| Message ID | 20260827115833.50735-1-pengpeng@iscas.ac.cn |
|---|---|
| State | New |
| Headers | show |
| Series | lib: sbi: dbtr: validate complete shared memory range | expand |
On Thu, Aug 27, 2026 at 5:28 PM Pengpeng Hou <pengpeng@iscas.ac.cn> wrote: > > The DBTR shared memory contains total_trigs entries, but setup currently > checks domain access for only its first byte. A supervisor can place that > base near a domain boundary so later entries extend into inaccessible or > M-mode-only memory. > > Validate the complete specification-defined shared-memory extent with > sbi_domain_check_addr_range(). Also reject an install count prohibited by > the DBTR specification before mapping or reading that many entries. > > This patch intentionally does not alter sbi_dbtr_read_trig(). Its equality > predicate follows the current DBTR error table even though the surrounding > half-open-range prose is inconsistent; that specification issue is a > separate decision. > > Fixes: 97f234f15c96 ("lib: sbi: Introduce the SBI debug triggers extension support") > > Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> > --- > Base-commit: 4e79fd7de59f1b2899092c1a84ce68c8ebc68f93 > > lib/sbi/sbi_dbtr.c | 14 +++++++++++--- > 1 file changed, 11 insertions(+), 3 deletions(-) > > diff --git a/lib/sbi/sbi_dbtr.c b/lib/sbi/sbi_dbtr.c > index 0104796..41d5e6f 100644 > --- a/lib/sbi/sbi_dbtr.c > +++ b/lib/sbi/sbi_dbtr.c > @@ -263,6 +263,7 @@ int sbi_dbtr_setup_shmem(const struct sbi_domain *dom, unsigned long smode, > unsigned long shmem_phys_lo, > unsigned long shmem_phys_hi) > { > + unsigned long shmem_addr, shmem_size; > struct sbi_dbtr_hart_triggers_state *hart_state; > > if (dom && !sbi_domain_is_assigned_hart(dom, current_hartindex())) { > @@ -304,9 +305,13 @@ int sbi_dbtr_setup_shmem(const struct sbi_domain *dom, unsigned long smode, > if (shmem_phys_hi) > return SBI_EINVALID_ADDR; > > - if (dom && !sbi_domain_check_addr(dom, > - DBTR_SHMEM_MAKE_PHYS(shmem_phys_hi, shmem_phys_lo), smode, > - SBI_DOMAIN_READ | SBI_DOMAIN_WRITE)) > + shmem_addr = DBTR_SHMEM_MAKE_PHYS(shmem_phys_hi, shmem_phys_lo); > + shmem_size = hart_state->total_trigs * > + sizeof(union sbi_dbtr_shmem_entry); > + if (dom && !sbi_domain_check_addr_range(dom, shmem_addr, shmem_size, > + smode, > + SBI_DOMAIN_READ | > + SBI_DOMAIN_WRITE)) > return SBI_ERR_INVALID_ADDRESS; > > hart_state->shmem.phys_lo = shmem_phys_lo; > @@ -619,6 +624,9 @@ int sbi_dbtr_install_trig(unsigned long smode, > if (sbi_dbtr_shmem_disabled(hs)) > return SBI_ERR_NO_SHMEM; > > + if (trig_count >= hs->total_trigs) > + return SBI_ERR_BAD_RANGE; > + Looks good to me. Reviewed-by: Himanshu Chauhan <himanshu.chauhan@oss.qualcomm.com> Himanshu > shmem_base = hart_shmem_base(hs); > sbi_hart_protection_map_range((unsigned long)shmem_base, > trig_count * sizeof(*entry)); > -- > 2.50.1 (Apple Git-155) >
diff --git a/lib/sbi/sbi_dbtr.c b/lib/sbi/sbi_dbtr.c index 0104796..41d5e6f 100644 --- a/lib/sbi/sbi_dbtr.c +++ b/lib/sbi/sbi_dbtr.c @@ -263,6 +263,7 @@ int sbi_dbtr_setup_shmem(const struct sbi_domain *dom, unsigned long smode, unsigned long shmem_phys_lo, unsigned long shmem_phys_hi) { + unsigned long shmem_addr, shmem_size; struct sbi_dbtr_hart_triggers_state *hart_state; if (dom && !sbi_domain_is_assigned_hart(dom, current_hartindex())) { @@ -304,9 +305,13 @@ int sbi_dbtr_setup_shmem(const struct sbi_domain *dom, unsigned long smode, if (shmem_phys_hi) return SBI_EINVALID_ADDR; - if (dom && !sbi_domain_check_addr(dom, - DBTR_SHMEM_MAKE_PHYS(shmem_phys_hi, shmem_phys_lo), smode, - SBI_DOMAIN_READ | SBI_DOMAIN_WRITE)) + shmem_addr = DBTR_SHMEM_MAKE_PHYS(shmem_phys_hi, shmem_phys_lo); + shmem_size = hart_state->total_trigs * + sizeof(union sbi_dbtr_shmem_entry); + if (dom && !sbi_domain_check_addr_range(dom, shmem_addr, shmem_size, + smode, + SBI_DOMAIN_READ | + SBI_DOMAIN_WRITE)) return SBI_ERR_INVALID_ADDRESS; hart_state->shmem.phys_lo = shmem_phys_lo; @@ -619,6 +624,9 @@ int sbi_dbtr_install_trig(unsigned long smode, if (sbi_dbtr_shmem_disabled(hs)) return SBI_ERR_NO_SHMEM; + if (trig_count >= hs->total_trigs) + return SBI_ERR_BAD_RANGE; + shmem_base = hart_shmem_base(hs); sbi_hart_protection_map_range((unsigned long)shmem_base, trig_count * sizeof(*entry));
The DBTR shared memory contains total_trigs entries, but setup currently checks domain access for only its first byte. A supervisor can place that base near a domain boundary so later entries extend into inaccessible or M-mode-only memory. Validate the complete specification-defined shared-memory extent with sbi_domain_check_addr_range(). Also reject an install count prohibited by the DBTR specification before mapping or reading that many entries. This patch intentionally does not alter sbi_dbtr_read_trig(). Its equality predicate follows the current DBTR error table even though the surrounding half-open-range prose is inconsistent; that specification issue is a separate decision. Fixes: 97f234f15c96 ("lib: sbi: Introduce the SBI debug triggers extension support") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> --- Base-commit: 4e79fd7de59f1b2899092c1a84ce68c8ebc68f93 lib/sbi/sbi_dbtr.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)