Currently the guest value for the SPLIT field is not checked. Also the spec says that values different from 6, 8, 10, respectively meaning 4KB, 16kB and 64kB leaf tables are reserved and behave as 6.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632 Signed-off-by: Eric Auger <[email protected]> Reviewed-by: Shameer Kolothum <[email protected]> --- hw/arm/smmuv3.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index 38aba9c0af9..285e6164a07 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -1688,6 +1688,13 @@ static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset, s->strtab_base_cfg = data; if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) { s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT); + if (s->sid_split != 6 && s->sid_split != 8 && s->sid_split != 10) { + /* Other values are reserved, behave as 6 */ + qemu_log_mask(LOG_GUEST_ERROR, + "Invalid STRTAB_BASE_CFG.SPLIT=%u, use 6 instead\n", + s->sid_split); + s->sid_split = 6; + } s->features |= SMMU_FEATURE_2LVL_STE; } break; -- 2.53.0
