From nobody Sun Jul 26 10:59:41 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1782897403; cv=none; d=zohomail.com; s=zohoarc; b=D7nR4xtE5vkEX5Fv40+/waL19vq+s+ZYKBv/bvn+1vA0En4XJ9FOUq38KtqWaQ2C9lmc0bBo86XzNJhVlOVwAAPgRMmfN3qamPMPUgKl6PLsrC6lVNbJvR4CZNHJzNMbOo4YuwZwkaQDqKTXplzNmzeTO5BKs+0yg9aHu21krkA= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782897403; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=4yBaZCqVS5OvWIaH4vQdFMJ7XFKVk46/GgIK1pAGS7I=; b=Y98EXwsa28fSrncuH0Mdlzl5aKkxXvKP1wmy6IXK1c+3+ZwMoJTdJZMWFmFF8fk5hS+ho7ovE2CRs5hIA/swYKCHG2yTdDonUiuaefL4I1RV5Sf4JvWtPD4jlmMQMmVk4jv5/bSzmKcjuWG6qm/nX2ZM9Lxyyn7YNffLD/bH5E4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782897403199442.02662295893435; Wed, 1 Jul 2026 02:16:43 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wer01-0000wc-Ni; Wed, 01 Jul 2026 05:12:55 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqzb-0000pk-Ek for qemu-devel@nongnu.org; Wed, 01 Jul 2026 05:12:31 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqza-0007Ih-23 for qemu-devel@nongnu.org; Wed, 01 Jul 2026 05:12:27 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-189-hHRNdt2EOlajnT7jDKyoKQ-1; Wed, 01 Jul 2026 05:12:22 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 8072A1830199; Wed, 1 Jul 2026 09:12:20 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.33.117]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7A2B218005BF; Wed, 1 Jul 2026 09:12:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782897145; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=4yBaZCqVS5OvWIaH4vQdFMJ7XFKVk46/GgIK1pAGS7I=; b=OVTIF2c83cPeiEr7FvEH0wx8Ickn+xRO/Usk2XUXa2EVOnmDSEKG/5FcWauvVq37NN7lUV 7q6BzLcz1RFXD4t4fr8ym/19LPB7afpu8/ZCbeH8bzGFvkbvT7NZFYZInN/hDiNDAn37yf U2hZ8bv0F+9FIohzirF0CMXAVBWDlfM= X-MC-Unique: hHRNdt2EOlajnT7jDKyoKQ-1 X-Mimecast-MFC-AGG-ID: hHRNdt2EOlajnT7jDKyoKQ_1782897140 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com Subject: [PATCH v2 1/5] hw/arm/smmuv3: Fix off-by-one bug in alignment strtab mask Date: Wed, 1 Jul 2026 11:11:38 +0200 Message-ID: <20260701091209.2860306-2-eric.auger@redhat.com> In-Reply-To: <20260701091209.2860306-1-eric.auger@redhat.com> References: <20260701091209.2860306-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1782897404938158500 Content-Type: text/plain; charset="utf-8" The stream table base address needs to be aligned to its size. With FMT =3D=3D 0, the spec says the linear stream table base address musst have ADDR[LOG2SIZE + 5:0] =3D 0. STE are 64B With FMT =3D=3D 1, ADDR[MAX(5, (LOG2SIZE - SPLIT - 1 + 3)):0] =3D 0. L1 descriptors are 8B. MAKE_64BIT_MASK() second argument is a size and not a shift, so there is an off-by-one computation. Signed-off-by: Eric Auger --- hw/arm/smmuv3.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 5e5a6a960c9..38aba9c0af9 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -664,7 +664,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *st= e, SMMUEventInfo *event) { dma_addr_t addr, strtab_base; uint32_t log2size; - int strtab_size_shift; + int strtab_size; int ret; =20 trace_smmuv3_find_ste(sid, s->features, s->sid_split); @@ -685,9 +685,9 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *st= e, SMMUEventInfo *event) * Align strtab base address to table size. For this purpose, assu= me it * is not bounded by SMMU_IDR1_SIDSIZE. */ - strtab_size_shift =3D MAX(5, (int)log2size - s->sid_split - 1 + 3); + strtab_size =3D MAX(6, (int)log2size - s->sid_split + 3); strtab_base =3D s->strtab_base & SMMU_BASE_ADDR_MASK & - ~MAKE_64BIT_MASK(0, strtab_size_shift); + ~MAKE_64BIT_MASK(0, strtab_size); l1_ste_offset =3D sid >> s->sid_split; l2_ste_offset =3D sid & ((1 << s->sid_split) - 1); l1ptr =3D (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std)= ); @@ -729,9 +729,9 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *st= e, SMMUEventInfo *event) } addr =3D l2ptr + l2_ste_offset * sizeof(*ste); } else { - strtab_size_shift =3D log2size + 5; + strtab_size =3D log2size + 6; strtab_base =3D s->strtab_base & SMMU_BASE_ADDR_MASK & - ~MAKE_64BIT_MASK(0, strtab_size_shift); + ~MAKE_64BIT_MASK(0, strtab_size); addr =3D strtab_base + sid * sizeof(*ste); } =20 --=20 2.53.0 From nobody Sun Jul 26 10:59:41 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1782897491; cv=none; d=zohomail.com; s=zohoarc; b=aWmN1KUAD1zeIDUYHp1C0s6JpIBxMYstTyGFHC2WplRZuHrteVZh0WaWWgApXkpUiyzurbnTZjJMkFdLhFMpzbATeSbisn27Iq/yvfYQJjFDNMSOPbY2x6Tmsli/Ezvpls5Q1v2E3KvtK27zNxI8Q2fXWsHE2sZzVPefdas6Em0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782897491; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=I7HeEaZfUnANcE9Fkz/SCoaMXVCKDowNd0wSbY9G/+Y=; b=Y4zyJIHRtv6CSWEoNlHObGZUohqWJiOSWyoF2jI937erSnuzShpIH5VMvnvHZyV/wfDaKrcWNr5IhrYejmGTkypKb24V652pkNp63TLqzJc9nr+5g1dtn7jkNgROx+HR+WJO+nUeE+ncZZ+n415kn6GBjYSdFm8jDNY/L6/b0fg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782897491407317.74490516337937; Wed, 1 Jul 2026 02:18:11 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wer0O-000156-MV; Wed, 01 Jul 2026 05:13:22 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqzf-0000qc-Fd for qemu-devel@nongnu.org; Wed, 01 Jul 2026 05:12:34 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqzd-0007Lu-7e for qemu-devel@nongnu.org; Wed, 01 Jul 2026 05:12:30 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-554-xg6NS3GKMrqxs9HAEjMuBQ-1; Wed, 01 Jul 2026 05:12:25 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 08AA918E6A51; Wed, 1 Jul 2026 09:12:24 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.33.117]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 01FE31800586; Wed, 1 Jul 2026 09:12:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782897148; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=I7HeEaZfUnANcE9Fkz/SCoaMXVCKDowNd0wSbY9G/+Y=; b=PbZrwuWWwUVkBX0n4QICgn5fLocBPltQfZWLTIKPsboW8XZac+iAWiOOu60tVOxiACjkhx JgOcdIQ2GNxyiaegUqv/rihv5xoZ5GsanigpeCEecR3DDJOVLaPlnMw+u4q72GIY9U9+bc mWGQKMuDw4/PNueRaeIZdjxXBnSM0qM= X-MC-Unique: xg6NS3GKMrqxs9HAEjMuBQ-1 X-Mimecast-MFC-AGG-ID: xg6NS3GKMrqxs9HAEjMuBQ_1782897144 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com Subject: [PATCH v2 2/5] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT Date: Wed, 1 Jul 2026 11:11:39 +0200 Message-ID: <20260701091209.2860306-3-eric.auger@redhat.com> In-Reply-To: <20260701091209.2860306-1-eric.auger@redhat.com> References: <20260701091209.2860306-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1782897493319158500 Content-Type: text/plain; charset="utf-8" Currently the guest value for the SPLIT field is not checked. Also the spec says that values different from 6, 8, 10, respectively meaning 4KB, 16kB and 64kB leaf tables are reserved and behave as 6. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632 Signed-off-by: Eric Auger Reviewed-by: Shameer Kolothum --- hw/arm/smmuv3.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 38aba9c0af9..285e6164a07 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -1688,6 +1688,13 @@ static MemTxResult smmu_writel(SMMUv3State *s, hwadd= r offset, s->strtab_base_cfg =3D data; if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) =3D=3D 1) { s->sid_split =3D FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT); + if (s->sid_split !=3D 6 && s->sid_split !=3D 8 && s->sid_split= !=3D 10) { + /* Other values are reserved, behave as 6 */ + qemu_log_mask(LOG_GUEST_ERROR, + "Invalid STRTAB_BASE_CFG.SPLIT=3D%u, use 6 i= nstead\n", + s->sid_split); + s->sid_split =3D 6; + } s->features |=3D SMMU_FEATURE_2LVL_STE; } break; --=20 2.53.0 From nobody Sun Jul 26 10:59:41 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1782897408; cv=none; d=zohomail.com; s=zohoarc; b=ULgKosLuO8m9lRs98Iyuf1f732osqv+dC2vHkw3Cml5iUQjibImqf21DNUzU6Sedk2ivQSClwsfwoDv2JHqoT98qJ/K5+Ou9S44Lxyi1N1EtTIsBWKJojzygivY97UL6X8HmWrmH5JV7zlqVXJHHTU20lQXSmy+1lcgdy8kB+fY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782897408; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=SeybQdIIWmF3pMhGkURLVzPRIuE7Bsif8FAumNRhLgY=; b=SjOC1ze65ELuZ1eZEx/EEQxK2qdE8SPklYxkxaZ5CK8daDVz4lASjN7vesHCG5/B/Ncyc8BImwm6XRx3e3MUoTnIOyUvaC5TtkUzOGorsUCCSZQJ50L+Fq4SiULptv6l2KV88J8vV6IePDErBzjZZP4/Gs01oJ0jxDHCB0s5ePw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782897408055198.21799273106546; Wed, 1 Jul 2026 02:16:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wer06-0000z3-Ag; Wed, 01 Jul 2026 05:12:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqzi-0000rX-Ka for qemu-devel@nongnu.org; Wed, 01 Jul 2026 05:12:35 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqzg-0007MT-FX for qemu-devel@nongnu.org; Wed, 01 Jul 2026 05:12:33 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-388-cN0DoPIVPeOia7H8uVDJEA-1; Wed, 01 Jul 2026 05:12:28 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 4878B1945106; Wed, 1 Jul 2026 09:12:27 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.33.117]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 7F215180060F; Wed, 1 Jul 2026 09:12:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782897151; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=SeybQdIIWmF3pMhGkURLVzPRIuE7Bsif8FAumNRhLgY=; b=JdoW4tj634Ge0KCq/yX+PKUA8l6xN644rH6hBV49c9QSPE6ANyao4E71wDv7bVP3C6FNaE E5kGFSpai7hOEQaS8xhkvsmqiBvQE508trnNUiMIkLX3fBg7hHcizETLNoFCrzps7Xiaap TkWuapn4hH4oPrO9NZ5cp2J440IAiek= X-MC-Unique: cN0DoPIVPeOia7H8uVDJEA-1 X-Mimecast-MFC-AGG-ID: cN0DoPIVPeOia7H8uVDJEA_1782897147 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com Subject: [PATCH v2 3/5] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.LOG2SIZE Date: Wed, 1 Jul 2026 11:11:40 +0200 Message-ID: <20260701091209.2860306-4-eric.auger@redhat.com> In-Reply-To: <20260701091209.2860306-1-eric.auger@redhat.com> References: <20260701091209.2860306-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1782897408803158500 Content-Type: text/plain; charset="utf-8" STRTAB_BASE_CFG.LOG2SIZE is programmed by the guest through the emulated SMMUv3 MMIO register interface. Currently the value is not checked and used directly in smmu_find_ste() for strtab_base alignment computation with risk that MAKE_64BIT_MASK() runs out of bounds. On FMT=3D=3D1 the strtab_size cannot be greater than 64 after the SPLIT being at minimum 6 (log2size is max 64). However on FMT=3D0 path, strtab_size=3D log2size + 6 can potentially exceed 64. Let's abort in that case. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632 Signed-off-by: Eric Auger --- hw/arm/smmuv3.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 285e6164a07..5ec3700d0d5 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -1696,6 +1696,14 @@ static MemTxResult smmu_writel(SMMUv3State *s, hwadd= r offset, s->sid_split =3D 6; } s->features |=3D SMMU_FEATURE_2LVL_STE; + } else { + uint32_t log2size =3D FIELD_EX32(data, STRTAB_BASE_CFG, LOG2SI= ZE); + + if (log2size + 6 > 64) { + qemu_log_mask(LOG_GUEST_ERROR, + "Invalid STRTAB_BASE_CFG.LOG2SIZE: %d", log2= size); + g_assert_not_reached(); + } } break; case A_CMDQ_BASE: /* 64b */ --=20 2.53.0 From nobody Sun Jul 26 10:59:41 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1782897379; cv=none; d=zohomail.com; s=zohoarc; b=koHnQIWEIeb6V41AeBiWHhR9igGKyVR3JzK8Dxk4ZVsNcfY8AAybdechTAQHR8Euz6tvAMqpVjmcUX7trIJkQJcGNwb8DVCmdUYjpk1833yGr+CmVO3gZA3+H4uIYNf5idDAwcqTTFjdFJqP5Ces7P+sQtrTgKvdJr89Gd5EsLY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782897379; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=2UlUWdtEhYgdtN6KjOCbmywf5XaizCagqsN+FcWuwf4=; b=LXMp1O0RfWFNbxwCJDb++RhUnUHtA+8IDy88OA0kSqEJaV3ZKSZrL711AtdLC44GogslUtXgH0i4jlR8LSi4CuPe0JimaHNStUC5tYwHd3eD0f1dYYi6L13CUKoD/d8E0qWfbejAaTch/Fiy2VQ98Pu9tW2EydZyfvhj8TKMTvg= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782897379499599.8994106017462; Wed, 1 Jul 2026 02:16:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wer0c-00019T-Gw; Wed, 01 Jul 2026 05:13:32 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqzn-0000uM-4B for qemu-devel@nongnu.org; Wed, 01 Jul 2026 05:12:45 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqzl-0007Nv-Ig for qemu-devel@nongnu.org; Wed, 01 Jul 2026 05:12:38 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-644-QDFIVG2UMVKh4fvf7Tz87w-1; Wed, 01 Jul 2026 05:12:31 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 896191945111; Wed, 1 Jul 2026 09:12:30 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.33.117]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id BEBA71800586; Wed, 1 Jul 2026 09:12:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782897157; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2UlUWdtEhYgdtN6KjOCbmywf5XaizCagqsN+FcWuwf4=; b=F7+PrRQ30C9gn7jDeOh/Rb+WxB7MibZAnO0Kjx2HQX/SBp1IkLySnswj9MPWF8ZkogVlvb 4Uv7egd3HA4SGB406Ugp62RUnyNSbDBuUQQMBuHJkRVqzEI4Xq7h0S6IQAavUrb8BV7W9q hH4N/nMXqFj33EAeFiFvfwzpuLEET9M= X-MC-Unique: QDFIVG2UMVKh4fvf7Tz87w-1 X-Mimecast-MFC-AGG-ID: QDFIVG2UMVKh4fvf7Tz87w_1782897150 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com Subject: [PATCH v2 4/5] hw/arm/smmuv3: Check L1STD.SPAN Date: Wed, 1 Jul 2026 11:11:41 +0200 Message-ID: <20260701091209.2860306-5-eric.auger@redhat.com> In-Reply-To: <20260701091209.2860306-1-eric.auger@redhat.com> References: <20260701091209.2860306-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1782897383311158500 Content-Type: text/plain; charset="utf-8" Span values above 11 are reserved and behave as 0. Also span must be within the range of 0 to (SMMU_STRTAB_BASE_CFG.SPLIT + 1), ie. it must stay within the bounds of the stream table split point. Signed-off-by: Eric Auger Reviewed-by: Shameer Kolothum --- hw/arm/smmuv3.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 5ec3700d0d5..f694f832598 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -707,7 +707,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *st= e, SMMUEventInfo *event) =20 span =3D L1STD_SPAN(&l1std); =20 - if (!span) { + if (!span || span > 11) { /* l2ptr is not valid */ if (!event->inval_ste_allowed) { qemu_log_mask(LOG_GUEST_ERROR, @@ -716,6 +716,16 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *s= te, SMMUEventInfo *event) event->type =3D SMMU_EVT_C_BAD_STREAMID; return -EINVAL; } + + if (span > s->sid_split + 1) { + if (!event->inval_ste_allowed) { + qemu_log_mask(LOG_GUEST_ERROR, + "invalid span (0x%x)\n", span); + } + event->type =3D SMMU_EVT_C_BAD_STREAMID; + return -EINVAL; + } + max_l2_ste =3D (1 << span) - 1; l2ptr =3D l1std_l2ptr(&l1std); trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset, --=20 2.53.0 From nobody Sun Jul 26 10:59:41 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1782897379; cv=none; d=zohomail.com; s=zohoarc; b=Os2XEacWo/w4crXrTU1lEK952tS6DIa1440mJeC1i27AztZVAIadXf2DRXKJDB7hF/SwNDu9ff88m3qlUN79fbg0U6s7dSPYnT8IXZPjpHD4bVVV9Zme7M75cV2BC4Dy0hXCC0KU4DYuXFFmCHy7zLa1KBVk0SCja6L2ynYX9mo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1782897379; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=Q83IdznpPl2YabS5s5hl01wTYb10psxYF3ahc42/aWY=; b=UCILzscpH6TDJc96EwkenNzXCID910bso0Z3Kh46ObiHpjSDjPRTOdzSk2DiW8DmFdEgivwM3YqBWA8eQbzAtuPcjrce+tgVU5Q47p0xTTY057GNUYiYjflJiSRIRxv7dnX/HkixCA9PyGh7sFDJBsUVFNxCkpjw7+wpCSI/5/s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1782897379626302.12654482469554; Wed, 1 Jul 2026 02:16:19 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wer0f-0001Cb-4m; Wed, 01 Jul 2026 05:13:33 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqzp-0000uV-Ba for qemu-devel@nongnu.org; Wed, 01 Jul 2026 05:12:45 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqzn-0007PB-B4 for qemu-devel@nongnu.org; Wed, 01 Jul 2026 05:12:40 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-449-5eLr4g7PN-K8C1aQJyt3Nw-1; Wed, 01 Jul 2026 05:12:35 -0400 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 09C28180A252; Wed, 1 Jul 2026 09:12:34 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.33.117]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 0AB101800586; Wed, 1 Jul 2026 09:12:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782897158; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Q83IdznpPl2YabS5s5hl01wTYb10psxYF3ahc42/aWY=; b=EJKHzuPNoVsvn8gLjTrP5qu7pLWIIvTAn4l435c2uQh8Uy2kLTdTHKjLh/hVr1Yj6r6WN4 oPB5Ie37xTkZPEthypjbcIcgDBAsAqzjeyFGtoTuszjz8knAwFfwKEuqYqcRLjFMCgy/XY IWXppqGyJue6+FVOvYQ+0NZ4fCctUY8= X-MC-Unique: 5eLr4g7PN-K8C1aQJyt3Nw-1 X-Mimecast-MFC-AGG-ID: 5eLr4g7PN-K8C1aQJyt3Nw_1782897154 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com Subject: [PATCH v2 5/5] hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span Date: Wed, 1 Jul 2026 11:11:42 +0200 Message-ID: <20260701091209.2860306-6-eric.auger@redhat.com> In-Reply-To: <20260701091209.2860306-1-eric.auger@redhat.com> References: <20260701091209.2860306-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1782897383305158500 Content-Type: text/plain; charset="utf-8" Spec says: Bits L2Ptr[N:0] are treated as 0 by the SMMU, where N =3D=3D 5 + (Span - 1). Let's enforce this alignment. Signed-off-by: Eric Auger Reviewed-by: Shameer Kolothum --- hw/arm/smmuv3.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index f694f832598..7eb2c59d9eb 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -728,6 +728,8 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *st= e, SMMUEventInfo *event) =20 max_l2_ste =3D (1 << span) - 1; l2ptr =3D l1std_l2ptr(&l1std); + + l2ptr &=3D ~MAKE_64BIT_MASK(0, 6 + (span - 1)); trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset, l2ptr, l2_ste_offset, max_l2_ste); if (l2_ste_offset > max_l2_ste) { --=20 2.53.0