hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()

[PATCH] hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()

Posted by Daniel Henrique Barboza 3 weeks, 2 days ago

riscv_iommu_translate(), the only caller of riscv_iommu_spa_fetch(),
will use riscv_iommu_report_fault() for all faults it detects.  And it
will use iotlb->translated_addr as 'iotval2' every time.

At this moment we're updating iotlb->translated_addr only after a
translation step is completed, meaning any fault that occur before that
will have a zeroed iotlb->translated_addr, and as a result iotval2 will
also be zero later on.

Keep iotlb->translated_addr updated with the latest translated addr we
have.

Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3559
Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
---
 hw/riscv/riscv-iommu.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 974042d017..6761b77f95 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -546,6 +546,14 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
         }
     } while (1);
 
+    /*
+     * riscv_iommu_translate() will receive a fault and then call
+     * riscv_iommu_report_fault() using iotlb->translated_addr
+     * as iotval2.  Update translated_addr it with the latest
+     * translated addr we have.
+     */
+    iotlb->translated_addr = addr;
+
     return (iotlb->perm & IOMMU_WO) ?
                 (pass ? RISCV_IOMMU_FQ_CAUSE_WR_FAULT_VS :
                         RISCV_IOMMU_FQ_CAUSE_WR_FAULT_S) :
-- 
2.43.0

Re: [PATCH] hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()

Posted by Alistair Francis 2 weeks, 6 days ago

On Fri, Jul 3, 2026 at 3:12 AM Daniel Henrique Barboza
<daniel.barboza@oss.qualcomm.com> wrote:
>
> riscv_iommu_translate(), the only caller of riscv_iommu_spa_fetch(),
> will use riscv_iommu_report_fault() for all faults it detects.  And it
> will use iotlb->translated_addr as 'iotval2' every time.
>
> At this moment we're updating iotlb->translated_addr only after a
> translation step is completed, meaning any fault that occur before that
> will have a zeroed iotlb->translated_addr, and as a result iotval2 will
> also be zero later on.
>
> Keep iotlb->translated_addr updated with the latest translated addr we
> have.
>
> Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3559
> Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>

Thanks!

Applied to riscv-to-apply.next

Alistair

> ---
>  hw/riscv/riscv-iommu.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
> index 974042d017..6761b77f95 100644
> --- a/hw/riscv/riscv-iommu.c
> +++ b/hw/riscv/riscv-iommu.c
> @@ -546,6 +546,14 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
>          }
>      } while (1);
>
> +    /*
> +     * riscv_iommu_translate() will receive a fault and then call
> +     * riscv_iommu_report_fault() using iotlb->translated_addr
> +     * as iotval2.  Update translated_addr it with the latest
> +     * translated addr we have.
> +     */
> +    iotlb->translated_addr = addr;
> +
>      return (iotlb->perm & IOMMU_WO) ?
>                  (pass ? RISCV_IOMMU_FQ_CAUSE_WR_FAULT_VS :
>                          RISCV_IOMMU_FQ_CAUSE_WR_FAULT_S) :
> --
> 2.43.0
>
>

Re: [PATCH] hw/riscv/riscv-iommu.c: update ioval2 when faulting in spa_fetch()

Posted by Alistair Francis 2 weeks, 6 days ago

On Fri, Jul 3, 2026 at 3:12 AM Daniel Henrique Barboza
<daniel.barboza@oss.qualcomm.com> wrote:
>
> riscv_iommu_translate(), the only caller of riscv_iommu_spa_fetch(),
> will use riscv_iommu_report_fault() for all faults it detects.  And it
> will use iotlb->translated_addr as 'iotval2' every time.
>
> At this moment we're updating iotlb->translated_addr only after a
> translation step is completed, meaning any fault that occur before that
> will have a zeroed iotlb->translated_addr, and as a result iotval2 will
> also be zero later on.
>
> Keep iotlb->translated_addr updated with the latest translated addr we
> have.
>
> Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3559
> Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>

Acked-by: Alistair Francis <alistair.francis@wdc.com>

Alistair

> ---
>  hw/riscv/riscv-iommu.c | 8 ++++++++
>  1 file changed, 8 insertions(+)
>
> diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
> index 974042d017..6761b77f95 100644
> --- a/hw/riscv/riscv-iommu.c
> +++ b/hw/riscv/riscv-iommu.c
> @@ -546,6 +546,14 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
>          }
>      } while (1);
>
> +    /*
> +     * riscv_iommu_translate() will receive a fault and then call
> +     * riscv_iommu_report_fault() using iotlb->translated_addr
> +     * as iotval2.  Update translated_addr it with the latest
> +     * translated addr we have.
> +     */
> +    iotlb->translated_addr = addr;
> +
>      return (iotlb->perm & IOMMU_WO) ?
>                  (pass ? RISCV_IOMMU_FQ_CAUSE_WR_FAULT_VS :
>                          RISCV_IOMMU_FQ_CAUSE_WR_FAULT_S) :
> --
> 2.43.0
>
>