From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

Using a target unsigned long would limit the Input Address to a LPAE
page-walk to 32 bits on AArch32 and 64 bits on AArch64. This is okay
for stage 1 or on AArch64, but it is insufficient for stage 2 on
AArch32. In that later case, the Input Address can have up to 40 bits.

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 11b0803df7..38cd35c049 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -40,7 +40,7 @@
 
 #ifndef CONFIG_USER_ONLY
 
-static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
+static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                bool s1_is_el0,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
@@ -10988,7 +10988,7 @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
  * @fi: set to fault info if the translation fails
  * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
  */
-static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
+static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                bool s1_is_el0,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
-- 
2.20.1

On 11/18/20 7:04 AM, Rémi Denis-Courmont wrote:
> From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
> 
> Using a target unsigned long would limit the Input Address to a LPAE
> page-walk to 32 bits on AArch32 and 64 bits on AArch64. This is okay
> for stage 1 or on AArch64, but it is insufficient for stage 2 on
> AArch32. In that later case, the Input Address can have up to 40 bits.
> 
> Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
> ---
>  target/arm/helper.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Peter, bug fix for 5.2 or postpone?


r~

On Thu, 19 Nov 2020 at 22:37, Richard Henderson
<richard.henderson@linaro.org> wrote:
>
> On 11/18/20 7:04 AM, Rémi Denis-Courmont wrote:
> > From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
> >
> > Using a target unsigned long would limit the Input Address to a LPAE
> > page-walk to 32 bits on AArch32 and 64 bits on AArch64. This is okay
> > for stage 1 or on AArch64, but it is insufficient for stage 2 on
> > AArch32. In that later case, the Input Address can have up to 40 bits.
> >
> > Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
> > ---
> >  target/arm/helper.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
>
> Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
>
> Peter, bug fix for 5.2 or postpone?

Looks pretty safe so it seems reasonable to have in 5.2.
Interesting that it's taken so long for anybody to notice...

-- PMM