Commit 6ed77682d5 for qemu.org

commit 6ed77682d51fd0d8a21a6caba12dddec967ca7fb
Author: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
Date:   Fri Jun 26 14:05:33 2026 -0300

    hw/riscv/riscv-iommu: set cmd_ill IOFENCE.C rsvp bits are set

    We're not setting RISCV_IOMMU_CQCSR_CMD_ILL if a reserved bit happens to
    be set in an IOFENCE.C command.

    Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
    Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3575
    Signed-off-by: Daniel Henrique Barboza <daniel.barboza@oss.qualcomm.com>
    Acked-by: Alistair Francis <alistair.francis@wdc.com>
    Message-ID: <20260626170533.3562484-1-daniel.barboza@oss.qualcomm.com>
    Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

diff --git a/hw/riscv/riscv-iommu-bits.h b/hw/riscv/riscv-iommu-bits.h
index f9b6f35170..cc0b1c3ccd 100644
--- a/hw/riscv/riscv-iommu-bits.h
+++ b/hw/riscv/riscv-iommu-bits.h
@@ -347,6 +347,7 @@ struct riscv_iommu_command {
 #define RISCV_IOMMU_CMD_IOFENCE_OPCODE          2
 #define RISCV_IOMMU_CMD_IOFENCE_FUNC_C          0
 #define RISCV_IOMMU_CMD_IOFENCE_AV      BIT_ULL(10)
+#define RISCV_IOMMU_CMD_IOFENCE_RESERVED GENMASK_ULL(31, 14)
 #define RISCV_IOMMU_CMD_IOFENCE_DATA    GENMASK_ULL(63, 32)

 #define RISCV_IOMMU_CMD_IODIR_OPCODE            3
diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index c2c470b5df..9bf02084cc 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -1880,6 +1880,10 @@ static void riscv_iommu_process_cq_tail(RISCVIOMMUState *s)
         switch (cmd_opcode) {
         case RISCV_IOMMU_CMD(RISCV_IOMMU_CMD_IOFENCE_FUNC_C,
                              RISCV_IOMMU_CMD_IOFENCE_OPCODE):
+            if (cmd.dword0 & RISCV_IOMMU_CMD_IOFENCE_RESERVED) {
+                goto cmd_ill;
+            }
+
             res = riscv_iommu_iofence(s,
                 cmd.dword0 & RISCV_IOMMU_CMD_IOFENCE_AV, cmd.dword1 << 2,
                 get_field(cmd.dword0, RISCV_IOMMU_CMD_IOFENCE_DATA));