<!--This is the upstream QEMU issue tracker. If you are able to, it will greatly facilitate bug triage if you attempt to reproduce the problem with the latest qemu.git master built from source. See https://www.qemu.org/download/#source for instructions on how to do this. QEMU generally supports the last two releases advertised on https://www.qemu.org/. Problems with distro-packaged versions of QEMU older than this should be reported to the distribution instead. See https://www.qemu.org/contribute/report-a-bug/ for additional guidance. If this is a security issue, please consult https://www.qemu.org/contribute/security-process/--> ## Host environment - Operating system: Linux - OS/kernel version: Linux centos7 6.6.87.2-microsoft-standard-WSL2 - Architecture: x86 - QEMU flavor: qemu-system-riscv64 - QEMU version: v11.0.0-1713-gde5d8bfd61\`, reported version 11.0.50 - QEMU command line: <!--Give the smallest, complete command line that exhibits the problem. </li> </ul> <p data-sourcepos="39:1-40:62">If you are using libvirt, virsh, or vmm, you can likely find the QEMU command line arguments in /var/log/libvirt/qemu/$GUEST.log.--&gt;</p> <pre data-sourcepos="42:3-52:5"><code>qemu-system-riscv64 \ -M virt,iommu-sys=on,aia=aplic-imsic \ -cpu rv64,smstateen=true \ -m 8G \ -trace riscv_iommu_sys_msi_sent \ -nographic \ -device edu,dma_mask=0xFFFFFFFFFFFFFFFF \ -bios bin/iommu_msi_vec_mask.elf </code></pre> <h2 id="user-content-emulatedvirtualized-environment" data-sourcepos="54:1-54:35">Emulated/Virtualized environment<a href="#emulatedvirtualized-environment" aria-label="Link to heading 'Emulated/Virtualized environment'" data-heading-content="Emulated/Virtualized environment" class="anchor"></a></h2> <ul data-sourcepos="56:1-64:28"> <li data-sourcepos="56:1-58:41"> <p data-sourcepos="56:3-56:19">Operating system:</p> <!--Windows 10 21H1, Fedora 37, etc.--> - OS/kernel version: <!--For POSIX guests, use `uname -a`.--> - Architecture: <!--x86, ARM, s390x, etc.--> ## Description of problem When an IOMMU MSI vector is masked (msi_vec_ctl_x.M == 1), the IOMMU is prohibited from sending the associated message; the message should be held pending and sent later when the mask is cleared. The model does not check the mask bit: it sends the MSI even when the vector is masked, and does not record a pending message. ## Steps to reproduce 1. [iommu_msi_vec_mask.c](/uploads/e351ef25f385a920768b0978405ca245/iommu_msi_vec_mask.c) 2. Built with: `riscv64-unknown-elf-gcc -march=rv64gc -mabi=lp64 -mcmodel=medany -nostartfiles -nostdlib` 3. [iommu_msi_vec_mask.elf](/uploads/424b206ea353239c45cf5da456f534b3/iommu_msi_vec_mask.elf) ``` qemu-system-riscv64 \ -M virt,iommu-sys=on,aia=aplic-imsic \ -cpu rv64,smstateen=true \ -m 8G \ -trace riscv_iommu_sys_msi_sent \ -nographic \ -device edu,dma_mask=0xFFFFFFFFFFFFFFFF \ -bios bin/iommu_msi_vec_mask.elf ``` ## Additional information The guest program (`tests/iommu_msi_vec_mask.c`): 1. Enables the IOMMU and the fault queue (FQEN + FIE) in MSI mode (fctl.WSI = 0). 2. Programs the IOMMU MSI config table (offset 0x300) vector 0 with a valid writable msi_addr (a buffer), msi_data = 0xABCD, and vec_ctl.M = 1 (masked). 3. Issues a DMA from the unregistered EDU device, producing a DDT fault that raises the fault-queue interrupt; the IOMMU attempts to send the MSI for vector 0. 4. Reads the buffer to see whether the (masked) MSI was written. ## Expected behaviour (per spec) With the vector masked, no MSI should be sent (the buffer stays 0); the message should be held pending and delivered when the mask is cleared. Spec reference (RISC-V IOMMU Architecture Specification, Section 6, msi_vec_ctl_x register, mask bit M): > "When the mask bit M is 1, the corresponding interrupt vector is masked and the IOMMU is prohibited from sending the associated message. Pending messages for that vector are later generated if the corresponding mask bit is cleared to 0." ## Observed behaviour ``` MSI vec0: addr = 0x0000000080097000 data = 0x0000ABCD vec_ctl.M = 1 (masked) Result msi_buf[0] = 0x0000ABCD (expected 0 while vector is masked) BUG: masked vector (vec_ctl.M=1) still sent the MSI. The msi_vec_ctl mask bit is not checked. ``` `riscv_iommu_sys_msi_sent` trace (the MSI was sent despite the mask): ``` riscv_iommu_sys_msi_sent MSI sent to vector 0 msi_addr 0x80097000 msi_data 0xabcd result 0 ``` ## Source location `hw/riscv/riscv-iommu-sys.c`, function `riscv_iommu_sysdev_send_MSI()`. ```c uint8_t *table_entry = s->msix_table + vector * PCI_MSIX_ENTRY_SIZE; uint64_t msi_addr = pci_get_quad(table_entry + PCI_MSIX_ENTRY_LOWER_ADDR); uint32_t msi_data = pci_get_long(table_entry + PCI_MSIX_ENTRY_DATA); MemTxResult result; address_space_stl_le(&address_space_memory, msi_addr, msi_data, MEMTXATTRS_UNSPECIFIED, &result); ``` <!--The line below ensures that proper tags are added to the issue. Please do not remove it.-->