From nobody Sun Jul 26 11:50:59 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1782808296; cv=none; d=zohomail.com; s=zohoarc; b=gANOJ7iF4f/u1lb6nZrIxxakuexje+r8etsSSwPYQcvnwBCy7v7qj9QLuXZaI0QeC7ozaYweJDnUnlJb7vy4dLPJkhGf7TYK7Jvym22y2h+K6qAvrsBOhZWMrY7+xmQWRlbBopMipPTyMsIIV+XxNWde/MmKMWMHQFEIwKLeJ4o= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782808296; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=h8zGCmdAwloMFauytVcQhO34NOBxeWpOE94GwYvraSo=; b=JjYKiNx+hVZDWmZARrGTjte6biHPzkJBxnqWoxrfDF29Drb4krPTTzuqaA9jNSyFR8huyTwl9vo1GAcfH8sqslNvuVLt0w+i6tD4CuRDeAcB4xt1aHUtAMXqdza8+a4itiOzGBGmSWTX0aRS3OZp+4XJyd5otWFQlHUF4br5v2s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782808295983259.19848606447226; Tue, 30 Jun 2026 01:31:35 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1weTrz-0001IT-4u; Tue, 30 Jun 2026 04:31:03 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weTrx-0001HW-6W for qemu-devel@nongnu.org; Tue, 30 Jun 2026 04:31:01 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weTrv-0007Ne-S4 for qemu-devel@nongnu.org; Tue, 30 Jun 2026 04:31:00 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-512-YDdFB5oRNGOSpeCWTK6OFg-1; Tue, 30 Jun 2026 04:30:54 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id DE054180AC57; Tue, 30 Jun 2026 08:30:52 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.33.117]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 104771955F6F; Tue, 30 Jun 2026 08:30:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782808259; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=h8zGCmdAwloMFauytVcQhO34NOBxeWpOE94GwYvraSo=; b=S9mOuVsgc3dV3vcI+QS7+daNTAr7kIybbSOxGSrW07f2FT89RSNJqwgrwOa4v1ad5ebEag Cdjy6Lg5qhliRA2ywAfe+XXai/nJu4q8O2zEL7bM9V5RjcTENytKgbXFHU1vO1u5H94DxG RNZiv9Yk8Ucm2QPdbZ3O4xIq9IlWC3E= X-MC-Unique: YDdFB5oRNGOSpeCWTK6OFg-1 X-Mimecast-MFC-AGG-ID: YDdFB5oRNGOSpeCWTK6OFg_1782808253 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com Subject: [PATCH 1/2] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT Date: Tue, 30 Jun 2026 10:30:19 +0200 Message-ID: <20260630083042.2692392-2-eric.auger@redhat.com> In-Reply-To: <20260630083042.2692392-1-eric.auger@redhat.com> References: <20260630083042.2692392-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1782808297619158500 Content-Type: text/plain; charset="utf-8" Currently the guest value for the SPLIT field is not checked. Also the spec says that values different from 6, 8, 10, respectively meaning 4KB, 16kB and 64kB leaf tables are reserved and behave as 6. Signed-off-by: Eric Auger Reviewed-by: Shameer Kolothum --- hw/arm/smmuv3.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 5e5a6a960c9..0a8d2fbb6a7 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -1688,6 +1688,13 @@ static MemTxResult smmu_writel(SMMUv3State *s, hwadd= r offset, s->strtab_base_cfg =3D data; if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) =3D=3D 1) { s->sid_split =3D FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT); + if (s->sid_split !=3D 6 && s->sid_split !=3D 8 && s->sid_split= !=3D 10) { + /* Other values are reserved, behave as 6 */ + qemu_log_mask(LOG_GUEST_ERROR, + "Invalid STRTAB_BASE_CFG.SPLIT=3D0x%b, use 0= b0110\n", + s->sid_split); + s->sid_split =3D 6; + } s->features |=3D SMMU_FEATURE_2LVL_STE; } break; --=20 2.53.0 From nobody Sun Jul 26 11:50:59 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1782808317; cv=none; d=zohomail.com; s=zohoarc; b=PcCZ6Sv22SeGkQY+VEis4z7CDYjzg4GaVIQYBwoheHx07f4MVvQpTmIgidGqDBq2ZOv/kto/Gzhq7e06eqmLwtojo2nOit/SVhZsUhIvP5nx9zWnONEqkIui/9LWPTV54nnjePVp7FK3HjVNr0ddPklaAQ+Gxc/kkjOsKk040H8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782808317; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=hv+0R834BwhHICPy1zKpGYMVlCiOM1GdjbkzMGOS51o=; b=jXd+PnSoQ9INmg6KJbS4hQ4GQL4QXWTwmUycmXpPCq+7KVQHDbBZ9eZZolILoAnGYE1gfRZgQCC8/CvLkAy1DKPdZnjBUgn8GcOrbezirodkkn6OedDQQ3vmf3yJEQ0MUwugtrPs/IoavxAl3ZvFmDcokfuyOWukpt4+CFWoEBc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782808317342697.1614276749882; Tue, 30 Jun 2026 01:31:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1weTs0-0001J6-PO; Tue, 30 Jun 2026 04:31:04 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weTrz-0001Iw-OK for qemu-devel@nongnu.org; Tue, 30 Jun 2026 04:31:03 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weTry-0007OA-Bi for qemu-devel@nongnu.org; Tue, 30 Jun 2026 04:31:03 -0400 Received: from mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-638-2_wbR7PoM7C3Cp1a5RgNsw-1; Tue, 30 Jun 2026 04:30:57 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 485F91955D92; Tue, 30 Jun 2026 08:30:56 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.33.117]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 5F4BA1955F6F; Tue, 30 Jun 2026 08:30:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782808261; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hv+0R834BwhHICPy1zKpGYMVlCiOM1GdjbkzMGOS51o=; b=c1YQoNz40G1mcrSY9+fY3PUspSXKlHI2Imvw4qTgh9tp5xtAsc+YZ/1aZ8CSiWMu/rE9UT Al6b4iU1/rThUIL7sASDsZk2og9Y7c805/zFc1LvmcIi9lX6vde/34QQky+l+x8azcC+ES U3CSq2lJv8eLlU1cjcDBiSt3pwqbrXw= X-MC-Unique: 2_wbR7PoM7C3Cp1a5RgNsw-1 X-Mimecast-MFC-AGG-ID: 2_wbR7PoM7C3Cp1a5RgNsw_1782808256 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com Subject: [PATCH 2/2] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.LOG2SIZE Date: Tue, 30 Jun 2026 10:30:20 +0200 Message-ID: <20260630083042.2692392-3-eric.auger@redhat.com> In-Reply-To: <20260630083042.2692392-1-eric.auger@redhat.com> References: <20260630083042.2692392-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1782808319536158500 Content-Type: text/plain; charset="utf-8" STRTAB_BASE_CFG.LOG2SIZE is programmed by the guest through the emulated SMMUv3 MMIO register interface. Currently the value is not checked. The SMMU spec says: "Except for readback of a written value, the effective LOG2SIZE is <=3D SMMU_IDR1.SIDSIZE for the purposes of input StreamID range checking and upper/lower/linear Stream table index address calculation." So for STE lookup make sure log2size is capped at SMMU_IDR1.SIDSIZE. Signed-off-by: Eric Auger --- hw/arm/smmuv3.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 0a8d2fbb6a7..db5aca26ec0 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -672,6 +672,15 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *s= te, SMMUEventInfo *event) /* * Check SID range against both guest-configured and implementation li= mits */ + if (log2size > SMMU_IDR1_SIDSIZE) { + /* + * spec says: Except for readback of a written value, the effective + * LOG2SIZE is <=3D SMMU_IDR1.SIDSIZE for the purposes of input St= reamID + * range checking and upper/lower/linear Stream table index address + * calculation. + */ + log2size =3D SMMU_IDR1_SIDSIZE; + } if (sid >=3D (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) { event->type =3D SMMU_EVT_C_BAD_STREAMID; return -EINVAL; --=20 2.53.0