[RFC PATCH v7 0/6] Add Smsd supervisor domain protection

Sun Nov 1 20:33:51 PST 2026

NOTE: This series is updated for the latest RISC-V SDAP (Supervisor
domains access protection) spec 0.9 which has gone though some changes
which are not yet adapted in Qemu. This series is only for review.
Rest of the coverletter is old and will be Updated once the Qemu is
available with SDAP v0.9 support.

https://github.com/riscv/riscv-smmtt/releases/download/v0.9.0/supervisor-domains.pdf

This series adds OpenSBI support for the RISC-V SDAP specification
sub-extensions - Smsd (supervisor domain).

Together these let M-mode firmware confine each supervisor domain to a
physical address space that is enforced in hardware, via a per domain
memory protection table (MPT) selected by the mmpt CSR.

Every supervisor domain gets its own MPT built from the memory regions
of its SBI domain. Per-region XWR permissions are derived from the
region's S/U access flags from SBI domain, so a region that does not have S/U
access is mapped as an deny instead of skipped.

The Root domain maps all physical memory, with the firmware region explicitly
denied to S-mode. Regions may be shared between domains, each side keeping
its own permissions.

Testing:
Booted Linux when Sdap was active. The boot dump shows the expected per region
permissions. Also checked with a small self-test in Qemu which confirms the
firmware region denied and the kernel region permitted from S-mode.

The Qemu RISC-V Virt machine was used to test this. The new cli args
required to be passed to Qemu are -

./qemu-system-riscv64 -nographic -M virt -cpu rv64,x-smsdid=true,x-smmpt=true

or

./qemu-system-riscv64 -nographic -M virt -cpu rv64,smepmp=true,x-smsdid=true,x-smmpt=true

Boot Logs:

NOTE: The below logs are due the sbi_mpt_dump() function which is
present but not called. Its kept for debugging purposes.

sbi_mpt: mode=Smmpt52    SDIDLEN=6 max_domains=64
root_size=0x1000 root_align=0x1000
fw 0x0000000080000000+0x19e000  pool=global heap
SDID  0 root=0x0000000080098000 regions=9 dom=root
S-Domain0 Region01          : 0x0000000080000000+0x80000           : xwr=0 (---)
S-Domain0 Region02          : 0x0000000080000000+0x200000          : xwr=0 (---)
S-Domain0 Region03          : 0x0000000000100000+0x1000            : xwr=3 (RW-)
S-Domain0 Region04          : 0x0000000010000000+0x1000            : xwr=3 (RW-)
S-Domain0 Region05          : 0x0000000002000000+0x10000           : xwr=0 (---)
S-Domain0 Region06          : 0x000000000c400000+0x200000          : xwr=3 (RW-)
S-Domain0 Region07          : 0x000000000c000000+0x400000          : xwr=3 (RW-)
S-Domain0 Region08          : 0x0000000080000000+0x19e000          : xwr=0 (---) [LOCKED]
S-Domain0 Default           : Rest of the address space            : xwr=7 (RWX)   [baseline, overlay by regions above]
Boot HART ID                : 0
Boot HART Domain            : root
Boot HART Priv Version      : v1.12
Boot HART Base ISA          : rv64imafdch
Boot HART ISA Extensions    : sstc,zicntr,zihpm,zicboz,zicbom,sdtrig,svadu,f,d,smsdid,smmpt
Boot HART PMP Count         : 16
Boot HART PMP Granularity   : 2 bits
Boot HART PMP Address Bits  : 54
Boot HART MHPM Info         : 16 (0x0007fff8)
Boot HART Debug Triggers    : 2 triggers
Boot HART MIDELEG           : 0x0000000000001666
Boot HART MEDELEG           : 0x0000000000f4b509

The corresponding Qemu Smmpt support from LIU Zhiwei
https://patchew.org/QEMU/20260723200325.24969-1-zhiwei._5Fliu@linux.alibaba.com/

This is part of collaboration work for RISC-V SMMTT development. More
details are here:
https://lists.gnu.org/archive/html/qemu-riscv/2026-07/msg01018.html

These OpenSBI changes are also present in github -
https://github.com/pathakraul/opensbi/tree/rpathak_smmpt_v7

Further Development:
This series add base infrastructure for Smsd. Development
and testing with more then one Supervisor Domain. Extensive testing with
all the modes and other platform configurations. SDID allocation through
DT through a per domain property.

v6 -> v7:
  1. Naming convention improvements, changes from smmpt to smsd/mpt.

v5 -> v6:
  1. Revert back to state_finalize callback for per domain state
  finalization(v4) instead of having a notifier.
  2. Introduce memory class for TYPE_MEMORY hart protection mechanisms.
  3. Added the fdt_cpu_has_extension() helper to check for an extension in
  the DT before the hart extensions are parsed.
  4. Updated to RISC-V SMMTT specification v0.9
  5. Allow only root domain to initialize if the SDIDLEN=0 instead of disabling
  MPT for the system.
  6. The MPT heap memory is reserved only when a hart in the DT implements Smsd
  extension.
  7. Rebase on the latest master.

v4 -> v5:
  1. Drop the state_finalize callback on sbi_domain_state
     and use domain finalize notifier built on the registration notifier
     infrastructure instead.
  2. Remove stray text in copyright header in sbi_hart.c.

v3 -> v4:
  1. Drop the map_range/unmap_range rename patch from this series.
  2. Move sbi_mpt_init() function out of the platform.c and make it
     part of the sbi hart protection mechanism.
  3. Drop mpt_early_init() and mpt_final_init() functions. The SMMPT
     core registers the sbi domain state callbacks for initialization,
     activation and cleanup.
  4. Add state_finalize callback in for per domain state finalization.
  5. Address the review comments like typos and add relevant macros
     instead of using numbers for clarity.
  6. Remove the sbi_mpt_dump() function call.

v2 -> v3:
  1. Adapt to sbi hart protection abstraction.
  2. Add missing sbi_mpt_hart_deactivate() decl in sbi_mpt.h.
  3. Rename the *map_range and *unmap_range set of functions in sbi_hart_protection.
  4. Update the copyright string.

v1 -> v2:
  1. Rebase to latest master
  2. Change probe order between mode and sdid.
  3. Add sbi_mpt_query_access() function.
  4. Formatting changes.

Rahul Pathak (6):
  lib: sbi_domain: Add finalize callback for per-domain state
  lib: sbi: Introduce memory class for memory type hart protection
  lib: utils: fdt: Add helper to check for an extension in DT
  riscv: Add Smsd (supervisor domain) hart extensions
  mpt: Add Smsd (supervisor domain) core
  lib: sbi: Initialize Smsd during coldboot

 include/sbi/sbi_domain_state.h     |   22 +
 include/sbi/sbi_hart.h             |    2 +
 include/sbi/sbi_hart_mpt.h         |  314 +++++++++
 include/sbi/sbi_hart_protection.h  |   20 +
 include/sbi_utils/fdt/fdt_helper.h |    4 +
 lib/sbi/objects.mk                 |    2 +
 lib/sbi/sbi_domain.c               |   16 +
 lib/sbi/sbi_domain_state.c         |   25 +
 lib/sbi/sbi_hart.c                 |    7 +
 lib/sbi/sbi_hart_mpt.c             |  991 +++++++++++++++++++++++++++
 lib/sbi/sbi_hart_pmp.c             |    2 +
 lib/sbi/sbi_hart_protection.c      |   84 +--
 lib/sbi/sbi_mpt.c                  | 1000 ++++++++++++++++++++++++++++
 lib/utils/fdt/fdt_helper.c         |   61 +-
 platform/generic/platform.c        |   23 +-
 15 files changed, 2502 insertions(+), 71 deletions(-)
 create mode 100644 include/sbi/sbi_hart_mpt.h
 create mode 100644 lib/sbi/sbi_hart_mpt.c
 create mode 100644 lib/sbi/sbi_mpt.c

-- 
2.53.0