mbox series

[v2,0/9] Add RISC-V Worlds ISA support to OpenSBI

Message ID 20260817090503.2104998-1-peter.lin@sifive.com
Headers show
Series Add RISC-V Worlds ISA support to OpenSBI | expand

Message

Yu-Chien Peter Lin Aug. 17, 2026, 9:04 a.m. UTC 
This patch series adds support for RISC-V Worlds ISA extensions,
enabling hardware-enforced isolation boundaries based on World IDs
by extending the OpenSBI domain framework.

Trust Model and Boot-time Roles
--------------------------------

The implementation follows the two-phase M-mode trust model:

- RoT M-mode phase: Prior boot stage (ROM/SPL) that may program mwid and
  mlwidlist and lock mwid before handing off to OpenSBI.

- Regular M-mode phase (OpenSBI): Treats pmwid/pmwidlist/pmlwidlist as
  input policy from hardware/RoT. Locks mwid to prevent later M-mode code
  from changing its own WID. Programs per-domain mlwid/mwiddeleg based on
  DT configuration.

Device Tree Bindings
---------------------

Per-hart properties defined in linux kernel DT bindings v3 [1]:
- riscv,pmwid: M-mode World ID
- riscv,pmwidlist: M-mode permitted WID bitmap
- riscv,pmlwidlist: S/U-mode permitted WID bitmap

Per-domain properties (see domain_support.md):
- wid: S-mode WID for this domain
- widdeleg: WID delegation bitmap for this domain

If a domain node lacks wid, OpenSBI falls back to M-mode WID, all
modes will run in the same World.

[1] https://patchwork.kernel.org/project/linux-riscv/cover/20260812122131.1534906-1-peter.lin@sifive.com/

Yu-Chien Peter Lin (9):
  lib: sbi_hart: detect RISC-V Worlds ISA extensions
  lib: utils: fdt_helper: parse RISC-V Worlds per-hart WID properties
  lib: fdt_domain: parse domain WID properties
  lib: sbi_hart: lock mwid CSR for RoT immutability
  lib: sbi_hart: add WID protection mechanism
  lib: sbi_domain_context: add slwid to per-domain S-mode context
  include: sbi_types: add PRIx64 format macro
  lib: sbi: display World ID configuration at boot
  docs: document WID DT properties

 docs/domain_support.md             | 36 ++++++++++++
 include/sbi/riscv_encoding.h       | 12 ++++
 include/sbi/sbi_domain.h           |  6 ++
 include/sbi/sbi_hart.h             | 16 ++++++
 include/sbi/sbi_hart_worlds.h      | 24 ++++++++
 include/sbi/sbi_types.h            |  2 +
 include/sbi_utils/fdt/fdt_helper.h |  2 +
 lib/sbi/objects.mk                 |  1 +
 lib/sbi/sbi_domain.c               | 31 ++++++++++
 lib/sbi/sbi_domain_context.c       | 13 +++++
 lib/sbi/sbi_hart.c                 | 38 ++++++++++++
 lib/sbi/sbi_hart_worlds.c          | 72 +++++++++++++++++++++++
 lib/sbi/sbi_init.c                 | 13 +++++
 lib/utils/fdt/fdt_domain.c         | 50 ++++++++++++++++
 lib/utils/fdt/fdt_helper.c         | 92 ++++++++++++++++++++++++++++++
 platform/generic/platform.c        | 13 ++++-
 16 files changed, 420 insertions(+), 1 deletion(-)
 create mode 100644 include/sbi/sbi_hart_worlds.h
 create mode 100644 lib/sbi/sbi_hart_worlds.c

Comments

Krzysztof Kozlowski Sept. 28, 2026, 11:33 a.m. UTC | #1 
On 17/08/2026 11:04, Yu-Chien Peter Lin wrote:
> This patch series adds support for RISC-V Worlds ISA extensions,
> enabling hardware-enforced isolation boundaries based on World IDs
> by extending the OpenSBI domain framework.
> 
> Trust Model and Boot-time Roles
> --------------------------------
> 
> The implementation follows the two-phase M-mode trust model:
> 
> - RoT M-mode phase: Prior boot stage (ROM/SPL) that may program mwid and
>   mlwidlist and lock mwid before handing off to OpenSBI.
> 
> - Regular M-mode phase (OpenSBI): Treats pmwid/pmwidlist/pmlwidlist as
>   input policy from hardware/RoT. Locks mwid to prevent later M-mode code
>   from changing its own WID. Programs per-domain mlwid/mwiddeleg based on
>   DT configuration.
> 
> Device Tree Bindings
> ---------------------
> 
> Per-hart properties defined in linux kernel DT bindings v3 [1]:
> - riscv,pmwid: M-mode World ID
> - riscv,pmwidlist: M-mode permitted WID bitmap
> - riscv,pmlwidlist: S/U-mode permitted WID bitmap>
> Per-domain properties (see domain_support.md):
> - wid: S-mode WID for this domain
> - widdeleg: WID delegation bitmap for this domain


I don't understand why I am cc-ed here, why DT is described here but not
in the bindings and why do you reference some RFC (which means: not
READY for review) patchset in a different patchset which is ready for
review.

Best regards,
Krzysztof
Yu-Chien Peter Lin Sept. 29, 2026, 2:29 p.m. UTC | #2 
Hi Krzysztof,

On Mon, Sep 28, 2026 at 01:33:17PM +0200, Krzysztof Kozlowski wrote:
> On 17/08/2026 11:04, Yu-Chien Peter Lin wrote:
> > This patch series adds support for RISC-V Worlds ISA extensions,
> > enabling hardware-enforced isolation boundaries based on World IDs
> > by extending the OpenSBI domain framework.
> > 
> > Trust Model and Boot-time Roles
> > --------------------------------
> > 
> > The implementation follows the two-phase M-mode trust model:
> > 
> > - RoT M-mode phase: Prior boot stage (ROM/SPL) that may program mwid and
> >   mlwidlist and lock mwid before handing off to OpenSBI.
> > 
> > - Regular M-mode phase (OpenSBI): Treats pmwid/pmwidlist/pmlwidlist as
> >   input policy from hardware/RoT. Locks mwid to prevent later M-mode code
> >   from changing its own WID. Programs per-domain mlwid/mwiddeleg based on
> >   DT configuration.
> > 
> > Device Tree Bindings
> > ---------------------
> > 
> > Per-hart properties defined in linux kernel DT bindings v3 [1]:
> > - riscv,pmwid: M-mode World ID
> > - riscv,pmwidlist: M-mode permitted WID bitmap
> > - riscv,pmlwidlist: S/U-mode permitted WID bitmap>
> > Per-domain properties (see domain_support.md):
> > - wid: S-mode WID for this domain
> > - widdeleg: WID delegation bitmap for this domain
> 
> 
> I don't understand why I am cc-ed here,

OpenSBI consumes the riscv,pmwid/pmwidlist/pmlwidlist
properties. Sorry for the confusion; I will remove you
from the CC list and provide links to the associated
OpenSBI patches in the kernel patch cover letter.

> why DT is described here but not
> in the bindings and why do you reference some RFC (which means: not
> READY for review) patchset in a different patchset which is ready for
> review.

The kernel patch series is currently pending and cannot
be merged until the RISC-V Worlds specification has landed
with an associated commit hash. Therefore, I used a TBD
placeholder in PATCH 2 [1].

Best regards,
Peter Lin

[1] https://patchwork.kernel.org/project/linux-riscv/patch/20260812122131.1534906-2-peter.lin@sifive.com/

> 
> Best regards,
> Krzysztof