On Mon, Jul 01, 2024 at 11:02:23AM +0000, Mostafa Saleh wrote:
> According to the SMMU architecture specification (ARM IHI 0070 F.b),
> in “3.4 Address sizes”
> The address output from the translation causes a stage 1 Address Size
> fault if it exceeds the range of the effective IPA size for the given CD.
>
> However, this check was missing.
>
> There is already a similar check for stage-2 against effective PA.
>
> Reviewed-by: Eric Auger <eric.au...@redhat.com>
> Signed-off-by: Mostafa Saleh <smost...@google.com>
Reviewed-by: Jean-Philippe Brucker <jean-phili...@linaro.org>
> ---
> hw/arm/smmu-common.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
> index 1ce706bf94..eb2356bc35 100644
> --- a/hw/arm/smmu-common.c
> +++ b/hw/arm/smmu-common.c
> @@ -381,6 +381,16 @@ static int smmu_ptw_64_s1(SMMUTransCfg *cfg,
> goto error;
> }
>
> + /*
> + * The address output from the translation causes a stage 1 Address
> + * Size fault if it exceeds the range of the effective IPA size for
> + * the given CD.
> + */
> + if (gpa >= (1ULL << cfg->oas)) {
> + info->type = SMMU_PTW_ERR_ADDR_SIZE;
> + goto error;
> + }
> +
> tlbe->entry.translated_addr = gpa;
> tlbe->entry.iova = iova & ~mask;
> tlbe->entry.addr_mask = mask;
> --
> 2.45.2.803.g4e1b14247a-goog
>
