sbi_hsm_hart_start() acquires the target hart's start ticket, then
writes next_arg1, next_addr and next_mode before checking whether the
target is stopped.
A start request for a non-retentively suspended hart is rejected, but
those writes have already replaced the resume context consumed by
sbi_hsm_hart_resume_finish(). The same ordering also lets other rejected
start requests modify target scratch state.
Check the state immediately after acquiring the start ticket and before
updating the scratch context. The ticket serializes start requests for
the target; retain the cmpxchg as the publication barrier and defensive
state check.
Fixes: e8e9ed3790 ("lib: sbi: Set the state of a hart to START_PENDING after the hart is ready")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260831130817.54625-1-pengpeng@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
Timer callbacks can request that an expired event be restarted. Such
events are moved to a local restart_list, but the restart loop tests that
list while reading its first entry from tstate->event_list.
If the main event list is empty, the loop treats its list head as a timer
event. Otherwise it repeatedly removes and reinserts the wrong event
while restart_list remains nonempty, so timer processing cannot
complete.
No in-tree callback currently requests a restart, but the timer-event
callback interface exposes this path to OpenSBI library and platform
users.
Read the event from restart_list, matching the loop condition and the
list that owns the entry.
Fixes: b7fa8a246c ("lib: sbi_timer: Add support for timer events")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260831130641.54100-1-pengpeng@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
The RPMI shared-memory helpers validate a queue index before using it
to select queue_ctx_tbl, but the current comparison accepts queue_id
equal to queue_count.
Only entries 0 through queue_count - 1 are initialized from the device
tree. Accepting queue_count can therefore use an uninitialized queue
context when a protocol operation selects a queue omitted by the
description.
Reject queue_id greater than or equal to queue_count in both transfer
directions.
Fixes: 91f46fb47e ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260831130444.53629-1-pengpeng@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
The RPMI shared-memory mailbox transport derives qctx->num_slots from the
device-tree queue window size and the riscv,slot-size property. The current
initialization only checks that the queue window is nonzero before
subtracting the two RPMI header slots.
Reject queue windows that cannot provide the two header slots plus at least
two data ring slots. A zero data-slot count would later be used as a modulo
divisor, and a one-slot ring is also unusable with the current full/empty
convention because one empty slot is reserved to distinguish the two
states.
Also reject data-slot counts that cannot be represented by qctx->num_slots.
Fixes: 91f46fb47e ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260828142521.14267-1-pengpeng@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
The HPM feature detector and CSR emulator build mhpm_mask bits with a
plain signed 1. Both macro families expand through counter 31, so the
last expansion evaluates 1 << 31 and shifts a signed int into its sign
bit.
Use BIT() at both sites. The mask is unsigned and bit 31 is part of the
represented HPM counter set.
Fixes: c744ed77b1 ("lib: sbi_pmu: Enable noncontigous hpm event and counters")
Fixes: ee1f83ca84 ("lib: sbi_pmu: remove mhpm_count field in hart feature")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260828142354.13035-1-pengpeng@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
Pengpeng Hou