diff --git a/iommu_ref_model/libiommu/src/iommu_command_queue.c b/iommu_ref_model/libiommu/src/iommu_command_queue.c
index 19c984d..b0a6205 100644
--- a/iommu_ref_model/libiommu/src/iommu_command_queue.c
+++ b/iommu_ref_model/libiommu/src/iommu_command_queue.c
@@ -104,7 +104,7 @@ process_commands(
                  command.iotinval.rsvd2 != 0 || command.iotinval.rsvd3 != 0 ||
                  command.iotinval.rsvd4 != 0 ||
                  (g_reg_file.capabilities.nl == 0 && command.iotinval.nl != 0) ||
-                 (g_reg_file.capabilities.s == 0 && command.iotinval.s != 0) )
+                 (g_reg_file.capabilities.s  == 0 && command.iotinval.s  != 0) )
                 goto command_illegal;
             switch ( command.any.func3 ) {
                 case VMA:
@@ -355,6 +355,21 @@ do_iotinval_vma(
 
     uint8_t i, gscid_match, pscid_match, addr_match, global_match;
 
+    // The address range invalidation extension adds the S bit.
+    // When the AV operand is 0, the S operand is ignored in both the IOTINVAL.VMA and
+    // IOTINVAL.GVMA commands. When the S operand is ignored or set to 0, the operations of
+    // the IOTINVAL.VMA and IOTINVAL.GVMA commands are as specified in the RISC-V IOMMU
+    // Version 1.0 specification.
+    // When the S operand is not ignored and is 1, the ADDR operand represents a NAPOT
+    // range encoded in the operand itself. Starting from bit position 0 of the ADDR operand,
+    // if the first 0 bit is at position X, the range size is 2(X+1) * 4 KiB. When X is 0,
+    // the size of the range is 8 KiB.  If the S operand is not ignored and is 1 and all bits
+    // of the ADDR operand are 1, the behavior is UNSPECIFIED.
+    //   * The model treats this unspecified behavior as matching the entire address space.
+    // If the S operand is not ignored and is 1 and the most significant bit of the ADDR
+    // operand is 0 while all other bits are 1, the specified address range covers the entire
+    // address space
+
     for ( i = 0; i < TLB_SIZE; i++ ) {
         gscid_match = pscid_match = addr_match = global_match = 0;
         if ( (GV == 0 && tlb[i].GV == 0 ) ||
@@ -437,6 +452,23 @@ do_iotinval_gvma(
     //                   table entries corresponding to the guest-physical-address in
     //                   `ADDR` operand, for only for VM address spaces identified
     //                   `GSCID` operand.
+    //
+    // The address range invalidation extension adds the S bit.
+    // When the GV operand is 0, both the AV and S operands are ignored by the
+    // IOTINVAL.GVMA command.
+    // When the AV operand is 0, the S operand is ignored in both the IOTINVAL.VMA and
+    // IOTINVAL.GVMA commands. When the S operand is ignored or set to 0, the operations of
+    // the IOTINVAL.VMA and IOTINVAL.GVMA commands are as specified in the RISC-V IOMMU
+    // Version 1.0 specification.
+    // When the S operand is not ignored and is 1, the ADDR operand represents a NAPOT
+    // range encoded in the operand itself. Starting from bit position 0 of the ADDR operand,
+    // if the first 0 bit is at position X, the range size is 2(X+1) * 4 KiB. When X is 0,
+    // the size of the range is 8 KiB.  If the S operand is not ignored and is 1 and all bits
+    // of the ADDR operand are 1, the behavior is UNSPECIFIED.
+    //   * The model treats this unspecified behavior as matching the entire address space.
+    // If the S operand is not ignored and is 1 and the most significant bit of the ADDR
+    // operand is 0 while all other bits are 1, the specified address range covers the entire
+    // address space
     for ( i = 0; i < TLB_SIZE; i++ ) {
         if ( tlb[i].valid == 0 ) continue;
         if ( (GV == 0 && tlb[i].GV == 1) ||