Re: [PATCH v2 2/3] perf: marvell: Add CN20K LLC-TAD PMU support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Inconsistent masking of `event_idx` between validation and execution allows userspace to induce an aborted hardware programming state or bypass MPAM filters.
--

commit 13a14a3d137a1e1e8ddf65c82eb4ff187ff64ca5
Author: Geetha sowjanya <gakula@marvell.com>

perf: marvell: Add CN20K LLC-TAD PMU support

This commit adds support for the LLC Tag-and-Data (TAD) PMU on Marvell
CN20K SoCs. It introduces a new PMU profile, extended event maps, and
specific register base offsets.

> diff --git a/drivers/perf/marvell_cn10k_tad_pmu.c b/drivers/perf/marvell_cn10k_tad_pmu.c
> index af706b890bf17..e43598a52859e 100644
> --- a/drivers/perf/marvell_cn10k_tad_pmu.c
> +++ b/drivers/perf/marvell_cn10k_tad_pmu.c
[ ... ]
> @@ -85,8 +89,15 @@ static void tad_pmu_start_counter(struct tad_pmu *pmu,
>  	if (use_mpam && event_idx > 0x19 && event_idx < 0x21) {
>  		partid_filter = TAD_PRF_MATCH_PARTID | TAD_PRF_PARTID_NS |
>  				((u64)partid << 11);
> +
> +		if (pdata->id == TAD_PMU_V3)
> +			partid_filter = TAD_PRF_MATCH_PARTID | TAD_PRF_MATCH_MPAMNS |
> +				((u64)partid << 10);
>  	}
>  
> +	/* CN10K support events 0:24*/
> +	if (pdata->id == TAD_PMU_V1 && event_idx >= 0x25)
> +		return;

[Severity: Medium]
In tad_pmu_event_init(), the event configuration is validated using a masked
value:

tad_pmu_event_init() {
    ...
    u32 event_idx = (u32)(event->attr.config & GENMASK(7, 0));
    ...
}

However, in tad_pmu_start_counter(), event_idx is assigned directly from the
unmasked event->attr.config.

If a user provides an event configuration with upper bits set (e.g., 0x124),
it will pass the masked initialization checks, but won't it fail the unmasked
bounds checks here?

For V1 hardware, an unmasked config like 0x124 would evaluate as >= 0x25 and
trigger this new early return after clearing the counter but before
programming it, leaving the hardware in an aborted state.

Similarly, for V3 hardware, wouldn't the unmasked event_idx fail the
MPAM filter condition (event_idx > 0x19 && event_idx < 0x21) earlier in this
function, causing the counter to incorrectly bypass the filter and record all
partition IDs?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260612095746.19679-1-gakula@marvell.com?part=2