mbox series

[RFC,v4,0/4] Add Smsdid and Smmpt supervisor domain protection

Message ID 20260824020953.2438946-1-rahul.pathak@oss.qualcomm.com
Headers show
Series Add Smsdid and Smmpt supervisor domain protection | expand

Message

Rahul Pathak Aug. 24, 2026, 2:09 a.m. UTC 
This series adds OpenSBI support for the RISC-V SMMPT specification
sub-extensions - Smsdid (supervisor domain ID) and
Smmpt (supervisor domain memory protection).

Together these let M-mode firmware confine each supervisor domain to a
physical address space that is enforced in hardware, via a per domain
memory protection table (MPT) selected by the mmpt CSR.

Every supervisor domain gets its own MPT built from the memory regions
of its SBI domain. Per-region XWR permissions are derived from the
region's S/U access flags from SBI domain, so a region that does not have S/U
access is mapped as an deny instead of skipped.

The Root domain maps all physical memory, with the firmware region explicitly
denied to S-mode. Regions may be shared between domains, each side keeping
its own permissions.

NOTE: This series is based on another unmerged series which is present here: 
https://lore.kernel.org/all/20260820121309.2551296-1-rahul.pathak@oss.qualcomm.com/

Testing:
Booted Linux when Smmpt was active. The boot dump shows the expected per region
permissions. Also checked with a small self-test in Qemu which confirms the
firmware region denied and the kernel region permitted from S-mode.

The Qemu RISC-V Virt machine was used to test this. The new cli args
required to be passed to Qemu are -

./qemu-system-riscv64 -nographic -M virt -cpu rv64,x-smsdid=true,x-smmpt=true

Boot Logs:

NOTE: The below logs are due the sbi_mpt_dump() function which is
present but not called. Its kept for debugging purposes.

sbi_mpt: mode=Smmpt52    SDIDLEN=6 max_domains=64
root_size=0x1000 root_align=0x1000
fw 0x0000000080000000+0x19e000  pool=global heap
SDID  0 root=0x0000000080098000 regions=9 dom=root
S-Domain0 Region01          : 0x0000000080000000+0x80000           : xwr=0 (---)
S-Domain0 Region02          : 0x0000000080000000+0x200000          : xwr=0 (---)
S-Domain0 Region03          : 0x0000000000100000+0x1000            : xwr=3 (RW-)
S-Domain0 Region04          : 0x0000000010000000+0x1000            : xwr=3 (RW-)
S-Domain0 Region05          : 0x0000000002000000+0x10000           : xwr=0 (---)
S-Domain0 Region06          : 0x000000000c400000+0x200000          : xwr=3 (RW-)
S-Domain0 Region07          : 0x000000000c000000+0x400000          : xwr=3 (RW-)
S-Domain0 Region08          : 0x0000000080000000+0x19e000          : xwr=0 (---) [LOCKED]
S-Domain0 Default           : Rest of the address space            : xwr=7 (RWX)   [baseline, overlay by regions above]
Boot HART ID                : 0
Boot HART Domain            : root
Boot HART Priv Version      : v1.12
Boot HART Base ISA          : rv64imafdch
Boot HART ISA Extensions    : sstc,zicntr,zihpm,zicboz,zicbom,sdtrig,svadu,f,d,smsdid,smmpt
Boot HART PMP Count         : 16
Boot HART PMP Granularity   : 2 bits
Boot HART PMP Address Bits  : 54
Boot HART MHPM Info         : 16 (0x0007fff8)
Boot HART Debug Triggers    : 2 triggers
Boot HART MIDELEG           : 0x0000000000001666
Boot HART MEDELEG           : 0x0000000000f4b509

The corresponding Qemu Smmpt support from LIU Zhiwei
https://patchew.org/QEMU/20260723200325.24969-1-zhiwei._5Fliu@linux.alibaba.com/

This is part of collaboration work for RISC-V SMMTT development. More
details are here:
https://lists.gnu.org/archive/html/qemu-riscv/2026-07/msg01018.html

These OpenSBI changes are also present in github -
https://github.com/pathakraul/opensbi/tree/rpathak_smmpt_v4

Further Development:
This series add base infrastructure for Smsdid and Smmpt. Development
and testing with more then one Supervisor Domain. Extensive testing with
all the modes and other platform configurations.

v3 -> v4:
  1. Drop the map_range/unmap_range rename patch from this series.
  2. Move sbi_mpt_init() function out of the platform.c and make it
     part of the sbi hart protection mechanism.
  3. Drop mpt_early_init() and mpt_final_init() functions. The SMMPT
     core registers the sbi domain state callbacks for initialization,
     activation and cleanup.
  4. Add state_finalize callback in for per domain state finalization.
  5. Address the review comments like typos and add relevant macros
     instead of using numbers for clarity.
  6. Remove the sbi_mpt_dump() function call.

v2 -> v3:
  1. Adapt to sbi hart protection abstraction.
  2. Add missing sbi_mpt_hart_deactivate() decl in sbi_mpt.h.
  3. Rename the *map_range and *unmap_range set of functions in sbi_hart_protection.
  4. Update the copyright string.

v1 -> v2:
  1. Rebase to latest master
  2. Change probe order between mode and sdid.
  3. Add sbi_mpt_query_access() function.
  4. Formatting changes.

Rahul Pathak (4):
  lib: sbi_domain: Add finalize callback for per-domain state
  riscv: Add Smsdid and Smmpt hart extensions
  mpt: Add Smsdid and Smmpt supervisor domain core
  lib: sbi: Initialize SMMPT during coldboot

 include/sbi/sbi_domain_state.h |   22 +
 include/sbi/sbi_hart.h         |    4 +
 include/sbi/sbi_hart_mpt.h     |  312 ++++++++++
 lib/sbi/objects.mk             |    2 +
 lib/sbi/sbi_domain.c           |   16 +
 lib/sbi/sbi_domain_state.c     |   25 +
 lib/sbi/sbi_hart.c             |   10 +-
 lib/sbi/sbi_hart_mpt.c         |  993 +++++++++++++++++++++++++++++++
 lib/sbi/sbi_mpt.c              | 1000 ++++++++++++++++++++++++++++++++
 platform/generic/platform.c    |    9 +
 10 files changed, 2392 insertions(+), 1 deletion(-)
 create mode 100644 include/sbi/sbi_hart_mpt.h
 create mode 100644 lib/sbi/sbi_hart_mpt.c
 create mode 100644 lib/sbi/sbi_mpt.c