[RFC PATCH 00/12] Add RISC-V Worlds ISA support to OpenSBI

[RFC PATCH 00/12] Add RISC-V Worlds ISA support to OpenSBI

[Yu-Chien Peter Lin]

This RFC patch series adds support for RISC-V Worlds ISA extensions,
enabling hardware-enforced isolation boundaries based on World IDs (WIDs)
by extending the OpenSBI domain framework.

Trust Model and Boot-time Roles
--------------------------------

The implementation follows the two-phase M-mode trust model:

- RoT M-mode phase: Prior boot stage (ROM/SPL) that may program mwid/
  mlwidlist and lock mwid before handing off to OpenSBI.

- Regular M-mode phase (OpenSBI): Treats pmwid/pmwidlist/pmlwidlist as
  read-only input policy from hardware/RoT. Locks mwid during feature
  detection to prevent later M-mode code from changing its own WID.
  Programs per-domain mlwid/mwiddeleg based on DT configuration.

Device Tree Bindings
---------------------

New CPU properties (per-hart):
- riscv,pmwid: Platform-defined M-mode World ID
- riscv,pmwidlist: M-mode permitted WID bitmap (u64, 2 cells)
- riscv,pmlwidlist: S/U-mode permitted WID bitmap (u64, 2 cells)

New domain properties (per-domain):
- next-wid: Override S-mode WID for this domain (u32, 1 cell)
- next-widlist: WID delegation bitmap for this domain (u64, 2 cells)

If a domain lacks next-wid, OpenSBI falls back to pmwid (M-mode and
S-mode run in the same World).

Example DT snippet:

    cpus {
        riscv,nworlds = <4>;
        cpu@0 {
            riscv,pmwid = <3>;
            riscv,pmwidlist = <0x0 0xf>;
            riscv,pmlwidlist = <0x0 0xf>;
        };
    };

    chosen {
        opensbi-domains {
            trusted-domain {
                next-wid = <1>;
                next-widlist = <0x0 0x2>;
            };
            untrusted-domain {
                next-wid = <0>;
                next-widlist = <0x0 0x1>;
            };
        };
    };

Known Limitations and Future Work
----------------------------------

This RFC implements core functionality but has several areas requiring
refinement in the future revisions:

1. WID Validation:
   - Domain next-wid is NOT validated against pmlwidlist
   - Domain next-widlist is NOT validated as subset of pmlwidlist
   - Invalid WID configuration fails at runtime with software-check
     exceptions rather than at domain registration time
   - Planned: Add validation in sanitize_domain() to catch errors early

2. Resume Path mwid Restoration:
   - Current implementation only re-locks mwid on resume, assuming RoT
     has already restored the correct WID value
   - No mechanism to verify or actively restore mwid to RoT-defined value

Specification References
-------------------------

- RISC-V Worlds ISA Spec: https://github.com/riscv/riscv-worlds
  (Release: riscv-isa-release-4c81a3f-2026-04-14)
- Device Tree Proposal: https://lore.kernel.org/all/20260619105834.1277302-1-peter.lin@sifive.com/

Yu-Chien Peter Lin (12):
  lib: sbi_hart: detect RISC-V Worlds ISA extensions
  lib: utils: fdt_helper: parse RISC-V Worlds DT properties
  lib: sbi_hart: enforce riscv,pmwid for Worlds ISA
  lib: sbi_hart: lock mwid CSR for RoT immutability
  include: sbi_domain: add Worlds WID fields
  include: sbi_types: add PRIx64 format macro
  lib: sbi_domain: print World ID config at boot
  lib: sbi_init: print M-mode World ID at boot
  platform: generic: parse root domain WID config from DT
  lib: utils: fdt_domain: parse per-domain WID properties
  lib: sbi_domain: add Worlds CSR config on domain entry
  docs: add RISC-V Worlds next-wid/next-widlist DT properties

 docs/domain_support.md             | 13 ++++++
 docs/opensbi_config.md             | 13 ++++++
 include/sbi/riscv_encoding.h       | 12 +++++
 include/sbi/sbi_domain.h           |  9 ++++
 include/sbi/sbi_hart.h             | 25 +++++++++++
 include/sbi/sbi_types.h            |  2 +
 include/sbi_utils/fdt/fdt_helper.h |  2 +
 lib/sbi/sbi_domain.c               | 50 +++++++++++++++++++++
 lib/sbi/sbi_domain_context.c       |  3 ++
 lib/sbi/sbi_hart.c                 | 71 ++++++++++++++++++++++++++++++
 lib/sbi/sbi_hsm.c                  |  4 ++
 lib/sbi/sbi_init.c                 | 13 ++++++
 lib/utils/fdt/fdt_domain.c         | 15 +++++++
 lib/utils/fdt/fdt_helper.c         | 61 +++++++++++++++++++++++++
 platform/generic/platform.c        | 33 +++++++++++++-
 15 files changed, 324 insertions(+), 2 deletions(-)

-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 01/12] lib: sbi_hart: detect RISC-V Worlds ISA extensions

[Yu-Chien Peter Lin]

Add detection for RISC-V Worlds ISA extensions (Smwid, Smlwid,
Smlwidlist, Smwiddeleg, Sswid) via ISA string detection and
CSR probes.

These feature flags enable subsequent patches to conditionally
configure World ID CSRs and print boot-time Worlds status.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 include/sbi/riscv_encoding.h | 12 +++++++++
 include/sbi/sbi_hart.h       | 10 +++++++
 lib/sbi/sbi_hart.c           | 51 ++++++++++++++++++++++++++++++++++++
 3 files changed, 73 insertions(+)

diff --git a/include/sbi/riscv_encoding.h b/include/sbi/riscv_encoding.h
index ffe7666c..271820fd 100644
--- a/include/sbi/riscv_encoding.h
+++ b/include/sbi/riscv_encoding.h
@@ -400,6 +400,9 @@
 /* Supervisor Resource Management Configuration CSRs */
 #define CSR_SRMCFG			0x181
 
+/* Supervisor World-ID CSR (Sswid) */
+#define CSR_SLWID			0x190
+
 /* Machine-Level Control transfer records CSRs */
 #define CSR_MCTRCTL                     0x34e
 
@@ -520,6 +523,15 @@
 #define CSR_MTINST			0x34a
 #define CSR_MTVAL2			0x34b
 
+/* Machine World-ID CSRs (Smwid, Smlwid, Smlwidlist, Smwiddeleg) */
+#define CSR_MLWID			0x390
+#define CSR_MWID			0x391
+#define CSR_MWIDDELEG			0x748
+#define CSR_MLWIDLIST			0x749
+
+/* mwid lock bit */
+#define MWID_LOCK			(_UL(1) << (__riscv_xlen - 1))
+
 /* Machine Memory Protection */
 #define CSR_PMPCFG0			0x3a0
 #define CSR_PMPCFG1			0x3a1
diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
index 543393bb..2941809e 100644
--- a/include/sbi/sbi_hart.h
+++ b/include/sbi/sbi_hart.h
@@ -95,6 +95,16 @@ enum sbi_hart_extensions {
 	SBI_HART_EXT_F,
 	/** Hart has D extension */
 	SBI_HART_EXT_D,
+	/** Hart has Smwid extension */
+	SBI_HART_EXT_SMWID,
+	/** Hart has Smlwid extension */
+	SBI_HART_EXT_SMLWID,
+	/** Hart has Smlwidlist extension */
+	SBI_HART_EXT_SMLWIDLIST,
+	/** Hart has Smwiddeleg extension */
+	SBI_HART_EXT_SMWIDDELEG,
+	/** Hart has Sswid extension */
+	SBI_HART_EXT_SSWID,
 
 	/** Maximum index of Hart extension */
 	SBI_HART_EXT_MAX,
diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index 21713816..0c584bfc 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -402,6 +402,11 @@ const struct sbi_hart_ext_data sbi_hart_ext[] = {
 	__SBI_HART_EXT_DATA(v, SBI_HART_EXT_V),
 	__SBI_HART_EXT_DATA(f, SBI_HART_EXT_F),
 	__SBI_HART_EXT_DATA(d, SBI_HART_EXT_D),
+	__SBI_HART_EXT_DATA(smwid, SBI_HART_EXT_SMWID),
+	__SBI_HART_EXT_DATA(smlwid, SBI_HART_EXT_SMLWID),
+	__SBI_HART_EXT_DATA(smlwidlist, SBI_HART_EXT_SMLWIDLIST),
+	__SBI_HART_EXT_DATA(smwiddeleg, SBI_HART_EXT_SMWIDDELEG),
+	__SBI_HART_EXT_DATA(sswid, SBI_HART_EXT_SSWID),
 };
 
 _Static_assert(SBI_HART_EXT_MAX == array_size(sbi_hart_ext),
@@ -689,6 +694,52 @@ __pmp_skip:
 	/* Detect if hart support sdtrig (debug triggers) */
 	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
 			CSR_TSELECT, SBI_HART_EXT_SDTRIG);
+	/* Detect if hart supports Smwid (mwid CSR) */
+	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
+			CSR_MWID, SBI_HART_EXT_SMWID);
+	/* Detect if hart supports Smlwid (mlwid CSR) */
+	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
+			CSR_MLWID, SBI_HART_EXT_SMLWID);
+	/* Detect if hart supports Smlwidlist (mlwidlist CSR). */
+	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
+			CSR_MLWIDLIST, SBI_HART_EXT_SMLWIDLIST);
+	/*
+	 * Detect if hart supports Smwiddeleg & Sswid.
+	 * Smwiddeleg requires Smlwid. Sswid requires Smwiddeleg.
+	 */
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) {
+		unsigned long old_mwiddeleg, new_mwiddeleg;
+
+		old_mwiddeleg = csr_read_allowed(CSR_MWIDDELEG, &trap);
+		if (trap.cause)
+			goto skip_smwiddeleg;
+
+		csr_write_allowed(CSR_MWIDDELEG, &trap, ~0UL);
+		if (trap.cause)
+			goto skip_smwiddeleg;
+
+		new_mwiddeleg = csr_read_allowed(CSR_MWIDDELEG, &trap);
+		if (trap.cause) {
+			csr_write(CSR_MWIDDELEG, old_mwiddeleg);
+			goto skip_smwiddeleg;
+		}
+
+		if (new_mwiddeleg) {
+			__sbi_hart_update_extension(hfeatures,
+						    SBI_HART_EXT_SMWIDDELEG, true);
+
+			csr_read_allowed(CSR_SLWID, &trap);
+			if (!trap.cause) {
+				__sbi_hart_update_extension(hfeatures,
+							    SBI_HART_EXT_SSWID, true);
+			}
+		}
+
+		csr_write(CSR_MWIDDELEG, old_mwiddeleg);
+
+skip_smwiddeleg:
+		;
+	}
 
 #undef __check_ext_csr
 
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 02/12] lib: utils: fdt_helper: parse RISC-V Worlds DT properties

[Yu-Chien Peter Lin]

Add fdt_parse_worlds_all_harts() to parse RISC-V Worlds device tree
properties from CPU nodes:
  - riscv,pmwid (u32): Physical Machine World ID for this hart
  - riscv,pmwidlist (u64): Bitmap of permitted M-mode World IDs
  - riscv,pmlwidlist (u64): Bitmap of permitted S/U-mode World IDs

This patch extends the sbi_hart_features struct with new fields to
store the parsed World ID configuration (has_pmwid, pmwid, pmwidlist,
and pmlwidlist).

Link: https://lore.kernel.org/all/20260619105834.1277302-3-peter.lin@sifive.com/
Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 include/sbi/sbi_hart.h             | 15 ++++++++
 include/sbi_utils/fdt/fdt_helper.h |  2 +
 lib/utils/fdt/fdt_helper.c         | 61 ++++++++++++++++++++++++++++++
 platform/generic/platform.c        | 13 ++++++-
 4 files changed, 90 insertions(+), 1 deletion(-)

diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
index 2941809e..97072c09 100644
--- a/include/sbi/sbi_hart.h
+++ b/include/sbi/sbi_hart.h
@@ -135,6 +135,21 @@ struct sbi_hart_features {
 	unsigned int pmp_log2gran;
 	unsigned int mhpm_mask;
 	unsigned int mhpm_bits;
+	/** True if riscv,pmwid was present in DT */
+	bool has_pmwid;
+	u32 pmwid;
+	/**
+	 * Platform-defined bitmap of M-mode WIDs
+	 * (from DT riscv,pmwidlist). Zero means
+	 * absent/unrestricted.
+	 */
+	u64 pmwidlist;
+	/**
+	 * Platform-defined bitmap of S/U-mode WIDs
+	 * (from DT riscv,pmlwidlist). Zero means
+	 * absent/unrestricted.
+	 */
+	u64 pmlwidlist;
 };
 
 extern unsigned long hart_features_offset;
diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
index 75a564d1..3f3d091b 100644
--- a/include/sbi_utils/fdt/fdt_helper.h
+++ b/include/sbi_utils/fdt/fdt_helper.h
@@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
 
 int fdt_parse_isa_extensions_all_harts(const void *fdt);
 
+int fdt_parse_worlds_all_harts(const void *fdt);
+
 int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
 				struct platform_uart_data *uart);
 
diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
index ad4efaaf..8b40cd28 100644
--- a/lib/utils/fdt/fdt_helper.c
+++ b/lib/utils/fdt/fdt_helper.c
@@ -457,6 +457,67 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
 	return 0;
 }
 
+int fdt_parse_worlds_all_harts(const void *fdt)
+{
+	u32 hartid;
+	const fdt32_t *val;
+	struct sbi_scratch *scratch;
+	struct sbi_hart_features *hfeatures;
+	int err, cpu_offset, cpus_offset, len;
+
+	if (!fdt)
+		return SBI_EINVAL;
+
+	cpus_offset = fdt_path_offset(fdt, "/cpus");
+	if (cpus_offset < 0)
+		return cpus_offset;
+
+	fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
+		err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
+		if (err)
+			continue;
+
+		if (!fdt_node_is_enabled(fdt, cpu_offset))
+			continue;
+
+		scratch = sbi_hartid_to_scratch(hartid);
+		if (!scratch)
+			return SBI_ENOENT;
+
+		hfeatures = sbi_hart_features_ptr(scratch);
+		if (!hfeatures)
+			return SBI_ENOENT;
+
+		val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
+		if (val && len == sizeof(fdt32_t)) {
+			hfeatures->pmwid = fdt32_to_cpu(*val);
+			hfeatures->has_pmwid = true;
+		}
+
+		val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
+		if (val && len == 2 * sizeof(fdt32_t)) {
+			hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
+					        fdt32_to_cpu(val[1]);
+		}
+
+		val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
+		if (val && len == 2 * sizeof(fdt32_t)) {
+			hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
+					         fdt32_to_cpu(val[1]);
+		}
+
+		/* Sanity checks */
+		if (hfeatures->has_pmwid && (hfeatures->pmwid >= 64))
+			return SBI_EINVAL;
+		if (hfeatures->has_pmwid && hfeatures->pmwidlist &&
+		    !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
+			return SBI_EINVAL;
+		}
+	}
+
+	return 0;
+}
+
 static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
 				      struct platform_uart_data *uart,
 				      unsigned long default_freq,
diff --git a/platform/generic/platform.c b/platform/generic/platform.c
index 1df0280d..51e9f342 100644
--- a/platform/generic/platform.c
+++ b/platform/generic/platform.c
@@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
 
 int generic_extensions_init(bool cold_boot)
 {
+	int rc;
+
 	if (!cold_boot)
 		return 0;
 
 	/* Parse the ISA string from FDT and enable the listed extensions */
-	return fdt_parse_isa_extensions_all_harts(fdt_get_address());
+	rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
+	if (rc)
+		return rc;
+
+	/* Parse RISC-V Worlds CPU properties from FDT */
+	rc = fdt_parse_worlds_all_harts(fdt_get_address());
+	if (rc)
+		return rc;
+
+	return 0;
 }
 
 int generic_domains_init(void)
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 03/12] lib: sbi_hart: enforce riscv,pmwid for Worlds ISA

[Yu-Chien Peter Lin]

When Smwid/Smlwid extensions are detected during hart ISA detection,
the riscv,pmwid device tree property is required to specify the M-mode
WID default value.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 lib/sbi/sbi_hart.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index 0c584bfc..cb0c66ea 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -768,6 +768,19 @@ skip_smwiddeleg:
 	/* Mark hart feature detection done */
 	hfeatures->detected = true;
 
+	/*
+	 * Validate M-mode WID default value: if Worlds ISA extensions
+	 * are present, riscv,pmwid must exist in DT.
+	 */
+	if ((sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID) ||
+	     sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) &&
+	     !hfeatures->has_pmwid) {
+		sbi_printf("WARNING: hart%u has Worlds ISA extension but DT "
+			   "lacks riscv,pmwid.\n",
+			   current_hartid());
+		return SBI_EINVAL;
+	}
+
 	/*
 	 * On platforms with Smepmp, the previous booting stage must
 	 * enter OpenSBI with mseccfg.MML == 0. This allows OpenSBI
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 04/12] lib: sbi_hart: lock mwid CSR for RoT immutability

[Yu-Chien Peter Lin]

Lock the M-mode World ID (mwid) CSR during hart re-initialization to
enforce immutability of the WID established by the root-of-trust.

OpenSBI does not assign the WID value itself; it only sets MWID_LOCK
to freeze the value established by prior RoT stage. The MWID_LOCK bit
at XLEN-1 is sticky and makes the CSR read-only until reset, enforcing
a temporal security boundary per the RISC-V Worlds specification.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 lib/sbi/sbi_hart.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index cb0c66ea..4fbe46d7 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -804,6 +804,13 @@ int sbi_hart_reinit(struct sbi_scratch *scratch)
 	if (rc)
 		return rc;
 
+	/*
+	 * Assume MWID is restored by root-of-trust M-mode in previous
+	 * stage. Lock mwid so RoT-defined WID remains immutable.
+	 */
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID))
+		csr_set(CSR_MWID, MWID_LOCK);
+
 	return 0;
 }
 
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 05/12] include: sbi_domain: add Worlds WID fields

[Yu-Chien Peter Lin]

Adds next_wid (u32 WID for next boot stage), has_next_wid (distinguishes
explicit zero from unset for pmwid fallback), and next_widlist (u64 bitmask
specifying which WIDs can be delegated to this domain) to sbi_domain
structure. Enables per-domain World ID configuration.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 include/sbi/sbi_domain.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/sbi/sbi_domain.h b/include/sbi/sbi_domain.h
index 16edd4ce..7d523493 100644
--- a/include/sbi/sbi_domain.h
+++ b/include/sbi/sbi_domain.h
@@ -211,6 +211,12 @@ struct sbi_domain {
 	unsigned long next_addr;
 	/** Privilege mode of next booting stage for this domain */
 	unsigned long next_mode;
+	/** Next booting stage World ID for this domain */
+	u32 next_wid;
+	/** Whether next_wid was explicitly set */
+	bool has_next_wid;
+	/** Next booting stage World ID delegation bitmask for this domain */
+	u64 next_widlist;
 	/** Is domain allowed to reset the system */
 	bool system_reset_allowed;
 	/** Is domain allowed to suspend the system */
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 06/12] include: sbi_types: add PRIx64 format macro

[Yu-Chien Peter Lin]

Adds PRIx64 for portable 64-bit hex printing. Expands to "016lx" on RV64
(long is 64-bit), "016llx" on RV32 (long long is 64-bit). Enables
consistent printf-style formatting of uint64_t values with 16-digit
zero-padded output across XLEN configurations.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 include/sbi/sbi_types.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/sbi/sbi_types.h b/include/sbi/sbi_types.h
index b8a7e6cb..780a4c2a 100644
--- a/include/sbi/sbi_types.h
+++ b/include/sbi/sbi_types.h
@@ -34,12 +34,14 @@ typedef unsigned long		u64;
 typedef long			int64_t;
 typedef unsigned long		uint64_t;
 #define PRILX			"016lx"
+#define PRIx64			"016lx"
 #elif __riscv_xlen == 32
 typedef long long		s64;
 typedef unsigned long long	u64;
 typedef long long		int64_t;
 typedef unsigned long long	uint64_t;
 #define PRILX			"08lx"
+#define PRIx64			"016llx"
 #else
 #error "Unexpected __riscv_xlen"
 #endif
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 07/12] lib: sbi_domain: print World ID config at boot

[Yu-Chien Peter Lin]

Extends sbi_domain_dump() to display World ID configuration
(next_wid and next_widlist) for each domain at boot. Provides
boot-time diagnostic visibility for debugging and verification.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 lib/sbi/sbi_domain.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
index fa69170b..443aa60b 100644
--- a/lib/sbi/sbi_domain.c
+++ b/lib/sbi/sbi_domain.c
@@ -10,6 +10,7 @@
 #include <sbi/riscv_asm.h>
 #include <sbi/sbi_console.h>
 #include <sbi/sbi_domain.h>
+#include <sbi/sbi_hart.h>
 #include <sbi/sbi_hartmask.h>
 #include <sbi/sbi_heap.h>
 #include <sbi/sbi_hsm.h>
@@ -608,6 +609,31 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
 		break;
 	}
 
+	if (sbi_hart_has_extension(sbi_scratch_thishart_ptr(),
+				   SBI_HART_EXT_SMLWID)) {
+		if (dom->has_next_wid)
+			sbi_printf("Domain%d Next Wid    %s: %u\n",
+				   dom->index, suffix, dom->next_wid);
+		else {
+			struct sbi_scratch *scratch = sbi_scratch_thishart_ptr();
+			const struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
+			sbi_printf("Domain%d Next Wid    %s: %u (pmwid)\n",
+				   dom->index, suffix, hf->pmwid);
+		}
+	} else {
+		sbi_printf("Domain%d Next Wid    %s: unsupported\n",
+			   dom->index, suffix);
+	}
+
+	if (sbi_hart_has_extension(sbi_scratch_thishart_ptr(),
+				   SBI_HART_EXT_SMWIDDELEG)) {
+		sbi_printf("Domain%d Next Widlist%s: 0x%" PRIx64 "\n",
+			   dom->index, suffix, dom->next_widlist);
+	} else {
+		sbi_printf("Domain%d Next Widlist%s: unsupported\n",
+			   dom->index, suffix);
+	}
+
 	sbi_printf("Domain%d SysReset    %s: %s\n",
 		   dom->index, suffix, (dom->system_reset_allowed) ? "yes" : "no");
 
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 08/12] lib: sbi_init: print M-mode World ID at boot

[Yu-Chien Peter Lin]

This extends sbi_boot_print_hart() to display M-mode World ID
configuration during initialization. Shows mwid value from CSR_MWID
and lock status for Smwid extension, pmwid value from DT when
available, or "unsupported" message. Provides visibility into Worlds
configuration at boot for verification.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 lib/sbi/sbi_init.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/sbi/sbi_init.c b/lib/sbi/sbi_init.c
index 658fe37f..1fb79eae 100644
--- a/lib/sbi/sbi_init.c
+++ b/lib/sbi/sbi_init.c
@@ -169,6 +169,7 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
 	int xlen;
 	char str[256];
 	const struct sbi_domain *dom = sbi_domain_thishart_ptr();
+	struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
 
 	if (scratch->options & SBI_SCRATCH_NO_BOOT_PRINTS)
 		return;
@@ -201,6 +202,18 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
 	sbi_printf("Boot HART Debug Triggers    : %d triggers\n",
 		   sbi_dbtr_get_total_triggers());
 	sbi_hart_delegation_dump(scratch, "Boot HART ", "           ");
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID)) {
+		ulong mwid = csr_read(CSR_MWID);
+
+		sbi_printf("Boot HART M-mode World ID   : %lu (%s)\n",
+			   mwid & ~MWID_LOCK,
+			   (mwid & MWID_LOCK) ? "locked" : "unlocked");
+	} else if (hf->has_pmwid) {
+		sbi_printf("Boot HART M-mode World ID   : %u (pmwid)\n",
+			   hf->pmwid);
+	} else {
+		sbi_printf("Boot HART M-mode World ID   : unsupported\n");
+	}
 }
 
 static unsigned long coldboot_done;
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 09/12] platform: generic: parse root domain WID config from DT

[Yu-Chien Peter Lin]

Parse root-domain-next-wid (32-bit) and root-domain-next-widlist
(64-bit) properties from /chosen/opensbi,config node during
generic_domains_init(). Sets root.next_wid/has_next_wid and
root.next_widlist.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 platform/generic/platform.c | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/platform/generic/platform.c b/platform/generic/platform.c
index 51e9f342..de12deb5 100644
--- a/platform/generic/platform.c
+++ b/platform/generic/platform.c
@@ -11,6 +11,7 @@
 #include <platform_override.h>
 #include <sbi/riscv_asm.h>
 #include <sbi/sbi_bitops.h>
+#include <sbi/sbi_domain.h>
 #include <sbi/sbi_hartmask.h>
 #include <sbi/sbi_heap.h>
 #include <sbi/sbi_platform.h>
@@ -276,7 +277,9 @@ int generic_extensions_init(bool cold_boot)
 int generic_domains_init(void)
 {
 	const void *fdt = fdt_get_address();
-	int offset, ret;
+	const fdt32_t *val;
+	int len, offset, ret;
+	u64 val64;
 
 	ret = fdt_domains_populate(fdt);
 	if (ret < 0)
@@ -290,6 +293,21 @@ int generic_domains_init(void)
 		if (offset >= 0 &&
 		    fdt_get_property(fdt, offset, "system-suspend-test", NULL))
 			sbi_system_suspend_test_enable();
+
+		if (offset >= 0) {
+			val = fdt_getprop(fdt, offset, "root-domain-next-wid", &len);
+			if (val && len == sizeof(fdt32_t)) {
+				root.next_wid = fdt32_to_cpu(val[0]);
+				root.has_next_wid = true;
+			}
+
+			val = fdt_getprop(fdt, offset, "root-domain-next-widlist", &len);
+			if (val && (len == (2 * sizeof(fdt32_t)))) {
+				val64 = fdt32_to_cpu(val[0]);
+				val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
+				root.next_widlist = val64;
+			}
+		}
 	}
 
 	return 0;
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 10/12] lib: utils: fdt_domain: parse per-domain WID properties

[Yu-Chien Peter Lin]

Extends __fdt_parse_domain() to parse next-wid (32-bit WID) and
next-widlist (64-bit delegation mask) from domain DT nodes. Enables
per-domain World ID configuration. Stores in sbi_domain structure
for mlwid/mwiddeleg CSR programming during domain context switches.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 lib/utils/fdt/fdt_domain.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/lib/utils/fdt/fdt_domain.c b/lib/utils/fdt/fdt_domain.c
index 61627db3..0849c4d0 100644
--- a/lib/utils/fdt/fdt_domain.c
+++ b/lib/utils/fdt/fdt_domain.c
@@ -469,6 +469,21 @@ static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
 	}
 	dom->next_mode = val32;
 
+	/* Read "next-wid" DT property */
+	val = fdt_getprop(fdt, domain_offset, "next-wid", &len);
+	if (val && len == sizeof(fdt32_t)) {
+		dom->next_wid = fdt32_to_cpu(val[0]);
+		dom->has_next_wid = true;
+	}
+
+	/* Read "next-widlist" DT property */
+	val = fdt_getprop(fdt, domain_offset, "next-widlist", &len);
+	if (val && (len == (2 * sizeof(fdt32_t)))) {
+		val64 = fdt32_to_cpu(val[0]);
+		val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
+		dom->next_widlist = val64;
+	}
+
 	/* Read "system-reset-allowed" DT property */
 	if (fdt_get_property(fdt, domain_offset,
 			     "system-reset-allowed", NULL))
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 11/12] lib: sbi_domain: add Worlds CSR config on domain entry

[Yu-Chien Peter Lin]

Add sbi_domain_worlds_enter() to configure mlwid and mwiddeleg
CSRs when entering a domain. Called during domain context switches,
hart start, and hart resume. Ensures proper World ID isolation
across domain boundaries.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 include/sbi/sbi_domain.h     |  3 +++
 lib/sbi/sbi_domain.c         | 24 ++++++++++++++++++++++++
 lib/sbi/sbi_domain_context.c |  3 +++
 lib/sbi/sbi_hsm.c            |  4 ++++
 4 files changed, 34 insertions(+)

diff --git a/include/sbi/sbi_domain.h b/include/sbi/sbi_domain.h
index 7d523493..b54bd952 100644
--- a/include/sbi/sbi_domain.h
+++ b/include/sbi/sbi_domain.h
@@ -331,6 +331,9 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix);
 /** Dump all domain details on the console */
 void sbi_domain_dump_all(const char *suffix);
 
+/** Apply Worlds CSR state */
+void sbi_domain_worlds_enter(const struct sbi_domain *dom);
+
 /**
  * Register a new domain
  * @param dom pointer to domain
diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
index 443aa60b..c0c9b315 100644
--- a/lib/sbi/sbi_domain.c
+++ b/lib/sbi/sbi_domain.c
@@ -93,6 +93,30 @@ int sbi_domain_get_assigned_hartmask(const struct sbi_domain *dom,
 	return ret;
 }
 
+void sbi_domain_worlds_enter(const struct sbi_domain *dom)
+{
+	struct sbi_scratch *scratch = sbi_scratch_thishart_ptr();
+	const struct sbi_hart_features *hf;
+	unsigned long mlwid_val;
+
+	if (!dom || !scratch)
+		return;
+
+	hf = sbi_hart_features_ptr(scratch);
+	if (!hf) {
+		sbi_panic("%s: hart%u features not initialized\n",
+			  __func__, current_hartid());
+	}
+
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) {
+		mlwid_val = (dom->has_next_wid) ? dom->next_wid : hf->pmwid;
+		csr_write(CSR_MLWID, mlwid_val);
+	}
+
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG))
+		csr_write(CSR_MWIDDELEG, dom->next_widlist);
+}
+
 void sbi_domain_memregion_init(unsigned long addr,
 				unsigned long size,
 				unsigned long flags,
diff --git a/lib/sbi/sbi_domain_context.c b/lib/sbi/sbi_domain_context.c
index cc4cc04d..1fb05c07 100644
--- a/lib/sbi/sbi_domain_context.c
+++ b/lib/sbi/sbi_domain_context.c
@@ -174,6 +174,9 @@ static int switch_to_next_domain_context(struct hart_context *ctx,
 	sbi_hart_protection_unconfigure(scratch);
 	sbi_hart_protection_configure(scratch);
 
+	/* Apply target domain's Worlds state */
+	sbi_domain_worlds_enter(dom_ctx->dom);
+
 	/* Mark current context structure initialized because context saved */
 	ctx->initialized = true;
 
diff --git a/lib/sbi/sbi_hsm.c b/lib/sbi/sbi_hsm.c
index 0a355f9c..82856da6 100644
--- a/lib/sbi/sbi_hsm.c
+++ b/lib/sbi/sbi_hsm.c
@@ -154,6 +154,8 @@ void __noreturn sbi_hsm_hart_start_finish(struct sbi_scratch *scratch,
 	next_mode = scratch->next_mode;
 	hsm_start_ticket_release(hdata);
 
+	sbi_domain_worlds_enter(sbi_domain_thishart_ptr());
+
 	sbi_hart_switch_mode(hartid, next_arg1, next_addr, next_mode, false);
 }
 
@@ -478,6 +480,8 @@ void __noreturn sbi_hsm_hart_resume_finish(struct sbi_scratch *scratch,
 	 */
 	__sbi_hsm_suspend_non_ret_restore(scratch);
 
+	sbi_domain_worlds_enter(sbi_domain_thishart_ptr());
+
 	sbi_hart_switch_mode(hartid, scratch->next_arg1,
 			     scratch->next_addr,
 			     scratch->next_mode, false);
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[RFC PATCH 12/12] docs: add RISC-V Worlds next-wid/next-widlist DT properties

[Yu-Chien Peter Lin]

Add device tree bindings for RISC-V Worlds support in OpenSBI
domains. These properties enable per-domain world isolation.

Per-domain properties:
  * next-wid - Sets mlwid CSR (requires Smlwid extension)
  * next-widlist - Sets mwiddeleg CSR (requires Smwiddeleg extension)

ROOT domain properties (in /chosen/opensbi-config):
  * root-domain-next-wid - mlwid for ROOT domain
  * root-domain-next-widlist - mwiddeleg for ROOT domain

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 docs/domain_support.md | 13 +++++++++++++
 docs/opensbi_config.md | 13 +++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/docs/domain_support.md b/docs/domain_support.md
index e267a9f7..164d87e6 100644
--- a/docs/domain_support.md
+++ b/docs/domain_support.md
@@ -91,6 +91,8 @@ following manner:
   is the next arg1 for the ROOT domain
 * **next_mode** - Next booting stage mode in coldboot HART scratch space
   is the next mode for the ROOT domain
+* **next_wid** - Next booting stage World ID
+* **next_widlist** - Next booting stage World ID delegation bitmask
 * **system_reset_allowed** - The ROOT domain is allowed to reset the system
 * **system_suspend_allowed** - The ROOT domain is allowed to suspend the system
 
@@ -200,6 +202,17 @@ The DT properties of a domain instance DT node are as follows:
   is used as default value. If this DT property is not available and
   coldboot HART is assigned to the domain instance then **next booting
   stage mode of coldboot HART** is used as default value.
+* **next-wid** (Optional) - The 32 bit World ID for lower-privilege modes
+  (S/U-mode) for the domain instance. If present, OpenSBI writes this value
+  to **mlwid** on context switch into this domain (requires Smlwid extension).
+  If absent, OpenSBI uses the platform M-mode WID from the **riscv,pmwid** DT
+  property as fallback, in which case the value must be identical across all
+  HARTs assigned to the domain. In either case, the value written to **mlwid**
+  must be permitted by **pmlwidlist** on every HART assigned to the domain.
+* **next-widlist** (Optional) - The 64 bit World ID delegation bitmask for
+  the domain instance. If present, OpenSBI writes this value to **mwiddeleg**
+  on context switch into this domain (requires Smwiddeleg extension). If absent,
+  clears **mwiddeleg** to disable S-mode WID delegation.
 * **system-reset-allowed** (Optional) - A boolean flag representing
   whether the domain instance is allowed to do system reset.
 * **system-suspend-allowed** (Optional) - A boolean flag representing
diff --git a/docs/opensbi_config.md b/docs/opensbi_config.md
index 104d82c9..b7210dfc 100644
--- a/docs/opensbi_config.md
+++ b/docs/opensbi_config.md
@@ -29,6 +29,19 @@ The DT properties of a domain configuration DT node are as follows:
 * **system-suspend-test** (Optional) - When present, enable a system
   suspend test implementation which simply waits five seconds and issues a WFI.
 
+* **root-domain-next-wid** (Optional) - The 32 bit World ID for lower-privilege
+  modes (S/U-mode) for the ROOT domain. If present, OpenSBI writes this value
+  to **mlwid** when entering the ROOT domain (requires Smlwid extension). If not
+  set, OpenSBI uses the platform M-mode WID from the **riscv,pmwid** DT property
+  as fallback, in which case the value must be identical across all HARTs assigned
+  to the ROOT domain. In either case, the value written to **mlwid** must be
+  permitted by **pmlwidlist** on every HART assigned to the ROOT domain.
+
+* **root-domain-next-widlist** (Optional) - The 64 bit World ID delegation bitmask
+  for the ROOT domain. If present, OpenSBI writes this value to **mwiddeleg** when
+  entering the ROOT domain (requires Smwiddeleg extension). If not set, clears
+  **mwiddeleg** to disable S-mode WID delegation.
+
 The OpenSBI Configuration Node will be deleted at the end of cold boot
 (replace the node (subtree) with nop tags).
 
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 02/12] lib: utils: fdt_helper: parse RISC-V Worlds DT properties

[Pawandeep Oza]

On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add fdt_parse_worlds_all_harts() to parse RISC-V Worlds device tree
> properties from CPU nodes:
>   - riscv,pmwid (u32): Physical Machine World ID for this hart
>   - riscv,pmwidlist (u64): Bitmap of permitted M-mode World IDs
>   - riscv,pmlwidlist (u64): Bitmap of permitted S/U-mode World IDs
>
> This patch extends the sbi_hart_features struct with new fields to
> store the parsed World ID configuration (has_pmwid, pmwid, pmwidlist,
> and pmlwidlist).
>
> Link: https://lore.kernel.org/all/20260619105834.1277302-3-peter.lin@sifive.com/
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  include/sbi/sbi_hart.h             | 15 ++++++++
>  include/sbi_utils/fdt/fdt_helper.h |  2 +
>  lib/utils/fdt/fdt_helper.c         | 61 ++++++++++++++++++++++++++++++
>  platform/generic/platform.c        | 13 ++++++-
>  4 files changed, 90 insertions(+), 1 deletion(-)
>
> diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> index 2941809e..97072c09 100644
> --- a/include/sbi/sbi_hart.h
> +++ b/include/sbi/sbi_hart.h
> @@ -135,6 +135,21 @@ struct sbi_hart_features {
>         unsigned int pmp_log2gran;
>         unsigned int mhpm_mask;
>         unsigned int mhpm_bits;
> +       /** True if riscv,pmwid was present in DT */
> +       bool has_pmwid;
> +       u32 pmwid;
> +       /**
> +        * Platform-defined bitmap of M-mode WIDs
> +        * (from DT riscv,pmwidlist). Zero means
> +        * absent/unrestricted.
> +        */
> +       u64 pmwidlist;
> +       /**
> +        * Platform-defined bitmap of S/U-mode WIDs
> +        * (from DT riscv,pmlwidlist). Zero means
> +        * absent/unrestricted.
> +        */
> +       u64 pmlwidlist;
>  };
>
>  extern unsigned long hart_features_offset;
> diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
> index 75a564d1..3f3d091b 100644
> --- a/include/sbi_utils/fdt/fdt_helper.h
> +++ b/include/sbi_utils/fdt/fdt_helper.h
> @@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
>
>  int fdt_parse_isa_extensions_all_harts(const void *fdt);
>
> +int fdt_parse_worlds_all_harts(const void *fdt);
> +
>  int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
>                                 struct platform_uart_data *uart);
>
> diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
> index ad4efaaf..8b40cd28 100644
> --- a/lib/utils/fdt/fdt_helper.c
> +++ b/lib/utils/fdt/fdt_helper.c
> @@ -457,6 +457,67 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
>         return 0;
>  }
>
> +int fdt_parse_worlds_all_harts(const void *fdt)
> +{
> +       u32 hartid;
> +       const fdt32_t *val;
> +       struct sbi_scratch *scratch;
> +       struct sbi_hart_features *hfeatures;
> +       int err, cpu_offset, cpus_offset, len;
> +
> +       if (!fdt)
> +               return SBI_EINVAL;
> +
> +       cpus_offset = fdt_path_offset(fdt, "/cpus");
> +       if (cpus_offset < 0)
> +               return cpus_offset;
> +
> +       fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
what about riscv,nworlds ? I think you should parse this and based on
that assume wid range - and rest of the wids should be rejected.
> +               err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
> +               if (err)
> +                       continue;
> +
> +               if (!fdt_node_is_enabled(fdt, cpu_offset))
> +                       continue;
> +
> +               scratch = sbi_hartid_to_scratch(hartid);
> +               if (!scratch)
> +                       return SBI_ENOENT;
> +
> +               hfeatures = sbi_hart_features_ptr(scratch);
> +               if (!hfeatures)
> +                       return SBI_ENOENT;
> +
> +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
> +               if (val && len == sizeof(fdt32_t)) {
> +                       hfeatures->pmwid = fdt32_to_cpu(*val);
> +                       hfeatures->has_pmwid = true;
> +               }
> +
> +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
> +               if (val && len == 2 * sizeof(fdt32_t)) {
> +                       hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> +                                               fdt32_to_cpu(val[1]);
> +               }
Oza: provide some defines for magic numbers.
> +
> +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
> +               if (val && len == 2 * sizeof(fdt32_t)) {
> +                       hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> +                                                fdt32_to_cpu(val[1]);
> +               }
> +
> +               /* Sanity checks */
> +               if (hfeatures->has_pmwid && (hfeatures->pmwid >= 64))
Oza:  features->pmwid >=nworlds ?
> +                       return SBI_EINVAL;
> +               if (hfeatures->has_pmwid && hfeatures->pmwidlist &&
> +                   !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
> +                       return SBI_EINVAL;
> +               }
> +       }
> +
> +       return 0;
> +}
> +
>  static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
>                                       struct platform_uart_data *uart,
>                                       unsigned long default_freq,
> diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> index 1df0280d..51e9f342 100644
> --- a/platform/generic/platform.c
> +++ b/platform/generic/platform.c
> @@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
>
>  int generic_extensions_init(bool cold_boot)
>  {
> +       int rc;
> +
>         if (!cold_boot)
>                 return 0;
>
>         /* Parse the ISA string from FDT and enable the listed extensions */
> -       return fdt_parse_isa_extensions_all_harts(fdt_get_address());
> +       rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
> +       if (rc)
> +               return rc;
> +
> +       /* Parse RISC-V Worlds CPU properties from FDT */
> +       rc = fdt_parse_worlds_all_harts(fdt_get_address());
> +       if (rc)
> +               return rc;
> +
> +       return 0;
>  }
>
>  int generic_domains_init(void)
> --
> 2.43.7
>
>
> --
> opensbi mailing list
> opensbi@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 09/12] platform: generic: parse root domain WID config from DT

[Pawandeep Oza]

On Fri, Jun 26, 2026 at 3:17 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Parse root-domain-next-wid (32-bit) and root-domain-next-widlist
> (64-bit) properties from /chosen/opensbi,config node during
> generic_domains_init(). Sets root.next_wid/has_next_wid and
> root.next_widlist.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  platform/generic/platform.c | 20 +++++++++++++++++++-
>  1 file changed, 19 insertions(+), 1 deletion(-)
>
> diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> index 51e9f342..de12deb5 100644
> --- a/platform/generic/platform.c
> +++ b/platform/generic/platform.c
> @@ -11,6 +11,7 @@
>  #include <platform_override.h>
>  #include <sbi/riscv_asm.h>
>  #include <sbi/sbi_bitops.h>
> +#include <sbi/sbi_domain.h>
>  #include <sbi/sbi_hartmask.h>
>  #include <sbi/sbi_heap.h>
>  #include <sbi/sbi_platform.h>
> @@ -276,7 +277,9 @@ int generic_extensions_init(bool cold_boot)
>  int generic_domains_init(void)
>  {
>         const void *fdt = fdt_get_address();
> -       int offset, ret;
> +       const fdt32_t *val;
> +       int len, offset, ret;
> +       u64 val64;
>
>         ret = fdt_domains_populate(fdt);
>         if (ret < 0)
> @@ -290,6 +293,21 @@ int generic_domains_init(void)
>                 if (offset >= 0 &&
>                     fdt_get_property(fdt, offset, "system-suspend-test", NULL))
>                         sbi_system_suspend_test_enable();
> +
> +               if (offset >= 0) {
> +                       val = fdt_getprop(fdt, offset, "root-domain-next-wid", &len);
> +                       if (val && len == sizeof(fdt32_t)) {
> +                               root.next_wid = fdt32_to_cpu(val[0]);
> +                               root.has_next_wid = true;
> +                       }
> +
> +                       val = fdt_getprop(fdt, offset, "root-domain-next-widlist", &len);
Oza: Root domain WID config is semantically identical to per-domain
WID config but lives in a completely different DT location
root can be another default domain under chosen { opensbi-domains {
> +                       if (val && (len == (2 * sizeof(fdt32_t)))) {
> +                               val64 = fdt32_to_cpu(val[0]);
> +                               val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
> +                               root.next_widlist = val64;
> +                       }
> +               }
>         }
>
>         return 0;
> --
> 2.43.7
>
>
> --
> opensbi mailing list
> opensbi@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 02/12] lib: utils: fdt_helper: parse RISC-V Worlds DT properties

[Pawandeep Oza]

On Wed, Jul 8, 2026 at 5:36 PM Pawandeep Oza
<pawandeep.oza@oss.qualcomm.com> wrote:
>
> On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Add fdt_parse_worlds_all_harts() to parse RISC-V Worlds device tree
> > properties from CPU nodes:
> >   - riscv,pmwid (u32): Physical Machine World ID for this hart
> >   - riscv,pmwidlist (u64): Bitmap of permitted M-mode World IDs
> >   - riscv,pmlwidlist (u64): Bitmap of permitted S/U-mode World IDs
> >
> > This patch extends the sbi_hart_features struct with new fields to
> > store the parsed World ID configuration (has_pmwid, pmwid, pmwidlist,
> > and pmlwidlist).
> >
> > Link: https://lore.kernel.org/all/20260619105834.1277302-3-peter.lin@sifive.com/
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> >  include/sbi/sbi_hart.h             | 15 ++++++++
> >  include/sbi_utils/fdt/fdt_helper.h |  2 +
> >  lib/utils/fdt/fdt_helper.c         | 61 ++++++++++++++++++++++++++++++
> >  platform/generic/platform.c        | 13 ++++++-
> >  4 files changed, 90 insertions(+), 1 deletion(-)
> >
> > diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> > index 2941809e..97072c09 100644
> > --- a/include/sbi/sbi_hart.h
> > +++ b/include/sbi/sbi_hart.h
> > @@ -135,6 +135,21 @@ struct sbi_hart_features {
> >         unsigned int pmp_log2gran;
> >         unsigned int mhpm_mask;
> >         unsigned int mhpm_bits;
> > +       /** True if riscv,pmwid was present in DT */
> > +       bool has_pmwid;
> > +       u32 pmwid;
> > +       /**
> > +        * Platform-defined bitmap of M-mode WIDs
> > +        * (from DT riscv,pmwidlist). Zero means
> > +        * absent/unrestricted.
> > +        */
> > +       u64 pmwidlist;
> > +       /**
> > +        * Platform-defined bitmap of S/U-mode WIDs
> > +        * (from DT riscv,pmlwidlist). Zero means
> > +        * absent/unrestricted.
> > +        */
> > +       u64 pmlwidlist;
Oza: pmlwidlist defines which WIDs M-mode is permitted to assign to
S-mode. But next-wid is never validated against it.
> >  };
> >
> >  extern unsigned long hart_features_offset;
> > diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
> > index 75a564d1..3f3d091b 100644
> > --- a/include/sbi_utils/fdt/fdt_helper.h
> > +++ b/include/sbi_utils/fdt/fdt_helper.h
> > @@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
> >
> >  int fdt_parse_isa_extensions_all_harts(const void *fdt);
> >
> > +int fdt_parse_worlds_all_harts(const void *fdt);
> > +
> >  int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
> >                                 struct platform_uart_data *uart);
> >
> > diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
> > index ad4efaaf..8b40cd28 100644
> > --- a/lib/utils/fdt/fdt_helper.c
> > +++ b/lib/utils/fdt/fdt_helper.c
> > @@ -457,6 +457,67 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
> >         return 0;
> >  }
> >
> > +int fdt_parse_worlds_all_harts(const void *fdt)
> > +{
> > +       u32 hartid;
> > +       const fdt32_t *val;
> > +       struct sbi_scratch *scratch;
> > +       struct sbi_hart_features *hfeatures;
> > +       int err, cpu_offset, cpus_offset, len;
> > +
> > +       if (!fdt)
> > +               return SBI_EINVAL;
> > +
> > +       cpus_offset = fdt_path_offset(fdt, "/cpus");
> > +       if (cpus_offset < 0)
> > +               return cpus_offset;
> > +
> > +       fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
> what about riscv,nworlds ? I think you should parse this and based on
> that assume wid range - and rest of the wids should be rejected.
> > +               err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
> > +               if (err)
> > +                       continue;
> > +
> > +               if (!fdt_node_is_enabled(fdt, cpu_offset))
> > +                       continue;
> > +
> > +               scratch = sbi_hartid_to_scratch(hartid);
> > +               if (!scratch)
> > +                       return SBI_ENOENT;
> > +
> > +               hfeatures = sbi_hart_features_ptr(scratch);
> > +               if (!hfeatures)
> > +                       return SBI_ENOENT;
> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
> > +               if (val && len == sizeof(fdt32_t)) {
> > +                       hfeatures->pmwid = fdt32_to_cpu(*val);
> > +                       hfeatures->has_pmwid = true;
> > +               }
Oza: Nothing prevents assigning the same WID to both M-mode and S-mode
- should not be identical for both worlds.
> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
> > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > +                       hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > +                                               fdt32_to_cpu(val[1]);
> > +               }
> Oza: provide some defines for magic numbers.
> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
> > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > +                       hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > +                                                fdt32_to_cpu(val[1]);
> > +               }
> > +
> > +               /* Sanity checks */
> > +               if (hfeatures->has_pmwid && (hfeatures->pmwid >= 64))
> Oza:  features->pmwid >=nworlds ?
> > +                       return SBI_EINVAL;
> > +               if (hfeatures->has_pmwid && hfeatures->pmwidlist &&
> > +                   !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
> > +                       return SBI_EINVAL;
> > +               }
> > +       }
> > +
> > +       return 0;
> > +}
> > +
> >  static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
> >                                       struct platform_uart_data *uart,
> >                                       unsigned long default_freq,
> > diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> > index 1df0280d..51e9f342 100644
> > --- a/platform/generic/platform.c
> > +++ b/platform/generic/platform.c
> > @@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
> >
> >  int generic_extensions_init(bool cold_boot)
> >  {
> > +       int rc;
> > +
> >         if (!cold_boot)
> >                 return 0;
> >
> >         /* Parse the ISA string from FDT and enable the listed extensions */
> > -       return fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > +       rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > +       if (rc)
> > +               return rc;
> > +
> > +       /* Parse RISC-V Worlds CPU properties from FDT */
> > +       rc = fdt_parse_worlds_all_harts(fdt_get_address());
> > +       if (rc)
> > +               return rc;
> > +
> > +       return 0;
> >  }
> >
> >  int generic_domains_init(void)
> > --
> > 2.43.7
> >
> >
> > --
> > opensbi mailing list
> > opensbi@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 00/12] Add RISC-V Worlds ISA support to OpenSBI

[Pawandeep Oza]

On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:

Oza: I have started reviewing this series, and will provide comments
in coming days.
>
> This RFC patch series adds support for RISC-V Worlds ISA extensions,
> enabling hardware-enforced isolation boundaries based on World IDs (WIDs)
> by extending the OpenSBI domain framework.
>
> Trust Model and Boot-time Roles
> --------------------------------
>
> The implementation follows the two-phase M-mode trust model:
>
> - RoT M-mode phase: Prior boot stage (ROM/SPL) that may program mwid/
>   mlwidlist and lock mwid before handing off to OpenSBI.
>
> - Regular M-mode phase (OpenSBI): Treats pmwid/pmwidlist/pmlwidlist as
>   read-only input policy from hardware/RoT. Locks mwid during feature
>   detection to prevent later M-mode code from changing its own WID.
>   Programs per-domain mlwid/mwiddeleg based on DT configuration.
>
> Device Tree Bindings
> ---------------------
>
> New CPU properties (per-hart):
> - riscv,pmwid: Platform-defined M-mode World ID
> - riscv,pmwidlist: M-mode permitted WID bitmap (u64, 2 cells)
> - riscv,pmlwidlist: S/U-mode permitted WID bitmap (u64, 2 cells)
>
> New domain properties (per-domain):
> - next-wid: Override S-mode WID for this domain (u32, 1 cell)
> - next-widlist: WID delegation bitmap for this domain (u64, 2 cells)
>
> If a domain lacks next-wid, OpenSBI falls back to pmwid (M-mode and
> S-mode run in the same World).
>
> Example DT snippet:
>
>     cpus {
>         riscv,nworlds = <4>;
>         cpu@0 {
>             riscv,pmwid = <3>;
>             riscv,pmwidlist = <0x0 0xf>;
>             riscv,pmlwidlist = <0x0 0xf>;
>         };
>     };
>
>     chosen {
>         opensbi-domains {
>             trusted-domain {
>                 next-wid = <1>;
>                 next-widlist = <0x0 0x2>;
>             };
>             untrusted-domain {
>                 next-wid = <0>;
>                 next-widlist = <0x0 0x1>;
>             };
>         };
>     };
>
> Known Limitations and Future Work
> ----------------------------------
>
> This RFC implements core functionality but has several areas requiring
> refinement in the future revisions:
>
> 1. WID Validation:
>    - Domain next-wid is NOT validated against pmlwidlist
>    - Domain next-widlist is NOT validated as subset of pmlwidlist
>    - Invalid WID configuration fails at runtime with software-check
>      exceptions rather than at domain registration time
>    - Planned: Add validation in sanitize_domain() to catch errors early
>
> 2. Resume Path mwid Restoration:
>    - Current implementation only re-locks mwid on resume, assuming RoT
>      has already restored the correct WID value
>    - No mechanism to verify or actively restore mwid to RoT-defined value
>
> Specification References
> -------------------------
>
> - RISC-V Worlds ISA Spec: https://github.com/riscv/riscv-worlds
>   (Release: riscv-isa-release-4c81a3f-2026-04-14)
> - Device Tree Proposal: https://lore.kernel.org/all/20260619105834.1277302-1-peter.lin@sifive.com/
>
> Yu-Chien Peter Lin (12):
>   lib: sbi_hart: detect RISC-V Worlds ISA extensions
>   lib: utils: fdt_helper: parse RISC-V Worlds DT properties
>   lib: sbi_hart: enforce riscv,pmwid for Worlds ISA
>   lib: sbi_hart: lock mwid CSR for RoT immutability
>   include: sbi_domain: add Worlds WID fields
>   include: sbi_types: add PRIx64 format macro
>   lib: sbi_domain: print World ID config at boot
>   lib: sbi_init: print M-mode World ID at boot
>   platform: generic: parse root domain WID config from DT
>   lib: utils: fdt_domain: parse per-domain WID properties
>   lib: sbi_domain: add Worlds CSR config on domain entry
>   docs: add RISC-V Worlds next-wid/next-widlist DT properties
>
>  docs/domain_support.md             | 13 ++++++
>  docs/opensbi_config.md             | 13 ++++++
>  include/sbi/riscv_encoding.h       | 12 +++++
>  include/sbi/sbi_domain.h           |  9 ++++
>  include/sbi/sbi_hart.h             | 25 +++++++++++
>  include/sbi/sbi_types.h            |  2 +
>  include/sbi_utils/fdt/fdt_helper.h |  2 +
>  lib/sbi/sbi_domain.c               | 50 +++++++++++++++++++++
>  lib/sbi/sbi_domain_context.c       |  3 ++
>  lib/sbi/sbi_hart.c                 | 71 ++++++++++++++++++++++++++++++
>  lib/sbi/sbi_hsm.c                  |  4 ++
>  lib/sbi/sbi_init.c                 | 13 ++++++
>  lib/utils/fdt/fdt_domain.c         | 15 +++++++
>  lib/utils/fdt/fdt_helper.c         | 61 +++++++++++++++++++++++++
>  platform/generic/platform.c        | 33 +++++++++++++-
>  15 files changed, 324 insertions(+), 2 deletions(-)
>
> --
> 2.43.7
>
>
> --
> opensbi mailing list
> opensbi@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 01/12] lib: sbi_hart: detect RISC-V Worlds ISA extensions

[Pawandeep Oza]

On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add detection for RISC-V Worlds ISA extensions (Smwid, Smlwid,
> Smlwidlist, Smwiddeleg, Sswid) via ISA string detection and
> CSR probes.
>
> These feature flags enable subsequent patches to conditionally
> configure World ID CSRs and print boot-time Worlds status.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  include/sbi/riscv_encoding.h | 12 +++++++++
>  include/sbi/sbi_hart.h       | 10 +++++++
>  lib/sbi/sbi_hart.c           | 51 ++++++++++++++++++++++++++++++++++++
>  3 files changed, 73 insertions(+)
>
> diff --git a/include/sbi/riscv_encoding.h b/include/sbi/riscv_encoding.h
> index ffe7666c..271820fd 100644
> --- a/include/sbi/riscv_encoding.h
> +++ b/include/sbi/riscv_encoding.h
> @@ -400,6 +400,9 @@
>  /* Supervisor Resource Management Configuration CSRs */
>  #define CSR_SRMCFG                     0x181
>
> +/* Supervisor World-ID CSR (Sswid) */
> +#define CSR_SLWID                      0x190
Oza: Misleading comment -
should be
Supervisor WID value for lower privilege modes Register
> +
>  /* Machine-Level Control transfer records CSRs */
>  #define CSR_MCTRCTL                     0x34e
>
> @@ -520,6 +523,15 @@
>  #define CSR_MTINST                     0x34a
>  #define CSR_MTVAL2                     0x34b
>
> +/* Machine World-ID CSRs (Smwid, Smlwid, Smlwidlist, Smwiddeleg) */
> +#define CSR_MLWID                      0x390
> +#define CSR_MWID                       0x391
> +#define CSR_MWIDDELEG                  0x748
> +#define CSR_MLWIDLIST                  0x749
> +
> +/* mwid lock bit */
> +#define MWID_LOCK                      (_UL(1) << (__riscv_xlen - 1))
> +
>  /* Machine Memory Protection */
>  #define CSR_PMPCFG0                    0x3a0
>  #define CSR_PMPCFG1                    0x3a1
> diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> index 543393bb..2941809e 100644
> --- a/include/sbi/sbi_hart.h
> +++ b/include/sbi/sbi_hart.h
> @@ -95,6 +95,16 @@ enum sbi_hart_extensions {
>         SBI_HART_EXT_F,
>         /** Hart has D extension */
>         SBI_HART_EXT_D,
> +       /** Hart has Smwid extension */
> +       SBI_HART_EXT_SMWID,
> +       /** Hart has Smlwid extension */
> +       SBI_HART_EXT_SMLWID,
> +       /** Hart has Smlwidlist extension */
> +       SBI_HART_EXT_SMLWIDLIST,
> +       /** Hart has Smwiddeleg extension */
> +       SBI_HART_EXT_SMWIDDELEG,
> +       /** Hart has Sswid extension */
> +       SBI_HART_EXT_SSWID,
>
>         /** Maximum index of Hart extension */
>         SBI_HART_EXT_MAX,
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index 21713816..0c584bfc 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -402,6 +402,11 @@ const struct sbi_hart_ext_data sbi_hart_ext[] = {
>         __SBI_HART_EXT_DATA(v, SBI_HART_EXT_V),
>         __SBI_HART_EXT_DATA(f, SBI_HART_EXT_F),
>         __SBI_HART_EXT_DATA(d, SBI_HART_EXT_D),
> +       __SBI_HART_EXT_DATA(smwid, SBI_HART_EXT_SMWID),
> +       __SBI_HART_EXT_DATA(smlwid, SBI_HART_EXT_SMLWID),
> +       __SBI_HART_EXT_DATA(smlwidlist, SBI_HART_EXT_SMLWIDLIST),
> +       __SBI_HART_EXT_DATA(smwiddeleg, SBI_HART_EXT_SMWIDDELEG),
> +       __SBI_HART_EXT_DATA(sswid, SBI_HART_EXT_SSWID),
>  };
>
>  _Static_assert(SBI_HART_EXT_MAX == array_size(sbi_hart_ext),
> @@ -689,6 +694,52 @@ __pmp_skip:
>         /* Detect if hart support sdtrig (debug triggers) */
>         __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
>                         CSR_TSELECT, SBI_HART_EXT_SDTRIG);
> +       /* Detect if hart supports Smwid (mwid CSR) */
> +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> +                       CSR_MWID, SBI_HART_EXT_SMWID);
> +       /* Detect if hart supports Smlwid (mlwid CSR) */
> +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> +                       CSR_MLWID, SBI_HART_EXT_SMLWID);
> +       /* Detect if hart supports Smlwidlist (mlwidlist CSR). */
> +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> +                       CSR_MLWIDLIST, SBI_HART_EXT_SMLWIDLIST);
> +       /*
> +        * Detect if hart supports Smwiddeleg & Sswid.
> +        * Smwiddeleg requires Smlwid. Sswid requires Smwiddeleg.
> +        */
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) {
> +               unsigned long old_mwiddeleg, new_mwiddeleg;
> +
> +               old_mwiddeleg = csr_read_allowed(CSR_MWIDDELEG, &trap);
Oza: why not use __check_ext_csr at all the following ?
> +               if (trap.cause)
> +                       goto skip_smwiddeleg;
> +
> +               csr_write_allowed(CSR_MWIDDELEG, &trap, ~0UL);
> +               if (trap.cause)
> +                       goto skip_smwiddeleg;
> +
> +               new_mwiddeleg = csr_read_allowed(CSR_MWIDDELEG, &trap);
> +               if (trap.cause) {
> +                       csr_write(CSR_MWIDDELEG, old_mwiddeleg);
> +                       goto skip_smwiddeleg;
> +               }
> +
> +               if (new_mwiddeleg) {
> +                       __sbi_hart_update_extension(hfeatures,
> +                                                   SBI_HART_EXT_SMWIDDELEG, true);
> +
> +                       csr_read_allowed(CSR_SLWID, &trap);
> +                       if (!trap.cause) {
> +                               __sbi_hart_update_extension(hfeatures,
> +                                                           SBI_HART_EXT_SSWID, true);
> +                       }
> +               }
> +
> +               csr_write(CSR_MWIDDELEG, old_mwiddeleg);
> +
> +skip_smwiddeleg:
> +               ;
> +       }
>
>  #undef __check_ext_csr
>
> --
> 2.43.7
>
>
> --
> opensbi mailing list
> opensbi@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 02/12] lib: utils: fdt_helper: parse RISC-V Worlds DT properties

[Pawandeep Oza]

On Wed, Jul 8, 2026 at 5:42 PM Pawandeep Oza
<pawandeep.oza@oss.qualcomm.com> wrote:
>
> On Wed, Jul 8, 2026 at 5:36 PM Pawandeep Oza
> <pawandeep.oza@oss.qualcomm.com> wrote:
> >
> > On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> > >
> > > Add fdt_parse_worlds_all_harts() to parse RISC-V Worlds device tree
> > > properties from CPU nodes:
> > >   - riscv,pmwid (u32): Physical Machine World ID for this hart
> > >   - riscv,pmwidlist (u64): Bitmap of permitted M-mode World IDs
> > >   - riscv,pmlwidlist (u64): Bitmap of permitted S/U-mode World IDs
> > >
> > > This patch extends the sbi_hart_features struct with new fields to
> > > store the parsed World ID configuration (has_pmwid, pmwid, pmwidlist,
> > > and pmlwidlist).
> > >
> > > Link: https://lore.kernel.org/all/20260619105834.1277302-3-peter.lin@sifive.com/
> > > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > > ---
> > >  include/sbi/sbi_hart.h             | 15 ++++++++
> > >  include/sbi_utils/fdt/fdt_helper.h |  2 +
> > >  lib/utils/fdt/fdt_helper.c         | 61 ++++++++++++++++++++++++++++++
> > >  platform/generic/platform.c        | 13 ++++++-
> > >  4 files changed, 90 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> > > index 2941809e..97072c09 100644
> > > --- a/include/sbi/sbi_hart.h
> > > +++ b/include/sbi/sbi_hart.h
> > > @@ -135,6 +135,21 @@ struct sbi_hart_features {
> > >         unsigned int pmp_log2gran;
> > >         unsigned int mhpm_mask;
> > >         unsigned int mhpm_bits;
> > > +       /** True if riscv,pmwid was present in DT */
> > > +       bool has_pmwid;
> > > +       u32 pmwid;
> > > +       /**
> > > +        * Platform-defined bitmap of M-mode WIDs
> > > +        * (from DT riscv,pmwidlist). Zero means
> > > +        * absent/unrestricted.
> > > +        */
> > > +       u64 pmwidlist;
> > > +       /**
> > > +        * Platform-defined bitmap of S/U-mode WIDs
> > > +        * (from DT riscv,pmlwidlist). Zero means
> > > +        * absent/unrestricted.
> > > +        */
> > > +       u64 pmlwidlist;
> Oza: pmlwidlist defines which WIDs M-mode is permitted to assign to
> S-mode. But next-wid is never validated against it.
> > >  };
> > >
> > >  extern unsigned long hart_features_offset;
> > > diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
> > > index 75a564d1..3f3d091b 100644
> > > --- a/include/sbi_utils/fdt/fdt_helper.h
> > > +++ b/include/sbi_utils/fdt/fdt_helper.h
> > > @@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
> > >
> > >  int fdt_parse_isa_extensions_all_harts(const void *fdt);
> > >
> > > +int fdt_parse_worlds_all_harts(const void *fdt);
> > > +
> > >  int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
> > >                                 struct platform_uart_data *uart);
> > >
> > > diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
> > > index ad4efaaf..8b40cd28 100644
> > > --- a/lib/utils/fdt/fdt_helper.c
> > > +++ b/lib/utils/fdt/fdt_helper.c
> > > @@ -457,6 +457,67 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
> > >         return 0;
> > >  }
> > >
> > > +int fdt_parse_worlds_all_harts(const void *fdt)
> > > +{
> > > +       u32 hartid;
> > > +       const fdt32_t *val;
> > > +       struct sbi_scratch *scratch;
> > > +       struct sbi_hart_features *hfeatures;
> > > +       int err, cpu_offset, cpus_offset, len;
> > > +
> > > +       if (!fdt)
> > > +               return SBI_EINVAL;
> > > +
> > > +       cpus_offset = fdt_path_offset(fdt, "/cpus");
> > > +       if (cpus_offset < 0)
> > > +               return cpus_offset;
> > > +
> > > +       fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
> > what about riscv,nworlds ? I think you should parse this and based on
> > that assume wid range - and rest of the wids should be rejected.
> > > +               err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
> > > +               if (err)
> > > +                       continue;
> > > +
> > > +               if (!fdt_node_is_enabled(fdt, cpu_offset))
> > > +                       continue;
> > > +
> > > +               scratch = sbi_hartid_to_scratch(hartid);
> > > +               if (!scratch)
Oza: should you not continue if hart is disabled/fuxed you may not
find sscratch.
> > > +                       return SBI_ENOENT;
> > > +
> > > +               hfeatures = sbi_hart_features_ptr(scratch);
> > > +               if (!hfeatures)
> > > +                       return SBI_ENOENT;
> > > +
> > > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
> > > +               if (val && len == sizeof(fdt32_t)) {
> > > +                       hfeatures->pmwid = fdt32_to_cpu(*val);
> > > +                       hfeatures->has_pmwid = true;
> > > +               }
> Oza: Nothing prevents assigning the same WID to both M-mode and S-mode
> - should not be identical for both worlds.
> > > +
> > > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
> > > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > > +                       hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > > +                                               fdt32_to_cpu(val[1]);
> > > +               }
> > Oza: provide some defines for magic numbers.
> > > +
> > > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
> > > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > > +                       hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > > +                                                fdt32_to_cpu(val[1]);
> > > +               }
> > > +
> > > +               /* Sanity checks */
> > > +               if (hfeatures->has_pmwid && (hfeatures->pmwid >= 64))
> > Oza:  features->pmwid >=nworlds ?
> > > +                       return SBI_EINVAL;
> > > +               if (hfeatures->has_pmwid && hfeatures->pmwidlist &&
> > > +                   !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
> > > +                       return SBI_EINVAL;
> > > +               }
> > > +       }
> > > +
> > > +       return 0;
> > > +}
> > > +
> > >  static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
> > >                                       struct platform_uart_data *uart,
> > >                                       unsigned long default_freq,
> > > diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> > > index 1df0280d..51e9f342 100644
> > > --- a/platform/generic/platform.c
> > > +++ b/platform/generic/platform.c
> > > @@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
> > >
> > >  int generic_extensions_init(bool cold_boot)
> > >  {
> > > +       int rc;
> > > +
> > >         if (!cold_boot)
> > >                 return 0;
> > >
> > >         /* Parse the ISA string from FDT and enable the listed extensions */
> > > -       return fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > > +       rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > > +       if (rc)
> > > +               return rc;
> > > +
> > > +       /* Parse RISC-V Worlds CPU properties from FDT */
> > > +       rc = fdt_parse_worlds_all_harts(fdt_get_address());
> > > +       if (rc)
> > > +               return rc;
> > > +
> > > +       return 0;
> > >  }
> > >
> > >  int generic_domains_init(void)
> > > --
> > > 2.43.7
> > >
> > >
> > > --
> > > opensbi mailing list
> > > opensbi@lists.infradead.org
> > > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 03/12] lib: sbi_hart: enforce riscv,pmwid for Worlds ISA

[Pawandeep Oza]

On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> When Smwid/Smlwid extensions are detected during hart ISA detection,
> the riscv,pmwid device tree property is required to specify the M-mode
> WID default value.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  lib/sbi/sbi_hart.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
>
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index 0c584bfc..cb0c66ea 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -768,6 +768,19 @@ skip_smwiddeleg:
>         /* Mark hart feature detection done */
>         hfeatures->detected = true;
>
> +       /*
> +        * Validate M-mode WID default value: if Worlds ISA extensions
> +        * are present, riscv,pmwid must exist in DT.
> +        */
> +       if ((sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID) ||
> +            sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) &&
> +            !hfeatures->has_pmwid) {
> +               sbi_printf("WARNING: hart%u has Worlds ISA extension but DT "
:%s/WARNING/ERROR/gc as this is causing panic/hang
> +                          "lacks riscv,pmwid.\n",
> +                          current_hartid());
> +               return SBI_EINVAL;
> +       }
> +
>         /*
>          * On platforms with Smepmp, the previous booting stage must
>          * enter OpenSBI with mseccfg.MML == 0. This allows OpenSBI
> --
> 2.43.7
>
>
> --
> opensbi mailing list
> opensbi@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 04/12] lib: sbi_hart: lock mwid CSR for RoT immutability

[Pawandeep Oza]

On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Lock the M-mode World ID (mwid) CSR during hart re-initialization to
> enforce immutability of the WID established by the root-of-trust.
>
> OpenSBI does not assign the WID value itself; it only sets MWID_LOCK
> to freeze the value established by prior RoT stage. The MWID_LOCK bit
> at XLEN-1 is sticky and makes the CSR read-only until reset, enforcing
> a temporal security boundary per the RISC-V Worlds specification.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  lib/sbi/sbi_hart.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index cb0c66ea..4fbe46d7 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -804,6 +804,13 @@ int sbi_hart_reinit(struct sbi_scratch *scratch)
>         if (rc)
>                 return rc;
>
> +       /*
> +        * Assume MWID is restored by root-of-trust M-mode in previous
> +        * stage. Lock mwid so RoT-defined WID remains immutable.
> +        */
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID))
> +               csr_set(CSR_MWID, MWID_LOCK);
At minimum, before locking, read back CSR_MWID & ~MWID_LOCK and verify
it matches hf->pmwid. If they don't match, this is a fatal security
error and sbi_panic() is appropriate
> +
>         return 0;
>  }
>
> --
> 2.43.7
>
>
> --
> opensbi mailing list
> opensbi@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 05/12] include: sbi_domain: add Worlds WID fields

[Pawandeep Oza]

On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Adds next_wid (u32 WID for next boot stage), has_next_wid (distinguishes
> explicit zero from unset for pmwid fallback), and next_widlist (u64 bitmask
> specifying which WIDs can be delegated to this domain) to sbi_domain
> structure. Enables per-domain World ID configuration.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  include/sbi/sbi_domain.h | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/include/sbi/sbi_domain.h b/include/sbi/sbi_domain.h
> index 16edd4ce..7d523493 100644
> --- a/include/sbi/sbi_domain.h
> +++ b/include/sbi/sbi_domain.h
> @@ -211,6 +211,12 @@ struct sbi_domain {
>         unsigned long next_addr;
>         /** Privilege mode of next booting stage for this domain */
>         unsigned long next_mode;
> +       /** Next booting stage World ID for this domain */
> +       u32 next_wid;
oza: The next_ convention works well for one-time boot handoff fields
like next_addr and next_mode
But next_wid and next_widlist are not one-time boot fields — they are:
Written on every domain entry via sbi_domain_worlds_enter()
Active throughout the domain's lifetime
Runtime isolation policy, not a boot handoff value
So the next_ naming is semantically misleading here

why not just have this naming

widThe
WID assigned to this domain.
has_wid
lwid_deleg
The delegation budget to lower levels.

> +       /** Whether next_wid was explicitly set */
> +       bool has_next_wid;
> +       /** Next booting stage World ID delegation bitmask for this domain */
> +       u64 next_widlist;
>         /** Is domain allowed to reset the system */
>         bool system_reset_allowed;
>         /** Is domain allowed to suspend the system */
> --
> 2.43.7
>
>
> --
> opensbi mailing list
> opensbi@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 07/12] lib: sbi_domain: print World ID config at boot

[Pawandeep Oza]

On Fri, Jun 26, 2026 at 3:17 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Extends sbi_domain_dump() to display World ID configuration
> (next_wid and next_widlist) for each domain at boot. Provides
> boot-time diagnostic visibility for debugging and verification.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  lib/sbi/sbi_domain.c | 26 ++++++++++++++++++++++++++
>  1 file changed, 26 insertions(+)
>
> diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
> index fa69170b..443aa60b 100644
> --- a/lib/sbi/sbi_domain.c
> +++ b/lib/sbi/sbi_domain.c
> @@ -10,6 +10,7 @@
>  #include <sbi/riscv_asm.h>
>  #include <sbi/sbi_console.h>
>  #include <sbi/sbi_domain.h>
> +#include <sbi/sbi_hart.h>
>  #include <sbi/sbi_hartmask.h>
>  #include <sbi/sbi_heap.h>
>  #include <sbi/sbi_hsm.h>
> @@ -608,6 +609,31 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
>                 break;
>         }
>
> +       if (sbi_hart_has_extension(sbi_scratch_thishart_ptr(),
> +                                  SBI_HART_EXT_SMLWID)) {
> +               if (dom->has_next_wid)
> +                       sbi_printf("Domain%d Next Wid    %s: %u\n",
> +                                  dom->index, suffix, dom->next_wid);
> +               else {
> +                       struct sbi_scratch *scratch = sbi_scratch_thishart_ptr();
use local variable to store sbi_scratch_thishart_ptr
> +                       const struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
> +                       sbi_printf("Domain%d Next Wid    %s: %u (pmwid)\n",
> +                                  dom->index, suffix, hf->pmwid);
> +               }
> +       } else {
> +               sbi_printf("Domain%d Next Wid    %s: unsupported\n",
> +                          dom->index, suffix);
> +       }
> +
> +       if (sbi_hart_has_extension(sbi_scratch_thishart_ptr(),
> +                                  SBI_HART_EXT_SMWIDDELEG)) {
> +               sbi_printf("Domain%d Next Widlist%s: 0x%" PRIx64 "\n",
> +                          dom->index, suffix, dom->next_widlist);
> +       } else {
> +               sbi_printf("Domain%d Next Widlist%s: unsupported\n",
> +                          dom->index, suffix);
> +       }
> +
>         sbi_printf("Domain%d SysReset    %s: %s\n",
>                    dom->index, suffix, (dom->system_reset_allowed) ? "yes" : "no");
>
> --
> 2.43.7
>
>
> --
> opensbi mailing list
> opensbi@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 00/12] Add RISC-V Worlds ISA support to OpenSBI

[Pawandeep Oza]

On Wed, Jul 8, 2026 at 5:44 PM Pawandeep Oza
<pawandeep.oza@oss.qualcomm.com> wrote:
>
> On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Oza: I have started reviewing this series, and will provide comments
> in coming days.
> >
> > This RFC patch series adds support for RISC-V Worlds ISA extensions,
> > enabling hardware-enforced isolation boundaries based on World IDs (WIDs)
> > by extending the OpenSBI domain framework.
> >
> > Trust Model and Boot-time Roles
> > --------------------------------
> >
> > The implementation follows the two-phase M-mode trust model:
> >
> > - RoT M-mode phase: Prior boot stage (ROM/SPL) that may program mwid/
> >   mlwidlist and lock mwid before handing off to OpenSBI.
> >
> > - Regular M-mode phase (OpenSBI): Treats pmwid/pmwidlist/pmlwidlist as
> >   read-only input policy from hardware/RoT. Locks mwid during feature
> >   detection to prevent later M-mode code from changing its own WID.
> >   Programs per-domain mlwid/mwiddeleg based on DT configuration.
> >
> > Device Tree Bindings
> > ---------------------
> >
> > New CPU properties (per-hart):
> > - riscv,pmwid: Platform-defined M-mode World ID
> > - riscv,pmwidlist: M-mode permitted WID bitmap (u64, 2 cells)
> > - riscv,pmlwidlist: S/U-mode permitted WID bitmap (u64, 2 cells)
> >
> > New domain properties (per-domain):
> > - next-wid: Override S-mode WID for this domain (u32, 1 cell)
> > - next-widlist: WID delegation bitmap for this domain (u64, 2 cells)
> >
> > If a domain lacks next-wid, OpenSBI falls back to pmwid (M-mode and
> > S-mode run in the same World).
> >
> > Example DT snippet:
> >
> >     cpus {
> >         riscv,nworlds = <4>;
> >         cpu@0 {
> >             riscv,pmwid = <3>;
> >             riscv,pmwidlist = <0x0 0xf>;
> >             riscv,pmlwidlist = <0x0 0xf>;
> >         };
> >     };
> >
> >     chosen {
> >         opensbi-domains {
> >             trusted-domain {
> >                 next-wid = <1>;
> >                 next-widlist = <0x0 0x2>;
> >             };
> >             untrusted-domain {
> >                 next-wid = <0>;
> >                 next-widlist = <0x0 0x1>;
> >             };
> >         };
> >     };

Oza: lets start a bit from here from device tree.

cpus {
    riscv,nworlds = <4>;

    cpu@0 {
        riscv,pmwid      = <3>;       /* M-mode lives in World 3 */
        riscv,pmwidlist  = <0x0 0xf>; /* M-mode can access Worlds 0-3 */
        riscv,pmlwidlist = <0x0 0xf>; /* S/U-mode can use Worlds 0-3 */
    };
};

chosen {
    opensbi-domains {
        /* WID 3 — M-mode (implicit, via pmwid) */
        trusted-domain {
            wid     = <2>;       /* WID 2 — trusted S-mode */
            widlist = <0x0 0x4>; /* can delegate WID 2 to U-mode */
        };
        untrusted-domain {
            wid     = <1>;       /* WID 1 — untrusted S-mode */
            widlist = <0x0 0x0>; /* no delegation */
        };
        root-domain {
            wid     = <0>;       /* WID 0 — root/unprotected */
            widlist = <0x0 0x0>;
        };
    };
};

> >
> > Known Limitations and Future Work
> > ----------------------------------
> >
> > This RFC implements core functionality but has several areas requiring
> > refinement in the future revisions:
> >
> > 1. WID Validation:
> >    - Domain next-wid is NOT validated against pmlwidlist
> >    - Domain next-widlist is NOT validated as subset of pmlwidlist
> >    - Invalid WID configuration fails at runtime with software-check
> >      exceptions rather than at domain registration time
> >    - Planned: Add validation in sanitize_domain() to catch errors early
> >
> > 2. Resume Path mwid Restoration:
> >    - Current implementation only re-locks mwid on resume, assuming RoT
> >      has already restored the correct WID value
> >    - No mechanism to verify or actively restore mwid to RoT-defined value
> >
> > Specification References
> > -------------------------
> >
> > - RISC-V Worlds ISA Spec: https://github.com/riscv/riscv-worlds
> >   (Release: riscv-isa-release-4c81a3f-2026-04-14)
> > - Device Tree Proposal: https://lore.kernel.org/all/20260619105834.1277302-1-peter.lin@sifive.com/
> >
> > Yu-Chien Peter Lin (12):
> >   lib: sbi_hart: detect RISC-V Worlds ISA extensions
> >   lib: utils: fdt_helper: parse RISC-V Worlds DT properties
> >   lib: sbi_hart: enforce riscv,pmwid for Worlds ISA
> >   lib: sbi_hart: lock mwid CSR for RoT immutability
> >   include: sbi_domain: add Worlds WID fields
> >   include: sbi_types: add PRIx64 format macro
> >   lib: sbi_domain: print World ID config at boot
> >   lib: sbi_init: print M-mode World ID at boot
> >   platform: generic: parse root domain WID config from DT
> >   lib: utils: fdt_domain: parse per-domain WID properties
> >   lib: sbi_domain: add Worlds CSR config on domain entry
> >   docs: add RISC-V Worlds next-wid/next-widlist DT properties
> >
> >  docs/domain_support.md             | 13 ++++++
> >  docs/opensbi_config.md             | 13 ++++++
> >  include/sbi/riscv_encoding.h       | 12 +++++
> >  include/sbi/sbi_domain.h           |  9 ++++
> >  include/sbi/sbi_hart.h             | 25 +++++++++++
> >  include/sbi/sbi_types.h            |  2 +
> >  include/sbi_utils/fdt/fdt_helper.h |  2 +
> >  lib/sbi/sbi_domain.c               | 50 +++++++++++++++++++++
> >  lib/sbi/sbi_domain_context.c       |  3 ++
> >  lib/sbi/sbi_hart.c                 | 71 ++++++++++++++++++++++++++++++
> >  lib/sbi/sbi_hsm.c                  |  4 ++
> >  lib/sbi/sbi_init.c                 | 13 ++++++
> >  lib/utils/fdt/fdt_domain.c         | 15 +++++++
> >  lib/utils/fdt/fdt_helper.c         | 61 +++++++++++++++++++++++++
> >  platform/generic/platform.c        | 33 +++++++++++++-
> >  15 files changed, 324 insertions(+), 2 deletions(-)
> >
> > --
> > 2.43.7
> >
> >
> > --
> > opensbi mailing list
> > opensbi@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 01/12] lib: sbi_hart: detect RISC-V Worlds ISA extensions

[Yu-Chien Peter Lin]

Hi Oza,

On Mon, Jul 13, 2026 at 01:58:42PM -0700, Pawandeep Oza wrote:
> On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Add detection for RISC-V Worlds ISA extensions (Smwid, Smlwid,
> > Smlwidlist, Smwiddeleg, Sswid) via ISA string detection and
> > CSR probes.
> >
> > These feature flags enable subsequent patches to conditionally
> > configure World ID CSRs and print boot-time Worlds status.
> >
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> >  include/sbi/riscv_encoding.h | 12 +++++++++
> >  include/sbi/sbi_hart.h       | 10 +++++++
> >  lib/sbi/sbi_hart.c           | 51 ++++++++++++++++++++++++++++++++++++
> >  3 files changed, 73 insertions(+)
> >
> > diff --git a/include/sbi/riscv_encoding.h b/include/sbi/riscv_encoding.h
> > index ffe7666c..271820fd 100644
> > --- a/include/sbi/riscv_encoding.h
> > +++ b/include/sbi/riscv_encoding.h
> > @@ -400,6 +400,9 @@
> >  /* Supervisor Resource Management Configuration CSRs */
> >  #define CSR_SRMCFG                     0x181
> >
> > +/* Supervisor World-ID CSR (Sswid) */
> > +#define CSR_SLWID                      0x190
> Oza: Misleading comment -
> should be
> Supervisor WID value for lower privilege modes Register

Okay, will improve wording.

> > +
> >  /* Machine-Level Control transfer records CSRs */
> >  #define CSR_MCTRCTL                     0x34e
> >
> > @@ -520,6 +523,15 @@
> >  #define CSR_MTINST                     0x34a
> >  #define CSR_MTVAL2                     0x34b
> >
> > +/* Machine World-ID CSRs (Smwid, Smlwid, Smlwidlist, Smwiddeleg) */
> > +#define CSR_MLWID                      0x390
> > +#define CSR_MWID                       0x391
> > +#define CSR_MWIDDELEG                  0x748
> > +#define CSR_MLWIDLIST                  0x749
> > +
> > +/* mwid lock bit */
> > +#define MWID_LOCK                      (_UL(1) << (__riscv_xlen - 1))
> > +
> >  /* Machine Memory Protection */
> >  #define CSR_PMPCFG0                    0x3a0
> >  #define CSR_PMPCFG1                    0x3a1
> > diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> > index 543393bb..2941809e 100644
> > --- a/include/sbi/sbi_hart.h
> > +++ b/include/sbi/sbi_hart.h
> > @@ -95,6 +95,16 @@ enum sbi_hart_extensions {
> >         SBI_HART_EXT_F,
> >         /** Hart has D extension */
> >         SBI_HART_EXT_D,
> > +       /** Hart has Smwid extension */
> > +       SBI_HART_EXT_SMWID,
> > +       /** Hart has Smlwid extension */
> > +       SBI_HART_EXT_SMLWID,
> > +       /** Hart has Smlwidlist extension */
> > +       SBI_HART_EXT_SMLWIDLIST,
> > +       /** Hart has Smwiddeleg extension */
> > +       SBI_HART_EXT_SMWIDDELEG,
> > +       /** Hart has Sswid extension */
> > +       SBI_HART_EXT_SSWID,
> >
> >         /** Maximum index of Hart extension */
> >         SBI_HART_EXT_MAX,
> > diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> > index 21713816..0c584bfc 100644
> > --- a/lib/sbi/sbi_hart.c
> > +++ b/lib/sbi/sbi_hart.c
> > @@ -402,6 +402,11 @@ const struct sbi_hart_ext_data sbi_hart_ext[] = {
> >         __SBI_HART_EXT_DATA(v, SBI_HART_EXT_V),
> >         __SBI_HART_EXT_DATA(f, SBI_HART_EXT_F),
> >         __SBI_HART_EXT_DATA(d, SBI_HART_EXT_D),
> > +       __SBI_HART_EXT_DATA(smwid, SBI_HART_EXT_SMWID),
> > +       __SBI_HART_EXT_DATA(smlwid, SBI_HART_EXT_SMLWID),
> > +       __SBI_HART_EXT_DATA(smlwidlist, SBI_HART_EXT_SMLWIDLIST),
> > +       __SBI_HART_EXT_DATA(smwiddeleg, SBI_HART_EXT_SMWIDDELEG),
> > +       __SBI_HART_EXT_DATA(sswid, SBI_HART_EXT_SSWID),
> >  };
> >
> >  _Static_assert(SBI_HART_EXT_MAX == array_size(sbi_hart_ext),
> > @@ -689,6 +694,52 @@ __pmp_skip:
> >         /* Detect if hart support sdtrig (debug triggers) */
> >         __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> >                         CSR_TSELECT, SBI_HART_EXT_SDTRIG);
> > +       /* Detect if hart supports Smwid (mwid CSR) */
> > +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> > +                       CSR_MWID, SBI_HART_EXT_SMWID);
> > +       /* Detect if hart supports Smlwid (mlwid CSR) */
> > +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> > +                       CSR_MLWID, SBI_HART_EXT_SMLWID);
> > +       /* Detect if hart supports Smlwidlist (mlwidlist CSR). */
> > +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> > +                       CSR_MLWIDLIST, SBI_HART_EXT_SMLWIDLIST);
> > +       /*
> > +        * Detect if hart supports Smwiddeleg & Sswid.
> > +        * Smwiddeleg requires Smlwid. Sswid requires Smwiddeleg.
> > +        */
> > +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) {
> > +               unsigned long old_mwiddeleg, new_mwiddeleg;
> > +
> > +               old_mwiddeleg = csr_read_allowed(CSR_MWIDDELEG, &trap);
> Oza: why not use __check_ext_csr at all the following ?

Yes, __check_ext_csr(CSR_MWIDDELEG, SBI_HART_EXT_SMWIDDELEG) is
sufficient Smwiddeleg which also implies Sswid.

Will update the ISA detection here.

Thanks,
Peter Lin

> > +               if (trap.cause)
> > +                       goto skip_smwiddeleg;
> > +
> > +               csr_write_allowed(CSR_MWIDDELEG, &trap, ~0UL);
> > +               if (trap.cause)
> > +                       goto skip_smwiddeleg;
> > +
> > +               new_mwiddeleg = csr_read_allowed(CSR_MWIDDELEG, &trap);
> > +               if (trap.cause) {
> > +                       csr_write(CSR_MWIDDELEG, old_mwiddeleg);
> > +                       goto skip_smwiddeleg;
> > +               }
> > +
> > +               if (new_mwiddeleg) {
> > +                       __sbi_hart_update_extension(hfeatures,
> > +                                                   SBI_HART_EXT_SMWIDDELEG, true);
> > +
> > +                       csr_read_allowed(CSR_SLWID, &trap);
> > +                       if (!trap.cause) {
> > +                               __sbi_hart_update_extension(hfeatures,
> > +                                                           SBI_HART_EXT_SSWID, true);
> > +                       }
> > +               }
> > +
> > +               csr_write(CSR_MWIDDELEG, old_mwiddeleg);
> > +
> > +skip_smwiddeleg:
> > +               ;
> > +       }
> >
> >  #undef __check_ext_csr
> >
> > --
> > 2.43.7
> >
> >
> > --
> > opensbi mailing list
> > opensbi@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 02/12] lib: utils: fdt_helper: parse RISC-V Worlds DT properties

[Yu-Chien Peter Lin]

On Wed, Jul 08, 2026 at 05:36:23PM -0700, Pawandeep Oza wrote:
> On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Add fdt_parse_worlds_all_harts() to parse RISC-V Worlds device tree
> > properties from CPU nodes:
> >   - riscv,pmwid (u32): Physical Machine World ID for this hart
> >   - riscv,pmwidlist (u64): Bitmap of permitted M-mode World IDs
> >   - riscv,pmlwidlist (u64): Bitmap of permitted S/U-mode World IDs
> >
> > This patch extends the sbi_hart_features struct with new fields to
> > store the parsed World ID configuration (has_pmwid, pmwid, pmwidlist,
> > and pmlwidlist).
> >
> > Link: https://lore.kernel.org/all/20260619105834.1277302-3-peter.lin@sifive.com/
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> >  include/sbi/sbi_hart.h             | 15 ++++++++
> >  include/sbi_utils/fdt/fdt_helper.h |  2 +
> >  lib/utils/fdt/fdt_helper.c         | 61 ++++++++++++++++++++++++++++++
> >  platform/generic/platform.c        | 13 ++++++-
> >  4 files changed, 90 insertions(+), 1 deletion(-)
> >
> > diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> > index 2941809e..97072c09 100644
> > --- a/include/sbi/sbi_hart.h
> > +++ b/include/sbi/sbi_hart.h
> > @@ -135,6 +135,21 @@ struct sbi_hart_features {
> >         unsigned int pmp_log2gran;
> >         unsigned int mhpm_mask;
> >         unsigned int mhpm_bits;
> > +       /** True if riscv,pmwid was present in DT */
> > +       bool has_pmwid;
> > +       u32 pmwid;
> > +       /**
> > +        * Platform-defined bitmap of M-mode WIDs
> > +        * (from DT riscv,pmwidlist). Zero means
> > +        * absent/unrestricted.
> > +        */
> > +       u64 pmwidlist;
> > +       /**
> > +        * Platform-defined bitmap of S/U-mode WIDs
> > +        * (from DT riscv,pmlwidlist). Zero means
> > +        * absent/unrestricted.
> > +        */
> > +       u64 pmlwidlist;
> >  };
> >
> >  extern unsigned long hart_features_offset;
> > diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
> > index 75a564d1..3f3d091b 100644
> > --- a/include/sbi_utils/fdt/fdt_helper.h
> > +++ b/include/sbi_utils/fdt/fdt_helper.h
> > @@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
> >
> >  int fdt_parse_isa_extensions_all_harts(const void *fdt);
> >
> > +int fdt_parse_worlds_all_harts(const void *fdt);
> > +
> >  int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
> >                                 struct platform_uart_data *uart);
> >
> > diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
> > index ad4efaaf..8b40cd28 100644
> > --- a/lib/utils/fdt/fdt_helper.c
> > +++ b/lib/utils/fdt/fdt_helper.c
> > @@ -457,6 +457,67 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
> >         return 0;
> >  }
> >
> > +int fdt_parse_worlds_all_harts(const void *fdt)
> > +{
> > +       u32 hartid;
> > +       const fdt32_t *val;
> > +       struct sbi_scratch *scratch;
> > +       struct sbi_hart_features *hfeatures;
> > +       int err, cpu_offset, cpus_offset, len;
> > +
> > +       if (!fdt)
> > +               return SBI_EINVAL;
> > +
> > +       cpus_offset = fdt_path_offset(fdt, "/cpus");
> > +       if (cpus_offset < 0)
> > +               return cpus_offset;
> > +
> > +       fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
> what about riscv,nworlds ? I think you should parse this and based on
> that assume wid range - and rest of the wids should be rejected.

Sure, will check against riscv,nworlds.

> > +               err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
> > +               if (err)
> > +                       continue;
> > +
> > +               if (!fdt_node_is_enabled(fdt, cpu_offset))
> > +                       continue;
> > +
> > +               scratch = sbi_hartid_to_scratch(hartid);
> > +               if (!scratch)
> > +                       return SBI_ENOENT;
> > +
> > +               hfeatures = sbi_hart_features_ptr(scratch);
> > +               if (!hfeatures)
> > +                       return SBI_ENOENT;
> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
> > +               if (val && len == sizeof(fdt32_t)) {
> > +                       hfeatures->pmwid = fdt32_to_cpu(*val);
> > +                       hfeatures->has_pmwid = true;
> > +               }
> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
> > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > +                       hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > +                                               fdt32_to_cpu(val[1]);
> > +               }
> Oza: provide some defines for magic numbers.

Okay.

> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
> > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > +                       hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > +                                                fdt32_to_cpu(val[1]);
> > +               }
> > +
> > +               /* Sanity checks */
> > +               if (hfeatures->has_pmwid && (hfeatures->pmwid >= 64))
> Oza:  features->pmwid >=nworlds ?

Okay.

> > +                       return SBI_EINVAL;
> > +               if (hfeatures->has_pmwid && hfeatures->pmwidlist &&
> > +                   !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
> > +                       return SBI_EINVAL;
> > +               }
> > +       }
> > +
> > +       return 0;
> > +}
> > +
> >  static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
> >                                       struct platform_uart_data *uart,
> >                                       unsigned long default_freq,
> > diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> > index 1df0280d..51e9f342 100644
> > --- a/platform/generic/platform.c
> > +++ b/platform/generic/platform.c
> > @@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
> >
> >  int generic_extensions_init(bool cold_boot)
> >  {
> > +       int rc;
> > +
> >         if (!cold_boot)
> >                 return 0;
> >
> >         /* Parse the ISA string from FDT and enable the listed extensions */
> > -       return fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > +       rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > +       if (rc)
> > +               return rc;
> > +
> > +       /* Parse RISC-V Worlds CPU properties from FDT */
> > +       rc = fdt_parse_worlds_all_harts(fdt_get_address());
> > +       if (rc)
> > +               return rc;
> > +
> > +       return 0;
> >  }
> >
> >  int generic_domains_init(void)
> > --
> > 2.43.7
> >
> >
> > --
> > opensbi mailing list
> > opensbi@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 02/12] lib: utils: fdt_helper: parse RISC-V Worlds DT properties

[Yu-Chien Peter Lin]

On Wed, Jul 08, 2026 at 05:42:44PM -0700, Pawandeep Oza wrote:
> On Wed, Jul 8, 2026 at 5:36 PM Pawandeep Oza
> <pawandeep.oza@oss.qualcomm.com> wrote:
> >
> > On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> > >
> > > Add fdt_parse_worlds_all_harts() to parse RISC-V Worlds device tree
> > > properties from CPU nodes:
> > >   - riscv,pmwid (u32): Physical Machine World ID for this hart
> > >   - riscv,pmwidlist (u64): Bitmap of permitted M-mode World IDs
> > >   - riscv,pmlwidlist (u64): Bitmap of permitted S/U-mode World IDs
> > >
> > > This patch extends the sbi_hart_features struct with new fields to
> > > store the parsed World ID configuration (has_pmwid, pmwid, pmwidlist,
> > > and pmlwidlist).
> > >
> > > Link: https://lore.kernel.org/all/20260619105834.1277302-3-peter.lin@sifive.com/
> > > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > > ---
> > >  include/sbi/sbi_hart.h             | 15 ++++++++
> > >  include/sbi_utils/fdt/fdt_helper.h |  2 +
> > >  lib/utils/fdt/fdt_helper.c         | 61 ++++++++++++++++++++++++++++++
> > >  platform/generic/platform.c        | 13 ++++++-
> > >  4 files changed, 90 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> > > index 2941809e..97072c09 100644
> > > --- a/include/sbi/sbi_hart.h
> > > +++ b/include/sbi/sbi_hart.h
> > > @@ -135,6 +135,21 @@ struct sbi_hart_features {
> > >         unsigned int pmp_log2gran;
> > >         unsigned int mhpm_mask;
> > >         unsigned int mhpm_bits;
> > > +       /** True if riscv,pmwid was present in DT */
> > > +       bool has_pmwid;
> > > +       u32 pmwid;
> > > +       /**
> > > +        * Platform-defined bitmap of M-mode WIDs
> > > +        * (from DT riscv,pmwidlist). Zero means
> > > +        * absent/unrestricted.
> > > +        */
> > > +       u64 pmwidlist;
> > > +       /**
> > > +        * Platform-defined bitmap of S/U-mode WIDs
> > > +        * (from DT riscv,pmlwidlist). Zero means
> > > +        * absent/unrestricted.
> > > +        */
> > > +       u64 pmlwidlist;
> Oza: pmlwidlist defines which WIDs M-mode is permitted to assign to
> S-mode. But next-wid is never validated against it.

Yes, will add checks on DT properties.

> > >  };
> > >
> > >  extern unsigned long hart_features_offset;
> > > diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
> > > index 75a564d1..3f3d091b 100644
> > > --- a/include/sbi_utils/fdt/fdt_helper.h
> > > +++ b/include/sbi_utils/fdt/fdt_helper.h
> > > @@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
> > >
> > >  int fdt_parse_isa_extensions_all_harts(const void *fdt);
> > >
> > > +int fdt_parse_worlds_all_harts(const void *fdt);
> > > +
> > >  int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
> > >                                 struct platform_uart_data *uart);
> > >
> > > diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
> > > index ad4efaaf..8b40cd28 100644
> > > --- a/lib/utils/fdt/fdt_helper.c
> > > +++ b/lib/utils/fdt/fdt_helper.c
> > > @@ -457,6 +457,67 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
> > >         return 0;
> > >  }
> > >
> > > +int fdt_parse_worlds_all_harts(const void *fdt)
> > > +{
> > > +       u32 hartid;
> > > +       const fdt32_t *val;
> > > +       struct sbi_scratch *scratch;
> > > +       struct sbi_hart_features *hfeatures;
> > > +       int err, cpu_offset, cpus_offset, len;
> > > +
> > > +       if (!fdt)
> > > +               return SBI_EINVAL;
> > > +
> > > +       cpus_offset = fdt_path_offset(fdt, "/cpus");
> > > +       if (cpus_offset < 0)
> > > +               return cpus_offset;
> > > +
> > > +       fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
> > what about riscv,nworlds ? I think you should parse this and based on
> > that assume wid range - and rest of the wids should be rejected.
> > > +               err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
> > > +               if (err)
> > > +                       continue;
> > > +
> > > +               if (!fdt_node_is_enabled(fdt, cpu_offset))
> > > +                       continue;
> > > +
> > > +               scratch = sbi_hartid_to_scratch(hartid);
> > > +               if (!scratch)
> > > +                       return SBI_ENOENT;
> > > +
> > > +               hfeatures = sbi_hart_features_ptr(scratch);
> > > +               if (!hfeatures)
> > > +                       return SBI_ENOENT;
> > > +
> > > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
> > > +               if (val && len == sizeof(fdt32_t)) {
> > > +                       hfeatures->pmwid = fdt32_to_cpu(*val);
> > > +                       hfeatures->has_pmwid = true;
> > > +               }
> Oza: Nothing prevents assigning the same WID to both M-mode and S-mode
> - should not be identical for both worlds.

Agreed. Will add validation in __fdt_parse_domain() to reject domains
where next-wid == pmwid.

Thanks,
Peter Lin

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 02/12] lib: utils: fdt_helper: parse RISC-V Worlds DT properties

[Yu-Chien Peter Lin]

On Mon, Jul 13, 2026 at 02:13:06PM -0700, Pawandeep Oza wrote:
> On Wed, Jul 8, 2026 at 5:42 PM Pawandeep Oza
> <pawandeep.oza@oss.qualcomm.com> wrote:
> >
> > On Wed, Jul 8, 2026 at 5:36 PM Pawandeep Oza
> > <pawandeep.oza@oss.qualcomm.com> wrote:
> > >
> > > On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> > > >
> > > > Add fdt_parse_worlds_all_harts() to parse RISC-V Worlds device tree
> > > > properties from CPU nodes:
> > > >   - riscv,pmwid (u32): Physical Machine World ID for this hart
> > > >   - riscv,pmwidlist (u64): Bitmap of permitted M-mode World IDs
> > > >   - riscv,pmlwidlist (u64): Bitmap of permitted S/U-mode World IDs
> > > >
> > > > This patch extends the sbi_hart_features struct with new fields to
> > > > store the parsed World ID configuration (has_pmwid, pmwid, pmwidlist,
> > > > and pmlwidlist).
> > > >
> > > > Link: https://lore.kernel.org/all/20260619105834.1277302-3-peter.lin@sifive.com/
> > > > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > > > ---
> > > >  include/sbi/sbi_hart.h             | 15 ++++++++
> > > >  include/sbi_utils/fdt/fdt_helper.h |  2 +
> > > >  lib/utils/fdt/fdt_helper.c         | 61 ++++++++++++++++++++++++++++++
> > > >  platform/generic/platform.c        | 13 ++++++-
> > > >  4 files changed, 90 insertions(+), 1 deletion(-)
> > > >
> > > > diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> > > > index 2941809e..97072c09 100644
> > > > --- a/include/sbi/sbi_hart.h
> > > > +++ b/include/sbi/sbi_hart.h
> > > > @@ -135,6 +135,21 @@ struct sbi_hart_features {
> > > >         unsigned int pmp_log2gran;
> > > >         unsigned int mhpm_mask;
> > > >         unsigned int mhpm_bits;
> > > > +       /** True if riscv,pmwid was present in DT */
> > > > +       bool has_pmwid;
> > > > +       u32 pmwid;
> > > > +       /**
> > > > +        * Platform-defined bitmap of M-mode WIDs
> > > > +        * (from DT riscv,pmwidlist). Zero means
> > > > +        * absent/unrestricted.
> > > > +        */
> > > > +       u64 pmwidlist;
> > > > +       /**
> > > > +        * Platform-defined bitmap of S/U-mode WIDs
> > > > +        * (from DT riscv,pmlwidlist). Zero means
> > > > +        * absent/unrestricted.
> > > > +        */
> > > > +       u64 pmlwidlist;
> > Oza: pmlwidlist defines which WIDs M-mode is permitted to assign to
> > S-mode. But next-wid is never validated against it.
> > > >  };
> > > >
> > > >  extern unsigned long hart_features_offset;
> > > > diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
> > > > index 75a564d1..3f3d091b 100644
> > > > --- a/include/sbi_utils/fdt/fdt_helper.h
> > > > +++ b/include/sbi_utils/fdt/fdt_helper.h
> > > > @@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
> > > >
> > > >  int fdt_parse_isa_extensions_all_harts(const void *fdt);
> > > >
> > > > +int fdt_parse_worlds_all_harts(const void *fdt);
> > > > +
> > > >  int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
> > > >                                 struct platform_uart_data *uart);
> > > >
> > > > diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
> > > > index ad4efaaf..8b40cd28 100644
> > > > --- a/lib/utils/fdt/fdt_helper.c
> > > > +++ b/lib/utils/fdt/fdt_helper.c
> > > > @@ -457,6 +457,67 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
> > > >         return 0;
> > > >  }
> > > >
> > > > +int fdt_parse_worlds_all_harts(const void *fdt)
> > > > +{
> > > > +       u32 hartid;
> > > > +       const fdt32_t *val;
> > > > +       struct sbi_scratch *scratch;
> > > > +       struct sbi_hart_features *hfeatures;
> > > > +       int err, cpu_offset, cpus_offset, len;
> > > > +
> > > > +       if (!fdt)
> > > > +               return SBI_EINVAL;
> > > > +
> > > > +       cpus_offset = fdt_path_offset(fdt, "/cpus");
> > > > +       if (cpus_offset < 0)
> > > > +               return cpus_offset;
> > > > +
> > > > +       fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
> > > what about riscv,nworlds ? I think you should parse this and based on
> > > that assume wid range - and rest of the wids should be rejected.
> > > > +               err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
> > > > +               if (err)
> > > > +                       continue;
> > > > +
> > > > +               if (!fdt_node_is_enabled(fdt, cpu_offset))
> > > > +                       continue;
> > > > +
> > > > +               scratch = sbi_hartid_to_scratch(hartid);
> > > > +               if (!scratch)
> Oza: should you not continue if hart is disabled/fuxed you may not
> find sscratch.

Yup. Will fix.

Thanks,
Peter Lin

> > > > +                       return SBI_ENOENT;
> > > > +
> > > > +               hfeatures = sbi_hart_features_ptr(scratch);
> > > > +               if (!hfeatures)
> > > > +                       return SBI_ENOENT;
> > > > +
> > > > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
> > > > +               if (val && len == sizeof(fdt32_t)) {
> > > > +                       hfeatures->pmwid = fdt32_to_cpu(*val);
> > > > +                       hfeatures->has_pmwid = true;
> > > > +               }
> > Oza: Nothing prevents assigning the same WID to both M-mode and S-mode
> > - should not be identical for both worlds.
> > > > +
> > > > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
> > > > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > > > +                       hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > > > +                                               fdt32_to_cpu(val[1]);
> > > > +               }
> > > Oza: provide some defines for magic numbers.
> > > > +
> > > > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
> > > > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > > > +                       hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > > > +                                                fdt32_to_cpu(val[1]);
> > > > +               }
> > > > +
> > > > +               /* Sanity checks */
> > > > +               if (hfeatures->has_pmwid && (hfeatures->pmwid >= 64))
> > > Oza:  features->pmwid >=nworlds ?
> > > > +                       return SBI_EINVAL;
> > > > +               if (hfeatures->has_pmwid && hfeatures->pmwidlist &&
> > > > +                   !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
> > > > +                       return SBI_EINVAL;
> > > > +               }
> > > > +       }
> > > > +
> > > > +       return 0;
> > > > +}
> > > > +
> > > >  static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
> > > >                                       struct platform_uart_data *uart,
> > > >                                       unsigned long default_freq,
> > > > diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> > > > index 1df0280d..51e9f342 100644
> > > > --- a/platform/generic/platform.c
> > > > +++ b/platform/generic/platform.c
> > > > @@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
> > > >
> > > >  int generic_extensions_init(bool cold_boot)
> > > >  {
> > > > +       int rc;
> > > > +
> > > >         if (!cold_boot)
> > > >                 return 0;
> > > >
> > > >         /* Parse the ISA string from FDT and enable the listed extensions */
> > > > -       return fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > > > +       rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > > > +       if (rc)
> > > > +               return rc;
> > > > +
> > > > +       /* Parse RISC-V Worlds CPU properties from FDT */
> > > > +       rc = fdt_parse_worlds_all_harts(fdt_get_address());
> > > > +       if (rc)
> > > > +               return rc;
> > > > +
> > > > +       return 0;
> > > >  }
> > > >
> > > >  int generic_domains_init(void)
> > > > --
> > > > 2.43.7
> > > >
> > > >
> > > > --
> > > > opensbi mailing list
> > > > opensbi@lists.infradead.org
> > > > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 03/12] lib: sbi_hart: enforce riscv,pmwid for Worlds ISA

[Yu-Chien Peter Lin]

On Mon, Jul 13, 2026 at 02:26:13PM -0700, Pawandeep Oza wrote:
> On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > When Smwid/Smlwid extensions are detected during hart ISA detection,
> > the riscv,pmwid device tree property is required to specify the M-mode
> > WID default value.
> >
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> >  lib/sbi/sbi_hart.c | 13 +++++++++++++
> >  1 file changed, 13 insertions(+)
> >
> > diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> > index 0c584bfc..cb0c66ea 100644
> > --- a/lib/sbi/sbi_hart.c
> > +++ b/lib/sbi/sbi_hart.c
> > @@ -768,6 +768,19 @@ skip_smwiddeleg:
> >         /* Mark hart feature detection done */
> >         hfeatures->detected = true;
> >
> > +       /*
> > +        * Validate M-mode WID default value: if Worlds ISA extensions
> > +        * are present, riscv,pmwid must exist in DT.
> > +        */
> > +       if ((sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID) ||
> > +            sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) &&
> > +            !hfeatures->has_pmwid) {
> > +               sbi_printf("WARNING: hart%u has Worlds ISA extension but DT "
> :%s/WARNING/ERROR/gc as this is causing panic/hang

Yes, makes sense.

> > +                          "lacks riscv,pmwid.\n",
> > +                          current_hartid());
> > +               return SBI_EINVAL;
> > +       }
> > +
> >         /*
> >          * On platforms with Smepmp, the previous booting stage must
> >          * enter OpenSBI with mseccfg.MML == 0. This allows OpenSBI
> > --
> > 2.43.7
> >
> >
> > --
> > opensbi mailing list
> > opensbi@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 04/12] lib: sbi_hart: lock mwid CSR for RoT immutability

[Yu-Chien Peter Lin]

On Mon, Jul 13, 2026 at 02:28:50PM -0700, Pawandeep Oza wrote:
> On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Lock the M-mode World ID (mwid) CSR during hart re-initialization to
> > enforce immutability of the WID established by the root-of-trust.
> >
> > OpenSBI does not assign the WID value itself; it only sets MWID_LOCK
> > to freeze the value established by prior RoT stage. The MWID_LOCK bit
> > at XLEN-1 is sticky and makes the CSR read-only until reset, enforcing
> > a temporal security boundary per the RISC-V Worlds specification.
> >
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> >  lib/sbi/sbi_hart.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> > index cb0c66ea..4fbe46d7 100644
> > --- a/lib/sbi/sbi_hart.c
> > +++ b/lib/sbi/sbi_hart.c
> > @@ -804,6 +804,13 @@ int sbi_hart_reinit(struct sbi_scratch *scratch)
> >         if (rc)
> >                 return rc;
> >
> > +       /*
> > +        * Assume MWID is restored by root-of-trust M-mode in previous
> > +        * stage. Lock mwid so RoT-defined WID remains immutable.
> > +        */
> > +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID))
> > +               csr_set(CSR_MWID, MWID_LOCK);
> At minimum, before locking, read back CSR_MWID & ~MWID_LOCK and verify
> it matches hf->pmwid. If they don't match, this is a fatal security
> error and sbi_panic() is appropriate

In this patchset, OpenSBI trusts that RoT M-mode has set mwid correctly
in the previous boot stage. The early-boot M-mode may set mwid to any
value (within pmwidlist if exists) when unlocked on reset, independent
of DT's riscv,pmwid (which describes the reset default, not a mandatory
final value). Adding a panic would incorrectly treat RoT's legitimate
WID selection as a security error. Am I missing something?

Thanks,
Peter Lin

> > +
> >         return 0;
> >  }
> >
> > --
> > 2.43.7
> >
> >
> > --
> > opensbi mailing list
> > opensbi@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 05/12] include: sbi_domain: add Worlds WID fields

[Yu-Chien Peter Lin]

On Mon, Jul 13, 2026 at 02:52:27PM -0700, Pawandeep Oza wrote:
> On Fri, Jun 26, 2026 at 3:16 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Adds next_wid (u32 WID for next boot stage), has_next_wid (distinguishes
> > explicit zero from unset for pmwid fallback), and next_widlist (u64 bitmask
> > specifying which WIDs can be delegated to this domain) to sbi_domain
> > structure. Enables per-domain World ID configuration.
> >
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> >  include/sbi/sbi_domain.h | 6 ++++++
> >  1 file changed, 6 insertions(+)
> >
> > diff --git a/include/sbi/sbi_domain.h b/include/sbi/sbi_domain.h
> > index 16edd4ce..7d523493 100644
> > --- a/include/sbi/sbi_domain.h
> > +++ b/include/sbi/sbi_domain.h
> > @@ -211,6 +211,12 @@ struct sbi_domain {
> >         unsigned long next_addr;
> >         /** Privilege mode of next booting stage for this domain */
> >         unsigned long next_mode;
> > +       /** Next booting stage World ID for this domain */
> > +       u32 next_wid;
> oza: The next_ convention works well for one-time boot handoff fields
> like next_addr and next_mode
> But next_wid and next_widlist are not one-time boot fields — they are:
> Written on every domain entry via sbi_domain_worlds_enter()
> Active throughout the domain's lifetime
> Runtime isolation policy, not a boot handoff value
> So the next_ naming is semantically misleading here
> 
> why not just have this naming
> 
> widThe
> WID assigned to this domain.
> has_wid
> lwid_deleg
> The delegation budget to lower levels.

Good catch! That's indeed better naming. I prefer wid_deleg
over lwid_deleg to mirror the MWIDDELEG CSR name. Hope that
works for you

Thanks,
Peter Lin

> 
> > +       /** Whether next_wid was explicitly set */
> > +       bool has_next_wid;
> > +       /** Next booting stage World ID delegation bitmask for this domain */
> > +       u64 next_widlist;
> >         /** Is domain allowed to reset the system */
> >         bool system_reset_allowed;
> >         /** Is domain allowed to suspend the system */
> > --
> > 2.43.7
> >
> >
> > --
> > opensbi mailing list
> > opensbi@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 07/12] lib: sbi_domain: print World ID config at boot

[Yu-Chien Peter Lin]

On Mon, Jul 13, 2026 at 04:48:00PM -0700, Pawandeep Oza wrote:
> On Fri, Jun 26, 2026 at 3:17 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Extends sbi_domain_dump() to display World ID configuration
> > (next_wid and next_widlist) for each domain at boot. Provides
> > boot-time diagnostic visibility for debugging and verification.
> >
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> >  lib/sbi/sbi_domain.c | 26 ++++++++++++++++++++++++++
> >  1 file changed, 26 insertions(+)
> >
> > diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
> > index fa69170b..443aa60b 100644
> > --- a/lib/sbi/sbi_domain.c
> > +++ b/lib/sbi/sbi_domain.c
> > @@ -10,6 +10,7 @@
> >  #include <sbi/riscv_asm.h>
> >  #include <sbi/sbi_console.h>
> >  #include <sbi/sbi_domain.h>
> > +#include <sbi/sbi_hart.h>
> >  #include <sbi/sbi_hartmask.h>
> >  #include <sbi/sbi_heap.h>
> >  #include <sbi/sbi_hsm.h>
> > @@ -608,6 +609,31 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
> >                 break;
> >         }
> >
> > +       if (sbi_hart_has_extension(sbi_scratch_thishart_ptr(),
> > +                                  SBI_HART_EXT_SMLWID)) {
> > +               if (dom->has_next_wid)
> > +                       sbi_printf("Domain%d Next Wid    %s: %u\n",
> > +                                  dom->index, suffix, dom->next_wid);
> > +               else {
> > +                       struct sbi_scratch *scratch = sbi_scratch_thishart_ptr();
> use local variable to store sbi_scratch_thishart_ptr

Sure, will update.

> > +                       const struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
> > +                       sbi_printf("Domain%d Next Wid    %s: %u (pmwid)\n",
> > +                                  dom->index, suffix, hf->pmwid);
> > +               }
> > +       } else {
> > +               sbi_printf("Domain%d Next Wid    %s: unsupported\n",
> > +                          dom->index, suffix);
> > +       }
> > +
> > +       if (sbi_hart_has_extension(sbi_scratch_thishart_ptr(),
> > +                                  SBI_HART_EXT_SMWIDDELEG)) {
> > +               sbi_printf("Domain%d Next Widlist%s: 0x%" PRIx64 "\n",
> > +                          dom->index, suffix, dom->next_widlist);
> > +       } else {
> > +               sbi_printf("Domain%d Next Widlist%s: unsupported\n",
> > +                          dom->index, suffix);
> > +       }
> > +
> >         sbi_printf("Domain%d SysReset    %s: %s\n",
> >                    dom->index, suffix, (dom->system_reset_allowed) ? "yes" : "no");
> >
> > --
> > 2.43.7
> >
> >
> > --
> > opensbi mailing list
> > opensbi@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 09/12] platform: generic: parse root domain WID config from DT

[Yu-Chien Peter Lin]

On Wed, Jul 08, 2026 at 05:39:34PM -0700, Pawandeep Oza wrote:
> On Fri, Jun 26, 2026 at 3:17 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Parse root-domain-next-wid (32-bit) and root-domain-next-widlist
> > (64-bit) properties from /chosen/opensbi,config node during
> > generic_domains_init(). Sets root.next_wid/has_next_wid and
> > root.next_widlist.
> >
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> >  platform/generic/platform.c | 20 +++++++++++++++++++-
> >  1 file changed, 19 insertions(+), 1 deletion(-)
> >
> > diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> > index 51e9f342..de12deb5 100644
> > --- a/platform/generic/platform.c
> > +++ b/platform/generic/platform.c
> > @@ -11,6 +11,7 @@
> >  #include <platform_override.h>
> >  #include <sbi/riscv_asm.h>
> >  #include <sbi/sbi_bitops.h>
> > +#include <sbi/sbi_domain.h>
> >  #include <sbi/sbi_hartmask.h>
> >  #include <sbi/sbi_heap.h>
> >  #include <sbi/sbi_platform.h>
> > @@ -276,7 +277,9 @@ int generic_extensions_init(bool cold_boot)
> >  int generic_domains_init(void)
> >  {
> >         const void *fdt = fdt_get_address();
> > -       int offset, ret;
> > +       const fdt32_t *val;
> > +       int len, offset, ret;
> > +       u64 val64;
> >
> >         ret = fdt_domains_populate(fdt);
> >         if (ret < 0)
> > @@ -290,6 +293,21 @@ int generic_domains_init(void)
> >                 if (offset >= 0 &&
> >                     fdt_get_property(fdt, offset, "system-suspend-test", NULL))
> >                         sbi_system_suspend_test_enable();
> > +
> > +               if (offset >= 0) {
> > +                       val = fdt_getprop(fdt, offset, "root-domain-next-wid", &len);
> > +                       if (val && len == sizeof(fdt32_t)) {
> > +                               root.next_wid = fdt32_to_cpu(val[0]);
> > +                               root.has_next_wid = true;
> > +                       }
> > +
> > +                       val = fdt_getprop(fdt, offset, "root-domain-next-widlist", &len);
> Oza: Root domain WID config is semantically identical to per-domain
> WID config but lives in a completely different DT location
> root can be another default domain under chosen { opensbi-domains {

Sure, it would be better to have root domain wid configuration
specified under the opensbi-domain parent node alongside other
domains. I also am planning to introduce "opensbi,domain,instance,root"
compatible string.

Thanks,
Peter Lin

> > +                       if (val && (len == (2 * sizeof(fdt32_t)))) {
> > +                               val64 = fdt32_to_cpu(val[0]);
> > +                               val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
> > +                               root.next_widlist = val64;
> > +                       }
> > +               }
> >         }
> >
> >         return 0;
> > --
> > 2.43.7
> >
> >
> > --
> > opensbi mailing list
> > opensbi@lists.infradead.org
> > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 09/12] platform: generic: parse root domain WID config from DT

[Anup Patel]

On Mon, Jul 20, 2026 at 2:24 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> On Wed, Jul 08, 2026 at 05:39:34PM -0700, Pawandeep Oza wrote:
> > On Fri, Jun 26, 2026 at 3:17 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> > >
> > > Parse root-domain-next-wid (32-bit) and root-domain-next-widlist
> > > (64-bit) properties from /chosen/opensbi,config node during
> > > generic_domains_init(). Sets root.next_wid/has_next_wid and
> > > root.next_widlist.
> > >
> > > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > > ---
> > >  platform/generic/platform.c | 20 +++++++++++++++++++-
> > >  1 file changed, 19 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> > > index 51e9f342..de12deb5 100644
> > > --- a/platform/generic/platform.c
> > > +++ b/platform/generic/platform.c
> > > @@ -11,6 +11,7 @@
> > >  #include <platform_override.h>
> > >  #include <sbi/riscv_asm.h>
> > >  #include <sbi/sbi_bitops.h>
> > > +#include <sbi/sbi_domain.h>
> > >  #include <sbi/sbi_hartmask.h>
> > >  #include <sbi/sbi_heap.h>
> > >  #include <sbi/sbi_platform.h>
> > > @@ -276,7 +277,9 @@ int generic_extensions_init(bool cold_boot)
> > >  int generic_domains_init(void)
> > >  {
> > >         const void *fdt = fdt_get_address();
> > > -       int offset, ret;
> > > +       const fdt32_t *val;
> > > +       int len, offset, ret;
> > > +       u64 val64;
> > >
> > >         ret = fdt_domains_populate(fdt);
> > >         if (ret < 0)
> > > @@ -290,6 +293,21 @@ int generic_domains_init(void)
> > >                 if (offset >= 0 &&
> > >                     fdt_get_property(fdt, offset, "system-suspend-test", NULL))
> > >                         sbi_system_suspend_test_enable();
> > > +
> > > +               if (offset >= 0) {
> > > +                       val = fdt_getprop(fdt, offset, "root-domain-next-wid", &len);
> > > +                       if (val && len == sizeof(fdt32_t)) {
> > > +                               root.next_wid = fdt32_to_cpu(val[0]);
> > > +                               root.has_next_wid = true;
> > > +                       }
> > > +
> > > +                       val = fdt_getprop(fdt, offset, "root-domain-next-widlist", &len);
> > Oza: Root domain WID config is semantically identical to per-domain
> > WID config but lives in a completely different DT location
> > root can be another default domain under chosen { opensbi-domains {
>
> Sure, it would be better to have root domain wid configuration
> specified under the opensbi-domain parent node alongside other
> domains. I also am planning to introduce "opensbi,domain,instance,root"
> compatible string.

Another approach is to treat DT node named "root" under path
"/chosen/opensbi-domains" for RISC-V worlds related DT property.
In the future, same "root" DT node can be used other root domain
DT properties.

Regards,
Anup

>
> Thanks,
> Peter Lin
>
> > > +                       if (val && (len == (2 * sizeof(fdt32_t)))) {
> > > +                               val64 = fdt32_to_cpu(val[0]);
> > > +                               val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
> > > +                               root.next_widlist = val64;
> > > +                       }
> > > +               }
> > >         }
> > >
> > >         return 0;
> > > --
> > > 2.43.7
> > >
> > >
> > > --
> > > opensbi mailing list
> > > opensbi@lists.infradead.org
> > > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 09/12] platform: generic: parse root domain WID config from DT

[Pawandeep Oza]

I gave the comment on your cover letter which was defining DT. pasting
it here for the reference.

Oza: lets start a bit from here from device tree.

cpus {
    riscv,nworlds = <4>;

    cpu@0 {
        riscv,pmwid      = <3>;       /* M-mode lives in World 3 */
        riscv,pmwidlist  = <0x0 0xf>; /* M-mode can access Worlds 0-3 */
        riscv,pmlwidlist = <0x0 0xf>; /* S/U-mode can use Worlds 0-3 */
    };
};

chosen {
    opensbi-domains {
        /* WID 3 — M-mode (implicit, via pmwid) */
        trusted-domain {
            wid     = <2>;       /* WID 2 — trusted S-mode */
            widlist = <0x0 0x4>; /* can delegate WID 2 to U-mode */
        };
        untrusted-domain {
            wid     = <1>;       /* WID 1 — untrusted S-mode */
            widlist = <0x0 0x0>; /* no delegation */
        };
        root-domain {
            wid     = <0>;       /* WID 0 — root/unprotected */
            widlist = <0x0 0x0>;

On Mon, Jul 20, 2026 at 3:39 AM Anup Patel <anup@brainfault.org> wrote:
>
> On Mon, Jul 20, 2026 at 2:24 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > On Wed, Jul 08, 2026 at 05:39:34PM -0700, Pawandeep Oza wrote:
> > > On Fri, Jun 26, 2026 at 3:17 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> > > >
> > > > Parse root-domain-next-wid (32-bit) and root-domain-next-widlist
> > > > (64-bit) properties from /chosen/opensbi,config node during
> > > > generic_domains_init(). Sets root.next_wid/has_next_wid and
> > > > root.next_widlist.
> > > >
> > > > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > > > ---
> > > >  platform/generic/platform.c | 20 +++++++++++++++++++-
> > > >  1 file changed, 19 insertions(+), 1 deletion(-)
> > > >
> > > > diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> > > > index 51e9f342..de12deb5 100644
> > > > --- a/platform/generic/platform.c
> > > > +++ b/platform/generic/platform.c
> > > > @@ -11,6 +11,7 @@
> > > >  #include <platform_override.h>
> > > >  #include <sbi/riscv_asm.h>
> > > >  #include <sbi/sbi_bitops.h>
> > > > +#include <sbi/sbi_domain.h>
> > > >  #include <sbi/sbi_hartmask.h>
> > > >  #include <sbi/sbi_heap.h>
> > > >  #include <sbi/sbi_platform.h>
> > > > @@ -276,7 +277,9 @@ int generic_extensions_init(bool cold_boot)
> > > >  int generic_domains_init(void)
> > > >  {
> > > >         const void *fdt = fdt_get_address();
> > > > -       int offset, ret;
> > > > +       const fdt32_t *val;
> > > > +       int len, offset, ret;
> > > > +       u64 val64;
> > > >
> > > >         ret = fdt_domains_populate(fdt);
> > > >         if (ret < 0)
> > > > @@ -290,6 +293,21 @@ int generic_domains_init(void)
> > > >                 if (offset >= 0 &&
> > > >                     fdt_get_property(fdt, offset, "system-suspend-test", NULL))
> > > >                         sbi_system_suspend_test_enable();
> > > > +
> > > > +               if (offset >= 0) {
> > > > +                       val = fdt_getprop(fdt, offset, "root-domain-next-wid", &len);
> > > > +                       if (val && len == sizeof(fdt32_t)) {
> > > > +                               root.next_wid = fdt32_to_cpu(val[0]);
> > > > +                               root.has_next_wid = true;
> > > > +                       }
> > > > +
> > > > +                       val = fdt_getprop(fdt, offset, "root-domain-next-widlist", &len);
> > > Oza: Root domain WID config is semantically identical to per-domain
> > > WID config but lives in a completely different DT location
> > > root can be another default domain under chosen { opensbi-domains {
> >
> > Sure, it would be better to have root domain wid configuration
> > specified under the opensbi-domain parent node alongside other
> > domains. I also am planning to introduce "opensbi,domain,instance,root"
> > compatible string.
>
> Another approach is to treat DT node named "root" under path
> "/chosen/opensbi-domains" for RISC-V worlds related DT property.
> In the future, same "root" DT node can be used other root domain
> DT properties.
>
> Regards,
> Anup
>
> >
> > Thanks,
> > Peter Lin
> >
> > > > +                       if (val && (len == (2 * sizeof(fdt32_t)))) {
> > > > +                               val64 = fdt32_to_cpu(val[0]);
> > > > +                               val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
> > > > +                               root.next_widlist = val64;
> > > > +                       }
> > > > +               }
> > > >         }
> > > >
> > > >         return 0;
> > > > --
> > > > 2.43.7
> > > >
> > > >
> > > > --
> > > > opensbi mailing list
> > > > opensbi@lists.infradead.org
> > > > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [RFC PATCH 09/12] platform: generic: parse root domain WID config from DT

[Yu-Chien Peter Lin]

On Mon, Jul 20, 2026 at 02:14:16PM -0700, Pawandeep Oza wrote:
> I gave the comment on your cover letter which was defining DT. pasting
> it here for the reference.
> 
> Oza: lets start a bit from here from device tree.
> 
> cpus {
>     riscv,nworlds = <4>;
> 
>     cpu@0 {
>         riscv,pmwid      = <3>;       /* M-mode lives in World 3 */
>         riscv,pmwidlist  = <0x0 0xf>; /* M-mode can access Worlds 0-3 */
>         riscv,pmlwidlist = <0x0 0xf>; /* S/U-mode can use Worlds 0-3 */
>     };
> };
> 
> chosen {
>     opensbi-domains {
>         /* WID 3 — M-mode (implicit, via pmwid) */
>         trusted-domain {
>             wid     = <2>;       /* WID 2 — trusted S-mode */
>             widlist = <0x0 0x4>; /* can delegate WID 2 to U-mode */
>         };
>         untrusted-domain {
>             wid     = <1>;       /* WID 1 — untrusted S-mode */
>             widlist = <0x0 0x0>; /* no delegation */
>         };
>         root-domain {
>             wid     = <0>;       /* WID 0 — root/unprotected */
>             widlist = <0x0 0x0>;

Ah, I overlooked that reply, thanks Anup and Oza for suggestion.
I will follow it.

Regards,
Peter Lin

> 
> On Mon, Jul 20, 2026 at 3:39 AM Anup Patel <anup@brainfault.org> wrote:
> >
> > On Mon, Jul 20, 2026 at 2:24 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> > >
> > > On Wed, Jul 08, 2026 at 05:39:34PM -0700, Pawandeep Oza wrote:
> > > > On Fri, Jun 26, 2026 at 3:17 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> > > > >
> > > > > Parse root-domain-next-wid (32-bit) and root-domain-next-widlist
> > > > > (64-bit) properties from /chosen/opensbi,config node during
> > > > > generic_domains_init(). Sets root.next_wid/has_next_wid and
> > > > > root.next_widlist.
> > > > >
> > > > > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > > > > ---
> > > > >  platform/generic/platform.c | 20 +++++++++++++++++++-
> > > > >  1 file changed, 19 insertions(+), 1 deletion(-)
> > > > >
> > > > > diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> > > > > index 51e9f342..de12deb5 100644
> > > > > --- a/platform/generic/platform.c
> > > > > +++ b/platform/generic/platform.c
> > > > > @@ -11,6 +11,7 @@
> > > > >  #include <platform_override.h>
> > > > >  #include <sbi/riscv_asm.h>
> > > > >  #include <sbi/sbi_bitops.h>
> > > > > +#include <sbi/sbi_domain.h>
> > > > >  #include <sbi/sbi_hartmask.h>
> > > > >  #include <sbi/sbi_heap.h>
> > > > >  #include <sbi/sbi_platform.h>
> > > > > @@ -276,7 +277,9 @@ int generic_extensions_init(bool cold_boot)
> > > > >  int generic_domains_init(void)
> > > > >  {
> > > > >         const void *fdt = fdt_get_address();
> > > > > -       int offset, ret;
> > > > > +       const fdt32_t *val;
> > > > > +       int len, offset, ret;
> > > > > +       u64 val64;
> > > > >
> > > > >         ret = fdt_domains_populate(fdt);
> > > > >         if (ret < 0)
> > > > > @@ -290,6 +293,21 @@ int generic_domains_init(void)
> > > > >                 if (offset >= 0 &&
> > > > >                     fdt_get_property(fdt, offset, "system-suspend-test", NULL))
> > > > >                         sbi_system_suspend_test_enable();
> > > > > +
> > > > > +               if (offset >= 0) {
> > > > > +                       val = fdt_getprop(fdt, offset, "root-domain-next-wid", &len);
> > > > > +                       if (val && len == sizeof(fdt32_t)) {
> > > > > +                               root.next_wid = fdt32_to_cpu(val[0]);
> > > > > +                               root.has_next_wid = true;
> > > > > +                       }
> > > > > +
> > > > > +                       val = fdt_getprop(fdt, offset, "root-domain-next-widlist", &len);
> > > > Oza: Root domain WID config is semantically identical to per-domain
> > > > WID config but lives in a completely different DT location
> > > > root can be another default domain under chosen { opensbi-domains {
> > >
> > > Sure, it would be better to have root domain wid configuration
> > > specified under the opensbi-domain parent node alongside other
> > > domains. I also am planning to introduce "opensbi,domain,instance,root"
> > > compatible string.
> >
> > Another approach is to treat DT node named "root" under path
> > "/chosen/opensbi-domains" for RISC-V worlds related DT property.
> > In the future, same "root" DT node can be used other root domain
> > DT properties.
> >
> > Regards,
> > Anup
> >
> > >
> > > Thanks,
> > > Peter Lin
> > >
> > > > > +                       if (val && (len == (2 * sizeof(fdt32_t)))) {
> > > > > +                               val64 = fdt32_to_cpu(val[0]);
> > > > > +                               val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
> > > > > +                               root.next_widlist = val64;
> > > > > +                       }
> > > > > +               }
> > > > >         }
> > > > >
> > > > >         return 0;
> > > > > --
> > > > > 2.43.7
> > > > >
> > > > >
> > > > > --
> > > > > opensbi mailing list
> > > > > opensbi@lists.infradead.org
> > > > > http://lists.infradead.org/mailman/listinfo/opensbi

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi