> -----Original Message-----
> From: Eric Auger <[email protected]>
> Sent: 01 July 2026 10:12
> To: [email protected]; [email protected]; qemu-
> [email protected]; [email protected]; [email protected];
> [email protected]; Shameer Kolothum Thodi
> <[email protected]>; Nicolin Chen <[email protected]>; Nathan
> Chen <[email protected]>
> Subject: [PATCH v2 4/5] hw/arm/smmuv3: Check L1STD.SPAN
>
> External email: Use caution opening links or attachments
>
>
> Span values above 11 are reserved and behave as 0.
>
> Also span must be within the range of 0 to (SMMU_STRTAB_BASE_CFG.SPLIT
> + 1),
> ie. it must stay within the bounds of the stream table split point.
>
> Signed-off-by: Eric Auger <[email protected]>
Reviewed-by: Shameer Kolothum <[email protected]>
Thanks,
Shameer
> ---
> hw/arm/smmuv3.c | 12 +++++++++++-
> 1 file changed, 11 insertions(+), 1 deletion(-)
>
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index 5ec3700d0d5..f694f832598 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -707,7 +707,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid,
> STE *ste, SMMUEventInfo *event)
>
> span = L1STD_SPAN(&l1std);
>
> - if (!span) {
> + if (!span || span > 11) {
> /* l2ptr is not valid */
> if (!event->inval_ste_allowed) {
> qemu_log_mask(LOG_GUEST_ERROR,
> @@ -716,6 +716,16 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid,
> STE *ste, SMMUEventInfo *event)
> event->type = SMMU_EVT_C_BAD_STREAMID;
> return -EINVAL;
> }
> +
> + if (span > s->sid_split + 1) {
> + if (!event->inval_ste_allowed) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "invalid span (0x%x)\n", span);
> + }
> + event->type = SMMU_EVT_C_BAD_STREAMID;
> + return -EINVAL;
> + }
> +
> max_l2_ste = (1 << span) - 1;
> l2ptr = l1std_l2ptr(&l1std);
> trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
> --
> 2.53.0
