* Re: [PATCH v2] irqchip/riscv-imsic: Reject overlapping group index fields
2026-09-20 13:07 [PATCH v2] irqchip/riscv-imsic: Reject overlapping group index fields Pengpeng Hou
@ 2026-09-23 11:12 ` Anup Patel
2026-10-14 8:59 ` Pengpeng Hou
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Anup Patel @ 2026-09-23 11:12 UTC (permalink / raw)
To: Pengpeng Hou
Cc: tglx, Alexandre Ghiti, Andrew Jones, Albert Ou, Bjorn Topel,
linux-kernel, linux-riscv, Palmer Dabbelt, Paul Walmsley,
Radu Rendec
On Sun, Sep 20, 2026 at 6:38 PM Pengpeng Hou <hppiscas@163.com> wrote:
>
> The IMSIC address layout places the group index above the page offset,
> guest index and HART index. imsic_parse_fwnode() checks the individual
> field widths and the upper end of the group field, but does not check
> that its lower end is above the other fields.
>
> Reject a nonzero group field whose shift overlaps the lower fields.
> Otherwise a firmware-supplied layout can assign the same address bit to
> different indices when MSI target addresses are constructed.
>
> Keep the existing upper-bound check unchanged. The new lower-bound
> check applies only when group index bits are present.
>
> The issue was found by our static-analysis tool.
>
> Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early driver")
> Assisted-by: gpt 5
> Signed-off-by: Pengpeng Hou <hppiscas@163.com>
LGTM.
Reviewed-by: Anup Patel <anup@brainfault.org>
Thanks,
Anup
> ---
> Changes since v1: https://lore.kernel.org/r/caplitmus-rv.bc36e3a0ebcb4a01838171f27625004b.imsic-overlap@163.com/
> - Limit the change to the lower-bound check discussed with Anup.
> - Keep the existing upper-bound check unchanged.
> - Send this as a standalone patch, without the zero-width-group change.
> - Do not change APLIC configuration or require the earlier series.
>
> drivers/irqchip/irq-riscv-imsic-state.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
> diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c
> index b8d1bbb..a7b241f 100644
> --- a/drivers/irqchip/irq-riscv-imsic-state.c
> +++ b/drivers/irqchip/irq-riscv-imsic-state.c
> @@ -739,6 +739,14 @@ static int __init imsic_parse_fwnode(struct fwnode_handle *fwnode,
> return -EINVAL;
> }
>
> + /* Group index bits must not overlap guest and HART index bits. */
> + i = IMSIC_MMIO_PAGE_SHIFT + global->guest_index_bits +
> + global->hart_index_bits;
> + if (global->group_index_bits && global->group_index_shift < i) {
> + pr_err("%pfwP: group index shift too small\n", fwnode);
> + return -EINVAL;
> + }
> +
> /* Sanity check group index shift */
> i = global->group_index_bits + global->group_index_shift - 1;
> if (i >= BITS_PER_LONG) {
>
> base-commit: 518e5b794c06c0f0eb40df3e202274a66202c137
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2] irqchip/riscv-imsic: Reject overlapping group index fields
2026-09-20 13:07 [PATCH v2] irqchip/riscv-imsic: Reject overlapping group index fields Pengpeng Hou
2026-09-23 11:12 ` Anup Patel
@ 2026-10-14 8:59 ` Pengpeng Hou
2026-10-15 9:54 ` [tip: irq/drivers] " tip-bot2 for Pengpeng Hou
2026-11-01 22:16 ` [PATCH v2] " patchwork-bot+linux-riscv
3 siblings, 0 replies; 5+ messages in thread
From: Pengpeng Hou @ 2026-10-14 8:59 UTC (permalink / raw)
To: anup, tglx
Cc: alex, andrew.jones, aou, bjorn, palmer, pjw, radu, linux-kernel,
linux-riscv, hppiscas
Hi Anup, Thomas,
Following up on the standalone v2, which received Anup's Reviewed-by.
It is limited to the lower-bound overlap check for a nonzero group
index field.
Could you please let me know whether it is queued or if anything else
is needed?
Thanks,
Pengpeng
^ permalink raw reply [flat|nested] 5+ messages in thread
* [tip: irq/drivers] irqchip/riscv-imsic: Reject overlapping group index fields
2026-09-20 13:07 [PATCH v2] irqchip/riscv-imsic: Reject overlapping group index fields Pengpeng Hou
2026-09-23 11:12 ` Anup Patel
2026-10-14 8:59 ` Pengpeng Hou
@ 2026-10-15 9:54 ` tip-bot2 for Pengpeng Hou
2026-11-01 22:16 ` [PATCH v2] " patchwork-bot+linux-riscv
3 siblings, 0 replies; 5+ messages in thread
From: tip-bot2 for Pengpeng Hou @ 2026-10-15 9:54 UTC (permalink / raw)
To: linux-tip-commits
Cc: Pengpeng Hou, Thomas Gleixner, Anup Patel, x86, linux-kernel
The following commit has been merged into the irq/drivers branch of tip:
Commit-ID: 8caa8fcec8db5358437b9b7ca456bc3093d2a4d0
Gitweb: https://git.kernel.org/tip/8caa8fcec8db5358437b9b7ca456bc3093d2a4d0
Author: Pengpeng Hou <hppiscas@163.com>
AuthorDate: Sun, 20 Sep 2026 21:07:54 +08:00
Committer: Thomas Gleixner <tglx@kernel.org>
CommitterDate: Thu, 15 Oct 2026 11:50:48 +02:00
irqchip/riscv-imsic: Reject overlapping group index fields
The IMSIC address layout places the group index above the page offset,
guest index and HART index. imsic_parse_fwnode() checks the individual
field widths and the upper end of the group field, but does not check
that its lower end is above the other fields.
Reject a nonzero group field whose shift overlaps the lower fields.
Otherwise a firmware-supplied layout can assign the same address bit to
different indices when MSI target addresses are constructed.
Keep the existing upper-bound check unchanged. The new lower-bound
check applies only when group index bits are present.
The issue was found by our static-analysis tool.
Fixes: 21a8f8a0eb35 ("irqchip: Add RISC-V incoming MSI controller early driver")
Signed-off-by: Pengpeng Hou <hppiscas@163.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: gpt 5
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://patch.msgid.link/caplitmus-rv.v2.imsic.f2c0e5bdc627451c83deb0cf7eb8834a@163.com
---
drivers/irqchip/irq-riscv-imsic-state.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/irqchip/irq-riscv-imsic-state.c b/drivers/irqchip/irq-riscv-imsic-state.c
index 9505ddb..960c71d 100644
--- a/drivers/irqchip/irq-riscv-imsic-state.c
+++ b/drivers/irqchip/irq-riscv-imsic-state.c
@@ -740,6 +740,14 @@ static int __init imsic_parse_fwnode(struct fwnode_handle *fwnode,
return -EINVAL;
}
+ /* Group index bits must not overlap guest and HART index bits. */
+ i = IMSIC_MMIO_PAGE_SHIFT + global->guest_index_bits +
+ global->hart_index_bits;
+ if (global->group_index_bits && global->group_index_shift < i) {
+ pr_err("%pfwP: group index shift too small\n", fwnode);
+ return -EINVAL;
+ }
+
/* Sanity check group index shift */
i = global->group_index_bits + global->group_index_shift - 1;
if (i >= BITS_PER_LONG) {
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH v2] irqchip/riscv-imsic: Reject overlapping group index fields
2026-09-20 13:07 [PATCH v2] irqchip/riscv-imsic: Reject overlapping group index fields Pengpeng Hou
` (2 preceding siblings ...)
2026-10-15 9:54 ` [tip: irq/drivers] " tip-bot2 for Pengpeng Hou
@ 2026-11-01 22:16 ` patchwork-bot+linux-riscv
3 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+linux-riscv @ 2026-11-01 22:16 UTC (permalink / raw)
To: Pengpeng Hou
Cc: linux-riscv, anup, tglx, alex, andrew.jones, aou, bjorn,
linux-kernel, palmer, pjw, radu
Hello:
This patch was applied to riscv/linux.git (fixes)
by Thomas Gleixner <tglx@kernel.org>:
On Sun, 20 Sep 2026 21:07:54 +0800 you wrote:
> The IMSIC address layout places the group index above the page offset,
> guest index and HART index. imsic_parse_fwnode() checks the individual
> field widths and the upper end of the group field, but does not check
> that its lower end is above the other fields.
>
> Reject a nonzero group field whose shift overlaps the lower fields.
> Otherwise a firmware-supplied layout can assign the same address bit to
> different indices when MSI target addresses are constructed.
>
> [...]
Here is the summary with links:
- [v2] irqchip/riscv-imsic: Reject overlapping group index fields
https://git.kernel.org/riscv/c/8caa8fcec8db
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread