[PATCH] lib: utils/mailbox: reject undersized RPMI shmem queues

[Anup Patel]

On Fri, Aug 28, 2026 at 7:55 PM Pengpeng Hou <pengpeng at iscas.ac.cn> wrote:
>
> The RPMI shared-memory mailbox transport derives qctx->num_slots from the
> device-tree queue window size and the riscv,slot-size property. The current
> initialization only checks that the queue window is nonzero before
> subtracting the two RPMI header slots.
>
> Reject queue windows that cannot provide the two header slots plus at least
> two data ring slots. A zero data-slot count would later be used as a modulo
> divisor, and a one-slot ring is also unusable with the current full/empty
> convention because one empty slot is reserved to distinguish the two
> states.
>
> Also reject data-slot counts that cannot be represented by qctx->num_slots.
>
> Fixes: 91f46fb47eef ("lib/utils: Add RPMI messaging protocol and shared memory transport support")
> Signed-off-by: Pengpeng Hou <pengpeng at iscas.ac.cn>

LGTM.

Reviewed-by: Anup Patel <anup at brainfault.org>

Applied this patch to the riscv/opensbi repo.

Thanks,
Anup

> ---
>  lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
> index 521e0673..4457617a 100644
> --- a/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
> +++ b/lib/utils/mailbox/fdt_mailbox_rpmi_shmem.c
> @@ -589,6 +589,7 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
>         const fdt32_t *prop;
>         int count, len, ret, qid;
>         uint64_t reg_addr, reg_size;
> +       u64 total_slots;
>         struct smq_queue_ctx *qctx;
>
>         ret = fdt_node_check_compatible(fdt, nodeoff,
> @@ -638,6 +639,14 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
>                 if (ret < 0 || !reg_addr || !reg_size)
>                         return SBI_ENOENT;
>
> +               /* calculate number of slots in each queue */
> +               total_slots = reg_size / mctl->slot_size;
> +               if (total_slots < RPMI_QUEUE_HEADER_SLOTS + 2 ||
> +                   total_slots - RPMI_QUEUE_HEADER_SLOTS > (u32)-1)
> +                       return SBI_EINVAL;
> +
> +               qctx->num_slots = total_slots - RPMI_QUEUE_HEADER_SLOTS;
> +
>                 ret = sbi_domain_root_add_memrange(reg_addr, reg_size, reg_size,
>                                                    (SBI_DOMAIN_MEMREGION_MMIO |
>                                                     SBI_DOMAIN_MEMREGION_M_READABLE |
> @@ -645,10 +654,6 @@ static int rpmi_shmem_transport_init(struct rpmi_shmem_mbox_controller *mctl,
>                 if (ret)
>                         return ret;
>
> -               /* calculate number of slots in each queue */
> -               qctx->num_slots =
> -                       (reg_size - (mctl->slot_size * RPMI_QUEUE_HEADER_SLOTS)) / mctl->slot_size;
> -
>                 /* setup queue pointers */
>                 qctx->headptr = ((void *)(unsigned long)reg_addr) +
>                                 RPMI_QUEUE_HEAD_SLOT * mctl->slot_size;
>
> base-commit: 4e79fd7de59f1b2899092c1a84ce68c8ebc68f93
> --
> 2.43.0
>
>
> --
> opensbi mailing list
> opensbi at lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/opensbi