From: Yu-Chien Peter Lin <peter.lin@sifive.com>
To: opensbi@lists.infradead.org
Cc: zong.li@sifive.com, greentime.hu@sifive.com, anup@brainfault.org,
scott@riscstar.com, conor@kernel.org, dave.patel@riscstar.com,
raymond.mao@riscstar.com, robin.randhawa@sifive.com,
samuel.holland@sifive.com, pawandeep.oza@oss.qualcomm.com,
krzk@kernel.org, Yu-Chien Peter Lin <peter.lin@sifive.com>
Subject: [PATCH v2 4/9] lib: sbi_hart: lock mwid CSR for RoT immutability
Date: Mon, 17 Aug 2026 17:04:58 +0800 [thread overview]
Message-ID: <20260817090503.2104998-5-peter.lin@sifive.com> (raw)
In-Reply-To: <20260817090503.2104998-1-peter.lin@sifive.com>
Lock the M-mode World ID (mwid) CSR during hart re-initialization
to enforce immutability of the WID established by the root-of-trust.
OpenSBI does not assign the WID value itself; it only sets MWID_LOCK
to freeze the value established by prior RoT stage. The MWID_LOCK bit
at XLEN-1 is sticky and makes the CSR read-only until reset, enforcing
a temporal security boundary per the RISC-V Worlds specification.
Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
lib/sbi/sbi_hart.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index f5f4062e..29856c0f 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -724,6 +724,13 @@ int sbi_hart_reinit(struct sbi_scratch *scratch)
if (rc)
return rc;
+ /*
+ * Assume MWID is restored by root-of-trust M-mode in previous
+ * stage. Lock mwid so RoT-defined WID remains immutable.
+ */
+ if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID))
+ csr_set(CSR_MWID, MWID_LOCK);
+
return 0;
}
--
2.43.7
--
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi
next prev parent reply other threads:[~2026-08-17 9:05 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-17 9:04 [PATCH v2 0/9] Add RISC-V Worlds ISA support to OpenSBI Yu-Chien Peter Lin
2026-08-17 9:04 ` [PATCH v2 1/9] lib: sbi_hart: detect RISC-V Worlds ISA extensions Yu-Chien Peter Lin
2026-08-17 9:04 ` [PATCH v2 2/9] lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties Yu-Chien Peter Lin
2026-08-17 9:04 ` [PATCH v2 3/9] lib: fdt_domain: parse domain " Yu-Chien Peter Lin
2026-08-17 9:04 ` Yu-Chien Peter Lin [this message]
2026-08-17 9:04 ` [PATCH v2 5/9] lib: sbi_hart: add WID protection mechanism Yu-Chien Peter Lin
2026-08-18 2:39 ` Yu-Chien Peter Lin
2026-08-17 9:05 ` [PATCH v2 6/9] lib: sbi_domain_context: add slwid to per-domain S-mode context Yu-Chien Peter Lin
2026-08-17 9:05 ` [PATCH v2 7/9] include: sbi_types: add PRIx64 format macro Yu-Chien Peter Lin
2026-08-17 9:05 ` [PATCH v2 8/9] lib: sbi: display World ID configuration at boot Yu-Chien Peter Lin
2026-08-17 9:05 ` [PATCH v2 9/9] docs: document WID DT properties Yu-Chien Peter Lin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260817090503.2104998-5-peter.lin@sifive.com \
--to=peter.lin@sifive.com \
--cc=anup@brainfault.org \
--cc=conor@kernel.org \
--cc=dave.patel@riscstar.com \
--cc=greentime.hu@sifive.com \
--cc=krzk@kernel.org \
--cc=opensbi@lists.infradead.org \
--cc=pawandeep.oza@oss.qualcomm.com \
--cc=raymond.mao@riscstar.com \
--cc=robin.randhawa@sifive.com \
--cc=samuel.holland@sifive.com \
--cc=scott@riscstar.com \
--cc=zong.li@sifive.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).