hw/arm/smmuv3: Sanitize SMMU_S_STRTAB_BASE_CFG.SPLIT
Currently the guest value for the SPLIT field is not checked. Also the spec says that values different from 6, 8, 10, respectively meaning 4KB, 16kB and 64kB leaf tables are reserved and behave as 6. Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3632 Signed-off-by: Eric Auger <eric.auger@redhat.com> Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com> Message-id: 20260707085028.165557-3-eric.auger@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Eric Auger committed
Jul 13, 2026 at 12:34 UTC
ab918cc278c6d30210ff37dc815a90966d00c5e2
1 file changed
+7
hw/arm/smmuv3.c
+7
@@ -1688,6 +1688,13 @@ static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
1688
s->strtab_base_cfg = data;
1689
if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
1690
s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
1691
+ if (s->sid_split != 6 && s->sid_split != 8 && s->sid_split != 10) {
1692
+ /* Other values are reserved, behave as 6 */
1693
+ qemu_log_mask(LOG_GUEST_ERROR,
1694
+ "Invalid STRTAB_BASE_CFG.SPLIT=%u, use 6 instead\n",
1695
+ s->sid_split);
1696
+ s->sid_split = 6;
1697
+ }
1698
s->features |= SMMU_FEATURE_2LVL_STE;
1699
}
1700
break;