From 98452daad604a18ad181b4aa1b84c6db688cdbaa Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Tue, 20 Feb 2018 11:03:39 -0500 Subject: [PATCH] target-i386: fix PSE36 mode (pde & 0x1fe000) is a 32-bit integer; when shifting it into bits 39-32 the result is zero. Fix it by making the mask (and thus the result of the AND) a 64-bit integer. Reported by Coverity. Backports commit 388ee48a88e684e719660a2cae9c21897b94fa37 from qemu --- qemu/target-i386/helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/qemu/target-i386/helper.c b/qemu/target-i386/helper.c index 31080853..584ae2a8 100644 --- a/qemu/target-i386/helper.c +++ b/qemu/target-i386/helper.c @@ -674,7 +674,7 @@ int x86_cpu_handle_mmu_fault(CPUState *cs, vaddr addr, /* Bits 20-13 provide bits 39-32 of the address, bit 21 is reserved. * Leave bits 20-13 in place for setting accessed/dirty bits below. */ - pte = pde | ((pde & 0x1fe000) << (32 - 13)); + pte = pde | ((pde & 0x1fe000LL) << (32 - 13)); rsvd_mask = 0x200000; goto do_check_protect_pse36; } @@ -874,7 +874,7 @@ hwaddr x86_cpu_get_phys_page_debug(CPUState *cs, vaddr addr) if (!(pde & PG_PRESENT_MASK)) return -1; if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) { - pte = pde | ((pde & 0x1fe000) << (32 - 13)); + pte = pde | ((pde & 0x1fe000LL) << (32 - 13)); page_size = 4096 * 1024; } else { /* page directory entry */