Re: [PATCH V4 04/19] accel/amdxdna: Support firmware 6.0

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] accel/amdxdna: missing capability check for REALTIME priority allows DoS
--

commit 33aba925e30324fed055cc90f6f20b1a9826f931
Author: David Zhang <yidong.zhang@amd.com>

accel/amdxdna: Support firmware 6.0

This commit supports firmware interface version 6.0 by updating the host queue
layout, opcode definitions, and context creation/destruction request structures.
It also parses priority band and PASID for hardware context creation.

> diff --git a/drivers/accel/amdxdna/aie4_ctx.c b/drivers/accel/amdxdna/aie4_ctx.c
> index 8157f2a6fd10a..5eb918e1d58c7 100644
> --- a/drivers/accel/amdxdna/aie4_ctx.c
> +++ b/drivers/accel/amdxdna/aie4_ctx.c

[ ... ]

> @@ -110,6 +111,22 @@ static int aie4_msg_destroy_context(struct amdxdna_dev_hdl *ndev, u32 hw_context
>  	return aie_send_mgmt_msg_wait(&ndev->aie, &msg);
>  }
>  
> +static u8 aie4_parse_priority_to_dev(u32 priority)
> +{
> +	switch (priority) {
> +	case AMDXDNA_QOS_LOW_PRIORITY:
> +		return AIE4_CONTEXT_PRIORITY_BAND_IDLE;
> +	case AMDXDNA_QOS_NORMAL_PRIORITY:
> +		return AIE4_CONTEXT_PRIORITY_BAND_NORMAL;
> +	case AMDXDNA_QOS_HIGH_PRIORITY:
> +		return AIE4_CONTEXT_PRIORITY_BAND_FOCUS;
> +	case AMDXDNA_QOS_REALTIME_PRIORITY:
> +		return AIE4_CONTEXT_PRIORITY_BAND_REAL_TIME;

[Severity: Medium]
Could this allow an unprivileged user to monopolize the NPU?

In aie4_parse_priority_to_dev() in drivers/accel/amdxdna/aie4_ctx.c, when a
user calls the AMDXDNA_CREATE_HWCTX ioctl and passes
AMDXDNA_QOS_REALTIME_PRIORITY in qos.priority, this maps directly to
AIE4_CONTEXT_PRIORITY_BAND_REAL_TIME during context creation and is sent to
the firmware.

Since there doesn't appear to be a capability check (such as verifying if the
caller possesses CAP_SYS_NICE or similar privileges), could any local user
with access to the DRM node create an NPU hardware context with REALTIME
priority and starve other workloads, causing a denial of service?

> +	default:
> +		return AIE4_CONTEXT_PRIORITY_BAND_NORMAL;
> +	}
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009225343.3079074-1-yidong.zhang@amd.com?part=4