public inbox for opensbi@lists.infradead.org
 help / color / mirror / Atom feed
From: Nicholas Piggin <npiggin@gmail.com>
To: opensbi@lists.infradead.org
Cc: Nicholas Piggin <npiggin@gmail.com>,
	Himanshu Chauhan <hchauhan@ventanamicro.com>
Subject: [PATCH 01/18] dbtr: Add consistent range checks to trigger ecalls
Date: Fri, 13 Mar 2026 15:19:30 +1000	[thread overview]
Message-ID: <20260313051948.4017134-2-npiggin@gmail.com> (raw)
In-Reply-To: <20260313051948.4017134-1-npiggin@gmail.com>

Be more consistent with the sequence of trigger range checks in dbtr
ecall handlers. This includes adding a missing range check in install
triggers that can result in SBI past the end of the shm region.

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
---
 lib/sbi/sbi_dbtr.c | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/lib/sbi/sbi_dbtr.c b/lib/sbi/sbi_dbtr.c
index 8bcb4312..b0160163 100644
--- a/lib/sbi/sbi_dbtr.c
+++ b/lib/sbi/sbi_dbtr.c
@@ -550,6 +550,9 @@ int sbi_dbtr_read_trig(unsigned long smode,
 	if (!hs)
 		return SBI_ERR_FAILED;
 
+	if (trig_count >= hs->total_trigs)
+		return SBI_ERR_BAD_RANGE;
+
 	if (trig_idx_base >= hs->total_trigs ||
 	    trig_idx_base + trig_count >= hs->total_trigs)
 		return SBI_ERR_INVALID_PARAM;
@@ -594,6 +597,9 @@ int sbi_dbtr_install_trig(unsigned long smode,
 	if (!hs)
 		return SBI_ERR_FAILED;
 
+	if (trig_count >= hs->total_trigs)
+		return SBI_ERR_BAD_RANGE;
+
 	if (sbi_dbtr_shmem_disabled(hs))
 		return SBI_ERR_NO_SHMEM;
 
@@ -663,6 +669,11 @@ int sbi_dbtr_uninstall_trig(unsigned long trig_idx_base,
 	if (!hs)
 		return SBI_ERR_FAILED;
 
+	if (trig_idx_base >= hs->total_trigs ||
+		find_last_bit(&trig_idx_mask, hs->total_trigs) +
+				trig_idx_base >= hs->total_trigs)
+		return SBI_ERR_INVALID_PARAM;
+
 	for_each_set_bit_from(idx, &trig_mask, hs->total_trigs) {
 		trig = INDEX_TO_TRIGGER(idx);
 		if (!(trig->state & RV_DBTR_BIT_MASK(TS, MAPPED)))
@@ -688,6 +699,11 @@ int sbi_dbtr_enable_trig(unsigned long trig_idx_base,
 	if (!hs)
 		return SBI_ERR_FAILED;
 
+	if (trig_idx_base >= hs->total_trigs ||
+		find_last_bit(&trig_idx_mask, hs->total_trigs) +
+				trig_idx_base >= hs->total_trigs)
+		return SBI_ERR_INVALID_PARAM;
+
 	for_each_set_bit_from(idx, &trig_mask, hs->total_trigs) {
 		trig = INDEX_TO_TRIGGER(idx);
 		sbi_dprintf("%s: enable trigger %lu\n", __func__, idx);
@@ -710,14 +726,14 @@ int sbi_dbtr_update_trig(unsigned long smode,
 	if (!hs)
 		return SBI_ERR_FAILED;
 
+	if (trig_count >= hs->total_trigs)
+		return SBI_ERR_BAD_RANGE;
+
 	if (sbi_dbtr_shmem_disabled(hs))
 		return SBI_ERR_NO_SHMEM;
 
 	shmem_base = hart_shmem_base(hs);
 
-	if (trig_count >= hs->total_trigs)
-		return SBI_ERR_BAD_RANGE;
-
 	for_each_trig_entry(shmem_base, trig_count, typeof(*entry), entry) {
 		sbi_hart_protection_map_range((unsigned long)entry, sizeof(*entry));
 		trig_idx = entry->id.idx;
@@ -754,6 +770,11 @@ int sbi_dbtr_disable_trig(unsigned long trig_idx_base,
 	if (!hs)
 		return SBI_ERR_FAILED;
 
+	if (trig_idx_base >= hs->total_trigs ||
+		find_last_bit(&trig_idx_mask, hs->total_trigs) +
+				trig_idx_base >= hs->total_trigs)
+		return SBI_ERR_INVALID_PARAM;
+
 	for_each_set_bit_from(idx, &trig_mask, hs->total_trigs) {
 		trig = INDEX_TO_TRIGGER(idx);
 		dbtr_trigger_disable(trig);
-- 
2.51.0


-- 
opensbi mailing list
opensbi@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/opensbi

  reply	other threads:[~2026-03-13  5:20 UTC|newest]

Thread overview: 21+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-03-13  5:19 [PATCH 00/18] dbtr: Fixes and heterogeneous trigger types Nicholas Piggin
2026-03-13  5:19 ` Nicholas Piggin [this message]
2026-03-20 12:46   ` [PATCH 01/18] dbtr: Add consistent range checks to trigger ecalls Ilya Mamay
2026-04-07  5:22   ` Himanshu Chauhan
2026-03-13  5:19 ` [PATCH 02/18] dbtr: Trigger update should set sbiret.value on failure Nicholas Piggin
2026-03-13  5:19 ` [PATCH 03/18] dbtr: Fix endian conversion in trigger install handler Nicholas Piggin
2026-03-13  5:19 ` [PATCH 04/18] dbtr: Return correct error on install not supported Nicholas Piggin
2026-03-13  5:19 ` [PATCH 05/18] dbtr: Do not support chain bit Nicholas Piggin
2026-03-13  5:19 ` [PATCH 06/18] dbtr: Improve trigger update error checking Nicholas Piggin
2026-03-13  5:19 ` [PATCH 07/18] dbtr: Check for invalid and unsupported triggers in update Nicholas Piggin
2026-03-13  5:19 ` [PATCH 08/18] dbtr: Improve error handling for trigger enable, disable, uninstall Nicholas Piggin
2026-03-13  5:19 ` [PATCH 09/18] dbtr: Read triggers should not read HW trigger if not mapped Nicholas Piggin
2026-03-13  5:19 ` [PATCH 10/18] dbtr: Avoid crash in sbi_debug_read_triggers Nicholas Piggin
2026-03-13  5:19 ` [PATCH 11/18] dbtr: Succeed operations with no triggers in mask Nicholas Piggin
2026-03-13  5:19 ` [PATCH 12/18] dbtr: Move hardware trigger probing to a function Nicholas Piggin
2026-03-13  5:19 ` [PATCH 13/18] dbtr: Rework install and update error handling Nicholas Piggin
2026-03-13  5:19 ` [PATCH 14/18] dbtr: Decouple dbtr trigger index from hardware trigger number Nicholas Piggin
2026-03-13  5:19 ` [PATCH 15/18] dbtr: Move trigger feature support test into a function Nicholas Piggin
2026-03-13  5:19 ` [PATCH 16/18] dbtr: Heterogeneous trigger type support Nicholas Piggin
2026-03-13  5:19 ` [PATCH 17/18] dbtr: Heterogeneous access type matching for mcontrol triggers Nicholas Piggin
2026-03-13  5:19 ` [PATCH 18/18] dbtr: Work around specification bug in range checks Nicholas Piggin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260313051948.4017134-2-npiggin@gmail.com \
    --to=npiggin@gmail.com \
    --cc=hchauhan@ventanamicro.com \
    --cc=opensbi@lists.infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox