[PATCH 2/5] lib: sbi: Workaround for FENCE(.I) errata on C906, C910.

[Radim Krčmář]

2025-10-26T21:21:56+01:00, Benedikt Freisen <b.freisen at gmx.net>:
> According to the RISCVuzz paper by Thomas et al., the T-Head/Xuantie C906
> and C910 cores fail to ignore reserved fields in the "fence" and "fence.i"
> encodings and trigger illegal instruction traps if these fields are non-zero,
> so address that in the illegal instruction trap handler.
>
> Signed-off-by: Benedikt Freisen <b.freisen at gmx.net>
> ---
> diff --git a/include/sbi/riscv_encoding.h b/include/sbi/riscv_encoding.h
> @@ -944,8 +944,12 @@
> +#define INSN_MASK_FENCE			0xf000707f

Bits 31, 30, 29, and 28 should not be a part of the mask, because any
reserved value there must be treated as 0b0000.

> +#define INSN_MATCH_FENCE		0x0000000f
>  #define INSN_MASK_FENCE_TSO		0xffffffff

(Related: INSN_MASK_FENCE_TSO should ignore the reserved rs1/rd fields,
 but covering that encoding with the new IORW fence is acceptable.)

>  #define INSN_MATCH_FENCE_TSO		0x8330000f
> +#define INSN_MASK_FENCE_I		0x0000707f
> +#define INSN_MATCH_FENCE_I		0x0000100f
> diff --git a/lib/sbi/sbi_illegal_insn.c b/lib/sbi/sbi_illegal_insn.c
> @@ -42,6 +42,21 @@ static int misc_mem_opcode_insn(ulong insn, struct sbi_trap_regs *regs)
> +	/* Errata workaround: C906, C910 fail to ignore reserved fields
> +	 * in the `fence` and `fence.i` encodings. [Thomas2024RISCVuzz] */
> +	if ((insn & INSN_MASK_FENCE) == INSN_MATCH_FENCE) {
> +		/* NOTE: Emulation should ideally preserve the `pred` and
> +		 * `succ` fields, but that is not easily possible here. */
> +		mb();
> +		regs->mepc += 4;
> +		return 0;
> +	}
> +	if ((insn & INSN_MASK_FENCE_I) == INSN_MATCH_FENCE_I) {
> +		RISCV_FENCE_I;
> +		regs->mepc += 4;
> +		return 0;
> +	}

Don't we want to hide these workarounds behind a config, so the code
doesn't have to be included in builds for other platorms?

Thanks.