| Age | Commit message (Collapse) | Author |
|---|
|
In a single fw region scheme, there is no separate PMP created for RW
memory. The checks that opensbi does for the alignment between fw_start
and fw_rw_start (using fw_rw_offset) and the power of 2 check for
fw_rw_offset are no longer necessary.
Update sbi_domain_init so that these checks are only done in the non
single fw region scheme.
Signed-off-by: Nicholas Piggin <[email protected]>
Co-developed-by: Anirudh Srinivasan <[email protected]>
Signed-off-by: Anirudh Srinivasan <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/20260522-fw_rw_start_alignment-v1-1-362c17331541@oss.tenstorrent.com
Signed-off-by: Anup Patel <[email protected]>
|
|
sbi_domain_check_addr_range() computes `max = addr + size` without
checking for integer overflow. When a caller passes a size large enough
to wrap around (e.g. addr=0x80000000, size=0xFFFFFFFF80000000), max
becomes less than addr, causing the while(addr < max) validation loop
to be skipped entirely. The function then returns true without
performing any permission checks.
This allows an S-mode caller to bypass domain memory protection and
access M-mode memory through SBI extensions that use address range
validation (e.g. DBCN console write/read).
Add an overflow check after computing max: if size is non-zero and
max wrapped to a value <= addr, reject the request.
Signed-off-by: Takumi Hara <[email protected]>
Reviewed-by: Rahul Pathak <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Hartid is better represented by hex number since it is likely
a combination of bits representing various elements in the
platform hierarchy
Signed-off-by: Vladimir Kondratiev <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
There are 2 locations where memory regions moved in a bulk,
but this implemented in a region-by region move or even swap.
Use more effective way. Note, last entry, dom->regions[count], always
exists and is empty, copying it replaces clear_region()
Signed-off-by: Vladimir Kondratiev <[email protected]>
Reviewed-by: Samuel Holland <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
By default the OpenSBI itself is covered by 2 memregions for RX/RW
sections. This is required by platforms with Smepmp to enforce
proper permissions in M mode. Note: M-mode only regions can't
have RWX permissions with Smepmp. Platforms with traditional PMPs
won't be able to benefit from it, as both regions are effectively
RWX in M mode, but usually it's harmless to so. Now we provide
these platforms with an option to disable this logic. It saves 1
PMP entry. For platforms really in short of PMPs, it does make a
difference.
Note: Platform requesting single OpenSBI memregion must be using
traditional (old) PMP. We expect the platform code to do
the right thing.
Signed-off-by: Bo Gan <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The helper function is renamed as sbi_domain_memregion_is_subset,
and made public in header file.
Also add a convenient helper of sbi_domain_for_each_memregion_idx.
Signed-off-by: Bo Gan <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Factor out logic in `sbi_hart_oldpmp_configure` into function
`sbi_domain_get_oldpmp_flags`, analogous to `sbi_domain_get_smepmp_flags`.
Platform specific hart-protection implementation can now leverage it.
Signed-off-by: Bo Gan <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Currently, platforms do not provide complete memory region information
to OpenSBI. Generally, memory regions are only created for the few MMIO
devices that have M-mode drivers. As a result, most MMIO devices fall
inside the default S-mode RWX memory region, which does _not_ have the
MMIO flag set.
In fact, OpenSBI relies on certain S-mode MMIO devices being inside
non-MMIO memory regions. Both fdt_domain_based_fixup_one() and
mpxy_rpmi_sysmis_xfer() call sbi_domain_check_addr() with the MMIO flag
cleared, and that function currently requires an exact flag match. Those
access checks will thus erroneously fail if the platform creates memory
regions with the correct flags for these devices (or for a larger MMIO
region containing these devices).
We should not ignore the MMIO flag entirely, because
sbi_domain_check_addr() is also used to check the permissions of S-mode
shared memory buffers, and S-mode should not be using MMIO device
addresses as memory buffers. But when checking if S-mode is allowed to
do MMIO accesses, we need to recognize that MMIO devices appear in
memory regions both with and without the MMIO flag set.
Signed-off-by: Samuel Holland <[email protected]>
Reviewed-by: Yu-Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Calculate number of used memory regions using helper function when needed.
Signed-off-by: Vladimir Kondratiev <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
In the sanitize_domain, code that checks for the case when one
memory region covered by the other, was never executed. Quote:
/* Sort the memory regions */
for (i = 0; i < (count - 1); i++) {
<snip>
}
/* Remove covered regions */
while(i < (count - 1)) {
Here "while" loop never executed because condition "i < (count - 1)"
is always false after the "for" loop just above.
In addition, when clearing region, "root_memregs_count"
should be adjusted as well, otherwise code that adds memory region
in the "root_add_memregion" will use wrong position:
/* Append the memregion to root memregions */
nreg = &root.regions[root_memregs_count];
empty entry will be created in the middle of regions array, new
regions will be added after this empty entry while sanitizing code
will stop when reaching empty entry.
Fixes: 3b03cdd60ce5 ("lib: sbi: Add regions merging when sanitizing domain region")
Signed-off-by: Vladimir Kondratiev <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
During domain context switches, all PMP entries are reconfigured
which can clear firmware access permissions, causing M-mode access
faults under SmePMP.
Sort domain regions to place firmware regions first, ensuring
consistent firmware PMP entries so they won't be revoked during
domain context switches.
Signed-off-by: Yu-Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Add a new memregion flag, SBI_DOMAIN_MEMREGION_FW and mark the
OpenSBI code and data regions.
Signed-off-by: Yu-Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The reg->flag is encoded with 6 bits to specify RWX
permissions for M-mode and S-/U-mode. However, only
16 of the possible encodings are valid on SmePMP.
Add a warning message when an unsupported permission
encoding is detected.
Signed-off-by: Yu-Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
According to the RISC‑V Privileged Specification, SmePMP
regions that grant no access in any privilege mode are
valid. Allow such regions to be specified.
Signed-off-by: Yu-Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Move sbi_hart_get_smepmp_flags() from sbi_hart.c to sbi_domain.c and
rename it to sbi_domain_get_smepmp_flags() to better reflect its
purpose of converting domain memory region flags to PMP configuration.
Also removes unused parameters (scratch and dom).
Signed-off-by: Yu-Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Simplify the code and improve consistency by using the new macros where
possible. sbi_hart_count() obsoletes sbi_scratch_last_hartindex().
Signed-off-by: Samuel Holland <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Currently, the sbi_sse_init() in cold boot path is called after
sbi_domain_finalize() so boot HART of non-root domains will start
before SSE cold boot init which can cause warm boot of such HARTs
to crash in sbi_sse_init().
To address the above issue, factor-out the non-root domain startup
from sbi_domain_finalize() function as a separate sbi_domain_startup()
function which can be called after sbi_sse_init() in cold boot path.
Fixes: 93f7d819fdeb ("lib: sbi: sse: allow adding new events")
Signed-off-by: Anup Patel <[email protected]>
|
|
As more drivers adding memregions into root domain, the current static limit
of ROOT_REGION_MAX is not sufficient. Increase the limit to accomodate more
memregions.
Signed-off-by: Rahul Pathak <[email protected]>
Signed-off-by: Anup Patel <[email protected]>
|
|
The per-domain hartindex_to_context_table[] is yet another per-domain
data required for implementing hart entry into (or exit from) domain.
Use the recently added domain data support for per-domain hart context
so that a dedicated hartindex_to_context_table[] in struct sbi_domain
is not needed.
Signed-off-by: Anup Patel <[email protected]>
Reviewed-by: Yu Chien Peter Lin <[email protected]>
|
|
Different parts of OpenSBI require their own per-domain data so
introduce domain data (or sbi_domain_data) which can be registered
by any part of OpenSBI. Using the domain data, the domain framework
will create a data pointer for every domain which can be used to
maintain some per-domain state.
Signed-off-by: Anup Patel <[email protected]>
Reviewed-by: Yu Chien Peter Lin <[email protected]>
|
|
The sbi_domain_root_add_memregion() is only used within sbi_domain
implementation so rename and make it a local function.
Signed-off-by: Anup Patel <[email protected]>
Reviewed-by: Samuel Holland <[email protected]>
|
|
This removes redundant hartid to hartindex conversions from four call
sites and provides a net reduction in code size.
Signed-off-by: Samuel Holland <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
This removes several hartid/hartindex conversions, as well as two loops
through the mask for broadcast IPIs.
Signed-off-by: Samuel Holland <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
This removes the compile-time limit on the number of domains. It also
reduces firmware size by about 200 bytes by removing the lookup table.
Signed-off-by: Samuel Holland <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Add spinlock protection to avoid race condition on assigned_harts
during domain context switching. Also, rename/add variables for
accessing the corresponding domain of target/current context.
Signed-off-by: Alvin Chang <[email protected]>
Reviewed-by: Yu Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
The domain context management component in OpenSBI provides basic CPU
context management routines for existing OpenSBI domain. As domain
extension, it was initially designed to facilitate the suspension
and resumption of domains, enabling secure domains to efficiently
share CPU resources.
The patch also provides an addition to the OpenSBI domain to provide
updates on hart-domain assignment and declarations of contexts within
the domain.
Signed-off-by: Qingyu Shang <[email protected]>
Reviewed-by: Yu Chien Peter Lin <[email protected]>
Tested-by: Yu Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
The original code has multiple conversions between hartid and
hartindex. Can call sbi_hartmask_set_hartindex directly to
avoid conversion.
Signed-off-by: Xiang W <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
As the domain will reject a new memory region which has a sub-regions
already in the domain, even the new region is bigger and has the same
flags. This problem can be solved by relaxing region restriction and
rechecking when adding and sanitizing domains.
Signed-off-by: Inochi Amaoto <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Swapping domain region is a common operation when sorting domain region,
so separate it as a function to make code clean.
Signed-off-by: Inochi Amaoto <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Since commit 112daa2e647c ("lib: sbi: Maximize the use of HART index in
sbi_domain") the platform parameter is unused.
Fixes: 112daa2e647c ("lib: sbi: Maximize the use of HART index in sbi_domain")
Signed-off-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
'1' is a 32 bit integer. When shifting it by more than 31 bits it becomes
zero and we get an incorrect return value.
Addresses-Coverity-ID: 1568356 Bad bit shift operation
Fixes: 296e70d69da7 ("lib: sbi: Extend sbi_hartmask to support both hartid and hartindex")
Signed-off-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Xiang W <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Let us maximize the use of HART index in sbi_domain because hartindex
based hartmask access and sbi_scratch lookup is faster.
Signed-off-by: Anup Patel <[email protected]>
|
|
Currently, the sbi_hartmask is indexed by hartid which puts a
limit on hartid to be less than SBI_HARTMASK_MAX_BITS.
We extend the sbi_hartmask implementation to use hartindex and
support updating sbi_hartmask using hartid. This removes the
limit on hartid and existing code works largely unmodified.
Signed-off-by: Xiang W <[email protected]>
Signed-off-by: Anup Patel <[email protected]>
|
|
The hartid to hartindex mapping is now tracked in sbi_scratch so we
don't need sbi_platform_hart_index() and sbi_platform_hart_invalid()
functions hence let us remove them.
Signed-off-by: Anup Patel <[email protected]>
|
|
Since pmp entries have implicit priority on index, previous entries will
deny access to SU on M-mode region. Also, M-mode will not have access to
SU region while previous entries will allow access to M-mode regions.
Signed-off-by: Himanshu Chauhan <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Instead of using a global array indexed by hartid, we should use
scratch space to save per-HART domain pointer.
Signed-off-by: Anup Patel <[email protected]>
Reviewed-by: Andrew Jones <[email protected]>
|
|
Let's use heap allocation in root domain creation instead of using
a fixed size global array.
Signed-off-by: Anup Patel <[email protected]>
Reviewed-by: Andrew Jones <[email protected]>
|
|
We have redundant semicolon at quite a few places so let's remove it.
Signed-off-by: Xiang W <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Because firmware is split into rw/rx segments, it cannot be recorded
by a root_fw_region. This problem is solved by adding a flag
fw_region_inited to sbi_domain.
Signed-off-by: Xiang W <[email protected]>
Reviewed-by: Himanshu Chauhan <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Only privileged domains should be allowed to suspend the entire
system. Give the root domain this property by default and allow
other domains to be given the property by specifying it in the
DT.
Signed-off-by: Andrew Jones <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Minor updates to the comments for language and style fixes.
Signed-off-by: Bin Meng <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
We add sbi_domain_check_addr_range() helper function to check
whether a given address range is accessible under a particular
domain.
Signed-off-by: Anup Patel <[email protected]>
Reviewed-by: Atish Patra <[email protected]>
Reviewed-by: Xiang W <[email protected]>
Reviewed-by: Bin Meng <[email protected]>
Reviewed-by: Andrew Jones <[email protected]>
|
|
sbi_domain_for_each() requires domidx_to_domain_table[] to be
null-terminated. Allocate one extra element which will always
be null.
Signed-off-by: Andrew Jones <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Add two entries for firmware in the root domain:
1. TEXT: fw_start to _fw_rw_offset with RX permissions
2. DATA: _fw_rw_offset to fw_size with RW permissions
These permissions are still not enforced from M-mode but lay
the ground work for enforcing them for M-mode. SU-mode don't
have any access to these regions.
Sample output:
Domain0 Region01 : 0x0000000080000000-0x000000008001ffff M: (R,X) S/U: ()
Domain0 Region02 : 0x0000000080020000-0x000000008003ffff M: (R,W) S/U: ()
Signed-off-by: Himanshu Chauhan <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
With the finer permission semantics, the region access
permissions must be displayed separately for M and SU mode.
Signed-off-by: Himanshu Chauhan <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Tested-by: Anup Patel <[email protected]>
|
|
Change the zero flag to M-mode R/W/X flag for the firmware
region.
Signed-off-by: Himanshu Chauhan <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Tested-by: Anup Patel <[email protected]>
|
|
Use the fine grained permisssion semantics for address validation
of a given region.
Signed-off-by: Himanshu Chauhan <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Tested-by: Anup Patel <[email protected]>
|
|
C language standard uses true/false for the boolean type.
Let's switch to that for better language compatibility.
Signed-off-by: Bin Meng <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Reviewed-by: Samuel Holland <[email protected]>
Tested-by: Samuel Holland <[email protected]>
|
|
For 'reg->order == __riscv_xlen' the term 'BIT(reg->order)' is undefined.
Addresses-Coverity-ID: 1529706 ("Bad bit shift operation")
Signed-off-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Xiang W <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
When order is equal to __riscv_xlen, the shift operation will not perform
any operation, which will cause reg->base & (BIT(reg->order) - 1) to always
be 0, and the condition has not been established.
This patch fixes this bug.
Signed-off-by: Xiang W <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
