From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 9 Feb 2016 10:44:35 +0000 (+0100)
Subject: target-i386: fix PSE36 mode
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=388ee48a88e684e719660a2cae9c21897b94fa37;p=people%2Fliuw%2Flibxenctrl-split%2Fqemu-xen.git

target-i386: fix PSE36 mode

(pde & 0x1fe000) is a 32-bit integer; when shifting it
into bits 39-32 the result is zero.  Fix it by making the
mask (and thus the result of the AND) a 64-bit integer.

Reported by Coverity.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---

diff --git a/target-i386/helper.c b/target-i386/helper.c
index 81568c8b2..3802ed935 100644
--- a/target-i386/helper.c
+++ b/target-i386/helper.c
@@ -861,7 +861,7 @@ int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr,
             /* Bits 20-13 provide bits 39-32 of the address, bit 21 is reserved.
              * Leave bits 20-13 in place for setting accessed/dirty bits below.
              */
-            pte = pde | ((pde & 0x1fe000) << (32 - 13));
+            pte = pde | ((pde & 0x1fe000LL) << (32 - 13));
             rsvd_mask = 0x200000;
             goto do_check_protect_pse36;
         }
@@ -1056,7 +1056,7 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
         if (!(pde & PG_PRESENT_MASK))
             return -1;
         if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {
-            pte = pde | ((pde & 0x1fe000) << (32 - 13));
+            pte = pde | ((pde & 0x1fe000LL) << (32 - 13));
             page_size = 4096 * 1024;
         } else {
             /* page directory entry */