[PATCH v5 4/9] lib: sbi_hart: lock mwid CSR for RoT immutability

[Yu-Chien Peter Lin]

Lock the M-mode World ID (mwid) CSR during hart re-initialization
to enforce immutability of the WID established by the root-of-trust.

OpenSBI does not assign the WID value itself; it only sets MWID_LOCK
to freeze the value established by prior RoT stage. The MWID_LOCK bit
at XLEN-1 is sticky and makes the CSR read-only until reset, enforcing
a temporal security boundary per the RISC-V Worlds specification.

Signed-off-by: Yu-Chien Peter Lin <peter.lin at sifive.com>
---
Changes v4->v5:
- Move the MWID lock out of sbi_hart_reinit() into smwid_hart_init()
- Drop RB-tags from Oza and Anup
---
 lib/sbi/sbi_hart.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index d86abf07..a721bef4 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -469,6 +469,16 @@ static int hart_mhpm_get_allowed_bits(void)
 	return num_bits;
 }
 
+static void smwid_hart_init(struct sbi_scratch *scratch)
+{
+	/*
+	 * Assume MWID is restored by root-of-trust M-mode in previous
+	 * stage. Lock mwid so RoT-defined WID remains immutable.
+	 */
+	if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID))
+		csr_set(CSR_MWID, MWID_LOCK);
+}
+
 static int smrnmi_hart_init(struct sbi_scratch *scratch)
 {
 	const struct sbi_platform *plat;
@@ -721,6 +731,8 @@ int sbi_hart_reinit(struct sbi_scratch *scratch)
 {
 	int rc;
 
+	smwid_hart_init(scratch);
+
 	rc = smrnmi_hart_init(scratch);
 	if (rc)
 		return rc;
-- 
2.43.7