[PATCH] perf/arm-cmn: Reject unsupported hardware configurations

[Robin Murphy]

On 2026-01-30 3:57 am, Ilkka Koskinen wrote:
> 
> 
> Hi Robin,
> 
> On Thu, 29 Jan 2026, Robin Murphy wrote:
>> So far we've been fairly lax about accepting both unknown CMN models
>> (at least with a warning), and unknown revisions of those which we
>> do know, as although things do frequently change between releases,
>> typically enough remains the same to be somewhat useful for at least
>> some basic bringup checks. However, we also make assumptions of the
>> maximum supported sizes and numbers of things in various places, and
>> there's no guarantee that something new might not be bigger and lead
>> to nasty array overflows. Make sure we only try to run on things that
>> actually match our assumptions and so will not risk memory corruption.
>>
>> Cc: stable at vger.kernel.org
>> Fixes: 7819e05a0dce ("perf/arm-cmn: Revamp model detection")
>> Signed-off-by: Robin Murphy <robin.murphy at arm.com>
>> ---
>> drivers/perf/arm-cmn.c | 13 +++++++++++++
>> 1 file changed, 13 insertions(+)
>>
>> diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
>> index 2903e01f951f..24fec53ceccc 100644
>> --- a/drivers/perf/arm-cmn.c
>> +++ b/drivers/perf/arm-cmn.c
>> @@ -2422,6 +2422,15 @@ static int arm_cmn_discover(struct arm_cmn 
>> *cmn, unsigned int rgn_offset)
>>             arm_cmn_init_node_info(cmn, reg & CMN_CHILD_NODE_ADDR, dn);
>>             dn->portid_bits = xp->portid_bits;
>>             dn->deviceid_bits = xp->deviceid_bits;
>> +            /*
>> +             * Logical IDs are assigned from 0 per node type, so as
>> +             * soon as we one bigger than expected, we can assume
> 
> Should that be something like:
> 
>              "...as soon as we see one bigger than expected.."

Erm, indeed "see" is what I was trying to type... apparently it didn't 
make it all the way to my fingers.

> Other than that, the patch looks good to me.
> 
> Reviewed-by: Ilkka Koskinen <ilkka at os.amperecomputing.com>

Thanks!

Robin.

> 
> Cheers, Ilkka
> 
>> +             * there are more than we can cope with.
>> +             */
>> +            if (dn->logid > CMN_MAX_NODES_PER_EVENT) {
>> +                dev_err(cmn->dev, "Invalid node number: %d\n", dn- 
>> >logid);
>> +                return -ENODEV;
>> +            }
>>
>>             switch (dn->type) {
>>             case CMN_TYPE_DTC:
>> @@ -2499,6 +2508,10 @@ static int arm_cmn_discover(struct arm_cmn 
>> *cmn, unsigned int rgn_offset)
>>         cmn->mesh_x = cmn->num_xps;
>>     cmn->mesh_y = cmn->num_xps / cmn->mesh_x;
>>
>> +    if (max(cmn->mesh_x, cmn->mesh_y) > CMN_MAX_DIMENSION) {
>> +        dev_err(cmn->dev, "Invalid mesh size: %dx%d\n", cmn->mesh_x, 
>> cmn->mesh_y);
>> +        return -ENODEV;
>> +    }
>>     /* 1x1 config plays havoc with XP event encodings */
>>     if (cmn->num_xps == 1)
>>         dev_warn(cmn->dev, "1x1 config not fully supported, translate 
>> XP events manually\n");
>> -- 
>> 2.39.2.101.g768bb238c484.dirty
>>
>>
>>