From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0FB27C43602 for ; Wed, 1 Jul 2026 09:16:49 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wer0D-00014L-1c; Wed, 01 Jul 2026 05:13:09 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqzf-0000qb-Fb for qemu-arm@nongnu.org; Wed, 01 Jul 2026 05:12:34 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1weqzd-0007Lv-81 for qemu-arm@nongnu.org; Wed, 01 Jul 2026 05:12:30 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1782897148; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=I7HeEaZfUnANcE9Fkz/SCoaMXVCKDowNd0wSbY9G/+Y=; b=Z1xc2A8cfHi7J7N+mHUPCB5+JToOMdkSwOmsmBSfePIWfNI9u0c3J53ZX9n3CP8Vh4wYYg +QIV8M0t79wZWSsx14o7A7AhtMvQk0TXhodf4FZssmd1jaZ1dYBmprirMziT41w3ByF0Nf XmN6kNXxpxiowCO17epU6HZohf0QRs8= Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-554-xg6NS3GKMrqxs9HAEjMuBQ-1; Wed, 01 Jul 2026 05:12:25 -0400 X-MC-Unique: xg6NS3GKMrqxs9HAEjMuBQ-1 X-Mimecast-MFC-AGG-ID: xg6NS3GKMrqxs9HAEjMuBQ_1782897144 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 08AA918E6A51; Wed, 1 Jul 2026 09:12:24 +0000 (UTC) Received: from laptop.redhat.com (unknown [10.44.33.117]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id 01FE31800586; Wed, 1 Jul 2026 09:12:20 +0000 (UTC) From: Eric Auger To: eric.auger.pro@gmail.com, eric.auger@redhat.com, qemu-devel@nongnu.org, qemu-arm@nongnu.org, peter.maydell@linaro.org, berrange@redhat.com, skolothumtho@nvidia.com, nicolinc@nvidia.com, nathanc@nvidia.com Subject: [PATCH v2 2/5] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT Date: Wed, 1 Jul 2026 11:11:39 +0200 Message-ID: <20260701091209.2860306-3-eric.auger@redhat.com> In-Reply-To: <20260701091209.2860306-1-eric.auger@redhat.com> References: <20260701091209.2860306-1-eric.auger@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 X-Mimecast-MFC-PROC-ID: cEhlrdsW6xsFHWZEnd54nhDFu0WNtJgPLfut2lT6jLw_1782897144 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: 8bit content-type: text/plain; charset="US-ASCII"; x-default=true Received-SPF: pass client-ip=170.10.133.124; envelope-from=eric.auger@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: 8 X-Spam_score: 0.8 X-Spam_bar: / X-Spam_report: (0.8 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.445, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_SBL_CSS=3.335, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=no autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-arm@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-arm-bounces+qemu-arm=archiver.kernel.org@nongnu.org Sender: qemu-arm-bounces+qemu-arm=archiver.kernel.org@nongnu.org Currently the guest value for the SPLIT field is not checked. Also the spec says that values different from 6, 8, 10, respectively meaning 4KB, 16kB and 64kB leaf tables are reserved and behave as 6. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632 Signed-off-by: Eric Auger Reviewed-by: Shameer Kolothum --- hw/arm/smmuv3.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 38aba9c0af9..285e6164a07 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -1688,6 +1688,13 @@ static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset, s->strtab_base_cfg = data; if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) { s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT); + if (s->sid_split != 6 && s->sid_split != 8 && s->sid_split != 10) { + /* Other values are reserved, behave as 6 */ + qemu_log_mask(LOG_GUEST_ERROR, + "Invalid STRTAB_BASE_CFG.SPLIT=%u, use 6 instead\n", + s->sid_split); + s->sid_split = 6; + } s->features |= SMMU_FEATURE_2LVL_STE; } break; -- 2.53.0