| Message ID | 1575467748-28898-3-git-send-email-sveith@amazon.de |
|---|---|
| State | New |
| Headers | show |
| Series | hw/arm/smmuv3: Correct stream ID and event address handling | expand |
Hi Simon, On 12/4/19 2:55 PM, Simon Veith wrote: > When checking whether a stream ID is in range of the stream table, we > have so far been only checking it against our implementation limit > (SMMU_IDR1_SIDSIZE). However, the guest can program the > STRTAB_BASE_CFG.LOG2SIZE field to a size that is smaller than this > limit. > > Check the stream ID against this limit as well to match the hardware > behavior of raising C_BAD_STREAMID events in case the limit is exceeded. > > ref. ARM IHI 0070C, section 6.3.24. > > Signed-off-by: Simon Veith <sveith@amazon.de> > Cc: Eric Auger <eric.auger@redhat.com> > Cc: qemu-devel@nongnu.org > Cc: qemu-arm@nongnu.org > --- > hw/arm/smmuv3.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c > index eef9a18..aad4639 100644 > --- a/hw/arm/smmuv3.c > +++ b/hw/arm/smmuv3.c > @@ -377,11 +377,15 @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, > SMMUEventInfo *event) > { > dma_addr_t addr; > + uint32_t log2size; > int ret; > > trace_smmuv3_find_ste(sid, s->features, s->sid_split); > - /* Check SID range */ > - if (sid > (1 << SMMU_IDR1_SIDSIZE)) { > + log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE); > + /* > + * Check SID range against both guest-configured and implementation limits > + */ > + if (sid > (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) {I think this should be sid >= (1 << MIN(log2size, SMMU_IDR1_SIDSIZE)) If you agree can you fix it at the same time? > event->type = SMMU_EVT_C_BAD_STREAMID; > return -EINVAL; > } > Thanks Eric
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index eef9a18..aad4639 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -377,11 +377,15 @@ static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event) { dma_addr_t addr; + uint32_t log2size; int ret; trace_smmuv3_find_ste(sid, s->features, s->sid_split); - /* Check SID range */ - if (sid > (1 << SMMU_IDR1_SIDSIZE)) { + log2size = FIELD_EX32(s->strtab_base_cfg, STRTAB_BASE_CFG, LOG2SIZE); + /* + * Check SID range against both guest-configured and implementation limits + */ + if (sid > (1 << MIN(log2size, SMMU_IDR1_SIDSIZE))) { event->type = SMMU_EVT_C_BAD_STREAMID; return -EINVAL; }
When checking whether a stream ID is in range of the stream table, we have so far been only checking it against our implementation limit (SMMU_IDR1_SIDSIZE). However, the guest can program the STRTAB_BASE_CFG.LOG2SIZE field to a size that is smaller than this limit. Check the stream ID against this limit as well to match the hardware behavior of raising C_BAD_STREAMID events in case the limit is exceeded. ref. ARM IHI 0070C, section 6.3.24. Signed-off-by: Simon Veith <sveith@amazon.de> Cc: Eric Auger <eric.auger@redhat.com> Cc: qemu-devel@nongnu.org Cc: qemu-arm@nongnu.org --- hw/arm/smmuv3.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)