@samitouri / QOSamiQemu / commits / 88ddcb2c16

hw/riscv/virt-acpi-build: Fix off-by-one error in RIMT ID mapping

In build_rimt(), the calculation of `num_ids` for the ID mapping array incorrectly uses the same formula (`0xffff - s->pci_iommu_bdf`) for both System IOMMU and PCI IOMMU topologies. For a System IOMMU, `s->pci_iommu_bdf` is 0. This results in a `num_ids` value of 0xffff. Since the source ID base starts at 0, the mapping only covers Requester IDs from 0 to 0xfffe. The final valid PCI Requester ID (0xffff) is erroneously omitted from the RIMT table. Fix this by decoupling the `num_ids` calculation. For System IOMMUs, explicitly set `num_ids` to 0x10000 to cover the entire PCI Requester ID space. This issue was discovered and reported by SpecHunter, an AI-driven architecture specification analysis tool. Link: https://github.com/yizishun/rv-isa-sec/blob/c78dacf66c8acd677b3538c837fde310bb71a97b/output/riscv-server-platform/pr-102/qemu.txt#L32 Signed-off-by: Zishun Yi <vulab@iscas.ac.cn> Acked-by: Alistair Francis <alistair.francis@wdc.com> Message-ID: <20260512062310.348208-1-vulab@iscas.ac.cn> Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

Zishun Yi committed May 12, 2026 at 14:23 UTC 88ddcb2c16ccbefd0c0e75d0e94cf5fdd5ce37cf

1 file changed +2 -1

hw/riscv/virt-acpi-build.c

+2 -1

@@ -802,10 +802,11 @@ static void build_rimt(GArray *table_data, BIOSLinker *linker,

802 range = &g_array_index(iommu_idmaps, AcpiRimtIdMapping, i);

803 if (virt_is_iommu_sys_enabled(s)) {

804 range->source_id_base = 0;

805 + range->num_ids = 0x10000;

806 } else {

807 range->source_id_base = s->pci_iommu_bdf + 1;

808 + range->num_ids = 0xffff - s->pci_iommu_bdf;

809 }

808 - range->num_ids = 0xffff - s->pci_iommu_bdf;

810 build_rimt_id_mapping(table_data, range->source_id_base,

811 range->num_ids, iommu_offset);

812 }