Commit 15406cc593 for qemu.org

commit 15406cc593a76f075f23e4113b2723190e6a0d1a
Author: Frank Chang <frank.chang@sifive.com>
Date:   Tue Oct 28 16:50:32 2025 +0800

    hw/riscv: riscv-iommu: Don't look up DDT cache in Off and Bare modes

    According to the RISC-V IOMMU specification:

    * When ddtp.iommu_mode is set to Off, there is no DDT look-up, and an "All
      inbound transactions disallowed" fault (cause = 256) is reported for any
      inbound transaction.

    * When ddtp.iommu_mode is set to Bare, there is no DDT look-up, and the
      translated address is the same as the IOVA, unless the transaction type
      is disallowed (cause = 260).

    In the current implementation, the DDT cache is incorrectly looked up
    even when ddtp.iommu_mode is set to Off or Bare. This may result in
    unintended cache hits.

    Therefore, the DDT cache must not be looked up when ddtp.iommu_mode is
    set to Off or Bare. For other modes, software is required to issue cache
    invalidation commands before any inbound transactions.

    Signed-off-by: Frank Chang <frank.chang@sifive.com>
    Acked-by: Alistair Francis <alistair.francis@wdc.com>
    Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
    Reviewed-by: Jim Shu <jim.shu@sifive.com>
    Message-ID: <20251028085032.2053569-1-frank.chang@sifive.com>
    Signed-off-by: Alistair Francis <alistair.francis@wdc.com>

diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 01730109c7..b46b337375 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -1292,13 +1292,18 @@ static RISCVIOMMUContext *riscv_iommu_ctx(RISCVIOMMUState *s,
         .devid = devid,
         .process_id = process_id,
     };
+    unsigned mode = get_field(s->ddtp, RISCV_IOMMU_DDTP_MODE);

     ctx_cache = g_hash_table_ref(s->ctx_cache);
-    ctx = g_hash_table_lookup(ctx_cache, &key);

-    if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
-        *ref = ctx_cache;
-        return ctx;
+    if (mode != RISCV_IOMMU_DDTP_MODE_OFF &&
+        mode != RISCV_IOMMU_DDTP_MODE_BARE) {
+        ctx = g_hash_table_lookup(ctx_cache, &key);
+
+        if (ctx && (ctx->tc & RISCV_IOMMU_DC_TC_V)) {
+            *ref = ctx_cache;
+            return ctx;
+        }
     }

     ctx = g_new0(RISCVIOMMUContext, 1);