Commit Graph

1365 Commits

Author SHA1 Message Date
Bo Gan a8be5e9478 lib: sbi: Rework misaligned vector load/store
Fix the following issues with misaligned vector load/store:

a. Stack overflow: the mask[VLEN_MAX / 8] variable consumes 8K stack
space, given VLEN_MAX=65536, overflowing the default-sized stack.
There's no need to fetch the whole mask in one go, instead, make it
on-demand. Use a 128-byte mask as local buffer to hold the sliding
window of mask. For rvv load, this is allowed -- from the spec:

  "The destination vector register group for a masked vector
   instruction cannot overlap the source mask register (v0),
   unless the destination vector register is being written with
   a mask value (e.g., compares) or the scalar result of a reduction"

We don't need to worry about the mask getting overwritten.

b. Maintain the value of vstart upon abort (uptrap) to avoid duplicate
work. After fault resolution, the instruction can restart from the
faulting vstart. For Fault-Only-First loads, reset vstart to 0, as
previously done so, to conform to spec.

c. Explicitly set VS dirty in VSSTATUS with SET_VS_DIRTY() if faulting
from V=1, and if any vector register, including vstart/vl/vtype, gets
changed in the handler. It can add 1 unnecessary op to set VS dirty
in M/SSTATUS (not VSSTATUS), where the HW already did, but for code
simplicity, do it anyway. The overhead should be negligible.

Signed-off-by: Bo Gan <ganboing@gmail.com>
Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260609060024.706-5-ganboing@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-17 11:43:38 +05:30
Bo Gan 914aeddaf1 lib: sbi: Add variable-length unprivilege access functions
sbi_load/store_loop read/write variable-length buffer unprivileged.
Both function use the widest aligned 8/4/2/1 byte load/stores in each
loop to reduce the total number of iterations.

Also switch the scalar/vector misaligned handlers to make use of such
functions to simplify code.

Miscellaneous: remove the unnecessary [taddr] in inline assembly

Signed-off-by: Bo Gan <ganboing@gmail.com>
Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260609060024.706-4-ganboing@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-17 11:41:11 +05:30
Bo Gan 1475f147f6 lib: sbi: Rework and split sbi_misaligned(_v)_tinst_fixup
The load/store address offset between the uptrap and the orig_trap
can be derived by orig_trap->tval - uptrap->tval, thus refactor
the function prototype for simplicity.

For vector load, sbi_misaligned_v_tinst_fixup is introduced. There's
no transformed instruction for vector load/store, so null out tinst
if the fault is not a guest-page fault.

Signed-off-by: Bo Gan <ganboing@gmail.com>
Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260609060024.706-3-ganboing@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-17 11:37:19 +05:30
Bo Gan 4120e6dce2 lib: sbi: cosmetic changes to reduce indentation
In preparation for subsequent patches.

Signed-off-by: Bo Gan <ganboing@gmail.com>
Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260609060024.706-2-ganboing@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-17 11:23:05 +05:30
David E. Garcia Porras 3afe63d4e3 lib: sbi: dbtr: do not unconditionally access tdata2/tdata3 CSRs
The current SBI DBTR extension implementation accesses tdata2 and tdata3
without first checking whether either register is implemented on the
underlying hart. This produces an illegal instruction exception on
otherwise spec-compliant cores that legitimately omit one or both
registers.

Per the RISC-V Debug Specification, Chapter 5 (Sdtrig ISA Extension)
and Section 5.7 (Trigger Module Registers):

  Section 5 (Sdtrig introduction):
    "If Sdtrig is implemented, the Trigger Module must support at least
     one trigger. Accessing trigger CSRs that are not used by any of the
     implemented triggers must result in an illegal instruction
     exception. M-Mode and Debug Mode accesses to trigger CSRs that are
     used by any of the implemented triggers must succeed, regardless of
     the current type of the currently selected trigger."

  Section 5.7 (Trigger Module Registers):
    "Attempts to access an unimplemented Trigger Module Register raise
     an illegal instruction exception."

Per-register optionality is also explicit:

  Section 5.7.3 (Trigger Data 2, at 0x7a2):
    "Trigger-specific data. It is optional if no implemented triggers
     use it."

  Section 5.7.4 (Trigger Data 3, at 0x7a3):
    "Trigger-specific data. It is optional if no implemented triggers
     use it."

  Section 5.7.17 (Trigger Extra (RV32), at 0x7a3), which also applies
  via textra64 on RV64:
    "All functionality in this register is optional. Any number of
     upper bits of mhvalue and svalue may be tied to 0. mhselect and
     sselect may only support 0 (ignore)."

Unconditionally accessing tdata2/tdata3 in the install/update/read/
uninstall paths causes SBI calls to fail with an illegal instruction
exception on hardware that does not implement one or both CSRs, even
if the supervisor-supplied trigger configuration does not require the
missing CSR(s).

This patch:

  1. Introduces tdata_read_safe() / tdata_write_safe() helpers that
     wrap csr_read_allowed / csr_write_allowed so that an illegal-
     instruction trap raised by an unimplemented CSR is caught locally
     rather than propagated. On the read path, a trapped read yields
     zero; on the write path, the trap is silently absorbed (writes to
     an unimplemented CSR are no-ops by definition). Every tdata2/tdata3
     read and write in the install/update/read/uninstall paths is
     converted to these helpers.

  2. On the install and update paths, rejects requests that program
     a non-zero trig_tdata2 or trig_tdata3 into an unimplemented CSR
     with SBI_ERR_NOT_SUPPORTED, matching the SBI spec
     wording in sections 19.4 / 19.5:

       "One of the trigger configuration can't be programmed due to
        unimplemented optional bits in tdata1, tdata2, or tdata3
        CSRs."

     Implementation status is probed once per call via the
     tdata_implemented() helper. This only catches the "whole CSR
     unimplemented" case; tied-off WARL bits inside an otherwise-
     implemented CSR are not caught here and would require programming
     the trigger and reading the value back for comparison, which can
     be addressed separately.

  3. Enable tdata3 configuration in the debug trigger install path.

References:
  - RISC-V Debug Specification, Chapter 5 (Sdtrig), sections 5, 5.7,
    5.7.3, 5.7.4, 5.7.17.
  - RISC-V SBI Specification v3.0, Chapter 19 (Debug Triggers
    Extension), sections 19.4, 19.5.

Fixes: 97f234f15c ("lib: sbi: Introduce the SBI debug triggers extension support")
Suggested-by: Nicholas Piggin <npiggin@gmail.com>
Suggested-by: Himanshu Chauhan <himanshu.chauhan@oss.qualcomm.com>
Signed-off-by: David E. Garcia Porras <david.garcia@aheadcomputing.com>
Reviewed-By: Himanshu Chauhan <himanshu.chauhan@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260616170118.3515676-1-david.garcia@aheadcomputing.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-17 09:42:57 +05:30
Oriol Catalan d936372eab lib: sbi: Make per-HART stack size configurable via Kconfig
The per-HART stack size for exception/interrupt handling is currently
hardcoded to 8192 bytes in SBI_PLATFORM_DEFAULT_HART_STACK_SIZE. This
may not be sufficient for platforms with deeper call stacks (e.g. those
enabling additional SBI extensions) or may be wasteful for minimal
platforms.

Introduce a HART_STACK_SIZE Kconfig option in lib/sbi/Kconfig with a
valid range of 8192 to 1048576 bytes and a default of 8192 bytes to
preserve existing behavior. The SBI_PLATFORM_DEFAULT_HART_STACK_SIZE
macro now resolves to CONFIG_HART_STACK_SIZE, allowing all platforms
to benefit from a single configuration knob without any source changes.

Signed-off-by: Oriol Catalan <oriol.catalan@openchip.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/VI0P192MB3062735A6194BB6DA72083499E002@VI0P192MB3062.EURP192.PROD.OUTLOOK.COM
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-16 19:21:11 +05:30
Bo Gan 56c39d1f08 lib: sbi: Rework load/store emulator instruction decoding
Rehaul instruction decoding to fix the following issues:

- We assume the XLEN of previous mode is the same as MXLEN. However,
  RVC instructions decodes differently in RV32 and RV64, so shouldn't
  have assumed that.
- We assume it's a misaligned fault and the load/store offset is 0,
  i.e., base address == fault address, but access faults can have
  non-0 offset (on HW supporting misaligned accesses), so platform
  specific load/store fault handler gets the wrong base address.
- No checking of [63:32] of tinst in RV64, which is explicitly
  required by Privileged ISA 19.6.3. Must reject tinst with non-0
  high 32 bits.

Thus, fix all the above. For misaligned load/store fault, the address
offset should be 0, but we'll validate that on a DEBUG build. On an
optmized build, we kill the use of base address, and use trap address
instead (same as before), which lets the compiler optimize out imm
parsing and other calculations.

I also analyzed the behavior of misaligned fault handler before fix.
With the following conditions met, it can trigger data corruption:

- HW doesn't transform instruction into tinst.
- HW doesn't support misaligned load/store, and OS doesn't enable
  misaligned delegation, thus OpenSBI handler is in effect
- HW supports mixed XLEN, and M mode is running RV64, and the trapping
  mode (U/VS/VU) is running RV32.
- The trapping instruction is c.f{l|s}w(sp).

Due to the incorrect insn decoding, the trapping instruction would
mistakenly be decoded as c.{l|s}d(sp). With this fix, c.f{l|s}w(sp)
in RV32 is now emulated correctly.

Validation:
The patch is validated to have fixed the issue with test cases running
on a modified version of QEMU that exposes misaligned faults [1], and
a further modified version that removes tinst transformation [2]. The
S-mode OS is a local build of Debian Trixie 6.12 kernel that enables
COMPAT (RV32), and the U-mode test application exercises all integer
and floating-point load/store (RVIFD64/32+RVC64/32) instructions with
all possible imm values. The patch is also tested on real HW (Sifive
P550/ESWIN EIC7700), which only supports RV64. On P550, the same test
was validated both in U mode and VU mode, where the host runs a 6.12
ESWIN vendor kernel that has some ESWIN SoC device driver patches [3]
applied, and the guest runs the exact same Debian Trixie 6.12 kernel
mentioned above.

[1] https://github.com/ganboing/qemu/tree/ganboing-misalign
[2] https://github.com/ganboing/qemu/tree/ganboing-misalign-no-tinst
[3] https://github.com/sifiveinc/riscv-linux/tree/rel/kernel-6.12/hifive-premier-p550

Fixes: 7219477f7b ("lib: Use MTINST CSR in misaligned load/store emulation")
Fixes: b5ae8e8a65 ("lib: Add misaligned load/store trap handling")
Fixes: 4c112650bb ("lib: sbi: abstract out insn decoding to unify mem fault handlers")
Signed-off-by: Bo Gan <ganboing@gmail.com>
Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260605113214.242-8-ganboing@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-16 13:42:47 +05:30
Bo Gan eba121b459 lib: sbi: Do not override emulator callback for vector load/store
It's wrong to override the emulator callback in sbi_trap_emulate_load/
store. The function must respect the callback function passed in the
parameter. Hence, let the misaligned emulator callback decide when to
use sbi_misaligned_v_ld/st_emulator. To clean up things, also make the
following changes:

- Add the `insn` parameter to the callback. The trapping insn has been
  fetched by the caller already, whether transformed or directly loaded,
  thus saving the trouble in the callback. Note that you must not rely
  on the length of the `insn`, as it can be a transformed one from tinst

- Also the `tcntx` is added, providing the callback with register values
  to handle vector insn or other customized insns.

- Clarify that the read/write length (rlen/wlen) can be 0, in which
  case it could be a vector load/store or some customized instruction.
  The callback is responsible to handle it accordingly.

Also fixed issues in the sbi_misaligned_v_ld/st_emulator:
a. Redirect the trap when OPENSBI_CC_SUPPORT_VECTOR is not available.
b. Ensure the return code is >0 when no faults are redirected.

Fixes: c2acc5e5b0 ("lib: sbi_misaligned_ldst: Add handling of vector load/store")
Signed-off-by: Bo Gan <ganboing@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Link: https://lore.kernel.org/r/20260605113214.242-6-ganboing@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-16 13:25:27 +05:30
Michael Ellerman 1157eb37e2 lib: sbi_trap_v_ldst: Redirect unhandled traps
When SBI is built with a compiler that doesn't support vector, the
misaligned vector load/store emulation is not built in, the handlers are
just stubs.

Currently the stubs just return 0, causing sbi_trap_emulate_load() to
return without incrementing mepc, meaning the instruction will just
fault again, an infinite loop.

Fix the stubs to use sbi_trap_redirect(), which forwards the trap to the
previous mode, allowing it to be handled there.

Fixes: c2acc5e5 ("lib: sbi_misaligned_ldst: Add handling of vector load/store")
Signed-off-by: Michael Ellerman <mpe@kernel.org>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260530-trap-redirect-v1-1-45d4d333d8c9@kernel.org
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-15 10:21:03 +05:30
Inochi Amaoto dec9141a77 lib: utils/reset: Add litex SoC reset driver
Litex SoC controller supports reboot function by toggling the first
bit of the ctrl register. Add a reset driver so other software can
use it.

Signed-off-by: Inochi Amaoto <inochiama@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260529085234.1682842-1-inochiama@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-15 10:10:25 +05:30
Nicholas Piggin 9c9767504d lib: sbi: Drop fw_rw_offset alignment requirement for single fw region
In a single fw region scheme, there is no separate PMP created for RW
memory. The checks that opensbi does for the alignment between fw_start
and fw_rw_start (using fw_rw_offset) and the power of 2 check for
fw_rw_offset are no longer necessary.

Update sbi_domain_init so that these checks are only done in the non
single fw region scheme.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Co-developed-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Signed-off-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260522-fw_rw_start_alignment-v1-1-362c17331541@oss.tenstorrent.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-13 15:22:32 +05:30
David E. Garcia Porras 3d29f380a6 lib: sbi_pmu: Honor CLEAR_VALUE/AUTO_START for all hardware event types
sbi_pmu_ctr_cfg_match() only acts on SBI_PMU_CFG_FLAG_CLEAR_VALUE and
SBI_PMU_CFG_FLAG_AUTO_START when the event type is SBI_PMU_EVENT_TYPE_HW.
However, pmu_ctr_find_hw() allocates a hardware counter from the same
hw_event_map for SBI_PMU_EVENT_TYPE_HW_CACHE, SBI_PMU_EVENT_TYPE_HW_RAW,
and SBI_PMU_EVENT_TYPE_HW_RAW_V2 as well, and the start/clear helpers
(pmu_ctr_start_hw, pmu_ctr_write_hw) operate on the counter index alone
and are agnostic to the event type. As a result, when a supervisor
configures a HW_CACHE/HW_RAW/HW_RAW_V2 event with these flags, the
counter is programmed and recorded in active_events[] but is never
cleared or started, requiring an extra SBI call to make it count.

Extend the check to cover all hardware-counter event types so that
the configuration flags take effect for HW_CACHE and raw events too.

Deliberately avoiding using "not FW" logic to be explicit about
HW-backed events only.

Fixes: 13d40f21 ("lib: sbi: Add PMU support")
Signed-off-by: David E. Garcia Porras <david.garcia@aheadcomputing.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260522144608.3433470-1-david.garcia@aheadcomputing.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12 18:59:40 +05:30
Evgeny Voevodin b508e6e25e lib: sbi: Apply budget restriction when polling Zkr CSR state transition
Zkr architecture doesn't define a time limit on state transitions
which results in hanging on unresponsive or event-driven platforms.
To prevent this, we need to limit polling iterations and fall back
in case the budget is over, and stack guard keeps its initial value.
The budget is configurable with CONFIG_ZKR_POLL_BUDGET, defaulting
to 1000 iterations. Successful reads do not consume a try.

Signed-off-by: Evgeny Voevodin <evvoevod@tenstorrent.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260519225014.244672-1-evvoevod@tenstorrent.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12 18:59:16 +05:30
Anup Patel ecc92e87a9 platform: generic: Optimize extensions_init() to parse ISA extensions once
Instead of parsing ISA extensions separately for each hart in the
generic_extensions_init() function, it is better to parse ISA extensions
for all available harts in the cold boot path. Also, this allows us
to remove fdt_isa_bitmap from scratch space and directly initialize
"extensions" in struct sbi_hart_features for each hart.

Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260521082625.1520870-3-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12 16:08:29 +05:30
Anup Patel a62385ab80 lib: sbi_hart: No need to clear features in hart_detect_features()
The per-hart features are already zeroed by sbi_scratch_alloc_offset()
for all harts so hart_detect_features() should not explicitly clear
features later.

Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260521082625.1520870-2-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12 16:08:29 +05:30
Marcos Oduardo 7bdcf55705 lib: sbi: add UBSan support
UBSan (Undefined Behavior Sanitizer) is a tool implemented using
compiler instrumentation at runtime that allows checking for
statements whose output is not deterministic or defined by the C
standard. Compiling and running OpenSBI with UBSan instrumentation
will print a message in the console if any sentence performs such
an action.

Support involves two main components:
1. The UBSan implementation hooks (derived from NetBSD),
   used by the compiler to handle the check output.
2. A test suite integrated with the SBI unit test framework to
   verify correct operation at runtime.

Usage:

  make UBSAN=y PLATFORM=generic ...

The test suite is built when both UBSAN=y and CONFIG_SBIUNIT=y are
enabled.

When UBSan is enabled, FW_PAYLOAD_OFFSET may need to be increased
due to the size increase added by the instrumentation. A
value of 0x400000 has been tested.

UBSan adds runtime overhead and is intended for development builds
only, not for production.

Note: This patch marks __stack_chk_guard in sbi_init.c as a weak
symbol to prevent multiple definition errors at compile time with
UBSan instrumentation enabled. This resolves the conflict
between the .globl definitions in sbi_init.c and test_head.S.

Signed-off-by: Marcos Oduardo <marcos.oduardo@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260515163321.2038366-1-marcos.oduardo@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12 11:58:35 +05:30
Anup Patel c175c97a27 lib: sbi: Fix LLVM compile error observed in sbi_mpxy.c
The following LLVM compile error is observed in sbi_mpxy.c:

 CC        lib/sbi/sbi_mpxy.o
lib/sbi/sbi_mpxy.c:535:36: error: result of comparison of constant 18446744073709551615 with
      expression of type 'u32' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
  535 |                     (attrs->msi_info.msi_addr_hi == INVALID_ADDR))
      |                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^  ~~~~~~~~~~~~
lib/sbi/sbi_mpxy.c:534:36: error: result of comparison of constant 18446744073709551615 with
      expression of type 'u32' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
  534 |                     (attrs->msi_info.msi_addr_lo == INVALID_ADDR) &&
      |                      ~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^  ~~~~~~~~~~~~
2 errors generated.

To address the above issue, add u32 typecast to INVALID_ADDR.

Fixes: e92c8fd083 ("sbi: mpxy: define INVALID_ADDR using unsigned long width")
Fixes: 7939bf1329 ("lib: sbi: Add SBI Message Proxy (MPXY) framework")
Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260612062218.172726-1-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-12 11:58:21 +05:30
David E. Garcia Porras d0ae6a91ff lib: sbi_mpxy: Enable MPXY channel MSI availability determination
Use sbi_irqchip_find_device_by_caps() to determine MSI availability
for each MPXY channel based on MSI controller presence in the system
instead of unconditionally disabling it.

Signed-off-by: David E. Garcia Porras <david.garcia@aheadcomputing.com>
Link: https://lore.kernel.org/r/20260608125257.3220114-3-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10 18:13:10 +05:30
Anup Patel 8570b93844 lib: sbi_irqchip: Allow irqchip drivers advertise capabilities
Extend struct sbi_irqchip_device to allow irqchip drivers advertise
interrupt controller capabilities (such as wired interrupt, MSIs, etc).
This further allows other parts of OpenSBI to lookup irqchip devices
based on capabilities.

Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260608125257.3220114-2-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10 18:13:10 +05:30
Nicholas Piggin a59c8fb9fb lib: sbi: Move hart PMP functions to sbi_hart_pmp.c
The sbi_hart_pmp.c looks like a good place for the hart PMP CSR
access functions.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260430045528.420437-9-npiggin@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10 17:55:33 +05:30
Nicholas Piggin 63350c6ea6 lib: sbi: Add hart_ prefix to PMP functions
PMP functions that deal with hart PMP CSRs are given a sbi_hart_ prefix,
to distinguish from RISC-V PMP encoding functions.

The is_pmp_entry_mapped() function is changed a little more, to align
with other PMP conventions, and made to return a bool to make it more
obvious that it returns a bool and not an SBI_ return code.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260430045528.420437-8-npiggin@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10 17:37:49 +05:30
Nicholas Piggin f7738cc1e5 lib: sbi: Add sbi_pmp_is_enabled() helper
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260430045528.420437-7-npiggin@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10 13:25:29 +05:30
Nicholas Piggin 8f1a6164f2 lib: sbi: Add PMP CSR read and write accessors
PMPCFG CSR access is non-trivial as it requires shifting and masking, it
makes PMP manipulation code simpler if this basic CSR read/write access is
abstracted away.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260430045528.420437-6-npiggin@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10 13:23:18 +05:30
Nicholas Piggin e9797b5e57 lib: sbi: Move RISC-V PMP encoding functions to sbi_pmp.c
Create a new file for handling the RISC-V PMP format and the new pmp_t
type, as opposed to hart PMP CSR specific access.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260430045528.420437-4-npiggin@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10 13:17:30 +05:30
Nicholas Piggin c93a89f214 lib: sbi: split PMP encoding and CSR access
Allow PMP encoding functions to be shared with non-hart PMP manipulation
by splitting encoding / decoding and hart PMP CSR access into their own
functions.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260430045528.420437-3-npiggin@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10 09:57:58 +05:30
Nicholas Piggin 8ae3b0985a lib: sbi: Introduce pmp_t type
To help abstract details of PMP encoding and access, add a new pmp_t
type which contains address and cfg in the format of the riscv CSRs.
There is no functional change.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260430045528.420437-2-npiggin@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-10 09:56:29 +05:30
Zishun Yi 73bc794b40 lib: sbi_domain_context: Flush TLB after SATP mode switch
When switching between domains with different satp.MODE values (e.g.
Sv39 to Sv48), the RISC-V ISA permits hardware to use cached translations
from the old virtual-address width if no SFENCE.VMA intervenes. This
constrained-unpredictable behavior is clarified in riscv-isa-manual
PR #2219.

The hart protection re-configuration will anyway do full SFENCE / HFENCE
so move the hart protection re-configuration after register context switch
in switch_to_next_domain_context() to ensure translations from the new
domain's address width are used.

Link: https://github.com/riscv/riscv-isa-manual/pull/2219
Signed-off-by: Zishun Yi <vulab@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260429181747.160033-1-vulab@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-06-09 22:12:48 +05:30
Samuel Holland 547a5bbda7 lib: utils/reset: Remove unused match data
Some drivers inherited FDT match data from the GPIO/syscon reset
drivers, but do not use it for anything. Remove it to avoid confusion.

Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260513224414.1078791-1-samuel.holland@sifive.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-22 10:31:41 +05:30
Himanshu Chauhan e92c8fd083 sbi: mpxy: define INVALID_ADDR using unsigned long width
INVALID_ADDR is used as an all-ones physical address sentinel.
Using -1U only guarantees 32-bit width, so on platforms where
unsigned long is wider it may not expand to all ones after assignment.

Use -1UL so the conversion to unsigned long preserves an all-ones
bit pattern across supported widths.

Fixes: 7939bf1329 ("lib: sbi: Add SBI Message Proxy (MPXY) framework")
Signed-off-by: Himanshu Chauhan <himanshu.chauhan@oss.qualcomm.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260521052838.2174588-1-himanshu.chauhan@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-22 10:31:39 +05:30
Yu-Chien Peter Lin f36acaeb80 lib: utils: fdt_domain: add root-regions-inheritance policy
Introduce root-regions-inheritance DT property to control
copying of root domain memregions. Support 'all' and 'm-only'
modes, always inheriting firmware and M-only regions; behavior
matches m-only policy when property is absent.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260516072906.1427203-1-peter.lin@sifive.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-18 18:20:50 +05:30
Dave Patel 22d7e99ed2 lib: sbi: domain FP/Vector context support for context switch
This patch adds proper support for per-domain floating-point (FP) and
vector (V) contexts in the domain context switch logic. Each domain
now maintains its own FP and vector state, which is saved and restored
during domain switches.

Conditionalize FP and Vector save/restore based on extensions, unconditional
save and restore of floating-point (FP) and Vector registers fails on
generic platform firmware. This firmware must run on multiple platforms
that may lack these extensions.

Address this by conditionally executing FP save/restore only if the underlying
hart supports the F or D extensions. Similarly, perform Vector save/restore
only if the hart supports the Vector extension.

This improves support for multi-domain systems with FP and Vector
extensions, and prevents corruption of FP/Vector state during domain
switches.

Signed-off-by: Dave Patel <dave.patel@riscstar.com>
Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260518083023.997323-4-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-18 14:02:28 +05:30
Dave Patel 718e1d194f lib: sbi: Add floating-point context save/restore support.
Add support for saving and restoring RISC-V floating-point (F/D) extension
state in OpenSBI. This introduces a floating-point context structure and
helper routines to perform full context save and restore.

The floating-point context includes storage for all 32 FPi registers (f0–f31)
along with the fcsr control and status register. The register state is saved
and restored using double-precision load/store instructions (fsd/fld), and
single-precision load/store instructions (fsw/flw) on an RV64 system with
F and D-extension support.

The implementation follows an eager context switching model where the entire
FP state is saved and restored on every context switch. This avoids the need
for trap-based lazy management and keeps the design simple and deterministic.

Signed-off-by: Dave Patel <dave.patel@riscstar.com>
Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260518083023.997323-3-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-18 14:02:28 +05:30
Dave Patel 21461156da lib: sbi: Add RISC-V vector context save/restore support
Eager context switch: Add support for saving and restoring RISC-V vector
extension state in OpenSBI. This introduces a per-hart vector context
structure and helper routines to perform full context save and restore.

The vector context includes vcsr CSRs along with storage for all 32 vector
registers. The register state is saved and restored using byte-wise vector
load/store instructions (vs8r/vl8r).

The implementation follows an eager context switching model where the entire
vector state is saved and restored on every context switch. This provides a
simple and deterministic mechanism without requiring lazy trap-based
management.

Signed-off-by: Dave Patel <dave.patel@riscstar.com>
Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260518083023.997323-2-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-18 14:02:28 +05:30
Anup Patel 79e63bc834 lib: sbi_irqchip: Add support for registering MSI handlers
Some of the drivers (such as APLIC) require capability to registers
MSI handlers from the parent interrupt controller (such as IMSIC)
so add sbi_irqchip_register_msi_handler() for this purpose.

Link: https://lore.kernel.org/r/20260423052339.356900-7-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-12 09:55:58 +05:30
Anup Patel c0d0dd02b1 lib: sbi_irqchip: Allow setting hardware interrupt affinity
The irqchip drivers can provide mechanism to set interrupt affinity
so add hwirq_set_affinity() callback for irqchip drivers and use it
to implement sbi_irqchip_set_affinity() which can be used by other
drivers.

Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260423052339.356900-6-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-12 09:55:58 +05:30
Anup Patel d861447b0b lib: sbi_irqchip: Allow marking hardware interrupts as reserved
Some of the hardware interrupts may be special so allow irqchip
drivers to make these hardware interrupts as reserved. Introduce
sbi_irqchip_register_reserved() for this purpose.

Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260423052339.356900-5-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-12 09:55:58 +05:30
Anup Patel adb4caf765 lib: sbi_irqchip: Allow interrupt client to specify line sensing
The interrupt client should be allowed to specify the line sensing
type of the hwirqs for which it is registering handler. To support
this, add hwirq_flags parameter to hwirq_setup() callback provided
by the irqchip driver.

Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260423052339.356900-4-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-12 09:55:58 +05:30
Anup Patel 255df5d802 lib: sbi_irqchip: Keep the handler list in sorted order for irqchip
Let's keep the handler list in sorted order for irqchip so that
it is easier to allocate unused hardware interrupts based on the
sorted list.

Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260423052339.356900-3-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-12 09:55:58 +05:30
Anup Patel 0d81a78ec5 lib: sbi_irqchip: Check full range for existing handlers in sbi_irqchip_register_handler()
Currently, the sbi_irqchip_register_handler() only checks the first and the
last hardware interrupt for existing handlers which is buggy because there
may be existing handlers between the first and the last hardware interrupt.

Fixes: 0ab0c470d5 ("lib: sbi_irqchip: Allow registering interrupt handlers")
Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260423052339.356900-2-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-12 09:55:58 +05:30
Takumi Hara 9595829a33 lib: sbi_domain: reject overflowing address range in check_addr_range()
sbi_domain_check_addr_range() computes `max = addr + size` without
checking for integer overflow. When a caller passes a size large enough
to wrap around (e.g. addr=0x80000000, size=0xFFFFFFFF80000000), max
becomes less than addr, causing the while(addr < max) validation loop
to be skipped entirely. The function then returns true without
performing any permission checks.

This allows an S-mode caller to bypass domain memory protection and
access M-mode memory through SBI extensions that use address range
validation (e.g. DBCN console write/read).

Add an overflow check after computing max: if size is non-zero and
max wrapped to a value <= addr, reject the request.

Signed-off-by: Takumi Hara <takumihara1226@gmail.com>
Reviewed-by: Rahul Pathak <rahul@summations.net>
Link: https://lore.kernel.org/r/20260319132232.51572-1-takumihara1226@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-11 19:42:38 +05:30
Aurelien Jarno d9637d00bf lib: utils/reset: add SpacemiT P1 PMIC support
The SpacemiT P1 is a PMIC commonly found with SpacemiT CPU like K1. Add
a reset driver for it.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Tested-by: Anand Moon <linux.amoon@gmail.com>
Link: https://lore.kernel.org/r/20260419150857.2705843-3-aurelien@aurel32.net
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-11 19:21:31 +05:30
Aurelien Jarno b10e18ec85 lib: utils/i2c: add minimal SpacemiT I2C driver
Add a simple SpacemiT I2C driver for basic byte transfers over the I2C
bus, prioritizing simplicity over performance. The driver operates in
PIO mode and does not use interrupts, FIFO, or DMA.

The controller is reset at the start of each transaction to ensure a
known initial state, regardless of prior configuration by the kernel.
This also avoids the need for additional error recovery code.

This will be used for communication with onboard PMIC to reset and
power-off the board.

Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Tested-by: Anand Moon <linux.amoon@gmail.com>
Link: https://lore.kernel.org/r/20260419150857.2705843-2-aurelien@aurel32.net
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-11 19:21:31 +05:30
Andrew Jones 5f13f9e13f lib: sbi: Fix hw a/d updating defaults
The Svade dt-binding description states that Svadu should only
be enabled at boot time when only Svadu is present in the DT.
Ensure that's the case. Also, when only Svadu is supported,
disable FWFT.PTE_AD_HW_UPDATING, as we need both to support
toggling.

Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Reviewed-by: Radim Krčmář <radim.krcmar@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260401220845.190680-1-andrew.jones@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-11 19:16:20 +05:30
David E. Garcia Porras 8536a351fd lib: utils/regmap: Fix reg_stride calculation in syscon regmap
The reg_stride field represents the address stride in bytes between
consecutive registers. The Linux kernel regmap framework validates
register accesses using IS_ALIGNED(reg, map->reg_stride) as an address
alignment check (drivers/base/regmap/regmap.c). The Linux kernel syscon
driver (drivers/mfd/syscon.c) sets reg_stride directly to reg_io_width:

  syscon_config.reg_stride = reg_io_width;

The current OpenSBI code incorrectly multiplies reg_io_width by 8,
converting a byte value to bits. Fix this by using reg_io_width directly
as the stride value, consistent with the Linux kernel.

Fixes: f21d8f7d59 ("lib: utils/regmap: Add simple FDT based syscon regmap driver")
Signed-off-by: David E. Garcia Porras <david.garcia@aheadcomputing.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260403202903.3407945-1-david.garcia@aheadcomputing.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-11 11:49:59 +05:30
Michael Ellerman 65bb705f7b lib/sbi_pmu: Don't fallback to fixed counters when sscofpmf && !smcntrpmf
Currently when searching for a hardware counter for an event, if no
programmable counter is available, the code falls back to using a fixed
counter (mcycle/minstret) if one matches the event.

However the fallback is incorrect when sscofpmf is present but
smcntrpmf is not. That's because with sscofpmf, programmable counters
support mode filtering, but the fixed counters do not (without
smcntrpmf). Even if the caller didn't configure mode filtering, by
default programmable counters don't count M mode when sscofpmf is
present, whereas mcycle/minstret do.

Fix the logic to not fallback to a fixed counter if sscofpmf is present
but smcntrpmf is not.

Fixes: 0c304b6619 ("lib: sbi: Allow programmable counters to monitor cycle/instret events")
Signed-off-by: Michael Ellerman <mpe@kernel.org>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260324-mcycle-fix-v1-1-1444e9fe5c32@kernel.org
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-11 11:30:22 +05:30
Yu-Chien Peter Lin 8cd279e321 lib: fdt_domain: Default boot-hart to coldboot HART for multi-domain boot
When "boot-hart" is not specified, dom->boot_hartid was left as -1U,
causing domain context switching to fail. Default it to the coldboot
HART to enable SMP boot in multi-domain setups, consistent with how
next-arg1 is handled.

Also update its description in domain_support.md.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260327054936.3462935-1-peter.lin@sifive.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-11 10:11:06 +05:30
Anup Patel ae8f28a868 lib: utils: Fix LLVM compile error in MPXY client driver for RPMI MM
The following compile error is seen with LLVM compiler:

 CC        platform/generic/lib/utils/mpxy/fdt_mpxy_rpmi_mm.o
lib/utils/mpxy/fdt_mpxy_rpmi_mm.c:17:6: error: use of GNU 'missing =' extension in
      designator [-Werror,-Wgnu-designator]
   17 |         [0] {
      |             ^
      |             =
lib/utils/mpxy/fdt_mpxy_rpmi_mm.c:24:6: error: use of GNU 'missing =' extension in
      designator [-Werror,-Wgnu-designator]
   24 |         [1] {
      |             ^
      |             =
2 errors generated.

Add missing "=" in mm_srvcdata[] array initialization to address
the above issue.

Fixes: 0b041e58c0 ("lib: utils: Add MPXY client driver for RPMI MM service group")
Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Reviewed-by: Ranbir Singh <ranbir.singh@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260509161849.2935816-1-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-11 10:08:55 +05:30
Anup Patel 1932ee3f0a lib: sbi_timer: Introduce sbi_timer_compute_delta() and friends
The users of timer event have to compute next_event (aka timer value
in the future) based on desired units and unit frequency. Introduce
sbi_timer_compute_delta() and friends to simplify computing next_event
for timer event users.

Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Link: https://lore.kernel.org/r/20260425104048.2335262-5-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-09 13:16:07 +05:30
Anup Patel b7fa8a246c lib: sbi_timer: Add support for timer events
Currently, the sbi_timer only supports timer events configured via
SBI calls. Introduce struct sbi_timer_event and related functions
to allow configuring timer events from any part of OpenSBI.

Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Link: https://lore.kernel.org/r/20260425104048.2335262-4-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-09 13:16:05 +05:30
Anup Patel 357fae4820 lib: sbi_timer: Introduce per-HART timer state
Currently, only time_delta is per-HART so introduce per-HART timer
state for having more per-HART timer information.

Signed-off-by: Anup Patel <anup.patel@oss.qualcomm.com>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Link: https://lore.kernel.org/r/20260425104048.2335262-3-anup.patel@oss.qualcomm.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-05-09 13:15:43 +05:30