[PATCH 1/4] target/i386: mask the PML5 table address taken from CR3

[Tim <mdspan.github@gmail.com>]

The 5-level page walks in mmu_translate() and
x86_cpu_translate_for_debug() take the PML5 table address from CR3
with ~0xfff, which keeps CR3 bits 63:52.  The 4-level walks already
use PG_ADDRESS_MASK.  Use PG_ADDRESS_MASK for the 5-level walks as
well, so that CR3 control bits above the physical address width, such
as the LAM bits 61 and 62, do not become part of the table address.

Signed-off-by: Tim <mdspan.github@gmail.com>
---
 target/i386/helper.c                 | 2 +-
 target/i386/tcg/system/excp_helper.c | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/i386/helper.c b/target/i386/helper.c
index cb25018..723e87f 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -297,7 +297,7 @@ bool x86_cpu_translate_for_debug(CPUState *cs, vaddr addr,
             }
 
             if (la57) {
-                pml5e_addr = ((env->cr[3] & ~0xfff) +
+                pml5e_addr = ((env->cr[3] & PG_ADDRESS_MASK) +
                         (((addr >> 48) & 0x1ff) << 3)) & a20_mask;
                 pml5e = x86_ldq_phys(cs, pml5e_addr);
                 if (!(pml5e & PG_PRESENT_MASK)) {
diff --git a/target/i386/tcg/system/excp_helper.c b/target/i386/tcg/system/excp_helper.c
index 44be98a..6c48ccb 100644
--- a/target/i386/tcg/system/excp_helper.c
+++ b/target/i386/tcg/system/excp_helper.c
@@ -173,7 +173,8 @@ static bool mmu_translate(CPUX86State *env, const TranslateParams *in,
                 /*
                  * Page table level 5
                  */
-                pte_addr = (in->cr3 & ~0xfff) + (((addr >> 48) & 0x1ff) << 3);
+                pte_addr = (in->cr3 & PG_ADDRESS_MASK) +
+                           (((addr >> 48) & 0x1ff) << 3);
                 if (!ptw_translate(&pte_trans, pte_addr)) {
                     return false;
                 }
-- 
2.47.3