Re: [PATCH 2/2] hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.LOG2SIZE

[Eric Auger <eric.auger@redhat.com>]

On 6/30/26 11:18 AM, Daniel P. Berrangé wrote:
> On Tue, Jun 30, 2026 at 10:30:20AM +0200, Eric Auger wrote:
>> STRTAB_BASE_CFG.LOG2SIZE is programmed by the guest through the
>> emulated SMMUv3 MMIO register interface. Currently the value is
>> not checked.
>>
>> The SMMU spec says: "Except for readback of a written value, the
>> effective LOG2SIZE is <= SMMU_IDR1.SIDSIZE for the purposes of
>> input StreamID range checking and upper/lower/linear Stream table
>> index address calculation."
>>
>> So for STE lookup make sure log2size is capped at SMMU_IDR1.SIDSIZE.
>>
>> Signed-off-by: Eric Auger <eric.auger@redhat.com>
>> ---
>>  hw/arm/smmuv3.c | 9 +++++++++
>>  1 file changed, 9 insertions(+)
> Can you add the "Resolves: bug URL" to the commit message so it
> gets auto-closed on merge.

sure. Thanks for the hint

Eric
>
>> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
>> index 0a8d2fbb6a7..db5aca26ec0 100644
>> --- a/hw/arm/smmuv3.c
>> +++ b/hw/arm/smmuv3.c
>> @@ -672,6 +672,15 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event)
>>      /*
>>       * Check SID range against both guest-configured and implementation limits
>>       */
>> +    if (log2size > SMMU_IDR1_SIDSIZE) {
>> +        /*
>> +         * spec says: Except for readback of a written value, the effective
>> +         * LOG2SIZE is <= SMMU_IDR1.SIDSIZE for the purposes of input StreamID
>> +         * range checking and upper/lower/linear Stream table index address
>> +         * calculation.
>> +         */
>> +        log2size = SMMU_IDR1_SIDSIZE;
>> +    }
>>      if (sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {
>>          event->type = SMMU_EVT_C_BAD_STREAMID;
>>          return -EINVAL;
>> -- 
>> 2.53.0
>>
> With regards,
> Daniel