friedkiwi/qemu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT

Browse Source 
Currently the guest value for the SPLIT field is not checked.
Also the spec says that values different from 6, 8, 10, respectively
meaning 4KB, 16kB and 64kB leaf tables are reserved and behave as 6.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Message-id: 20260707085028.165557-3-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
This commit is contained in:
Eric Auger
2026-07-13 12:34:16 +01:00
committed by Peter Maydell
parent ad693ac92b
commit ab918cc278
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
hw/arm/smmuv3.c
View File

@@ -1688,6 +1688,13 @@ static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
s->strtab_base_cfg = data;
if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
if (s->sid_split != 6 && s->sid_split != 8 && s->sid_split != 10) {
/* Other values are reserved, behave as 6 */
qemu_log_mask(LOG_GUEST_ERROR,
"Invalid STRTAB_BASE_CFG.SPLIT=%u, use 6 instead\n",
s->sid_split);
s->sid_split = 6;
}
s->features |= SMMU_FEATURE_2LVL_STE;
}
break;