hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set
We're not setting RISCV_IOMMU_CQCSR_CMD_ILL if a reserved bit happens to be set in an IOFENCE.C command. Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3575 Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260626170533.3562484-1-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Daniel Henrique Barboza committed
Jun 26, 2026 at 14:05 UTC
6ed77682d51fd0d8a21a6caba12dddec967ca7fb
2 files changed
+5
hw/riscv/riscv-iommu-bits.h
+1
@@ -347,6 +347,7 @@ struct riscv_iommu_command {
347
#define RISCV_IOMMU_CMD_IOFENCE_OPCODE 2
348
#define RISCV_IOMMU_CMD_IOFENCE_FUNC_C 0
349
#define RISCV_IOMMU_CMD_IOFENCE_AV BIT_ULL(10)
350
+#define RISCV_IOMMU_CMD_IOFENCE_RESERVED GENMASK_ULL(31, 14)
351
#define RISCV_IOMMU_CMD_IOFENCE_DATA GENMASK_ULL(63, 32)
352
353
#define RISCV_IOMMU_CMD_IODIR_OPCODE 3
hw/riscv/riscv-iommu.c
+4
@@ -1880,6 +1880,10 @@ static void riscv_iommu_process_cq_tail(RISCVIOMMUState *s)
1880
switch (cmd_opcode) {
1881
case RISCV_IOMMU_CMD(RISCV_IOMMU_CMD_IOFENCE_FUNC_C,
1882
RISCV_IOMMU_CMD_IOFENCE_OPCODE):
1883
+ if (cmd.dword0 & RISCV_IOMMU_CMD_IOFENCE_RESERVED) {
1884
+ goto cmd_ill;
1885
+ }
1886
+
1887
res = riscv_iommu_iofence(s,
1888
cmd.dword0 & RISCV_IOMMU_CMD_IOFENCE_AV, cmd.dword1 << 2,
1889
get_field(cmd.dword0, RISCV_IOMMU_CMD_IOFENCE_DATA));