Re: [PATCH V4 05/19] accel/amdxdna: Add NPU3 classic device support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] amdxdna: user-triggerable WARN_ON via AMDXDNA_BO_DEV_HEAP on NPU3 classic
--

commit 9daa4537d3513c6a4bc057f8afd01b65162be2b6
Author: David Zhang <yidong.zhang@amd.com>

accel/amdxdna: Add NPU3 classic device support

Add NPU3 classic device operations (aie4_classic_ops) and register
definitions, as well as the PCI device ID and firmware declarations for
NPU3 classic devices. Remove device IDs 0x1B0B and 0x1B0C because those
devices will not be released.

> diff --git a/drivers/accel/amdxdna/npu3_regs.c b/drivers/accel/amdxdna/npu3_regs.c
> index 93f749acb5d5d..c82433d629012 100644
> --- a/drivers/accel/amdxdna/npu3_regs.c
> +++ b/drivers/accel/amdxdna/npu3_regs.c
> @@ -105,3 +105,17 @@ const struct amdxdna_dev_info dev_npu3_vf_info = {
>  	.cert_feature_tbl	= npu3_cert_feature_table,
>  	.ops			= &aie4_vf_ops,
>  };
> +
> +const struct amdxdna_dev_info dev_npu3_classic_info = {
> +	.mbox_bar		= NPU3_MBOX_BAR,
> +	.sram_bar		= NPU3_MBOX_BUFFER_BAR,
> +	.psp_bar                = NPU3_PSP_BAR_INDEX,
> +	.smu_bar		= NPU3_SMU_BAR_INDEX,
> +	.doorbell_bar		= NPU3_DOORBELL_BAR,
> +	.default_vbnv		= "RyzenAI-npu3",
> +	.device_type		= AMDXDNA_DEV_TYPE_UMQ,
> +	.dev_priv		= &npu3_dev_priv,
> +	.fw_feature_tbl		= npu3_fw_feature_table,
> +	.cert_feature_tbl	= npu3_cert_feature_table,
> +	.ops			= &aie4_classic_ops,
> +};

[Severity: Medium]
Since dev_mem_size is omitted here, it defaults to 0. Does this cause a
kernel warning when creating a device heap BO?

If an unprivileged user opens the accelerator device and requests a BO with
type AMDXDNA_BO_DEV_HEAP, the ioctl dispatcher calls
amdxdna_drm_create_dev_heap_bo() which unconditionally evaluates:

WARN_ON(!is_power_of_2(xdna->dev_info->dev_mem_size));

Since dev_mem_size is 0, this will evaluate to true and trigger a warning,
potentially causing a local denial of service if panic_on_warn is enabled.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009225343.3079074-1-yidong.zhang@amd.com?part=5