[PATCH v3 6/9] lib: sbi_hart_worlds: Implement WID hart protection backend
Pawandeep Oza
pawandeep.oza at oss.qualcomm.com
Tue Oct 27 11:23:45 PDT 2026
On Tue, Oct 27, 2026 at 1:36 AM Yu-Chien Peter Lin <peter.lin at sifive.com> wrote:
>
> Introduce a WID-based hart protection backend that switches World ID
> configurations across domains.
>
> Access to slwid is gated by mwiddeleg (Sswid), which means slwid cannot
> be handled by generic hart_context save/restore. Instead, manage slwid as
> domain state with explicit sequencing:
>
> - configure:
> - Validate and program mlwid and mwiddeleg according to domain policy
> and platform constraints (pmlwidlist/mlwidlist).
> - Restore slwid after mwiddeleg is enabled.
> - unconfigure:
> - Save slwid prior to clearing mwiddeleg.
> - Reset mwiddeleg to 0 to disable Sswid.
>
> Signed-off-by: Yu-Chien Peter Lin <peter.lin at sifive.com>
> ---
> Change v2->v3:
> - Add hart_worlds_validate_wid() to check domain wid against pmlwidlist
> and mlwidlist masks.
> - Add hart_worlds_validate_widdeleg() to check domain widdeleg against
> pmlwidlist and mlwidlist masks.
> - Drop M-mode WID fallback (mwid/pmwid) for mlwid; program dom->wid directly.
> - Adapt to upstream domain state API rename (sbi_domain_data ->
> sbi_domain_state).
> ---
> include/sbi/sbi_hart_worlds.h | 24 ++++
> lib/sbi/objects.mk | 1 +
> lib/sbi/sbi_hart.c | 5 +
> lib/sbi/sbi_hart_worlds.c | 210 ++++++++++++++++++++++++++++++++++
> 4 files changed, 240 insertions(+)
> create mode 100644 include/sbi/sbi_hart_worlds.h
> create mode 100644 lib/sbi/sbi_hart_worlds.c
>
> diff --git a/include/sbi/sbi_hart_worlds.h b/include/sbi/sbi_hart_worlds.h
> new file mode 100644
> index 00000000..91b11023
> --- /dev/null
> +++ b/include/sbi/sbi_hart_worlds.h
> @@ -0,0 +1,24 @@
> +/*
> + * SPDX-License-Identifier: BSD-2-Clause
> + *
> + * Copyright (c) 2026 SiFive Inc.
> + */
> +
> +#ifndef __SBI_HART_WORLDS_H__
> +#define __SBI_HART_WORLDS_H__
> +
> +struct sbi_scratch;
> +
> +/**
> + * Initialize WID hart protection for current HART
> + *
> + * Registers the WID protection mechanism if Smlwid
> + * extension is present.
> + *
> + * @param scratch pointer to scratch space of current HART
> + *
> + * @return 0 on success and negative error code on failure
> + */
> +int sbi_hart_worlds_init(struct sbi_scratch *scratch);
> +
> +#endif /* __SBI_HART_WORLDS_H__ */
> diff --git a/lib/sbi/objects.mk b/lib/sbi/objects.mk
> index ae27d0c5..355ae6e9 100644
> --- a/lib/sbi/objects.mk
> +++ b/lib/sbi/objects.mk
> @@ -77,6 +77,7 @@ libsbi-objs-y += sbi_fwft.o
> libsbi-objs-y += sbi_hart.o
> libsbi-objs-y += sbi_hart_pmp.o
> libsbi-objs-y += sbi_hart_protection.o
> +libsbi-objs-y += sbi_hart_worlds.o
> libsbi-objs-y += sbi_heap.o
> libsbi-objs-y += sbi_math.o
> libsbi-objs-y += sbi_hfence.o
> diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
> index f05d9b5d..6aa6edd5 100644
> --- a/lib/sbi/sbi_hart.c
> +++ b/lib/sbi/sbi_hart.c
> @@ -17,6 +17,7 @@
> #include <sbi/sbi_error.h>
> #include <sbi/sbi_hart.h>
> #include <sbi/sbi_hart_pmp.h>
> +#include <sbi/sbi_hart_worlds.h>
> #include <sbi/sbi_platform.h>
> #include <sbi/sbi_pmu.h>
> #include <sbi/sbi_string.h>
> @@ -762,6 +763,10 @@ int sbi_hart_init(struct sbi_scratch *scratch, bool cold_boot)
> rc = sbi_hart_pmp_init(scratch);
> if (rc)
> return rc;
> +
> + rc = sbi_hart_worlds_init(scratch);
> + if (rc)
> + return rc;
> }
>
> return sbi_hart_reinit(scratch);
> diff --git a/lib/sbi/sbi_hart_worlds.c b/lib/sbi/sbi_hart_worlds.c
> new file mode 100644
> index 00000000..6f582bd2
> --- /dev/null
> +++ b/lib/sbi/sbi_hart_worlds.c
> @@ -0,0 +1,210 @@
> +/*
> + * SPDX-License-Identifier: BSD-2-Clause
> + *
> + * Copyright (c) 2026 SiFive Inc.
> + */
> +
> +#include <sbi/riscv_encoding.h>
> +#include <sbi/sbi_bitops.h>
> +#include <sbi/sbi_console.h>
> +#include <sbi/sbi_domain.h>
> +#include <sbi/sbi_error.h>
> +#include <sbi/sbi_hart.h>
> +#include <sbi/sbi_hart_protection.h>
> +#include <sbi/sbi_hart_worlds.h>
> +#include <sbi/sbi_scratch.h>
> +
> +/**
> + * Initialize the per-hart slwid values of a domain using
> + * the lowest delegated WID as the initial value.
> + *
> + * S-mode OS should choose the desire slwid for it's
> + * U-mode.
> + */
> +static int sbi_hart_worlds_state_setup(struct sbi_domain *dom,
> + struct sbi_domain_state *state,
> + void *state_ptr)
> +{
> + unsigned long widdeleg = dom->widdeleg;
> + unsigned long *slwid = state_ptr;
> + unsigned long init_wid;
> +
> + if (!widdeleg)
> + return SBI_OK;
> +
> + init_wid = sbi_ffs(widdeleg);
> + sbi_for_each_hartindex(i)
> + slwid[i] = init_wid;
> +
> + return SBI_OK;
> +}
> +
> +static struct sbi_domain_state wid_state = {
> + .state_setup = sbi_hart_worlds_state_setup,
> +};
> +
> +static unsigned long *sbi_hart_worlds_slwid_ptr(struct sbi_domain *dom)
> +{
> + unsigned long *slwid;
> +
> + slwid = sbi_domain_state_ptr(dom, &wid_state);
> + if (!slwid || !sbi_hartindex_valid(current_hartindex()))
> + return NULL;
> +
> + return &slwid[current_hartindex()];
> +}
> +
> +static int hart_worlds_validate_wid(struct sbi_scratch *scratch,
> + struct sbi_domain *dom,
> + unsigned long mlwidlist)
> +{
> + struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
> +
> + if (hf->has_pmlwidlist && !(hf->pmlwidlist & BIT_ULL(dom->wid))) {
> + sbi_printf("%s: domain%d WID %u not permitted by"
> + " pmlwidlist\n",
> + __func__, dom->index, dom->wid);
> + return SBI_EINVAL;
> + }
> +
> + if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST) &&
> + !(mlwidlist & BIT_ULL(dom->wid))) {
> + sbi_printf("%s: domain%d WID %u not permitted by"
> + " mlwidlist 0x%lx\n",
> + __func__, dom->index, dom->wid, mlwidlist);
> + return SBI_EINVAL;
> + }
> +
> + return SBI_OK;
> +}
> +
> +/*
> + * Validate that a domain's widdeleg value, parsed from the
> + * "widdeleg" DT property, is permitted on this hart.
> + *
> + * mwiddeleg is a M-mode WARL register, so an S-mode OS must rely
> + * on the "widdeleg" DT property to determine which WIDs it may
> + * delegate to U-mode via slwid. If pmwidlist or mlwidlist silently
> + * filters out any of those WIDs, the S-mode OS's view of the WIDs
> + * available for delegation would be incorrect. Treat this mismatch
> + * as a misconfiguration.
> + */
> +static int hart_worlds_validate_widdeleg(struct sbi_scratch *scratch,
> + struct sbi_domain *dom,
> + unsigned long mlwidlist)
> +{
> + struct sbi_hart_features *hf = sbi_hart_features_ptr(scratch);
> + unsigned long widdeleg = dom->widdeleg;
> +
> + if (!widdeleg)
> + return SBI_OK;
> +
> + if (hf->has_pmlwidlist && (widdeleg & ~hf->pmlwidlist)) {
> + sbi_printf("%s: domain%d widdeleg 0x%lx has WID(s)"
> + " outside pmlwidlist 0x%lx\n",
> + __func__, dom->index, widdeleg,
> + (unsigned long)hf->pmlwidlist);
> + return SBI_EINVAL;
> + }
> +
> + if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST) &&
> + (widdeleg & ~mlwidlist)) {
> + sbi_printf("%s: domain%d widdeleg 0x%lx has WID(s)"
> + " outside mlwidlist 0x%lx\n",
> + __func__, dom->index, widdeleg, mlwidlist);
> + return SBI_EINVAL;
> + }
> +
> + return SBI_OK;
> +}
> +
> +static int sbi_hart_worlds_configure(struct sbi_scratch *scratch,
> + struct sbi_domain *dom)
> +{
> + unsigned long *slwid = NULL;
> + unsigned long mlwidlist = 0;
> + int rc;
> +
> + if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
> + return SBI_OK;
> +
> + if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWIDLIST))
> + mlwidlist = csr_read(CSR_MLWIDLIST);
> +
> + rc = hart_worlds_validate_wid(scratch, dom, mlwidlist);
> + if (rc)
> + return rc;
> +
> + csr_write(CSR_MLWID, dom->wid);
> +
> + if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG))
> + return SBI_OK;
> +
> + rc = hart_worlds_validate_widdeleg(scratch, dom, mlwidlist);
> + if (rc)
> + return rc;
> +
> + /*
> + * Enable Sswid before restoring slwid. A zero mwiddeleg
> + * disables access to slwid, so the order here is required.
> + */
> + csr_write(CSR_MWIDDELEG, dom->widdeleg);
> +
> + if (dom->widdeleg) {
> + slwid = sbi_hart_worlds_slwid_ptr(dom);
> + if (!slwid)
> + return SBI_EINVAL;
> + csr_write(CSR_SLWID, *slwid);
> + }
> +
> + return SBI_OK;
> +}
> +
> +static void sbi_hart_worlds_unconfigure(struct sbi_scratch *scratch,
> + struct sbi_domain *dom)
> +{
> + unsigned long *slwid;
> +
> + if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG) ||
> + !dom->widdeleg)
> + return;
> +
> + /*
> + * Save slwid value before disabling Sswid since the
> + * CSR value may not retain through the disabled period.
> + */
> + slwid = sbi_hart_worlds_slwid_ptr(dom);
> + if (!slwid) {
> + sbi_panic("%s: domain%d has no slwid state\n",
> + __func__, dom->index);
> + }
> + *slwid = csr_read(CSR_SLWID);
> +
> + /* Disable Sswid */
> + csr_write(CSR_MWIDDELEG, 0);
> +}
> +
> +static struct sbi_hart_protection wid_protection = {
> + .name = "wid",
> + .rating = 100,
> + .type = SBI_HART_PROTECTION_TYPE_ID,
> + .configure = sbi_hart_worlds_configure,
> + .unconfigure = sbi_hart_worlds_unconfigure
> +};
> +
> +int sbi_hart_worlds_init(struct sbi_scratch *scratch)
> +{
> + int rc;
> +
> + if (!sbi_hart_has_extension(scratch, SBI_HART_EXT_SMLWID))
> + return 0;
> +
> + if (sbi_hart_has_extension(scratch, SBI_HART_EXT_SMWIDDELEG)) {
> + wid_state.state_size = sizeof(unsigned long) * sbi_hart_count();
> + rc = sbi_domain_register_state(&wid_state);
> + if (rc)
> + return rc;
> + }
> +
> + return sbi_hart_protection_register(&wid_protection);
> +}
> --
> 2.43.7
>
Reviewed-by: Pawandeep Oza <pawandeep.oza at oss.qualcomm.com>
More information about the opensbi
mailing list