From c1d5ec3a2f4bbc9fdc120ba5697e8ad89e682e45 Mon Sep 17 00:00:00 2001 From: Daniel Henrique Barboza Date: Wed, 1 Jul 2026 09:11:09 -0300 Subject: [PATCH] hw/riscv/riscv-iommu.c: check for reserved PTE bits We need to fault if reserved PTE bits (60:54) are set. Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3554 Signed-off-by: Daniel Henrique Barboza Reviewed-by: Nutty Liu Reviewed-by: Chao Liu Message-ID: <20260701121111.537654-2-daniel.barboza@oss.qualcomm.com> Signed-off-by: Alistair Francis --- hw/riscv/riscv-iommu.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c index 7f94ce152e..6665ad9f7c 100644 --- a/hw/riscv/riscv-iommu.c +++ b/hw/riscv/riscv-iommu.c @@ -469,6 +469,8 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx, if (!(pte & PTE_V)) { break; /* Invalid PTE */ + } else if (pte & PTE_RESERVED(false)) { + break; /* Reserved PTE bits set */ } else if (!(pte & (PTE_R | PTE_W | PTE_X))) { base = PPN_PHYS(ppn); /* Inner PTE, continue walking */ } else if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {