From: Eric Auger <[email protected]> In the linear stream table mode (FMT = 0), if the guest programs SMMU_STRTAB_BASE_CFG.LOG2SIZE (8 bits) to something bigger than 58, MAKE_64BIT_MASK() will overflow. So cap the mask length to 64. We still comply with the spec ADDR alignment computation:
ADDR[LOG2SIZE + 5:0] = 0. In the 2 level stream table mode (FMT = 1), we don't have this risk anymore since SPLIT is sanitized and equals to 6 at minimum. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632 Signed-off-by: Eric Auger <[email protected]> Reviewed-by: Shameer Kolothum <[email protected]> Message-id: [email protected] Signed-off-by: Peter Maydell <[email protected]> --- hw/arm/smmuv3.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c index c2946d8d23c..3fd1dd7cf81 100644 --- a/hw/arm/smmuv3.c +++ b/hw/arm/smmuv3.c @@ -730,6 +730,7 @@ int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste, SMMUEventInfo *event) addr = l2ptr + l2_ste_offset * sizeof(*ste); } else { strtab_size = log2size + STE_SIZE; + strtab_size = MIN(64, strtab_size); strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK & ~MAKE_64BIT_MASK(0, strtab_size); addr = strtab_base + sid * sizeof(*ste); -- 2.43.0
