The current code fails to sanitize SMMU_S_STRTAB_BASE_CFG LOG2SIZE and SPLIT which are used in the STE lookup. This could potentially lead to wrong shifts/masks in smmu_find_ste() and does not fully comply with the spec.
Also the series fixes different issues related to strtab base address alignment computations: off-by-one mask, unchecked span, missing L2ptr base address alignment. Those issues were not visible because the guest kernel does what it should but better comply with the spec. Best Regards Eric This series is available at: https://github.com/eauger/qemu/tree/smmu_sanitize_v3 v2 -> v3: - Introduced STE_SIZE and L1STD_SIZE - Just cap strtab_size to 64 Eric Auger (5): hw/arm/smmuv3: Fix off-by-one bug in alignment strtab mask hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT hw/arm/smmuv3: Fix possible overflow in strtab_base computation hw/arm/smmuv3: Check L1STD.SPAN hw/arm/smmuv3: Enforce alignment of L2Ptr according to the span hw/arm/smmuv3-internal.h | 3 +++ hw/arm/smmuv3.c | 32 ++++++++++++++++++++++++++------ 2 files changed, 29 insertions(+), 6 deletions(-) -- 2.53.0
