Re: [PATCH v2] perf/arm-cmn: Add workarounds for CMN-S3 on Graviton5

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Buffer overflow in `arm_cmn_event_init` due to `CMN_MAX_DTCS` not scaling with mesh dimension.
--

commit 9d571ad62b9e626c4f8ff883ad8a2627c1e26529
Author: Aviv Bakal <avivb@amazon.com>

    perf/arm-cmn: Add workarounds for CMN-S3 on Graviton5

    Graviton5 uses a customised CMN-S3 implementation where certain
    discovery registers report zeroed fields. Add the following workarounds:
    
     - Introduce a dedicated ACPI HID to identify the Graviton5 CMN variant.
     - Derive the DTC domain from the XP node ID, since the unit info
       register reports it as zero.
     - Set the DTC logical ID from the computed domain ID, since the node
       info register's logical ID field is also zeroed.

> diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
> index f5305c8fdca43..8ee3f86386025 100644
> --- a/drivers/perf/arm-cmn.c
> +++ b/drivers/perf/arm-cmn.c
> @@ -31,7 +31,8 @@
>  #define CMN_CHILD_NODE_ADDR		GENMASK(29, 0)
>  #define CMN_CHILD_NODE_EXTERNAL		BIT(31)
>  
> -#define CMN_MAX_DIMENSION		12
> +/* Some implementations use a mesh larger than the architectural max of 12 */
> +#define CMN_MAX_DIMENSION		14
>  #define CMN_MAX_XPS			(CMN_MAX_DIMENSION * CMN_MAX_DIMENSION)
>  #define CMN_MAX_DTMS			(CMN_MAX_XPS + (CMN_MAX_DIMENSION - 1) * 4)
>  

[ ... ]

> @@ -2221,6 +2224,18 @@ static unsigned int arm_cmn_dtc_domain(struct arm_cmn *cmn, void __iomem *xp_reg
>  	return FIELD_GET(CMN_DTM_UNIT_INFO_DTC_DOMAIN, readl_relaxed(xp_region + offset));
>  }
>  
> +static unsigned int arm_cmn_graviton5_dtc_domain(u16 xp_id)
> +{
> +	unsigned int x = (xp_id >> 7) & 0xf;
> +	unsigned int y = (xp_id >> 3) & 0xf;
> +
> +	/*
> +	 * The unit info register reads as zero; derive the DTC domain from
> +	 * the XP's mesh coordinates over the 10x14 mesh.
> +	 */
> +	return (x / 5) + (y / 7) * 2;
> +}
> +

Does this new dimension limit require an update to CMN_MAX_DTCS?

CMN_MAX_DTCS is currently 4, which sizes the dtc_idx array in struct arm_cmn_hw_event:

struct arm_cmn_hw_event {
	struct arm_cmn_node *dn;
	u64 dtm_idx[DIV_ROUND_UP(CMN_MAX_NODES_PER_EVENT * 2, 64)];
	s8 dtc_idx[CMN_MAX_DTCS];
	...
};

For a 14x10 mesh where X=13 and Y=9, arm_cmn_graviton5_dtc_domain() will return 4.

Will this cause an out-of-bounds write in arm_cmn_event_init()?

	memset(hw->dtc_idx, -1, sizeof(hw->dtc_idx));
	for (dn = hw->dn; dn->type == type; dn++) {
		...
		if (dn->dtc < 0)
			memset(hw->dtc_idx, 0, cmn->num_dtcs);
		else
			hw->dtc_idx[dn->dtc] = 0;
		...
	}

If the larger mesh size exposes more than 4 DTC nodes, could cmn->num_dtcs also
exceed 4, causing the memset() to overflow the dtc_idx[] array?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260504133923.23373-1-avivb@amazon.com?part=1