[PATCH 4/8] lib: sbi_hart: add error message for insufficient PMP entries

Yu-Chien Peter Lin
2025-08-14T15:37:18Z

Report PMP configuration errors when available PMP entries are
insufficient to adequately protect the system, at least the
security vulnerabilities becomes visible at boot-time.

Signed-off-by: Yu-Chien Peter Lin <peter.lin@sifive.com>
---
lib/sbi/sbi_hart.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/lib/sbi/sbi_hart.c b/lib/sbi/sbi_hart.c
index eab27f48..f4932909 100644
--- a/lib/sbi/sbi_hart.c
+++ b/lib/sbi/sbi_hart.c
@@ -348,8 +348,11 @@ static int sbi_hart_smepmp_configure(struct sbi_scratch *scratch,
/* Skip reserved entry */
if (pmp_idx == SBI_SMEPMP_RESV_ENTRY)
pmp_idx++;
- if (pmp_count <= pmp_idx)
+ if (pmp_count <= pmp_idx) {
+ sbi_printf("%s: ERR: region %#lx cannot be protected - "
+ "insufficient PMP entries\n", __func__, reg->base);
break;
+ }

/* Skip shared and SU-only regions */
if (!SBI_DOMAIN_MEMREGION_M_ONLY_ACCESS(reg->flags)) {
@@ -372,8 +375,11 @@ static int sbi_hart_smepmp_configure(struct sbi_scratch *scratch,
/* Skip reserved entry */
if (pmp_idx == SBI_SMEPMP_RESV_ENTRY)
pmp_idx++;
- if (pmp_count <= pmp_idx)
+ if (pmp_count <= pmp_idx) {
+ sbi_printf("%s: ERR: region %#lx cannot be protected - "
+ "insufficient PMP entries\n", __func__, reg->base);
break;
+ }

/* Skip M-only regions */
if (SBI_DOMAIN_MEMREGION_M_ONLY_ACCESS(reg->flags)) {
@@ -407,8 +413,11 @@ static int sbi_hart_oldpmp_configure(struct sbi_scratch *scratch,
unsigned long pmp_addr;

sbi_domain_for_each_memregion(dom, reg) {
- if (pmp_count <= pmp_idx)
+ if (pmp_count <= pmp_idx) {
+ sbi_printf("%s: ERR: region %#lx cannot be protected - "
+ "insufficient PMP entries\n", __func__, reg->base);
break;
+ }

pmp_flags = 0;