opensbi.git/lib/sbi/sbi_pmu.c, branch master

lib: sbi_pmu: fix integer overflow in pmu_ctr_idx_validate

2026-06-28T08:34:17Z

pmu_ctr_idx_validate() checks whether counter indices are in range using cbase + sbi_fls(cmask) < total_ctrs. Both operands are unsigned long, so a crafted cbase close to ULONG_MAX causes the addition to wrap around to a small value that passes the comparison. Once validation is bypassed, sbi_pmu_ctr_cfg_match() with the SKIP_MATCH flag uses the overflowed index directly as an array subscript into phs->active_events[], producing an out-of-bounds read in M-mode. Through the firmware-event code path, the same overflowed index reaches fw_counters_data[] and fw_counters_started, giving an attacker OOB write-zero and OOB bit-set primitives in M-mode memory. Fix pmu_ctr_idx_validate() by checking for unsigned overflow before the comparison, and add a secondary bounds check on cidx_first in the SKIP_MATCH path so that even if validation is somehow bypassed in the future, the array access remains bounded. Signed-off-by: liutong Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260624035049.1753003-1-liutong@iscas.ac.cn Signed-off-by: Anup Patel

lib: sbi_pmu: Honor CLEAR_VALUE/AUTO_START for all hardware event types

2026-06-12T13:29:40Z

sbi_pmu_ctr_cfg_match() only acts on SBI_PMU_CFG_FLAG_CLEAR_VALUE and SBI_PMU_CFG_FLAG_AUTO_START when the event type is SBI_PMU_EVENT_TYPE_HW. However, pmu_ctr_find_hw() allocates a hardware counter from the same hw_event_map for SBI_PMU_EVENT_TYPE_HW_CACHE, SBI_PMU_EVENT_TYPE_HW_RAW, and SBI_PMU_EVENT_TYPE_HW_RAW_V2 as well, and the start/clear helpers (pmu_ctr_start_hw, pmu_ctr_write_hw) operate on the counter index alone and are agnostic to the event type. As a result, when a supervisor configures a HW_CACHE/HW_RAW/HW_RAW_V2 event with these flags, the counter is programmed and recorded in active_events[] but is never cleared or started, requiring an extra SBI call to make it count. Extend the check to cover all hardware-counter event types so that the configuration flags take effect for HW_CACHE and raw events too. Deliberately avoiding using "not FW" logic to be explicit about HW-backed events only. Fixes: 13d40f21 ("lib: sbi: Add PMU support") Signed-off-by: David E. Garcia Porras Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260522144608.3433470-1-david.garcia@aheadcomputing.com Signed-off-by: Anup Patel

lib/sbi_pmu: Don't fallback to fixed counters when sscofpmf && !smcntrpmf

2026-05-11T06:00:22Z

Currently when searching for a hardware counter for an event, if no programmable counter is available, the code falls back to using a fixed counter (mcycle/minstret) if one matches the event. However the fallback is incorrect when sscofpmf is present but smcntrpmf is not. That's because with sscofpmf, programmable counters support mode filtering, but the fixed counters do not (without smcntrpmf). Even if the caller didn't configure mode filtering, by default programmable counters don't count M mode when sscofpmf is present, whereas mcycle/minstret do. Fix the logic to not fallback to a fixed counter if sscofpmf is present but smcntrpmf is not. Fixes: 0c304b661965 ("lib: sbi: Allow programmable counters to monitor cycle/instret events") Signed-off-by: Michael Ellerman Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260324-mcycle-fix-v1-1-1444e9fe5c32@kernel.org Signed-off-by: Anup Patel

lib: sbi_pmu: Add FW counter index validation when reading high bits on RV64

2026-02-21T04:50:41Z

Currently, when we attempt to read the upper 32 bits of a firmware counter on RV64 or higher, we just set `sbiret.value` to 0 without validating the counter index. The SBI specification requires us to set `sbiret.error` to `SBI_ERR_INVALID_PARAM` if the counter index points to a hardware counter or an invalid counter. Add a validation check to ensure compliance with the specification on RV64 or higher. Fixes: 51951d9e9af8 ("lib: sbi_pmu: Implement sbi_pmu_counter_fw_read_hi") Signed-off-by: James Raphael Tiovalen Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260125090643.190748-1-jamestiotio@gmail.com Signed-off-by: Anup Patel

lib: sbi_pmu: Fix multiple FW counter start operations with custom PMU device

2026-02-20T11:54:55Z

Currently, we immediately return the result of `fw_counter_start` if the event code is 0xFFFF. However, this skips setting the bit in the `fw_counters_started` bitmap even if the platform-specific call succeeds. Restore the original behavior of returning early only on an error so that we still set the bit in the bitmap. This prevents multiple starts of the same FW counter. This also aligns the expectations of `pmu_ctr_start_fw` with `pmu_ctr_stop_fw` since we cannot assume that the platform-specific functions to start and stop FW counters will modify the bitmap state. Fixes: 57d3aa3b0dbd ("lib: sbi_pmu: Introduce fw_counter_write_value API") Signed-off-by: James Raphael Tiovalen Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20260116165304.180441-1-jamestiotio@gmail.com Signed-off-by: Anup Patel

lib: sbi_pmu: Fix multiple start and stop operations of FW counters

2025-12-27T05:34:43Z

Currently, OpenSBI returns SBI_ERR_ALREADY_STARTED when attempting to start a HW counter that is already started and SBI_ERR_ALREADY_STOPPED when attempting to stop a HW counter that is already stopped. However, this is not yet implemented for FW counters. Add the necessary checks to return the same error codes when attempting the same actions on FW counters. Signed-off-by: James Raphael Tiovalen Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20251213104146.422972-1-jamestiotio@gmail.com Signed-off-by: Anup Patel

lib: sbi: Replace sbi_hart_pmp_xyz() and sbi_hart_map/unmap_addr()

2025-12-16T14:46:47Z

The sbi_hart_pmp_xyz() and sbi_hart_map/unmap_addr() functions can now be replaced by various sbi_hart_protection_xyz() functions. Signed-off-by: Anup Patel Link: https://lore.kernel.org/r/20251209135235.423391-5-apatel@ventanamicro.com Signed-off-by: Anup Patel

lib: sbi_pmu: Fix xINH bits configuring

2025-12-01T05:36:36Z

Before this patch sbi_pmu_ctr_start() ignores flags received in sbi_pmu_ctr_cfg_match() including inhibit ones. To prevent it, save flags together with event_data and use them both in sbi_pmu_ctr_start(). Fixes: 1db95da2997b ("lib: sbi: sbi_pmu: fixed hw counters start for hart") Signed-off-by: Shifrin Dmitry Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20251110113140.80561-1-dmitry.shifrin@syntacore.com Signed-off-by: Anup Patel

lib: sbi: sbi_pmu: added checks for ctr_idx in match

2025-10-27T11:29:42Z

Previously, in sbi_pmu_ctr_cfg_match() function, ctr_idx was used immediately after pmu_ctr_find_fw() or pmu_ctr_find_hw() calls. In first case, array index was (ctr_idx - num_hw_ctrs), in second - ctr_idx. But pmu_ctr_find_fw() and pmu_ctr_find_hw() functions can return negative value, in which case writing in arrays with such indexes would corrupt sbi_pmu_hart_state structure. To avoid this situation, direct ctr_idx value check added. Signed-off-by: Alexander Chuprunov Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20250918090706.2217603-4-alexander.chuprunov@syntacore.com Signed-off-by: Anup Patel

lib: sbi: sbi_pmu: fixed alignment

2025-10-27T11:26:20Z

Deleted spaces before brace in pmu_ctr_start_fw() for correct alignment. Signed-off-by: Alexander Chuprunov Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20250918090706.2217603-3-alexander.chuprunov@syntacore.com Signed-off-by: Anup Patel