hw/riscv/riscv-iommu-bits.h | 1 + hw/riscv/riscv-iommu.c | 5 +++++ 2 files changed, 6 insertions(+)
When capabilities.AMO_HWADD isn't set, DC.tc.GADE and DC.tc.SADE are
reserved bits and setting them throws a DDT_MISCONFIGURED error.
Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3549
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
---
hw/riscv/riscv-iommu-bits.h | 1 +
hw/riscv/riscv-iommu.c | 5 +++++
2 files changed, 6 insertions(+)
diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
index a938fd3eb4..2e8bc19dca 100644
--- a/hw/riscv/riscv-iommu-bits.h
+++ b/hw/riscv/riscv-iommu-bits.h
@@ -86,6 +86,7 @@ struct riscv_iommu_pq_record {
#define RISCV_IOMMU_CAP_SV57X4 BIT_ULL(19)
#define RISCV_IOMMU_CAP_MSI_FLAT BIT_ULL(22)
#define RISCV_IOMMU_CAP_MSI_MRIF BIT_ULL(23)
+#define RISCV_IOMMU_CAP_AMO_HWAD BIT_ULL(24)
#define RISCV_IOMMU_CAP_ATS BIT_ULL(25)
#define RISCV_IOMMU_CAP_T2GPA BIT_ULL(26)
#define RISCV_IOMMU_CAP_IGS GENMASK_ULL(29, 28)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index c9687e01a8..891a56e731 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -416,6 +416,11 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
const bool ade =
ctx->tc & (pass ? RISCV_IOMMU_DC_TC_GADE : RISCV_IOMMU_DC_TC_SADE);
+ if (ade && !(s->cap & RISCV_IOMMU_CAP_AMO_HWAD)) {
+ /* GADE/SADE are reserved bits if AMO_HWAD is cleared. */
+ return RISCV_IOMMU_FQ_CAUSE_DDT_MISCONFIGURED;
+ }
+
/* Address range check before first level lookup */
if (!sc[pass].step) {
const uint64_t va_len = va_skip + va_bits;
--
2.43.0
On Wed, Jul 1, 2026 at 3:22 AM Daniel Henrique Barboza
<daniel.barboza@oss.qualcomm.com> wrote:
>
> When capabilities.AMO_HWADD isn't set, DC.tc.GADE and DC.tc.SADE are
> reserved bits and setting them throws a DDT_MISCONFIGURED error.
>
> Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3549
> Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Thanks!
Applied to riscv-to-apply.next
Alistair
> ---
> hw/riscv/riscv-iommu-bits.h | 1 +
> hw/riscv/riscv-iommu.c | 5 +++++
> 2 files changed, 6 insertions(+)
>
> diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
> index a938fd3eb4..2e8bc19dca 100644
> --- a/hw/riscv/riscv-iommu-bits.h
> +++ b/hw/riscv/riscv-iommu-bits.h
> @@ -86,6 +86,7 @@ struct riscv_iommu_pq_record {
> #define RISCV_IOMMU_CAP_SV57X4 BIT_ULL(19)
> #define RISCV_IOMMU_CAP_MSI_FLAT BIT_ULL(22)
> #define RISCV_IOMMU_CAP_MSI_MRIF BIT_ULL(23)
> +#define RISCV_IOMMU_CAP_AMO_HWAD BIT_ULL(24)
> #define RISCV_IOMMU_CAP_ATS BIT_ULL(25)
> #define RISCV_IOMMU_CAP_T2GPA BIT_ULL(26)
> #define RISCV_IOMMU_CAP_IGS GENMASK_ULL(29, 28)
> diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
> index c9687e01a8..891a56e731 100644
> --- a/hw/riscv/riscv-iommu.c
> +++ b/hw/riscv/riscv-iommu.c
> @@ -416,6 +416,11 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
> const bool ade =
> ctx->tc & (pass ? RISCV_IOMMU_DC_TC_GADE : RISCV_IOMMU_DC_TC_SADE);
>
> + if (ade && !(s->cap & RISCV_IOMMU_CAP_AMO_HWAD)) {
> + /* GADE/SADE are reserved bits if AMO_HWAD is cleared. */
> + return RISCV_IOMMU_FQ_CAUSE_DDT_MISCONFIGURED;
> + }
> +
> /* Address range check before first level lookup */
> if (!sc[pass].step) {
> const uint64_t va_len = va_skip + va_bits;
> --
> 2.43.0
>
>
On 7/1/2026 1:21 AM, Daniel Henrique Barboza wrote:
> When capabilities.AMO_HWADD isn't set, DC.tc.GADE and DC.tc.SADE are
> reserved bits and setting them throws a DDT_MISCONFIGURED error.
>
> Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3549
> Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Thanks,
Nutty
> ---
> hw/riscv/riscv-iommu-bits.h | 1 +
> hw/riscv/riscv-iommu.c | 5 +++++
> 2 files changed, 6 insertions(+)
>
> diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
> index a938fd3eb4..2e8bc19dca 100644
> --- a/hw/riscv/riscv-iommu-bits.h
> +++ b/hw/riscv/riscv-iommu-bits.h
> @@ -86,6 +86,7 @@ struct riscv_iommu_pq_record {
> #define RISCV_IOMMU_CAP_SV57X4 BIT_ULL(19)
> #define RISCV_IOMMU_CAP_MSI_FLAT BIT_ULL(22)
> #define RISCV_IOMMU_CAP_MSI_MRIF BIT_ULL(23)
> +#define RISCV_IOMMU_CAP_AMO_HWAD BIT_ULL(24)
> #define RISCV_IOMMU_CAP_ATS BIT_ULL(25)
> #define RISCV_IOMMU_CAP_T2GPA BIT_ULL(26)
> #define RISCV_IOMMU_CAP_IGS GENMASK_ULL(29, 28)
> diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
> index c9687e01a8..891a56e731 100644
> --- a/hw/riscv/riscv-iommu.c
> +++ b/hw/riscv/riscv-iommu.c
> @@ -416,6 +416,11 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
> const bool ade =
> ctx->tc & (pass ? RISCV_IOMMU_DC_TC_GADE : RISCV_IOMMU_DC_TC_SADE);
>
> + if (ade && !(s->cap & RISCV_IOMMU_CAP_AMO_HWAD)) {
> + /* GADE/SADE are reserved bits if AMO_HWAD is cleared. */
> + return RISCV_IOMMU_FQ_CAUSE_DDT_MISCONFIGURED;
> + }
> +
> /* Address range check before first level lookup */
> if (!sc[pass].step) {
> const uint64_t va_len = va_skip + va_bits;
© 2016 - 2026 Red Hat, Inc.