Claude review: accel: ethosu: Validate SRAM size on submit

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Correctness:** The core logic change is sound. Before this patch, the SRAM region bypass in the loop at line ~417 checked:

```c
if (!job->region_bo_handles[i] &&
    (!cmd_info->region_size[i] || (i == ETHOSU_SRAM_REGION && job->sram_size)))
    continue;
```

This allowed any SRAM region through as long as userspace set `job->sram_size` to nonzero — but `job->sram_size` comes directly from the `struct drm_ethosu_job` ioctl argument and can be anything. The new code instead validates against `edev->npu_info.sram_size`, which is set from `gen_pool_size()` during driver probe (`ethosu_drv.c:284`), making it trustworthy.

**Edge case — no SRAM configured:** When the device has no SRAM pool, `edev->npu_info.sram_size` is initialized to 0 (`ethosu_drv.c:278`). The new condition `cmd_info->region_size[i] <= edev->npu_info.sram_size` will only pass when `region_size[i]` is also 0, which was already handled by the `!cmd_info->region_size[i]` check above. So a nonzero SRAM region request on a device without SRAM will correctly be rejected. Good.

**Interaction with the earlier `job->sram_size` checks:** The existing validation at lines 377-381 still checks `job->sram_size` against `edev->npu_info.sram_size` and uses `job->sram_size` to guard HW register writes at line 60. Those uses remain valid — `job->sram_size` is bounded by the check at line 380, and is used to decide whether to program the SRAM base address, not to set a size limit. The new check is complementary, validating the *command stream's* declared region size, which is a separate trust boundary.

**Minor nit — trailing whitespace:** Line 428 in the patched file (`edev->npu_info.sram_size);`) appears to have a trailing space after the comma on the line above:

```c
				i, cmd_info->region_size[i], 
				edev->npu_info.sram_size);
```

There's a trailing space after the `,` before the newline continuation. This would likely trigger `checkpatch.pl --strict` warnings. Not a functional issue.

**Format specifier correctness:** `region_size[i]` is `u64` (from `ethosu_gem.h:12`), printed with `%llu` — correct. `sram_size` is `__u32` (from `ethosu_accel.h:81`), printed with `%u` — correct.

**Overall:** This is a clean, well-scoped security fix. The commit message accurately describes the problem and the approach. Reviewed-by worthy with or without the whitespace nit fix.

---
Generated by Claude Code Patch Reviewer