Commit 6d2b9d542f for qemu.org

commit 6d2b9d542fe2cec17eec71bdb33e45bee8805105
Author: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Date:   Tue Jun 30 14:21:10 2026 -0300

    hw/riscv/riscv-iommu: forbid GATE/SADE if caps.AMO_HWADD is zero

    When capabilities.AMO_HWADD isn't set, DC.tc.GADE and DC.tc.SADE are
    reserved bits and setting them throws a DDT_MISCONFIGURED error.

    Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3549
    Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
    Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
    Message-ID: <20260630172110.1866951-1-daniel.barboza@oss.qualcomm.com>
    Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
index cc0b1c3ccd..924a1f8c21 100644
--- a/hw/riscv/riscv-iommu-bits.h
+++ b/hw/riscv/riscv-iommu-bits.h
@@ -86,6 +86,7 @@ struct riscv_iommu_pq_record {
 #define RISCV_IOMMU_CAP_SV57X4          BIT_ULL(19)
 #define RISCV_IOMMU_CAP_MSI_FLAT        BIT_ULL(22)
 #define RISCV_IOMMU_CAP_MSI_MRIF        BIT_ULL(23)
+#define RISCV_IOMMU_CAP_AMO_HWAD        BIT_ULL(24)
 #define RISCV_IOMMU_CAP_ATS             BIT_ULL(25)
 #define RISCV_IOMMU_CAP_T2GPA           BIT_ULL(26)
 #define RISCV_IOMMU_CAP_IGS             GENMASK_ULL(29, 28)
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index bdc409adc9..877d24bc47 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -417,6 +417,11 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
         const bool ade =
             ctx->tc & (pass ? RISCV_IOMMU_DC_TC_GADE : RISCV_IOMMU_DC_TC_SADE);

+        if (ade && !(s->cap & RISCV_IOMMU_CAP_AMO_HWAD)) {
+            /* GADE/SADE are reserved bits if AMO_HWAD is cleared.  */
+            return RISCV_IOMMU_FQ_CAUSE_DDT_MISCONFIGURED;
+        }
+
         /* Address range check before first level lookup */
         if (!sc[pass].step) {
             const uint64_t va_len = va_skip + va_bits;