diff -r 2c2dc567a450 src/arch/x86/isa/insts/general_purpose/control_transfer/interrupts_and_exceptions.py
--- a/src/arch/x86/isa/insts/general_purpose/control_transfer/interrupts_and_exceptions.py	Mon Feb 07 01:23:16 2011 -0800
+++ b/src/arch/x86/isa/insts/general_purpose/control_transfer/interrupts_and_exceptions.py	Mon Feb 07 13:19:01 2011 +0000
@@ -102,10 +102,10 @@
     andi t6, t2, 0xF8, dataSize=8
     andi t0, t2, 0x4, flags=(EZF,), dataSize=2
     br label("globalCSDescriptor"), flags=(CEZF,)
-    ld t8, tsl, [1, t0, t6], dataSize=8
+    ld t8, tsl, [1, t0, t6], dataSize=8, atCPL0=True
     br label("processCSDescriptor")
 globalCSDescriptor:
-    ld t8, tsg, [1, t0, t6], dataSize=8
+    ld t8, tsg, [1, t0, t6], dataSize=8, atCPL0=True
 processCSDescriptor:
     chks t2, t6, dataSize=8
 
@@ -159,10 +159,10 @@
     andi t7, t9, 0xF8, dataSize=8
     andi t0, t9, 0x4, flags=(EZF,), dataSize=2
     br label("globalSSDescriptor"), flags=(CEZF,)
-    ld t7, tsl, [1, t0, t7], dataSize=8
+    ld t7, tsl, [1, t0, t7], dataSize=8, atCPL0=True
     br label("processSSDescriptor")
 globalSSDescriptor:
-    ld t7, tsg, [1, t0, t7], dataSize=8
+    ld t7, tsg, [1, t0, t7], dataSize=8, atCPL0=True
 processSSDescriptor:
     chks t9, t7, dataSize=8
 
diff -r 2c2dc567a450 src/arch/x86/isa/insts/general_purpose/control_transfer/jump.py
--- a/src/arch/x86/isa/insts/general_purpose/control_transfer/jump.py	Mon Feb 07 01:23:16 2011 -0800
+++ b/src/arch/x86/isa/insts/general_purpose/control_transfer/jump.py	Mon Feb 07 13:19:01 2011 +0000
@@ -101,11 +101,11 @@
     # Figure out the width of the offset.
     limm t3, dsz, dataSize=8
     slli t3, t3, 3, dataSize=8
-    # Get the selector into t1.
-    sll t1, t2, t3, dataSize=8
-    mov t1, t0, t1, dataSize=2
-    # And get the offset into t2
-    mov t2, t0, t2
+    # Get the offset into t1.
+    mov t1, t0, t2
+    # Get the selector into t2.
+    srl t2, t2, t3, dataSize=8
+    mov t2, t0, t2, dataSize=2
     br rom_label("jmpFarWork")
 };
 
diff -r 2c2dc567a450 src/arch/x86/isa/insts/general_purpose/system_calls.py
--- a/src/arch/x86/isa/insts/general_purpose/system_calls.py	Mon Feb 07 01:23:16 2011 -0800
+++ b/src/arch/x86/isa/insts/general_purpose/system_calls.py	Mon Feb 07 13:19:01 2011 +0000
@@ -79,8 +79,8 @@
     wrattr ss, t4
 
     # Set the new rip.
-    rdval t7, lstar
-    wrip t0, t7
+    rdval t7, lstar, dataSize=8
+    wrip t0, t7, dataSize=8
 
     # Mask the flags against sf_mask and leave RF turned off.
     rdval t3, sf_mask, dataSize=8
diff -r 2c2dc567a450 src/arch/x86/tlb.cc
--- a/src/arch/x86/tlb.cc	Mon Feb 07 01:23:16 2011 -0800
+++ b/src/arch/x86/tlb.cc	Mon Feb 07 13:19:01 2011 +0000
@@ -634,14 +634,16 @@
             // Do paging protection checks.
             bool inUser = (m5Reg.cpl == 3 &&
                     !(flags & (CPL0FlagBit << FlagShift)));
-            if ((inUser && !entry->user) ||
-                (mode == Write && !entry->writable)) {
+            CR0 cr0 = tc->readMiscRegNoEffect(MISCREG_CR0);
+            bool badWrite = (!entry->writable && (inUser || cr0.wp));
+            if ((inUser && !entry->user) || 
+                (mode == Write && badWrite)) {
                 // The page must have been present to get into the TLB in
                 // the first place. We'll assume the reserved bits are
                 // fine even though we're not checking them.
                 return new PageFault(vaddr, true, mode, inUser, false);
             }
-            if (storeCheck && !entry->writable) {
+            if (storeCheck && badWrite) {
                 // This would fault if this were a write, so return a page
                 // fault that reflects that happening.
                 return new PageFault(vaddr, true, Write, inUser, false);