[PATCH v2 0/9] Add RISC-V Worlds ISA support to OpenSBI

[PATCH v2 0/9] Add RISC-V Worlds ISA support to OpenSBI

[Yu-Chien Peter Lin]

This patch series adds support for RISC-V Worlds ISA extensions,
enabling hardware-enforced isolation boundaries based on World IDs
by extending the OpenSBI domain framework.

Trust Model and Boot-time Roles
--------------------------------

The implementation follows the two-phase M-mode trust model:

- RoT M-mode phase: Prior boot stage (ROM/SPL) that may program mwid and
  mlwidlist and lock mwid before handing off to OpenSBI.

- Regular M-mode phase (OpenSBI): Treats pmwid/pmwidlist/pmlwidlist as
  input policy from hardware/RoT. Locks mwid to prevent later M-mode code
  from changing its own WID. Programs per-domain mlwid/mwiddeleg based on
  DT configuration.

Device Tree Bindings
---------------------

Per-hart properties defined in linux kernel DT bindings v3 [1]:
- riscv,pmwid: M-mode World ID
- riscv,pmwidlist: M-mode permitted WID bitmap
- riscv,pmlwidlist: S/U-mode permitted WID bitmap

Per-domain properties (see domain_support.md):
- wid: S-mode WID for this domain
- widdeleg: WID delegation bitmap for this domain

If a domain node lacks wid, OpenSBI falls back to M-mode WID, all
modes will run in the same World.

[1] https://patchwork.kernel.org/project/linux-riscv/cover/20260812122131.1534906-1-peter.lin@sifive.com/

Yu-Chien Peter Lin (9):
  lib: sbi_hart: detect RISC-V Worlds ISA extensions
  lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties
  lib: fdt_domain: parse domain WID properties
  lib: sbi_hart: lock mwid CSR for RoT immutability
  lib: sbi_hart: add WID protection mechanism
  lib: sbi_domain_context: add slwid to per-domain S-mode context
  include: sbi_types: add PRIx64 format macro
  lib: sbi: display World ID configuration at boot
  docs: document WID DT properties

 docs/domain_support.md             | 36 ++++++++++++
 include/sbi/riscv_encoding.h       | 12 ++++
 include/sbi/sbi_domain.h           |  6 ++
 include/sbi/sbi_hart.h             | 16 ++++++
 include/sbi/sbi_hart_worlds.h      | 24 ++++++++
 include/sbi/sbi_types.h            |  2 +
 include/sbi_utils/fdt/fdt_helper.h |  2 +
 lib/sbi/objects.mk                 |  1 +
 lib/sbi/sbi_domain.c               | 31 ++++++++++
 lib/sbi/sbi_domain_context.c       | 13 +++++
 lib/sbi/sbi_hart.c                 | 38 ++++++++++++
 lib/sbi/sbi_hart_worlds.c          | 72 +++++++++++++++++++++++
 lib/sbi/sbi_init.c                 | 13 +++++
 lib/utils/fdt/fdt_domain.c         | 50 ++++++++++++++++
 lib/utils/fdt/fdt_helper.c         | 92 ++++++++++++++++++++++++++++++
 platform/generic/platform.c        | 13 ++++-
 16 files changed, 420 insertions(+), 1 deletion(-)
 create mode 100644 include/sbi/sbi_hart_worlds.h
 create mode 100644 lib/sbi/sbi_hart_worlds.c

-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v2 1/9] lib: sbi_hart: detect RISC-V Worlds ISA extensions

[Yu-Chien Peter Lin]

Add CSR definitions for RISC-V Worlds (mwid, mlwid, mlwidlist,
mwiddeleg, slwid) and detect Worlds extensions via CSR probes
in hart_detect_features().

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 include/sbi/riscv_encoding.h | 12 ++++++++++++
 include/sbi/sbi_hart.h       | 10 ++++++++++
 lib/sbi/sbi_hart.c           | 26 ++++++++++++++++++++++++++
 3 files changed, 48 insertions(+)

diff --git a/include/sbi/riscv_encoding.h b/include/sbi/riscv_encoding.h
index ffe7666c..e0262bfc 100644
--- a/include/sbi/riscv_encoding.h
+++ b/include/sbi/riscv_encoding.h
@@ -400,6 +400,9 @@
 /* Supervisor Resource Management Configuration CSRs */
 #define CSR_SRMCFG			0x181
 
+/* Supervisor lower-privilege mode World ID CSR (Sswid) */
+#define CSR_SLWID			0x190
+
 /* Machine-Level Control transfer records CSRs */
 #define CSR_MCTRCTL                     0x34e
 
@@ -520,6 +523,15 @@
 #define CSR_MTINST			0x34a
 #define CSR_MTVAL2			0x34b
 
+/* Machine World ID CSRs (Smwid, Smlwid, Smlwidlist, Smwiddeleg) */
+#define CSR_MLWID			0x390
+#define CSR_MWID			0x749
+#define CSR_MWIDDELEG			0x748
+#define CSR_MLWIDLIST			0x74A
+
+/* mwid lock bit */
+#define MWID_LOCK			(_UL(1) << (__riscv_xlen - 1))
+
 /* Machine Memory Protection */
 #define CSR_PMPCFG0			0x3a0
 #define CSR_PMPCFG1			0x3a1
diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
index 543393bb..2941809e 100644
--- a/include/sbi/sbi_hart.h
+++ b/include/sbi/sbi_hart.h
@@ -95,6 +95,16 @@ enum sbi_hart_extensions {
 	SBI_HART_EXT_F,
 	/** Hart has D extension */
 	SBI_HART_EXT_D,
+	/** Hart has Smwid extension */
+	SBI_HART_EXT_SMWID,
+	/** Hart has Smlwid extension */
+	SBI_HART_EXT_SMLWID,
+	/** Hart has Smlwidlist extension */
+	SBI_HART_EXT_SMLWIDLIST,
+	/** Hart has Smwiddeleg extension */
+	SBI_HART_EXT_SMWIDDELEG,
+	/** Hart has Sswid extension */
+	SBI_HART_EXT_SSWID,
 
 	/** Maximum index of Hart extension */
 	SBI_HART_EXT_MAX,
diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index bee88557..f5f4062e 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -360,6 +360,11 @@ const struct sbi_hart_ext_data sbi_hart_ext[] = {
 	__SBI_HART_EXT_DATA(v, SBI_HART_EXT_V),
 	__SBI_HART_EXT_DATA(f, SBI_HART_EXT_F),
 	__SBI_HART_EXT_DATA(d, SBI_HART_EXT_D),
+	__SBI_HART_EXT_DATA(smwid, SBI_HART_EXT_SMWID),
+	__SBI_HART_EXT_DATA(smlwid, SBI_HART_EXT_SMLWID),
+	__SBI_HART_EXT_DATA(smlwidlist, SBI_HART_EXT_SMLWIDLIST),
+	__SBI_HART_EXT_DATA(smwiddeleg, SBI_HART_EXT_SMWIDDELEG),
+	__SBI_HART_EXT_DATA(sswid, SBI_HART_EXT_SSWID),
 };
 
 _Static_assert(SBI_HART_EXT_MAX == array_size(sbi_hart_ext),
@@ -647,9 +652,30 @@ __pmp_skip:
 	/* Detect if hart support sdtrig (debug triggers) */
 	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
 			CSR_TSELECT, SBI_HART_EXT_SDTRIG);
+	/* Detect if hart supports Smwid */
+	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
+			CSR_MWID, SBI_HART_EXT_SMWID);
+	/* Detect if hart supports Smlwid */
+	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
+			CSR_MLWID, SBI_HART_EXT_SMLWID);
+	/* Detect if hart supports Smlwidlist */
+	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
+			CSR_MLWIDLIST, SBI_HART_EXT_SMLWIDLIST);
+	/* Detect if hart supports Smwiddeleg */
+	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
+			CSR_MWIDDELEG, SBI_HART_EXT_SMWIDDELEG);
 
 #undef __check_ext_csr
 
+	/*
+	 * slwid traps on access when mwiddeleg=0 (reset state), so
+	 * Sswid presence is inferred from Smwiddeleg.
+	 */
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
+		__sbi_hart_update_extension(hfeatures,
+					    SBI_HART_EXT_SSWID, true);
+	}
+
 #define __check_csr_existence(__csr, __csr_id)				\
 	csr_read_allowed(__csr, &trap);					\
 	if (!trap.cause)						\
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v2 2/9] lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties

[Yu-Chien Peter Lin]

Add fdt_parse_worlds_all_harts() to parse platform-defined DT
properties in the /cpus/cpu@X:
- riscv,pmwid: M-mode World ID
- riscv,pmwidlist: bitmap of permitted M-mode WIDs
- riscv,pmlwidlist: bitmap of permitted lower-privilege WIDs
Initialize parsed values in sbi_hart_features with has_* presence
flags.

These platform-defined values serve as the root-of-trust constraints
for per-domain WID assignment during domain creation and context
switching.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 include/sbi/sbi_hart.h             |  6 ++
 include/sbi_utils/fdt/fdt_helper.h |  2 +
 lib/utils/fdt/fdt_helper.c         | 92 ++++++++++++++++++++++++++++++
 platform/generic/platform.c        | 13 ++++-
 4 files changed, 112 insertions(+), 1 deletion(-)

diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
index 2941809e..4fcf5372 100644
--- a/include/sbi/sbi_hart.h
+++ b/include/sbi/sbi_hart.h
@@ -135,6 +135,12 @@ struct sbi_hart_features {
 	unsigned int pmp_log2gran;
 	unsigned int mhpm_mask;
 	unsigned int mhpm_bits;
+	u32 pmwid;
+	u64 pmwidlist;
+	u64 pmlwidlist;
+	bool has_pmwid;
+	bool has_pmwidlist;
+	bool has_pmlwidlist;
 };
 
 extern unsigned long hart_features_offset;
diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
index 75a564d1..3f3d091b 100644
--- a/include/sbi_utils/fdt/fdt_helper.h
+++ b/include/sbi_utils/fdt/fdt_helper.h
@@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
 
 int fdt_parse_isa_extensions_all_harts(const void *fdt);
 
+int fdt_parse_worlds_all_harts(const void *fdt);
+
 int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
 				struct platform_uart_data *uart);
 
diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
index 747ba028..d6025705 100644
--- a/lib/utils/fdt/fdt_helper.c
+++ b/lib/utils/fdt/fdt_helper.c
@@ -457,6 +457,98 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
 	return 0;
 }
 
+int fdt_parse_worlds_all_harts(const void *fdt)
+{
+	u32 hartid;
+	const fdt32_t *val;
+	struct sbi_scratch *scratch;
+	struct sbi_hart_features *hfeatures;
+	int err, cpu_offset, cpus_offset, len;
+
+	if (!fdt)
+		return SBI_EINVAL;
+
+	cpus_offset = fdt_path_offset(fdt, "/cpus");
+	if (cpus_offset < 0)
+		return cpus_offset;
+
+	fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
+		err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
+		if (err)
+			continue;
+
+		if (!fdt_node_is_enabled(fdt, cpu_offset))
+			continue;
+
+		scratch = sbi_hartid_to_scratch(hartid);
+		if (!scratch)
+			return SBI_ENOENT;
+
+		hfeatures = sbi_hart_features_ptr(scratch);
+		if (!hfeatures)
+			return SBI_ENOENT;
+
+		val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
+		if (val && len == sizeof(fdt32_t)) {
+			hfeatures->pmwid = fdt32_to_cpu(*val);
+			hfeatures->has_pmwid = true;
+		}
+
+		val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
+		if (val && len == 2 * sizeof(fdt32_t)) {
+			hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
+						fdt32_to_cpu(val[1]);
+			hfeatures->has_pmwidlist = true;
+		}
+
+		val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
+		if (val && len == 2 * sizeof(fdt32_t)) {
+			hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
+						 fdt32_to_cpu(val[1]);
+			hfeatures->has_pmlwidlist = true;
+		}
+
+		/* Sanity checks */
+		if (hfeatures->has_pmwidlist && !hfeatures->pmwidlist) {
+			sbi_printf("%s: hart%u riscv,pmwidlist is empty\n",
+				   __func__, hartid);
+			return SBI_EINVAL;
+		}
+
+#if __riscv_xlen == 32
+		if (hfeatures->has_pmwidlist &&
+		    (hfeatures->pmwidlist >> 32)) {
+			sbi_printf("%s: hart%u riscv,pmwidlist has bits beyond XLEN\n",
+				   __func__, hartid);
+			return SBI_EINVAL;
+		}
+
+		if (hfeatures->has_pmlwidlist &&
+		    (hfeatures->pmlwidlist >> 32)) {
+			sbi_printf("%s: hart%u riscv,pmlwidlist has bits beyond XLEN\n",
+				   __func__, hartid);
+			return SBI_EINVAL;
+		}
+#endif
+
+		if (hfeatures->has_pmwid &&
+		    hfeatures->pmwid >= __riscv_xlen) {
+			sbi_printf("%s: hart%u riscv,pmwid (%u) exceeds max WID\n",
+				   __func__, hartid, hfeatures->pmwid);
+			return SBI_EINVAL;
+		}
+
+		if (hfeatures->has_pmwidlist && hfeatures->has_pmwid &&
+		    !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
+			sbi_printf("%s: hart%u riscv,pmwid (%u) not in pmwidlist\n",
+				   __func__, hartid, hfeatures->pmwid);
+			return SBI_EINVAL;
+		}
+	}
+
+	return 0;
+}
+
 static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
 				      struct platform_uart_data *uart,
 				      unsigned long default_freq,
diff --git a/platform/generic/platform.c b/platform/generic/platform.c
index 1df0280d..51e9f342 100644
--- a/platform/generic/platform.c
+++ b/platform/generic/platform.c
@@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
 
 int generic_extensions_init(bool cold_boot)
 {
+	int rc;
+
 	if (!cold_boot)
 		return 0;
 
 	/* Parse the ISA string from FDT and enable the listed extensions */
-	return fdt_parse_isa_extensions_all_harts(fdt_get_address());
+	rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
+	if (rc)
+		return rc;
+
+	/* Parse RISC-V Worlds CPU properties from FDT */
+	rc = fdt_parse_worlds_all_harts(fdt_get_address());
+	if (rc)
+		return rc;
+
+	return 0;
 }
 
 int generic_domains_init(void)
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v2 3/9] lib: fdt_domain: parse domain WID properties

[Yu-Chien Peter Lin]

Add wid and widdeleg fields to struct sbi_domain to store the
RISC-V Worlds mlwid and mwideleg CSR values for each domain.
Also, parse the root and user-defined domains' WID during
fdt_domains_populate().

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
Changes v1 -> v2:
- Add root subnode for root domain configuration (Oza and Anup)
- Rename next_wid/widlist to wid/widdeleg (Oza)
---
 include/sbi/sbi_domain.h   |  6 +++++
 lib/utils/fdt/fdt_domain.c | 50 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/include/sbi/sbi_domain.h b/include/sbi/sbi_domain.h
index 16edd4ce..44c8befc 100644
--- a/include/sbi/sbi_domain.h
+++ b/include/sbi/sbi_domain.h
@@ -215,6 +215,12 @@ struct sbi_domain {
 	bool system_reset_allowed;
 	/** Is domain allowed to suspend the system */
 	bool system_suspend_allowed;
+	/** World ID for this domain (mlwid value) */
+	u32 wid;
+	/** Whether World ID was explicitly set */
+	bool has_wid;
+	/** World ID delegation bitmask for this domain (mwiddeleg value) */
+	u64 widdeleg;
 	/** Identifies whether to include the firmware region */
 	bool fw_region_inited;
 };
diff --git a/lib/utils/fdt/fdt_domain.c b/lib/utils/fdt/fdt_domain.c
index 61627db3..68dd6da4 100644
--- a/lib/utils/fdt/fdt_domain.c
+++ b/lib/utils/fdt/fdt_domain.c
@@ -307,6 +307,27 @@ static int __fdt_parse_region(const void *fdt, int domain_offset,
 	return 0;
 }
 
+static void fdt_parse_domain_wid_props(const void *fdt, int offset,
+				       struct sbi_domain *dom)
+{
+	const fdt32_t *val;
+	int len;
+	u64 val64;
+
+	val = fdt_getprop(fdt, offset, "wid", &len);
+	if (val && len == sizeof(fdt32_t)) {
+		dom->wid = fdt32_to_cpu(val[0]);
+		dom->has_wid = true;
+	}
+
+	val = fdt_getprop(fdt, offset, "widdeleg", &len);
+	if (val && (len == (2 * sizeof(fdt32_t)))) {
+		val64 = fdt32_to_cpu(val[0]);
+		val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
+		dom->widdeleg = val64;
+	}
+}
+
 static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
 {
 	u32 val32;
@@ -469,6 +490,9 @@ static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
 	}
 	dom->next_mode = val32;
 
+	/* Read "wid" and "widdeleg" DT properties */
+	fdt_parse_domain_wid_props(fdt, domain_offset, dom);
+
 	/* Read "system-reset-allowed" DT property */
 	if (fdt_get_property(fdt, domain_offset,
 			     "system-reset-allowed", NULL))
@@ -535,6 +559,29 @@ fail_free_domain:
 	return err;
 }
 
+static void fdt_parse_root_domain(const void *fdt)
+{
+	int offset;
+
+	if (!fdt)
+		return;
+
+	offset = fdt_path_offset(fdt, "/chosen");
+	if (offset < 0)
+		return;
+
+	offset = fdt_node_offset_by_compatible(fdt, offset,
+					       "opensbi,domain,config");
+	if (offset < 0)
+		return;
+
+	offset = fdt_subnode_offset(fdt, offset, "root");
+	if (offset < 0)
+		return;
+
+	fdt_parse_domain_wid_props(fdt, offset, &root);
+}
+
 int fdt_domains_populate(const void *fdt)
 {
 	const u32 *val;
@@ -573,6 +620,9 @@ int fdt_domains_populate(const void *fdt)
 		break;
 	}
 
+	/* Parse root domain config from "root" subnode */
+	fdt_parse_root_domain(fdt);
+
 	/* Iterate over each domain in FDT and populate details */
 	return fdt_iterate_each_domain_ro(fdt, &cold_domain_offset,
 					  __fdt_parse_domain);
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v2 4/9] lib: sbi_hart: lock mwid CSR for RoT immutability

[Yu-Chien Peter Lin]

Lock the M-mode World ID (mwid) CSR during hart re-initialization
to enforce immutability of the WID established by the root-of-trust.

OpenSBI does not assign the WID value itself; it only sets MWID_LOCK
to freeze the value established by prior RoT stage. The MWID_LOCK bit
at XLEN-1 is sticky and makes the CSR read-only until reset, enforcing
a temporal security boundary per the RISC-V Worlds specification.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 lib/sbi/sbi_hart.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index f5f4062e..29856c0f 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -724,6 +724,13 @@ int sbi_hart_reinit(struct sbi_scratch *scratch)
 	if (rc)
 		return rc;
 
+	/*
+	 * Assume MWID is restored by root-of-trust M-mode in previous
+	 * stage. Lock mwid so RoT-defined WID remains immutable.
+	 */
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID))
+		csr_set(CSR_MWID, MWID_LOCK);
+
 	return 0;
 }
 
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v2 5/9] lib: sbi_hart: add WID protection mechanism

[Yu-Chien Peter Lin]

Register a WID-based hart protection mechanism that
configures mlwid and mwiddeleg CSRs on domain entry.
This enables the protection framework reconfigure WID
isolation whenever domains are switched.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
Changes v1 -> v2:
- Validate WID against pmlwidlist before writing mlwid CSR (Oza)
---
 include/sbi/sbi_hart_worlds.h | 24 ++++++++++++
 lib/sbi/objects.mk            |  1 +
 lib/sbi/sbi_hart.c            |  5 +++
 lib/sbi/sbi_hart_worlds.c     | 72 +++++++++++++++++++++++++++++++++++
 4 files changed, 102 insertions(+)
 create mode 100644 include/sbi/sbi_hart_worlds.h
 create mode 100644 lib/sbi/sbi_hart_worlds.c

diff --git a/include/sbi/sbi_hart_worlds.h b/include/sbi/sbi_hart_worlds.h
new file mode 100644
index 00000000..2bb35a7e
--- /dev/null
+++ b/include/sbi/sbi_hart_worlds.h
@@ -0,0 +1,24 @@
+/*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2026 SiFive Inc.
+ */
+
+#ifndef __SBI_HART_WORLDS_H__
+#define __SBI_HART_WORLDS_H__
+
+struct sbi_scratch;
+
+/**
+ * Initialize WID hart protection for current HART
+ *
+ * Registers the WID protection mechanism if Smwid/Smlwid
+ * extensions are present.
+ *
+ * @param scratch pointer to scratch space of current HART
+ *
+ * @return 0 on success and negative error code on failure
+ */
+int sbi_hart_worlds_init(struct sbi_scratch *scratch);
+
+#endif /* __SBI_HART_WORLDS_H__ */
diff --git a/lib/sbi/objects.mk b/lib/sbi/objects.mk
index c29c888f..ac026dec 100644
--- a/lib/sbi/objects.mk
+++ b/lib/sbi/objects.mk
@@ -77,6 +77,7 @@ libsbi-objs-y += sbi_fwft.o
 libsbi-objs-y += sbi_hart.o
 libsbi-objs-y += sbi_hart_pmp.o
 libsbi-objs-y += sbi_hart_protection.o
+libsbi-objs-y += sbi_hart_worlds.o
 libsbi-objs-y += sbi_heap.o
 libsbi-objs-y += sbi_math.o
 libsbi-objs-y += sbi_hfence.o
diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index 29856c0f..e92f0af3 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -17,6 +17,7 @@
 #include <sbi/sbi_error.h>
 #include <sbi/sbi_hart.h>
 #include <sbi/sbi_hart_pmp.h>
+#include <sbi/sbi_hart_worlds.h>
 #include <sbi/sbi_platform.h>
 #include <sbi/sbi_pmu.h>
 #include <sbi/sbi_string.h>
@@ -762,6 +763,10 @@ int sbi_hart_init(struct sbi_scratch *scratch, bool cold_boot)
 		rc = sbi_hart_pmp_init(scratch);
 		if (rc)
 			return rc;
+
+		rc = sbi_hart_worlds_init(scratch);
+		if (rc)
+			return rc;
 	}
 
 	return sbi_hart_reinit(scratch);
diff --git a/lib/sbi/sbi_hart_worlds.c b/lib/sbi/sbi_hart_worlds.c
new file mode 100644
index 00000000..d9d69b07
--- /dev/null
+++ b/lib/sbi/sbi_hart_worlds.c
@@ -0,0 +1,72 @@
+/*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2026 SiFive Inc.
+ */
+
+#include <sbi/riscv_encoding.h>
+#include <sbi/sbi_console.h>
+#include <sbi/sbi_domain.h>
+#include <sbi/sbi_error.h>
+#include <sbi/sbi_hart.h>
+#include <sbi/sbi_hart_protection.h>
+#include <sbi/sbi_hart_worlds.h>
+#include <sbi/sbi_scratch.h>
+
+static int sbi_hart_worlds_configure(struct sbi_scratch *scratch,
+				     struct sbi_domain *dom)
+{
+	struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
+	bool wid_found = true;
+	u32 wid_val = 0;
+
+	if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
+		return 0;
+
+	if (dom->has_wid) {
+		wid_val = dom->wid;
+	} else if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID)) {
+		wid_val = csr_read(CSR_MWID) & ~MWID_LOCK;
+	} else if (hf->has_pmwid) {
+		wid_val = hf->pmwid;
+	} else {
+		/*
+		 * Smlwid present but no WID source. Without writing
+		 * mlwid, the hardware reset value is used which may
+		 * cause a software-check exception on lower-privilege
+		 * mode entry.
+		 */
+		wid_found = false;
+	}
+
+	if (wid_found) {
+		if (hf->has_pmlwidlist &&
+		    !(hf->pmlwidlist & BIT_ULL(wid_val))) {
+			sbi_printf("%s: domain wid %u not in pmlwidlist\n",
+				   __func__, wid_val);
+			return SBI_EINVAL;
+		}
+		csr_write(CSR_MLWID, wid_val);
+	}
+
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG))
+		csr_write(CSR_MWIDDELEG, dom->widdeleg);
+
+	return 0;
+}
+
+static struct sbi_hart_protection wid_protection = {
+	.name		= "wid",
+	.rating		= 100,
+	.type		= SBI_HART_PROTECTION_TYPE_ID,
+	.configure	= sbi_hart_worlds_configure,
+	.unconfigure	= NULL
+};
+
+int sbi_hart_worlds_init(struct sbi_scratch *scratch)
+{
+	if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
+		return 0;
+
+	return sbi_hart_protection_register(&wid_protection);
+}
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v2 6/9] lib: sbi_domain_context: add slwid to per-domain S-mode context

[Yu-Chien Peter Lin]

slwid is the S-mode CSR that controls U-mode's World ID. Since
each domain may run different U-mode workloads with different
WID isolation requirements, slwid must be part of the per-domain
S-mode context.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 lib/sbi/sbi_domain_context.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/lib/sbi/sbi_domain_context.c b/lib/sbi/sbi_domain_context.c
index 0861d541..0b45c0fd 100644
--- a/lib/sbi/sbi_domain_context.c
+++ b/lib/sbi/sbi_domain_context.c
@@ -50,6 +50,8 @@ struct hart_context {
 	unsigned long senvcfg;
 	/** Supervisor resource management configuration register */
 	unsigned long srmcfg;
+	/** Supervisor lower-privilege mode World ID register */
+	unsigned long slwid;
 
 	/** Float context state */
 	struct sbi_fp_context fp_ctx;
@@ -145,6 +147,17 @@ static int switch_to_next_domain_context(struct hart_context *ctx,
 		ctx->senvcfg	= csr_swap(CSR_SENVCFG, dom_ctx->senvcfg);
 	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SSQOSID))
 		ctx->srmcfg	= csr_swap(CSR_SRMCFG, dom_ctx->srmcfg);
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SSWID)) {
+		/*
+		 * Temporarily enable Sswid so slwid is accessible for
+		 * swap. The target domain's mwiddeleg is restored by
+		 * sbi_hart_protection_reconfigure() below.
+		 */
+		csr_write(CSR_MWIDDELEG, ~0UL);
+		if (csr_read(CSR_MWIDDELEG))
+			ctx->slwid = csr_swap(CSR_SLWID, dom_ctx->slwid);
+		csr_write(CSR_MWIDDELEG, 0);
+	}
 
 	/* Eager context switch for float */
 	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_F) ||
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v2 7/9] include: sbi_types: add PRIx64 format macro

[Yu-Chien Peter Lin]

Add PRIx64 for portable 64-bit hex printing. Expands
to 016lx on RV64 and 016llx on RV32, enabling consistent
printf-style formatting of uint64_t values.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 include/sbi/sbi_types.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/sbi/sbi_types.h b/include/sbi/sbi_types.h
index b8a7e6cb..780a4c2a 100644
--- a/include/sbi/sbi_types.h
+++ b/include/sbi/sbi_types.h
@@ -34,12 +34,14 @@ typedef unsigned long		u64;
 typedef long			int64_t;
 typedef unsigned long		uint64_t;
 #define PRILX			"016lx"
+#define PRIx64			"016lx"
 #elif __riscv_xlen == 32
 typedef long long		s64;
 typedef unsigned long long	u64;
 typedef long long		int64_t;
 typedef unsigned long long	uint64_t;
 #define PRILX			"08lx"
+#define PRIx64			"016llx"
 #else
 #error "Unexpected __riscv_xlen"
 #endif
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v2 8/9] lib: sbi: display World ID configuration at boot

[Yu-Chien Peter Lin]

Display domain-specific World ID (Wid/Widdeleg)
and M-mode World ID source (from mwid/pmwid) during
initialization for RISC-V Worlds debugging and
verification.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 lib/sbi/sbi_domain.c | 31 +++++++++++++++++++++++++++++++
 lib/sbi/sbi_init.c   | 13 +++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
index fa69170b..d1f7bb0c 100644
--- a/lib/sbi/sbi_domain.c
+++ b/lib/sbi/sbi_domain.c
@@ -10,6 +10,7 @@
 #include <sbi/riscv_asm.h>
 #include <sbi/sbi_console.h>
 #include <sbi/sbi_domain.h>
+#include <sbi/sbi_hart.h>
 #include <sbi/sbi_hartmask.h>
 #include <sbi/sbi_heap.h>
 #include <sbi/sbi_hsm.h>
@@ -533,6 +534,8 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
 	u32 i, j, k;
 	unsigned long rstart, rend;
 	struct sbi_domain_memregion *reg;
+	struct sbi_scratch *scratch = sbi_scratch_thishart_ptr();
+	const struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
 
 	sbi_printf("Domain%d Name        %s: %s\n",
 		   dom->index, suffix, dom->name);
@@ -608,6 +611,34 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
 		break;
 	}
 
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) {
+		if (dom->has_wid) {
+			sbi_printf("Domain%d Wid         %s: %u\n",
+				   dom->index, suffix, dom->wid);
+		} else if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID)) {
+			sbi_printf("Domain%d Wid         %s: %lu (mwid)\n",
+				   dom->index, suffix,
+				   csr_read(CSR_MWID) & ~MWID_LOCK);
+		} else if (hf->has_pmwid) {
+			sbi_printf("Domain%d Wid         %s: %u (pmwid)\n",
+				   dom->index, suffix, hf->pmwid);
+		} else {
+			sbi_printf("Domain%d Wid         %s: unknown\n",
+				   dom->index, suffix);
+		}
+	} else {
+		sbi_printf("Domain%d Wid         %s: unsupported\n",
+			   dom->index, suffix);
+	}
+
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
+		sbi_printf("Domain%d Widdeleg    %s: 0x%" PRIx64 "\n",
+			   dom->index, suffix, dom->widdeleg);
+	} else {
+		sbi_printf("Domain%d Widdeleg    %s: unsupported\n",
+			   dom->index, suffix);
+	}
+
 	sbi_printf("Domain%d SysReset    %s: %s\n",
 		   dom->index, suffix, (dom->system_reset_allowed) ? "yes" : "no");
 
diff --git a/lib/sbi/sbi_init.c b/lib/sbi/sbi_init.c
index acd2f8b6..f771f548 100644
--- a/lib/sbi/sbi_init.c
+++ b/lib/sbi/sbi_init.c
@@ -167,6 +167,7 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
 	int xlen;
 	char str[256];
 	const struct sbi_domain *dom = sbi_domain_thishart_ptr();
+	struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
 
 	if (scratch->options & SBI_SCRATCH_NO_BOOT_PRINTS)
 		return;
@@ -199,6 +200,18 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
 	sbi_printf("Boot HART Debug Triggers    : %d triggers\n",
 		   sbi_dbtr_get_total_triggers());
 	sbi_hart_delegation_dump(scratch, "Boot HART ", "           ");
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID)) {
+		ulong mwid = csr_read(CSR_MWID);
+
+		sbi_printf("Boot HART M-mode World ID   : %lu (%s)\n",
+			   mwid & ~MWID_LOCK,
+			   (mwid & MWID_LOCK) ? "locked" : "unlocked");
+	} else if (hf->has_pmwid) {
+		sbi_printf("Boot HART M-mode World ID   : %u (pmwid)\n",
+			   hf->pmwid);
+	} else {
+		sbi_printf("Boot HART M-mode World ID   : unsupported\n");
+	}
 }
 
 static unsigned long coldboot_done;
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v2 9/9] docs: document WID DT properties

[Yu-Chien Peter Lin]

Add "wid" and "widdeleg" properties to domain instance node
documentation and example DT. Add a "Root Domain Node" section
describing the "root" subnode under the domain configuration
node for root domain WID configuration

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
 docs/domain_support.md | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/docs/domain_support.md b/docs/domain_support.md
index e267a9f7..c35a1d9a 100644
--- a/docs/domain_support.md
+++ b/docs/domain_support.md
@@ -93,6 +93,8 @@ following manner:
   is the next mode for the ROOT domain
 * **system_reset_allowed** - The ROOT domain is allowed to reset the system
 * **system_suspend_allowed** - The ROOT domain is allowed to suspend the system
+* **wid** - Configurable World ID for the ROOT domain
+* **widdeleg** - Configurable World ID delegation bitmask for the ROOT domain
 
 Domain Effects
 --------------
@@ -126,6 +128,23 @@ The DT properties of a domain configuration DT node are as follows:
 * **compatible** (Mandatory) - The compatible string of the domain
   configuration. This DT property should have value *"opensbi,domain,config"*
 
+### Root Domain Node
+
+The root domain WID configuration is described in a **root** subnode under
+the domain configuration DT node. This subnode does not have a compatible
+string.
+
+The DT properties of the root domain node are as follows:
+
+* **wid** (Optional) - The 32 bit World ID for lower-privilege modes
+  (S/U-mode) for the ROOT domain. If present, OpenSBI writes this value
+  to **mlwid** when entering the ROOT domain (requires Smlwid extension).
+  If absent, OpenSBI uses the M-mode WID as fallback.
+* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
+  the ROOT domain. If present, OpenSBI writes this value to **mwiddeleg**
+  when entering the ROOT domain (requires Smwiddeleg extension). If absent,
+  clears **mwiddeleg** to disable S-mode WID delegation.
+
 ### Domain Memory Region Node
 
 The domain memory region DT node describes details of a memory region and
@@ -204,6 +223,14 @@ The DT properties of a domain instance DT node are as follows:
   whether the domain instance is allowed to do system reset.
 * **system-suspend-allowed** (Optional) - A boolean flag representing
   whether the domain instance is allowed to do system suspend.
+* **wid** (Optional) - The 32 bit World ID for lower-privilege modes
+  (S/U-mode) for the domain instance. If present, OpenSBI writes this value
+  to **mlwid** on context switch into this domain (requires Smlwid extension).
+  If absent, OpenSBI uses the M-mode WID as fallback.
+* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
+  the domain instance. If present, OpenSBI writes this value to **mwiddeleg**
+  on context switch into this domain (requires Smwiddeleg extension). If absent,
+  clears **mwiddeleg** to disable S-mode WID delegation.
 
 ### Assigning HART To Domain Instance
 
@@ -260,6 +287,11 @@ be done:
                 order = <64>;
             };
 
+            root {
+                wid = <3>;
+                widdeleg = <0x0 0x0>;
+            };
+
             tdomain: trusted-domain {
                 compatible = "opensbi,domain,instance";
                 possible-harts = <&cpu0>;
@@ -268,6 +300,8 @@ be done:
                 next-arg1 = <0x0 0x0>;
                 next-addr = <0x0 0x80100000>;
                 next-mode = <0x0>;
+                wid = <1>;
+                widdeleg = <0x0 0x6>;
                 system-reset-allowed;
                 system-suspend-allowed;
             };
@@ -276,6 +310,8 @@ be done:
                 compatible = "opensbi,domain,instance";
                 possible-harts = <&cpu1 &cpu2 &cpu3 &cpu4>;
                 regions = <&tmem 0x0>, <&tuart 0x0>, <&allmem 0x3f>;
+                wid = <0>;
+                widdeleg = <0x0 0x1>;
             };
         };
     };
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 5/9] lib: sbi_hart: add WID protection mechanism

[Yu-Chien Peter Lin]

On Mon, Aug 17, 2026 at 05:04:59PM +0800, Yu-Chien Peter Lin wrote:
> Register a WID-based hart protection mechanism that
> configures mlwid and mwiddeleg CSRs on domain entry.
> This enables the protection framework reconfigure WID
> isolation whenever domains are switched.
> 
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Changes v1 -> v2:
> - Validate WID against pmlwidlist before writing mlwid CSR (Oza)
> ---
>  include/sbi/sbi_hart_worlds.h | 24 ++++++++++++
>  lib/sbi/objects.mk            |  1 +
>  lib/sbi/sbi_hart.c            |  5 +++
>  lib/sbi/sbi_hart_worlds.c     | 72 +++++++++++++++++++++++++++++++++++
>  4 files changed, 102 insertions(+)
>  create mode 100644 include/sbi/sbi_hart_worlds.h
>  create mode 100644 lib/sbi/sbi_hart_worlds.c
> 
> diff --git a/include/sbi/sbi_hart_worlds.h b/include/sbi/sbi_hart_worlds.h
> new file mode 100644
> index 00000000..2bb35a7e
> --- /dev/null
> +++ b/include/sbi/sbi_hart_worlds.h
> @@ -0,0 +1,24 @@
> +/*
> + * SPDX-License-Identifier: BSD-2-Clause
> + *
> + * Copyright (c) 2026 SiFive Inc.
> + */
> +
> +#ifndef __SBI_HART_WORLDS_H__
> +#define __SBI_HART_WORLDS_H__
> +
> +struct sbi_scratch;
> +
> +/**
> + * Initialize WID hart protection for current HART
> + *
> + * Registers the WID protection mechanism if Smwid/Smlwid
> + * extensions are present.

Only Smlwid is needed for registration. Will update comment here
in the next version.

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 1/9] lib: sbi_hart: detect RISC-V Worlds ISA extensions

[Pawandeep Oza]

On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add CSR definitions for RISC-V Worlds (mwid, mlwid, mlwidlist,
> mwiddeleg, slwid) and detect Worlds extensions via CSR probes
> in hart_detect_features().
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  include/sbi/riscv_encoding.h | 12 ++++++++++++
>  include/sbi/sbi_hart.h       | 10 ++++++++++
>  lib/sbi/sbi_hart.c           | 26 ++++++++++++++++++++++++++
>  3 files changed, 48 insertions(+)
>
> diff --git a/include/sbi/riscv_encoding.h b/include/sbi/riscv_encoding.h
> index ffe7666c..e0262bfc 100644
> --- a/include/sbi/riscv_encoding.h
> +++ b/include/sbi/riscv_encoding.h
> @@ -400,6 +400,9 @@
>  /* Supervisor Resource Management Configuration CSRs */
>  #define CSR_SRMCFG                     0x181
>
> +/* Supervisor lower-privilege mode World ID CSR (Sswid) */
> +#define CSR_SLWID                      0x190
> +
>  /* Machine-Level Control transfer records CSRs */
>  #define CSR_MCTRCTL                     0x34e
>
> @@ -520,6 +523,15 @@
>  #define CSR_MTINST                     0x34a
>  #define CSR_MTVAL2                     0x34b
>
> +/* Machine World ID CSRs (Smwid, Smlwid, Smlwidlist, Smwiddeleg) */
> +#define CSR_MLWID                      0x390
> +#define CSR_MWID                       0x749
> +#define CSR_MWIDDELEG                  0x748
> +#define CSR_MLWIDLIST                  0x74A
> +
> +/* mwid lock bit */
> +#define MWID_LOCK                      (_UL(1) << (__riscv_xlen - 1))
> +
>  /* Machine Memory Protection */
>  #define CSR_PMPCFG0                    0x3a0
>  #define CSR_PMPCFG1                    0x3a1
> diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> index 543393bb..2941809e 100644
> --- a/include/sbi/sbi_hart.h
> +++ b/include/sbi/sbi_hart.h
> @@ -95,6 +95,16 @@ enum sbi_hart_extensions {
>         SBI_HART_EXT_F,
>         /** Hart has D extension */
>         SBI_HART_EXT_D,
> +       /** Hart has Smwid extension */
> +       SBI_HART_EXT_SMWID,
> +       /** Hart has Smlwid extension */
> +       SBI_HART_EXT_SMLWID,
> +       /** Hart has Smlwidlist extension */
> +       SBI_HART_EXT_SMLWIDLIST,
> +       /** Hart has Smwiddeleg extension */
> +       SBI_HART_EXT_SMWIDDELEG,
> +       /** Hart has Sswid extension */
> +       SBI_HART_EXT_SSWID,
>
>         /** Maximum index of Hart extension */
>         SBI_HART_EXT_MAX,
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index bee88557..f5f4062e 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -360,6 +360,11 @@ const struct sbi_hart_ext_data sbi_hart_ext[] = {
>         __SBI_HART_EXT_DATA(v, SBI_HART_EXT_V),
>         __SBI_HART_EXT_DATA(f, SBI_HART_EXT_F),
>         __SBI_HART_EXT_DATA(d, SBI_HART_EXT_D),
> +       __SBI_HART_EXT_DATA(smwid, SBI_HART_EXT_SMWID),
> +       __SBI_HART_EXT_DATA(smlwid, SBI_HART_EXT_SMLWID),
> +       __SBI_HART_EXT_DATA(smlwidlist, SBI_HART_EXT_SMLWIDLIST),
> +       __SBI_HART_EXT_DATA(smwiddeleg, SBI_HART_EXT_SMWIDDELEG),
> +       __SBI_HART_EXT_DATA(sswid, SBI_HART_EXT_SSWID),
>  };
>
>  _Static_assert(SBI_HART_EXT_MAX == array_size(sbi_hart_ext),
> @@ -647,9 +652,30 @@ __pmp_skip:
>         /* Detect if hart support sdtrig (debug triggers) */
>         __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
>                         CSR_TSELECT, SBI_HART_EXT_SDTRIG);
> +       /* Detect if hart supports Smwid */
> +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> +                       CSR_MWID, SBI_HART_EXT_SMWID);
> +       /* Detect if hart supports Smlwid */
> +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> +                       CSR_MLWID, SBI_HART_EXT_SMLWID);
> +       /* Detect if hart supports Smlwidlist */
> +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> +                       CSR_MLWIDLIST, SBI_HART_EXT_SMLWIDLIST);
> +       /* Detect if hart supports Smwiddeleg */
> +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> +                       CSR_MWIDDELEG, SBI_HART_EXT_SMWIDDELEG);
>
>  #undef __check_ext_csr
>
> +       /*
> +        * slwid traps on access when mwiddeleg=0 (reset state), so
> +        * Sswid presence is inferred from Smwiddeleg.
> +        */
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
> +               __sbi_hart_update_extension(hfeatures,
> +                                           SBI_HART_EXT_SSWID, true);
> +       }
> +
>  #define __check_csr_existence(__csr, __csr_id)                         \
>         csr_read_allowed(__csr, &trap);                                 \
>         if (!trap.cause)                                                \
> --
> 2.43.7
>

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 2/9] lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties

[Pawandeep Oza]

On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add fdt_parse_worlds_all_harts() to parse platform-defined DT
> properties in the /cpus/cpu@X:
> - riscv,pmwid: M-mode World ID
> - riscv,pmwidlist: bitmap of permitted M-mode WIDs
> - riscv,pmlwidlist: bitmap of permitted lower-privilege WIDs
> Initialize parsed values in sbi_hart_features with has_* presence
> flags.
>
> These platform-defined values serve as the root-of-trust constraints
> for per-domain WID assignment during domain creation and context
> switching.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  include/sbi/sbi_hart.h             |  6 ++
>  include/sbi_utils/fdt/fdt_helper.h |  2 +
>  lib/utils/fdt/fdt_helper.c         | 92 ++++++++++++++++++++++++++++++
>  platform/generic/platform.c        | 13 ++++-
>  4 files changed, 112 insertions(+), 1 deletion(-)
>
> diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> index 2941809e..4fcf5372 100644
> --- a/include/sbi/sbi_hart.h
> +++ b/include/sbi/sbi_hart.h
> @@ -135,6 +135,12 @@ struct sbi_hart_features {
>         unsigned int pmp_log2gran;
>         unsigned int mhpm_mask;
>         unsigned int mhpm_bits;
> +       u32 pmwid;
> +       u64 pmwidlist;
> +       u64 pmlwidlist;
> +       bool has_pmwid;
> +       bool has_pmwidlist;
> +       bool has_pmlwidlist;

Oza: do you need these 3 booleans ?

you can find out from the value itslef ?
pmwidlist == 0 means not rpesent
pmlwidlist = 0 means not rpesent
and may be pmwid == UINT_MAX then not present ?

>  };
>
>  extern unsigned long hart_features_offset;
> diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
> index 75a564d1..3f3d091b 100644
> --- a/include/sbi_utils/fdt/fdt_helper.h
> +++ b/include/sbi_utils/fdt/fdt_helper.h
> @@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
>
>  int fdt_parse_isa_extensions_all_harts(const void *fdt);
>
> +int fdt_parse_worlds_all_harts(const void *fdt);
> +
>  int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
>                                 struct platform_uart_data *uart);
>
> diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
> index 747ba028..d6025705 100644
> --- a/lib/utils/fdt/fdt_helper.c
> +++ b/lib/utils/fdt/fdt_helper.c
> @@ -457,6 +457,98 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
>         return 0;
>  }
>
> +int fdt_parse_worlds_all_harts(const void *fdt)
> +{
> +       u32 hartid;
> +       const fdt32_t *val;
> +       struct sbi_scratch *scratch;
> +       struct sbi_hart_features *hfeatures;
> +       int err, cpu_offset, cpus_offset, len;
> +
> +       if (!fdt)
> +               return SBI_EINVAL;
> +
> +       cpus_offset = fdt_path_offset(fdt, "/cpus");
> +       if (cpus_offset < 0)
> +               return cpus_offset;
> +
> +       fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
> +               err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
> +               if (err)
> +                       continue;
> +
> +               if (!fdt_node_is_enabled(fdt, cpu_offset))
> +                       continue;
> +
> +               scratch = sbi_hartid_to_scratch(hartid);
> +               if (!scratch)
> +                       return SBI_ENOENT;
> +
> +               hfeatures = sbi_hart_features_ptr(scratch);
> +               if (!hfeatures)
> +                       return SBI_ENOENT;
> +
> +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
> +               if (val && len == sizeof(fdt32_t)) {
> +                       hfeatures->pmwid = fdt32_to_cpu(*val);
> +                       hfeatures->has_pmwid = true;
> +               }
> +
> +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
> +               if (val && len == 2 * sizeof(fdt32_t)) {
> +                       hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> +                                               fdt32_to_cpu(val[1]);
> +                       hfeatures->has_pmwidlist = true;
> +               }
> +
> +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
> +               if (val && len == 2 * sizeof(fdt32_t)) {
> +                       hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> +                                                fdt32_to_cpu(val[1]);
> +                       hfeatures->has_pmlwidlist = true;
> +               }
> +
> +               /* Sanity checks */
> +               if (hfeatures->has_pmwidlist && !hfeatures->pmwidlist) {
> +                       sbi_printf("%s: hart%u riscv,pmwidlist is empty\n",
> +                                  __func__, hartid);
> +                       return SBI_EINVAL;
> +               }
> +
> +#if __riscv_xlen == 32
> +               if (hfeatures->has_pmwidlist &&
> +                   (hfeatures->pmwidlist >> 32)) {
> +                       sbi_printf("%s: hart%u riscv,pmwidlist has bits beyond XLEN\n",
> +                                  __func__, hartid);
> +                       return SBI_EINVAL;
> +               }
> +
> +               if (hfeatures->has_pmlwidlist &&
> +                   (hfeatures->pmlwidlist >> 32)) {
> +                       sbi_printf("%s: hart%u riscv,pmlwidlist has bits beyond XLEN\n",
> +                                  __func__, hartid);
> +                       return SBI_EINVAL;
> +               }
> +#endif
> +
> +               if (hfeatures->has_pmwid &&
> +                   hfeatures->pmwid >= __riscv_xlen) {
> +                       sbi_printf("%s: hart%u riscv,pmwid (%u) exceeds max WID\n",
> +                                  __func__, hartid, hfeatures->pmwid);
> +                       return SBI_EINVAL;
> +               }
> +
> +               if (hfeatures->has_pmwidlist && hfeatures->has_pmwid &&
> +                   !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
> +                       sbi_printf("%s: hart%u riscv,pmwid (%u) not in pmwidlist\n",
> +                                  __func__, hartid, hfeatures->pmwid);
> +                       return SBI_EINVAL;
> +               }
> +       }
> +
> +       return 0;
> +}
> +
>  static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
>                                       struct platform_uart_data *uart,
>                                       unsigned long default_freq,
> diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> index 1df0280d..51e9f342 100644
> --- a/platform/generic/platform.c
> +++ b/platform/generic/platform.c
> @@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
>
>  int generic_extensions_init(bool cold_boot)
>  {
> +       int rc;
> +
>         if (!cold_boot)
>                 return 0;
>
>         /* Parse the ISA string from FDT and enable the listed extensions */
> -       return fdt_parse_isa_extensions_all_harts(fdt_get_address());
> +       rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
> +       if (rc)
> +               return rc;
> +
> +       /* Parse RISC-V Worlds CPU properties from FDT */
> +       rc = fdt_parse_worlds_all_harts(fdt_get_address());
> +       if (rc)
> +               return rc;
> +
> +       return 0;
>  }
>
>  int generic_domains_init(void)
> --
> 2.43.7
>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 3/9] lib: fdt_domain: parse domain WID properties

[Pawandeep Oza]

On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add wid and widdeleg fields to struct sbi_domain to store the
> RISC-V Worlds mlwid and mwideleg CSR values for each domain.
> Also, parse the root and user-defined domains' WID during
> fdt_domains_populate().
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Changes v1 -> v2:
> - Add root subnode for root domain configuration (Oza and Anup)
> - Rename next_wid/widlist to wid/widdeleg (Oza)
> ---
>  include/sbi/sbi_domain.h   |  6 +++++
>  lib/utils/fdt/fdt_domain.c | 50 ++++++++++++++++++++++++++++++++++++++
>  2 files changed, 56 insertions(+)
>
> diff --git a/include/sbi/sbi_domain.h b/include/sbi/sbi_domain.h
> index 16edd4ce..44c8befc 100644
> --- a/include/sbi/sbi_domain.h
> +++ b/include/sbi/sbi_domain.h
> @@ -215,6 +215,12 @@ struct sbi_domain {
>         bool system_reset_allowed;
>         /** Is domain allowed to suspend the system */
>         bool system_suspend_allowed;
> +       /** World ID for this domain (mlwid value) */
> +       u32 wid;
> +       /** Whether World ID was explicitly set */
> +       bool has_wid;
Oza: again here you may be able to find out if wid == UINT_MAX then
wid is not set. because we have finite number of N wolrds so max is N
-1 ?
you can then drop bool has_wid;

> +       /** World ID delegation bitmask for this domain (mwiddeleg value) */
> +       u64 widdeleg;
>         /** Identifies whether to include the firmware region */
>         bool fw_region_inited;
>  };
> diff --git a/lib/utils/fdt/fdt_domain.c b/lib/utils/fdt/fdt_domain.c
> index 61627db3..68dd6da4 100644
> --- a/lib/utils/fdt/fdt_domain.c
> +++ b/lib/utils/fdt/fdt_domain.c
> @@ -307,6 +307,27 @@ static int __fdt_parse_region(const void *fdt, int domain_offset,
>         return 0;
>  }
>
> +static void fdt_parse_domain_wid_props(const void *fdt, int offset,
> +                                      struct sbi_domain *dom)
> +{
> +       const fdt32_t *val;
> +       int len;
> +       u64 val64;
> +
> +       val = fdt_getprop(fdt, offset, "wid", &len);
> +       if (val && len == sizeof(fdt32_t)) {
> +               dom->wid = fdt32_to_cpu(val[0]);
> +               dom->has_wid = true;
> +       }
> +
> +       val = fdt_getprop(fdt, offset, "widdeleg", &len);
> +       if (val && (len == (2 * sizeof(fdt32_t)))) {
> +               val64 = fdt32_to_cpu(val[0]);
> +               val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
> +               dom->widdeleg = val64;
> +       }
> +}
> +
>  static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
>  {
>         u32 val32;
> @@ -469,6 +490,9 @@ static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
>         }
>         dom->next_mode = val32;
>
> +       /* Read "wid" and "widdeleg" DT properties */
> +       fdt_parse_domain_wid_props(fdt, domain_offset, dom);
> +
>         /* Read "system-reset-allowed" DT property */
>         if (fdt_get_property(fdt, domain_offset,
>                              "system-reset-allowed", NULL))
> @@ -535,6 +559,29 @@ fail_free_domain:
>         return err;
>  }
>
> +static void fdt_parse_root_domain(const void *fdt)
> +{
> +       int offset;
> +
> +       if (!fdt)
> +               return;
> +
> +       offset = fdt_path_offset(fdt, "/chosen");
> +       if (offset < 0)
> +               return;
> +
> +       offset = fdt_node_offset_by_compatible(fdt, offset,
> +                                              "opensbi,domain,config");
> +       if (offset < 0)
> +               return;
> +
> +       offset = fdt_subnode_offset(fdt, offset, "root");
> +       if (offset < 0)
> +               return;
> +
> +       fdt_parse_domain_wid_props(fdt, offset, &root);
> +}
> +
>  int fdt_domains_populate(const void *fdt)
>  {
>         const u32 *val;
> @@ -573,6 +620,9 @@ int fdt_domains_populate(const void *fdt)
>                 break;
>         }
>
> +       /* Parse root domain config from "root" subnode */
> +       fdt_parse_root_domain(fdt);
> +
>         /* Iterate over each domain in FDT and populate details */
>         return fdt_iterate_each_domain_ro(fdt, &cold_domain_offset,
>                                           __fdt_parse_domain);
> --
> 2.43.7
>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 4/9] lib: sbi_hart: lock mwid CSR for RoT immutability

[Pawandeep Oza]

On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Lock the M-mode World ID (mwid) CSR during hart re-initialization
> to enforce immutability of the WID established by the root-of-trust.
>
> OpenSBI does not assign the WID value itself; it only sets MWID_LOCK
> to freeze the value established by prior RoT stage. The MWID_LOCK bit
> at XLEN-1 is sticky and makes the CSR read-only until reset, enforcing
> a temporal security boundary per the RISC-V Worlds specification.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  lib/sbi/sbi_hart.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index f5f4062e..29856c0f 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -724,6 +724,13 @@ int sbi_hart_reinit(struct sbi_scratch *scratch)
>         if (rc)
>                 return rc;
>
> +       /*
> +        * Assume MWID is restored by root-of-trust M-mode in previous
> +        * stage. Lock mwid so RoT-defined WID remains immutable.
> +        */
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID))
> +               csr_set(CSR_MWID, MWID_LOCK);
> +
>         return 0;
>  }
>
> --
> 2.43.7
>

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 5/9] lib: sbi_hart: add WID protection mechanism

[Pawandeep Oza]

On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Register a WID-based hart protection mechanism that
> configures mlwid and mwiddeleg CSRs on domain entry.
> This enables the protection framework reconfigure WID
> isolation whenever domains are switched.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Changes v1 -> v2:
> - Validate WID against pmlwidlist before writing mlwid CSR (Oza)
> ---
>  include/sbi/sbi_hart_worlds.h | 24 ++++++++++++
>  lib/sbi/objects.mk            |  1 +
>  lib/sbi/sbi_hart.c            |  5 +++
>  lib/sbi/sbi_hart_worlds.c     | 72 +++++++++++++++++++++++++++++++++++
>  4 files changed, 102 insertions(+)
>  create mode 100644 include/sbi/sbi_hart_worlds.h
>  create mode 100644 lib/sbi/sbi_hart_worlds.c
>
> diff --git a/include/sbi/sbi_hart_worlds.h b/include/sbi/sbi_hart_worlds.h
> new file mode 100644
> index 00000000..2bb35a7e
> --- /dev/null
> +++ b/include/sbi/sbi_hart_worlds.h
> @@ -0,0 +1,24 @@
> +/*
> + * SPDX-License-Identifier: BSD-2-Clause
> + *
> + * Copyright (c) 2026 SiFive Inc.
> + */
> +
> +#ifndef __SBI_HART_WORLDS_H__
> +#define __SBI_HART_WORLDS_H__
> +
> +struct sbi_scratch;
> +
> +/**
> + * Initialize WID hart protection for current HART
> + *
> + * Registers the WID protection mechanism if Smwid/Smlwid
> + * extensions are present.
> + *
> + * @param scratch pointer to scratch space of current HART
> + *
> + * @return 0 on success and negative error code on failure
> + */
> +int sbi_hart_worlds_init(struct sbi_scratch *scratch);
> +
> +#endif /* __SBI_HART_WORLDS_H__ */
> diff --git a/lib/sbi/objects.mk b/lib/sbi/objects.mk
> index c29c888f..ac026dec 100644
> --- a/lib/sbi/objects.mk
> +++ b/lib/sbi/objects.mk
> @@ -77,6 +77,7 @@ libsbi-objs-y += sbi_fwft.o
>  libsbi-objs-y += sbi_hart.o
>  libsbi-objs-y += sbi_hart_pmp.o
>  libsbi-objs-y += sbi_hart_protection.o
> +libsbi-objs-y += sbi_hart_worlds.o
>  libsbi-objs-y += sbi_heap.o
>  libsbi-objs-y += sbi_math.o
>  libsbi-objs-y += sbi_hfence.o
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index 29856c0f..e92f0af3 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -17,6 +17,7 @@
>  #include <sbi/sbi_error.h>
>  #include <sbi/sbi_hart.h>
>  #include <sbi/sbi_hart_pmp.h>
> +#include <sbi/sbi_hart_worlds.h>
>  #include <sbi/sbi_platform.h>
>  #include <sbi/sbi_pmu.h>
>  #include <sbi/sbi_string.h>
> @@ -762,6 +763,10 @@ int sbi_hart_init(struct sbi_scratch *scratch, bool cold_boot)
>                 rc = sbi_hart_pmp_init(scratch);
>                 if (rc)
>                         return rc;
> +
> +               rc = sbi_hart_worlds_init(scratch);
> +               if (rc)
> +                       return rc;
>         }
>
>         return sbi_hart_reinit(scratch);
> diff --git a/lib/sbi/sbi_hart_worlds.c b/lib/sbi/sbi_hart_worlds.c
> new file mode 100644
> index 00000000..d9d69b07
> --- /dev/null
> +++ b/lib/sbi/sbi_hart_worlds.c
> @@ -0,0 +1,72 @@
> +/*
> + * SPDX-License-Identifier: BSD-2-Clause
> + *
> + * Copyright (c) 2026 SiFive Inc.
> + */
> +
> +#include <sbi/riscv_encoding.h>
> +#include <sbi/sbi_console.h>
> +#include <sbi/sbi_domain.h>
> +#include <sbi/sbi_error.h>
> +#include <sbi/sbi_hart.h>
> +#include <sbi/sbi_hart_protection.h>
> +#include <sbi/sbi_hart_worlds.h>
> +#include <sbi/sbi_scratch.h>
> +
> +static int sbi_hart_worlds_configure(struct sbi_scratch *scratch,
> +                                    struct sbi_domain *dom)
> +{
> +       struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
> +       bool wid_found = true;
> +       u32 wid_val = 0;
> +
> +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
> +               return 0;
> +
> +       if (dom->has_wid) {
> +               wid_val = dom->wid;
> +       } else if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID)) {
> +               wid_val = csr_read(CSR_MWID) & ~MWID_LOCK;
> +       } else if (hf->has_pmwid) {
> +               wid_val = hf->pmwid;
> +       } else {
> +               /*
> +                * Smlwid present but no WID source. Without writing
> +                * mlwid, the hardware reset value is used which may
> +                * cause a software-check exception on lower-privilege
> +                * mode entry.
> +                */
> +               wid_found = false;
> +       }
> +
> +       if (wid_found) {
> +               if (hf->has_pmlwidlist &&
> +                   !(hf->pmlwidlist & BIT_ULL(wid_val))) {
> +                       sbi_printf("%s: domain wid %u not in pmlwidlist\n",
> +                                  __func__, wid_val);
> +                       return SBI_EINVAL;
> +               }
> +               csr_write(CSR_MLWID, wid_val);
> +       }
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG))
> +               csr_write(CSR_MWIDDELEG, dom->widdeleg);
> +
> +       return 0;
> +}
> +
> +static struct sbi_hart_protection wid_protection = {
> +       .name           = "wid",
> +       .rating         = 100,
> +       .type           = SBI_HART_PROTECTION_TYPE_ID,
> +       .configure      = sbi_hart_worlds_configure,
> +       .unconfigure    = NULL
> +};
> +
> +int sbi_hart_worlds_init(struct sbi_scratch *scratch)
> +{
> +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
> +               return 0;
> +
> +       return sbi_hart_protection_register(&wid_protection);
> +}
> --
> 2.43.7
>

Oza: except the part that if you decide to remove all the boolenas and
figure out from the wid , widlist itslef if that valid or not.

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 6/9] lib: sbi_domain_context: add slwid to per-domain S-mode context

[Pawandeep Oza]

On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> slwid is the S-mode CSR that controls U-mode's World ID. Since
> each domain may run different U-mode workloads with different
> WID isolation requirements, slwid must be part of the per-domain
> S-mode context.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  lib/sbi/sbi_domain_context.c | 13 +++++++++++++
>  1 file changed, 13 insertions(+)
>
> diff --git a/lib/sbi/sbi_domain_context.c b/lib/sbi/sbi_domain_context.c
> index 0861d541..0b45c0fd 100644
> --- a/lib/sbi/sbi_domain_context.c
> +++ b/lib/sbi/sbi_domain_context.c
> @@ -50,6 +50,8 @@ struct hart_context {
>         unsigned long senvcfg;
>         /** Supervisor resource management configuration register */
>         unsigned long srmcfg;
> +       /** Supervisor lower-privilege mode World ID register */
> +       unsigned long slwid;
>
>         /** Float context state */
>         struct sbi_fp_context fp_ctx;
> @@ -145,6 +147,17 @@ static int switch_to_next_domain_context(struct hart_context *ctx,
>                 ctx->senvcfg    = csr_swap(CSR_SENVCFG, dom_ctx->senvcfg);
>         if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SSQOSID))
>                 ctx->srmcfg     = csr_swap(CSR_SRMCFG, dom_ctx->srmcfg);
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SSWID)) {
> +               /*
> +                * Temporarily enable Sswid so slwid is accessible for
> +                * swap. The target domain's mwiddeleg is restored by
> +                * sbi_hart_protection_reconfigure() below.
> +                */
> +               csr_write(CSR_MWIDDELEG, ~0UL);
> +               if (csr_read(CSR_MWIDDELEG))
> +                       ctx->slwid = csr_swap(CSR_SLWID, dom_ctx->slwid);
> +               csr_write(CSR_MWIDDELEG, 0);
> +       }
>
>         /* Eager context switch for float */
>         if (sbi_hart_has_extension(scratch, SBI_HART_EXT_F) ||
> --
> 2.43.7
>

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 7/9] include: sbi_types: add PRIx64 format macro

[Pawandeep Oza]

On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add PRIx64 for portable 64-bit hex printing. Expands
> to 016lx on RV64 and 016llx on RV32, enabling consistent
> printf-style formatting of uint64_t values.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  include/sbi/sbi_types.h | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/include/sbi/sbi_types.h b/include/sbi/sbi_types.h
> index b8a7e6cb..780a4c2a 100644
> --- a/include/sbi/sbi_types.h
> +++ b/include/sbi/sbi_types.h
> @@ -34,12 +34,14 @@ typedef unsigned long               u64;
>  typedef long                   int64_t;
>  typedef unsigned long          uint64_t;
>  #define PRILX                  "016lx"
> +#define PRIx64                 "016lx"
>  #elif __riscv_xlen == 32
>  typedef long long              s64;
>  typedef unsigned long long     u64;
>  typedef long long              int64_t;
>  typedef unsigned long long     uint64_t;
>  #define PRILX                  "08lx"
> +#define PRIx64                 "016llx"
>  #else
>  #error "Unexpected __riscv_xlen"
>  #endif
> --
> 2.43.7
>

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 8/9] lib: sbi: display World ID configuration at boot

[Pawandeep Oza]

On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Display domain-specific World ID (Wid/Widdeleg)
> and M-mode World ID source (from mwid/pmwid) during
> initialization for RISC-V Worlds debugging and
> verification.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  lib/sbi/sbi_domain.c | 31 +++++++++++++++++++++++++++++++
>  lib/sbi/sbi_init.c   | 13 +++++++++++++
>  2 files changed, 44 insertions(+)
>
> diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
> index fa69170b..d1f7bb0c 100644
> --- a/lib/sbi/sbi_domain.c
> +++ b/lib/sbi/sbi_domain.c
> @@ -10,6 +10,7 @@
>  #include <sbi/riscv_asm.h>
>  #include <sbi/sbi_console.h>
>  #include <sbi/sbi_domain.h>
> +#include <sbi/sbi_hart.h>
>  #include <sbi/sbi_hartmask.h>
>  #include <sbi/sbi_heap.h>
>  #include <sbi/sbi_hsm.h>
> @@ -533,6 +534,8 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
>         u32 i, j, k;
>         unsigned long rstart, rend;
>         struct sbi_domain_memregion *reg;
> +       struct sbi_scratch *scratch = sbi_scratch_thishart_ptr();
> +       const struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
>
>         sbi_printf("Domain%d Name        %s: %s\n",
>                    dom->index, suffix, dom->name);
> @@ -608,6 +611,34 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
>                 break;
>         }
>
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) {
> +               if (dom->has_wid) {
> +                       sbi_printf("Domain%d Wid         %s: %u\n",
> +                                  dom->index, suffix, dom->wid);
> +               } else if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID)) {
> +                       sbi_printf("Domain%d Wid         %s: %lu (mwid)\n",
> +                                  dom->index, suffix,
> +                                  csr_read(CSR_MWID) & ~MWID_LOCK);
> +               } else if (hf->has_pmwid) {
> +                       sbi_printf("Domain%d Wid         %s: %u (pmwid)\n",
> +                                  dom->index, suffix, hf->pmwid);
> +               } else {
> +                       sbi_printf("Domain%d Wid         %s: unknown\n",
> +                                  dom->index, suffix);
> +               }
> +       } else {
> +               sbi_printf("Domain%d Wid         %s: unsupported\n",
> +                          dom->index, suffix);
> +       }
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
> +               sbi_printf("Domain%d Widdeleg    %s: 0x%" PRIx64 "\n",
> +                          dom->index, suffix, dom->widdeleg);
> +       } else {
> +               sbi_printf("Domain%d Widdeleg    %s: unsupported\n",
> +                          dom->index, suffix);
> +       }
> +
>         sbi_printf("Domain%d SysReset    %s: %s\n",
>                    dom->index, suffix, (dom->system_reset_allowed) ? "yes" : "no");
>
> diff --git a/lib/sbi/sbi_init.c b/lib/sbi/sbi_init.c
> index acd2f8b6..f771f548 100644
> --- a/lib/sbi/sbi_init.c
> +++ b/lib/sbi/sbi_init.c
> @@ -167,6 +167,7 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
>         int xlen;
>         char str[256];
>         const struct sbi_domain *dom = sbi_domain_thishart_ptr();
> +       struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
>
>         if (scratch->options & SBI_SCRATCH_NO_BOOT_PRINTS)
>                 return;
> @@ -199,6 +200,18 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
>         sbi_printf("Boot HART Debug Triggers    : %d triggers\n",
>                    sbi_dbtr_get_total_triggers());
>         sbi_hart_delegation_dump(scratch, "Boot HART ", "           ");
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID)) {
> +               ulong mwid = csr_read(CSR_MWID);
> +
> +               sbi_printf("Boot HART M-mode World ID   : %lu (%s)\n",
> +                          mwid & ~MWID_LOCK,
> +                          (mwid & MWID_LOCK) ? "locked" : "unlocked");
> +       } else if (hf->has_pmwid) {
> +               sbi_printf("Boot HART M-mode World ID   : %u (pmwid)\n",
> +                          hf->pmwid);
> +       } else {
> +               sbi_printf("Boot HART M-mode World ID   : unsupported\n");
> +       }
>  }
>
>  static unsigned long coldboot_done;
> --
> 2.43.7
>

if you decide to remove all the booleans may be then this patch will
change as well

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 9/9] docs: document WID DT properties

[Pawandeep Oza]

On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add "wid" and "widdeleg" properties to domain instance node
> documentation and example DT. Add a "Root Domain Node" section
> describing the "root" subnode under the domain configuration
> node for root domain WID configuration
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  docs/domain_support.md | 36 ++++++++++++++++++++++++++++++++++++
>  1 file changed, 36 insertions(+)
>
> diff --git a/docs/domain_support.md b/docs/domain_support.md
> index e267a9f7..c35a1d9a 100644
> --- a/docs/domain_support.md
> +++ b/docs/domain_support.md
> @@ -93,6 +93,8 @@ following manner:
>    is the next mode for the ROOT domain
>  * **system_reset_allowed** - The ROOT domain is allowed to reset the system
>  * **system_suspend_allowed** - The ROOT domain is allowed to suspend the system
> +* **wid** - Configurable World ID for the ROOT domain
> +* **widdeleg** - Configurable World ID delegation bitmask for the ROOT domain
>
>  Domain Effects
>  --------------
> @@ -126,6 +128,23 @@ The DT properties of a domain configuration DT node are as follows:
>  * **compatible** (Mandatory) - The compatible string of the domain
>    configuration. This DT property should have value *"opensbi,domain,config"*
>
> +### Root Domain Node
> +
> +The root domain WID configuration is described in a **root** subnode under
> +the domain configuration DT node. This subnode does not have a compatible
> +string.
> +
> +The DT properties of the root domain node are as follows:
> +
> +* **wid** (Optional) - The 32 bit World ID for lower-privilege modes
> +  (S/U-mode) for the ROOT domain. If present, OpenSBI writes this value
> +  to **mlwid** when entering the ROOT domain (requires Smlwid extension).
> +  If absent, OpenSBI uses the M-mode WID as fallback.
> +* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
> +  the ROOT domain. If present, OpenSBI writes this value to **mwiddeleg**
> +  when entering the ROOT domain (requires Smwiddeleg extension). If absent,
> +  clears **mwiddeleg** to disable S-mode WID delegation.
> +
>  ### Domain Memory Region Node
>
>  The domain memory region DT node describes details of a memory region and
> @@ -204,6 +223,14 @@ The DT properties of a domain instance DT node are as follows:
>    whether the domain instance is allowed to do system reset.
>  * **system-suspend-allowed** (Optional) - A boolean flag representing
>    whether the domain instance is allowed to do system suspend.
> +* **wid** (Optional) - The 32 bit World ID for lower-privilege modes
> +  (S/U-mode) for the domain instance. If present, OpenSBI writes this value
> +  to **mlwid** on context switch into this domain (requires Smlwid extension).
> +  If absent, OpenSBI uses the M-mode WID as fallback.
> +* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
> +  the domain instance. If present, OpenSBI writes this value to **mwiddeleg**
> +  on context switch into this domain (requires Smwiddeleg extension). If absent,
> +  clears **mwiddeleg** to disable S-mode WID delegation.
>
>  ### Assigning HART To Domain Instance
>
> @@ -260,6 +287,11 @@ be done:
>                  order = <64>;
>              };
>
> +            root {
> +                wid = <3>;
> +                widdeleg = <0x0 0x0>;
> +            };
> +
>              tdomain: trusted-domain {
>                  compatible = "opensbi,domain,instance";
>                  possible-harts = <&cpu0>;
> @@ -268,6 +300,8 @@ be done:
>                  next-arg1 = <0x0 0x0>;
>                  next-addr = <0x0 0x80100000>;
>                  next-mode = <0x0>;
> +                wid = <1>;
> +                widdeleg = <0x0 0x6>;
>                  system-reset-allowed;
>                  system-suspend-allowed;
>              };
> @@ -276,6 +310,8 @@ be done:
>                  compatible = "opensbi,domain,instance";
>                  possible-harts = <&cpu1 &cpu2 &cpu3 &cpu4>;
>                  regions = <&tmem 0x0>, <&tuart 0x0>, <&allmem 0x3f>;
> +                wid = <0>;
> +                widdeleg = <0x0 0x1>;
>              };
>          };
>      };
> --
> 2.43.7
>

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 2/9] lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties

[Yu-Chien Peter Lin]

Hi Oza,

On Thu, Sep 03, 2026 at 02:15:16PM -0700, Pawandeep Oza wrote:
> On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Add fdt_parse_worlds_all_harts() to parse platform-defined DT
> > properties in the /cpus/cpu@X:
> > - riscv,pmwid: M-mode World ID
> > - riscv,pmwidlist: bitmap of permitted M-mode WIDs
> > - riscv,pmlwidlist: bitmap of permitted lower-privilege WIDs
> > Initialize parsed values in sbi_hart_features with has_* presence
> > flags.
> >
> > These platform-defined values serve as the root-of-trust constraints
> > for per-domain WID assignment during domain creation and context
> > switching.
> >
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> >  include/sbi/sbi_hart.h             |  6 ++
> >  include/sbi_utils/fdt/fdt_helper.h |  2 +
> >  lib/utils/fdt/fdt_helper.c         | 92 ++++++++++++++++++++++++++++++
> >  platform/generic/platform.c        | 13 ++++-
> >  4 files changed, 112 insertions(+), 1 deletion(-)
> >
> > diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> > index 2941809e..4fcf5372 100644
> > --- a/include/sbi/sbi_hart.h
> > +++ b/include/sbi/sbi_hart.h
> > @@ -135,6 +135,12 @@ struct sbi_hart_features {
> >         unsigned int pmp_log2gran;
> >         unsigned int mhpm_mask;
> >         unsigned int mhpm_bits;
> > +       u32 pmwid;
> > +       u64 pmwidlist;
> > +       u64 pmlwidlist;
> > +       bool has_pmwid;
> > +       bool has_pmwidlist;
> > +       bool has_pmlwidlist;
> 
> Oza: do you need these 3 booleans ?
> 
> you can find out from the value itslef ?
> pmwidlist == 0 means not rpesent
> pmlwidlist = 0 means not rpesent
> and may be pmwid == UINT_MAX then not present ?

I'd like to keep has_pmwid. pmwid = 0 is a valid WID, as
sbi_hart_features is zero-initialized, using a sentinel
like UINT_MAX to mean "not set" would require adding an
explicit init step at sbi_hart_feature allocation time.

I'd like to keep has_pmlwidlist too. Per the spec,
pmlwidlist = 0 is a legal configuration meaning
"no WID is authorized for mlwid" which is the opposite
of unrestricted.

I agree we can drop has_pmwidlist, as pmwidlist can never
be 0.

Thanks,
Peter Lin

> 
> >  };
> >
> >  extern unsigned long hart_features_offset;
> > diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
> > index 75a564d1..3f3d091b 100644
> > --- a/include/sbi_utils/fdt/fdt_helper.h
> > +++ b/include/sbi_utils/fdt/fdt_helper.h
> > @@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
> >
> >  int fdt_parse_isa_extensions_all_harts(const void *fdt);
> >
> > +int fdt_parse_worlds_all_harts(const void *fdt);
> > +
> >  int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
> >                                 struct platform_uart_data *uart);
> >
> > diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
> > index 747ba028..d6025705 100644
> > --- a/lib/utils/fdt/fdt_helper.c
> > +++ b/lib/utils/fdt/fdt_helper.c
> > @@ -457,6 +457,98 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
> >         return 0;
> >  }
> >
> > +int fdt_parse_worlds_all_harts(const void *fdt)
> > +{
> > +       u32 hartid;
> > +       const fdt32_t *val;
> > +       struct sbi_scratch *scratch;
> > +       struct sbi_hart_features *hfeatures;
> > +       int err, cpu_offset, cpus_offset, len;
> > +
> > +       if (!fdt)
> > +               return SBI_EINVAL;
> > +
> > +       cpus_offset = fdt_path_offset(fdt, "/cpus");
> > +       if (cpus_offset < 0)
> > +               return cpus_offset;
> > +
> > +       fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
> > +               err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
> > +               if (err)
> > +                       continue;
> > +
> > +               if (!fdt_node_is_enabled(fdt, cpu_offset))
> > +                       continue;
> > +
> > +               scratch = sbi_hartid_to_scratch(hartid);
> > +               if (!scratch)
> > +                       return SBI_ENOENT;
> > +
> > +               hfeatures = sbi_hart_features_ptr(scratch);
> > +               if (!hfeatures)
> > +                       return SBI_ENOENT;
> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
> > +               if (val && len == sizeof(fdt32_t)) {
> > +                       hfeatures->pmwid = fdt32_to_cpu(*val);
> > +                       hfeatures->has_pmwid = true;
> > +               }
> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
> > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > +                       hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > +                                               fdt32_to_cpu(val[1]);
> > +                       hfeatures->has_pmwidlist = true;
> > +               }
> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
> > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > +                       hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > +                                                fdt32_to_cpu(val[1]);
> > +                       hfeatures->has_pmlwidlist = true;
> > +               }
> > +
> > +               /* Sanity checks */
> > +               if (hfeatures->has_pmwidlist && !hfeatures->pmwidlist) {
> > +                       sbi_printf("%s: hart%u riscv,pmwidlist is empty\n",
> > +                                  __func__, hartid);
> > +                       return SBI_EINVAL;
> > +               }
> > +
> > +#if __riscv_xlen == 32
> > +               if (hfeatures->has_pmwidlist &&
> > +                   (hfeatures->pmwidlist >> 32)) {
> > +                       sbi_printf("%s: hart%u riscv,pmwidlist has bits beyond XLEN\n",
> > +                                  __func__, hartid);
> > +                       return SBI_EINVAL;
> > +               }
> > +
> > +               if (hfeatures->has_pmlwidlist &&
> > +                   (hfeatures->pmlwidlist >> 32)) {
> > +                       sbi_printf("%s: hart%u riscv,pmlwidlist has bits beyond XLEN\n",
> > +                                  __func__, hartid);
> > +                       return SBI_EINVAL;
> > +               }
> > +#endif
> > +
> > +               if (hfeatures->has_pmwid &&
> > +                   hfeatures->pmwid >= __riscv_xlen) {
> > +                       sbi_printf("%s: hart%u riscv,pmwid (%u) exceeds max WID\n",
> > +                                  __func__, hartid, hfeatures->pmwid);
> > +                       return SBI_EINVAL;
> > +               }
> > +
> > +               if (hfeatures->has_pmwidlist && hfeatures->has_pmwid &&
> > +                   !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
> > +                       sbi_printf("%s: hart%u riscv,pmwid (%u) not in pmwidlist\n",
> > +                                  __func__, hartid, hfeatures->pmwid);
> > +                       return SBI_EINVAL;
> > +               }
> > +       }
> > +
> > +       return 0;
> > +}
> > +
> >  static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
> >                                       struct platform_uart_data *uart,
> >                                       unsigned long default_freq,
> > diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> > index 1df0280d..51e9f342 100644
> > --- a/platform/generic/platform.c
> > +++ b/platform/generic/platform.c
> > @@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
> >
> >  int generic_extensions_init(bool cold_boot)
> >  {
> > +       int rc;
> > +
> >         if (!cold_boot)
> >                 return 0;
> >
> >         /* Parse the ISA string from FDT and enable the listed extensions */
> > -       return fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > +       rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > +       if (rc)
> > +               return rc;
> > +
> > +       /* Parse RISC-V Worlds CPU properties from FDT */
> > +       rc = fdt_parse_worlds_all_harts(fdt_get_address());
> > +       if (rc)
> > +               return rc;
> > +
> > +       return 0;
> >  }
> >
> >  int generic_domains_init(void)
> > --
> > 2.43.7
> >

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 3/9] lib: fdt_domain: parse domain WID properties

[Yu-Chien Peter Lin]

Hi Oza,

On Thu, Sep 03, 2026 at 02:18:48PM -0700, Pawandeep Oza wrote:
> On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Add wid and widdeleg fields to struct sbi_domain to store the
> > RISC-V Worlds mlwid and mwideleg CSR values for each domain.
> > Also, parse the root and user-defined domains' WID during
> > fdt_domains_populate().
> >
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> > Changes v1 -> v2:
> > - Add root subnode for root domain configuration (Oza and Anup)
> > - Rename next_wid/widlist to wid/widdeleg (Oza)
> > ---
> >  include/sbi/sbi_domain.h   |  6 +++++
> >  lib/utils/fdt/fdt_domain.c | 50 ++++++++++++++++++++++++++++++++++++++
> >  2 files changed, 56 insertions(+)
> >
> > diff --git a/include/sbi/sbi_domain.h b/include/sbi/sbi_domain.h
> > index 16edd4ce..44c8befc 100644
> > --- a/include/sbi/sbi_domain.h
> > +++ b/include/sbi/sbi_domain.h
> > @@ -215,6 +215,12 @@ struct sbi_domain {
> >         bool system_reset_allowed;
> >         /** Is domain allowed to suspend the system */
> >         bool system_suspend_allowed;
> > +       /** World ID for this domain (mlwid value) */
> > +       u32 wid;
> > +       /** Whether World ID was explicitly set */
> > +       bool has_wid;
> Oza: again here you may be able to find out if wid == UINT_MAX then
> wid is not set. because we have finite number of N wolrds so max is N
> -1 ?
> you can then drop bool has_wid;

Agreed, will drop in next patch version.

Thanks,
Peter Lin

> 
> > +       /** World ID delegation bitmask for this domain (mwiddeleg value) */
> > +       u64 widdeleg;
> >         /** Identifies whether to include the firmware region */
> >         bool fw_region_inited;
> >  };
> > diff --git a/lib/utils/fdt/fdt_domain.c b/lib/utils/fdt/fdt_domain.c
> > index 61627db3..68dd6da4 100644
> > --- a/lib/utils/fdt/fdt_domain.c
> > +++ b/lib/utils/fdt/fdt_domain.c
> > @@ -307,6 +307,27 @@ static int __fdt_parse_region(const void *fdt, int domain_offset,
> >         return 0;
> >  }
> >
> > +static void fdt_parse_domain_wid_props(const void *fdt, int offset,
> > +                                      struct sbi_domain *dom)
> > +{
> > +       const fdt32_t *val;
> > +       int len;
> > +       u64 val64;
> > +
> > +       val = fdt_getprop(fdt, offset, "wid", &len);
> > +       if (val && len == sizeof(fdt32_t)) {
> > +               dom->wid = fdt32_to_cpu(val[0]);
> > +               dom->has_wid = true;
> > +       }
> > +
> > +       val = fdt_getprop(fdt, offset, "widdeleg", &len);
> > +       if (val && (len == (2 * sizeof(fdt32_t)))) {
> > +               val64 = fdt32_to_cpu(val[0]);
> > +               val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
> > +               dom->widdeleg = val64;
> > +       }
> > +}
> > +
> >  static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
> >  {
> >         u32 val32;
> > @@ -469,6 +490,9 @@ static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
> >         }
> >         dom->next_mode = val32;
> >
> > +       /* Read "wid" and "widdeleg" DT properties */
> > +       fdt_parse_domain_wid_props(fdt, domain_offset, dom);
> > +
> >         /* Read "system-reset-allowed" DT property */
> >         if (fdt_get_property(fdt, domain_offset,
> >                              "system-reset-allowed", NULL))
> > @@ -535,6 +559,29 @@ fail_free_domain:
> >         return err;
> >  }
> >
> > +static void fdt_parse_root_domain(const void *fdt)
> > +{
> > +       int offset;
> > +
> > +       if (!fdt)
> > +               return;
> > +
> > +       offset = fdt_path_offset(fdt, "/chosen");
> > +       if (offset < 0)
> > +               return;
> > +
> > +       offset = fdt_node_offset_by_compatible(fdt, offset,
> > +                                              "opensbi,domain,config");
> > +       if (offset < 0)
> > +               return;
> > +
> > +       offset = fdt_subnode_offset(fdt, offset, "root");
> > +       if (offset < 0)
> > +               return;
> > +
> > +       fdt_parse_domain_wid_props(fdt, offset, &root);
> > +}
> > +
> >  int fdt_domains_populate(const void *fdt)
> >  {
> >         const u32 *val;
> > @@ -573,6 +620,9 @@ int fdt_domains_populate(const void *fdt)
> >                 break;
> >         }
> >
> > +       /* Parse root domain config from "root" subnode */
> > +       fdt_parse_root_domain(fdt);
> > +
> >         /* Iterate over each domain in FDT and populate details */
> >         return fdt_iterate_each_domain_ro(fdt, &cold_domain_offset,
> >                                           __fdt_parse_domain);
> > --
> > 2.43.7
> >

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 5/9] lib: sbi_hart: add WID protection mechanism

[Yu-Chien Peter Lin]

Hi Oza,

On Thu, Sep 03, 2026 at 02:52:51PM -0700, Pawandeep Oza wrote:
> On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Register a WID-based hart protection mechanism that
> > configures mlwid and mwiddeleg CSRs on domain entry.
> > This enables the protection framework reconfigure WID
> > isolation whenever domains are switched.
> >
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> > Changes v1 -> v2:
> > - Validate WID against pmlwidlist before writing mlwid CSR (Oza)
> > ---
> >  include/sbi/sbi_hart_worlds.h | 24 ++++++++++++
> >  lib/sbi/objects.mk            |  1 +
> >  lib/sbi/sbi_hart.c            |  5 +++
> >  lib/sbi/sbi_hart_worlds.c     | 72 +++++++++++++++++++++++++++++++++++
> >  4 files changed, 102 insertions(+)
> >  create mode 100644 include/sbi/sbi_hart_worlds.h
> >  create mode 100644 lib/sbi/sbi_hart_worlds.c
> >
> > diff --git a/include/sbi/sbi_hart_worlds.h b/include/sbi/sbi_hart_worlds.h
> > new file mode 100644
> > index 00000000..2bb35a7e
> > --- /dev/null
> > +++ b/include/sbi/sbi_hart_worlds.h
> > @@ -0,0 +1,24 @@
> > +/*
> > + * SPDX-License-Identifier: BSD-2-Clause
> > + *
> > + * Copyright (c) 2026 SiFive Inc.
> > + */
> > +
> > +#ifndef __SBI_HART_WORLDS_H__
> > +#define __SBI_HART_WORLDS_H__
> > +
> > +struct sbi_scratch;
> > +
> > +/**
> > + * Initialize WID hart protection for current HART
> > + *
> > + * Registers the WID protection mechanism if Smwid/Smlwid
> > + * extensions are present.
> > + *
> > + * @param scratch pointer to scratch space of current HART
> > + *
> > + * @return 0 on success and negative error code on failure
> > + */
> > +int sbi_hart_worlds_init(struct sbi_scratch *scratch);
> > +
> > +#endif /* __SBI_HART_WORLDS_H__ */
> > diff --git a/lib/sbi/objects.mk b/lib/sbi/objects.mk
> > index c29c888f..ac026dec 100644
> > --- a/lib/sbi/objects.mk
> > +++ b/lib/sbi/objects.mk
> > @@ -77,6 +77,7 @@ libsbi-objs-y += sbi_fwft.o
> >  libsbi-objs-y += sbi_hart.o
> >  libsbi-objs-y += sbi_hart_pmp.o
> >  libsbi-objs-y += sbi_hart_protection.o
> > +libsbi-objs-y += sbi_hart_worlds.o
> >  libsbi-objs-y += sbi_heap.o
> >  libsbi-objs-y += sbi_math.o
> >  libsbi-objs-y += sbi_hfence.o
> > diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> > index 29856c0f..e92f0af3 100644
> > --- a/lib/sbi/sbi_hart.c
> > +++ b/lib/sbi/sbi_hart.c
> > @@ -17,6 +17,7 @@
> >  #include <sbi/sbi_error.h>
> >  #include <sbi/sbi_hart.h>
> >  #include <sbi/sbi_hart_pmp.h>
> > +#include <sbi/sbi_hart_worlds.h>
> >  #include <sbi/sbi_platform.h>
> >  #include <sbi/sbi_pmu.h>
> >  #include <sbi/sbi_string.h>
> > @@ -762,6 +763,10 @@ int sbi_hart_init(struct sbi_scratch *scratch, bool cold_boot)
> >                 rc = sbi_hart_pmp_init(scratch);
> >                 if (rc)
> >                         return rc;
> > +
> > +               rc = sbi_hart_worlds_init(scratch);
> > +               if (rc)
> > +                       return rc;
> >         }
> >
> >         return sbi_hart_reinit(scratch);
> > diff --git a/lib/sbi/sbi_hart_worlds.c b/lib/sbi/sbi_hart_worlds.c
> > new file mode 100644
> > index 00000000..d9d69b07
> > --- /dev/null
> > +++ b/lib/sbi/sbi_hart_worlds.c
> > @@ -0,0 +1,72 @@
> > +/*
> > + * SPDX-License-Identifier: BSD-2-Clause
> > + *
> > + * Copyright (c) 2026 SiFive Inc.
> > + */
> > +
> > +#include <sbi/riscv_encoding.h>
> > +#include <sbi/sbi_console.h>
> > +#include <sbi/sbi_domain.h>
> > +#include <sbi/sbi_error.h>
> > +#include <sbi/sbi_hart.h>
> > +#include <sbi/sbi_hart_protection.h>
> > +#include <sbi/sbi_hart_worlds.h>
> > +#include <sbi/sbi_scratch.h>
> > +
> > +static int sbi_hart_worlds_configure(struct sbi_scratch *scratch,
> > +                                    struct sbi_domain *dom)
> > +{
> > +       struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
> > +       bool wid_found = true;
> > +       u32 wid_val = 0;
> > +
> > +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
> > +               return 0;
> > +
> > +       if (dom->has_wid) {
> > +               wid_val = dom->wid;
> > +       } else if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID)) {
> > +               wid_val = csr_read(CSR_MWID) & ~MWID_LOCK;
> > +       } else if (hf->has_pmwid) {
> > +               wid_val = hf->pmwid;
> > +       } else {
> > +               /*
> > +                * Smlwid present but no WID source. Without writing
> > +                * mlwid, the hardware reset value is used which may
> > +                * cause a software-check exception on lower-privilege
> > +                * mode entry.
> > +                */
> > +               wid_found = false;
> > +       }
> > +
> > +       if (wid_found) {
> > +               if (hf->has_pmlwidlist &&
> > +                   !(hf->pmlwidlist & BIT_ULL(wid_val))) {
> > +                       sbi_printf("%s: domain wid %u not in pmlwidlist\n",
> > +                                  __func__, wid_val);
> > +                       return SBI_EINVAL;
> > +               }
> > +               csr_write(CSR_MLWID, wid_val);
> > +       }
> > +
> > +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG))
> > +               csr_write(CSR_MWIDDELEG, dom->widdeleg);
> > +
> > +       return 0;
> > +}
> > +
> > +static struct sbi_hart_protection wid_protection = {
> > +       .name           = "wid",
> > +       .rating         = 100,
> > +       .type           = SBI_HART_PROTECTION_TYPE_ID,
> > +       .configure      = sbi_hart_worlds_configure,
> > +       .unconfigure    = NULL
> > +};
> > +
> > +int sbi_hart_worlds_init(struct sbi_scratch *scratch)
> > +{
> > +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
> > +               return 0;
> > +
> > +       return sbi_hart_protection_register(&wid_protection);
> > +}
> > --
> > 2.43.7
> >
> 
> Oza: except the part that if you decide to remove all the boolenas and
> figure out from the wid , widlist itslef if that valid or not.
> 
> Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

If the rationale I provided in PATCH2 is sound, I would keep the
code here as is.

Thanks,
Peter Lin


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 2/9] lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties

[Pawandeep Oza]

On Thu, Sep 24, 2026 at 12:33 AM Yu-Chien Peter Lin
<peter.lin@sifive.com> wrote:
>
> Hi Oza,
>
> On Thu, Sep 03, 2026 at 02:15:16PM -0700, Pawandeep Oza wrote:
> > On Mon, Aug 17, 2026 at 2:05 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> > >
> > > Add fdt_parse_worlds_all_harts() to parse platform-defined DT
> > > properties in the /cpus/cpu@X:
> > > - riscv,pmwid: M-mode World ID
> > > - riscv,pmwidlist: bitmap of permitted M-mode WIDs
> > > - riscv,pmlwidlist: bitmap of permitted lower-privilege WIDs
> > > Initialize parsed values in sbi_hart_features with has_* presence
> > > flags.
> > >
> > > These platform-defined values serve as the root-of-trust constraints
> > > for per-domain WID assignment during domain creation and context
> > > switching.
> > >
> > > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > > ---
> > >  include/sbi/sbi_hart.h             |  6 ++
> > >  include/sbi_utils/fdt/fdt_helper.h |  2 +
> > >  lib/utils/fdt/fdt_helper.c         | 92 ++++++++++++++++++++++++++++++
> > >  platform/generic/platform.c        | 13 ++++-
> > >  4 files changed, 112 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> > > index 2941809e..4fcf5372 100644
> > > --- a/include/sbi/sbi_hart.h
> > > +++ b/include/sbi/sbi_hart.h
> > > @@ -135,6 +135,12 @@ struct sbi_hart_features {
> > >         unsigned int pmp_log2gran;
> > >         unsigned int mhpm_mask;
> > >         unsigned int mhpm_bits;
> > > +       u32 pmwid;
> > > +       u64 pmwidlist;
> > > +       u64 pmlwidlist;
> > > +       bool has_pmwid;
> > > +       bool has_pmwidlist;
> > > +       bool has_pmlwidlist;
> >
> > Oza: do you need these 3 booleans ?
> >
> > you can find out from the value itslef ?
> > pmwidlist == 0 means not rpesent
> > pmlwidlist = 0 means not rpesent
> > and may be pmwid == UINT_MAX then not present ?
>
> I'd like to keep has_pmwid. pmwid = 0 is a valid WID, as
> sbi_hart_features is zero-initialized, using a sentinel
> like UINT_MAX to mean "not set" would require adding an
> explicit init step at sbi_hart_feature allocation time.
>
> I'd like to keep has_pmlwidlist too. Per the spec,
> pmlwidlist = 0 is a legal configuration meaning
> "no WID is authorized for mlwid" which is the opposite
> of unrestricted.
>
> I agree we can drop has_pmwidlist, as pmwidlist can never
> be 0.

Oza: Everything sounds good to me.

>
> Thanks,
> Peter Lin
>
> >
> > >  };
> > >
> > >  extern unsigned long hart_features_offset;
> > > diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
> > > index 75a564d1..3f3d091b 100644
> > > --- a/include/sbi_utils/fdt/fdt_helper.h
> > > +++ b/include/sbi_utils/fdt/fdt_helper.h
> > > @@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
> > >
> > >  int fdt_parse_isa_extensions_all_harts(const void *fdt);
> > >
> > > +int fdt_parse_worlds_all_harts(const void *fdt);
> > > +
> > >  int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
> > >                                 struct platform_uart_data *uart);
> > >
> > > diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
> > > index 747ba028..d6025705 100644
> > > --- a/lib/utils/fdt/fdt_helper.c
> > > +++ b/lib/utils/fdt/fdt_helper.c
> > > @@ -457,6 +457,98 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
> > >         return 0;
> > >  }
> > >
> > > +int fdt_parse_worlds_all_harts(const void *fdt)
> > > +{
> > > +       u32 hartid;
> > > +       const fdt32_t *val;
> > > +       struct sbi_scratch *scratch;
> > > +       struct sbi_hart_features *hfeatures;
> > > +       int err, cpu_offset, cpus_offset, len;
> > > +
> > > +       if (!fdt)
> > > +               return SBI_EINVAL;
> > > +
> > > +       cpus_offset = fdt_path_offset(fdt, "/cpus");
> > > +       if (cpus_offset < 0)
> > > +               return cpus_offset;
> > > +
> > > +       fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
> > > +               err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
> > > +               if (err)
> > > +                       continue;
> > > +
> > > +               if (!fdt_node_is_enabled(fdt, cpu_offset))
> > > +                       continue;
> > > +
> > > +               scratch = sbi_hartid_to_scratch(hartid);
> > > +               if (!scratch)
> > > +                       return SBI_ENOENT;
> > > +
> > > +               hfeatures = sbi_hart_features_ptr(scratch);
> > > +               if (!hfeatures)
> > > +                       return SBI_ENOENT;
> > > +
> > > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
> > > +               if (val && len == sizeof(fdt32_t)) {
> > > +                       hfeatures->pmwid = fdt32_to_cpu(*val);
> > > +                       hfeatures->has_pmwid = true;
> > > +               }
> > > +
> > > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
> > > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > > +                       hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > > +                                               fdt32_to_cpu(val[1]);
> > > +                       hfeatures->has_pmwidlist = true;
> > > +               }
> > > +
> > > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
> > > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > > +                       hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > > +                                                fdt32_to_cpu(val[1]);
> > > +                       hfeatures->has_pmlwidlist = true;
> > > +               }
> > > +
> > > +               /* Sanity checks */
> > > +               if (hfeatures->has_pmwidlist && !hfeatures->pmwidlist) {
> > > +                       sbi_printf("%s: hart%u riscv,pmwidlist is empty\n",
> > > +                                  __func__, hartid);
> > > +                       return SBI_EINVAL;
> > > +               }
> > > +
> > > +#if __riscv_xlen == 32
> > > +               if (hfeatures->has_pmwidlist &&
> > > +                   (hfeatures->pmwidlist >> 32)) {
> > > +                       sbi_printf("%s: hart%u riscv,pmwidlist has bits beyond XLEN\n",
> > > +                                  __func__, hartid);
> > > +                       return SBI_EINVAL;
> > > +               }
> > > +
> > > +               if (hfeatures->has_pmlwidlist &&
> > > +                   (hfeatures->pmlwidlist >> 32)) {
> > > +                       sbi_printf("%s: hart%u riscv,pmlwidlist has bits beyond XLEN\n",
> > > +                                  __func__, hartid);
> > > +                       return SBI_EINVAL;
> > > +               }
> > > +#endif
> > > +
> > > +               if (hfeatures->has_pmwid &&
> > > +                   hfeatures->pmwid >= __riscv_xlen) {
> > > +                       sbi_printf("%s: hart%u riscv,pmwid (%u) exceeds max WID\n",
> > > +                                  __func__, hartid, hfeatures->pmwid);
> > > +                       return SBI_EINVAL;
> > > +               }
> > > +
> > > +               if (hfeatures->has_pmwidlist && hfeatures->has_pmwid &&
> > > +                   !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
> > > +                       sbi_printf("%s: hart%u riscv,pmwid (%u) not in pmwidlist\n",
> > > +                                  __func__, hartid, hfeatures->pmwid);
> > > +                       return SBI_EINVAL;
> > > +               }
> > > +       }
> > > +
> > > +       return 0;
> > > +}
> > > +
> > >  static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
> > >                                       struct platform_uart_data *uart,
> > >                                       unsigned long default_freq,
> > > diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> > > index 1df0280d..51e9f342 100644
> > > --- a/platform/generic/platform.c
> > > +++ b/platform/generic/platform.c
> > > @@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
> > >
> > >  int generic_extensions_init(bool cold_boot)
> > >  {
> > > +       int rc;
> > > +
> > >         if (!cold_boot)
> > >                 return 0;
> > >
> > >         /* Parse the ISA string from FDT and enable the listed extensions */
> > > -       return fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > > +       rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > > +       if (rc)
> > > +               return rc;
> > > +
> > > +       /* Parse RISC-V Worlds CPU properties from FDT */
> > > +       rc = fdt_parse_worlds_all_harts(fdt_get_address());
> > > +       if (rc)
> > > +               return rc;
> > > +
> > > +       return 0;
> > >  }
> > >
> > >  int generic_domains_init(void)
> > > --
> > > 2.43.7
> > >

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 9/9] docs: document WID DT properties

[Anup Patel]

On Mon, Aug 17, 2026 at 2:35 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add "wid" and "widdeleg" properties to domain instance node
> documentation and example DT. Add a "Root Domain Node" section
> describing the "root" subnode under the domain configuration
> node for root domain WID configuration
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  docs/domain_support.md | 36 ++++++++++++++++++++++++++++++++++++
>  1 file changed, 36 insertions(+)
>
> diff --git a/docs/domain_support.md b/docs/domain_support.md
> index e267a9f7..c35a1d9a 100644
> --- a/docs/domain_support.md
> +++ b/docs/domain_support.md
> @@ -93,6 +93,8 @@ following manner:
>    is the next mode for the ROOT domain
>  * **system_reset_allowed** - The ROOT domain is allowed to reset the system
>  * **system_suspend_allowed** - The ROOT domain is allowed to suspend the system
> +* **wid** - Configurable World ID for the ROOT domain
> +* **widdeleg** - Configurable World ID delegation bitmask for the ROOT domain

Based on the below examples, the "wid" and "widdeleg" is also available for
non-ROOT domains so should not have these listed under "Domain Instance"
section as well ??

>
>  Domain Effects
>  --------------
> @@ -126,6 +128,23 @@ The DT properties of a domain configuration DT node are as follows:
>  * **compatible** (Mandatory) - The compatible string of the domain
>    configuration. This DT property should have value *"opensbi,domain,config"*
>
> +### Root Domain Node
> +
> +The root domain WID configuration is described in a **root** subnode under
> +the domain configuration DT node. This subnode does not have a compatible
> +string.
> +
> +The DT properties of the root domain node are as follows:
> +
> +* **wid** (Optional) - The 32 bit World ID for lower-privilege modes
> +  (S/U-mode) for the ROOT domain. If present, OpenSBI writes this value
> +  to **mlwid** when entering the ROOT domain (requires Smlwid extension).
> +  If absent, OpenSBI uses the M-mode WID as fallback.
> +* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
> +  the ROOT domain. If present, OpenSBI writes this value to **mwiddeleg**
> +  when entering the ROOT domain (requires Smwiddeleg extension). If absent,
> +  clears **mwiddeleg** to disable S-mode WID delegation.
> +
>  ### Domain Memory Region Node
>
>  The domain memory region DT node describes details of a memory region and
> @@ -204,6 +223,14 @@ The DT properties of a domain instance DT node are as follows:
>    whether the domain instance is allowed to do system reset.
>  * **system-suspend-allowed** (Optional) - A boolean flag representing
>    whether the domain instance is allowed to do system suspend.
> +* **wid** (Optional) - The 32 bit World ID for lower-privilege modes
> +  (S/U-mode) for the domain instance. If present, OpenSBI writes this value
> +  to **mlwid** on context switch into this domain (requires Smlwid extension).
> +  If absent, OpenSBI uses the M-mode WID as fallback.
> +* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
> +  the domain instance. If present, OpenSBI writes this value to **mwiddeleg**
> +  on context switch into this domain (requires Smwiddeleg extension). If absent,
> +  clears **mwiddeleg** to disable S-mode WID delegation.
>
>  ### Assigning HART To Domain Instance
>
> @@ -260,6 +287,11 @@ be done:
>                  order = <64>;
>              };
>
> +            root {
> +                wid = <3>;
> +                widdeleg = <0x0 0x0>;
> +            };
> +
>              tdomain: trusted-domain {
>                  compatible = "opensbi,domain,instance";
>                  possible-harts = <&cpu0>;
> @@ -268,6 +300,8 @@ be done:
>                  next-arg1 = <0x0 0x0>;
>                  next-addr = <0x0 0x80100000>;
>                  next-mode = <0x0>;
> +                wid = <1>;
> +                widdeleg = <0x0 0x6>;
>                  system-reset-allowed;
>                  system-suspend-allowed;
>              };
> @@ -276,6 +310,8 @@ be done:
>                  compatible = "opensbi,domain,instance";
>                  possible-harts = <&cpu1 &cpu2 &cpu3 &cpu4>;
>                  regions = <&tmem 0x0>, <&tuart 0x0>, <&allmem 0x3f>;
> +                wid = <0>;
> +                widdeleg = <0x0 0x1>;
>              };
>          };
>      };
> --
> 2.43.7
>

Regards,
Anup

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 9/9] docs: document WID DT properties

[Krzysztof Kozlowski]

On 17/08/2026 11:05, Yu-Chien Peter Lin wrote:
> Add "wid" and "widdeleg" properties to domain instance node
> documentation and example DT. Add a "Root Domain Node" section
> describing the "root" subnode under the domain configuration
> node for root domain WID configuration
> 
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
>  docs/domain_support.md | 36 ++++++++++++++++++++++++++++++++++++
>  1 file changed, 36 insertions(+)
> 
> diff --git a/docs/domain_support.md b/docs/domain_support.md
> index e267a9f7..c35a1d9a 100644
> --- a/docs/domain_support.md
> +++ b/docs/domain_support.md
> @@ -93,6 +93,8 @@ following manner:
>    is the next mode for the ROOT domain
>  * **system_reset_allowed** - The ROOT domain is allowed to reset the system
>  * **system_suspend_allowed** - The ROOT domain is allowed to suspend the system
> +* **wid** - Configurable World ID for the ROOT domain
> +* **widdeleg** - Configurable World ID delegation bitmask for the ROOT domain

Why are you documenting DT in some random docts?

>  
>  Domain Effects
>  --------------
> @@ -126,6 +128,23 @@ The DT properties of a domain configuration DT node are as follows:
>  * **compatible** (Mandatory) - The compatible string of the domain
>    configuration. This DT property should have value *"opensbi,domain,config"*
>  
> +### Root Domain Node
> +
> +The root domain WID configuration is described in a **root** subnode under
> +the domain configuration DT node. This subnode does not have a compatible
> +string.
> +
> +The DT properties of the root domain node are as follows:

NAK, please read writing bindings and both documents for submitting patches.


Best regards,
Krzysztof

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 0/9] Add RISC-V Worlds ISA support to OpenSBI

[Krzysztof Kozlowski]

On 17/08/2026 11:04, Yu-Chien Peter Lin wrote:
> This patch series adds support for RISC-V Worlds ISA extensions,
> enabling hardware-enforced isolation boundaries based on World IDs
> by extending the OpenSBI domain framework.
> 
> Trust Model and Boot-time Roles
> --------------------------------
> 
> The implementation follows the two-phase M-mode trust model:
> 
> - RoT M-mode phase: Prior boot stage (ROM/SPL) that may program mwid and
>   mlwidlist and lock mwid before handing off to OpenSBI.
> 
> - Regular M-mode phase (OpenSBI): Treats pmwid/pmwidlist/pmlwidlist as
>   input policy from hardware/RoT. Locks mwid to prevent later M-mode code
>   from changing its own WID. Programs per-domain mlwid/mwiddeleg based on
>   DT configuration.
> 
> Device Tree Bindings
> ---------------------
> 
> Per-hart properties defined in linux kernel DT bindings v3 [1]:
> - riscv,pmwid: M-mode World ID
> - riscv,pmwidlist: M-mode permitted WID bitmap
> - riscv,pmlwidlist: S/U-mode permitted WID bitmap>
> Per-domain properties (see domain_support.md):
> - wid: S-mode WID for this domain
> - widdeleg: WID delegation bitmap for this domain


I don't understand why I am cc-ed here, why DT is described here but not
in the bindings and why do you reference some RFC (which means: not
READY for review) patchset in a different patchset which is ready for
review.

Best regards,
Krzysztof

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 9/9] docs: document WID DT properties

[Yu-Chien Peter Lin]

Hi Anup,

On Mon, Sep 28, 2026 at 02:05:32PM +0530, Anup Patel wrote:
> On Mon, Aug 17, 2026 at 2:35 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Add "wid" and "widdeleg" properties to domain instance node
> > documentation and example DT. Add a "Root Domain Node" section
> > describing the "root" subnode under the domain configuration
> > node for root domain WID configuration
> >
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> >  docs/domain_support.md | 36 ++++++++++++++++++++++++++++++++++++
> >  1 file changed, 36 insertions(+)
> >
> > diff --git a/docs/domain_support.md b/docs/domain_support.md
> > index e267a9f7..c35a1d9a 100644
> > --- a/docs/domain_support.md
> > +++ b/docs/domain_support.md
> > @@ -93,6 +93,8 @@ following manner:
> >    is the next mode for the ROOT domain
> >  * **system_reset_allowed** - The ROOT domain is allowed to reset the system
> >  * **system_suspend_allowed** - The ROOT domain is allowed to suspend the system
> > +* **wid** - Configurable World ID for the ROOT domain
> > +* **widdeleg** - Configurable World ID delegation bitmask for the ROOT domain
> 
> Based on the below examples, the "wid" and "widdeleg" is also available for
> non-ROOT domains so should not have these listed under "Domain Instance"
> section as well ??

Yes, they should be added, will fix in the PATCHv3.

Thanks,
Peter Lin

> Regards,
> Anup

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 9/9] docs: document WID DT properties

[Yu-Chien Peter Lin]

Hi Krzysztof,

On Mon, Sep 28, 2026 at 01:30:28PM +0200, Krzysztof Kozlowski wrote:
> On 17/08/2026 11:05, Yu-Chien Peter Lin wrote:
> > Add "wid" and "widdeleg" properties to domain instance node
> > documentation and example DT. Add a "Root Domain Node" section
> > describing the "root" subnode under the domain configuration
> > node for root domain WID configuration
> > 
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> >  docs/domain_support.md | 36 ++++++++++++++++++++++++++++++++++++
> >  1 file changed, 36 insertions(+)
> > 
> > diff --git a/docs/domain_support.md b/docs/domain_support.md
> > index e267a9f7..c35a1d9a 100644
> > --- a/docs/domain_support.md
> > +++ b/docs/domain_support.md
> > @@ -93,6 +93,8 @@ following manner:
> >    is the next mode for the ROOT domain
> >  * **system_reset_allowed** - The ROOT domain is allowed to reset the system
> >  * **system_suspend_allowed** - The ROOT domain is allowed to suspend the system
> > +* **wid** - Configurable World ID for the ROOT domain
> > +* **widdeleg** - Configurable World ID delegation bitmask for the ROOT domain
> 
> Why are you documenting DT in some random docts?
> 
> >  
> >  Domain Effects
> >  --------------
> > @@ -126,6 +128,23 @@ The DT properties of a domain configuration DT node are as follows:
> >  * **compatible** (Mandatory) - The compatible string of the domain
> >    configuration. This DT property should have value *"opensbi,domain,config"*
> >  
> > +### Root Domain Node
> > +
> > +The root domain WID configuration is described in a **root** subnode under
> > +the domain configuration DT node. This subnode does not have a compatible
> > +string.
> > +
> > +The DT properties of the root domain node are as follows:
> 
> NAK, please read writing bindings and both documents for submitting patches.

I agree that it should be validated by kernel's
dt_binding_check/dtbs_check tooling.

To support Worlds-based supervisor domain and the
upcoming OP-TEE (and possibly StandaloneMM) trusted
domain use cases, this raises an open question for
Anup and the OpenSBI community: should we start
upstreaming the OpenSBI domain DT bindings
to linux/Documentation/devicetree/bindings?

I can send an RFC if there is consensus.

Thanks,
Peter Lin

> 
> 
> Best regards,
> Krzysztof

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v2 0/9] Add RISC-V Worlds ISA support to OpenSBI

[Yu-Chien Peter Lin]

Hi Krzysztof,

On Mon, Sep 28, 2026 at 01:33:17PM +0200, Krzysztof Kozlowski wrote:
> On 17/08/2026 11:04, Yu-Chien Peter Lin wrote:
> > This patch series adds support for RISC-V Worlds ISA extensions,
> > enabling hardware-enforced isolation boundaries based on World IDs
> > by extending the OpenSBI domain framework.
> > 
> > Trust Model and Boot-time Roles
> > --------------------------------
> > 
> > The implementation follows the two-phase M-mode trust model:
> > 
> > - RoT M-mode phase: Prior boot stage (ROM/SPL) that may program mwid and
> >   mlwidlist and lock mwid before handing off to OpenSBI.
> > 
> > - Regular M-mode phase (OpenSBI): Treats pmwid/pmwidlist/pmlwidlist as
> >   input policy from hardware/RoT. Locks mwid to prevent later M-mode code
> >   from changing its own WID. Programs per-domain mlwid/mwiddeleg based on
> >   DT configuration.
> > 
> > Device Tree Bindings
> > ---------------------
> > 
> > Per-hart properties defined in linux kernel DT bindings v3 [1]:
> > - riscv,pmwid: M-mode World ID
> > - riscv,pmwidlist: M-mode permitted WID bitmap
> > - riscv,pmlwidlist: S/U-mode permitted WID bitmap>
> > Per-domain properties (see domain_support.md):
> > - wid: S-mode WID for this domain
> > - widdeleg: WID delegation bitmap for this domain
> 
> 
> I don't understand why I am cc-ed here,

OpenSBI consumes the riscv,pmwid/pmwidlist/pmlwidlist
properties. Sorry for the confusion; I will remove you
from the CC list and provide links to the associated
OpenSBI patches in the kernel patch cover letter.

> why DT is described here but not
> in the bindings and why do you reference some RFC (which means: not
> READY for review) patchset in a different patchset which is ready for
> review.

The kernel patch series is currently pending and cannot
be merged until the RISC-V Worlds specification has landed
with an associated commit hash. Therefore, I used a TBD
placeholder in PATCH 2 [1].

Best regards,
Peter Lin

[1] https://patchwork.kernel.org/project/linux-riscv/patch/20260812122131.1534906-2-peter.lin@sifive.com/

> 
> Best regards,
> Krzysztof

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi