Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] amdxdna: unaligned memory access in aie4_set_runtime_cfg() --
commit 1c7fe2fcd8c5df7169f8d7c14de7898318de0123 Author: David Zhang <[email protected]> accel/amdxdna: Add context switch hysteresis with debugfs control This commit adds aie4_set_ctx_hysteresis() to configure the AIE4 context switch hysteresis timeout. It also exposes a debugfs node to change the timeout at runtime. > diff --git a/drivers/accel/amdxdna/aie4_message.c > b/drivers/accel/amdxdna/aie4_message.c > index 7112b0bc3725a..5720aa88e6d6d 100644 > --- a/drivers/accel/amdxdna/aie4_message.c > +++ b/drivers/accel/amdxdna/aie4_message.c [ ... ] > @@ -262,3 +262,46 @@ int aie4_msg_set_power_mode(struct amdxdna_dev_hdl > *ndev, u8 power_mode) > > return ret; > } > + > +int aie4_set_runtime_cfg(struct amdxdna_dev_hdl *ndev, u32 type, > + const void *data, size_t size) > +{ > + DECLARE_AIE_MSG(aie4_msg_set_runtime_cfg, > AIE4_MSG_OP_SET_RUNTIME_CONFIG); > + u8 buf[sizeof(req.type) + AIE4_RUNTIME_CFG_MAX_DATA_SIZE] = { 0 }; [Severity: Medium] Could this lead to unaligned memory access? The payload buffer is declared as a byte array with no alignment guarantees, meaning its start address on the stack might not be 4-byte aligned. Later in this function, buf is assigned to msg.send_data and passed to aie_send_mgmt_msg_wait(). When the mailbox code processes this message, it does: drivers/accel/amdxdna/amdxdna_mailbox.c:xdna_mailbox_send_msg() { ... if (unlikely(((u32 *)msg->send_data)[0] == TOMBSTONE)) { ... } Dereferencing a potentially unaligned pointer via a u32 pointer cast is undefined behavior. While x86_64 hardware typically handles unaligned reads gracefully, the compiler is permitted to optimize assuming the pointer is strictly 4-byte aligned, which can lead to miscompilation. Furthermore, this will trigger Undefined Behavior Sanitizer (UBSAN) warnings during runtime testing. Could the buffer be aligned, perhaps by using __aligned(4) or an appropriately typed struct? > + int ret; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=9
