On Wed, Jul 1, 2026 at 10:12 PM Daniel Henrique Barboza
<[email protected]> wrote:
>
> riscv-iommu spec 1.0 says:
>
> "When checking the U bit in a second-stage PTE, the transaction
>  is treated as not requesting supervisor privilege."
>
> We need to *always* fault in case we're on G_STAGE and PTE_U is cleared
> since we can't be on supervisor mode at this point.
>
> Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3555
> Signed-off-by: Daniel Henrique Barboza <[email protected]>

Acked-by: Alistair Francis <[email protected]>

Alistair

> ---
>  hw/riscv/riscv-iommu.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
> index 3b165348ca..29eec3133e 100644
> --- a/hw/riscv/riscv-iommu.c
> +++ b/hw/riscv/riscv-iommu.c
> @@ -494,6 +494,16 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, 
> RISCVIOMMUContext *ctx,
>              break;                /* Access bit not set */
>          } else if ((iotlb->perm & IOMMU_WO) && !ade && !(pte & PTE_D)) {
>              break;                /* Dirty bit not set */
> +        } else if (pass == G_STAGE && !(pte & PTE_U)) {
> +            /*
> +             * riscv-iommu spec 1.0: "When checking the U bit in a
> +             * second-stage PTE, the transaction is treated as
> +             * not requesting supervisor privilege."
> +             *
> +             * I.e. we need to fault if this is a non-user PTE since
> +             * we are always in user mode at this point.
> +             */
> +            break;
>          } else {
>              /* Leaf PTE, translation completed. */
>              sc[pass].step = sc[pass].levels;
> --
> 2.43.0
>
>

Reply via email to