1. Patchew
  2. QEMU
  3. View series

[PATCH] hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes

frank.chang@sifive.com posted 1 patch 2 weeks, 3 days ago
Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20251028085032.2053569-1-frank.chang@sifive.com
Maintainers: Palmer Dabbelt <palmer@dabbelt.com>, Alistair Francis <alistair.francis@wdc.com>, Weiwei Li <liwei1518@gmail.com>, Daniel Henrique Barboza <dbarboza@ventanamicro.com>, Liu Zhiwei <zhiwei_liu@linux.alibaba.com>
hw/riscv/riscv-iommu.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
[PATCH] hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes
Posted by frank.chang@sifive.com 2 weeks, 3 days ago 
From: Frank Chang <frank.chang@sifive.com>

According to the RISC-V IOMMU specification:

* When ddtp.iommu_mode is set to Off, there is no DDT look-up, and an "All
  inbound transactions disallowed" fault (cause = 256) is reported for any
  inbound transaction.

* When ddtp.iommu_mode is set to Bare, there is no DDT look-up, and the
  translated address is the same as the IOVA, unless the transaction type
  is disallowed (cause = 260).

In the current implementation, the DDT cache is incorrectly looked up
even when ddtp.iommu_mode is set to Off or Bare. This may result in
unintended cache hits.

Therefore, the DDT cache must not be looked up when ddtp.iommu_mode is
set to Off or Bare. For other modes, software is required to issue cache
invalidation commands before any inbound transactions.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
---
 hw/riscv/riscv-iommu.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index b33c7fe3259..95db811f125 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -1290,13 +1290,18 @@ static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMUState *s,
         .devid = devid,
         .process_id = process_id,
     };
+    unsigned mode = get_field(s->ddtp, RISCV_IOMMU_DDTP_MODE);
 
     ctx_cache = g_hash_table_ref(s->ctx_cache);
-    ctx = g_hash_table_lookup(ctx_cache, &key);
 
-    if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
-        *ref = ctx_cache;
-        return ctx;
+    if (mode != RISCV_IOMMU_DDTP_MODE_OFF &&
+        mode != RISCV_IOMMU_DDTP_MODE_BARE) {
+        ctx = g_hash_table_lookup(ctx_cache, &key);
+
+        if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
+            *ref = ctx_cache;
+            return ctx;
+        }
     }
 
     ctx = g_new0(RISCVIOMMUContext, 1);
-- 
2.43.0
Re: [PATCH] hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes
Posted by Alistair Francis 2 days, 15 hours ago 
On Tue, Oct 28, 2025 at 6:54 PM <frank.chang@sifive.com> wrote:
>
> From: Frank Chang <frank.chang@sifive.com>
>
> According to the RISC-V IOMMU specification:
>
> * When ddtp.iommu_mode is set to Off, there is no DDT look-up, and an "All
>   inbound transactions disallowed" fault (cause = 256) is reported for any
>   inbound transaction.
>
> * When ddtp.iommu_mode is set to Bare, there is no DDT look-up, and the
>   translated address is the same as the IOVA, unless the transaction type
>   is disallowed (cause = 260).
>
> In the current implementation, the DDT cache is incorrectly looked up
> even when ddtp.iommu_mode is set to Off or Bare. This may result in
> unintended cache hits.
>
> Therefore, the DDT cache must not be looked up when ddtp.iommu_mode is
> set to Off or Bare. For other modes, software is required to issue cache
> invalidation commands before any inbound transactions.
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>

Thanks!

Applied to riscv-to-apply.next

Alistair

> ---
>  hw/riscv/riscv-iommu.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
> index b33c7fe3259..95db811f125 100644
> --- a/hw/riscv/riscv-iommu.c
> +++ b/hw/riscv/riscv-iommu.c
> @@ -1290,13 +1290,18 @@ static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMUState *s,
>          .devid = devid,
>          .process_id = process_id,
>      };
> +    unsigned mode = get_field(s->ddtp, RISCV_IOMMU_DDTP_MODE);
>
>      ctx_cache = g_hash_table_ref(s->ctx_cache);
> -    ctx = g_hash_table_lookup(ctx_cache, &key);
>
> -    if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
> -        *ref = ctx_cache;
> -        return ctx;
> +    if (mode != RISCV_IOMMU_DDTP_MODE_OFF &&
> +        mode != RISCV_IOMMU_DDTP_MODE_BARE) {
> +        ctx = g_hash_table_lookup(ctx_cache, &key);
> +
> +        if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
> +            *ref = ctx_cache;
> +            return ctx;
> +        }
>      }
>
>      ctx = g_new0(RISCVIOMMUContext, 1);
> --
> 2.43.0
>
>
Re: [PATCH] hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes
Posted by Alistair Francis 2 days, 15 hours ago 
On Tue, Oct 28, 2025 at 6:54 PM <frank.chang@sifive.com> wrote:
>
> From: Frank Chang <frank.chang@sifive.com>
>
> According to the RISC-V IOMMU specification:
>
> * When ddtp.iommu_mode is set to Off, there is no DDT look-up, and an "All
>   inbound transactions disallowed" fault (cause = 256) is reported for any
>   inbound transaction.
>
> * When ddtp.iommu_mode is set to Bare, there is no DDT look-up, and the
>   translated address is the same as the IOVA, unless the transaction type
>   is disallowed (cause = 260).
>
> In the current implementation, the DDT cache is incorrectly looked up
> even when ddtp.iommu_mode is set to Off or Bare. This may result in
> unintended cache hits.
>
> Therefore, the DDT cache must not be looked up when ddtp.iommu_mode is
> set to Off or Bare. For other modes, software is required to issue cache
> invalidation commands before any inbound transactions.
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>

Acked-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  hw/riscv/riscv-iommu.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
> index b33c7fe3259..95db811f125 100644
> --- a/hw/riscv/riscv-iommu.c
> +++ b/hw/riscv/riscv-iommu.c
> @@ -1290,13 +1290,18 @@ static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMUState *s,
>          .devid = devid,
>          .process_id = process_id,
>      };
> +    unsigned mode = get_field(s->ddtp, RISCV_IOMMU_DDTP_MODE);
>
>      ctx_cache = g_hash_table_ref(s->ctx_cache);
> -    ctx = g_hash_table_lookup(ctx_cache, &key);
>
> -    if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
> -        *ref = ctx_cache;
> -        return ctx;
> +    if (mode != RISCV_IOMMU_DDTP_MODE_OFF &&
> +        mode != RISCV_IOMMU_DDTP_MODE_BARE) {
> +        ctx = g_hash_table_lookup(ctx_cache, &key);
> +
> +        if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
> +            *ref = ctx_cache;
> +            return ctx;
> +        }
>      }
>
>      ctx = g_new0(RISCVIOMMUContext, 1);
> --
> 2.43.0
>
>
Re: [PATCH] hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes
Posted by Daniel Henrique Barboza 2 weeks, 1 day ago 

On 10/28/25 5:50 AM, frank.chang@sifive.com wrote:
> From: Frank Chang <frank.chang@sifive.com>
> 
> According to the RISC-V IOMMU specification:
> 
> * When ddtp.iommu_mode is set to Off, there is no DDT look-up, and an "All
>    inbound transactions disallowed" fault (cause = 256) is reported for any
>    inbound transaction.
> 
> * When ddtp.iommu_mode is set to Bare, there is no DDT look-up, and the
>    translated address is the same as the IOVA, unless the transaction type
>    is disallowed (cause = 260).
> 
> In the current implementation, the DDT cache is incorrectly looked up
> even when ddtp.iommu_mode is set to Off or Bare. This may result in
> unintended cache hits.
> 
> Therefore, the DDT cache must not be looked up when ddtp.iommu_mode is
> set to Off or Bare. For other modes, software is required to issue cache
> invalidation commands before any inbound transactions.
> 
> Signed-off-by: Frank Chang <frank.chang@sifive.com>
> ---

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>

>   hw/riscv/riscv-iommu.c | 13 +++++++++----
>   1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
> index b33c7fe3259..95db811f125 100644
> --- a/hw/riscv/riscv-iommu.c
> +++ b/hw/riscv/riscv-iommu.c
> @@ -1290,13 +1290,18 @@ static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMUState *s,
>           .devid = devid,
>           .process_id = process_id,
>       };
> +    unsigned mode = get_field(s->ddtp, RISCV_IOMMU_DDTP_MODE);
>   
>       ctx_cache = g_hash_table_ref(s->ctx_cache);
> -    ctx = g_hash_table_lookup(ctx_cache, &key);
>   
> -    if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
> -        *ref = ctx_cache;
> -        return ctx;
> +    if (mode != RISCV_IOMMU_DDTP_MODE_OFF &&
> +        mode != RISCV_IOMMU_DDTP_MODE_BARE) {
> +        ctx = g_hash_table_lookup(ctx_cache, &key);
> +
> +        if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
> +            *ref = ctx_cache;
> +            return ctx;
> +        }
>       }
>   
>       ctx = g_new0(RISCVIOMMUContext, 1);
Re: [PATCH] hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes
Posted by Jim Shu 2 weeks, 3 days ago 
Reviewed-by: Jim Shu <jim.shu@sifive.com>

- Jim



On Tue, Oct 28, 2025 at 4:51 PM <frank.chang@sifive.com> wrote:
>
> From: Frank Chang <frank.chang@sifive.com>
>
> According to the RISC-V IOMMU specification:
>
> * When ddtp.iommu_mode is set to Off, there is no DDT look-up, and an "All
>   inbound transactions disallowed" fault (cause = 256) is reported for any
>   inbound transaction.
>
> * When ddtp.iommu_mode is set to Bare, there is no DDT look-up, and the
>   translated address is the same as the IOVA, unless the transaction type
>   is disallowed (cause = 260).
>
> In the current implementation, the DDT cache is incorrectly looked up
> even when ddtp.iommu_mode is set to Off or Bare. This may result in
> unintended cache hits.
>
> Therefore, the DDT cache must not be looked up when ddtp.iommu_mode is
> set to Off or Bare. For other modes, software is required to issue cache
> invalidation commands before any inbound transactions.
>
> Signed-off-by: Frank Chang <frank.chang@sifive.com>
> ---
>  hw/riscv/riscv-iommu.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
> index b33c7fe3259..95db811f125 100644
> --- a/hw/riscv/riscv-iommu.c
> +++ b/hw/riscv/riscv-iommu.c
> @@ -1290,13 +1290,18 @@ static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMUState *s,
>          .devid = devid,
>          .process_id = process_id,
>      };
> +    unsigned mode = get_field(s->ddtp, RISCV_IOMMU_DDTP_MODE);
>
>      ctx_cache = g_hash_table_ref(s->ctx_cache);
> -    ctx = g_hash_table_lookup(ctx_cache, &key);
>
> -    if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
> -        *ref = ctx_cache;
> -        return ctx;
> +    if (mode != RISCV_IOMMU_DDTP_MODE_OFF &&
> +        mode != RISCV_IOMMU_DDTP_MODE_BARE) {
> +        ctx = g_hash_table_lookup(ctx_cache, &key);
> +
> +        if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
> +            *ref = ctx_cache;
> +            return ctx;
> +        }
>      }
>
>      ctx = g_new0(RISCVIOMMUContext, 1);
> --
> 2.43.0
>
>

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.