Re: [PATCH V3 05/19] accel/amdxdna: Add NPU3 classic device support

[Zhang, Yidong (David)]

On 10/7/2026 8:44 PM, sashiko-...@kernel.org wrote:

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) 
to consider:
- [Medium] amdxdna: user-triggerable WARN_ON due to 0 dev_mem_size on NPU3
--

commit f86aaf866bc504bcba674227ac3b36c9902b057f
Author: David Zhang <yidong.zh...@amd.com>

accel/amdxdna: Add NPU3 classic device support

This commit adds NPU3 classic device operations, register definitions, PCI
device IDs, and firmware declarations. It also guards device heap memory
initialization against a zero-sized device heap, since NPU3 does not
configure a dedicated device memory heap.

diff --git a/drivers/accel/amdxdna/npu3_regs.c 
b/drivers/accel/amdxdna/npu3_regs.c
index 93f749acb5d5d..c82433d629012 100644
--- a/drivers/accel/amdxdna/npu3_regs.c
+++ b/drivers/accel/amdxdna/npu3_regs.c

[ ... ]

@@ -105,3 +105,17 @@ const struct amdxdna_dev_info dev_npu3_vf_info = {
        .cert_feature_tbl       = npu3_cert_feature_table,
        .ops                    = &aie4_vf_ops,
  };
+
+const struct amdxdna_dev_info dev_npu3_classic_info = {
+       .mbox_bar               = NPU3_MBOX_BAR,

[Severity: Medium]
Since this struct leaves dev_mem_size uninitialized (defaults to 0),
can this cause a user-triggerable WARN_ON?

When an unprivileged user space client calls the DRM_IOCTL_AMDXDNA_CREATE_BO
ioctl with args.type == AMDXDNA_BO_DEV_HEAP, the handler delegates to
amdxdna_drm_create_dev_heap_bo() without verifying if the device actually
supports a heap.

In amdxdna_drm_create_dev_heap_bo():

         WARN_ON(!is_power_of_2(xdna->dev_info->dev_mem_size));

Since dev_mem_size is 0, is_power_of_2(0) evaluates to false, causing the
WARN_ON to execute. This allows any local user with DRM node access to
flood the kernel log or potentially trigger a crash if panic_on_warn is
enabled.

Yes, will fix this with a single patch.

/David

+       .sram_bar               = NPU3_MBOX_BUFFER_BAR,
+       .psp_bar                = NPU3_PSP_BAR_INDEX,
+       .smu_bar                = NPU3_SMU_BAR_INDEX,
+       .doorbell_bar           = NPU3_DOORBELL_BAR,
+       .default_vbnv           = "RyzenAI-npu3",
+       .device_type            = AMDXDNA_DEV_TYPE_UMQ,
+       .dev_priv               = &npu3_dev_priv,
+       .fw_feature_tbl         = npu3_fw_feature_table,
+       .cert_feature_tbl       = npu3_cert_feature_table,
+       .ops                    = &aie4_classic_ops,
+};