| Age | Commit message (Collapse) | Author |
|---|
|
Currently, the trap delegation setup is part of sbi_hart.c and
called via sbi_hart_init() whereas the per-hart trap (aka exception
and interrupt) handling is part of sbi_trap.c.
Move trap delegation init to sbi_trap.c and call it via new
sbi_trap_init() from both cold boot and warm boot path. This
way trap delegation setup is in same place as trap handling.
Signed-off-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Instead of parsing ISA extensions separately for each hart in the
generic_extensions_init() function, it is better to parse ISA extensions
for all available harts in the cold boot path. Also, this allows us
to remove fdt_isa_bitmap from scratch space and directly initialize
"extensions" in struct sbi_hart_features for each hart.
Signed-off-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The per-hart features are already zeroed by sbi_scratch_alloc_offset()
for all harts so hart_detect_features() should not explicitly clear
features later.
Signed-off-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
This patch adds proper support for per-domain floating-point (FP) and
vector (V) contexts in the domain context switch logic. Each domain
now maintains its own FP and vector state, which is saved and restored
during domain switches.
Conditionalize FP and Vector save/restore based on extensions, unconditional
save and restore of floating-point (FP) and Vector registers fails on
generic platform firmware. This firmware must run on multiple platforms
that may lack these extensions.
Address this by conditionally executing FP save/restore only if the underlying
hart supports the F or D extensions. Similarly, perform Vector save/restore
only if the hart supports the Vector extension.
This improves support for multi-domain systems with FP and Vector
extensions, and prevents corruption of FP/Vector state during domain
switches.
Signed-off-by: Dave Patel <[email protected]>
Signed-off-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The Svade dt-binding description states that Svadu should only
be enabled at boot time when only Svadu is present in the DT.
Ensure that's the case. Also, when only Svadu is supported,
disable FWFT.PTE_AD_HW_UPDATING, as we need both to support
toggling.
Signed-off-by: Andrew Jones <[email protected]>
Reviewed-by: Radim Krčmář <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The location of the RNMI/E trap vectors in the Smrnmi extension is
implementation-defined, so platforms with vendor-specific NMI vector
mechanisms must install the firmware's NMI entry points themselves.
Add an smrnmi_handlers_init() callback to sbi_platform_operations that
receives the firmware entry points and lets platform code install them
at the hardware-specific vector locations. Two pointers are passed:
- _trap_rnmi_handler: the dedicated RNMI entry point that saves
context using the Smrnmi MN* CSRs and returns via mnret.
- _trap_handler: the regular M-mode trap entry since RNME is taken
as a regular M-mode trap with NMIE=0.
When Smrnmi is present, install the platform's NMI vectors via the new
callback, initialize MNSCRATCH with the per-hart scratch pointer, and
set MNSTATUS.NMIE.
Smrnmi-enabled platforms must register smrnmi_handlers_init; if the
extension is detected but no callback is registered, sbi_panic() is
called since enabling NMIs without handlers in place would route
subsequent traps into nowhere.
Signed-off-by: Evgeny Voevodin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/88b1470e1e3348d454b4b995a11a85c01914f7af.1778176768.git.evvoevod@tenstorrent.com
Signed-off-by: Anup Patel <[email protected]>
|
|
Smrnmi detection and enablement in the following commits will happen
before any trap-based mechanism. As it relies on device tree, move
sbi_platform_extensions_init() to the beginning of hart_detect_features().
Signed-off-by: Evgeny Voevodin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/d066935990f12e1f4f21cd709eb20afba618b134.1778176768.git.evvoevod@tenstorrent.com
Signed-off-by: Anup Patel <[email protected]>
|
|
Add CSR definitions (MNSCRATCH, MNSTATUS, MNEPC, MNCAUSE) and bit definitions
(MNSTATUS_NMIE, MNSTATUS_MNPV, MNSTATUS_MNPP). Also add SBI_HART_EXT_SMRNMI to
the hart extension enumeration.
Signed-off-by: Evgeny Voevodin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/1c6feb6d359b9827b3c2ad8f4f0e0a4dfd1de911.1778176768.git.evvoevod@tenstorrent.com
Signed-off-by: Anup Patel <[email protected]>
|
|
UBSan detected undefined behavior in sbi_hart.c and sbi_fwft.c (in
the case of sbi_fwft.c, the bug comes from a macro call defined at
sbi_ecall_interface.h) caused by shifting a signed integer into the
sign bit (1 << 31)
This can be fixed by using the 1UL literal, ensuring defined arithmetic.
Please let me know if there’s any other most suitable solution for
this bug.
Signed-off-by: Marcos Oduardo <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The PMP programming is a significant part of sbi_hart.c so factor-out
this into separate sources sbi_hart_pmp.c and sbi_hart_pmp.h for better
maintainability.
Signed-off-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The sbi_hart_pmp_xyz() and sbi_hart_map/unmap_addr() functions can
now be replaced by various sbi_hart_protection_xyz() functions.
Signed-off-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Implement PMP and ePMP based hart protection abstraction so
that usage of sbi_hart_pmp_xyz() functions can be replaced
with sbi_hart_protection_xyz() functions.
Signed-off-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Currently, the unconfiguring PMP is implemented directly inside
switch_to_next_domain_context() whereas rest of the PMP programming
is done via functions implemented in sbi_hart.c.
Introduce a separate sbi_hart_pmp_unconfigure() function so that
all PMP programming is in one place.
Signed-off-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The QoS Identifiers extension (Ssqosid) introduces the srmcfg register,
which configures a hart with two identifiers: a Resource Control ID
(RCID) and a Monitoring Counter ID (MCID). These identifiers accompany
each request issued by the hart to shared resource controllers.
If extension Smstateen is implemented together with Ssqosid, then
Ssqosid also requires the SRMCFG bit in mstateen0 to be implemented. If
mstateen0.SRMCFG is 0, attempts to access srmcfg in privilege modes less
privileged than M-mode raise an illegal-instruction exception. If
mstateen0.SRMCFG is 1 or if extension Smstateen is not implemented,
attempts to access srmcfg when V=1 raise a virtual-instruction exception.
This extension can be found in the RISC-V Instruction Set Manual:
https://github.com/riscv/riscv-isa-manual
Changes in v5:
- Remove SBI_HART_EXT_SSQOSID dependency SBI_HART_PRIV_VER_1_12
Changes in v4:
- Remove extraneous parentheses around SMSTATEEN0_SRMCFG
Changes in v3:
- Check SBI_HART_EXT_SSQOSID when swapping SRMCFG
Changes in v2:
- Remove trap-n-detect
- Context switch CSR_SRMCFG
Signed-off-by: Chen Pei <[email protected]>
Reviewed-by: Radim Krčmář <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Add fw_smepmp_ids bitmap to track PMP entries that protect firmware
regions. Allow us to preserve these critical entries across domain
transitions and check inconsistent firmware entry allocation.
Also add sbi_hart_smepmp_is_fw_region() helper function to query
whether a given SmePMP entry protects firmware regions.
Signed-off-by: Yu-Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Previously, when memory regions exceed available PMP entries,
some regions were silently ignored. If the last entry that covers
the full 64-bit address space is not added to a domain, the next
stage S-mode software won't have permission to access and fetch
instructions from its memory. So return early with error message
to catch such situation.
Signed-off-by: Yu-Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
According to the RISC‑V Privileged Specification, SmePMP
regions that grant no access in any privilege mode are
valid. Allow such regions to be specified.
Signed-off-by: Yu-Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Move sbi_hart_get_smepmp_flags() from sbi_hart.c to sbi_domain.c and
rename it to sbi_domain_get_smepmp_flags() to better reflect its
purpose of converting domain memory region flags to PMP configuration.
Also removes unused parameters (scratch and dom).
Signed-off-by: Yu-Chien Peter Lin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Using ISA string "xsfcease" to detect the support of the custom
instruction "CEASE".
Reviewed-by: Cyan Yang <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Signed-off-by: Nick Hu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Using ISA string "xsfcflushdlone" to detect the support of the
SiFive L1D cache flush custom instruction.
Reviewed-by: Cyan Yang <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Signed-off-by: Nick Hu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The only purpose of this function is to program the initial values of
mideleg and medeleg. However, both of these CSRs are now saved/restored
across non-retentive suspend, so the values from this function are
always overwritten by the restored values.
Signed-off-by: Samuel Holland <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The S-mode should disable Cycle and instruction counter for user space
to avoid side channel attacks. The Linux kernel already does this so that
any random user space code shouldn't be able to monitor cycle/instruction
without higher privilege mode involvement.
Remove the CY/IR bits in scountern in OpenSBI.
Reviewed-by: Anup Patel <[email protected]>
Signed-off-by: Atish Patra <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Allow platforms to implement platform specific PMP setup and
PMP disable functions which are called before actual PMP CSRs
are configured.
Also, implement pmp_set() and pmp_disable() for MIPS P8700.
Signed-off-by: Chao-ying Fu <[email protected]>
Signed-off-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Zicntr extension specifies three read-only CSRs, time, cycle and
instret. It isn't sufficient to report Zicntr is fully supported with
only time CSR detected.
This patch introduces a bitmap to sbi_hart_features to record
availability of these CSRs, which are detected using traps. Zicntr is
reported as present if and only if three CSRs are all available on the
HARTs.
Sites originally depending on SBI_HART_EXT_ZICNTR for detecting
existence of time CSR are switched to detect SBI_HART_CSR_TIME instead.
Suggested-by: Anup Patel <[email protected]>
Signed-off-by: Yao Zi <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
sstateen* and hstateen* CSRs must be zeroed by M-mode if the mstateen*
registers are missing, to avoid security issues.
Reviewed-by: Anup Patel <[email protected]>
Signed-off-by: Radim Krčmář <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
We already detect Smstateen, but Ssstateen exists as well and it doesn't
have the M-state CSRs.
Reviewed-by: Anup Patel <[email protected]>
Signed-off-by: Radim Krčmář <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The current logic clears some bits based on SBI known extensions.
Be safe and do not leave enabled anything that SBI doesn't control.
This is not a breaking change, because the register must be initialized
to 0 by the ISA on reset, but it is better to not depend on it when we
don't need to.
Reviewed-by: Anup Patel <[email protected]>
Signed-off-by: Radim Krčmář <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The Sstateen extension defines 4 sstateen registers, but SBI currently
configures the execution environment to throw illegal instruction
exception when accessing sstateen1-3.
SBI should implement all sstateen registers, so delegate the
implementation to hardware by setting the SE bit.
Reviewed-by: Anup Patel <[email protected]>
Signed-off-by: Radim Krčmář <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Not resetting sstateen is a potential security hole, because U might be
able to access state that S does not properly context-switch.
Similar for hstateen with VS and HS.
Reviewed-by: Anup Patel <[email protected]>
Signed-off-by: Radim Krčmář <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
hstatus.HU must be cleared, because U-mode could otherwise use the
HLS/HSV instructions. This would allow U-mode to read physical memory
directly if vgatp and vsatp was 0.
The remaining fields don't seem like a security vulnerability now, but
clearing the whole CSR is not an issue, so do that be safe.
Reviewed-by: Anup Patel <[email protected]>
Signed-off-by: Radim Krčmář <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
Switch the most obvious cases to new macros.
Reviewed-by: Anup Patel <[email protected]>
Signed-off-by: Radim Krčmář <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
print error message and turncat the string when length
of extension name string exceed buffer size
Signed-off-by: Jimmy Ho <[email protected]>
Reviewed-by: Nick Hu <[email protected]>
Reviewed-by: Zong Li <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
The Control Transfer Records (CTR) extension provides a method to
record a limited branch history in register-accessible internal chip
storage.
This extension is similar to Arch LBR in x86 and BRBE in ARM.
The Extension has been stable and the latest release can be found here
https://github.com/riscv/riscv-control-transfer-records/release
Signed-off-by: Rajnesh Kanwal <[email protected]>
Reviewed-by: Atish Patra <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Anup Patel <[email protected]>
|
|
While sbi_pmu_irq_bit() was used to delegate irq to S-mode, LCOFIP usage
was still hardcoded in various places. This led to change the returned
value of sbi_pmu_irq_bit() to be a bit number rather than a bit mask
since it returns an 'int' and we need to obtain the bit number itself to
handle it in the IRQs handlers. Add a similar function to return the
irq mask which can also be used where the mask is required rather than
the bit itself.
Signed-off-by: Clément Léger <[email protected]>
Reviewed-by: Samuel Holland <[email protected]>
Reviewed-by: Atish Patra <[email protected]>
|
|
CSR_PMPADDRn lower bits may read all-0 or all-1, depending on
the configuration. For TOR it is all-0, for NAPOT - all-1.
Thus if PMP entry was pre-configured as NAPOT, original code would
stop scanning because value read back not equal to the written one.
Mask lower bits before comparison to fix this
Signed-off-by: Vladimir Kondratiev <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Add Ssdbltrp trap handler support for S-mode double trap handling. If
the trap is received while in VS-mode, then the trap is redirected to
S-mode. If caught while in HS-mode, then an error is returned to the top
trap handler which will panic.
Signed-off-by: Clément Léger <[email protected]>
Reviewed-by: Samuel Holland <[email protected]>
|
|
zicfiss and zicfilp introduces new exception (cause=18). Delegate this
exception to S mode because cfi violations in U / S will be reported
via this exception.
Signed-off-by: Deepak Gupta <[email protected]>
Reviewed-by: Samuel Holland <[email protected]>
Reviewed-by: Atish Patra <[email protected]>
|
|
This patch adds support to check for zicfilp / zicfiss extension.
zicfilp record status of hart's ELP state in *status csr. Missing landing
pad sets MPELP in mstatus. When SBI is redirecting back to S/VS/HS, SPELP
is set in sstatus/vsstatus.
Signed-off-by: Deepak Gupta <[email protected]>
Reviewed-by: Atish Patra <[email protected]>
Reviewed-by: Samuel Holland <[email protected]>
|
|
Add support for controlling the pointer masking mode on harts which
support the Smnpm extension. This extension can only exist on harts
where XLEN >= 64 bits. This implementation selects the mode with the
smallest PMLEN that satisfies the caller's requested lower bound.
Signed-off-by: Samuel Holland <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
In `csr_read_allowed` and `csr_write_allowed` macros, has already
converted second param to `ulong`. So delete redundant `ulong`
where uses csr_read/write_allowed macros.
Signed-off-by: Zhang RunMin <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Add support for Svade and Svadu extensions. When both are present in the
device tree, the M-mode firmware should select the Svade extension
to comply with the RVA23 profile, which mandates Svade and lists Svadu as
an optional extension.
Signed-off-by: Yong-Xuan Wang <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Although Mstatus.MPV is set, before executing mret, access to VS mode
registers should use the actual register addresses, not the pseudonyms
of S registers.
Signed-off-by: Pope B.Lei <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
The sbi_hart_ext[] array is missing these two extensions ids. It is
expected that this array contains all the extensions declaration at the
same index of the SBI_HART_EXT_* define. Without this, when adding a new
extension, there is a mismatch between ids and extension names and it
can even display corrupted extension names.
Addresses-Coverity-ID: 1584994 Out-of-bounds read
Fixes: 6bb6b61c27eb ("lib: sbi: Add support for smcsrind and smcdeleg")
Signed-off-by: Clément Léger <[email protected]>
Reviewed-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Smcsrind allows generic indirect CSR access mechanism while
Smcdeleg allows delegating hpmcounters in Supervisor mode.
Enable both extensions and set the appropriate bits in mstateen
and menvcfg.
Co-developed-by: Kaiwen Xue <[email protected]>
Signed-off-by: Atish Patra <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Detect if debug triggers, sdtrig extension, is supported
by the CPU. The support is detected by access traps and
ISA string parsing.
Signed-off-by: Himanshu Chauhan <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
OpenSBI uses time CSR if Zicntr extension present which causes
it to crash on an older QEMU because QEMU generates Zicntr in
the ISA string for unleashed machine which only has CYCLE and
INSTRET counters.
Fixes: 776770d2adbf ("lib: sbi: Using one array to define the
name of extensions")
Signed-off-by: Anup Patel <[email protected]>
Signed-off-by: Anup Patel <[email protected]>
|
|
On platforms with Smepmp, the previous booting stage must enter
OpenSBI with mseccfg.MML == 0. This allows OpenSBI to configure
it's own M-mode only regions without depending on the previous
booting stage.
Signed-off-by: Anup Patel <[email protected]>
|
|
Enable access to some extensions through menvcfg and show them in "Boot
HART ISA Extensions" if they are present in the device tree.
Signed-off-by: Yong-Xuan Wang <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Define an array sbi_hart_ext to map extension ID and name , and use it
for ISA parsing and printing out the supported extensions.
Signed-off-by: Yong-Xuan Wang <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
|
Use 1 variable to store the value of menvcfg.
Signed-off-by: Yong-Xuan Wang <[email protected]>
Reviewed-by: Anup Patel <[email protected]>
|
