diff mbox series

lib: utils/mailbox: reject undersized RPMI shmem queues

Message ID 20260828142521.14267-1-pengpeng@iscas.ac.cn
State New
Headers show
Series lib: utils/mailbox: reject undersized RPMI shmem queues | expand

Commit Message

Pengpeng Hou Aug. 28, 2026, 2:25 p.m. UTC 
The RPMI shared-memory mailbox transport derives qctx->num_slots from the
device-tree queue window size and the riscv,slot-size property. The current
initialization only checks that the queue window is nonzero before
subtracting the two RPMI header slots.

Reject queue windows that cannot provide the two header slots plus at least
two data ring slots. A zero data-slot count would later be used as a modulo
divisor, and a one-slot ring is also unusable with the current full/empty
convention because one empty slot is reserved to distinguish the two
states.

Also reject data-slot counts that cannot be represented by qctx->num_slots.

Fixes: 91f46fb47eef ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)


base-commit: 4e79fd7de59f1b2899092c1a84ce68c8ebc68f93
diff mbox series

Patch

diff --git a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
index 521e0673..4457617a 100644
--- a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
+++ b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
@@ -589,6 +589,7 @@  static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
 	const fdt32_t *prop;
 	int count, len, ret, qid;
 	uint64_t reg_addr, reg_size;
+	u64 total_slots;
 	struct smq_queue_ctx *qctx;
 
 	ret = fdt_node_check_compatible(fdt, nodeoff,
@@ -638,6 +639,14 @@  static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
 		if (ret < 0 || !reg_addr || !reg_size)
 			return SBI_ENOENT;
 
+		/* calculate number of slots in each queue */
+		total_slots = reg_size / mctl->slot_size;
+		if (total_slots < RPMI_QUEUE_HEADER_SLOTS + 2 ||
+		    total_slots - RPMI_QUEUE_HEADER_SLOTS > (u32)-1)
+			return SBI_EINVAL;
+
+		qctx->num_slots = total_slots - RPMI_QUEUE_HEADER_SLOTS;
+
 		ret = sbi_domain_root_add_memrange(reg_addr, reg_size, reg_size,
 						   (SBI_DOMAIN_MEMREGION_MMIO |
 						    SBI_DOMAIN_MEMREGION_M_READABLE |
@@ -645,10 +654,6 @@  static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
 		if (ret)
 			return ret;
 
-		/* calculate number of slots in each queue */
-		qctx->num_slots =
-			(reg_size - (mctl->slot_size * RPMI_QUEUE_HEADER_SLOTS)) / mctl->slot_size;
-
 		/* setup queue pointers */
 		qctx->headptr = ((void *)(unsigned long)reg_addr) +
 				RPMI_QUEUE_HEAD_SLOT * mctl->slot_size;