riscv: Add supervisor pointer masking infrastructure

[RFC PATCH 0/3] riscv: Add supervisor pointer masking infrastructure

Xie Bo posted 3 patches 3 days, 16 hours ago

Download series mbox

arch/riscv/Kconfig                |  23 ++++
arch/riscv/include/asm/sbi.h      |   1 +
arch/riscv/include/asm/sspm.h     |  78 ++++++++++++
arch/riscv/kernel/Makefile        |   1 +
arch/riscv/kernel/cpu-hotplug.c   |   3 +-
arch/riscv/kernel/hibernate.c     |  12 ++
arch/riscv/kernel/machine_kexec.c |  10 +-
arch/riscv/kernel/sbi.c           |  29 +++++
arch/riscv/kernel/setup.c         |   2 +
arch/riscv/kernel/smp.c           |   2 +
arch/riscv/kernel/smpboot.c       |  11 +-
arch/riscv/kernel/sspm.c          | 202 ++++++++++++++++++++++++++++++
12 files changed, 368 insertions(+), 6 deletions(-)
create mode 100644 arch/riscv/include/asm/sspm.h
create mode 100644 arch/riscv/kernel/sspm.c

Expand all Fold all

[RFC PATCH 0/3] riscv: Add supervisor pointer masking infrastructure

Posted by Xie Bo 3 days, 16 hours ago

RVA23 requires an Sspm execution environment to provide supervisor-mode
pointer masking with at least PMLEN=0 and PMLEN=7. SBI 3.0 FWFT provides
the standard per-hart interface for selecting that value.

This RFC adds the architecture-private lifecycle needed by a future
in-kernel tagged-pointer consumer. It deliberately does not enable pointer
masking at boot and adds no userspace ABI, DT binding, hwprobe key, HWCAP,
or cpuinfo token.

The consumer API performs an all-online-hart PMLEN=7 transaction. It only
publishes success after every online hart accepts the setting, rolls back
the complete mask before publishing failure, and rejects an incompatible
hart before it becomes online after successful enablement.

The lifecycle code also restores a known setting across CPU hotplug and
hibernation, clears retained state at boot, and clears every hart at its
final kexec handoff point so an older successor kernel cannot inherit
PMLEN=7. Returning to normal execution with an unknown retained PMLEN is
treated as fatal.

Patch 2 is an independent RISC-V kexec fix: KEXEC_FILE-only SMP builds
need HOTPLUG_CPU for machine_shutdown() to offline secondary harts. It
is placed before the Sspm lifecycle code because safe outgoing handoff
depends on that guarantee.

There is no tagged-pointer consumer in this series. I am sending this as an
RFC to get feedback on the API, lifecycle boundaries, failure policy, and
whether the infrastructure should instead be carried with its first
consumer.

Specifications:

  Pointer Masking Extensions, version 1.0
  https://docs.riscv.org/reference/isa/v20260120/priv/zpm.html

  RISC-V SBI specification, FWFT extension
  https://docs.riscv.org/reference/sbi/_attachments/riscv-sbi.pdf

Tested on Linux v7.2-rc4 with a RISC-V cross compiler:

  - W=1 builds with CONFIG_RISCV_ISA_SSPM=y and disabled
  - KEXEC_FILE=y, KEXEC=n SMP configuration selects HOTPLUG_CPU
  - strict checkpatch (apart from the generic new-file MAINTAINERS warning)
  - sequential git apply --check against v7.2-rc4

Runtime SBI 3.0 FWFT, CPU hotplug, hibernation, kexec, and crash-kexec
tests have not yet been performed.

Xie Bo (3):
  riscv: sbi: Add FWFT get helper
  riscv: kexec: Select HOTPLUG_CPU for KEXEC_FILE
  riscv: Add supervisor pointer masking control

 arch/riscv/Kconfig                |  23 ++++
 arch/riscv/include/asm/sbi.h      |   1 +
 arch/riscv/include/asm/sspm.h     |  78 ++++++++++++
 arch/riscv/kernel/Makefile        |   1 +
 arch/riscv/kernel/cpu-hotplug.c   |   3 +-
 arch/riscv/kernel/hibernate.c     |  12 ++
 arch/riscv/kernel/machine_kexec.c |  10 +-
 arch/riscv/kernel/sbi.c           |  29 +++++
 arch/riscv/kernel/setup.c         |   2 +
 arch/riscv/kernel/smp.c           |   2 +
 arch/riscv/kernel/smpboot.c       |  11 +-
 arch/riscv/kernel/sspm.c          | 202 ++++++++++++++++++++++++++++++
 12 files changed, 368 insertions(+), 6 deletions(-)
 create mode 100644 arch/riscv/include/asm/sspm.h
 create mode 100644 arch/riscv/kernel/sspm.c

base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f
-- 
2.17.1