xen/arm: guest_walk: refuse a block descriptor where the granule has none

index 09fe486598..e23457869b 100644
@@ -533,6 +533,15 @@ static bool guest_walk_ld(const struct vcpu *v,
     if ( !lpae_is_valid(pte) || !lpae_is_mapping(pte, level) )
         return false;
 
+    /*
+     * A block descriptor is only supported at level 1 and level 2 with the
+     * 4KB granule, and only at level 2 with the 16KB and 64KB granules (ARM
+     * DDI 0487A.k D4.3.1). The block encoding at any other level generates a
+     * Translation fault (AArch64.TranslationTableWalk(), J1.1.5).
+     */
+    if ( level == 0 || (level == 1 && gran != GRANULE_SIZE_INDEX_4K) )
+        return false;
+
     /* Make sure that the lower bits of the PTE's base address are zero. */
     mask = GENMASK_ULL(47, grainsizes[gran]);
     *ipa = (pfn_to_paddr(pte.walk.base) & mask) |

index e23457869b..a8f8530683 100644
@@ -407,6 +407,15 @@ static bool guest_walk_ld(const struct vcpu *v,
         if ( (input_size > TCR_EL1_IPS_48_BIT_VAL) ||
              (input_size < TCR_EL1_IPS_MIN_VAL) )
             return false;
+
+        /*
+         * The bits of the GVA from the top bit down to the input size must
+         * all be 0 for TTBR0 and all 1 for TTBR1, or the translation faults
+         * (ARM DDI 0487A.k AArch64.TranslationTableWalk(), J1.1.5).
+         */
+        mask = GENMASK_ULL(topbit, input_size);
+        if ( (gva & mask) != ((gva & BIT(topbit, ULL)) ? mask : 0) )
+            return false;
     }
     else
     {

index 6a5dcef2aa..f6abe25f74 100644
@@ -532,7 +532,13 @@ static vaddr_t exception_handler64(struct cpu_user_regs *regs, vaddr_t offset)
         base += VECTOR64_LOWER32_BASE;
     else if ( psr_mode(regs->cpsr,PSR_MODE_EL0t) )
         base += VECTOR64_LOWER64_BASE;
-    else /* Otherwise must be from kernel mode */
+    /*
+     * Otherwise must be from kernel mode. The current EL group is chosen by
+     * the stack pointer in use (ARM DDI 0487A.k D1.10.2, Table D1-7).
+     */
+    else if ( psr_mode(regs->cpsr,PSR_MODE_EL1t) )
+        base += VECTOR64_CURRENT_SP0_BASE;
+    else
         base += VECTOR64_CURRENT_SPx_BASE;
 
     return base + offset;

index 7e5f4b8a00..0bdc4d6a46 100644
@@ -366,7 +366,8 @@ static int modify_bars(const struct pci_dev *pdev, uint16_t cmd, bool rom_only)
             gprintk(XENLOG_G_WARNING,
                     "%pp: can't map BAR%u - offset mismatch: %#lx vs %#lx\n",
                     &pdev->sbdf, i, bar->guest_addr, bar->addr);
-            return -EINVAL;
+            rc = -EINVAL;
+            goto fail;
         }
 
         rc = rangeset_add_range(bar->mem, start_guest, end_guest);

@@ -374,7 +375,7 @@ static int modify_bars(const struct pci_dev *pdev, uint16_t cmd, bool rom_only)
         {
             printk(XENLOG_G_WARNING "Failed to add [%lx, %lx]: %d\n",
                    start_guest, end_guest, rc);
-            return rc;
+            goto fail;
         }
 
         /* Check for overlap with the already setup BAR ranges. */

@@ -391,7 +392,7 @@ static int modify_bars(const struct pci_dev *pdev, uint16_t cmd, bool rom_only)
                 gprintk(XENLOG_WARNING,
                        "%pp: failed to remove overlapping range [%lx, %lx]: %d\n",
                         &pdev->sbdf, start_guest, end_guest, rc);
-                return rc;
+                goto fail;
             }
         }
 

@@ -401,7 +402,7 @@ static int modify_bars(const struct pci_dev *pdev, uint16_t cmd, bool rom_only)
             gprintk(XENLOG_WARNING,
                     "%pp: failed to sanitize BAR#%u memory: %d\n",
                     &pdev->sbdf, i, rc);
-            return rc;
+            goto fail;
         }
     }
 

@@ -425,7 +426,7 @@ static int modify_bars(const struct pci_dev *pdev, uint16_t cmd, bool rom_only)
                 gprintk(XENLOG_WARNING,
                        "%pp: failed to remove MSIX table [%lx, %lx]: %d\n",
                         &pdev->sbdf, start, end, rc);
-                return rc;
+                goto fail;
             }
         }
     }

@@ -487,7 +488,7 @@ static int modify_bars(const struct pci_dev *pdev, uint16_t cmd, bool rom_only)
                         gprintk(XENLOG_WARNING,
                                 "%pp: failed to remove [%lx, %lx]: %d\n",
                                 &pdev->sbdf, start, end, rc);
-                        return rc;
+                        goto fail;
                     }
                 }
             }

@@ -516,6 +517,18 @@ static int modify_bars(const struct pci_dev *pdev, uint16_t cmd, bool rom_only)
     defer_map(pdev, cmd, rom_only);
 
     return 0;
+
+ fail:
+    /*
+     * Leave no range collected for the request that failed: the next request
+     * expects every BAR's set to start empty, and a range left behind would
+     * be mapped or unmapped with it.
+     */
+    for ( i = 0; i < ARRAY_SIZE(header->bars); i++ )
+        if ( header->bars[i].mem )
+            rangeset_purge(header->bars[i].mem);
+
+    return rc;
 }
 
 static void cf_check cmd_write(