opensbi.git, branch v1.9

include: Bump-up version to 1.9

2026-06-30T14:19:54Z

Update the OpenSBI version to 1.9 as part of release preparation. Signed-off-by: Anup Patel

firmware: Fix comment after relocation completion

2026-06-28T08:38:14Z

After relocation is done, the code is running from the load address, not the link address. Fix the comment to correctly reflect this. Signed-off-by: Zong Li Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260626022121.1885209-1-zong.li@sifive.com Signed-off-by: Anup Patel

lib: sbi_pmu: fix integer overflow in pmu_ctr_idx_validate

2026-06-28T08:34:17Z

pmu_ctr_idx_validate() checks whether counter indices are in range using cbase + sbi_fls(cmask) < total_ctrs. Both operands are unsigned long, so a crafted cbase close to ULONG_MAX causes the addition to wrap around to a small value that passes the comparison. Once validation is bypassed, sbi_pmu_ctr_cfg_match() with the SKIP_MATCH flag uses the overflowed index directly as an array subscript into phs->active_events[], producing an out-of-bounds read in M-mode. Through the firmware-event code path, the same overflowed index reaches fw_counters_data[] and fw_counters_started, giving an attacker OOB write-zero and OOB bit-set primitives in M-mode memory. Fix pmu_ctr_idx_validate() by checking for unsigned overflow before the comparison, and add a secondary bounds check on cidx_first in the SKIP_MATCH path so that even if validation is somehow bypassed in the future, the array access remains bounded. Signed-off-by: liutong Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260624035049.1753003-1-liutong@iscas.ac.cn Signed-off-by: Anup Patel

platform: generic: spacemit: k1: fix wrong address definitions

2026-06-28T05:46:36Z

PMU_AP_CORE2_IDLE_CFG and PMU_AP_CORE3_IDLE_CFG are not continuous with PMU_AP_CORE0_IDLE_CFG and PMU_AP_CORE1_IDLE_CFG. They are at PMU AP base + 0x160 and + 0x164, matching the vendor OpenSBI definitions. After fixing these addresses, the intermediate cluster offset macros are redundant now, so define the wakeup and idle registers directly as PMU_AP_BASE offsets. This makes the actual register addresses easier to inspect and compare against the vendor code. C1_RVBADDR_HI_ADDR is also corrected according to the vendor OpenSBI definition. This was tested by writing an invalid value to the corrected address, which prevents cluster1 CPUs from coming online, while doing the same with the old address does not affect SMP boot. Fixes: 1f84ec2a ("platform: generic: spacemit: add K1") Signed-off-by: Junhui Liu Link: https://lore.kernel.org/r/20260623-k1-fix-addr-v1-1-3dbde8c03bd6@pigmoral.tech Signed-off-by: Anup Patel

platform: generic: mips eyeq7h: fix boot with JTAG

2026-06-28T05:38:13Z

When JTAG is connected, internal logic leads to the bit MIPS_CTL0_DBG_RST_DASRT (for the debug unit) stay high and this prevents normal cluster power-up. Force proper power-on reset value prior to power-up sequence. Hold this value for about 10 usec Signed-off-by: Vladimir Kondratiev Link: https://lore.kernel.org/r/20260618103713.2588984-1-vladimir.kondratiev@mobileye.com Signed-off-by: Anup Patel

lib: sbi: Rework misaligned vector load/store

2026-06-17T06:13:38Z

Fix the following issues with misaligned vector load/store: a. Stack overflow: the mask[VLEN_MAX / 8] variable consumes 8K stack space, given VLEN_MAX=65536, overflowing the default-sized stack. There's no need to fetch the whole mask in one go, instead, make it on-demand. Use a 128-byte mask as local buffer to hold the sliding window of mask. For rvv load, this is allowed -- from the spec: "The destination vector register group for a masked vector instruction cannot overlap the source mask register (v0), unless the destination vector register is being written with a mask value (e.g., compares) or the scalar result of a reduction" We don't need to worry about the mask getting overwritten. b. Maintain the value of vstart upon abort (uptrap) to avoid duplicate work. After fault resolution, the instruction can restart from the faulting vstart. For Fault-Only-First loads, reset vstart to 0, as previously done so, to conform to spec. c. Explicitly set VS dirty in VSSTATUS with SET_VS_DIRTY() if faulting from V=1, and if any vector register, including vstart/vl/vtype, gets changed in the handler. It can add 1 unnecessary op to set VS dirty in M/SSTATUS (not VSSTATUS), where the HW already did, but for code simplicity, do it anyway. The overhead should be negligible. Signed-off-by: Bo Gan Tested-by: Anirudh Srinivasan Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260609060024.706-5-ganboing@gmail.com Signed-off-by: Anup Patel

lib: sbi: Add variable-length unprivilege access functions

2026-06-17T06:11:11Z

sbi_load/store_loop read/write variable-length buffer unprivileged. Both function use the widest aligned 8/4/2/1 byte load/stores in each loop to reduce the total number of iterations. Also switch the scalar/vector misaligned handlers to make use of such functions to simplify code. Miscellaneous: remove the unnecessary [taddr] in inline assembly Signed-off-by: Bo Gan Tested-by: Anirudh Srinivasan Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260609060024.706-4-ganboing@gmail.com Signed-off-by: Anup Patel

lib: sbi: Rework and split sbi_misaligned(_v)_tinst_fixup

2026-06-17T06:07:19Z

The load/store address offset between the uptrap and the orig_trap can be derived by orig_trap->tval - uptrap->tval, thus refactor the function prototype for simplicity. For vector load, sbi_misaligned_v_tinst_fixup is introduced. There's no transformed instruction for vector load/store, so null out tinst if the fault is not a guest-page fault. Signed-off-by: Bo Gan Tested-by: Anirudh Srinivasan Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260609060024.706-3-ganboing@gmail.com Signed-off-by: Anup Patel

lib: sbi: cosmetic changes to reduce indentation

2026-06-17T05:53:05Z

In preparation for subsequent patches. Signed-off-by: Bo Gan Tested-by: Anirudh Srinivasan Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260609060024.706-2-ganboing@gmail.com Signed-off-by: Anup Patel

lib: sbi: dbtr: do not unconditionally access tdata2/tdata3 CSRs

2026-06-17T04:12:57Z

The current SBI DBTR extension implementation accesses tdata2 and tdata3 without first checking whether either register is implemented on the underlying hart. This produces an illegal instruction exception on otherwise spec-compliant cores that legitimately omit one or both registers. Per the RISC-V Debug Specification, Chapter 5 (Sdtrig ISA Extension) and Section 5.7 (Trigger Module Registers): Section 5 (Sdtrig introduction): "If Sdtrig is implemented, the Trigger Module must support at least one trigger. Accessing trigger CSRs that are not used by any of the implemented triggers must result in an illegal instruction exception. M-Mode and Debug Mode accesses to trigger CSRs that are used by any of the implemented triggers must succeed, regardless of the current type of the currently selected trigger." Section 5.7 (Trigger Module Registers): "Attempts to access an unimplemented Trigger Module Register raise an illegal instruction exception." Per-register optionality is also explicit: Section 5.7.3 (Trigger Data 2, at 0x7a2): "Trigger-specific data. It is optional if no implemented triggers use it." Section 5.7.4 (Trigger Data 3, at 0x7a3): "Trigger-specific data. It is optional if no implemented triggers use it." Section 5.7.17 (Trigger Extra (RV32), at 0x7a3), which also applies via textra64 on RV64: "All functionality in this register is optional. Any number of upper bits of mhvalue and svalue may be tied to 0. mhselect and sselect may only support 0 (ignore)." Unconditionally accessing tdata2/tdata3 in the install/update/read/ uninstall paths causes SBI calls to fail with an illegal instruction exception on hardware that does not implement one or both CSRs, even if the supervisor-supplied trigger configuration does not require the missing CSR(s). This patch: 1. Introduces tdata_read_safe() / tdata_write_safe() helpers that wrap csr_read_allowed / csr_write_allowed so that an illegal- instruction trap raised by an unimplemented CSR is caught locally rather than propagated. On the read path, a trapped read yields zero; on the write path, the trap is silently absorbed (writes to an unimplemented CSR are no-ops by definition). Every tdata2/tdata3 read and write in the install/update/read/uninstall paths is converted to these helpers. 2. On the install and update paths, rejects requests that program a non-zero trig_tdata2 or trig_tdata3 into an unimplemented CSR with SBI_ERR_NOT_SUPPORTED, matching the SBI spec wording in sections 19.4 / 19.5: "One of the trigger configuration can't be programmed due to unimplemented optional bits in tdata1, tdata2, or tdata3 CSRs." Implementation status is probed once per call via the tdata_implemented() helper. This only catches the "whole CSR unimplemented" case; tied-off WARL bits inside an otherwise- implemented CSR are not caught here and would require programming the trigger and reading the value back for comparison, which can be addressed separately. 3. Enable tdata3 configuration in the debug trigger install path. References: - RISC-V Debug Specification, Chapter 5 (Sdtrig), sections 5, 5.7, 5.7.3, 5.7.4, 5.7.17. - RISC-V SBI Specification v3.0, Chapter 19 (Debug Triggers Extension), sections 19.4, 19.5. Fixes: 97f234f15c96 ("lib: sbi: Introduce the SBI debug triggers extension support") Suggested-by: Nicholas Piggin Suggested-by: Himanshu Chauhan Signed-off-by: David E. Garcia Porras Reviewed-By: Himanshu Chauhan Link: https://lore.kernel.org/r/20260616170118.3515676-1-david.garcia@aheadcomputing.com Signed-off-by: Anup Patel