hw/riscv/riscv-iommu: check DC.TC reserved bits
We are not checking for reserved TC bits being set during device context validation. Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3548 Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260627194640.4130073-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Daniel Henrique Barboza committed
Jun 27, 2026 at 16:46 UTC
13c2fc34f18491c7b74451cc64e91139bc5db272
2 files changed
+7
hw/riscv/riscv-iommu-bits.h
+3
@@ -308,6 +308,9 @@ struct riscv_iommu_dc {
308
#define RISCV_IOMMU_DC_IOHGATP_GSCID GENMASK_ULL(59, 44)
309
#define RISCV_IOMMU_DC_IOHGATP_MODE RISCV_IOMMU_ATP_MODE_FIELD
310
311
+#define RISCV_IOMMU_DC_TC_RESERVED (GENMASK_ULL(23, 12) \
312
+ | GENMASK_ULL(63, 32))
313
+
314
enum riscv_iommu_dc_iohgatp_modes {
315
RISCV_IOMMU_DC_IOHGATP_MODE_BARE = 0,
316
RISCV_IOMMU_DC_IOHGATP_MODE_SV32X4 = 8,
hw/riscv/riscv-iommu.c
+4
@@ -752,6 +752,10 @@ static bool riscv_iommu_validate_device_ctx(RISCVIOMMUState *s,
752
uint32_t fsc_mode, msi_mode;
753
uint64_t gatp;
754
755
+ if (ctx->tc & RISCV_IOMMU_DC_TC_RESERVED) {
756
+ return false;
757
+ }
758
+
759
if (!(s->cap & RISCV_IOMMU_CAP_ATS) &&
760
(ctx->tc & RISCV_IOMMU_DC_TC_EN_ATS ||
761
ctx->tc & RISCV_IOMMU_DC_TC_EN_PRI ||