Mirrors/opensbi
3
0 Fork 1
mirror of https://github.com/riscv-software-src/opensbi.git synced 2026-10-23 20:31:14 +01:00
Code Issues Packages Projects Releases Wiki Activity

lib: utils/mailbox: reject undersized RPMI shmem queues

Browse Source 
The RPMI shared-memory mailbox transport derives qctx->num_slots from the
device-tree queue window size and the riscv,slot-size property. The current
initialization only checks that the queue window is nonzero before
subtracting the two RPMI header slots.

Reject queue windows that cannot provide the two header slots plus at least
two data ring slots. A zero data-slot count would later be used as a modulo
divisor, and a one-slot ring is also unusable with the current full/empty
convention because one empty slot is reserved to distinguish the two
states.

Also reject data-slot counts that cannot be represented by qctx->num_slots.

Fixes: 91f46fb47e ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260828142521.14267-1-pengpeng@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
This commit is contained in:
Pengpeng Hou authored and Anup Patel committed 2026-10-23 13:06:37 +05:30
1 parent 9dcd9f9365
commit 95c7980851
1 file changed
+8 -5
Download Patch File Download Diff File Expand all files Collapse all files
lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
+8 -5
View File
@@ -592,7 +592,7 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
const char *name;
const fdt32_t *prop;
int count, len, ret, qid;
uint64_t reg_addr, reg_size;
uint64_t reg_addr, reg_size, total_slots;
struct smq_queue_ctx *qctx;
ret = fdt_node_check_compatible(fdt, nodeoff,
@@ -642,6 +642,13 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
if (ret < 0 || !reg_addr || !reg_size)
return SBI_ENOENT;
/* calculate number of slots in each queue */
total_slots = reg_size / mctl->slot_size;
if (total_slots < RPMI_QUEUE_HEADER_SLOTS + 2 ||
total_slots - RPMI_QUEUE_HEADER_SLOTS > (u32)-1)
return SBI_EINVAL;
qctx->num_slots = total_slots - RPMI_QUEUE_HEADER_SLOTS;
ret = sbi_domain_root_add_memrange(reg_addr, reg_size, reg_size,
(SBI_DOMAIN_MEMREGION_MMIO |
SBI_DOMAIN_MEMREGION_M_READABLE |
@@ -649,10 +656,6 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
if (ret)
return ret;
/* calculate number of slots in each queue */
qctx->num_slots =
(reg_size - (mctl->slot_size * RPMI_QUEUE_HEADER_SLOTS)) / mctl->slot_size;
/* setup queue pointers */
qctx->headptr = ((void *)(unsigned long)reg_addr) +
RPMI_QUEUE_HEAD_SLOT * mctl->slot_size;