issues/3319 Tested with a Linux guest by mapping a page RW, writing a single instruction, mprotect(PROT_READ) (no exec) and then calling through a function pointer. With this series applied the guest receives SIGSEGV instead of executing or hanging. rail5 (2): target/loongarch: Preserve PTE permission bits in LDDIR/LDPTE target/loongarch: Avoid recursive PNX exception on CSR_BADI fetch target/loongarch/tcg/tcg_cpu.c | 2 +- target/loongarch/tcg/tlb_helper.c | 29 +++++++++++++++++++++++++---- 2 files changed, 26 insertions(+), 5 deletions(-) -- 2.47.3
