The RPMI shared-memory helpers validate a queue index before using it
to select queue_ctx_tbl, but the current comparison accepts queue_id
equal to queue_count.
Only entries 0 through queue_count - 1 are initialized from the device
tree. Accepting queue_count can therefore use an uninitialized queue
context when a protocol operation selects a queue omitted by the
description.
Reject queue_id greater than or equal to queue_count in both transfer
directions.
Fixes: 91f46fb47e ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260831130444.53629-1-pengpeng@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
The RPMI shared-memory mailbox transport derives qctx->num_slots from the
device-tree queue window size and the riscv,slot-size property. The current
initialization only checks that the queue window is nonzero before
subtracting the two RPMI header slots.
Reject queue windows that cannot provide the two header slots plus at least
two data ring slots. A zero data-slot count would later be used as a modulo
divisor, and a one-slot ring is also unusable with the current full/empty
convention because one empty slot is reserved to distinguish the two
states.
Also reject data-slot counts that cannot be represented by qctx->num_slots.
Fixes: 91f46fb47e ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260828142521.14267-1-pengpeng@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
The HPM feature detector and CSR emulator build mhpm_mask bits with a
plain signed 1. Both macro families expand through counter 31, so the
last expansion evaluates 1 << 31 and shifts a signed int into its sign
bit.
Use BIT() at both sites. The mask is unsigned and bit 31 is part of the
represented HPM counter set.
Fixes: c744ed77b1 ("lib: sbi_pmu: Enable noncontigous hpm event and counters")
Fixes: ee1f83ca84 ("lib: sbi_pmu: remove mhpm_count field in hart feature")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260828142354.13035-1-pengpeng@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
Pengpeng Hou