[PATCH v5 4/9] lib: sbi_hart: lock mwid CSR for RoT immutability

[Pawandeep Oza]

On Tue, Nov 10, 2026 at 1:50 AM Yu-Chien Peter Lin <peter.lin at sifive.com> wrote:
>
> Lock the M-mode World ID (mwid) CSR during hart re-initialization
> to enforce immutability of the WID established by the root-of-trust.
>
> OpenSBI does not assign the WID value itself; it only sets MWID_LOCK
> to freeze the value established by prior RoT stage. The MWID_LOCK bit
> at XLEN-1 is sticky and makes the CSR read-only until reset, enforcing
> a temporal security boundary per the RISC-V Worlds specification.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin at sifive.com>
> ---
> Changes v4->v5:
> - Move the MWID lock out of sbi_hart_reinit() into smwid_hart_init()
> - Drop RB-tags from Oza and Anup
> ---
>  lib/sbi/sbi_hart.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
>
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index d86abf07..a721bef4 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -469,6 +469,16 @@ static int hart_mhpm_get_allowed_bits(void)
>         return num_bits;
>  }
>
> +static void smwid_hart_init(struct sbi_scratch *scratch)
> +{
> +       /*
> +        * Assume MWID is restored by root-of-trust M-mode in previous
> +        * stage. Lock mwid so RoT-defined WID remains immutable.
> +        */
> +       if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWID))
> +               csr_set(CSR_MWID, MWID_LOCK);
> +}
> +
>  static int smrnmi_hart_init(struct sbi_scratch *scratch)
>  {
>         const struct sbi_platform *plat;
> @@ -721,6 +731,8 @@ int sbi_hart_reinit(struct sbi_scratch *scratch)
>  {
>         int rc;
>
> +       smwid_hart_init(scratch);
> +
>         rc = smrnmi_hart_init(scratch);
>         if (rc)
>                 return rc;
> --
> 2.43.7
>
Reviewed-by: Pawandeep Oza <pawandeep.oza at oss.qualcomm.com>