[PATCH] lib: sbi: reject PMU skip-match counter class mismatches

[Sebastian Alba Vives]

Hi Pengpeng,

I reproduced this independently in both directions, before and after your
patch, using a bare-metal M-mode payload that issues the ecalls directly
under QEMU. Base was master 6ad246a1 rather than the 4e79fd7d you list;
the patch applied cleanly there. QEMU 8.2.2, gcc 13.3.0. Smepmp was not
required.

  direction              tree                  result
  FW event, HW counter   master 6ad246a1       M-mode store access fault
  FW event, HW counter   master + this patch   SBI_ENOTSUPP (-2), survives
  HW event, FW counter   master 6ad246a1       M-mode illegal instruction
  HW event, FW counter   master + this patch   SBI_ENOTSUPP (-2), survives

On the first direction the fault is consistent with the underflow you
describe. ctr_idx is int and num_hw_ctrs is uint32_t, so ctr_idx -
num_hw_ctrs is evaluated as unsigned: it does not go negative, it wraps,
and the fw_counters_data[] access lands far outside the hart state rather
than just before it.

Tested-by: Sebastian Alba Vives <sebasjosue84 at gmail.com>

Happy to send the reproducer to the list if that is useful.

Thanks,
Sebastian