From nobody Sun Jul 26 10:46:18 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1783414318; cv=none; d=zohomail.com; s=zohoarc; b=kG70wdnOKkYcTadHNfiqWpdVuI9e3eJBOyDLShxdRpQefZdKwVAcAGKiQFhlWeRMVpEgIOvRj8zullQBTbSuPZpftYLEAwXCfucesgTTRmOsj3ML2EV0VyAiDfjtil30iUEUWocBxfUieAXi+LcGsn0Pywc0B+cHWj+zxvEeLus= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783414318; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=8U2MTWyabXUItvW1t0Lz2PRc6T/C9QiAccFcwCx/YkI=; b=DsTaXm7DMOgD3Tg0C9JDLrWMCtpexZ+zd6HQdU58DR6Uwifj0sepC+T3a9OjoeU/DN+7+frmtF8Cg9NIlhXh/Rc4y3AtLhYgqEIUNrRazl11MlUoo000s0HLZypQwiYzTbk/R2XH1+fHcKZ9b42lVzuxJHOGN+BrpAXtsqxT3ek= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783414318211169.47990928184277; Tue, 7 Jul 2026 01:51:58 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wh1W3-0007hn-Vw; Tue, 07 Jul 2026 04:50:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wh1Vz-0007h1-Hz for qemu-devel@nongnu.org; Tue, 07 Jul 2026 04:50:51 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wh1Vy-0008Gd-6G for qemu-devel@nongnu.org; Tue, 07 Jul 2026 04:50:51 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-374-oW5hyGvhOTK8APObgSO5sw-1; Tue, 07 Jul 2026 04:50:44 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id ABF6918052C9; Tue, 7 Jul 2026 08:50:42 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.50.66]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 8F8541955F71; Tue, 7 Jul 2026 08:50:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783414249; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=8U2MTWyabXUItvW1t0Lz2PRc6T/C9QiAccFcwCx/YkI=; b=hW8yNy83fJTznmpAcqtnDGOEzIKwX1h24a+Yr+worrNZk3pduK0xijJ5OMhm6LvduL/B6x Uo7Aw6vt7vIn+tBYWy2T2Vnm2QAPZyvk/5i7/UTHNXGmg+bpDsVt8iddhpFZpVKxPlzDga K3IOyAHRrqpyMWGims2sR1mvAO2D96Y= X-MC-Unique: oW5hyGvhOTK8APObgSO5sw-1 X-Mimecast-MFC-AGG-ID: oW5hyGvhOTK8APObgSO5sw_1783414242 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com, philmd@oss.qualcomm.com Subject: [PATCH v3 1/5] hw/arm/smmuv3: Fix off-by-one bug in alignment strtab mask Date: Tue, 7 Jul 2026 10:49:33 +0200 Message-ID: <20260707085028.165557-2-eric.auger@redhat.com> In-Reply-To: <20260707085028.165557-1-eric.auger@redhat.com> References: <20260707085028.165557-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1783414320250158500 Content-Type: text/plain; charset="utf-8" The stream table base address needs to be aligned to its size. With FMT =3D=3D 0 (linear stream table), the table size is log2size * STE_SIZE (2^6). So the spec says the base address must have ADDR[LOG2SIZE + 5:0] =3D 0. With FMT =3D=3D 1 (2 level stream table), the table size is (log2size - split) * L1STD_SIZE (2^3) So the spec days the effective base address is aligned by the SMMU to the larger of 64 bytes or the first-level table size: ADDR[MAX(5, (LOG2SIZE - SPLIT - 1 + 3)):0] =3D 0. MAKE_64BIT_MASK() second argument is a size and not a shift, so fix this off-by-one computation. Subsequent patches will fix the risk of overflow in MAKE_64BIT_MASK() Signed-off-by: Eric Auger Reviewed-by: Shameer Kolothum --- hw/arm/smmuv3-internal.h | 3 +++ hw/arm/smmuv3.c | 10 +++++----- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h index eb482c7000f..0819a4b2e8d 100644 --- a/hw/arm/smmuv3-internal.h +++ b/hw/arm/smmuv3-internal.h @@ -359,6 +359,9 @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo = *event); void smmuv3_propagate_event(SMMUv3State *s, Evt *evt); int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *e= vent); =20 +#define STE_SIZE 6 +#define L1STD_SIZE 3 + static inline int oas2bits(int oas_field) { switch (oas_field) { diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 5e5a6a960c9..10c67645a57 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -664,7 +664,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *st= e, SMMUEventInfo *event) { dma_addr_t addr, strtab_base; uint32_t log2size; - int strtab_size_shift; + int strtab_size; int ret; =20 trace_smmuv3_find_ste(sid, s->features, s->sid_split); @@ -685,9 +685,9 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *st= e, SMMUEventInfo *event) * Align strtab base address to table size. For this purpose, assu= me it * is not bounded by SMMU_IDR1_SIDSIZE. */ - strtab_size_shift =3D MAX(5, (int)log2size - s->sid_split - 1 + 3); + strtab_size =3D MAX(6, (int)log2size - s->sid_split + L1STD_SIZE); strtab_base =3D s->strtab_base & SMMU_BASE_ADDR_MASK & - ~MAKE_64BIT_MASK(0, strtab_size_shift); + ~MAKE_64BIT_MASK(0, strtab_size); l1_ste_offset =3D sid >> s->sid_split; l2_ste_offset =3D sid & ((1 << s->sid_split) - 1); l1ptr =3D (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std)= ); @@ -729,9 +729,9 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *st= e, SMMUEventInfo *event) } addr =3D l2ptr + l2_ste_offset * sizeof(*ste); } else { - strtab_size_shift =3D log2size + 5; + strtab_size =3D log2size + STE_SIZE; strtab_base =3D s->strtab_base & SMMU_BASE_ADDR_MASK & - ~MAKE_64BIT_MASK(0, strtab_size_shift); + ~MAKE_64BIT_MASK(0, strtab_size); addr =3D strtab_base + sid * sizeof(*ste); } =20 --=20 2.53.0 From nobody Sun Jul 26 10:46:18 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1783414327; cv=none; d=zohomail.com; s=zohoarc; b=FyjXWe3N/0esoL7d46QMv2z2N3cvI+ZwwFYMTdgNybXxQxMZrZEK6U7yvlE539YuTsDynzwYB9X8T9LqrqMbOCZOD3i9woWlNmSyBYNiACzobTjYq/dFZElNP/1PykCLJXRTJcxzgshf/I7ollWhkowmZf5vPGiuCRImiQIIyRQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783414327; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=8pXUedqGaqjSdjg6vALRkYIP0FPwPiBAZc5IUMI6tOI=; b=G3rzRJmvSSXcT5iCgeGqpX3rIti6NKzif43JLyA7NoQevWYQKYk6fPMcaResrAXhLfp7n/wFgwjTYnnvKjEt9RD1YNXCpxKxeLK86+OSNs5t4YlBIYckhjF7tizVk+QMtuEdnQv1EzkBkiupUS2XReqKVZHuhBNKqKJvQYdRnLY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783414327469885.8020319091902; Tue, 7 Jul 2026 01:52:07 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wh1W7-0007jl-Oz; Tue, 07 Jul 2026 04:50:59 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wh1W4-0007i9-9g for qemu-devel@nongnu.org; Tue, 07 Jul 2026 04:50:58 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wh1W2-0008H7-T8 for qemu-devel@nongnu.org; Tue, 07 Jul 2026 04:50:56 -0400 Received: from mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-80-mWhgRZGOPbCuRBNiSeC0QQ-1; Tue, 07 Jul 2026 04:50:49 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 87FEF1801326; Tue, 7 Jul 2026 08:50:47 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.50.66]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 538DA1955F71; Tue, 7 Jul 2026 08:50:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783414254; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=8pXUedqGaqjSdjg6vALRkYIP0FPwPiBAZc5IUMI6tOI=; b=VeVuFRiG9CPdwuJTGn3GdoAeTrotYZYJOgEZoDZ0zCkFhaW18Kt2MYfN8Hx2OE4oBxrgk7 4EvIu0kwpFu2UYUIEyEvA7ntMfg4DbOHQqXkMcxi1F61YXNIxJintFdCe965offNfD9FSt ZrIIHy4zR1pbpMXeAsocqx6t0ErSstI= X-MC-Unique: mWhgRZGOPbCuRBNiSeC0QQ-1 X-Mimecast-MFC-AGG-ID: mWhgRZGOPbCuRBNiSeC0QQ_1783414247 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com, philmd@oss.qualcomm.com Subject: [PATCH v3 2/5] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT Date: Tue, 7 Jul 2026 10:49:34 +0200 Message-ID: <20260707085028.165557-3-eric.auger@redhat.com> In-Reply-To: <20260707085028.165557-1-eric.auger@redhat.com> References: <20260707085028.165557-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=unavailable autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1783414328384158500 Content-Type: text/plain; charset="utf-8" Currently the guest value for the SPLIT field is not checked. Also the spec says that values different from 6, 8, 10, respectively meaning 4KB, 16kB and 64kB leaf tables are reserved and behave as 6. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632 Signed-off-by: Eric Auger Reviewed-by: Shameer Kolothum --- hw/arm/smmuv3.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 10c67645a57..c2946d8d23c 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -1688,6 +1688,13 @@ static MemTxResult smmu_writel(SMMUv3State *s, hwadd= r offset, s->strtab_base_cfg =3D data; if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) =3D=3D 1) { s->sid_split =3D FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT); + if (s->sid_split !=3D 6 && s->sid_split !=3D 8 && s->sid_split= !=3D 10) { + /* Other values are reserved, behave as 6 */ + qemu_log_mask(LOG_GUEST_ERROR, + "Invalid STRTAB_BASE_CFG.SPLIT=3D%u, use 6 i= nstead\n", + s->sid_split); + s->sid_split =3D 6; + } s->features |=3D SMMU_FEATURE_2LVL_STE; } break; --=20 2.53.0 From nobody Sun Jul 26 10:46:18 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1783414317; cv=none; d=zohomail.com; s=zohoarc; b=RosPpszQ18OIfBYtjRI2whHt1tfwsU/s5y60DNaul7ke4WlV87mBLs5KtbsGtrLpxlSDtiOjBiA1ruZU/OA/ttRQXooeWk5f+E5TdeKMD3b1jGQNPjT9DYwU6BFj8Q64V9RXOTX4hvUJTG2Mfb+Vw8QU08zDslCBiEw8NHzXLG4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783414317; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=FUxLKvQrjXBoERFnuq4rILmrrAKQKBPsHkbH7TgG2Dc=; b=nwt9uzwqOuBrUT8qQeKv3T09ggwvV8M5AcV3hSfrZadaBM6mIch0vzMSTZP61AjlLxtxeKMkuuwWTUVfsE9og4awtv177LqNB3zeT9eIDRUnX04qfORJCyQ5kdaX0swb5ONr0R0y+ID91Xa+0lLWMZi/1qaPV/J9LrairEaRD1w= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783414317491434.06377639467075; Tue, 7 Jul 2026 01:51:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wh1W9-0007k2-6C; Tue, 07 Jul 2026 04:51:01 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wh1W7-0007iv-8s for qemu-devel@nongnu.org; Tue, 07 Jul 2026 04:50:59 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wh1W5-0008HG-S9 for qemu-devel@nongnu.org; Tue, 07 Jul 2026 04:50:59 -0400 Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-208-FiE92qxEPK6OHxuN392xZQ-1; Tue, 07 Jul 2026 04:50:54 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 6931A1955D57; Tue, 7 Jul 2026 08:50:52 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.50.66]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 1FCEB1955F71; Tue, 7 Jul 2026 08:50:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783414257; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=FUxLKvQrjXBoERFnuq4rILmrrAKQKBPsHkbH7TgG2Dc=; b=KrcpEpHPxBjqwTqkW+pjbVSReGMTDQV3eTuiCkV0zBY9+v2HI7kAnwWZ1dF9yJXPQn6qBY FKOTaZP3pN+c3qaberBqT6K1mjUT0PotZn7tfKCUoYPWosTZz6aTxu4CVCJ/nQScFuONcs pce+8rG70zizffNKFvrw3wrYVX7RzPk= X-MC-Unique: FiE92qxEPK6OHxuN392xZQ-1 X-Mimecast-MFC-AGG-ID: FiE92qxEPK6OHxuN392xZQ_1783414252 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com, philmd@oss.qualcomm.com Subject: [PATCH v3 3/5] hw/arm/smmuv3: Fix possible overflow in strtab_base computation Date: Tue, 7 Jul 2026 10:49:35 +0200 Message-ID: <20260707085028.165557-4-eric.auger@redhat.com> In-Reply-To: <20260707085028.165557-1-eric.auger@redhat.com> References: <20260707085028.165557-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1783414319076158500 Content-Type: text/plain; charset="utf-8" In the linear stream table mode (FMT =3D 0), if the guest programs SMMU_STRTAB_BASE_CFG.LOG2SIZE (8 bits) to something bigger than 58, MAKE_64BIT_MASK() will overflow. So cap the mask length to 64. We still comply with the spec ADDR alignment computation: ADDR[LOG2SIZE + 5:0] =3D 0. In the 2 level stream table mode (FMT =3D 1), we don't have this risk anymore since SPLIT is sanitized and equals to 6 at minimum. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632 Signed-off-by: Eric Auger Reviewed-by: Shameer Kolothum --- hw/arm/smmuv3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index c2946d8d23c..3fd1dd7cf81 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -730,6 +730,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *st= e, SMMUEventInfo *event) addr =3D l2ptr + l2_ste_offset * sizeof(*ste); } else { strtab_size =3D log2size + STE_SIZE; + strtab_size =3D MIN(64, strtab_size); strtab_base =3D s->strtab_base & SMMU_BASE_ADDR_MASK & ~MAKE_64BIT_MASK(0, strtab_size); addr =3D strtab_base + sid * sizeof(*ste); --=20 2.53.0 From nobody Sun Jul 26 10:46:18 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1783414317; cv=none; d=zohomail.com; s=zohoarc; b=UPLWvR/2Rk1bPQykgkvHfcy0LTfyHlcLP7LCYTW/Y/Wx6VZBbPJQVlOs1aSepPux4i8l1ahhbek+ICeRj8CwNYeGfvwUIvACeU/lobTGoYvxnwaI0hatvfHTGY9oY/lKKmKMMQ+T3WaS4JXTdYTR4S1DGFsXKYU4Tf9k9fVT2Co= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783414317; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=GArge4nBUIHQBCTyEQ7SLnI00I48011MgF5jQ6ASM+0=; b=UKiFMMFs6z/udrnjdJvn1giLxMGeolzRZxNN3GurAtKo5eI7CdG14SLm7VURMtoAJlxDLEoYcmslJkpwNAeEZwE/GzzxYxzWbqRzezKyl9AMiL+g2XL8gwuoWO7vB/4D6rETgKdZrGZpg8RTo0096vw9FBVcXMSy++62VDLk9C8= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783414317949499.35491570017734; Tue, 7 Jul 2026 01:51:57 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wh1WD-0007lW-0u; Tue, 07 Jul 2026 04:51:05 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wh1WB-0007kf-H0 for qemu-devel@nongnu.org; Tue, 07 Jul 2026 04:51:03 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wh1WA-0008Hd-7c for qemu-devel@nongnu.org; Tue, 07 Jul 2026 04:51:03 -0400 Received: from mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (ec2-35-165-154-97.us-west-2.compute.amazonaws.com [35.165.154.97]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-587-L12lPRrfMqC3mV3lIhOwkA-1; Tue, 07 Jul 2026 04:50:58 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-08.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 14D181805C28; Tue, 7 Jul 2026 08:50:57 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.50.66]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 208F11955F71; Tue, 7 Jul 2026 08:50:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783414261; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=GArge4nBUIHQBCTyEQ7SLnI00I48011MgF5jQ6ASM+0=; b=ONwL6lIbygxad0VzqG4fn+2qpUIYP+lQex4jI3FrDaG8ml0d7ZCCMs2Qri5q2L5CKkFTUJ pQSee05MgbVfsJstt0kDbJRjgIae+W6X4gPU7pwThY2+NbHrEqzlYDiAxqZkQ47dSgXemz oYhDxqgFlhaGnWvUc4lfAnipLdXjlR0= X-MC-Unique: L12lPRrfMqC3mV3lIhOwkA-1 X-Mimecast-MFC-AGG-ID: L12lPRrfMqC3mV3lIhOwkA_1783414257 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com, philmd@oss.qualcomm.com Subject: [PATCH v3 4/5] hw/arm/smmuv3: Check L1STD.SPAN Date: Tue, 7 Jul 2026 10:49:36 +0200 Message-ID: <20260707085028.165557-5-eric.auger@redhat.com> In-Reply-To: <20260707085028.165557-1-eric.auger@redhat.com> References: <20260707085028.165557-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -24 X-Spam_score: -2.5 X-Spam_bar: -- X-Spam_report: (-2.5 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1783414320240158500 Content-Type: text/plain; charset="utf-8" Span values above 11 are reserved and behave as 0. Also span must be within the range of 0 to (SMMU_STRTAB_BASE_CFG.SPLIT + 1), ie. it must stay within the bounds of the stream table split point. Signed-off-by: Eric Auger Reviewed-by: Shameer Kolothum --- hw/arm/smmuv3.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 3fd1dd7cf81..9008ba7acd9 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -707,7 +707,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *st= e, SMMUEventInfo *event) =20 span =3D L1STD_SPAN(&l1std); =20 - if (!span) { + if (!span || span > 11) { /* l2ptr is not valid */ if (!event->inval_ste_allowed) { qemu_log_mask(LOG_GUEST_ERROR, @@ -716,6 +716,16 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *s= te, SMMUEventInfo *event) event->type =3D SMMU_EVT_C_BAD_STREAMID; return -EINVAL; } + + if (span > s->sid_split + 1) { + if (!event->inval_ste_allowed) { + qemu_log_mask(LOG_GUEST_ERROR, + "invalid span (0x%x)\n", span); + } + event->type =3D SMMU_EVT_C_BAD_STREAMID; + return -EINVAL; + } + max_l2_ste =3D (1 << span) - 1; l2ptr =3D l1std_l2ptr(&l1std); trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset, --=20 2.53.0 From nobody Sun Jul 26 10:46:18 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=quarantine dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1783414346; cv=none; d=zohomail.com; s=zohoarc; b=ItjHP90uvtkJrddS+i9UuqnJWYh9l7v+9IU3hbaZhEE/NI2cN4W29UYUW/qpdfYrwKkuxJTlwfWLGh16m5v2dcNMMX1X92vOy23mron2y6QyTsiGLlWJR+Cp0vqo52FliQxlJqwBqK233A6KOoyA1tUowfMRE0oE0sm67GVaiUU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1783414346; h=Content-Transfer-Encoding:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To:Cc; bh=a3g39iA4JS+k1lNGQjwNZM9Rju1IJm0KAcBPwoXoYLc=; b=HJXiNnSuUVMv0+m6zF2q5EWdkHYKbrXguCHqJOAEMQO/P20SnVtu4UK1SNr/AIAXG2wiVzS2VFEF+oxKsDC168fuZSgureK+iuim98x791NF2phs03enRtSsriQq3SAF2EHtw9rBkTol09WBlilRaPPy7kqfA1fuEWOuu6JIZ1M= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1783414346369649.9197222989515; Tue, 7 Jul 2026 01:52:26 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wh1WK-0007ng-Gu; Tue, 07 Jul 2026 04:51:12 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wh1WI-0007me-B1 for qemu-devel@nongnu.org; Tue, 07 Jul 2026 04:51:10 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wh1WH-0008I7-1F for qemu-devel@nongnu.org; Tue, 07 Jul 2026 04:51:10 -0400 Received: from mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-611-7S0e4_HDNjKkyzA3mbu8LQ-1; Tue, 07 Jul 2026 04:51:03 -0400 Received: from mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id AD4721954B21; Tue, 7 Jul 2026 08:51:01 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.50.66]) by mx-prod-int-05.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id A61201955F71; Tue, 7 Jul 2026 08:50:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1783414268; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=a3g39iA4JS+k1lNGQjwNZM9Rju1IJm0KAcBPwoXoYLc=; b=OVSjzSey3eDz1pfjTcVfnTFp1LFlB/BAUXsupLjEc22rhm+MUPNlzsI01DbWWraSLz0DAV Lt7SBJReehQpf2tRoCFcQBocbFNt99yTmEewu8p+lLDn3tWJVEg/p6or7CzYYAxJirWSke VfTP4uj1WnVwbt6T4bF/eDjE4bB/eA4= X-MC-Unique: 7S0e4_HDNjKkyzA3mbu8LQ-1 X-Mimecast-MFC-AGG-ID: 7S0e4_HDNjKkyzA3mbu8LQ_1783414261 From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com, philmd@oss.qualcomm.com Subject: [PATCH v3 5/5] hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span Date: Tue, 7 Jul 2026 10:49:37 +0200 Message-ID: <20260707085028.165557-6-eric.auger@redhat.com> In-Reply-To: <20260707085028.165557-1-eric.auger@redhat.com> References: <20260707085028.165557-1-eric.auger@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.0 on 10.30.177.17 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1783414348521158500 Content-Type: text/plain; charset="utf-8" Spec says: Bits L2Ptr[N:0] are treated as 0 by the SMMU, where N =3D=3D 5 + (Span - 1). Let's enforce this alignment. Signed-off-by: Eric Auger Reviewed-by: Shameer Kolothum --- hw/arm/smmuv3.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 9008ba7acd9..ed19536a4dc 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -728,6 +728,8 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *st= e, SMMUEventInfo *event) =20 max_l2_ste =3D (1 << span) - 1; l2ptr =3D l1std_l2ptr(&l1std); + + l2ptr &=3D ~MAKE_64BIT_MASK(0, 6 + (span - 1)); trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset, l2ptr, l2_ste_offset, max_l2_ste); if (l2_ste_offset > max_l2_ste) { --=20 2.53.0