hw/riscv/riscv-iommu.c: check reserved MSI PTE basic bits
We need to throw an MSI_MISCONFIGURED error when any of the reserved PTE bits (first doubleword only) are set. Fixes: Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3563 Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Reviewed-by: Nutty Liu <nutty.liu@hotmail.com> Message-ID: <20260629125719.679626-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Daniel Henrique Barboza committed
Jun 29, 2026 at 09:57 UTC
11486349ad9b8858d3f45a540fd48b7a15b2b61d
1 file changed
+21
hw/riscv/riscv-iommu.c
+21
@@ -677,6 +677,27 @@ static MemTxResult riscv_iommu_msi_write(RISCVIOMMUState *s,
677
678
switch (get_field(pte[0], RISCV_IOMMU_MSI_PTE_M)) {
679
case RISCV_IOMMU_MSI_PTE_M_BASIC:
680
+ /*
681
+ * riscv-iommu spec MSI PTE basic translate mode:
682
+ * "When an MSI PTE has fields V = 1, C = 0, and M = 3
683
+ * (basic translate mode), the PTE's complete format is:
684
+ * First doubleword: bit 63 C, = 0
685
+ * bits 53:10 PPN
686
+ * bits 2:1 M, = 3
687
+ * bit 0 V, = 1
688
+ * All other bits of the first doubleword are reserved
689
+ * and must be set to zeros by software. The second
690
+ * doubleword is ignored by an IOMMU so is free for
691
+ * software to use."
692
+ *
693
+ * In other words, bits 62:54 and 9:3 of pte[0] are reserved.
694
+ */
695
+ if (pte[0] & (GENMASK_ULL(62, 54) | GENMASK_ULL(9, 3))) {
696
+ res = MEMTX_DECODE_ERROR;
697
+ cause = RISCV_IOMMU_FQ_CAUSE_MSI_MISCONFIGURED;
698
+ goto err;
699
+ }
700
+
701
/* MSI Pass-through mode */
702
addr = PPN_PHYS(get_field(pte[0], RISCV_IOMMU_MSI_PTE_PPN));
703