librelane playground

No. 55 / project of 147 on the ladder

Hello, S-mode kernel

introduces — real C-level S-mode kernel running on identity-mapped megapages, calling SBI putchar and shutdown through M-mode firmware

harden statelast run2026-05-03
areaunknownμm²
signoff
  • DRCNOT RUN
  • LVSNOT RUN
  • antennaNOT RUN
artifacts

P55 runs a real C-level “kernel” in S-mode that talks to M-mode firmware via the SBI ABI. The smallest non-trivial demonstration that the chip can host a Linux-shaped boot.

Status: RTL pass. UART trail S k X Hello from S-mode kernel via SBI!\n a b c d e f g h D. halt_code=1 at 5,322,341 clocks. Chip ran a 34-byte greeting through SBI, then continued to FreeRTOS.

Pieces

  • Identity-mapped megapages. 4 × 4 MiB entries cover the full 16 MiB of RAM, all R/W/X/A/D, U=0.
  • M-mode SBI firmware. Naked trap handler: catches ECALL_FROM_S, dispatches SBI_CONSOLE_PUTCHAR (UART write) and SBI_SHUTDOWN (transport back to M).
  • C-level S-mode kernel. kernel_main_in_s iterates a static .rodata greeting and calls sbi_putchar for each byte, then sbi_shutdown.

Why it matters

This is the OpenSBI/Linux boot model in miniature. A real RV32 Linux boot has the same shape: M-mode firmware sets up page tables, mret-s to the kernel’s S-mode entry, kernel makes SBI calls through ECALL_FROM_S, firmware dispatches.

P55 proves the chip’s RTL + the testbench environment can host that model end-to-end. The remaining work for actual Linux is the content — real kernel image, real SBI runtime, DTB, initramfs.

A clobber-list bug found

The orchestrator’s asm volatile didn’t declare a5 clobbered. GCC kept its globals base pointer in a5 across the asm; the S-mode kernel used a5 as &hello_msg; orchestrator resumed reading from the wrong base. Fix: declare all caller-saved registers (ra, t0-t6, a0-a7) as clobbered.

What’s left for actual Linux

  • Real Linux RV32 kernel image (cross-build from kernel.org).
  • Real SBI v0.3 runtime (full function-ID set).
  • DTB.
  • Initramfs.
  • CLINT-style timer at standard MMIO addresses.
  • A/D bit hardware updates.
  • Instruction fetch translation.

These are integration / supervised-debugging steps, not autonomous work.

Files

  • app/main.c - firmware + S-mode kernel + orchestrator
  • test/tb_freertos_demo.sv - UART buffer 32 → 256

Harden

NOT RUN. P55 is software-only — same RTL as P53/P54.

What just happened?

The chip hosted a real C-level S-mode kernel that printed a greeting through M-mode SBI firmware. That’s the Linux model in miniature, working.