wolfBoot/src
Daniele Lacamera f573e97e76 F-11029: publish IPI fence completion only after the fence executes
sbi_ipi_irq() read-and-cleared the per-hart op word before executing
the requested fence.i/sfence.vma, and sbi_wait_ipi_done() treated a
zero op word as completion. The SBI remote-fence ecalls are
synchronous, so a requester could return while the target had not yet
run its fence (e.g. resume relying on a new page table before the
target flushed its TLB).

Split the protocol into pending work and completion state, per hart:
ipi_done[h] is incremented by the target only after it has executed
the fence ops it consumed; the requester snapshots it into
ipi_wait_gen[h] before posting (so a concurrent coalesced consume of
two requesters' ops still increments past both snapshots) and waits
until ipi_done[h] passes the snapshot. SSIP posts are fire-and-forget
and do not wait, as before.

Verification:
- Built: riscv-none-elf-gcc 15.2 -fsyntax-only -Wall with
  WOLFBOOT_RISCV_MMODE + WOLFBOOT_MMODE_SMODE_BOOT: clean.
- Tested: none (race condition; the contract skips failing-first tests
  for races, and the file is MPFS S-mode monitor code with no host or
  CI build target).
- Pitfalls: the shared DTIM struct gains two per-hart arrays; the
  struct is self-initialized under init_magic by this same code on
  every hart, so no cross-version ABI is broken. A target that never
  runs M-soft still hits the bounded spin timeout as before. The
  completion increment covers only fence ops, matching the only
  waiting call sites (both RFENCE paths).
- Style: cstyle-check.sh flag count unchanged from the pre-change
  file (3 pre-existing).
- Message: F-11029: prefix, no co-author trailers.
- Unverified: no multi-hart runtime execution (MPFS board only).
2026-08-25 08:51:09 +02:00
..
dice Add wolfCOSE DICE attestation 2026-08-06 09:44:52 +02:00
x86 F-5968: zeroize disk-unlock passphrase from static ATA command buffer 2026-07-02 14:27:04 +02:00
arm_tee_psa_ipc.c F-7389: arm_tee: reject Secure .base in zero-length PSA iovecs 2026-08-04 07:02:53 +02:00
arm_tee_psa_veneer.c
boot_aarch64.c cm4: define weak hal_get_boot_dts in update_disk.c so ARM32/RISC-V disk targets link 2026-08-24 12:47:34 +02:00
boot_aarch64_efi.c Add aarch64_efi target: wolfBoot as an AArch64 UEFI application 2026-08-10 21:03:50 +02:00
boot_aarch64_start.S Peer review fixes (thanks Jack) 2026-08-24 12:47:34 +02:00
boot_arm.c
boot_arm32.c PolarFire SoC: address PR review 2026-08-03 12:27:22 +02:00
boot_arm32_start.S
boot_c2000.c c2000: add wolfBoot TI C28x (TMS320F28P550SJ) secure-boot XIP port 2026-08-25 00:01:33 +02:00
boot_ppc.c PolarFire SoC: address PR review 2026-08-03 12:27:22 +02:00
boot_ppc_mp.S
boot_ppc_start.S
boot_renesas.c
boot_renesas_start.S renesas-rx: fix build for GCC RX 8.3/14.2 2026-07-30 15:32:31 +02:00
boot_riscv.c RISC-V: minimal SBI runtime; PolarFire SoC boots 4-CPU SMP Yocto Linux 2026-08-03 12:27:22 +02:00
boot_riscv_start.S RISC-V: minimal SBI runtime; PolarFire SoC boots 4-CPU SMP Yocto Linux 2026-08-03 12:27:22 +02:00
boot_x86_64.c PolarFire SoC: address PR review 2026-08-03 12:27:22 +02:00
boot_x86_fsp.c
boot_x86_fsp_payload.c
boot_x86_fsp_start.S
clang_sections.S
ddr_cadence.c PolarFire SoC: LPDDR4 DDR init for MPFS250T Video Kit (M-Mode) 2026-08-03 12:27:22 +02:00
delta.c F-5965: skip wb_diff match candidates whose offset MSB collides with ESC 2026-07-02 14:35:07 +02:00
disk.c
elf.c F-11027: abort the ELF load when an mmu_cb mapping fails 2026-08-25 08:51:09 +02:00
fdt.c F-9757: length-bound the FIT name/compression string properties 2026-08-21 08:52:59 +02:00
flash_otp_keystore.c
fwtpm_callable.c
gpt.c
gzip.c
image.c F-11024: pass full-width fields to wc_ecc_rs_raw_to_sig in the wolfHSM verify path 2026-08-25 08:50:42 +02:00
libwolfboot.c c2000: add wolfBoot TI C28x (TMS320F28P550SJ) secure-boot XIP port 2026-08-25 00:01:33 +02:00
loader.c Peer review fixes (thanks Jack) 2026-08-24 12:47:34 +02:00
multiboot.c
pci.c 6561 - Restore upper 64-bit BAR register on pci_program_bar error paths 2026-07-14 17:44:26 +02:00
pkcs11_callable.c F-6875: pkcs11: zeroize NSC bounce buffers before freeing them 2026-08-04 08:26:17 +02:00
pkcs11_store.c
psa_store.c F-6407: zeroize static cached_sector after each flash commit in psa_store 2026-07-02 14:03:24 +02:00
qspi_flash.c F-7382: clip QSPI page program transfers at the device page boundary 2026-08-11 12:54:36 +02:00
riscv_sbi.c F-11029: publish IPI fence completion only after the fence executes 2026-08-25 08:51:09 +02:00
sdhci.c Peer review fixes (thanks Daniele) 2026-08-24 12:47:34 +02:00
spi_flash.c
stage2_params.c
store_sbrk.c
store_sbrk.h
string.c c2000: add wolfBoot TI C28x (TMS320F28P550SJ) secure-boot XIP port 2026-08-25 00:01:33 +02:00
tpm.c F-7069: clear the EH authValue from the stack in wolfBoot_tpm2_get_timestamp 2026-08-11 12:59:01 +02:00
uart_flash.c
ubootenv.c Peer review fixes (thanks Daniele) 2026-08-24 12:47:34 +02:00
update_disk.c Merge pull request #868 from danielinux/fenrir-fixes-2026-08-21 2026-08-24 13:34:37 -04:00
update_flash.c F-9751: Add positive E2E encrypted-update test, fix what it exposes 2026-08-21 08:52:59 +02:00
update_flash_hwswap.c Address PR #815 review comments 2026-07-02 19:20:34 +02:00
update_ram.c F-11028: panic when both RAM-boot images fail verification 2026-08-25 08:51:09 +02:00
vector_riscv.S RISC-V: minimal SBI runtime; PolarFire SoC boots 4-CPU SMP Yocto Linux 2026-08-03 12:27:22 +02:00
wc_callable.c Add WOLFCRYPT_TZ_WOLFHSM TrustZone engine for STM32H5 2026-06-24 15:49:43 -07:00
wolfhsm_callable.c Add WOLFCRYPT_TZ_WOLFHSM TrustZone engine for STM32H5 2026-06-24 15:49:43 -07:00
wolfhsm_flash_hal.c 6589 - Use volatile accumulator in whFlashH5_Verify CT compare 2026-07-14 17:44:26 +02:00
xmalloc.c