[PATCH] perf/arm-cmn: Reject unsupported hardware configurations

[Ilkka Koskinen]

Hi Robin,

On Thu, 29 Jan 2026, Robin Murphy wrote:
> So far we've been fairly lax about accepting both unknown CMN models
> (at least with a warning), and unknown revisions of those which we
> do know, as although things do frequently change between releases,
> typically enough remains the same to be somewhat useful for at least
> some basic bringup checks. However, we also make assumptions of the
> maximum supported sizes and numbers of things in various places, and
> there's no guarantee that something new might not be bigger and lead
> to nasty array overflows. Make sure we only try to run on things that
> actually match our assumptions and so will not risk memory corruption.
>
> Cc: stable at vger.kernel.org
> Fixes: 7819e05a0dce ("perf/arm-cmn: Revamp model detection")
> Signed-off-by: Robin Murphy <robin.murphy at arm.com>
> ---
> drivers/perf/arm-cmn.c | 13 +++++++++++++
> 1 file changed, 13 insertions(+)
>
> diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
> index 2903e01f951f..24fec53ceccc 100644
> --- a/drivers/perf/arm-cmn.c
> +++ b/drivers/perf/arm-cmn.c
> @@ -2422,6 +2422,15 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
> 			arm_cmn_init_node_info(cmn, reg & CMN_CHILD_NODE_ADDR, dn);
> 			dn->portid_bits = xp->portid_bits;
> 			dn->deviceid_bits = xp->deviceid_bits;
> +			/*
> +			 * Logical IDs are assigned from 0 per node type, so as
> +			 * soon as we one bigger than expected, we can assume

Should that be something like:

 			"...as soon as we see one bigger than expected.."

Other than that, the patch looks good to me.

Reviewed-by: Ilkka Koskinen <ilkka at os.amperecomputing.com>

Cheers, Ilkka

> +			 * there are more than we can cope with.
> +			 */
> +			if (dn->logid > CMN_MAX_NODES_PER_EVENT) {
> +				dev_err(cmn->dev, "Invalid node number: %d\n", dn->logid);
> +				return -ENODEV;
> +			}
>
> 			switch (dn->type) {
> 			case CMN_TYPE_DTC:
> @@ -2499,6 +2508,10 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset)
> 		cmn->mesh_x = cmn->num_xps;
> 	cmn->mesh_y = cmn->num_xps / cmn->mesh_x;
>
> +	if (max(cmn->mesh_x, cmn->mesh_y) > CMN_MAX_DIMENSION) {
> +		dev_err(cmn->dev, "Invalid mesh size: %dx%d\n", cmn->mesh_x, cmn->mesh_y);
> +		return -ENODEV;
> +	}
> 	/* 1x1 config plays havoc with XP event encodings */
> 	if (cmn->num_xps == 1)
> 		dev_warn(cmn->dev, "1x1 config not fully supported, translate XP events manually\n");
> -- 
> 2.39.2.101.g768bb238c484.dirty
>
>
>