<!--This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/--> ## Host environment - Operating system: Linux Centos7 - OS/kernel version: Linux centos7 6.6.87.2-microsoft-standard-WSL2 #1 - Architecture: <!--x86, ARM, s390x, etc.--> - QEMU flavor: qemu-system-riscv64 - QEMU version: `v11.0.0-1713-gde5d8bfd61`, reported version 11.0.50 - QEMU command line: <!--Give the smallest, complete command line that exhibits the problem. </li> </ul> </li> </ul> </li> </ul> </li> </ul> </li> </ul> <p data-sourcepos="39:1-40:62">If you are using libvirt, virsh, or vmm, you can likely find the QEMU command line arguments in /var/log/libvirt/qemu/$GUEST.log.--&gt;</p> <pre data-sourcepos="42:3-52:5"><code>qemu-system-riscv64 \ -M virt,iommu-sys=on,aia=aplic-imsic \ -cpu rv64,smstateen=true \ -m 8G \ -trace riscv_iommu_dma \ -nographic \ -device edu,dma_mask=0xFFFFFFFFFFFFFFFF \ -bios bin/iommu_dc_reserved_bits.elf <p data-sourcepos="52:1-52:13"></code></pre></p> <h2 id="user-content-emulatedvirtualized-environment" data-sourcepos="54:1-54:35">Emulated/Virtualized environment<a href="#emulatedvirtualized-environment" aria-label="Link to heading 'Emulated/Virtualized environment'" data-heading-content="Emulated/Virtualized environment" class="anchor"></a></h2> <ul data-sourcepos="56:1-64:28"> <li data-sourcepos="56:1-58:41"> <p data-sourcepos="56:3-56:19">Operating system:</p> <!--Windows 10 21H1, Fedora 37, etc.--> - OS/kernel version: <!--For POSIX guests, use `uname -a`.--> - Architecture: <!--x86, ARM, s390x, etc.--> ## Description of problem The guest program (`tests/iommu_dc_reserved_bits.c`): 1. Enables the IOMMU with a 3-level DDT and enables the fault queue. 2. Registers a correct Device Context for the `edu` PCI device (G-stage Sv39x4, VS-stage Sv39, PDT = Bare, MSI Flat). 3. Reads the DC back, sets reserved bit 12 of `DC.tc` (`DC.tc.raw |= (1 << 12)`, leaving `DC.tc.V = 1`), and writes it back. Bits 0..11 of `DC.tc` are the defined fields (`V`, `EN_ATS`, `EN_PRI`, `T2GPA`, `DTF`, `PDTV`, `PRPR`, `GADE`, `SADE`, `DPE`, `SBE`, `SXL`); bit 12 is reserved. 4. Programs valid VS-stage and G-stage page tables for the source and destination buffers, so the only condition that should stop translation is the reserved bit in the DC. 5. Issues two `edu` DMA transfers (RAM -\> EDU internal buffer -\> RAM) using guest virtual addresses, then compares the buffers and reads the fault queue. ## Steps to reproduce 1. [iommu_dc_reserved_bits.c](/uploads/6df110d3ad36a028b69904f797f51158/iommu_dc_reserved_bits.c) 2. Built with: `riscv64-unknown-elf-gcc -march=rv64gc -mabi=lp64 -mcmodel=medany -nostartfiles -nostdlib` 3. [iommu_dc_reserved_bits.elf](/uploads/3eb78f19cf4b12f7cb3422e82fdc67ae/iommu_dc_reserved_bits.elf) ```` ``` qemu-system-riscv64 \ -M virt,iommu-sys=on,aia=aplic-imsic \ -cpu rv64,smstateen=true \ -m 8G \ -trace riscv_iommu_dma \ -nographic \ -device edu,dma_mask=0xFFFFFFFFFFFFFFFF \ -bios bin/iommu_dc_reserved_bits.elf ``` ```` ## Additional information ## Expected behaviour (per spec) The first translation should fail. The transaction should be terminated, no data should be copied, and a fault record with CAUSE = 259 (DDT entry misconfigured) should be written to the fault queue. Spec references: - RISC-V IOMMU Architecture Specification, Section 3.1.4, Device-context configuration checks: "A DC with DC.tc.V=1 is considered as misconfigured if any of the following conditions are true. If misconfigured then, stop and report "DDT entry misconfigured" (cause = 259). 1. If any bits or encodings that are reserved for future standard use are set." ## Observed behaviour The reserved bit is ignored. Both DMA transfers complete, the destination buffer matches the source buffer, and the fault queue is empty. Guest output: ``` DC.tc before = 0x0000000000000001 DC.tc after = 0x0000000000001001 (reserved bit 0000000C set, V still 1) ... Result No faults logged DMA moved data (buffers match) : YES DDT-misconfigured fault logged : NO BUG: reserved bit set in a valid DC was ignored. IOMMU translated the request and DMA completed; no CAUSE 259 fault. ``` QEMU `riscv_iommu_dma` trace (both translations succeed despite the reserved bit being set): ``` riscv_iommu_dma (null): translate 0000:01.0 #0 RO 0x100000 -> 0x80092000 riscv_iommu_dma (null): translate 0000:01.0 #0 WR 0x200000 -> 0x80093000 ``` ## Root cause In `hw/riscv/riscv-iommu.c` (master, commit de5d8bfd61): - The Device Context is loaded and then checked by `riscv_iommu_validate_device_ctx()` (function begins at line 749). On failure the caller returns `RISCV_IOMMU_FQ_CAUSE_DDT_MISCONFIGURED`. - `riscv_iommu_validate_device_ctx()` checks the consistency of defined fields (ATS/PRI/T2GPA/PDTV combinations, MSI mode, ATP modes versus capabilities, SBE) but does not check that bits reserved for future standard use are zero. ## Notes - The test sets only one reserved bit (`DC.tc` bit 12) to keep the case unambiguous. The spec requires the check across all reserved DC fields (`tc`, `iohgatp`, `ta`, `fsc`, `msiptp`, `msi_addr_mask`, `msi_addr_pattern`). <!--The line below ensures that proper tags are added to the issue. Please do not remove it.-->