diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index 5b4cdcb..bfbfb86 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -2743,8 +2743,11 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx)

 	vmcs_writel(CR0_GUEST_HOST_MASK, ~0UL);
 	vmx->vcpu.arch.cr4_guest_owned_bits = KVM_CR4_GUEST_OWNED_BITS;
-	if (enable_ept)
+	if (enable_ept) {
+		if (boot_cpu_has(X86_FEATURE_SMEP))
+			vmx->vcpu.arch.cr4_guest_owned_bits |= X86_CR4_SMEP;
 		vmx->vcpu.arch.cr4_guest_owned_bits |= X86_CR4_PGE;
+	}
 	vmcs_writel(CR4_GUEST_HOST_MASK, ~vmx->vcpu.arch.cr4_guest_owned_bits);

 	kvm_write_tsc(&vmx->vcpu, 0);
@@ -4366,6 +4369,12 @@ static void vmx_cpuid_update(struct kvm_vcpu *vcpu)

 static void vmx_set_supported_cpuid(u32 func, struct kvm_cpuid_entry2 *entry)
 {
+	switch (func) {
+		case 7:
+			if (!enable_ept)
+				entry->ebx &= ~(1U << 7); /* Clear SMEP bit */
+		break;
+	}
 }

 static struct kvm_x86_ops vmx_x86_ops = {
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 934b4c6..64ad4f6 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -68,7 +68,7 @@
 	(~(unsigned long)(X86_CR4_VME | X86_CR4_PVI | X86_CR4_TSD | X86_CR4_DE\
 			  | X86_CR4_PSE | X86_CR4_PAE | X86_CR4_MCE	\
 			  | X86_CR4_PGE | X86_CR4_PCE | X86_CR4_OSFXSR	\
-			  | X86_CR4_OSXSAVE \
+			  | X86_CR4_OSXSAVE | X86_CR4_SMEP \
 			  | X86_CR4_OSXMMEXCPT | X86_CR4_VMXE))

 #define CR8_RESERVED_BITS (~(unsigned long)X86_CR8_TPR)