The current code fails to sanitize SMMU_S_STRTAB_BASE_CFG
LOG2SIZE and SPLIT which are used in the STE lookup. This
could potentially lead to wrong shifts/masks in
smmu_find_ste() and does not fully comply with the spec.

Also the series fixes different issues related to strtab base
address alignment computations: off-by-one mask, unchecked span,
missing L2ptr base address alignment. Those issues
were not visible because the guest kernel does what it should
but better comply with the spec.

Best Regards

Eric

This series is available at:
https://github.com/eauger/qemu/tree/smmu_sanitize_v3

v2 -> v3:
- Introduced STE_SIZE and L1STD_SIZE
- Just cap strtab_size to 64

Eric Auger (5):
  hw/arm/smmuv3: Fix off-by-one bug in alignment strtab mask
  hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT
  hw/arm/smmuv3: Fix possible overflow in strtab_base computation
  hw/arm/smmuv3: Check L1STD.SPAN
  hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span

 hw/arm/smmuv3-internal.h |  3 +++
 hw/arm/smmuv3.c          | 32 ++++++++++++++++++++++++++------
 2 files changed, 29 insertions(+), 6 deletions(-)

-- 
2.53.0

On Tue, 7 Jul 2026 at 09:50, Eric Auger <eric.auger@redhat.com> wrote:
>
> The current code fails to sanitize SMMU_S_STRTAB_BASE_CFG
> LOG2SIZE and SPLIT which are used in the STE lookup. This
> could potentially lead to wrong shifts/masks in
> smmu_find_ste() and does not fully comply with the spec.
>
> Also the series fixes different issues related to strtab base
> address alignment computations: off-by-one mask, unchecked span,
> missing L2ptr base address alignment. Those issues
> were not visible because the guest kernel does what it should
> but better comply with the spec.
>
> Best Regards
>
> Eric
>
> This series is available at:
> https://github.com/eauger/qemu/tree/smmu_sanitize_v3
>
> v2 -> v3:
> - Introduced STE_SIZE and L1STD_SIZE
> - Just cap strtab_size to 64



Applied to target-arm.next, thanks.

-- PMM