[PATCH v3 0/9] Add RISC-V Worlds ISA support to OpenSBI

[PATCH v3 0/9] Add RISC-V Worlds ISA support to OpenSBI

[Yu-Chien Peter Lin]

This patch series adds support for the RISC-V Worlds ISA extensions in
OpenSBI, introducing a WID-based hart protection backend to enforce
hardware isolation boundaries across domains.

Trust Model and Boot-time Roles
-------------------------------

The implementation adheres to the two-phase M-mode trust model:

- RoT M-mode phase: An earlier boot stage (e.g., ROM or SPL) may program
  mwid and mlwidlist, locking mwid prior to handing off execution to
  OpenSBI.

- Regular M-mode phase (OpenSBI): OpenSBI treats the non-ISA platform
  constraints (pmwid, pmwidlist, pmlwidlist) and CSR states (mwid,
  mlwidlist) as immutable input policies from the hardware/RoT. It locks
  mwid if still unlocked, preventing subsequent M-mode software from
  altering its own WID, and programs per-domain mlwid and mwiddeleg based
  on device tree configuration.

Device Tree Bindings
--------------------

Per-hart properties defined in Linux kernel DT bindings v3 [1]:
- riscv,pmwid: M-mode World ID
- riscv,pmwidlist: M-mode permitted WID bitmap
- riscv,pmlwidlist: S/U-mode permitted WID bitmap

Per-domain properties (see docs/domain_support.md):
- wid: World ID assigned to this domain for S/U-mode
- widdeleg: WID delegation bitmap for this domain

Changes since v2
----------------
- Make 'wid' property mandatory for all domains (including root) when
  Smlwid is implemented; reject misconfigured domains at boot.
- Remove M-mode WID fallback logic (mwid/pmwid) for S-mode domain WID.
- Validate domain wid and widdeleg against pmlwidlist and mlwidlist masks.
- Introduce a new patch to propagate error from sbi_hart_protection_reconfigure()
  in sbi_domain_context.
- Adapt to upstream domain state framework API rename (sbi_domain_data ->
  sbi_domain_state).
- Update documentation and boot log output accordingly.

[1] https://patchwork.kernel.org/project/linux-riscv/cover/20260812122131.1534906-1-peter.lin@sifive.com/

Yu-Chien Peter Lin (9):
  lib: sbi_hart: detect RISC-V Worlds ISA extensions
  lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties
  lib: fdt_domain: parse domain WID properties
  lib: sbi_hart: lock mwid CSR for RoT immutability
  lib: sbi_domain_context: propagate error from
    sbi_hart_protection_reconfigure
  lib: sbi_hart_worlds: Implement WID hart protection backend
  include: sbi_types: add PRIx64 format macro
  lib: sbi: display World ID configuration at boot
  docs: document WID DT properties

 docs/domain_support.md             |  36 +++++
 include/sbi/riscv_encoding.h       |  12 ++
 include/sbi/sbi_domain.h           |   6 +
 include/sbi/sbi_hart.h             |  15 +++
 include/sbi/sbi_hart_worlds.h      |  24 ++++
 include/sbi/sbi_types.h            |   2 +
 include/sbi_utils/fdt/fdt_helper.h |   2 +
 lib/sbi/objects.mk                 |   1 +
 lib/sbi/sbi_domain.c               |  20 +++
 lib/sbi/sbi_domain_context.c       |   5 +-
 lib/sbi/sbi_hart.c                 |  38 ++++++
 lib/sbi/sbi_hart_worlds.c          | 210 +++++++++++++++++++++++++++++
 lib/sbi/sbi_init.c                 |  13 ++
 lib/utils/fdt/fdt_domain.c         |  84 ++++++++++++
 lib/utils/fdt/fdt_helper.c         |  90 +++++++++++++
 platform/generic/platform.c        |  13 +-
 16 files changed, 569 insertions(+), 2 deletions(-)
 create mode 100644 include/sbi/sbi_hart_worlds.h
 create mode 100644 lib/sbi/sbi_hart_worlds.c

-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v3 1/9] lib: sbi_hart: detect RISC-V Worlds ISA extensions

[Yu-Chien Peter Lin]

Add CSR definitions for RISC-V Worlds (mwid, mlwid, mlwidlist,
mwiddeleg, slwid) and detect Worlds extensions via CSR probes
in hart_detect_features().

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>
---
Change v2->v3:
- No change
---
 include/sbi/riscv_encoding.h | 12 ++++++++++++
 include/sbi/sbi_hart.h       | 10 ++++++++++
 lib/sbi/sbi_hart.c           | 26 ++++++++++++++++++++++++++
 3 files changed, 48 insertions(+)

diff --git a/include/sbi/riscv_encoding.h b/include/sbi/riscv_encoding.h
index ffe7666c..e0262bfc 100644
--- a/include/sbi/riscv_encoding.h
+++ b/include/sbi/riscv_encoding.h
@@ -400,6 +400,9 @@
 /* Supervisor Resource Management Configuration CSRs */
 #define CSR_SRMCFG			0x181
 
+/* Supervisor lower-privilege mode World ID CSR (Sswid) */
+#define CSR_SLWID			0x190
+
 /* Machine-Level Control transfer records CSRs */
 #define CSR_MCTRCTL                     0x34e
 
@@ -520,6 +523,15 @@
 #define CSR_MTINST			0x34a
 #define CSR_MTVAL2			0x34b
 
+/* Machine World ID CSRs (Smwid, Smlwid, Smlwidlist, Smwiddeleg) */
+#define CSR_MLWID			0x390
+#define CSR_MWID			0x749
+#define CSR_MWIDDELEG			0x748
+#define CSR_MLWIDLIST			0x74A
+
+/* mwid lock bit */
+#define MWID_LOCK			(_UL(1) << (__riscv_xlen - 1))
+
 /* Machine Memory Protection */
 #define CSR_PMPCFG0			0x3a0
 #define CSR_PMPCFG1			0x3a1
diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
index 543393bb..2941809e 100644
--- a/include/sbi/sbi_hart.h
+++ b/include/sbi/sbi_hart.h
@@ -95,6 +95,16 @@ enum sbi_hart_extensions {
 	SBI_HART_EXT_F,
 	/** Hart has D extension */
 	SBI_HART_EXT_D,
+	/** Hart has Smwid extension */
+	SBI_HART_EXT_SMWID,
+	/** Hart has Smlwid extension */
+	SBI_HART_EXT_SMLWID,
+	/** Hart has Smlwidlist extension */
+	SBI_HART_EXT_SMLWIDLIST,
+	/** Hart has Smwiddeleg extension */
+	SBI_HART_EXT_SMWIDDELEG,
+	/** Hart has Sswid extension */
+	SBI_HART_EXT_SSWID,
 
 	/** Maximum index of Hart extension */
 	SBI_HART_EXT_MAX,
diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index 8e4c36d0..38a761ac 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -360,6 +360,11 @@ const struct sbi_hart_ext_data sbi_hart_ext[] = {
 	__SBI_HART_EXT_DATA(v, SBI_HART_EXT_V),
 	__SBI_HART_EXT_DATA(f, SBI_HART_EXT_F),
 	__SBI_HART_EXT_DATA(d, SBI_HART_EXT_D),
+	__SBI_HART_EXT_DATA(smwid, SBI_HART_EXT_SMWID),
+	__SBI_HART_EXT_DATA(smlwid, SBI_HART_EXT_SMLWID),
+	__SBI_HART_EXT_DATA(smlwidlist, SBI_HART_EXT_SMLWIDLIST),
+	__SBI_HART_EXT_DATA(smwiddeleg, SBI_HART_EXT_SMWIDDELEG),
+	__SBI_HART_EXT_DATA(sswid, SBI_HART_EXT_SSWID),
 };
 
 _Static_assert(SBI_HART_EXT_MAX == array_size(sbi_hart_ext),
@@ -647,9 +652,30 @@ __pmp_skip:
 	/* Detect if hart support sdtrig (debug triggers) */
 	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
 			CSR_TSELECT, SBI_HART_EXT_SDTRIG);
+	/* Detect if hart supports Smwid */
+	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
+			CSR_MWID, SBI_HART_EXT_SMWID);
+	/* Detect if hart supports Smlwid */
+	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
+			CSR_MLWID, SBI_HART_EXT_SMLWID);
+	/* Detect if hart supports Smlwidlist */
+	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
+			CSR_MLWIDLIST, SBI_HART_EXT_SMLWIDLIST);
+	/* Detect if hart supports Smwiddeleg */
+	__check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
+			CSR_MWIDDELEG, SBI_HART_EXT_SMWIDDELEG);
 
 #undef __check_ext_csr
 
+	/*
+	 * slwid traps on access when mwiddeleg=0 (reset state), so
+	 * Sswid presence is inferred from Smwiddeleg.
+	 */
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
+		__sbi_hart_update_extension(hfeatures,
+					    SBI_HART_EXT_SSWID, true);
+	}
+
 #define __check_csr_existence(__csr, __csr_id)				\
 	csr_read_allowed(__csr, &trap);					\
 	if (!trap.cause)						\
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v3 2/9] lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties

[Yu-Chien Peter Lin]

Add fdt_parse_worlds_all_harts() to parse platform-defined DT
properties in the /cpus/cpu@X:
- riscv,pmwid: M-mode World ID
- riscv,pmwidlist: bitmap of permitted M-mode WIDs
- riscv,pmlwidlist: bitmap of permitted lower-privilege WIDs
Store parsed values in struct sbi_hart_features.

These platform-defined values serve as the root-of-trust constraints
for per-domain WID assignment during domain creation and context
switching.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
Change v2->v3:
- Drop has_pmwidlist presence flag and check pmwidlist directly.
---
 include/sbi/sbi_hart.h             |  5 ++
 include/sbi_utils/fdt/fdt_helper.h |  2 +
 lib/utils/fdt/fdt_helper.c         | 90 ++++++++++++++++++++++++++++++
 platform/generic/platform.c        | 13 ++++-
 4 files changed, 109 insertions(+), 1 deletion(-)

diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
index 2941809e..a1860a9c 100644
--- a/include/sbi/sbi_hart.h
+++ b/include/sbi/sbi_hart.h
@@ -135,6 +135,11 @@ struct sbi_hart_features {
 	unsigned int pmp_log2gran;
 	unsigned int mhpm_mask;
 	unsigned int mhpm_bits;
+	u32 pmwid;
+	u64 pmwidlist;
+	u64 pmlwidlist;
+	bool has_pmwid;
+	bool has_pmlwidlist;
 };
 
 extern unsigned long hart_features_offset;
diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
index 75a564d1..3f3d091b 100644
--- a/include/sbi_utils/fdt/fdt_helper.h
+++ b/include/sbi_utils/fdt/fdt_helper.h
@@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
 
 int fdt_parse_isa_extensions_all_harts(const void *fdt);
 
+int fdt_parse_worlds_all_harts(const void *fdt);
+
 int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
 				struct platform_uart_data *uart);
 
diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
index 747ba028..4701606d 100644
--- a/lib/utils/fdt/fdt_helper.c
+++ b/lib/utils/fdt/fdt_helper.c
@@ -457,6 +457,96 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
 	return 0;
 }
 
+int fdt_parse_worlds_all_harts(const void *fdt)
+{
+	u32 hartid;
+	const fdt32_t *val;
+	struct sbi_scratch *scratch;
+	struct sbi_hart_features *hfeatures;
+	int err, cpu_offset, cpus_offset, len;
+
+	if (!fdt)
+		return SBI_EINVAL;
+
+	cpus_offset = fdt_path_offset(fdt, "/cpus");
+	if (cpus_offset < 0)
+		return cpus_offset;
+
+	fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
+		err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
+		if (err)
+			continue;
+
+		if (!fdt_node_is_enabled(fdt, cpu_offset))
+			continue;
+
+		scratch = sbi_hartid_to_scratch(hartid);
+		if (!scratch)
+			return SBI_ENOENT;
+
+		hfeatures = sbi_hart_features_ptr(scratch);
+		if (!hfeatures)
+			return SBI_ENOENT;
+
+		val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
+		if (val && len == sizeof(fdt32_t)) {
+			hfeatures->pmwid = fdt32_to_cpu(*val);
+			hfeatures->has_pmwid = true;
+		}
+
+		val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
+		if (val && len == 2 * sizeof(fdt32_t)) {
+			hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
+						fdt32_to_cpu(val[1]);
+			if (!hfeatures->pmwidlist) {
+				sbi_printf("%s: hart%u riscv,pmwidlist is empty\n",
+					   __func__, hartid);
+				return SBI_EINVAL;
+			}
+		}
+
+		val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
+		if (val && len == 2 * sizeof(fdt32_t)) {
+			hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
+						 fdt32_to_cpu(val[1]);
+			hfeatures->has_pmlwidlist = true;
+		}
+
+		/* Sanity checks */
+#if __riscv_xlen == 32
+		if (hfeatures->pmwidlist &&
+		    (hfeatures->pmwidlist >> 32)) {
+			sbi_printf("%s: hart%u riscv,pmwidlist has bits beyond XLEN\n",
+				   __func__, hartid);
+			return SBI_EINVAL;
+		}
+
+		if (hfeatures->has_pmlwidlist &&
+		    (hfeatures->pmlwidlist >> 32)) {
+			sbi_printf("%s: hart%u riscv,pmlwidlist has bits beyond XLEN\n",
+				   __func__, hartid);
+			return SBI_EINVAL;
+		}
+#endif
+
+		if (hfeatures->has_pmwid &&
+		    hfeatures->pmwid >= __riscv_xlen) {
+			sbi_printf("%s: hart%u riscv,pmwid (%u) exceeds max WID\n",
+				   __func__, hartid, hfeatures->pmwid);
+			return SBI_EINVAL;
+		}
+
+		if (hfeatures->pmwidlist && hfeatures->has_pmwid &&
+		    !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
+			sbi_printf("%s: hart%u riscv,pmwid (%u) not in pmwidlist\n",
+				   __func__, hartid, hfeatures->pmwid);
+			return SBI_EINVAL;
+		}
+	}
+
+	return 0;
+}
+
 static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
 				      struct platform_uart_data *uart,
 				      unsigned long default_freq,
diff --git a/platform/generic/platform.c b/platform/generic/platform.c
index 1df0280d..51e9f342 100644
--- a/platform/generic/platform.c
+++ b/platform/generic/platform.c
@@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
 
 int generic_extensions_init(bool cold_boot)
 {
+	int rc;
+
 	if (!cold_boot)
 		return 0;
 
 	/* Parse the ISA string from FDT and enable the listed extensions */
-	return fdt_parse_isa_extensions_all_harts(fdt_get_address());
+	rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
+	if (rc)
+		return rc;
+
+	/* Parse RISC-V Worlds CPU properties from FDT */
+	rc = fdt_parse_worlds_all_harts(fdt_get_address());
+	if (rc)
+		return rc;
+
+	return 0;
 }
 
 int generic_domains_init(void)
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v3 3/9] lib: fdt_domain: parse domain WID properties

[Yu-Chien Peter Lin]

Add wid and widdeleg fields to struct sbi_domain to store the
RISC-V Worlds mlwid and mwideleg CSR values for each domain.
Also, parse the root and user-defined domains' WID during
fdt_domains_populate().

When Smlwid is implemented, the "wid" property is mandatory
for all domains; fail domain population if it is missing.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
Change v2->v3:
- Add validate_domain_wid() to check if 'wid' is specified when Smlwid
  extension is present; return SBI_EINVAL if missing.
- Parse 'wid' and 'widdeleg' for the root domain via fdt_parse_root_domain().
- Set root.widdeleg default to 0.
---
 include/sbi/sbi_domain.h   |  6 +++
 lib/sbi/sbi_domain.c       |  2 +
 lib/utils/fdt/fdt_domain.c | 84 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 92 insertions(+)

diff --git a/include/sbi/sbi_domain.h b/include/sbi/sbi_domain.h
index 56a21397..5a291d1f 100644
--- a/include/sbi/sbi_domain.h
+++ b/include/sbi/sbi_domain.h
@@ -19,6 +19,8 @@
 
 struct sbi_scratch;
 
+#define INVALID_WID	((unsigned int)~0U)
+
 /** Domain access types */
 enum sbi_domain_access {
 	SBI_DOMAIN_READ = (1UL << 0),
@@ -218,6 +220,10 @@ struct sbi_domain {
 	bool system_reset_allowed;
 	/** Is domain allowed to suspend the system */
 	bool system_suspend_allowed;
+	/** World ID for this domain (mlwid value) */
+	u32 wid;
+	/** World ID delegation bitmask for this domain (mwiddeleg value) */
+	u64 widdeleg;
 	/** Identifies whether to include the firmware region */
 	bool fw_region_inited;
 };
diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
index 42fe5632..be9020d0 100644
--- a/lib/sbi/sbi_domain.c
+++ b/lib/sbi/sbi_domain.c
@@ -30,6 +30,8 @@ struct sbi_domain root = {
 	.possible_harts = NULL,
 	.system_reset_allowed = true,
 	.system_suspend_allowed = true,
+	.wid = INVALID_WID,
+	.widdeleg = 0,
 	.fw_region_inited = false,
 };
 
diff --git a/lib/utils/fdt/fdt_domain.c b/lib/utils/fdt/fdt_domain.c
index e4cce8c3..8ce03236 100644
--- a/lib/utils/fdt/fdt_domain.c
+++ b/lib/utils/fdt/fdt_domain.c
@@ -13,6 +13,7 @@
 #include <sbi/sbi_console.h>
 #include <sbi/sbi_domain.h>
 #include <sbi/sbi_error.h>
+#include <sbi/sbi_hart.h>
 #include <sbi/sbi_hartmask.h>
 #include <sbi/sbi_heap.h>
 #include <sbi/sbi_scratch.h>
@@ -290,6 +291,42 @@ static int __fdt_parse_region(const void *fdt, int domain_offset,
 	return 0;
 }
 
+static void fdt_parse_domain_wid_props(const void *fdt, int offset,
+				       struct sbi_domain *dom)
+{
+	const fdt32_t *val;
+	int len;
+	u64 val64;
+
+	val = fdt_getprop(fdt, offset, "wid", &len);
+	if (val && len == sizeof(fdt32_t)) {
+		dom->wid = fdt32_to_cpu(val[0]);
+	}
+
+	val = fdt_getprop(fdt, offset, "widdeleg", &len);
+	if (val && (len == (2 * sizeof(fdt32_t)))) {
+		val64 = fdt32_to_cpu(val[0]);
+		val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
+		dom->widdeleg = val64;
+	}
+}
+
+static int validate_domain_wid(const struct sbi_domain *dom)
+{
+	if (dom->wid != INVALID_WID)
+		return 0;
+
+	if (sbi_hart_has_extension(sbi_scratch_thishart_ptr(),
+				   SBI_HART_EXT_SMLWID)) {
+		sbi_printf("%s: domain \"%s\": missing \"wid\""
+			   " property (required by Smlwid)\n",
+			   __func__, dom->name);
+		return SBI_EINVAL;
+	}
+
+	return 0;
+}
+
 static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
 {
 	u32 val32;
@@ -306,6 +343,7 @@ static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
 	dom = sbi_zalloc(sizeof(*dom));
 	if (!dom)
 		return SBI_ENOMEM;
+	dom->wid = INVALID_WID;
 
 	preg.dom = dom;
 	preg.region_count = 0;
@@ -449,6 +487,12 @@ static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
 	}
 	dom->next_mode = val32;
 
+	/* Read "wid" and "widdeleg" DT properties */
+	fdt_parse_domain_wid_props(fdt, domain_offset, dom);
+	err = validate_domain_wid(dom);
+	if (err)
+		goto fail_free_all;
+
 	/* Read "system-reset-allowed" DT property */
 	if (fdt_get_property(fdt, domain_offset,
 			     "system-reset-allowed", NULL))
@@ -477,12 +521,52 @@ fail_free_domain:
 	return err;
 }
 
+static int fdt_root_domain_offset(const void *fdt)
+{
+	int offset;
+
+	offset = fdt_path_offset(fdt, "/chosen");
+	if (offset < 0)
+		return offset;
+
+	offset = fdt_node_offset_by_compatible(fdt, offset,
+					       "opensbi,domain,config");
+	if (offset < 0)
+		return offset;
+
+	return fdt_subnode_offset(fdt, offset, "root");
+}
+
+static int fdt_parse_root_domain(const void *fdt)
+{
+	int offset;
+
+	if (fdt) {
+		offset = fdt_root_domain_offset(fdt);
+		if (offset >= 0)
+			fdt_parse_domain_wid_props(fdt, offset, &root);
+	}
+
+	/*
+	 * Ensure root domain has a valid WID
+	 * even if FDT or root subnode is absent
+	 */
+	return validate_domain_wid(&root);
+}
+
 int fdt_domains_populate(const void *fdt)
 {
+	int err;
+
 	/* Sanity checks */
 	if (!fdt)
 		return SBI_EINVAL;
 
+	/* Parse root domain config from "root" subnode */
+	err = fdt_parse_root_domain(fdt);
+	if (err)
+		return err;
+
 	/* Iterate over each domain in FDT and populate details */
 	return fdt_iterate_each_domain_ro(fdt, NULL, __fdt_parse_domain);
 }
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v3 4/9] lib: sbi_hart: lock mwid CSR for RoT immutability

[Yu-Chien Peter Lin]

Lock the M-mode World ID (mwid) CSR during hart re-initialization
to enforce immutability of the WID established by the root-of-trust.

OpenSBI does not assign the WID value itself; it only sets MWID_LOCK
to freeze the value established by prior RoT stage. The MWID_LOCK bit
at XLEN-1 is sticky and makes the CSR read-only until reset, enforcing
a temporal security boundary per the RISC-V Worlds specification.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>
---
Change v2->v3:
- No change
---
 lib/sbi/sbi_hart.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index 38a761ac..f05d9b5d 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -724,6 +724,13 @@ int sbi_hart_reinit(struct sbi_scratch *scratch)
 	if (rc)
 		return rc;
 
+	/*
+	 * Assume MWID is restored by root-of-trust M-mode in previous
+	 * stage. Lock mwid so RoT-defined WID remains immutable.
+	 */
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID))
+		csr_set(CSR_MWID, MWID_LOCK);
+
 	return 0;
 }
 
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v3 5/9] lib: sbi_domain_context: propagate error from sbi_hart_protection_reconfigure

[Yu-Chien Peter Lin]

Propagate the return value of sbi_hart_protection_reconfigure in
switch_to_next_domain_context to ensure that domain transition
failures are correctly handled by the caller.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
Change v2->v3:
- New patch: propagate return value of sbi_hart_protection_reconfigure()
  in switch_to_next_domain_context().
---
 lib/sbi/sbi_domain_context.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib/sbi/sbi_domain_context.c b/lib/sbi/sbi_domain_context.c
index 987ac7fa..1751d016 100644
--- a/lib/sbi/sbi_domain_context.c
+++ b/lib/sbi/sbi_domain_context.c
@@ -110,6 +110,7 @@ static int switch_to_next_domain_context(struct hart_context *ctx,
 	MUST_NOT_HOLD(&ctx->dom->assigned_harts_lock)
 	MUST_NOT_HOLD(&dom_ctx->dom->assigned_harts_lock)
 {
+	int rc;
 	u32 hartindex = current_hartindex();
 	struct sbi_trap_context *trap_ctx;
 	struct sbi_domain *current_dom, *target_dom;
@@ -173,7 +174,9 @@ static int switch_to_next_domain_context(struct hart_context *ctx,
 	 * is also required for some of the above CSR updates (such
 	 * as satp CSR).
 	 */
-	sbi_hart_protection_reconfigure(scratch, current_dom, target_dom);
+	rc = sbi_hart_protection_reconfigure(scratch, current_dom, target_dom);
+	if (rc)
+		return rc;
 
 	/* Mark current context structure initialized because context saved */
 	ctx->initialized = true;
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v3 6/9] lib: sbi_hart_worlds: Implement WID hart protection backend

[Yu-Chien Peter Lin]

Introduce a WID-based hart protection backend that switches World ID
configurations across domains.

Access to slwid is gated by mwiddeleg (Sswid), which means slwid cannot
be handled by generic hart_context save/restore. Instead, manage slwid as
domain state with explicit sequencing:

- configure:
  - Validate and program mlwid and mwiddeleg according to domain policy
    and platform constraints (pmlwidlist/mlwidlist).
  - Restore slwid after mwiddeleg is enabled.
- unconfigure:
  - Save slwid prior to clearing mwiddeleg.
  - Reset mwiddeleg to 0 to disable Sswid.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
Change v2->v3:
- Add hart_worlds_validate_wid() to check domain wid against pmlwidlist
  and mlwidlist masks.
- Add hart_worlds_validate_widdeleg() to check domain widdeleg against
  pmlwidlist and mlwidlist masks.
- Drop M-mode WID fallback (mwid/pmwid) for mlwid; program dom->wid directly.
- Adapt to upstream domain state API rename (sbi_domain_data ->
  sbi_domain_state).
---
 include/sbi/sbi_hart_worlds.h |  24 ++++
 lib/sbi/objects.mk            |   1 +
 lib/sbi/sbi_hart.c            |   5 +
 lib/sbi/sbi_hart_worlds.c     | 210 ++++++++++++++++++++++++++++++++++
 4 files changed, 240 insertions(+)
 create mode 100644 include/sbi/sbi_hart_worlds.h
 create mode 100644 lib/sbi/sbi_hart_worlds.c

diff --git a/include/sbi/sbi_hart_worlds.h b/include/sbi/sbi_hart_worlds.h
new file mode 100644
index 00000000..91b11023
--- /dev/null
+++ b/include/sbi/sbi_hart_worlds.h
@@ -0,0 +1,24 @@
+/*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2026 SiFive Inc.
+ */
+
+#ifndef __SBI_HART_WORLDS_H__
+#define __SBI_HART_WORLDS_H__
+
+struct sbi_scratch;
+
+/**
+ * Initialize WID hart protection for current HART
+ *
+ * Registers the WID protection mechanism if Smlwid
+ * extension is present.
+ *
+ * @param scratch pointer to scratch space of current HART
+ *
+ * @return 0 on success and negative error code on failure
+ */
+int sbi_hart_worlds_init(struct sbi_scratch *scratch);
+
+#endif /* __SBI_HART_WORLDS_H__ */
diff --git a/lib/sbi/objects.mk b/lib/sbi/objects.mk
index ae27d0c5..355ae6e9 100644
--- a/lib/sbi/objects.mk
+++ b/lib/sbi/objects.mk
@@ -77,6 +77,7 @@ libsbi-objs-y += sbi_fwft.o
 libsbi-objs-y += sbi_hart.o
 libsbi-objs-y += sbi_hart_pmp.o
 libsbi-objs-y += sbi_hart_protection.o
+libsbi-objs-y += sbi_hart_worlds.o
 libsbi-objs-y += sbi_heap.o
 libsbi-objs-y += sbi_math.o
 libsbi-objs-y += sbi_hfence.o
diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index f05d9b5d..6aa6edd5 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -17,6 +17,7 @@
 #include <sbi/sbi_error.h>
 #include <sbi/sbi_hart.h>
 #include <sbi/sbi_hart_pmp.h>
+#include <sbi/sbi_hart_worlds.h>
 #include <sbi/sbi_platform.h>
 #include <sbi/sbi_pmu.h>
 #include <sbi/sbi_string.h>
@@ -762,6 +763,10 @@ int sbi_hart_init(struct sbi_scratch *scratch, bool cold_boot)
 		rc = sbi_hart_pmp_init(scratch);
 		if (rc)
 			return rc;
+
+		rc = sbi_hart_worlds_init(scratch);
+		if (rc)
+			return rc;
 	}
 
 	return sbi_hart_reinit(scratch);
diff --git a/lib/sbi/sbi_hart_worlds.c b/lib/sbi/sbi_hart_worlds.c
new file mode 100644
index 00000000..6f582bd2
--- /dev/null
+++ b/lib/sbi/sbi_hart_worlds.c
@@ -0,0 +1,210 @@
+/*
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2026 SiFive Inc.
+ */
+
+#include <sbi/riscv_encoding.h>
+#include <sbi/sbi_bitops.h>
+#include <sbi/sbi_console.h>
+#include <sbi/sbi_domain.h>
+#include <sbi/sbi_error.h>
+#include <sbi/sbi_hart.h>
+#include <sbi/sbi_hart_protection.h>
+#include <sbi/sbi_hart_worlds.h>
+#include <sbi/sbi_scratch.h>
+
+/**
+ * Initialize the per-hart slwid values of a domain using
+ * the lowest delegated WID as the initial value.
+ *
+ * S-mode OS should choose the desire slwid for it's
+ * U-mode.
+ */
+static int sbi_hart_worlds_state_setup(struct sbi_domain *dom,
+				       struct sbi_domain_state *state,
+				       void *state_ptr)
+{
+	unsigned long widdeleg = dom->widdeleg;
+	unsigned long *slwid = state_ptr;
+	unsigned long init_wid;
+
+	if (!widdeleg)
+		return SBI_OK;
+
+	init_wid = sbi_ffs(widdeleg);
+	sbi_for_each_hartindex(i)
+		slwid[i] = init_wid;
+
+	return SBI_OK;
+}
+
+static struct sbi_domain_state wid_state = {
+	.state_setup = sbi_hart_worlds_state_setup,
+};
+
+static unsigned long *sbi_hart_worlds_slwid_ptr(struct sbi_domain *dom)
+{
+	unsigned long *slwid;
+
+	slwid = sbi_domain_state_ptr(dom, &wid_state);
+	if (!slwid || !sbi_hartindex_valid(current_hartindex()))
+		return NULL;
+
+	return &slwid[current_hartindex()];
+}
+
+static int hart_worlds_validate_wid(struct sbi_scratch *scratch,
+				    struct sbi_domain *dom,
+				    unsigned long mlwidlist)
+{
+	struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
+
+	if (hf->has_pmlwidlist && !(hf->pmlwidlist & BIT_ULL(dom->wid))) {
+		sbi_printf("%s: domain%d WID %u not permitted by"
+			   " pmlwidlist\n",
+			   __func__, dom->index, dom->wid);
+		return SBI_EINVAL;
+	}
+
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST) &&
+	    !(mlwidlist & BIT_ULL(dom->wid))) {
+		sbi_printf("%s: domain%d WID %u not permitted by"
+			   " mlwidlist 0x%lx\n",
+			   __func__, dom->index, dom->wid, mlwidlist);
+		return SBI_EINVAL;
+	}
+
+	return SBI_OK;
+}
+
+/*
+ * Validate that a domain's widdeleg value, parsed from the
+ * "widdeleg" DT property, is permitted on this hart.
+ *
+ * mwiddeleg is a M-mode WARL register, so an S-mode OS must rely
+ * on the "widdeleg" DT property to determine which WIDs it may
+ * delegate to U-mode via slwid. If pmwidlist or mlwidlist silently
+ * filters out any of those WIDs, the S-mode OS's view of the WIDs
+ * available for delegation would be incorrect. Treat this mismatch
+ * as a misconfiguration.
+ */
+static int hart_worlds_validate_widdeleg(struct sbi_scratch *scratch,
+					 struct sbi_domain *dom,
+					 unsigned long mlwidlist)
+{
+	struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
+	unsigned long widdeleg = dom->widdeleg;
+
+	if (!widdeleg)
+		return SBI_OK;
+
+	if (hf->has_pmlwidlist && (widdeleg & ~hf->pmlwidlist)) {
+		sbi_printf("%s: domain%d widdeleg 0x%lx has WID(s)"
+			   " outside pmlwidlist 0x%lx\n",
+			   __func__, dom->index, widdeleg,
+			   (unsigned long)hf->pmlwidlist);
+		return SBI_EINVAL;
+	}
+
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST) &&
+	    (widdeleg & ~mlwidlist)) {
+		sbi_printf("%s: domain%d widdeleg 0x%lx has WID(s)"
+			   " outside mlwidlist 0x%lx\n",
+			   __func__, dom->index, widdeleg, mlwidlist);
+		return SBI_EINVAL;
+	}
+
+	return SBI_OK;
+}
+
+static int sbi_hart_worlds_configure(struct sbi_scratch *scratch,
+				     struct sbi_domain *dom)
+{
+	unsigned long *slwid = NULL;
+	unsigned long mlwidlist = 0;
+	int rc;
+
+	if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
+		return SBI_OK;
+
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST))
+		mlwidlist = csr_read(CSR_MLWIDLIST);
+
+	rc = hart_worlds_validate_wid(scratch, dom, mlwidlist);
+	if (rc)
+		return rc;
+
+	csr_write(CSR_MLWID, dom->wid);
+
+	if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG))
+		return SBI_OK;
+
+	rc = hart_worlds_validate_widdeleg(scratch, dom, mlwidlist);
+	if (rc)
+		return rc;
+
+	/*
+	 * Enable Sswid before restoring slwid. A zero mwiddeleg
+	 * disables access to slwid, so the order here is required.
+	 */
+	csr_write(CSR_MWIDDELEG, dom->widdeleg);
+
+	if (dom->widdeleg) {
+		slwid = sbi_hart_worlds_slwid_ptr(dom);
+		if (!slwid)
+			return SBI_EINVAL;
+		csr_write(CSR_SLWID, *slwid);
+	}
+
+	return SBI_OK;
+}
+
+static void sbi_hart_worlds_unconfigure(struct sbi_scratch *scratch,
+					struct sbi_domain *dom)
+{
+	unsigned long *slwid;
+
+	if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG) ||
+	    !dom->widdeleg)
+		return;
+
+	/*
+	 * Save slwid value before disabling Sswid since the
+	 * CSR value may not retain through the disabled period.
+	 */
+	slwid = sbi_hart_worlds_slwid_ptr(dom);
+	if (!slwid) {
+		sbi_panic("%s: domain%d has no slwid state\n",
+			  __func__, dom->index);
+	}
+	*slwid = csr_read(CSR_SLWID);
+
+	/* Disable Sswid */
+	csr_write(CSR_MWIDDELEG, 0);
+}
+
+static struct sbi_hart_protection wid_protection = {
+	.name		= "wid",
+	.rating		= 100,
+	.type		= SBI_HART_PROTECTION_TYPE_ID,
+	.configure	= sbi_hart_worlds_configure,
+	.unconfigure	= sbi_hart_worlds_unconfigure
+};
+
+int sbi_hart_worlds_init(struct sbi_scratch *scratch)
+{
+	int rc;
+
+	if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
+		return 0;
+
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
+		wid_state.state_size = sizeof(unsigned long) * sbi_hart_count();
+		rc = sbi_domain_register_state(&wid_state);
+		if (rc)
+			return rc;
+	}
+
+	return sbi_hart_protection_register(&wid_protection);
+}
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v3 7/9] include: sbi_types: add PRIx64 format macro

[Yu-Chien Peter Lin]

Add PRIx64 for portable 64-bit hex printing. Expands
to 016lx on RV64 and 016llx on RV32, enabling consistent
printf-style formatting of uint64_t values.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>
---
Change v2->v3:
- No change
---
 include/sbi/sbi_types.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/sbi/sbi_types.h b/include/sbi/sbi_types.h
index b8a7e6cb..780a4c2a 100644
--- a/include/sbi/sbi_types.h
+++ b/include/sbi/sbi_types.h
@@ -34,12 +34,14 @@ typedef unsigned long		u64;
 typedef long			int64_t;
 typedef unsigned long		uint64_t;
 #define PRILX			"016lx"
+#define PRIx64			"016lx"
 #elif __riscv_xlen == 32
 typedef long long		s64;
 typedef unsigned long long	u64;
 typedef long long		int64_t;
 typedef unsigned long long	uint64_t;
 #define PRILX			"08lx"
+#define PRIx64			"016llx"
 #else
 #error "Unexpected __riscv_xlen"
 #endif
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v3 8/9] lib: sbi: display World ID configuration at boot

[Yu-Chien Peter Lin]

Print per-domain Wid/Widdeleg and boot HART's M-mode
World ID (mwid/pmwid fallback).

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
Change v2->v3:
- Display dom->wid directly when Smlwid is present.
---
 lib/sbi/sbi_domain.c | 18 ++++++++++++++++++
 lib/sbi/sbi_init.c   | 13 +++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
index be9020d0..f92ebc2f 100644
--- a/lib/sbi/sbi_domain.c
+++ b/lib/sbi/sbi_domain.c
@@ -10,6 +10,7 @@
 #include <sbi/riscv_asm.h>
 #include <sbi/sbi_console.h>
 #include <sbi/sbi_domain.h>
+#include <sbi/sbi_hart.h>
 #include <sbi/sbi_hartmask.h>
 #include <sbi/sbi_heap.h>
 #include <sbi/sbi_hsm.h>
@@ -613,6 +614,7 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
 	u32 i, j, k;
 	unsigned long rstart, rend;
 	const struct sbi_domain_memregion *reg;
+	struct sbi_scratch *scratch = sbi_scratch_thishart_ptr();
 
 	sbi_printf("Domain%d Name        %s: %s\n",
 		   dom->index, suffix, dom->name);
@@ -691,6 +693,22 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
 		break;
 	}
 
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) {
+		sbi_printf("Domain%d Wid         %s: %u\n",
+			   dom->index, suffix, dom->wid);
+	} else {
+		sbi_printf("Domain%d Wid         %s: unsupported\n",
+			   dom->index, suffix);
+	}
+
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
+		sbi_printf("Domain%d Widdeleg    %s: 0x%" PRIx64 "\n",
+			   dom->index, suffix, dom->widdeleg);
+	} else {
+		sbi_printf("Domain%d Widdeleg    %s: unsupported\n",
+			   dom->index, suffix);
+	}
+
 	sbi_printf("Domain%d SysReset    %s: %s\n",
 		   dom->index, suffix, (dom->system_reset_allowed) ? "yes" : "no");
 
diff --git a/lib/sbi/sbi_init.c b/lib/sbi/sbi_init.c
index acd2f8b6..f771f548 100644
--- a/lib/sbi/sbi_init.c
+++ b/lib/sbi/sbi_init.c
@@ -167,6 +167,7 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
 	int xlen;
 	char str[256];
 	const struct sbi_domain *dom = sbi_domain_thishart_ptr();
+	struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
 
 	if (scratch->options & SBI_SCRATCH_NO_BOOT_PRINTS)
 		return;
@@ -199,6 +200,18 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
 	sbi_printf("Boot HART Debug Triggers    : %d triggers\n",
 		   sbi_dbtr_get_total_triggers());
 	sbi_hart_delegation_dump(scratch, "Boot HART ", "           ");
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID)) {
+		ulong mwid = csr_read(CSR_MWID);
+
+		sbi_printf("Boot HART M-mode World ID   : %lu (%s)\n",
+			   mwid & ~MWID_LOCK,
+			   (mwid & MWID_LOCK) ? "locked" : "unlocked");
+	} else if (hf->has_pmwid) {
+		sbi_printf("Boot HART M-mode World ID   : %u (pmwid)\n",
+			   hf->pmwid);
+	} else {
+		sbi_printf("Boot HART M-mode World ID   : unsupported\n");
+	}
 }
 
 static unsigned long coldboot_done;
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

[PATCH v3 9/9] docs: document WID DT properties

[Yu-Chien Peter Lin]

Add "wid" and "widdeleg" properties to domain instance node
documentation and example DT. Add a "Root Domain Node" section
describing the "root" subnode under the domain configuration
node for root domain WID configuration

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
Change v2->v3:
- Mark 'wid' property as mandatory when Smlwid is present for both root
  and domain instance nodes.
- Remove mention of M-mode WID fallback when 'wid' is absent.
---
 docs/domain_support.md | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/docs/domain_support.md b/docs/domain_support.md
index 51737218..54327e8d 100644
--- a/docs/domain_support.md
+++ b/docs/domain_support.md
@@ -56,6 +56,8 @@ has following details:
   domain. This can be either S-mode or U-mode.
 * **system_reset_allowed** - Is domain allowed to reset the system?
 * **system_suspend_allowed** - Is domain allowed to suspend the system?
+* **wid** - World ID for the domain
+* **widdeleg** - World ID delegation bitmask for the domain
 
 The memory regions represented by **regions** in **struct sbi_domain** have
 following additional constraints to align with RISC-V PMP requirements:
@@ -98,6 +100,8 @@ following manner:
   is the next mode for the ROOT domain
 * **system_reset_allowed** - The ROOT domain is allowed to reset the system
 * **system_suspend_allowed** - The ROOT domain is allowed to suspend the system
+* **wid** - Configurable World ID for the ROOT domain
+* **widdeleg** - Configurable World ID delegation bitmask for the ROOT domain
 
 Domain Effects
 --------------
@@ -131,6 +135,22 @@ The DT properties of a domain configuration DT node are as follows:
 * **compatible** (Mandatory) - The compatible string of the domain
   configuration. This DT property should have value *"opensbi,domain,config"*
 
+### Root Domain Node
+
+The root domain WID configuration is described in a **root** subnode under
+the domain configuration DT node. This subnode does not have a compatible
+string.
+
+The DT properties of the root domain node are as follows:
+
+* **wid** (Mandatory if Smlwid is present) - The 32-bit World ID for
+  lower-privilege modes (S/U-mode) for the ROOT domain. If the hart
+  supports the Smlwid extension, this property must be provided.
+* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
+  the ROOT domain. If present, OpenSBI writes this value to **mwiddeleg**
+  when entering the ROOT domain (requires Smwiddeleg extension). If absent,
+  clears **mwiddeleg** to disable S-mode WID delegation.
+
 ### Domain Memory Region Node
 
 The domain memory region DT node describes details of a memory region and
@@ -205,6 +225,13 @@ The DT properties of a domain instance DT node are as follows:
   whether the domain instance is allowed to do system reset.
 * **system-suspend-allowed** (Optional) - A boolean flag representing
   whether the domain instance is allowed to do system suspend.
+* **wid** (Mandatory if Smlwid is present) - The 32-bit World ID for
+  lower-privilege modes (S/U-mode) for the domain instance. If the hart
+  supports the Smlwid extension, this property must be provided.
+* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
+  the domain instance. If present, OpenSBI writes this value to **mwiddeleg**
+  on context switch into this domain (requires Smwiddeleg extension). If absent,
+  clears **mwiddeleg** to disable S-mode WID delegation.
 
 ### Assigning HART To Domain Instance
 
@@ -260,6 +287,11 @@ be done:
                 order = <64>;
             };
 
+            root {
+                wid = <3>;
+                widdeleg = <0x0 0x0>;
+            };
+
             tdomain: trusted-domain {
                 compatible = "opensbi,domain,instance";
                 possible-harts = <&cpu0>;
@@ -268,6 +300,8 @@ be done:
                 next-arg1 = <0x0 0x0>;
                 next-addr = <0x0 0x80100000>;
                 next-mode = <0x0>;
+                wid = <1>;
+                widdeleg = <0x0 0x6>;
                 system-reset-allowed;
                 system-suspend-allowed;
             };
@@ -276,6 +310,8 @@ be done:
                 compatible = "opensbi,domain,instance";
                 possible-harts = <&cpu1 &cpu2 &cpu3 &cpu4>;
                 regions = <&tmem 0x0>, <&tuart 0x0>, <&allmem 0x3f>;
+                wid = <0>;
+                widdeleg = <0x0 0x1>;
             };
         };
     };
-- 
2.43.7


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 2/9] lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties

[Pawandeep Oza]

On Tue, Oct 27, 2026 at 1:35 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add fdt_parse_worlds_all_harts() to parse platform-defined DT
> properties in the /cpus/cpu@X:
> - riscv,pmwid: M-mode World ID
> - riscv,pmwidlist: bitmap of permitted M-mode WIDs
> - riscv,pmlwidlist: bitmap of permitted lower-privilege WIDs
> Store parsed values in struct sbi_hart_features.
>
> These platform-defined values serve as the root-of-trust constraints
> for per-domain WID assignment during domain creation and context
> switching.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Change v2->v3:
> - Drop has_pmwidlist presence flag and check pmwidlist directly.
> ---
>  include/sbi/sbi_hart.h             |  5 ++
>  include/sbi_utils/fdt/fdt_helper.h |  2 +
>  lib/utils/fdt/fdt_helper.c         | 90 ++++++++++++++++++++++++++++++
>  platform/generic/platform.c        | 13 ++++-
>  4 files changed, 109 insertions(+), 1 deletion(-)
>
> diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> index 2941809e..a1860a9c 100644
> --- a/include/sbi/sbi_hart.h
> +++ b/include/sbi/sbi_hart.h
> @@ -135,6 +135,11 @@ struct sbi_hart_features {
>         unsigned int pmp_log2gran;
>         unsigned int mhpm_mask;
>         unsigned int mhpm_bits;
> +       u32 pmwid;
> +       u64 pmwidlist;
> +       u64 pmlwidlist;
> +       bool has_pmwid;
> +       bool has_pmlwidlist;
>  };
>
>  extern unsigned long hart_features_offset;
> diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
> index 75a564d1..3f3d091b 100644
> --- a/include/sbi_utils/fdt/fdt_helper.h
> +++ b/include/sbi_utils/fdt/fdt_helper.h
> @@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
>
>  int fdt_parse_isa_extensions_all_harts(const void *fdt);
>
> +int fdt_parse_worlds_all_harts(const void *fdt);
> +
>  int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
>                                 struct platform_uart_data *uart);
>
> diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
> index 747ba028..4701606d 100644
> --- a/lib/utils/fdt/fdt_helper.c
> +++ b/lib/utils/fdt/fdt_helper.c
> @@ -457,6 +457,96 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
>         return 0;
>  }
>
> +int fdt_parse_worlds_all_harts(const void *fdt)
> +{
> +       u32 hartid;
> +       const fdt32_t *val;
> +       struct sbi_scratch *scratch;
> +       struct sbi_hart_features *hfeatures;
> +       int err, cpu_offset, cpus_offset, len;
> +
> +       if (!fdt)
> +               return SBI_EINVAL;
> +
> +       cpus_offset = fdt_path_offset(fdt, "/cpus");
> +       if (cpus_offset < 0)
> +               return cpus_offset;
> +
> +       fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
> +               err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
> +               if (err)
> +                       continue;
> +
> +               if (!fdt_node_is_enabled(fdt, cpu_offset))
> +                       continue;
> +
> +               scratch = sbi_hartid_to_scratch(hartid);
> +               if (!scratch)
> +                       return SBI_ENOENT;
> +
> +               hfeatures = sbi_hart_features_ptr(scratch);
> +               if (!hfeatures)
> +                       return SBI_ENOENT;
> +
> +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
> +               if (val && len == sizeof(fdt32_t)) {
> +                       hfeatures->pmwid = fdt32_to_cpu(*val);
> +                       hfeatures->has_pmwid = true;
> +               }
> +
> +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
> +               if (val && len == 2 * sizeof(fdt32_t)) {
> +                       hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> +                                               fdt32_to_cpu(val[1]);
> +                       if (!hfeatures->pmwidlist) {
> +                               sbi_printf("%s: hart%u riscv,pmwidlist is empty\n",
> +                                          __func__, hartid);
> +                               return SBI_EINVAL;
> +                       }
> +               }
> +
> +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
> +               if (val && len == 2 * sizeof(fdt32_t)) {
> +                       hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> +                                                fdt32_to_cpu(val[1]);
> +                       hfeatures->has_pmlwidlist = true;
> +               }
> +
> +               /* Sanity checks */
> +#if __riscv_xlen == 32
> +               if (hfeatures->pmwidlist &&
> +                   (hfeatures->pmwidlist >> 32)) {
> +                       sbi_printf("%s: hart%u riscv,pmwidlist has bits beyond XLEN\n",
> +                                  __func__, hartid);
> +                       return SBI_EINVAL;
> +               }
> +
> +               if (hfeatures->has_pmlwidlist &&
> +                   (hfeatures->pmlwidlist >> 32)) {
> +                       sbi_printf("%s: hart%u riscv,pmlwidlist has bits beyond XLEN\n",
> +                                  __func__, hartid);
> +                       return SBI_EINVAL;
> +               }
> +#endif
> +
> +               if (hfeatures->has_pmwid &&
> +                   hfeatures->pmwid >= __riscv_xlen) {
> +                       sbi_printf("%s: hart%u riscv,pmwid (%u) exceeds max WID\n",
> +                                  __func__, hartid, hfeatures->pmwid);
> +                       return SBI_EINVAL;
> +               }
> +
> +               if (hfeatures->pmwidlist && hfeatures->has_pmwid &&
> +                   !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
> +                       sbi_printf("%s: hart%u riscv,pmwid (%u) not in pmwidlist\n",
> +                                  __func__, hartid, hfeatures->pmwid);
> +                       return SBI_EINVAL;
> +               }
> +       }
> +
> +       return 0;
> +}
> +
>  static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
>                                       struct platform_uart_data *uart,
>                                       unsigned long default_freq,
> diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> index 1df0280d..51e9f342 100644
> --- a/platform/generic/platform.c
> +++ b/platform/generic/platform.c
> @@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
>
>  int generic_extensions_init(bool cold_boot)
>  {
> +       int rc;
> +
>         if (!cold_boot)
>                 return 0;
>
>         /* Parse the ISA string from FDT and enable the listed extensions */
> -       return fdt_parse_isa_extensions_all_harts(fdt_get_address());
> +       rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
> +       if (rc)
> +               return rc;
> +
> +       /* Parse RISC-V Worlds CPU properties from FDT */
> +       rc = fdt_parse_worlds_all_harts(fdt_get_address());
> +       if (rc)
> +               return rc;
> +
> +       return 0;
>  }
>
>  int generic_domains_init(void)
> --
> 2.43.7
>

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 3/9] lib: fdt_domain: parse domain WID properties

[Pawandeep Oza]

On Tue, Oct 27, 2026 at 1:35 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add wid and widdeleg fields to struct sbi_domain to store the
> RISC-V Worlds mlwid and mwideleg CSR values for each domain.
> Also, parse the root and user-defined domains' WID during
> fdt_domains_populate().
>
> When Smlwid is implemented, the "wid" property is mandatory
> for all domains; fail domain population if it is missing.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Change v2->v3:
> - Add validate_domain_wid() to check if 'wid' is specified when Smlwid
>   extension is present; return SBI_EINVAL if missing.
> - Parse 'wid' and 'widdeleg' for the root domain via fdt_parse_root_domain().
> - Set root.widdeleg default to 0.
> ---
>  include/sbi/sbi_domain.h   |  6 +++
>  lib/sbi/sbi_domain.c       |  2 +
>  lib/utils/fdt/fdt_domain.c | 84 ++++++++++++++++++++++++++++++++++++++
>  3 files changed, 92 insertions(+)
>
> diff --git a/include/sbi/sbi_domain.h b/include/sbi/sbi_domain.h
> index 56a21397..5a291d1f 100644
> --- a/include/sbi/sbi_domain.h
> +++ b/include/sbi/sbi_domain.h
> @@ -19,6 +19,8 @@
>
>  struct sbi_scratch;
>
> +#define INVALID_WID    ((unsigned int)~0U)
> +
>  /** Domain access types */
>  enum sbi_domain_access {
>         SBI_DOMAIN_READ = (1UL << 0),
> @@ -218,6 +220,10 @@ struct sbi_domain {
>         bool system_reset_allowed;
>         /** Is domain allowed to suspend the system */
>         bool system_suspend_allowed;
> +       /** World ID for this domain (mlwid value) */
> +       u32 wid;
> +       /** World ID delegation bitmask for this domain (mwiddeleg value) */
> +       u64 widdeleg;
>         /** Identifies whether to include the firmware region */
>         bool fw_region_inited;
>  };
> diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
> index 42fe5632..be9020d0 100644
> --- a/lib/sbi/sbi_domain.c
> +++ b/lib/sbi/sbi_domain.c
> @@ -30,6 +30,8 @@ struct sbi_domain root = {
>         .possible_harts = NULL,
>         .system_reset_allowed = true,
>         .system_suspend_allowed = true,
> +       .wid = INVALID_WID,
> +       .widdeleg = 0,
>         .fw_region_inited = false,
>  };
>
> diff --git a/lib/utils/fdt/fdt_domain.c b/lib/utils/fdt/fdt_domain.c
> index e4cce8c3..8ce03236 100644
> --- a/lib/utils/fdt/fdt_domain.c
> +++ b/lib/utils/fdt/fdt_domain.c
> @@ -13,6 +13,7 @@
>  #include <sbi/sbi_console.h>
>  #include <sbi/sbi_domain.h>
>  #include <sbi/sbi_error.h>
> +#include <sbi/sbi_hart.h>
>  #include <sbi/sbi_hartmask.h>
>  #include <sbi/sbi_heap.h>
>  #include <sbi/sbi_scratch.h>
> @@ -290,6 +291,42 @@ static int __fdt_parse_region(const void *fdt, int domain_offset,
>         return 0;
>  }
>
> +static void fdt_parse_domain_wid_props(const void *fdt, int offset,
> +                                      struct sbi_domain *dom)
> +{
> +       const fdt32_t *val;
> +       int len;
> +       u64 val64;
> +
> +       val = fdt_getprop(fdt, offset, "wid", &len);
> +       if (val && len == sizeof(fdt32_t)) {
> +               dom->wid = fdt32_to_cpu(val[0]);
> +       }
> +
> +       val = fdt_getprop(fdt, offset, "widdeleg", &len);
> +       if (val && (len == (2 * sizeof(fdt32_t)))) {
> +               val64 = fdt32_to_cpu(val[0]);
> +               val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
> +               dom->widdeleg = val64;
> +       }
> +}
> +
> +static int validate_domain_wid(const struct sbi_domain *dom)
> +{
> +       if (dom->wid != INVALID_WID)
> +               return 0;
> +
> +       if (sbi_hart_has_extension(sbi_scratch_thishart_ptr(),
> +                                  SBI_HART_EXT_SMLWID)) {
> +               sbi_printf("%s: domain \"%s\": missing \"wid\""
> +                          " property (required by Smlwid)\n",
> +                          __func__, dom->name);
> +               return SBI_EINVAL;
> +       }
> +
> +       return 0;
> +}
> +
>  static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
>  {
>         u32 val32;
> @@ -306,6 +343,7 @@ static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
>         dom = sbi_zalloc(sizeof(*dom));
>         if (!dom)
>                 return SBI_ENOMEM;
> +       dom->wid = INVALID_WID;
>
>         preg.dom = dom;
>         preg.region_count = 0;
> @@ -449,6 +487,12 @@ static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
>         }
>         dom->next_mode = val32;
>
> +       /* Read "wid" and "widdeleg" DT properties */
> +       fdt_parse_domain_wid_props(fdt, domain_offset, dom);
> +       err = validate_domain_wid(dom);
> +       if (err)
> +               goto fail_free_all;
> +
>         /* Read "system-reset-allowed" DT property */
>         if (fdt_get_property(fdt, domain_offset,
>                              "system-reset-allowed", NULL))
> @@ -477,12 +521,52 @@ fail_free_domain:
>         return err;
>  }
>
> +static int fdt_root_domain_offset(const void *fdt)
> +{
> +       int offset;
> +
> +       offset = fdt_path_offset(fdt, "/chosen");
> +       if (offset < 0)
> +               return offset;
> +
> +       offset = fdt_node_offset_by_compatible(fdt, offset,
> +                                              "opensbi,domain,config");
> +       if (offset < 0)
> +               return offset;
> +
> +       return fdt_subnode_offset(fdt, offset, "root");
> +}
> +
> +static int fdt_parse_root_domain(const void *fdt)
> +{
> +       int offset;
> +
> +       if (fdt) {
> +               offset = fdt_root_domain_offset(fdt);
> +               if (offset >= 0)
> +                       fdt_parse_domain_wid_props(fdt, offset, &root);
> +       }
> +
> +       /*
> +        * Ensure root domain has a valid WID
> +        * even if FDT or root subnode is absent
> +        */
> +       return validate_domain_wid(&root);
> +}
> +
>  int fdt_domains_populate(const void *fdt)
>  {
> +       int err;
> +
>         /* Sanity checks */
>         if (!fdt)
>                 return SBI_EINVAL;
>
> +       /* Parse root domain config from "root" subnode */
> +       err = fdt_parse_root_domain(fdt);
> +       if (err)
> +               return err;
> +
>         /* Iterate over each domain in FDT and populate details */
>         return fdt_iterate_each_domain_ro(fdt, NULL, __fdt_parse_domain);
>  }
> --
> 2.43.7
>

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 5/9] lib: sbi_domain_context: propagate error from sbi_hart_protection_reconfigure

[Pawandeep Oza]

On Tue, Oct 27, 2026 at 1:36 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Propagate the return value of sbi_hart_protection_reconfigure in
> switch_to_next_domain_context to ensure that domain transition
> failures are correctly handled by the caller.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Change v2->v3:
> - New patch: propagate return value of sbi_hart_protection_reconfigure()
>   in switch_to_next_domain_context().
> ---
>  lib/sbi/sbi_domain_context.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/lib/sbi/sbi_domain_context.c b/lib/sbi/sbi_domain_context.c
> index 987ac7fa..1751d016 100644
> --- a/lib/sbi/sbi_domain_context.c
> +++ b/lib/sbi/sbi_domain_context.c
> @@ -110,6 +110,7 @@ static int switch_to_next_domain_context(struct hart_context *ctx,
>         MUST_NOT_HOLD(&ctx->dom->assigned_harts_lock)
>         MUST_NOT_HOLD(&dom_ctx->dom->assigned_harts_lock)
>  {
> +       int rc;
>         u32 hartindex = current_hartindex();
>         struct sbi_trap_context *trap_ctx;
>         struct sbi_domain *current_dom, *target_dom;
> @@ -173,7 +174,9 @@ static int switch_to_next_domain_context(struct hart_context *ctx,
>          * is also required for some of the above CSR updates (such
>          * as satp CSR).
>          */
> -       sbi_hart_protection_reconfigure(scratch, current_dom, target_dom);
> +       rc = sbi_hart_protection_reconfigure(scratch, current_dom, target_dom);
> +       if (rc)
> +               return rc;
>
>         /* Mark current context structure initialized because context saved */
>         ctx->initialized = true;
> --
> 2.43.7
>

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 6/9] lib: sbi_hart_worlds: Implement WID hart protection backend

[Pawandeep Oza]

On Tue, Oct 27, 2026 at 1:36 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Introduce a WID-based hart protection backend that switches World ID
> configurations across domains.
>
> Access to slwid is gated by mwiddeleg (Sswid), which means slwid cannot
> be handled by generic hart_context save/restore. Instead, manage slwid as
> domain state with explicit sequencing:
>
> - configure:
>   - Validate and program mlwid and mwiddeleg according to domain policy
>     and platform constraints (pmlwidlist/mlwidlist).
>   - Restore slwid after mwiddeleg is enabled.
> - unconfigure:
>   - Save slwid prior to clearing mwiddeleg.
>   - Reset mwiddeleg to 0 to disable Sswid.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Change v2->v3:
> - Add hart_worlds_validate_wid() to check domain wid against pmlwidlist
>   and mlwidlist masks.
> - Add hart_worlds_validate_widdeleg() to check domain widdeleg against
>   pmlwidlist and mlwidlist masks.
> - Drop M-mode WID fallback (mwid/pmwid) for mlwid; program dom->wid directly.
> - Adapt to upstream domain state API rename (sbi_domain_data ->
>   sbi_domain_state).
> ---
>  include/sbi/sbi_hart_worlds.h |  24 ++++
>  lib/sbi/objects.mk            |   1 +
>  lib/sbi/sbi_hart.c            |   5 +
>  lib/sbi/sbi_hart_worlds.c     | 210 ++++++++++++++++++++++++++++++++++
>  4 files changed, 240 insertions(+)
>  create mode 100644 include/sbi/sbi_hart_worlds.h
>  create mode 100644 lib/sbi/sbi_hart_worlds.c
>
> diff --git a/include/sbi/sbi_hart_worlds.h b/include/sbi/sbi_hart_worlds.h
> new file mode 100644
> index 00000000..91b11023
> --- /dev/null
> +++ b/include/sbi/sbi_hart_worlds.h
> @@ -0,0 +1,24 @@
> +/*
> + * SPDX-License-Identifier: BSD-2-Clause
> + *
> + * Copyright (c) 2026 SiFive Inc.
> + */
> +
> +#ifndef __SBI_HART_WORLDS_H__
> +#define __SBI_HART_WORLDS_H__
> +
> +struct sbi_scratch;
> +
> +/**
> + * Initialize WID hart protection for current HART
> + *
> + * Registers the WID protection mechanism if Smlwid
> + * extension is present.
> + *
> + * @param scratch pointer to scratch space of current HART
> + *
> + * @return 0 on success and negative error code on failure
> + */
> +int sbi_hart_worlds_init(struct sbi_scratch *scratch);
> +
> +#endif /* __SBI_HART_WORLDS_H__ */
> diff --git a/lib/sbi/objects.mk b/lib/sbi/objects.mk
> index ae27d0c5..355ae6e9 100644
> --- a/lib/sbi/objects.mk
> +++ b/lib/sbi/objects.mk
> @@ -77,6 +77,7 @@ libsbi-objs-y += sbi_fwft.o
>  libsbi-objs-y += sbi_hart.o
>  libsbi-objs-y += sbi_hart_pmp.o
>  libsbi-objs-y += sbi_hart_protection.o
> +libsbi-objs-y += sbi_hart_worlds.o
>  libsbi-objs-y += sbi_heap.o
>  libsbi-objs-y += sbi_math.o
>  libsbi-objs-y += sbi_hfence.o
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index f05d9b5d..6aa6edd5 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -17,6 +17,7 @@
>  #include <sbi/sbi_error.h>
>  #include <sbi/sbi_hart.h>
>  #include <sbi/sbi_hart_pmp.h>
> +#include <sbi/sbi_hart_worlds.h>
>  #include <sbi/sbi_platform.h>
>  #include <sbi/sbi_pmu.h>
>  #include <sbi/sbi_string.h>
> @@ -762,6 +763,10 @@ int sbi_hart_init(struct sbi_scratch *scratch, bool cold_boot)
>                 rc = sbi_hart_pmp_init(scratch);
>                 if (rc)
>                         return rc;
> +
> +               rc = sbi_hart_worlds_init(scratch);
> +               if (rc)
> +                       return rc;
>         }
>
>         return sbi_hart_reinit(scratch);
> diff --git a/lib/sbi/sbi_hart_worlds.c b/lib/sbi/sbi_hart_worlds.c
> new file mode 100644
> index 00000000..6f582bd2
> --- /dev/null
> +++ b/lib/sbi/sbi_hart_worlds.c
> @@ -0,0 +1,210 @@
> +/*
> + * SPDX-License-Identifier: BSD-2-Clause
> + *
> + * Copyright (c) 2026 SiFive Inc.
> + */
> +
> +#include <sbi/riscv_encoding.h>
> +#include <sbi/sbi_bitops.h>
> +#include <sbi/sbi_console.h>
> +#include <sbi/sbi_domain.h>
> +#include <sbi/sbi_error.h>
> +#include <sbi/sbi_hart.h>
> +#include <sbi/sbi_hart_protection.h>
> +#include <sbi/sbi_hart_worlds.h>
> +#include <sbi/sbi_scratch.h>
> +
> +/**
> + * Initialize the per-hart slwid values of a domain using
> + * the lowest delegated WID as the initial value.
> + *
> + * S-mode OS should choose the desire slwid for it's
> + * U-mode.
> + */
> +static int sbi_hart_worlds_state_setup(struct sbi_domain *dom,
> +                                      struct sbi_domain_state *state,
> +                                      void *state_ptr)
> +{
> +       unsigned long widdeleg = dom->widdeleg;
> +       unsigned long *slwid = state_ptr;
> +       unsigned long init_wid;
> +
> +       if (!widdeleg)
> +               return SBI_OK;
> +
> +       init_wid = sbi_ffs(widdeleg);
> +       sbi_for_each_hartindex(i)
> +               slwid[i] = init_wid;
> +
> +       return SBI_OK;
> +}
> +
> +static struct sbi_domain_state wid_state = {
> +       .state_setup = sbi_hart_worlds_state_setup,
> +};
> +
> +static unsigned long *sbi_hart_worlds_slwid_ptr(struct sbi_domain *dom)
> +{
> +       unsigned long *slwid;
> +
> +       slwid = sbi_domain_state_ptr(dom, &wid_state);
> +       if (!slwid || !sbi_hartindex_valid(current_hartindex()))
> +               return NULL;
> +
> +       return &slwid[current_hartindex()];
> +}
> +
> +static int hart_worlds_validate_wid(struct sbi_scratch *scratch,
> +                                   struct sbi_domain *dom,
> +                                   unsigned long mlwidlist)
> +{
> +       struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
> +
> +       if (hf->has_pmlwidlist && !(hf->pmlwidlist & BIT_ULL(dom->wid))) {
> +               sbi_printf("%s: domain%d WID %u not permitted by"
> +                          " pmlwidlist\n",
> +                          __func__, dom->index, dom->wid);
> +               return SBI_EINVAL;
> +       }
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST) &&
> +           !(mlwidlist & BIT_ULL(dom->wid))) {
> +               sbi_printf("%s: domain%d WID %u not permitted by"
> +                          " mlwidlist 0x%lx\n",
> +                          __func__, dom->index, dom->wid, mlwidlist);
> +               return SBI_EINVAL;
> +       }
> +
> +       return SBI_OK;
> +}
> +
> +/*
> + * Validate that a domain's widdeleg value, parsed from the
> + * "widdeleg" DT property, is permitted on this hart.
> + *
> + * mwiddeleg is a M-mode WARL register, so an S-mode OS must rely
> + * on the "widdeleg" DT property to determine which WIDs it may
> + * delegate to U-mode via slwid. If pmwidlist or mlwidlist silently
> + * filters out any of those WIDs, the S-mode OS's view of the WIDs
> + * available for delegation would be incorrect. Treat this mismatch
> + * as a misconfiguration.
> + */
> +static int hart_worlds_validate_widdeleg(struct sbi_scratch *scratch,
> +                                        struct sbi_domain *dom,
> +                                        unsigned long mlwidlist)
> +{
> +       struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
> +       unsigned long widdeleg = dom->widdeleg;
> +
> +       if (!widdeleg)
> +               return SBI_OK;
> +
> +       if (hf->has_pmlwidlist && (widdeleg & ~hf->pmlwidlist)) {
> +               sbi_printf("%s: domain%d widdeleg 0x%lx has WID(s)"
> +                          " outside pmlwidlist 0x%lx\n",
> +                          __func__, dom->index, widdeleg,
> +                          (unsigned long)hf->pmlwidlist);
> +               return SBI_EINVAL;
> +       }
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST) &&
> +           (widdeleg & ~mlwidlist)) {
> +               sbi_printf("%s: domain%d widdeleg 0x%lx has WID(s)"
> +                          " outside mlwidlist 0x%lx\n",
> +                          __func__, dom->index, widdeleg, mlwidlist);
> +               return SBI_EINVAL;
> +       }
> +
> +       return SBI_OK;
> +}
> +
> +static int sbi_hart_worlds_configure(struct sbi_scratch *scratch,
> +                                    struct sbi_domain *dom)
> +{
> +       unsigned long *slwid = NULL;
> +       unsigned long mlwidlist = 0;
> +       int rc;
> +
> +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
> +               return SBI_OK;
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST))
> +               mlwidlist = csr_read(CSR_MLWIDLIST);
> +
> +       rc = hart_worlds_validate_wid(scratch, dom, mlwidlist);
> +       if (rc)
> +               return rc;
> +
> +       csr_write(CSR_MLWID, dom->wid);
> +
> +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG))
> +               return SBI_OK;
> +
> +       rc = hart_worlds_validate_widdeleg(scratch, dom, mlwidlist);
> +       if (rc)
> +               return rc;
> +
> +       /*
> +        * Enable Sswid before restoring slwid. A zero mwiddeleg
> +        * disables access to slwid, so the order here is required.
> +        */
> +       csr_write(CSR_MWIDDELEG, dom->widdeleg);
> +
> +       if (dom->widdeleg) {
> +               slwid = sbi_hart_worlds_slwid_ptr(dom);
> +               if (!slwid)
> +                       return SBI_EINVAL;
> +               csr_write(CSR_SLWID, *slwid);
> +       }
> +
> +       return SBI_OK;
> +}
> +
> +static void sbi_hart_worlds_unconfigure(struct sbi_scratch *scratch,
> +                                       struct sbi_domain *dom)
> +{
> +       unsigned long *slwid;
> +
> +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG) ||
> +           !dom->widdeleg)
> +               return;
> +
> +       /*
> +        * Save slwid value before disabling Sswid since the
> +        * CSR value may not retain through the disabled period.
> +        */
> +       slwid = sbi_hart_worlds_slwid_ptr(dom);
> +       if (!slwid) {
> +               sbi_panic("%s: domain%d has no slwid state\n",
> +                         __func__, dom->index);
> +       }
> +       *slwid = csr_read(CSR_SLWID);
> +
> +       /* Disable Sswid */
> +       csr_write(CSR_MWIDDELEG, 0);
> +}
> +
> +static struct sbi_hart_protection wid_protection = {
> +       .name           = "wid",
> +       .rating         = 100,
> +       .type           = SBI_HART_PROTECTION_TYPE_ID,
> +       .configure      = sbi_hart_worlds_configure,
> +       .unconfigure    = sbi_hart_worlds_unconfigure
> +};
> +
> +int sbi_hart_worlds_init(struct sbi_scratch *scratch)
> +{
> +       int rc;
> +
> +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
> +               return 0;
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
> +               wid_state.state_size = sizeof(unsigned long) * sbi_hart_count();
> +               rc = sbi_domain_register_state(&wid_state);
> +               if (rc)
> +                       return rc;
> +       }
> +
> +       return sbi_hart_protection_register(&wid_protection);
> +}
> --
> 2.43.7
>

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 8/9] lib: sbi: display World ID configuration at boot

[Pawandeep Oza]

On Tue, Oct 27, 2026 at 1:36 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Print per-domain Wid/Widdeleg and boot HART's M-mode
> World ID (mwid/pmwid fallback).
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Change v2->v3:
> - Display dom->wid directly when Smlwid is present.
> ---
>  lib/sbi/sbi_domain.c | 18 ++++++++++++++++++
>  lib/sbi/sbi_init.c   | 13 +++++++++++++
>  2 files changed, 31 insertions(+)
>
> diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
> index be9020d0..f92ebc2f 100644
> --- a/lib/sbi/sbi_domain.c
> +++ b/lib/sbi/sbi_domain.c
> @@ -10,6 +10,7 @@
>  #include <sbi/riscv_asm.h>
>  #include <sbi/sbi_console.h>
>  #include <sbi/sbi_domain.h>
> +#include <sbi/sbi_hart.h>
>  #include <sbi/sbi_hartmask.h>
>  #include <sbi/sbi_heap.h>
>  #include <sbi/sbi_hsm.h>
> @@ -613,6 +614,7 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
>         u32 i, j, k;
>         unsigned long rstart, rend;
>         const struct sbi_domain_memregion *reg;
> +       struct sbi_scratch *scratch = sbi_scratch_thishart_ptr();
>
>         sbi_printf("Domain%d Name        %s: %s\n",
>                    dom->index, suffix, dom->name);
> @@ -691,6 +693,22 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
>                 break;
>         }
>
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) {
> +               sbi_printf("Domain%d Wid         %s: %u\n",
> +                          dom->index, suffix, dom->wid);
> +       } else {
> +               sbi_printf("Domain%d Wid         %s: unsupported\n",
> +                          dom->index, suffix);
> +       }
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
> +               sbi_printf("Domain%d Widdeleg    %s: 0x%" PRIx64 "\n",
> +                          dom->index, suffix, dom->widdeleg);
> +       } else {
> +               sbi_printf("Domain%d Widdeleg    %s: unsupported\n",
> +                          dom->index, suffix);
> +       }
> +
>         sbi_printf("Domain%d SysReset    %s: %s\n",
>                    dom->index, suffix, (dom->system_reset_allowed) ? "yes" : "no");
>
> diff --git a/lib/sbi/sbi_init.c b/lib/sbi/sbi_init.c
> index acd2f8b6..f771f548 100644
> --- a/lib/sbi/sbi_init.c
> +++ b/lib/sbi/sbi_init.c
> @@ -167,6 +167,7 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
>         int xlen;
>         char str[256];
>         const struct sbi_domain *dom = sbi_domain_thishart_ptr();
> +       struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
>
>         if (scratch->options & SBI_SCRATCH_NO_BOOT_PRINTS)
>                 return;
> @@ -199,6 +200,18 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
>         sbi_printf("Boot HART Debug Triggers    : %d triggers\n",
>                    sbi_dbtr_get_total_triggers());
>         sbi_hart_delegation_dump(scratch, "Boot HART ", "           ");
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID)) {
> +               ulong mwid = csr_read(CSR_MWID);
> +
> +               sbi_printf("Boot HART M-mode World ID   : %lu (%s)\n",
> +                          mwid & ~MWID_LOCK,
> +                          (mwid & MWID_LOCK) ? "locked" : "unlocked");
> +       } else if (hf->has_pmwid) {
> +               sbi_printf("Boot HART M-mode World ID   : %u (pmwid)\n",
> +                          hf->pmwid);
> +       } else {
> +               sbi_printf("Boot HART M-mode World ID   : unsupported\n");
> +       }
>  }
>
>  static unsigned long coldboot_done;
> --
> 2.43.7
>

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 9/9] docs: document WID DT properties

[Pawandeep Oza]

On Tue, Oct 27, 2026 at 1:36 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add "wid" and "widdeleg" properties to domain instance node
> documentation and example DT. Add a "Root Domain Node" section
> describing the "root" subnode under the domain configuration
> node for root domain WID configuration
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Change v2->v3:
> - Mark 'wid' property as mandatory when Smlwid is present for both root
>   and domain instance nodes.
> - Remove mention of M-mode WID fallback when 'wid' is absent.
> ---
>  docs/domain_support.md | 36 ++++++++++++++++++++++++++++++++++++
>  1 file changed, 36 insertions(+)
>
> diff --git a/docs/domain_support.md b/docs/domain_support.md
> index 51737218..54327e8d 100644
> --- a/docs/domain_support.md
> +++ b/docs/domain_support.md
> @@ -56,6 +56,8 @@ has following details:
>    domain. This can be either S-mode or U-mode.
>  * **system_reset_allowed** - Is domain allowed to reset the system?
>  * **system_suspend_allowed** - Is domain allowed to suspend the system?
> +* **wid** - World ID for the domain
> +* **widdeleg** - World ID delegation bitmask for the domain
>
>  The memory regions represented by **regions** in **struct sbi_domain** have
>  following additional constraints to align with RISC-V PMP requirements:
> @@ -98,6 +100,8 @@ following manner:
>    is the next mode for the ROOT domain
>  * **system_reset_allowed** - The ROOT domain is allowed to reset the system
>  * **system_suspend_allowed** - The ROOT domain is allowed to suspend the system
> +* **wid** - Configurable World ID for the ROOT domain
> +* **widdeleg** - Configurable World ID delegation bitmask for the ROOT domain
>
>  Domain Effects
>  --------------
> @@ -131,6 +135,22 @@ The DT properties of a domain configuration DT node are as follows:
>  * **compatible** (Mandatory) - The compatible string of the domain
>    configuration. This DT property should have value *"opensbi,domain,config"*
>
> +### Root Domain Node
> +
> +The root domain WID configuration is described in a **root** subnode under
> +the domain configuration DT node. This subnode does not have a compatible
> +string.
> +
> +The DT properties of the root domain node are as follows:
> +
> +* **wid** (Mandatory if Smlwid is present) - The 32-bit World ID for
> +  lower-privilege modes (S/U-mode) for the ROOT domain. If the hart
> +  supports the Smlwid extension, this property must be provided.
> +* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
> +  the ROOT domain. If present, OpenSBI writes this value to **mwiddeleg**
> +  when entering the ROOT domain (requires Smwiddeleg extension). If absent,
> +  clears **mwiddeleg** to disable S-mode WID delegation.
> +
>  ### Domain Memory Region Node
>
>  The domain memory region DT node describes details of a memory region and
> @@ -205,6 +225,13 @@ The DT properties of a domain instance DT node are as follows:
>    whether the domain instance is allowed to do system reset.
>  * **system-suspend-allowed** (Optional) - A boolean flag representing
>    whether the domain instance is allowed to do system suspend.
> +* **wid** (Mandatory if Smlwid is present) - The 32-bit World ID for
> +  lower-privilege modes (S/U-mode) for the domain instance. If the hart
> +  supports the Smlwid extension, this property must be provided.
> +* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
> +  the domain instance. If present, OpenSBI writes this value to **mwiddeleg**
> +  on context switch into this domain (requires Smwiddeleg extension). If absent,
> +  clears **mwiddeleg** to disable S-mode WID delegation.
>
>  ### Assigning HART To Domain Instance
>
> @@ -260,6 +287,11 @@ be done:
>                  order = <64>;
>              };
>
> +            root {
> +                wid = <3>;
> +                widdeleg = <0x0 0x0>;
> +            };
> +
>              tdomain: trusted-domain {
>                  compatible = "opensbi,domain,instance";
>                  possible-harts = <&cpu0>;
> @@ -268,6 +300,8 @@ be done:
>                  next-arg1 = <0x0 0x0>;
>                  next-addr = <0x0 0x80100000>;
>                  next-mode = <0x0>;
> +                wid = <1>;
> +                widdeleg = <0x0 0x6>;
>                  system-reset-allowed;
>                  system-suspend-allowed;
>              };
> @@ -276,6 +310,8 @@ be done:
>                  compatible = "opensbi,domain,instance";
>                  possible-harts = <&cpu1 &cpu2 &cpu3 &cpu4>;
>                  regions = <&tmem 0x0>, <&tuart 0x0>, <&allmem 0x3f>;
> +                wid = <0>;
> +                widdeleg = <0x0 0x1>;
>              };
>          };
>      };
> --
> 2.43.7
>

Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 1/9] lib: sbi_hart: detect RISC-V Worlds ISA extensions

[Anup Patel]

On Tue, Oct 27, 2026 at 2:05 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add CSR definitions for RISC-V Worlds (mwid, mlwid, mlwidlist,
> mwiddeleg, slwid) and detect Worlds extensions via CSR probes
> in hart_detect_features().
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>
> ---
> Change v2->v3:
> - No change
> ---
>  include/sbi/riscv_encoding.h | 12 ++++++++++++
>  include/sbi/sbi_hart.h       | 10 ++++++++++
>  lib/sbi/sbi_hart.c           | 26 ++++++++++++++++++++++++++
>  3 files changed, 48 insertions(+)
>
> diff --git a/include/sbi/riscv_encoding.h b/include/sbi/riscv_encoding.h
> index ffe7666c..e0262bfc 100644
> --- a/include/sbi/riscv_encoding.h
> +++ b/include/sbi/riscv_encoding.h
> @@ -400,6 +400,9 @@
>  /* Supervisor Resource Management Configuration CSRs */
>  #define CSR_SRMCFG                     0x181
>
> +/* Supervisor lower-privilege mode World ID CSR (Sswid) */
> +#define CSR_SLWID                      0x190
> +
>  /* Machine-Level Control transfer records CSRs */
>  #define CSR_MCTRCTL                     0x34e
>
> @@ -520,6 +523,15 @@
>  #define CSR_MTINST                     0x34a
>  #define CSR_MTVAL2                     0x34b
>
> +/* Machine World ID CSRs (Smwid, Smlwid, Smlwidlist, Smwiddeleg) */
> +#define CSR_MLWID                      0x390
> +#define CSR_MWID                       0x749
> +#define CSR_MWIDDELEG                  0x748
> +#define CSR_MLWIDLIST                  0x74A
> +
> +/* mwid lock bit */
> +#define MWID_LOCK                      (_UL(1) << (__riscv_xlen - 1))
> +
>  /* Machine Memory Protection */
>  #define CSR_PMPCFG0                    0x3a0
>  #define CSR_PMPCFG1                    0x3a1
> diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> index 543393bb..2941809e 100644
> --- a/include/sbi/sbi_hart.h
> +++ b/include/sbi/sbi_hart.h
> @@ -95,6 +95,16 @@ enum sbi_hart_extensions {
>         SBI_HART_EXT_F,
>         /** Hart has D extension */
>         SBI_HART_EXT_D,
> +       /** Hart has Smwid extension */
> +       SBI_HART_EXT_SMWID,
> +       /** Hart has Smlwid extension */
> +       SBI_HART_EXT_SMLWID,
> +       /** Hart has Smlwidlist extension */
> +       SBI_HART_EXT_SMLWIDLIST,
> +       /** Hart has Smwiddeleg extension */
> +       SBI_HART_EXT_SMWIDDELEG,
> +       /** Hart has Sswid extension */
> +       SBI_HART_EXT_SSWID,
>
>         /** Maximum index of Hart extension */
>         SBI_HART_EXT_MAX,
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index 8e4c36d0..38a761ac 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -360,6 +360,11 @@ const struct sbi_hart_ext_data sbi_hart_ext[] = {
>         __SBI_HART_EXT_DATA(v, SBI_HART_EXT_V),
>         __SBI_HART_EXT_DATA(f, SBI_HART_EXT_F),
>         __SBI_HART_EXT_DATA(d, SBI_HART_EXT_D),
> +       __SBI_HART_EXT_DATA(smwid, SBI_HART_EXT_SMWID),
> +       __SBI_HART_EXT_DATA(smlwid, SBI_HART_EXT_SMLWID),
> +       __SBI_HART_EXT_DATA(smlwidlist, SBI_HART_EXT_SMLWIDLIST),
> +       __SBI_HART_EXT_DATA(smwiddeleg, SBI_HART_EXT_SMWIDDELEG),
> +       __SBI_HART_EXT_DATA(sswid, SBI_HART_EXT_SSWID),
>  };
>
>  _Static_assert(SBI_HART_EXT_MAX == array_size(sbi_hart_ext),
> @@ -647,9 +652,30 @@ __pmp_skip:
>         /* Detect if hart support sdtrig (debug triggers) */
>         __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
>                         CSR_TSELECT, SBI_HART_EXT_SDTRIG);
> +       /* Detect if hart supports Smwid */
> +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> +                       CSR_MWID, SBI_HART_EXT_SMWID);
> +       /* Detect if hart supports Smlwid */
> +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> +                       CSR_MLWID, SBI_HART_EXT_SMLWID);
> +       /* Detect if hart supports Smlwidlist */
> +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> +                       CSR_MLWIDLIST, SBI_HART_EXT_SMLWIDLIST);
> +       /* Detect if hart supports Smwiddeleg */
> +       __check_ext_csr(SBI_HART_PRIV_VER_UNKNOWN,
> +                       CSR_MWIDDELEG, SBI_HART_EXT_SMWIDDELEG);

Please drop these trap based extension detection, we are
minimizing our dependence on them.

>
>  #undef __check_ext_csr
>
> +       /*
> +        * slwid traps on access when mwiddeleg=0 (reset state), so
> +        * Sswid presence is inferred from Smwiddeleg.
> +        */
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
> +               __sbi_hart_update_extension(hfeatures,
> +                                           SBI_HART_EXT_SSWID, true);
> +       }
> +
>  #define __check_csr_existence(__csr, __csr_id)                         \
>         csr_read_allowed(__csr, &trap);                                 \
>         if (!trap.cause)                                                \
> --
> 2.43.7
>

Regards,
Anup

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 2/9] lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties

[Anup Patel]

On Tue, Oct 27, 2026 at 11:52 PM Pawandeep Oza
<pawandeep.oza@oss.qualcomm.com> wrote:
>
> On Tue, Oct 27, 2026 at 1:35 AM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > Add fdt_parse_worlds_all_harts() to parse platform-defined DT
> > properties in the /cpus/cpu@X:
> > - riscv,pmwid: M-mode World ID
> > - riscv,pmwidlist: bitmap of permitted M-mode WIDs
> > - riscv,pmlwidlist: bitmap of permitted lower-privilege WIDs
> > Store parsed values in struct sbi_hart_features.
> >
> > These platform-defined values serve as the root-of-trust constraints
> > for per-domain WID assignment during domain creation and context
> > switching.
> >
> > Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> > ---
> > Change v2->v3:
> > - Drop has_pmwidlist presence flag and check pmwidlist directly.
> > ---
> >  include/sbi/sbi_hart.h             |  5 ++
> >  include/sbi_utils/fdt/fdt_helper.h |  2 +
> >  lib/utils/fdt/fdt_helper.c         | 90 ++++++++++++++++++++++++++++++
> >  platform/generic/platform.c        | 13 ++++-
> >  4 files changed, 109 insertions(+), 1 deletion(-)
> >
> > diff --git a/include/sbi/sbi_hart.h b/include/sbi/sbi_hart.h
> > index 2941809e..a1860a9c 100644
> > --- a/include/sbi/sbi_hart.h
> > +++ b/include/sbi/sbi_hart.h
> > @@ -135,6 +135,11 @@ struct sbi_hart_features {
> >         unsigned int pmp_log2gran;
> >         unsigned int mhpm_mask;
> >         unsigned int mhpm_bits;
> > +       u32 pmwid;
> > +       u64 pmwidlist;
> > +       u64 pmlwidlist;
> > +       bool has_pmwid;
> > +       bool has_pmlwidlist;
> >  };
> >
> >  extern unsigned long hart_features_offset;
> > diff --git a/include/sbi_utils/fdt/fdt_helper.h b/include/sbi_utils/fdt/fdt_helper.h
> > index 75a564d1..3f3d091b 100644
> > --- a/include/sbi_utils/fdt/fdt_helper.h
> > +++ b/include/sbi_utils/fdt/fdt_helper.h
> > @@ -56,6 +56,8 @@ int fdt_parse_timebase_frequency(const void *fdt, unsigned long *freq);
> >
> >  int fdt_parse_isa_extensions_all_harts(const void *fdt);
> >
> > +int fdt_parse_worlds_all_harts(const void *fdt);
> > +
> >  int fdt_parse_gaisler_uart_node(const void *fdt, int nodeoffset,
> >                                 struct platform_uart_data *uart);
> >
> > diff --git a/lib/utils/fdt/fdt_helper.c b/lib/utils/fdt/fdt_helper.c
> > index 747ba028..4701606d 100644
> > --- a/lib/utils/fdt/fdt_helper.c
> > +++ b/lib/utils/fdt/fdt_helper.c
> > @@ -457,6 +457,96 @@ int fdt_parse_isa_extensions_all_harts(const void *fdt)
> >         return 0;
> >  }
> >
> > +int fdt_parse_worlds_all_harts(const void *fdt)
> > +{
> > +       u32 hartid;
> > +       const fdt32_t *val;
> > +       struct sbi_scratch *scratch;
> > +       struct sbi_hart_features *hfeatures;
> > +       int err, cpu_offset, cpus_offset, len;
> > +
> > +       if (!fdt)
> > +               return SBI_EINVAL;
> > +
> > +       cpus_offset = fdt_path_offset(fdt, "/cpus");
> > +       if (cpus_offset < 0)
> > +               return cpus_offset;
> > +
> > +       fdt_for_each_subnode(cpu_offset, fdt, cpus_offset) {
> > +               err = fdt_parse_hart_id(fdt, cpu_offset, &hartid);
> > +               if (err)
> > +                       continue;
> > +
> > +               if (!fdt_node_is_enabled(fdt, cpu_offset))
> > +                       continue;
> > +
> > +               scratch = sbi_hartid_to_scratch(hartid);
> > +               if (!scratch)
> > +                       return SBI_ENOENT;
> > +
> > +               hfeatures = sbi_hart_features_ptr(scratch);
> > +               if (!hfeatures)
> > +                       return SBI_ENOENT;
> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwid", &len);
> > +               if (val && len == sizeof(fdt32_t)) {
> > +                       hfeatures->pmwid = fdt32_to_cpu(*val);
> > +                       hfeatures->has_pmwid = true;
> > +               }
> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmwidlist", &len);
> > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > +                       hfeatures->pmwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > +                                               fdt32_to_cpu(val[1]);
> > +                       if (!hfeatures->pmwidlist) {
> > +                               sbi_printf("%s: hart%u riscv,pmwidlist is empty\n",
> > +                                          __func__, hartid);
> > +                               return SBI_EINVAL;
> > +                       }
> > +               }
> > +
> > +               val = fdt_getprop(fdt, cpu_offset, "riscv,pmlwidlist", &len);
> > +               if (val && len == 2 * sizeof(fdt32_t)) {
> > +                       hfeatures->pmlwidlist = ((u64)fdt32_to_cpu(val[0]) << 32) |
> > +                                                fdt32_to_cpu(val[1]);
> > +                       hfeatures->has_pmlwidlist = true;
> > +               }
> > +
> > +               /* Sanity checks */
> > +#if __riscv_xlen == 32
> > +               if (hfeatures->pmwidlist &&
> > +                   (hfeatures->pmwidlist >> 32)) {
> > +                       sbi_printf("%s: hart%u riscv,pmwidlist has bits beyond XLEN\n",
> > +                                  __func__, hartid);
> > +                       return SBI_EINVAL;
> > +               }
> > +
> > +               if (hfeatures->has_pmlwidlist &&
> > +                   (hfeatures->pmlwidlist >> 32)) {
> > +                       sbi_printf("%s: hart%u riscv,pmlwidlist has bits beyond XLEN\n",
> > +                                  __func__, hartid);
> > +                       return SBI_EINVAL;
> > +               }
> > +#endif
> > +
> > +               if (hfeatures->has_pmwid &&
> > +                   hfeatures->pmwid >= __riscv_xlen) {
> > +                       sbi_printf("%s: hart%u riscv,pmwid (%u) exceeds max WID\n",
> > +                                  __func__, hartid, hfeatures->pmwid);
> > +                       return SBI_EINVAL;
> > +               }
> > +
> > +               if (hfeatures->pmwidlist && hfeatures->has_pmwid &&
> > +                   !(hfeatures->pmwidlist & BIT_ULL(hfeatures->pmwid))) {
> > +                       sbi_printf("%s: hart%u riscv,pmwid (%u) not in pmwidlist\n",
> > +                                  __func__, hartid, hfeatures->pmwid);
> > +                       return SBI_EINVAL;
> > +               }
> > +       }
> > +
> > +       return 0;
> > +}
> > +
> >  static int fdt_parse_uart_node_common(const void *fdt, int nodeoffset,
> >                                       struct platform_uart_data *uart,
> >                                       unsigned long default_freq,
> > diff --git a/platform/generic/platform.c b/platform/generic/platform.c
> > index 1df0280d..51e9f342 100644
> > --- a/platform/generic/platform.c
> > +++ b/platform/generic/platform.c
> > @@ -255,11 +255,22 @@ int generic_final_init(bool cold_boot)
> >
> >  int generic_extensions_init(bool cold_boot)
> >  {
> > +       int rc;
> > +
> >         if (!cold_boot)
> >                 return 0;
> >
> >         /* Parse the ISA string from FDT and enable the listed extensions */
> > -       return fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > +       rc = fdt_parse_isa_extensions_all_harts(fdt_get_address());
> > +       if (rc)
> > +               return rc;
> > +
> > +       /* Parse RISC-V Worlds CPU properties from FDT */
> > +       rc = fdt_parse_worlds_all_harts(fdt_get_address());
> > +       if (rc)
> > +               return rc;
> > +

It is better to parse RISC-V Worlds per-hart WID properties
directl from fdt_parse_isa_extensions_all_harts() instead of
a separate fdt_parse_worlds_all_harts() function.

Regards,
Anup

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 3/9] lib: fdt_domain: parse domain WID properties

[Anup Patel]

On Tue, Oct 27, 2026 at 2:05 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add wid and widdeleg fields to struct sbi_domain to store the
> RISC-V Worlds mlwid and mwideleg CSR values for each domain.
> Also, parse the root and user-defined domains' WID during
> fdt_domains_populate().
>
> When Smlwid is implemented, the "wid" property is mandatory
> for all domains; fail domain population if it is missing.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Change v2->v3:
> - Add validate_domain_wid() to check if 'wid' is specified when Smlwid
>   extension is present; return SBI_EINVAL if missing.
> - Parse 'wid' and 'widdeleg' for the root domain via fdt_parse_root_domain().
> - Set root.widdeleg default to 0.
> ---
>  include/sbi/sbi_domain.h   |  6 +++
>  lib/sbi/sbi_domain.c       |  2 +
>  lib/utils/fdt/fdt_domain.c | 84 ++++++++++++++++++++++++++++++++++++++
>  3 files changed, 92 insertions(+)
>
> diff --git a/include/sbi/sbi_domain.h b/include/sbi/sbi_domain.h
> index 56a21397..5a291d1f 100644
> --- a/include/sbi/sbi_domain.h
> +++ b/include/sbi/sbi_domain.h
> @@ -19,6 +19,8 @@
>
>  struct sbi_scratch;
>
> +#define INVALID_WID    ((unsigned int)~0U)
> +
>  /** Domain access types */
>  enum sbi_domain_access {
>         SBI_DOMAIN_READ = (1UL << 0),
> @@ -218,6 +220,10 @@ struct sbi_domain {
>         bool system_reset_allowed;
>         /** Is domain allowed to suspend the system */
>         bool system_suspend_allowed;
> +       /** World ID for this domain (mlwid value) */
> +       u32 wid;
> +       /** World ID delegation bitmask for this domain (mwiddeleg value) */
> +       u64 widdeleg;
>         /** Identifies whether to include the firmware region */
>         bool fw_region_inited;
>  };
> diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
> index 42fe5632..be9020d0 100644
> --- a/lib/sbi/sbi_domain.c
> +++ b/lib/sbi/sbi_domain.c
> @@ -30,6 +30,8 @@ struct sbi_domain root = {
>         .possible_harts = NULL,
>         .system_reset_allowed = true,
>         .system_suspend_allowed = true,
> +       .wid = INVALID_WID,
> +       .widdeleg = 0,
>         .fw_region_inited = false,
>  };
>
> diff --git a/lib/utils/fdt/fdt_domain.c b/lib/utils/fdt/fdt_domain.c
> index e4cce8c3..8ce03236 100644
> --- a/lib/utils/fdt/fdt_domain.c
> +++ b/lib/utils/fdt/fdt_domain.c
> @@ -13,6 +13,7 @@
>  #include <sbi/sbi_console.h>
>  #include <sbi/sbi_domain.h>
>  #include <sbi/sbi_error.h>
> +#include <sbi/sbi_hart.h>
>  #include <sbi/sbi_hartmask.h>
>  #include <sbi/sbi_heap.h>
>  #include <sbi/sbi_scratch.h>
> @@ -290,6 +291,42 @@ static int __fdt_parse_region(const void *fdt, int domain_offset,
>         return 0;
>  }
>
> +static void fdt_parse_domain_wid_props(const void *fdt, int offset,
> +                                      struct sbi_domain *dom)
> +{
> +       const fdt32_t *val;
> +       int len;
> +       u64 val64;
> +
> +       val = fdt_getprop(fdt, offset, "wid", &len);
> +       if (val && len == sizeof(fdt32_t)) {
> +               dom->wid = fdt32_to_cpu(val[0]);
> +       }
> +
> +       val = fdt_getprop(fdt, offset, "widdeleg", &len);
> +       if (val && (len == (2 * sizeof(fdt32_t)))) {
> +               val64 = fdt32_to_cpu(val[0]);
> +               val64 = (val64 << 32) | fdt32_to_cpu(val[1]);
> +               dom->widdeleg = val64;
> +       }
> +}
> +
> +static int validate_domain_wid(const struct sbi_domain *dom)
> +{
> +       if (dom->wid != INVALID_WID)
> +               return 0;
> +
> +       if (sbi_hart_has_extension(sbi_scratch_thishart_ptr(),
> +                                  SBI_HART_EXT_SMLWID)) {
> +               sbi_printf("%s: domain \"%s\": missing \"wid\""
> +                          " property (required by Smlwid)\n",
> +                          __func__, dom->name);
> +               return SBI_EINVAL;
> +       }
> +
> +       return 0;
> +}
> +
>  static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
>  {
>         u32 val32;
> @@ -306,6 +343,7 @@ static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
>         dom = sbi_zalloc(sizeof(*dom));
>         if (!dom)
>                 return SBI_ENOMEM;
> +       dom->wid = INVALID_WID;
>
>         preg.dom = dom;
>         preg.region_count = 0;
> @@ -449,6 +487,12 @@ static int __fdt_parse_domain(const void *fdt, int domain_offset, void *opaque)
>         }
>         dom->next_mode = val32;
>
> +       /* Read "wid" and "widdeleg" DT properties */
> +       fdt_parse_domain_wid_props(fdt, domain_offset, dom);
> +       err = validate_domain_wid(dom);
> +       if (err)
> +               goto fail_free_all;
> +
>         /* Read "system-reset-allowed" DT property */
>         if (fdt_get_property(fdt, domain_offset,
>                              "system-reset-allowed", NULL))
> @@ -477,12 +521,52 @@ fail_free_domain:
>         return err;
>  }
>
> +static int fdt_root_domain_offset(const void *fdt)
> +{
> +       int offset;
> +
> +       offset = fdt_path_offset(fdt, "/chosen");
> +       if (offset < 0)
> +               return offset;
> +
> +       offset = fdt_node_offset_by_compatible(fdt, offset,
> +                                              "opensbi,domain,config");
> +       if (offset < 0)
> +               return offset;
> +
> +       return fdt_subnode_offset(fdt, offset, "root");
> +}
> +
> +static int fdt_parse_root_domain(const void *fdt)
> +{
> +       int offset;
> +
> +       if (fdt) {
> +               offset = fdt_root_domain_offset(fdt);
> +               if (offset >= 0)
> +                       fdt_parse_domain_wid_props(fdt, offset, &root);
> +       }
> +
> +       /*
> +        * Ensure root domain has a valid WID
> +        * even if FDT or root subnode is absent
> +        */
> +       return validate_domain_wid(&root);
> +}
> +
>  int fdt_domains_populate(const void *fdt)
>  {
> +       int err;
> +
>         /* Sanity checks */
>         if (!fdt)
>                 return SBI_EINVAL;
>
> +       /* Parse root domain config from "root" subnode */
> +       err = fdt_parse_root_domain(fdt);
> +       if (err)
> +               return err;
> +
>         /* Iterate over each domain in FDT and populate details */
>         return fdt_iterate_each_domain_ro(fdt, NULL, __fdt_parse_domain);

In addition to these changes, I suggest having compatible
string set to "opensbi,domain,instance" for root domain DT
node as well. To handle this in parsing, you can skip "root"
DT node in fdt_iterate_each_domain().

Regards,
Anup

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 4/9] lib: sbi_hart: lock mwid CSR for RoT immutability

[Anup Patel]

On Tue, Oct 27, 2026 at 2:05 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Lock the M-mode World ID (mwid) CSR during hart re-initialization
> to enforce immutability of the WID established by the root-of-trust.
>
> OpenSBI does not assign the WID value itself; it only sets MWID_LOCK
> to freeze the value established by prior RoT stage. The MWID_LOCK bit
> at XLEN-1 is sticky and makes the CSR read-only until reset, enforcing
> a temporal security boundary per the RISC-V Worlds specification.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

LGTM.

Reviewed-by: Anup Patel <anup@brainfault.org>

Regards,
Anup

> ---
> Change v2->v3:
> - No change
> ---
>  lib/sbi/sbi_hart.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index 38a761ac..f05d9b5d 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -724,6 +724,13 @@ int sbi_hart_reinit(struct sbi_scratch *scratch)
>         if (rc)
>                 return rc;
>
> +       /*
> +        * Assume MWID is restored by root-of-trust M-mode in previous
> +        * stage. Lock mwid so RoT-defined WID remains immutable.
> +        */
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID))
> +               csr_set(CSR_MWID, MWID_LOCK);
> +
>         return 0;
>  }
>
> --
> 2.43.7
>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 5/9] lib: sbi_domain_context: propagate error from sbi_hart_protection_reconfigure

[Anup Patel]

On Tue, Oct 27, 2026 at 2:05 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Propagate the return value of sbi_hart_protection_reconfigure in
> switch_to_next_domain_context to ensure that domain transition
> failures are correctly handled by the caller.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>

LGTM.

Reviewed-by: Anup Patel <anup@brainfault.org>

Regards,
Anup

> ---
> Change v2->v3:
> - New patch: propagate return value of sbi_hart_protection_reconfigure()
>   in switch_to_next_domain_context().
> ---
>  lib/sbi/sbi_domain_context.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/lib/sbi/sbi_domain_context.c b/lib/sbi/sbi_domain_context.c
> index 987ac7fa..1751d016 100644
> --- a/lib/sbi/sbi_domain_context.c
> +++ b/lib/sbi/sbi_domain_context.c
> @@ -110,6 +110,7 @@ static int switch_to_next_domain_context(struct hart_context *ctx,
>         MUST_NOT_HOLD(&ctx->dom->assigned_harts_lock)
>         MUST_NOT_HOLD(&dom_ctx->dom->assigned_harts_lock)
>  {
> +       int rc;
>         u32 hartindex = current_hartindex();
>         struct sbi_trap_context *trap_ctx;
>         struct sbi_domain *current_dom, *target_dom;
> @@ -173,7 +174,9 @@ static int switch_to_next_domain_context(struct hart_context *ctx,
>          * is also required for some of the above CSR updates (such
>          * as satp CSR).
>          */
> -       sbi_hart_protection_reconfigure(scratch, current_dom, target_dom);
> +       rc = sbi_hart_protection_reconfigure(scratch, current_dom, target_dom);
> +       if (rc)
> +               return rc;
>
>         /* Mark current context structure initialized because context saved */
>         ctx->initialized = true;
> --
> 2.43.7
>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 9/9] docs: document WID DT properties

[Anup Patel]

On Tue, Oct 27, 2026 at 2:06 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add "wid" and "widdeleg" properties to domain instance node
> documentation and example DT. Add a "Root Domain Node" section
> describing the "root" subnode under the domain configuration
> node for root domain WID configuration
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Change v2->v3:
> - Mark 'wid' property as mandatory when Smlwid is present for both root
>   and domain instance nodes.
> - Remove mention of M-mode WID fallback when 'wid' is absent.
> ---
>  docs/domain_support.md | 36 ++++++++++++++++++++++++++++++++++++
>  1 file changed, 36 insertions(+)
>
> diff --git a/docs/domain_support.md b/docs/domain_support.md
> index 51737218..54327e8d 100644
> --- a/docs/domain_support.md
> +++ b/docs/domain_support.md
> @@ -56,6 +56,8 @@ has following details:
>    domain. This can be either S-mode or U-mode.
>  * **system_reset_allowed** - Is domain allowed to reset the system?
>  * **system_suspend_allowed** - Is domain allowed to suspend the system?
> +* **wid** - World ID for the domain
> +* **widdeleg** - World ID delegation bitmask for the domain
>
>  The memory regions represented by **regions** in **struct sbi_domain** have
>  following additional constraints to align with RISC-V PMP requirements:
> @@ -98,6 +100,8 @@ following manner:
>    is the next mode for the ROOT domain
>  * **system_reset_allowed** - The ROOT domain is allowed to reset the system
>  * **system_suspend_allowed** - The ROOT domain is allowed to suspend the system
> +* **wid** - Configurable World ID for the ROOT domain
> +* **widdeleg** - Configurable World ID delegation bitmask for the ROOT domain
>
>  Domain Effects
>  --------------
> @@ -131,6 +135,22 @@ The DT properties of a domain configuration DT node are as follows:
>  * **compatible** (Mandatory) - The compatible string of the domain
>    configuration. This DT property should have value *"opensbi,domain,config"*
>
> +### Root Domain Node
> +
> +The root domain WID configuration is described in a **root** subnode under
> +the domain configuration DT node. This subnode does not have a compatible
> +string.
> +
> +The DT properties of the root domain node are as follows:
> +
> +* **wid** (Mandatory if Smlwid is present) - The 32-bit World ID for
> +  lower-privilege modes (S/U-mode) for the ROOT domain. If the hart
> +  supports the Smlwid extension, this property must be provided.
> +* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
> +  the ROOT domain. If present, OpenSBI writes this value to **mwiddeleg**
> +  when entering the ROOT domain (requires Smwiddeleg extension). If absent,
> +  clears **mwiddeleg** to disable S-mode WID delegation.
> +

Let's define mandatory compatible DT property for root domain DT node
as well. The suggestion in PATCH3 will allow you to do that.

>  ### Domain Memory Region Node
>
>  The domain memory region DT node describes details of a memory region and
> @@ -205,6 +225,13 @@ The DT properties of a domain instance DT node are as follows:
>    whether the domain instance is allowed to do system reset.
>  * **system-suspend-allowed** (Optional) - A boolean flag representing
>    whether the domain instance is allowed to do system suspend.
> +* **wid** (Mandatory if Smlwid is present) - The 32-bit World ID for
> +  lower-privilege modes (S/U-mode) for the domain instance. If the hart
> +  supports the Smlwid extension, this property must be provided.
> +* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for
> +  the domain instance. If present, OpenSBI writes this value to **mwiddeleg**
> +  on context switch into this domain (requires Smwiddeleg extension). If absent,
> +  clears **mwiddeleg** to disable S-mode WID delegation.
>
>  ### Assigning HART To Domain Instance
>
> @@ -260,6 +287,11 @@ be done:
>                  order = <64>;
>              };
>
> +            root {
> +                wid = <3>;
> +                widdeleg = <0x0 0x0>;
> +            };
> +
>              tdomain: trusted-domain {
>                  compatible = "opensbi,domain,instance";
>                  possible-harts = <&cpu0>;
> @@ -268,6 +300,8 @@ be done:
>                  next-arg1 = <0x0 0x0>;
>                  next-addr = <0x0 0x80100000>;
>                  next-mode = <0x0>;
> +                wid = <1>;
> +                widdeleg = <0x0 0x6>;
>                  system-reset-allowed;
>                  system-suspend-allowed;
>              };
> @@ -276,6 +310,8 @@ be done:
>                  compatible = "opensbi,domain,instance";
>                  possible-harts = <&cpu1 &cpu2 &cpu3 &cpu4>;
>                  regions = <&tmem 0x0>, <&tuart 0x0>, <&allmem 0x3f>;
> +                wid = <0>;
> +                widdeleg = <0x0 0x1>;
>              };
>          };
>      };
> --
> 2.43.7
>

Regards,
Anup

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 8/9] lib: sbi: display World ID configuration at boot

[Anup Patel]

On Tue, Oct 27, 2026 at 2:06 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Print per-domain Wid/Widdeleg and boot HART's M-mode
> World ID (mwid/pmwid fallback).
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>

LGTM.

Reviewed-by: Anup Patel <anup@brainfault.org>

Thanks,
Anup

> ---
> Change v2->v3:
> - Display dom->wid directly when Smlwid is present.
> ---
>  lib/sbi/sbi_domain.c | 18 ++++++++++++++++++
>  lib/sbi/sbi_init.c   | 13 +++++++++++++
>  2 files changed, 31 insertions(+)
>
> diff --git a/lib/sbi/sbi_domain.c b/lib/sbi/sbi_domain.c
> index be9020d0..f92ebc2f 100644
> --- a/lib/sbi/sbi_domain.c
> +++ b/lib/sbi/sbi_domain.c
> @@ -10,6 +10,7 @@
>  #include <sbi/riscv_asm.h>
>  #include <sbi/sbi_console.h>
>  #include <sbi/sbi_domain.h>
> +#include <sbi/sbi_hart.h>
>  #include <sbi/sbi_hartmask.h>
>  #include <sbi/sbi_heap.h>
>  #include <sbi/sbi_hsm.h>
> @@ -613,6 +614,7 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
>         u32 i, j, k;
>         unsigned long rstart, rend;
>         const struct sbi_domain_memregion *reg;
> +       struct sbi_scratch *scratch = sbi_scratch_thishart_ptr();
>
>         sbi_printf("Domain%d Name        %s: %s\n",
>                    dom->index, suffix, dom->name);
> @@ -691,6 +693,22 @@ void sbi_domain_dump(const struct sbi_domain *dom, const char *suffix)
>                 break;
>         }
>
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID)) {
> +               sbi_printf("Domain%d Wid         %s: %u\n",
> +                          dom->index, suffix, dom->wid);
> +       } else {
> +               sbi_printf("Domain%d Wid         %s: unsupported\n",
> +                          dom->index, suffix);
> +       }
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
> +               sbi_printf("Domain%d Widdeleg    %s: 0x%" PRIx64 "\n",
> +                          dom->index, suffix, dom->widdeleg);
> +       } else {
> +               sbi_printf("Domain%d Widdeleg    %s: unsupported\n",
> +                          dom->index, suffix);
> +       }
> +
>         sbi_printf("Domain%d SysReset    %s: %s\n",
>                    dom->index, suffix, (dom->system_reset_allowed) ? "yes" : "no");
>
> diff --git a/lib/sbi/sbi_init.c b/lib/sbi/sbi_init.c
> index acd2f8b6..f771f548 100644
> --- a/lib/sbi/sbi_init.c
> +++ b/lib/sbi/sbi_init.c
> @@ -167,6 +167,7 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
>         int xlen;
>         char str[256];
>         const struct sbi_domain *dom = sbi_domain_thishart_ptr();
> +       struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
>
>         if (scratch->options & SBI_SCRATCH_NO_BOOT_PRINTS)
>                 return;
> @@ -199,6 +200,18 @@ static void sbi_boot_print_hart(struct sbi_scratch *scratch, u32 hartid)
>         sbi_printf("Boot HART Debug Triggers    : %d triggers\n",
>                    sbi_dbtr_get_total_triggers());
>         sbi_hart_delegation_dump(scratch, "Boot HART ", "           ");
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID)) {
> +               ulong mwid = csr_read(CSR_MWID);
> +
> +               sbi_printf("Boot HART M-mode World ID   : %lu (%s)\n",
> +                          mwid & ~MWID_LOCK,
> +                          (mwid & MWID_LOCK) ? "locked" : "unlocked");
> +       } else if (hf->has_pmwid) {
> +               sbi_printf("Boot HART M-mode World ID   : %u (pmwid)\n",
> +                          hf->pmwid);
> +       } else {
> +               sbi_printf("Boot HART M-mode World ID   : unsupported\n");
> +       }
>  }
>
>  static unsigned long coldboot_done;
> --
> 2.43.7
>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 7/9] include: sbi_types: add PRIx64 format macro

[Anup Patel]

On Tue, Oct 27, 2026 at 2:06 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Add PRIx64 for portable 64-bit hex printing. Expands
> to 016lx on RV64 and 016llx on RV32, enabling consistent
> printf-style formatting of uint64_t values.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> Reviewed-by: Pawandeep Oza <pawandeep.oza@oss.qualcomm.com>

LGTM.

Reviewed-by: Anup Patel <anup@brainfault.org>

Thanks,
Anup

> ---
> Change v2->v3:
> - No change
> ---
>  include/sbi/sbi_types.h | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/include/sbi/sbi_types.h b/include/sbi/sbi_types.h
> index b8a7e6cb..780a4c2a 100644
> --- a/include/sbi/sbi_types.h
> +++ b/include/sbi/sbi_types.h
> @@ -34,12 +34,14 @@ typedef unsigned long               u64;
>  typedef long                   int64_t;
>  typedef unsigned long          uint64_t;
>  #define PRILX                  "016lx"
> +#define PRIx64                 "016lx"
>  #elif __riscv_xlen == 32
>  typedef long long              s64;
>  typedef unsigned long long     u64;
>  typedef long long              int64_t;
>  typedef unsigned long long     uint64_t;
>  #define PRILX                  "08lx"
> +#define PRIx64                 "016llx"
>  #else
>  #error "Unexpected __riscv_xlen"
>  #endif
> --
> 2.43.7
>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 6/9] lib: sbi_hart_worlds: Implement WID hart protection backend

[Anup Patel]

On Tue, Oct 27, 2026 at 2:06 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> Introduce a WID-based hart protection backend that switches World ID
> configurations across domains.
>
> Access to slwid is gated by mwiddeleg (Sswid), which means slwid cannot
> be handled by generic hart_context save/restore. Instead, manage slwid as
> domain state with explicit sequencing:
>
> - configure:
>   - Validate and program mlwid and mwiddeleg according to domain policy
>     and platform constraints (pmlwidlist/mlwidlist).
>   - Restore slwid after mwiddeleg is enabled.
> - unconfigure:
>   - Save slwid prior to clearing mwiddeleg.
>   - Reset mwiddeleg to 0 to disable Sswid.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>

LGTM.

Reviewed-by: Anup Patel <anup@brainfault.org>

Thanks,
Anup

> ---
> Change v2->v3:
> - Add hart_worlds_validate_wid() to check domain wid against pmlwidlist
>   and mlwidlist masks.
> - Add hart_worlds_validate_widdeleg() to check domain widdeleg against
>   pmlwidlist and mlwidlist masks.
> - Drop M-mode WID fallback (mwid/pmwid) for mlwid; program dom->wid directly.
> - Adapt to upstream domain state API rename (sbi_domain_data ->
>   sbi_domain_state).
> ---
>  include/sbi/sbi_hart_worlds.h |  24 ++++
>  lib/sbi/objects.mk            |   1 +
>  lib/sbi/sbi_hart.c            |   5 +
>  lib/sbi/sbi_hart_worlds.c     | 210 ++++++++++++++++++++++++++++++++++
>  4 files changed, 240 insertions(+)
>  create mode 100644 include/sbi/sbi_hart_worlds.h
>  create mode 100644 lib/sbi/sbi_hart_worlds.c
>
> diff --git a/include/sbi/sbi_hart_worlds.h b/include/sbi/sbi_hart_worlds.h
> new file mode 100644
> index 00000000..91b11023
> --- /dev/null
> +++ b/include/sbi/sbi_hart_worlds.h
> @@ -0,0 +1,24 @@
> +/*
> + * SPDX-License-Identifier: BSD-2-Clause
> + *
> + * Copyright (c) 2026 SiFive Inc.
> + */
> +
> +#ifndef __SBI_HART_WORLDS_H__
> +#define __SBI_HART_WORLDS_H__
> +
> +struct sbi_scratch;
> +
> +/**
> + * Initialize WID hart protection for current HART
> + *
> + * Registers the WID protection mechanism if Smlwid
> + * extension is present.
> + *
> + * @param scratch pointer to scratch space of current HART
> + *
> + * @return 0 on success and negative error code on failure
> + */
> +int sbi_hart_worlds_init(struct sbi_scratch *scratch);
> +
> +#endif /* __SBI_HART_WORLDS_H__ */
> diff --git a/lib/sbi/objects.mk b/lib/sbi/objects.mk
> index ae27d0c5..355ae6e9 100644
> --- a/lib/sbi/objects.mk
> +++ b/lib/sbi/objects.mk
> @@ -77,6 +77,7 @@ libsbi-objs-y += sbi_fwft.o
>  libsbi-objs-y += sbi_hart.o
>  libsbi-objs-y += sbi_hart_pmp.o
>  libsbi-objs-y += sbi_hart_protection.o
> +libsbi-objs-y += sbi_hart_worlds.o
>  libsbi-objs-y += sbi_heap.o
>  libsbi-objs-y += sbi_math.o
>  libsbi-objs-y += sbi_hfence.o
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index f05d9b5d..6aa6edd5 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -17,6 +17,7 @@
>  #include <sbi/sbi_error.h>
>  #include <sbi/sbi_hart.h>
>  #include <sbi/sbi_hart_pmp.h>
> +#include <sbi/sbi_hart_worlds.h>
>  #include <sbi/sbi_platform.h>
>  #include <sbi/sbi_pmu.h>
>  #include <sbi/sbi_string.h>
> @@ -762,6 +763,10 @@ int sbi_hart_init(struct sbi_scratch *scratch, bool cold_boot)
>                 rc = sbi_hart_pmp_init(scratch);
>                 if (rc)
>                         return rc;
> +
> +               rc = sbi_hart_worlds_init(scratch);
> +               if (rc)
> +                       return rc;
>         }
>
>         return sbi_hart_reinit(scratch);
> diff --git a/lib/sbi/sbi_hart_worlds.c b/lib/sbi/sbi_hart_worlds.c
> new file mode 100644
> index 00000000..6f582bd2
> --- /dev/null
> +++ b/lib/sbi/sbi_hart_worlds.c
> @@ -0,0 +1,210 @@
> +/*
> + * SPDX-License-Identifier: BSD-2-Clause
> + *
> + * Copyright (c) 2026 SiFive Inc.
> + */
> +
> +#include <sbi/riscv_encoding.h>
> +#include <sbi/sbi_bitops.h>
> +#include <sbi/sbi_console.h>
> +#include <sbi/sbi_domain.h>
> +#include <sbi/sbi_error.h>
> +#include <sbi/sbi_hart.h>
> +#include <sbi/sbi_hart_protection.h>
> +#include <sbi/sbi_hart_worlds.h>
> +#include <sbi/sbi_scratch.h>
> +
> +/**
> + * Initialize the per-hart slwid values of a domain using
> + * the lowest delegated WID as the initial value.
> + *
> + * S-mode OS should choose the desire slwid for it's
> + * U-mode.
> + */
> +static int sbi_hart_worlds_state_setup(struct sbi_domain *dom,
> +                                      struct sbi_domain_state *state,
> +                                      void *state_ptr)
> +{
> +       unsigned long widdeleg = dom->widdeleg;
> +       unsigned long *slwid = state_ptr;
> +       unsigned long init_wid;
> +
> +       if (!widdeleg)
> +               return SBI_OK;
> +
> +       init_wid = sbi_ffs(widdeleg);
> +       sbi_for_each_hartindex(i)
> +               slwid[i] = init_wid;
> +
> +       return SBI_OK;
> +}
> +
> +static struct sbi_domain_state wid_state = {
> +       .state_setup = sbi_hart_worlds_state_setup,
> +};
> +
> +static unsigned long *sbi_hart_worlds_slwid_ptr(struct sbi_domain *dom)
> +{
> +       unsigned long *slwid;
> +
> +       slwid = sbi_domain_state_ptr(dom, &wid_state);
> +       if (!slwid || !sbi_hartindex_valid(current_hartindex()))
> +               return NULL;
> +
> +       return &slwid[current_hartindex()];
> +}
> +
> +static int hart_worlds_validate_wid(struct sbi_scratch *scratch,
> +                                   struct sbi_domain *dom,
> +                                   unsigned long mlwidlist)
> +{
> +       struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
> +
> +       if (hf->has_pmlwidlist && !(hf->pmlwidlist & BIT_ULL(dom->wid))) {
> +               sbi_printf("%s: domain%d WID %u not permitted by"
> +                          " pmlwidlist\n",
> +                          __func__, dom->index, dom->wid);
> +               return SBI_EINVAL;
> +       }
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST) &&
> +           !(mlwidlist & BIT_ULL(dom->wid))) {
> +               sbi_printf("%s: domain%d WID %u not permitted by"
> +                          " mlwidlist 0x%lx\n",
> +                          __func__, dom->index, dom->wid, mlwidlist);
> +               return SBI_EINVAL;
> +       }
> +
> +       return SBI_OK;
> +}
> +
> +/*
> + * Validate that a domain's widdeleg value, parsed from the
> + * "widdeleg" DT property, is permitted on this hart.
> + *
> + * mwiddeleg is a M-mode WARL register, so an S-mode OS must rely
> + * on the "widdeleg" DT property to determine which WIDs it may
> + * delegate to U-mode via slwid. If pmwidlist or mlwidlist silently
> + * filters out any of those WIDs, the S-mode OS's view of the WIDs
> + * available for delegation would be incorrect. Treat this mismatch
> + * as a misconfiguration.
> + */
> +static int hart_worlds_validate_widdeleg(struct sbi_scratch *scratch,
> +                                        struct sbi_domain *dom,
> +                                        unsigned long mlwidlist)
> +{
> +       struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
> +       unsigned long widdeleg = dom->widdeleg;
> +
> +       if (!widdeleg)
> +               return SBI_OK;
> +
> +       if (hf->has_pmlwidlist && (widdeleg & ~hf->pmlwidlist)) {
> +               sbi_printf("%s: domain%d widdeleg 0x%lx has WID(s)"
> +                          " outside pmlwidlist 0x%lx\n",
> +                          __func__, dom->index, widdeleg,
> +                          (unsigned long)hf->pmlwidlist);
> +               return SBI_EINVAL;
> +       }
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST) &&
> +           (widdeleg & ~mlwidlist)) {
> +               sbi_printf("%s: domain%d widdeleg 0x%lx has WID(s)"
> +                          " outside mlwidlist 0x%lx\n",
> +                          __func__, dom->index, widdeleg, mlwidlist);
> +               return SBI_EINVAL;
> +       }
> +
> +       return SBI_OK;
> +}
> +
> +static int sbi_hart_worlds_configure(struct sbi_scratch *scratch,
> +                                    struct sbi_domain *dom)
> +{
> +       unsigned long *slwid = NULL;
> +       unsigned long mlwidlist = 0;
> +       int rc;
> +
> +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
> +               return SBI_OK;
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST))
> +               mlwidlist = csr_read(CSR_MLWIDLIST);
> +
> +       rc = hart_worlds_validate_wid(scratch, dom, mlwidlist);
> +       if (rc)
> +               return rc;
> +
> +       csr_write(CSR_MLWID, dom->wid);
> +
> +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG))
> +               return SBI_OK;
> +
> +       rc = hart_worlds_validate_widdeleg(scratch, dom, mlwidlist);
> +       if (rc)
> +               return rc;
> +
> +       /*
> +        * Enable Sswid before restoring slwid. A zero mwiddeleg
> +        * disables access to slwid, so the order here is required.
> +        */
> +       csr_write(CSR_MWIDDELEG, dom->widdeleg);
> +
> +       if (dom->widdeleg) {
> +               slwid = sbi_hart_worlds_slwid_ptr(dom);
> +               if (!slwid)
> +                       return SBI_EINVAL;
> +               csr_write(CSR_SLWID, *slwid);
> +       }
> +
> +       return SBI_OK;
> +}
> +
> +static void sbi_hart_worlds_unconfigure(struct sbi_scratch *scratch,
> +                                       struct sbi_domain *dom)
> +{
> +       unsigned long *slwid;
> +
> +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG) ||
> +           !dom->widdeleg)
> +               return;
> +
> +       /*
> +        * Save slwid value before disabling Sswid since the
> +        * CSR value may not retain through the disabled period.
> +        */
> +       slwid = sbi_hart_worlds_slwid_ptr(dom);
> +       if (!slwid) {
> +               sbi_panic("%s: domain%d has no slwid state\n",
> +                         __func__, dom->index);
> +       }
> +       *slwid = csr_read(CSR_SLWID);
> +
> +       /* Disable Sswid */
> +       csr_write(CSR_MWIDDELEG, 0);
> +}
> +
> +static struct sbi_hart_protection wid_protection = {
> +       .name           = "wid",
> +       .rating         = 100,
> +       .type           = SBI_HART_PROTECTION_TYPE_ID,
> +       .configure      = sbi_hart_worlds_configure,
> +       .unconfigure    = sbi_hart_worlds_unconfigure
> +};
> +
> +int sbi_hart_worlds_init(struct sbi_scratch *scratch)
> +{
> +       int rc;
> +
> +       if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
> +               return 0;
> +
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
> +               wid_state.state_size = sizeof(unsigned long) * sbi_hart_count();
> +               rc = sbi_domain_register_state(&wid_state);
> +               if (rc)
> +                       return rc;
> +       }
> +
> +       return sbi_hart_protection_register(&wid_protection);
> +}
> --
> 2.43.7
>

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 0/9] Add RISC-V Worlds ISA support to OpenSBI

[Anup Patel]

Hi Peter,

On Tue, Oct 27, 2026 at 2:05 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
>
> This patch series adds support for the RISC-V Worlds ISA extensions in
> OpenSBI, introducing a WID-based hart protection backend to enforce
> hardware isolation boundaries across domains.
>
> Trust Model and Boot-time Roles
> -------------------------------
>
> The implementation adheres to the two-phase M-mode trust model:
>
> - RoT M-mode phase: An earlier boot stage (e.g., ROM or SPL) may program
>   mwid and mlwidlist, locking mwid prior to handing off execution to
>   OpenSBI.
>
> - Regular M-mode phase (OpenSBI): OpenSBI treats the non-ISA platform
>   constraints (pmwid, pmwidlist, pmlwidlist) and CSR states (mwid,
>   mlwidlist) as immutable input policies from the hardware/RoT. It locks
>   mwid if still unlocked, preventing subsequent M-mode software from
>   altering its own WID, and programs per-domain mlwid and mwiddeleg based
>   on device tree configuration.
>
> Device Tree Bindings
> --------------------
>
> Per-hart properties defined in Linux kernel DT bindings v3 [1]:
> - riscv,pmwid: M-mode World ID
> - riscv,pmwidlist: M-mode permitted WID bitmap
> - riscv,pmlwidlist: S/U-mode permitted WID bitmap
>
> Per-domain properties (see docs/domain_support.md):
> - wid: World ID assigned to this domain for S/U-mode
> - widdeleg: WID delegation bitmap for this domain
>
> Changes since v2
> ----------------
> - Make 'wid' property mandatory for all domains (including root) when
>   Smlwid is implemented; reject misconfigured domains at boot.
> - Remove M-mode WID fallback logic (mwid/pmwid) for S-mode domain WID.
> - Validate domain wid and widdeleg against pmlwidlist and mlwidlist masks.
> - Introduce a new patch to propagate error from sbi_hart_protection_reconfigure()
>   in sbi_domain_context.
> - Adapt to upstream domain state framework API rename (sbi_domain_data ->
>   sbi_domain_state).
> - Update documentation and boot log output accordingly.
>
> [1] https://patchwork.kernel.org/project/linux-riscv/cover/20260812122131.1534906-1-peter.lin@sifive.com/
>
> Yu-Chien Peter Lin (9):
>   lib: sbi_hart: detect RISC-V Worlds ISA extensions
>   lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties
>   lib: fdt_domain: parse domain WID properties
>   lib: sbi_hart: lock mwid CSR for RoT immutability
>   lib: sbi_domain_context: propagate error from
>     sbi_hart_protection_reconfigure
>   lib: sbi_hart_worlds: Implement WID hart protection backend
>   include: sbi_types: add PRIx64 format macro
>   lib: sbi: display World ID configuration at boot
>   docs: document WID DT properties
>
>  docs/domain_support.md             |  36 +++++
>  include/sbi/riscv_encoding.h       |  12 ++
>  include/sbi/sbi_domain.h           |   6 +
>  include/sbi/sbi_hart.h             |  15 +++
>  include/sbi/sbi_hart_worlds.h      |  24 ++++
>  include/sbi/sbi_types.h            |   2 +
>  include/sbi_utils/fdt/fdt_helper.h |   2 +
>  lib/sbi/objects.mk                 |   1 +
>  lib/sbi/sbi_domain.c               |  20 +++
>  lib/sbi/sbi_domain_context.c       |   5 +-
>  lib/sbi/sbi_hart.c                 |  38 ++++++
>  lib/sbi/sbi_hart_worlds.c          | 210 +++++++++++++++++++++++++++++
>  lib/sbi/sbi_init.c                 |  13 ++
>  lib/utils/fdt/fdt_domain.c         |  84 ++++++++++++
>  lib/utils/fdt/fdt_helper.c         |  90 +++++++++++++
>  platform/generic/platform.c        |  13 +-
>  16 files changed, 569 insertions(+), 2 deletions(-)
>  create mode 100644 include/sbi/sbi_hart_worlds.h
>  create mode 100644 lib/sbi/sbi_hart_worlds.c
>
> --
> 2.43.7
>

Overall, this series is in great shape. Once, I will
merge once my comments are addressed.

Thanks,
Anup

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 0/9] Add RISC-V Worlds ISA support to OpenSBI

[Yu-Chien Peter Lin]

Hi Anup,

On Wed, Oct 28, 2026 at 04:50:24PM +0530, Anup Patel wrote:
> Hi Peter,
> 
> On Tue, Oct 27, 2026 at 2:05 PM Yu-Chien Peter Lin <peter.lin@sifive.com> wrote:
> >
> > This patch series adds support for the RISC-V Worlds ISA extensions in
> > OpenSBI, introducing a WID-based hart protection backend to enforce
> > hardware isolation boundaries across domains.
> >
> > Trust Model and Boot-time Roles
> > -------------------------------
> >
> > The implementation adheres to the two-phase M-mode trust model:
> >
> > - RoT M-mode phase: An earlier boot stage (e.g., ROM or SPL) may program
> >   mwid and mlwidlist, locking mwid prior to handing off execution to
> >   OpenSBI.
> >
> > - Regular M-mode phase (OpenSBI): OpenSBI treats the non-ISA platform
> >   constraints (pmwid, pmwidlist, pmlwidlist) and CSR states (mwid,
> >   mlwidlist) as immutable input policies from the hardware/RoT. It locks
> >   mwid if still unlocked, preventing subsequent M-mode software from
> >   altering its own WID, and programs per-domain mlwid and mwiddeleg based
> >   on device tree configuration.
> >
> > Device Tree Bindings
> > --------------------
> >
> > Per-hart properties defined in Linux kernel DT bindings v3 [1]:
> > - riscv,pmwid: M-mode World ID
> > - riscv,pmwidlist: M-mode permitted WID bitmap
> > - riscv,pmlwidlist: S/U-mode permitted WID bitmap
> >
> > Per-domain properties (see docs/domain_support.md):
> > - wid: World ID assigned to this domain for S/U-mode
> > - widdeleg: WID delegation bitmap for this domain
> >
> > Changes since v2
> > ----------------
> > - Make 'wid' property mandatory for all domains (including root) when
> >   Smlwid is implemented; reject misconfigured domains at boot.
> > - Remove M-mode WID fallback logic (mwid/pmwid) for S-mode domain WID.
> > - Validate domain wid and widdeleg against pmlwidlist and mlwidlist masks.
> > - Introduce a new patch to propagate error from sbi_hart_protection_reconfigure()
> >   in sbi_domain_context.
> > - Adapt to upstream domain state framework API rename (sbi_domain_data ->
> >   sbi_domain_state).
> > - Update documentation and boot log output accordingly.
> >
> > [1] https://patchwork.kernel.org/project/linux-riscv/cover/20260812122131.1534906-1-peter.lin@sifive.com/
> >
> > Yu-Chien Peter Lin (9):
> >   lib: sbi_hart: detect RISC-V Worlds ISA extensions
> >   lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties
> >   lib: fdt_domain: parse domain WID properties
> >   lib: sbi_hart: lock mwid CSR for RoT immutability
> >   lib: sbi_domain_context: propagate error from
> >     sbi_hart_protection_reconfigure
> >   lib: sbi_hart_worlds: Implement WID hart protection backend
> >   include: sbi_types: add PRIx64 format macro
> >   lib: sbi: display World ID configuration at boot
> >   docs: document WID DT properties
> >
> >  docs/domain_support.md             |  36 +++++
> >  include/sbi/riscv_encoding.h       |  12 ++
> >  include/sbi/sbi_domain.h           |   6 +
> >  include/sbi/sbi_hart.h             |  15 +++
> >  include/sbi/sbi_hart_worlds.h      |  24 ++++
> >  include/sbi/sbi_types.h            |   2 +
> >  include/sbi_utils/fdt/fdt_helper.h |   2 +
> >  lib/sbi/objects.mk                 |   1 +
> >  lib/sbi/sbi_domain.c               |  20 +++
> >  lib/sbi/sbi_domain_context.c       |   5 +-
> >  lib/sbi/sbi_hart.c                 |  38 ++++++
> >  lib/sbi/sbi_hart_worlds.c          | 210 +++++++++++++++++++++++++++++
> >  lib/sbi/sbi_init.c                 |  13 ++
> >  lib/utils/fdt/fdt_domain.c         |  84 ++++++++++++
> >  lib/utils/fdt/fdt_helper.c         |  90 +++++++++++++
> >  platform/generic/platform.c        |  13 +-
> >  16 files changed, 569 insertions(+), 2 deletions(-)
> >  create mode 100644 include/sbi/sbi_hart_worlds.h
> >  create mode 100644 lib/sbi/sbi_hart_worlds.c
> >
> > --
> > 2.43.7
> >
> 
> Overall, this series is in great shape. Once, I will
> merge once my comments are addressed.

Sure, comments are addressed accordingly.

Hi Oza, Radim,

Please re-review the PATCHv4.

Thanks,
Peter Lin

> 
> Thanks,
> Anup

-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 5/9] lib: sbi_domain_context: propagate error from sbi_hart_protection_reconfigure

[Radim Krcmar]

2026-10-27T16:35:05+08:00, Yu-Chien Peter Lin <peter.lin@sifive.com>:
> Propagate the return value of sbi_hart_protection_reconfigure in
> switch_to_next_domain_context to ensure that domain transition
> failures are correctly handled by the caller.

The state is a mess upon a failure here, so I don't think that the
caller could handle it more gracefully than doing a reset.

There is little reason why we should fail the domain transition, because
the failure conditions can be known at domain initialization.

This series is not to blame for the underlying issue, so I'd instead
note that in the future, we will not allow failures in the middle of
switching, because it's needlessly complicated to unwind such errors.

Thanks.
-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

Re: [PATCH v3 9/9] docs: document WID DT properties

[Radim Krcmar]

2026-10-27T16:35:09+08:00, Yu-Chien Peter Lin <peter.lin@sifive.com>:
> Add "wid" and "widdeleg" properties to domain instance node
> documentation and example DT. Add a "Root Domain Node" section
> describing the "root" subnode under the domain configuration
> node for root domain WID configuration
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
> ---
> Change v2->v3:
> - Mark 'wid' property as mandatory when Smlwid is present for both root
>   and domain instance nodes.
> - Remove mention of M-mode WID fallback when 'wid' is absent.
> ---
> diff --git a/docs/domain_support.md b/docs/domain_support.md
> @@ -205,6 +225,13 @@ The DT properties of a domain instance DT node are as follows:
> +* **wid** (Mandatory if Smlwid is present) - The 32-bit World ID for
> +  lower-privilege modes (S/U-mode) for the domain instance. If the hart
> +  supports the Smlwid extension, this property must be provided.

WID CSR field with Smlwid is log_2(MXLEN)-bit.

> +* **widdeleg** (Optional) - The 64 bit World ID delegation bitmask for

mwiddeleg CSR with Smwiddeleg is MXLEN-bit.

BIT_ULL(dom->wid) in [6/9] is UB because DT parser allows WID above
MXLEN, but it's easy to blame the platform for that...
How much do we want to sanitize the DT?

Thanks.
-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi