Re: [PATCH V3 05/19] accel/amdxdna: Add NPU3 classic device support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] amdxdna: user-triggerable WARN_ON due to 0 dev_mem_size on NPU3
--

commit f86aaf866bc504bcba674227ac3b36c9902b057f
Author: David Zhang <yidong.zhang@amd.com>

accel/amdxdna: Add NPU3 classic device support

This commit adds NPU3 classic device operations, register definitions, PCI
device IDs, and firmware declarations. It also guards device heap memory
initialization against a zero-sized device heap, since NPU3 does not
configure a dedicated device memory heap.

> diff --git a/drivers/accel/amdxdna/npu3_regs.c b/drivers/accel/amdxdna/npu3_regs.c
> index 93f749acb5d5d..c82433d629012 100644
> --- a/drivers/accel/amdxdna/npu3_regs.c
> +++ b/drivers/accel/amdxdna/npu3_regs.c

[ ... ]

> @@ -105,3 +105,17 @@ const struct amdxdna_dev_info dev_npu3_vf_info = {
>  	.cert_feature_tbl	= npu3_cert_feature_table,
>  	.ops			= &aie4_vf_ops,
>  };
> +
> +const struct amdxdna_dev_info dev_npu3_classic_info = {
> +	.mbox_bar		= NPU3_MBOX_BAR,

[Severity: Medium]
Since this struct leaves dev_mem_size uninitialized (defaults to 0),
can this cause a user-triggerable WARN_ON?

When an unprivileged user space client calls the DRM_IOCTL_AMDXDNA_CREATE_BO
ioctl with args.type == AMDXDNA_BO_DEV_HEAP, the handler delegates to
amdxdna_drm_create_dev_heap_bo() without verifying if the device actually
supports a heap.

In amdxdna_drm_create_dev_heap_bo():

        WARN_ON(!is_power_of_2(xdna->dev_info->dev_mem_size));

Since dev_mem_size is 0, is_power_of_2(0) evaluates to false, causing the
WARN_ON to execute. This allows any local user with DRM node access to
flood the kernel log or potentially trigger a crash if panic_on_warn is
enabled.

> +	.sram_bar		= NPU3_MBOX_BUFFER_BAR,
> +	.psp_bar                = NPU3_PSP_BAR_INDEX,
> +	.smu_bar		= NPU3_SMU_BAR_INDEX,
> +	.doorbell_bar		= NPU3_DOORBELL_BAR,
> +	.default_vbnv		= "RyzenAI-npu3",
> +	.device_type		= AMDXDNA_DEV_TYPE_UMQ,
> +	.dev_priv		= &npu3_dev_priv,
> +	.fw_feature_tbl		= npu3_fw_feature_table,
> +	.cert_feature_tbl	= npu3_cert_feature_table,
> +	.ops			= &aie4_classic_ops,
> +};

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008032348.2044667-1-yidong.zhang@amd.com?part=5