[PATCH 2/2] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.LOG2SIZE

[Eric Auger <eric.auger@redhat.com>]

STRTAB_BASE_CFG.LOG2SIZE is programmed by the guest through the
emulated SMMUv3 MMIO register interface. Currently the value is
not checked.

The SMMU spec says: "Except for readback of a written value, the
effective LOG2SIZE is <= SMMU_IDR1.SIDSIZE for the purposes of
input StreamID range checking and upper/lower/linear Stream table
index address calculation."

So for STE lookup make sure log2size is capped at SMMU_IDR1.SIDSIZE.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
---
 hw/arm/smmuv3.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 0a8d2fbb6a7..db5aca26ec0 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -672,6 +672,15 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
     /*
      * Check SID range against both guest-configured and implementation limits
      */
+    if (log2size > SMMU_IDR1_SIDSIZE) {
+        /*
+         * spec says: Except for readback of a written value, the effective
+         * LOG2SIZE is <= SMMU_IDR1.SIDSIZE for the purposes of input StreamID
+         * range checking and upper/lower/linear Stream table index address
+         * calculation.
+         */
+        log2size = SMMU_IDR1_SIDSIZE;
+    }
     if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {
         event->type = SMMU_EVT_C_BAD_STREAMID;
         return -EINVAL;
-- 
2.53.0