software/src/opensbi.git, branch master

lib: utils/mpxy: Add RPMI MPXY driver for logging service group

2026-07-01T16:00:24+00:00

Add RPMI MPXY proxy driver for LOGGING service group so that S-mode can leverage LOGGING service group implemented by the platform microcontroller. Reviewed-by: Rahul Pathak Signed-off-by: Subrahmanya Lingappa Link: https://lore.kernel.org/r/20260619103424.990954-1-subrahmanya.lingappa@oss.qualcomm.com Signed-off-by: Anup Patel

include: Bump-up version to 1.9

2026-06-30T14:19:54+00:00

Update the OpenSBI version to 1.9 as part of release preparation. Signed-off-by: Anup Patel

firmware: Fix comment after relocation completion

2026-06-28T08:38:14+00:00

After relocation is done, the code is running from the load address, not the link address. Fix the comment to correctly reflect this. Signed-off-by: Zong Li Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260626022121.1885209-1-zong.li@sifive.com Signed-off-by: Anup Patel

lib: sbi_pmu: fix integer overflow in pmu_ctr_idx_validate

2026-06-28T08:34:17+00:00

pmu_ctr_idx_validate() checks whether counter indices are in range using cbase + sbi_fls(cmask) < total_ctrs. Both operands are unsigned long, so a crafted cbase close to ULONG_MAX causes the addition to wrap around to a small value that passes the comparison. Once validation is bypassed, sbi_pmu_ctr_cfg_match() with the SKIP_MATCH flag uses the overflowed index directly as an array subscript into phs->active_events[], producing an out-of-bounds read in M-mode. Through the firmware-event code path, the same overflowed index reaches fw_counters_data[] and fw_counters_started, giving an attacker OOB write-zero and OOB bit-set primitives in M-mode memory. Fix pmu_ctr_idx_validate() by checking for unsigned overflow before the comparison, and add a secondary bounds check on cidx_first in the SKIP_MATCH path so that even if validation is somehow bypassed in the future, the array access remains bounded. Signed-off-by: liutong Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260624035049.1753003-1-liutong@iscas.ac.cn Signed-off-by: Anup Patel

platform: generic: spacemit: k1: fix wrong address definitions

2026-06-28T05:46:36+00:00

PMU_AP_CORE2_IDLE_CFG and PMU_AP_CORE3_IDLE_CFG are not continuous with PMU_AP_CORE0_IDLE_CFG and PMU_AP_CORE1_IDLE_CFG. They are at PMU AP base + 0x160 and + 0x164, matching the vendor OpenSBI definitions. After fixing these addresses, the intermediate cluster offset macros are redundant now, so define the wakeup and idle registers directly as PMU_AP_BASE offsets. This makes the actual register addresses easier to inspect and compare against the vendor code. C1_RVBADDR_HI_ADDR is also corrected according to the vendor OpenSBI definition. This was tested by writing an invalid value to the corrected address, which prevents cluster1 CPUs from coming online, while doing the same with the old address does not affect SMP boot. Fixes: 1f84ec2a ("platform: generic: spacemit: add K1") Signed-off-by: Junhui Liu Link: https://lore.kernel.org/r/20260623-k1-fix-addr-v1-1-3dbde8c03bd6@pigmoral.tech Signed-off-by: Anup Patel

platform: generic: mips eyeq7h: fix boot with JTAG

2026-06-28T05:38:13+00:00

When JTAG is connected, internal logic leads to the bit MIPS_CTL0_DBG_RST_DASRT (for the debug unit) stay high and this prevents normal cluster power-up. Force proper power-on reset value prior to power-up sequence. Hold this value for about 10 usec Signed-off-by: Vladimir Kondratiev Link: https://lore.kernel.org/r/20260618103713.2588984-1-vladimir.kondratiev@mobileye.com Signed-off-by: Anup Patel

lib: sbi: Rework misaligned vector load/store

2026-06-17T06:13:38+00:00

Fix the following issues with misaligned vector load/store: a. Stack overflow: the mask[VLEN_MAX / 8] variable consumes 8K stack space, given VLEN_MAX=65536, overflowing the default-sized stack. There's no need to fetch the whole mask in one go, instead, make it on-demand. Use a 128-byte mask as local buffer to hold the sliding window of mask. For rvv load, this is allowed -- from the spec: "The destination vector register group for a masked vector instruction cannot overlap the source mask register (v0), unless the destination vector register is being written with a mask value (e.g., compares) or the scalar result of a reduction" We don't need to worry about the mask getting overwritten. b. Maintain the value of vstart upon abort (uptrap) to avoid duplicate work. After fault resolution, the instruction can restart from the faulting vstart. For Fault-Only-First loads, reset vstart to 0, as previously done so, to conform to spec. c. Explicitly set VS dirty in VSSTATUS with SET_VS_DIRTY() if faulting from V=1, and if any vector register, including vstart/vl/vtype, gets changed in the handler. It can add 1 unnecessary op to set VS dirty in M/SSTATUS (not VSSTATUS), where the HW already did, but for code simplicity, do it anyway. The overhead should be negligible. Signed-off-by: Bo Gan Tested-by: Anirudh Srinivasan Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260609060024.706-5-ganboing@gmail.com Signed-off-by: Anup Patel

lib: sbi: Add variable-length unprivilege access functions

2026-06-17T06:11:11+00:00

sbi_load/store_loop read/write variable-length buffer unprivileged. Both function use the widest aligned 8/4/2/1 byte load/stores in each loop to reduce the total number of iterations. Also switch the scalar/vector misaligned handlers to make use of such functions to simplify code. Miscellaneous: remove the unnecessary [taddr] in inline assembly Signed-off-by: Bo Gan Tested-by: Anirudh Srinivasan Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260609060024.706-4-ganboing@gmail.com Signed-off-by: Anup Patel

lib: sbi: Rework and split sbi_misaligned(_v)_tinst_fixup

2026-06-17T06:07:19+00:00

The load/store address offset between the uptrap and the orig_trap can be derived by orig_trap->tval - uptrap->tval, thus refactor the function prototype for simplicity. For vector load, sbi_misaligned_v_tinst_fixup is introduced. There's no transformed instruction for vector load/store, so null out tinst if the fault is not a guest-page fault. Signed-off-by: Bo Gan Tested-by: Anirudh Srinivasan Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260609060024.706-3-ganboing@gmail.com Signed-off-by: Anup Patel

lib: sbi: cosmetic changes to reduce indentation

2026-06-17T05:53:05+00:00

In preparation for subsequent patches. Signed-off-by: Bo Gan Tested-by: Anirudh Srinivasan Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260609060024.706-2-ganboing@gmail.com Signed-off-by: Anup Patel