diff options
| author | Mostafa Saleh <smostafa@google.com> | 2024-07-15 08:45:01 +0000 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2024-07-18 13:49:29 +0100 |
| commit | bde809f05f66b4be4475ffa9819d82a01686d1c7 (patch) | |
| tree | d0c848ec8eadcd8ddc1ed27856e220e2b344d6a1 | |
| parent | 345acc443905eda8008a1d328dd89b73c4a3f89e (diff) | |
| download | qemu-bde809f05f66b4be4475ffa9819d82a01686d1c7.zip qemu-bde809f05f66b4be4475ffa9819d82a01686d1c7.tar.gz qemu-bde809f05f66b4be4475ffa9819d82a01686d1c7.tar.bz2 | |
hw/arm/smmu-common: Add missing size check for stage-1
According to the SMMU architecture specification (ARM IHI 0070 F.b),
in “3.4 Address sizes”
The address output from the translation causes a stage 1 Address Size
fault if it exceeds the range of the effective IPA size for the given CD.
However, this check was missing.
There is already a similar check for stage-2 against effective PA.
Reviewed-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Message-id: 20240715084519.1189624-2-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | hw/arm/smmu-common.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c index b6601cc..e81b684 100644 --- a/hw/arm/smmu-common.c +++ b/hw/arm/smmu-common.c @@ -381,6 +381,16 @@ static int smmu_ptw_64_s1(SMMUTransCfg *cfg, goto error; } + /* + * The address output from the translation causes a stage 1 Address + * Size fault if it exceeds the range of the effective IPA size for + * the given CD. + */ + if (gpa >= (1ULL << cfg->oas)) { + info->type = SMMU_PTW_ERR_ADDR_SIZE; + goto error; + } + tlbe->entry.translated_addr = gpa; tlbe->entry.iova = iova & ~mask; tlbe->entry.addr_mask = mask; |