[PATCH v2 0/3] ACPI: RHCT: validate nested node references

[Pengpeng Hou]

RHCT consumers walk the firmware-provided node area and follow hart-info
offsets without proving the corresponding extents.  ISA and CMO consumers
then read the referenced type-specific payloads directly.

Split the checks into independently reviewable layers.  Patch 1 validates
the table and node envelopes.  Patch 2 validates each hart-info offset
array and requires references to identify exact non-hart node boundaries.
Patch 3 validates the ISA string and CMO payload before use and publishes
CMO values only after a complete successful walk.

Changes since v1:
https://lore.kernel.org/all/20260706094619.83121-1-pengpeng@iscas.ac.cn/
- split root, reference and type-specific payload validation
- bound iteration by node_count
- require references to exact non-hart node starts
- enforce the RHCT rule that isa_length includes a trailing NUL
- avoid publishing partial CMO output after a later malformed node

Testing used Linux 3d6d817622b0 plus this series, GCC 13.3 and QEMU
8.2.2 for riscv64.  A temporary KUnit harness in rhct.c called the
actual static validation helpers; the harness is not part of this
series.  The acpi_rhct_bounds suite passed all three tests, covering
truncated table and node extents, invalid hart offset arrays, interior
node references, invalid ISA strings, and all-or-nothing publication of
CMO values after a later malformed reference.

This did not exercise a platform-provided RHCT table through the complete
boot-time discovery path.

Pengpeng Hou (3):
  ACPI: RHCT: validate table and node extents before traversal
  ACPI: RHCT: validate hart-info offsets and node references
  ACPI: RHCT: validate ISA and CMO node payloads

 drivers/acpi/riscv/rhct.c | 251 ++++++++++++++++++++++++++++++++------
 1 file changed, 213 insertions(+), 38 deletions(-)


base-commit: 3d6d817622b0a9721e3cc404df3469171582be13
-- 
2.50.1 (Apple Git-155)