Re: [PATCH v2 7/9] perf/cxl: Validate the hardware-reported counter width

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds MMIO write via `writeq()` overwriting the adjacent 32-bit filter register.
--

--- Patch [7]: [PATCH v2 7/9] perf/cxl: Validate the hardware-reported counter width ---
commit 5420efbe1c059e0ba51ccd9a185a7ae26d9866db
Author: Dave Jiang <[email protected]>

perf/cxl: Validate the hardware-reported counter width

cxl_pmu_parse_caps() takes the Counter Width straight from the CPMU Capability
register with no bounds check. A device reporting width 0 or > 64 is invalid,
so reject a counter width outside 1..64 at probe.

Closes: https://sashiko.dev/#/patchset/[email protected]?part=1

> diff --git a/drivers/perf/cxl_pmu.c b/drivers/perf/cxl_pmu.c
> index 52e78a6e09603..2e817a52ff1e1 100644
> --- a/drivers/perf/cxl_pmu.c
> +++ b/drivers/perf/cxl_pmu.c

[ ... ]

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential
out-of-bounds MMIO write in cxl_pmu_event_start() in this same file:

    writeq(cfg, base + CXL_PMU_FILTER_CFG_REG(hwc->idx, 0));

Can writing 64 bits using writeq to a 32-bit MMIO register cause an
Unsupported Request (UR) PCIe error on devices that only support 32-bit
access to this region?

If the hardware does happen to accept the 64-bit write, will this silently
overwrite the adjacent 32-bit filter register with zeroes, corrupting its
state?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=7