summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
5 dayslib: utils/mpxy: Add RPMI MPXY driver for logging service groupHEADmasterSubrahmanya Lingappa
Add RPMI MPXY proxy driver for LOGGING service group so that S-mode can leverage LOGGING service group implemented by the platform microcontroller. Reviewed-by: Rahul Pathak <rahul.pathak@oss.qualcomm.com> Signed-off-by: Subrahmanya Lingappa <subrahmanya.lingappa@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260619103424.990954-1-subrahmanya.lingappa@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
6 daysinclude: Bump-up version to 1.9v1.9Anup Patel
Update the OpenSBI version to 1.9 as part of release preparation. Signed-off-by: Anup Patel <anup@brainfault.org>
9 daysfirmware: Fix comment after relocation completionZong Li
After relocation is done, the code is running from the load address, not the link address. Fix the comment to correctly reflect this. Signed-off-by: Zong Li <zong.li@sifive.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260626022121.1885209-1-zong.li@sifive.com Signed-off-by: Anup Patel <anup@brainfault.org>
9 dayslib: sbi_pmu: fix integer overflow in pmu_ctr_idx_validateliutong
pmu_ctr_idx_validate() checks whether counter indices are in range using cbase + sbi_fls(cmask) < total_ctrs. Both operands are unsigned long, so a crafted cbase close to ULONG_MAX causes the addition to wrap around to a small value that passes the comparison. Once validation is bypassed, sbi_pmu_ctr_cfg_match() with the SKIP_MATCH flag uses the overflowed index directly as an array subscript into phs->active_events[], producing an out-of-bounds read in M-mode. Through the firmware-event code path, the same overflowed index reaches fw_counters_data[] and fw_counters_started, giving an attacker OOB write-zero and OOB bit-set primitives in M-mode memory. Fix pmu_ctr_idx_validate() by checking for unsigned overflow before the comparison, and add a secondary bounds check on cidx_first in the SKIP_MATCH path so that even if validation is somehow bypassed in the future, the array access remains bounded. Signed-off-by: liutong <liutong@iscas.ac.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260624035049.1753003-1-liutong@iscas.ac.cn Signed-off-by: Anup Patel <anup@brainfault.org>
9 daysplatform: generic: spacemit: k1: fix wrong address definitionsJunhui Liu
PMU_AP_CORE2_IDLE_CFG and PMU_AP_CORE3_IDLE_CFG are not continuous with PMU_AP_CORE0_IDLE_CFG and PMU_AP_CORE1_IDLE_CFG. They are at PMU AP base + 0x160 and + 0x164, matching the vendor OpenSBI definitions. After fixing these addresses, the intermediate cluster offset macros are redundant now, so define the wakeup and idle registers directly as PMU_AP_BASE offsets. This makes the actual register addresses easier to inspect and compare against the vendor code. C1_RVBADDR_HI_ADDR is also corrected according to the vendor OpenSBI definition. This was tested by writing an invalid value to the corrected address, which prevents cluster1 CPUs from coming online, while doing the same with the old address does not affect SMP boot. Fixes: 1f84ec2a ("platform: generic: spacemit: add K1") Signed-off-by: Junhui Liu <junhui.liu@pigmoral.tech> Link: https://lore.kernel.org/r/20260623-k1-fix-addr-v1-1-3dbde8c03bd6@pigmoral.tech Signed-off-by: Anup Patel <anup@brainfault.org>
9 daysplatform: generic: mips eyeq7h: fix boot with JTAGVladimir Kondratiev
When JTAG is connected, internal logic leads to the bit MIPS_CTL0_DBG_RST_DASRT (for the debug unit) stay high and this prevents normal cluster power-up. Force proper power-on reset value prior to power-up sequence. Hold this value for about 10 usec Signed-off-by: Vladimir Kondratiev <vladimir.kondratiev@mobileye.com> Link: https://lore.kernel.org/r/20260618103713.2588984-1-vladimir.kondratiev@mobileye.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-17lib: sbi: Rework misaligned vector load/storeBo Gan
Fix the following issues with misaligned vector load/store: a. Stack overflow: the mask[VLEN_MAX / 8] variable consumes 8K stack space, given VLEN_MAX=65536, overflowing the default-sized stack. There's no need to fetch the whole mask in one go, instead, make it on-demand. Use a 128-byte mask as local buffer to hold the sliding window of mask. For rvv load, this is allowed -- from the spec: "The destination vector register group for a masked vector instruction cannot overlap the source mask register (v0), unless the destination vector register is being written with a mask value (e.g., compares) or the scalar result of a reduction" We don't need to worry about the mask getting overwritten. b. Maintain the value of vstart upon abort (uptrap) to avoid duplicate work. After fault resolution, the instruction can restart from the faulting vstart. For Fault-Only-First loads, reset vstart to 0, as previously done so, to conform to spec. c. Explicitly set VS dirty in VSSTATUS with SET_VS_DIRTY() if faulting from V=1, and if any vector register, including vstart/vl/vtype, gets changed in the handler. It can add 1 unnecessary op to set VS dirty in M/SSTATUS (not VSSTATUS), where the HW already did, but for code simplicity, do it anyway. The overhead should be negligible. Signed-off-by: Bo Gan <ganboing@gmail.com> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260609060024.706-5-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-17lib: sbi: Add variable-length unprivilege access functionsBo Gan
sbi_load/store_loop read/write variable-length buffer unprivileged. Both function use the widest aligned 8/4/2/1 byte load/stores in each loop to reduce the total number of iterations. Also switch the scalar/vector misaligned handlers to make use of such functions to simplify code. Miscellaneous: remove the unnecessary [taddr] in inline assembly Signed-off-by: Bo Gan <ganboing@gmail.com> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260609060024.706-4-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-17lib: sbi: Rework and split sbi_misaligned(_v)_tinst_fixupBo Gan
The load/store address offset between the uptrap and the orig_trap can be derived by orig_trap->tval - uptrap->tval, thus refactor the function prototype for simplicity. For vector load, sbi_misaligned_v_tinst_fixup is introduced. There's no transformed instruction for vector load/store, so null out tinst if the fault is not a guest-page fault. Signed-off-by: Bo Gan <ganboing@gmail.com> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260609060024.706-3-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-17lib: sbi: cosmetic changes to reduce indentationBo Gan
In preparation for subsequent patches. Signed-off-by: Bo Gan <ganboing@gmail.com> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260609060024.706-2-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-17lib: sbi: dbtr: do not unconditionally access tdata2/tdata3 CSRsDavid E. Garcia Porras
The current SBI DBTR extension implementation accesses tdata2 and tdata3 without first checking whether either register is implemented on the underlying hart. This produces an illegal instruction exception on otherwise spec-compliant cores that legitimately omit one or both registers. Per the RISC-V Debug Specification, Chapter 5 (Sdtrig ISA Extension) and Section 5.7 (Trigger Module Registers): Section 5 (Sdtrig introduction): "If Sdtrig is implemented, the Trigger Module must support at least one trigger. Accessing trigger CSRs that are not used by any of the implemented triggers must result in an illegal instruction exception. M-Mode and Debug Mode accesses to trigger CSRs that are used by any of the implemented triggers must succeed, regardless of the current type of the currently selected trigger." Section 5.7 (Trigger Module Registers): "Attempts to access an unimplemented Trigger Module Register raise an illegal instruction exception." Per-register optionality is also explicit: Section 5.7.3 (Trigger Data 2, at 0x7a2): "Trigger-specific data. It is optional if no implemented triggers use it." Section 5.7.4 (Trigger Data 3, at 0x7a3): "Trigger-specific data. It is optional if no implemented triggers use it." Section 5.7.17 (Trigger Extra (RV32), at 0x7a3), which also applies via textra64 on RV64: "All functionality in this register is optional. Any number of upper bits of mhvalue and svalue may be tied to 0. mhselect and sselect may only support 0 (ignore)." Unconditionally accessing tdata2/tdata3 in the install/update/read/ uninstall paths causes SBI calls to fail with an illegal instruction exception on hardware that does not implement one or both CSRs, even if the supervisor-supplied trigger configuration does not require the missing CSR(s). This patch: 1. Introduces tdata_read_safe() / tdata_write_safe() helpers that wrap csr_read_allowed / csr_write_allowed so that an illegal- instruction trap raised by an unimplemented CSR is caught locally rather than propagated. On the read path, a trapped read yields zero; on the write path, the trap is silently absorbed (writes to an unimplemented CSR are no-ops by definition). Every tdata2/tdata3 read and write in the install/update/read/uninstall paths is converted to these helpers. 2. On the install and update paths, rejects requests that program a non-zero trig_tdata2 or trig_tdata3 into an unimplemented CSR with SBI_ERR_NOT_SUPPORTED, matching the SBI spec wording in sections 19.4 / 19.5: "One of the trigger configuration can't be programmed due to unimplemented optional bits in tdata1, tdata2, or tdata3 CSRs." Implementation status is probed once per call via the tdata_implemented() helper. This only catches the "whole CSR unimplemented" case; tied-off WARL bits inside an otherwise- implemented CSR are not caught here and would require programming the trigger and reading the value back for comparison, which can be addressed separately. 3. Enable tdata3 configuration in the debug trigger install path. References: - RISC-V Debug Specification, Chapter 5 (Sdtrig), sections 5, 5.7, 5.7.3, 5.7.4, 5.7.17. - RISC-V SBI Specification v3.0, Chapter 19 (Debug Triggers Extension), sections 19.4, 19.5. Fixes: 97f234f15c96 ("lib: sbi: Introduce the SBI debug triggers extension support") Suggested-by: Nicholas Piggin <npiggin@gmail.com> Suggested-by: Himanshu Chauhan <himanshu.chauhan@oss.qualcomm.com> Signed-off-by: David E. Garcia Porras <david.garcia@aheadcomputing.com> Reviewed-By: Himanshu Chauhan <himanshu.chauhan@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260616170118.3515676-1-david.garcia@aheadcomputing.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-16lib: sbi: Make per-HART stack size configurable via KconfigOriol Catalan
The per-HART stack size for exception/interrupt handling is currently hardcoded to 8192 bytes in SBI_PLATFORM_DEFAULT_HART_STACK_SIZE. This may not be sufficient for platforms with deeper call stacks (e.g. those enabling additional SBI extensions) or may be wasteful for minimal platforms. Introduce a HART_STACK_SIZE Kconfig option in lib/sbi/Kconfig with a valid range of 8192 to 1048576 bytes and a default of 8192 bytes to preserve existing behavior. The SBI_PLATFORM_DEFAULT_HART_STACK_SIZE macro now resolves to CONFIG_HART_STACK_SIZE, allowing all platforms to benefit from a single configuration knob without any source changes. Signed-off-by: Oriol Catalan <oriol.catalan@openchip.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/VI0P192MB3062735A6194BB6DA72083499E002@VI0P192MB3062.EURP192.PROD.OUTLOOK.COM Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-16lib: sbi: Rework load/store emulator instruction decodingBo Gan
Rehaul instruction decoding to fix the following issues: - We assume the XLEN of previous mode is the same as MXLEN. However, RVC instructions decodes differently in RV32 and RV64, so shouldn't have assumed that. - We assume it's a misaligned fault and the load/store offset is 0, i.e., base address == fault address, but access faults can have non-0 offset (on HW supporting misaligned accesses), so platform specific load/store fault handler gets the wrong base address. - No checking of [63:32] of tinst in RV64, which is explicitly required by Privileged ISA 19.6.3. Must reject tinst with non-0 high 32 bits. Thus, fix all the above. For misaligned load/store fault, the address offset should be 0, but we'll validate that on a DEBUG build. On an optmized build, we kill the use of base address, and use trap address instead (same as before), which lets the compiler optimize out imm parsing and other calculations. I also analyzed the behavior of misaligned fault handler before fix. With the following conditions met, it can trigger data corruption: - HW doesn't transform instruction into tinst. - HW doesn't support misaligned load/store, and OS doesn't enable misaligned delegation, thus OpenSBI handler is in effect - HW supports mixed XLEN, and M mode is running RV64, and the trapping mode (U/VS/VU) is running RV32. - The trapping instruction is c.f{l|s}w(sp). Due to the incorrect insn decoding, the trapping instruction would mistakenly be decoded as c.{l|s}d(sp). With this fix, c.f{l|s}w(sp) in RV32 is now emulated correctly. Validation: The patch is validated to have fixed the issue with test cases running on a modified version of QEMU that exposes misaligned faults [1], and a further modified version that removes tinst transformation [2]. The S-mode OS is a local build of Debian Trixie 6.12 kernel that enables COMPAT (RV32), and the U-mode test application exercises all integer and floating-point load/store (RVIFD64/32+RVC64/32) instructions with all possible imm values. The patch is also tested on real HW (Sifive P550/ESWIN EIC7700), which only supports RV64. On P550, the same test was validated both in U mode and VU mode, where the host runs a 6.12 ESWIN vendor kernel that has some ESWIN SoC device driver patches [3] applied, and the guest runs the exact same Debian Trixie 6.12 kernel mentioned above. [1] https://github.com/ganboing/qemu/tree/ganboing-misalign [2] https://github.com/ganboing/qemu/tree/ganboing-misalign-no-tinst [3] https://github.com/sifiveinc/riscv-linux/tree/rel/kernel-6.12/hifive-premier-p550 Fixes: 7219477f7b40 ("lib: Use MTINST CSR in misaligned load/store emulation") Fixes: b5ae8e8a650d ("lib: Add misaligned load/store trap handling") Fixes: 4c112650bbb0 ("lib: sbi: abstract out insn decoding to unify mem fault handlers") Signed-off-by: Bo Gan <ganboing@gmail.com> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260605113214.242-8-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-16Makefile: define OPENSBI_DEBUG if DEBUG buildsBo Gan
Signed-off-by: Bo Gan <ganboing@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Link: https://lore.kernel.org/r/20260605113214.242-7-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-16lib: sbi: Do not override emulator callback for vector load/storeBo Gan
It's wrong to override the emulator callback in sbi_trap_emulate_load/ store. The function must respect the callback function passed in the parameter. Hence, let the misaligned emulator callback decide when to use sbi_misaligned_v_ld/st_emulator. To clean up things, also make the following changes: - Add the `insn` parameter to the callback. The trapping insn has been fetched by the caller already, whether transformed or directly loaded, thus saving the trouble in the callback. Note that you must not rely on the length of the `insn`, as it can be a transformed one from tinst - Also the `tcntx` is added, providing the callback with register values to handle vector insn or other customized insns. - Clarify that the read/write length (rlen/wlen) can be 0, in which case it could be a vector load/store or some customized instruction. The callback is responsible to handle it accordingly. Also fixed issues in the sbi_misaligned_v_ld/st_emulator: a. Redirect the trap when OPENSBI_CC_SUPPORT_VECTOR is not available. b. Ensure the return code is >0 when no faults are redirected. Fixes: c2acc5e5b0d8 ("lib: sbi_misaligned_ldst: Add handling of vector load/store") Signed-off-by: Bo Gan <ganboing@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Link: https://lore.kernel.org/r/20260605113214.242-6-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-16include: sbi: set FS dirty in vsstatus when V=1Bo Gan
According to Privileged ISA 19.2.11: Modifying the floating-point state when V=1 causes both fields (vsstatus.FS and the HS-level sstatus.FS) to be set to 3 (Dirty) Fixes: 130e65dd9d44 ("lib: sbi: Implement SET_FS_DIRTY() to make sure the mstatus FS dirty is set") Signed-off-by: Bo Gan <ganboing@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Link: https://lore.kernel.org/r/20260605113214.242-5-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-16include: sbi: Add GET_RDS_NUM/SET(_FP32/_FP64)_RDS macrosBo Gan
These macros can be used to decode rd' and set rd' in RVC instructions Signed-off-by: Bo Gan <ganboing@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Link: https://lore.kernel.org/r/20260605113214.242-4-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-16include: sbi: Add sbi_regs_prev_xlenBo Gan
sbi_regs_prev_xlen reports the xlen of previous mode by decoding from multiple CSRs including mstatus/hstatus/vsstatus Signed-off-by: Bo Gan <ganboing@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Link: https://lore.kernel.org/r/20260605113214.242-3-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-16include: sbi: Add more mstatus and instruction encodingBo Gan
- Add MXL encoding for calculating XLEN. - Add instruction encoding for c.lbu/c.sb, and imm encoding for multiple RVC insn. Signed-off-by: Bo Gan <ganboing@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Link: https://lore.kernel.org/r/20260605113214.242-2-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-15platform: generic: eswin: Add eic770x_hsm and fix warm reset issuesBo Gan
During warm reset, my EIC770X/Hifive Premier P550 can sometimes encounter memory corruption issue crashing Linux boot. Currently the issue is mitigated by having a sbi_printf before writing to the reset register. I analyzed the issue further since then. From the SoC datasheet[1], it's recommended to implement power-down flow as: a. Designate a primary core, and let it broadcast requests to other cores to execute a CEASE insn. Primary core also notifies an "Externel Agent" to start monitoring. b. Primary core waits for other cores to CEASE before it CEASEs. c. "External Agent" waits for primary core to CEASE before resets the Core Complex. It's possible that EIC770X can trigger undefined behavior if the core complex is reset while the harts are actively running. The sbi_printf in the reset handler effectively hides the problem by delaying the reset -- by the time sbi_printf finishes, all other harts will have already landed in the loop in sbi_hsm_hart_wait(), which parks the hart. Without the sbi_printf, I confirmed that other harts haven't reached sbi_hsm_hart_wait yet before current hart resets the SoC. (by debugging) To safely reset, and inspired by the datasheet, the warm reset logic in eic770x.c now use the current hart as both primary core and the "External Agent", and other harts as secondary cores. It leverages the HSM framework and a new eic770x_hsm device to CEASE other harts, and wait for them to CEASE before resets the SoC. with the sbi_printf before reset removed, and this logic in place, stress test shows that the memory corruption issue no longer occurs. The new eic770x_hsm device is only used for the reset-CEASE logic at the moment, and may be extended to a fully functional HSM device in the future. [1] https://github.com/eswincomputing/EIC7700X-SoC-Technical-Reference-Manual Fixes: e5797e0688c1 ("platform: generic: eswin: add EIC7700") Signed-off-by: Bo Gan <ganboing@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260605075708.96-3-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-15include: utils/hsm: Add __noreturn attribute for sifive_ceaseBo Gan
Decorate the sifive_cease to allow more compiler optimizations Signed-off-by: Bo Gan <ganboing@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260605075708.96-2-ganboing@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-15gitignore: Ignore python cache directoriesMichael Ellerman
Running ./scripts/Kconfiglib/setconfig.py leaves the tree with untracked files: Untracked files: (use "git add <file>..." to include in what will be committed) scripts/Kconfiglib/__pycache__/ Add __pycache__ to .gitignore to fix it. Signed-off-by: Michael Ellerman <mpe@kernel.org> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260602-fix-gitignore-v1-1-4299e2e40ee4@kernel.org Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-15lib: sbi_trap_v_ldst: Redirect unhandled trapsMichael Ellerman
When SBI is built with a compiler that doesn't support vector, the misaligned vector load/store emulation is not built in, the handlers are just stubs. Currently the stubs just return 0, causing sbi_trap_emulate_load() to return without incrementing mepc, meaning the instruction will just fault again, an infinite loop. Fix the stubs to use sbi_trap_redirect(), which forwards the trap to the previous mode, allowing it to be handled there. Fixes: c2acc5e5 ("lib: sbi_misaligned_ldst: Add handling of vector load/store") Signed-off-by: Michael Ellerman <mpe@kernel.org> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260530-trap-redirect-v1-1-45d4d333d8c9@kernel.org Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-15lib: utils/reset: Add litex SoC reset driverInochi Amaoto
Litex SoC controller supports reboot function by toggling the first bit of the ctrl register. Add a reset driver so other software can use it. Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260529085234.1682842-1-inochiama@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-13lib: sbi: Drop fw_rw_offset alignment requirement for single fw regionNicholas Piggin
In a single fw region scheme, there is no separate PMP created for RW memory. The checks that opensbi does for the alignment between fw_start and fw_rw_start (using fw_rw_offset) and the power of 2 check for fw_rw_offset are no longer necessary. Update sbi_domain_init so that these checks are only done in the non single fw region scheme. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Co-developed-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Signed-off-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260522-fw_rw_start_alignment-v1-1-362c17331541@oss.tenstorrent.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12lib: sbi_pmu: Honor CLEAR_VALUE/AUTO_START for all hardware event typesDavid E. Garcia Porras
sbi_pmu_ctr_cfg_match() only acts on SBI_PMU_CFG_FLAG_CLEAR_VALUE and SBI_PMU_CFG_FLAG_AUTO_START when the event type is SBI_PMU_EVENT_TYPE_HW. However, pmu_ctr_find_hw() allocates a hardware counter from the same hw_event_map for SBI_PMU_EVENT_TYPE_HW_CACHE, SBI_PMU_EVENT_TYPE_HW_RAW, and SBI_PMU_EVENT_TYPE_HW_RAW_V2 as well, and the start/clear helpers (pmu_ctr_start_hw, pmu_ctr_write_hw) operate on the counter index alone and are agnostic to the event type. As a result, when a supervisor configures a HW_CACHE/HW_RAW/HW_RAW_V2 event with these flags, the counter is programmed and recorded in active_events[] but is never cleared or started, requiring an extra SBI call to make it count. Extend the check to cover all hardware-counter event types so that the configuration flags take effect for HW_CACHE and raw events too. Deliberately avoiding using "not FW" logic to be explicit about HW-backed events only. Fixes: 13d40f21 ("lib: sbi: Add PMU support") Signed-off-by: David E. Garcia Porras <david.garcia@aheadcomputing.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260522144608.3433470-1-david.garcia@aheadcomputing.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12lib: sbi: Apply budget restriction when polling Zkr CSR state transitionEvgeny Voevodin
Zkr architecture doesn't define a time limit on state transitions which results in hanging on unresponsive or event-driven platforms. To prevent this, we need to limit polling iterations and fall back in case the budget is over, and stack guard keeps its initial value. The budget is configurable with CONFIG_ZKR_POLL_BUDGET, defaulting to 1000 iterations. Successful reads do not consume a try. Signed-off-by: Evgeny Voevodin <evvoevod@tenstorrent.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260519225014.244672-1-evvoevod@tenstorrent.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12platform: generic: Optimize extensions_init() to parse ISA extensions onceAnup Patel
Instead of parsing ISA extensions separately for each hart in the generic_extensions_init() function, it is better to parse ISA extensions for all available harts in the cold boot path. Also, this allows us to remove fdt_isa_bitmap from scratch space and directly initialize "extensions" in struct sbi_hart_features for each hart. Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260521082625.1520870-3-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12lib: sbi_hart: No need to clear features in hart_detect_features()Anup Patel
The per-hart features are already zeroed by sbi_scratch_alloc_offset() for all harts so hart_detect_features() should not explicitly clear features later. Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260521082625.1520870-2-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12lib: sbi: add UBSan supportMarcos Oduardo
UBSan (Undefined Behavior Sanitizer) is a tool implemented using compiler instrumentation at runtime that allows checking for statements whose output is not deterministic or defined by the C standard. Compiling and running OpenSBI with UBSan instrumentation will print a message in the console if any sentence performs such an action. Support involves two main components: 1. The UBSan implementation hooks (derived from NetBSD), used by the compiler to handle the check output. 2. A test suite integrated with the SBI unit test framework to verify correct operation at runtime. Usage: make UBSAN=y PLATFORM=generic ... The test suite is built when both UBSAN=y and CONFIG_SBIUNIT=y are enabled. When UBSan is enabled, FW_PAYLOAD_OFFSET may need to be increased due to the size increase added by the instrumentation. A value of 0x400000 has been tested. UBSan adds runtime overhead and is intended for development builds only, not for production. Note: This patch marks __stack_chk_guard in sbi_init.c as a weak symbol to prevent multiple definition errors at compile time with UBSan instrumentation enabled. This resolves the conflict between the .globl definitions in sbi_init.c and test_head.S. Signed-off-by: Marcos Oduardo <marcos.oduardo@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260515163321.2038366-1-marcos.oduardo@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12lib: sbi: Fix LLVM compile error observed in sbi_mpxy.cAnup Patel
The following LLVM compile error is observed in sbi_mpxy.c: CC lib/sbi/sbi_mpxy.o lib/sbi/sbi_mpxy.c:535:36: error: result of comparison of constant 18446744073709551615 with expression of type 'u32' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare] 535 | (attrs->msi_info.msi_addr_hi == INVALID_ADDR)) | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~ lib/sbi/sbi_mpxy.c:534:36: error: result of comparison of constant 18446744073709551615 with expression of type 'u32' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare] 534 | (attrs->msi_info.msi_addr_lo == INVALID_ADDR) && | ~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~ 2 errors generated. To address the above issue, add u32 typecast to INVALID_ADDR. Fixes: e92c8fd0836e ("sbi: mpxy: define INVALID_ADDR using unsigned long width") Fixes: 7939bf1329eb ("lib: sbi: Add SBI Message Proxy (MPXY) framework") Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260612062218.172726-1-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12platform: Fix payload alignment when FW_TEXT_START isn't 2M/4M alignedAnirudh Srinivasan
The payload for FW_PAYLOAD needs to be placed at a 2M/4M aligned address (for 64/32 bit systems) and the current makefile uses FW_PAYLOAD_OFFSET to achieve this. This only works if FW_TEXT_START is already 2M/4M aligned. Most existing physical/virtual platforms have used a FW_TEXT_START of 0x0 or 0x80000000, so this hasn't been an issue so far. If, for example, FW_TEXT_START is 0x80000, the payload would end up placed at 0x280000 on a 64 bit system, which isn't a 2M aligned address. Update the makefile to use FW_PAYLOAD_ALIGN instead. This will ensure that the address picked for the payload is 2M/4M aligned irrespective of where FW_TEXT_START is. Signed-off-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260508-payload_alignment-v1-1-6628b4ec1ed3@oss.tenstorrent.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10include: sbi: Add SBI MPXY notification related definesDavid E. Garcia Porras
The SBI MPXY notification header related offsets are missing from the sbi_ecall_interface.h hence add these defines. Signed-off-by: David E. Garcia Porras <david.garcia@aheadcomputing.com> Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260608125257.3220114-5-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10include: mailbox: Update RPMI notification structs and add performance eventsDavid E. Garcia Porras
Add rpmi_event_notification_state enum with disable, enable, and return current state IDs. Also, add req_state field to rpmi_enable_notification_req and current_state field to rpmi_enable_notification_resp for RPMI specification compliance. Add notification event ID enum and data structures for RPMI Performance service group events: power change, limit change, and level change. Signed-off-by: David E. Garcia Porras <david.garcia@aheadcomputing.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260608125257.3220114-4-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10lib: sbi_mpxy: Enable MPXY channel MSI availability determinationDavid E. Garcia Porras
Use sbi_irqchip_find_device_by_caps() to determine MSI availability for each MPXY channel based on MSI controller presence in the system instead of unconditionally disabling it. Signed-off-by: David E. Garcia Porras <david.garcia@aheadcomputing.com> Link: https://lore.kernel.org/r/20260608125257.3220114-3-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10lib: sbi_irqchip: Allow irqchip drivers advertise capabilitiesAnup Patel
Extend struct sbi_irqchip_device to allow irqchip drivers advertise interrupt controller capabilities (such as wired interrupt, MSIs, etc). This further allows other parts of OpenSBI to lookup irqchip devices based on capabilities. Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260608125257.3220114-2-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10lib: sbi: Move hart PMP functions to sbi_hart_pmp.cNicholas Piggin
The sbi_hart_pmp.c looks like a good place for the hart PMP CSR access functions. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260430045528.420437-9-npiggin@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10lib: sbi: Add hart_ prefix to PMP functionsNicholas Piggin
PMP functions that deal with hart PMP CSRs are given a sbi_hart_ prefix, to distinguish from RISC-V PMP encoding functions. The is_pmp_entry_mapped() function is changed a little more, to align with other PMP conventions, and made to return a bool to make it more obvious that it returns a bool and not an SBI_ return code. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260430045528.420437-8-npiggin@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10lib: sbi: Add sbi_pmp_is_enabled() helperNicholas Piggin
Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260430045528.420437-7-npiggin@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10lib: sbi: Add PMP CSR read and write accessorsNicholas Piggin
PMPCFG CSR access is non-trivial as it requires shifting and masking, it makes PMP manipulation code simpler if this basic CSR read/write access is abstracted away. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260430045528.420437-6-npiggin@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10lib: sbi: Move RISC-V PMP encoding functions to sbi_pmp.cNicholas Piggin
Create a new file for handling the RISC-V PMP format and the new pmp_t type, as opposed to hart PMP CSR specific access. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260430045528.420437-4-npiggin@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10lib: sbi: split PMP encoding and CSR accessNicholas Piggin
Allow PMP encoding functions to be shared with non-hart PMP manipulation by splitting encoding / decoding and hart PMP CSR access into their own functions. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260430045528.420437-3-npiggin@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10lib: sbi: Introduce pmp_t typeNicholas Piggin
To help abstract details of PMP encoding and access, add a new pmp_t type which contains address and cfg in the format of the riscv CSRs. There is no functional change. Signed-off-by: Nicholas Piggin <npiggin@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260430045528.420437-2-npiggin@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-09lib: sbi_domain_context: Flush TLB after SATP mode switchZishun Yi
When switching between domains with different satp.MODE values (e.g. Sv39 to Sv48), the RISC-V ISA permits hardware to use cached translations from the old virtual-address width if no SFENCE.VMA intervenes. This constrained-unpredictable behavior is clarified in riscv-isa-manual PR #2219. The hart protection re-configuration will anyway do full SFENCE / HFENCE so move the hart protection re-configuration after register context switch in switch_to_next_domain_context() to ensure translations from the new domain's address width are used. Link: https://github.com/riscv/riscv-isa-manual/pull/2219 Signed-off-by: Zishun Yi <vulab@iscas.ac.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260429181747.160033-1-vulab@iscas.ac.cn Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-07include: mailbox: rpmi_msgprot: Add RPMI performance domain flag definesDavid E. Garcia Porras
Add bit-field defines for the RPMI performance domain attributes flags and fast-channel attributes flags as specified in the RPMI specification. These are needed by platform implementations that provide RPMI performance services (e.g. DVFS controllers). Also add the missing db_write_value field to rpmi_perf_get_fast_chn_attr_resp to match the RPMI spec layout. Signed-off-by: David E. Garcia Porras <david.garcia@aheadcomputing.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260328054347.3706029-5-david.garcia@aheadcomputing.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-22lib: utils/reset: Remove unused match dataSamuel Holland
Some drivers inherited FDT match data from the GPIO/syscon reset drivers, but do not use it for anything. Remove it to avoid confusion. Signed-off-by: Samuel Holland <samuel.holland@sifive.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260513224414.1078791-1-samuel.holland@sifive.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-22sbi: mpxy: define INVALID_ADDR using unsigned long widthHimanshu Chauhan
INVALID_ADDR is used as an all-ones physical address sentinel. Using -1U only guarantees 32-bit width, so on platforms where unsigned long is wider it may not expand to all ones after assignment. Use -1UL so the conversion to unsigned long preserves an all-ones bit pattern across supported widths. Fixes: 7939bf1329eb ("lib: sbi: Add SBI Message Proxy (MPXY) framework") Signed-off-by: Himanshu Chauhan <himanshu.chauhan@oss.qualcomm.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260521052838.2174588-1-himanshu.chauhan@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-18lib: utils: fdt_domain: add root-regions-inheritance policyYu-Chien Peter Lin
Introduce root-regions-inheritance DT property to control copying of root domain memregions. Support 'all' and 'm-only' modes, always inheriting firmware and M-only regions; behavior matches m-only policy when property is absent. Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260516072906.1427203-1-peter.lin@sifive.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-18lib: sbi: domain FP/Vector context support for context switchDave Patel
This patch adds proper support for per-domain floating-point (FP) and vector (V) contexts in the domain context switch logic. Each domain now maintains its own FP and vector state, which is saved and restored during domain switches. Conditionalize FP and Vector save/restore based on extensions, unconditional save and restore of floating-point (FP) and Vector registers fails on generic platform firmware. This firmware must run on multiple platforms that may lack these extensions. Address this by conditionally executing FP save/restore only if the underlying hart supports the F or D extensions. Similarly, perform Vector save/restore only if the hart supports the Vector extension. This improves support for multi-domain systems with FP and Vector extensions, and prevents corruption of FP/Vector state during domain switches. Signed-off-by: Dave Patel <dave.patel@riscstar.com> Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260518083023.997323-4-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-18lib: sbi: Add floating-point context save/restore support.Dave Patel
Add support for saving and restoring RISC-V floating-point (F/D) extension state in OpenSBI. This introduces a floating-point context structure and helper routines to perform full context save and restore. The floating-point context includes storage for all 32 FPi registers (f0–f31) along with the fcsr control and status register. The register state is saved and restored using double-precision load/store instructions (fsd/fld), and single-precision load/store instructions (fsw/flw) on an RV64 system with F and D-extension support. The implementation follows an eager context switching model where the entire FP state is saved and restored on every context switch. This avoids the need for trap-based lazy management and keeps the design simple and deterministic. Signed-off-by: Dave Patel <dave.patel@riscstar.com> Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260518083023.997323-3-anup.patel@oss.qualcomm.com Signed-off-by: Anup Patel <anup@brainfault.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-07-07 01:12:57 +0000