From nobody Sun Sep 27 00:35:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A40B3644BC for ; Thu, 27 Aug 2026 20:33:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862804; cv=none; b=BQC3bd0kq2Xr3/KhKSkliwkO2cbUSYhNq66h822mKU3GT7rzSIRumKg3oQE62yrEd066Ybw5EsNgkjpRaSgvYh51UDOu4BgcITW16BUCyaOzFgerJuPJwempkMlBpWCt+FIme6rMAbtN0WZajCQKkdM3EJvf+b7nkgxqvcp3hAE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862804; c=relaxed/simple; bh=dSIHslj+vZ9Da1R3G/PUkbvpiK5yzk6bs/ZH+hKU6ug=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=rwNd9DGEXzvFj40DbACmVzkPGGe0bixSA5uMiCisQMJIUpgHwtOXbIJs2p9F/5Cu7Jrx7QoOlG+ktpQXkEB+r0TdA0qJlCcQEZMgxbOi8aa/dDWbRZhs/xcDttmKdiBIJh97GDBO4jJQQtLiTQttwsD802nFp+aqNzkZW3V5vgY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JEPy6ki8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JEPy6ki8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF8D01F00A3A; Thu, 27 Aug 2026 20:33:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787862798; bh=IdrnkpO3EzdVTmDSOgcFTiAoRe1SyW/dmxYVVke1fVs=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=JEPy6ki84+j3c0MBpLgac1q0eGsGl8Eec2pcb+Z7oPjDjMnKDJfo+7Ejzbqu66P7T +dm6uqiPMBqrdCYQjl9eCKBsvGKuWVMVFCK1lfoCeehoYOK5/S29vHibBqFPMSwhBf f6s3+ANgfIUEWrXyKNIn4LBjRY6cyDqdiOeIZSLjkIvK3pEQ1tsrU6kwwKQK0+vKwF jHDAZYmu9JFwO0nZO3+dn8o6bjDxehyRAjUyne3DscN6CNL0bfBccocwqxQyMuvaEV vYrTLNDDNiizp6DdXr8urcBhKMYQp+7mRWOfUVxy4nw3rH9JhGUux4KWyRRU1ZrIvV UUgYBwTa9AB6A== From: "Rob Herring (Arm)" Date: Thu, 27 Aug 2026 15:33:00 -0500 Subject: [PATCH 01/11] accel: ethosu: Fix ethosu_job_open() return value Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260827-ethosu-fixes-v1-1-346f9ea8791c@kernel.org> References: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> In-Reply-To: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev A WARN_ON() returns a 0 or 1, not the original negative errno. Just drop the WARN_ON() as the FD open will pass the return code to userspace and there's only one possible source of the error (drm_sched_entity_init()). Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Signed-off-by: Rob Herring (Arm) Reviewed-by: Frank Li --- drivers/accel/ethosu/ethosu_job.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethos= u_job.c index 6a038c0384cc..99c8812691e5 100644 --- a/drivers/accel/ethosu/ethosu_job.c +++ b/drivers/accel/ethosu/ethosu_job.c @@ -368,12 +368,10 @@ int ethosu_job_open(struct ethosu_file_priv *ethosu_p= riv) { struct ethosu_device *dev =3D ethosu_priv->edev; struct drm_gpu_scheduler *sched =3D &dev->sched; - int ret; =20 - ret =3D drm_sched_entity_init(ðosu_priv->sched_entity, - DRM_SCHED_PRIORITY_NORMAL, - &sched, 1, NULL); - return WARN_ON(ret); + return drm_sched_entity_init(ðosu_priv->sched_entity, + DRM_SCHED_PRIORITY_NORMAL, + &sched, 1, NULL); } =20 void ethosu_job_close(struct ethosu_file_priv *ethosu_priv) --=20 2.53.0 From nobody Sun Sep 27 00:35:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8185D30EF8F for ; Thu, 27 Aug 2026 20:33:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862804; cv=none; b=gkd0Py0JI5VOOu/+mUExP5U7nnyO44fUBAfrkROuVzUpp/3WSD3W7HIbxapbsg+YlHWokOmvPYBWYJZOqseAKcVQtiBft1kRGLHhCjQCcuyHiM5kmr/3yDaLvrImV37PCSiHAo4DKNDi36ctvCDcNp52GJjJ8rnJLIc/b0jGJKc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862804; c=relaxed/simple; bh=PFORI70wkTXBJ3E9N+a4Qcwh/pK2Gq+1Tzt8EZcC7q8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=AZvIa0iKCpbvIPe6WzCCHkZY2SJ56NpsNQO/5UFYcMgd3pMARxsEYQWG3G8yu11DGoj5nalD2NjZFbWKfI6wo1qlqc+b/jWa4MVhT5LhEEziT077qScg5rqWDhxy+a7tEKAYOAesiTA3HmukuSGbFnIlkyguu5IbyKJDjuvaQ3k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NG5zfhq1; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NG5zfhq1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C51401F00A3D; Thu, 27 Aug 2026 20:33:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787862799; bh=5CB2dKmCQSY1qUwmTvFZhSCvj33xjn/pkJ3N+pasapc=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=NG5zfhq1Ui8zNeI5gL/cL0XPa92Qw1KI/XTkJu21PAB4scoAMTTQfSFQyLgYj/tsH m92JgKh+VAeNdNgyBfGIjaNcf5Daj4zqJztOPB4hNiGqvmhpoG4/l8nMsL4xtmSU2v uxViQJYyo7uotjCM2ovzAhHhLomUldN3EfH/IQMbgaZWwQnNkrMIgOZVUwcA04b9lS qX70JxU4ceVtQuDaga1p4SEOYiuT8kaMLEnd6bQ0mwQxHm7TjsQ76pWgvL9JJpuFAQ 5fSYzG2mlwoq4ZDA6OUHVxzwf/vII2BB1xNl9Sf1coSMkW0UpNHKmXUFW9Etk+V+su nzmLcaaprEYhg== From: "Rob Herring (Arm)" Date: Thu, 27 Aug 2026 15:33:01 -0500 Subject: [PATCH 02/11] accel: ethosu: Drop IRQF_SHARED flag Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260827-ethosu-fixes-v1-2-346f9ea8791c@kernel.org> References: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> In-Reply-To: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The IRQF_SHARED flag doesn't work with runtime-pm as the IRQ handler could run without resuming the device. This could also be fixed with runtime-pm calls in the IRQ handler, but there is no known need for a shared IRQ. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Signed-off-by: Rob Herring (Arm) Reviewed-by: Frank Li --- drivers/accel/ethosu/ethosu_job.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethos= u_job.c index 99c8812691e5..c33f2877b385 100644 --- a/drivers/accel/ethosu/ethosu_job.c +++ b/drivers/accel/ethosu/ethosu_job.c @@ -337,7 +337,7 @@ int ethosu_job_init(struct ethosu_device *edev) ret =3D devm_request_threaded_irq(dev, edev->irq, ethosu_job_irq_handler, ethosu_job_irq_handler_thread, - IRQF_SHARED, KBUILD_MODNAME, + 0, KBUILD_MODNAME, edev); if (ret) { dev_err(dev, "failed to request irq\n"); --=20 2.53.0 From nobody Sun Sep 27 00:35:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7DC8F184540 for ; Thu, 27 Aug 2026 20:33:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862804; cv=none; b=a9CHZzyLYIILjsIisio9FAiHWmde0h31lImsdosf2cyr2AITUWibKfTbADFttSiXsVLUZ/7GplKMX8iisI+g2BcUaI25pRykQqS7Efn+njYDB43FBQtrgff5aoIz/wBY/qDut8NQW0tAsYx6ia9E0pYO6tZdnYMKUwEPjEgHxVk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862804; c=relaxed/simple; bh=3z7xUq9E0oQENcyJ5atvmFQyYAxSsfTrJdb3r6AC9Y8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=nNXmWaSPdQh83sXaULCTVRsAo2YPWlxPNzlfLNz8gj0ofN/cnaboI0+ENwwmT+xMLsACU8IjEQF/Pbznl7pA9bWM4MYa+v57HzwtdMBVsbvsrBg9xmW83ZTivPKJN2mcSmC4tq0IROUUAQmEWECPU/RG23E/o/j+/iFX25uL9Og= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CIQVGsDo; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CIQVGsDo" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A78A71F00A3E; Thu, 27 Aug 2026 20:33:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787862799; bh=uKRuauSHS7on2i2iMUcMVC1/wQ8QGKYpMLEC5RACVLg=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=CIQVGsDoYzHEuoTPQ1yEWP7Qqb3b+X9Aa6dVflNeVPLLcUWtkSqTmBllkZD3YvGdD U1b22kIvz0xIm44FVAu3C3wmyBZK0OZzoczxJveeCqtFytJUy3877p1LiypYbP2YBo OxongRGP8eabViiKh72axWv7BHp4cNuYJrQKjMVqEvCFKD44bt+Vj9pF+FxzanRko6 H0kneYZfMPE1paAfakswBLXnLZ/g9TMYp/fufoaX1ebFfjxWkXHYIchImodEsySuM3 eF2uoFlZEpoF5aOl/KmgzTtNo74ZL2xkJsEoTZLjr/wETENNZ+s86cJBtFjIEAkrdn O1AMbQHr2Z9jQ== From: "Rob Herring (Arm)" Date: Thu, 27 Aug 2026 15:33:02 -0500 Subject: [PATCH 03/11] accel: ethosu: Ensure cmd stream ends with a stop op Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260827-ethosu-fixes-v1-3-346f9ea8791c@kernel.org> References: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> In-Reply-To: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev While the QSIZE register setting should prevent an out of bounds access of the command stream, it is not clear whether the h/w generates an interrupt in this case as is required (to prevent a timeout). As a stop op is expected end of the command stream, let's just ensure it is present. A stop op in the middle of the command stream also makes no sense. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Signed-off-by: Rob Herring (Arm) Reviewed-by: Frank Li --- drivers/accel/ethosu/ethosu_device.h | 1 + drivers/accel/ethosu/ethosu_gem.c | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index d4458eac8447..1eca8590e68d 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -87,6 +87,7 @@ struct gen_pool; #define PMU_EV_TYPE_IDLE 0x20 =20 enum ethosu_cmds { + NPU_OP_STOP =3D 0x0, NPU_OP_CONV =3D 0x2, NPU_OP_DEPTHWISE =3D 0x3, NPU_OP_POOL =3D 0x5, diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index d50fed64d4d9..eda9f42239be 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -390,6 +390,7 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, struct ethosu_validated_cmdstream_info __free(kfree) *info =3D kzalloc_ob= j(*info); struct ethosu_device *edev =3D to_ethosu_device(ddev); u32 *bocmds =3D bo->base.vaddr; + bool ends_with_stop =3D false; struct cmd_state st; int i, ret; =20 @@ -426,6 +427,11 @@ static int ethosu_gem_cmdstream_copy_and_validate(stru= ct drm_device *ddev, } =20 switch (cmd) { + case NPU_OP_STOP: + if (i !=3D size / 4 - 1) + return -EINVAL; + ends_with_stop =3D true; + break; case NPU_OP_DMA_START: srclen =3D dma_length(info, &st.dma, &st.dma.src); dstlen =3D dma_length(info, &st.dma, &st.dma.dst); @@ -688,6 +694,9 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, } } =20 + if (!ends_with_stop) + return -EINVAL; + for (i =3D 0; i < NPU_BASEP_REGION_MAX; i++) { if (!info->region_size[i]) continue; --=20 2.53.0 From nobody Sun Sep 27 00:35:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 83C1D367B74 for ; Thu, 27 Aug 2026 20:33:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862806; cv=none; b=UQmGedSV9bOlz5Ql8DFREAssaAsZxjqeJQzUkUylgpgfPk9KFolRYwxvl4rc3K3DK3wkAcrsV0/3SWAiqA/GUYUBr8qv1mm5WgCNU7UXWky8PFLVQXH0hERohO7g+z/GSBO8S5hYHduN4hn6saSVh8gCADnu1E8ez51vmjdHVj0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862806; c=relaxed/simple; bh=sQuQlp8R4ysVl7cElEjleVyXLS1sFHFr38pDZK4MvYI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=WnpnHCwFT0n8AxVjX3YVL6PJAmES7PTKZN59fxDWP7a5mVdA52AbOtTtHSdlL2dPUL7LOCod7drwLjVlrpAIo9b9T7gAT/DV6MvjFnT2UhQZKJNwizpHPrgMqoQgNuC7pIvOQimh/QrSeXRx6djqJyin3Yru4CBXhyd00Onpmi8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MVgsmmQQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MVgsmmQQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 87C011F000E9; Thu, 27 Aug 2026 20:33:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787862800; bh=hzR9RLCyU76G62Dq90oauFYiDU2TqRfYxKeKOLu97co=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=MVgsmmQQN6NIEXxq8eit9LyVhsZST9szrbp5fKhPIlVqHqfuXgLI6/REQXxzdo1Xl yjy4jT1offVOLnZz+NPWnQW0AU1s3LURwQ1OQVZwdFLJ9ycLXuWv7eCfCd9tN26tZ2 P2KsFDK6fPhTiZXqc8ICFQuov/HUmdab5TiiFXD0LoF0vWqqSIdkzUvUdJg8uN/WxE +hA87C/xJlQlJfzbmIG5sMc6CnkyBk5bDf1hx2xr6zbvhQksuicL82oMQDsMmBOuBJ hwTbqNh4DQjfzDIIIaU3OyRltCOoyduhgsg4mkxfuKZqQYGo/ZfbwwROwinexQOj2G rOXES/Qp5928A== From: "Rob Herring (Arm)" Date: Thu, 27 Aug 2026 15:33:03 -0500 Subject: [PATCH 04/11] accel: ethosu: Ensure SRAM size is 0 on mapping failure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260827-ethosu-fixes-v1-4-346f9ea8791c@kernel.org> References: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> In-Reply-To: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev On a mapping failure of the SRAM, the SRAM size is left as non-zero. The probe will succeed as the error return is not checked since having SRAM is not a hard requirement. The non-zero size allows jobs to access SRAM which is left pointing to physical base address 0x0. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Signed-off-by: Rob Herring (Arm) Reviewed-by: Frank Li --- drivers/accel/ethosu/ethosu_drv.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index d121fb0d7732..f1af7b3ea038 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -281,8 +281,6 @@ static int ethosu_device_suspend(struct device *dev) =20 static int ethosu_sram_init(struct ethosu_device *ethosudev) { - ethosudev->npu_info.sram_size =3D 0; - ethosudev->srampool =3D of_gen_pool_get(ethosudev->base.dev->of_node, "sr= am", 0); if (!ethosudev->srampool) return 0; @@ -293,6 +291,7 @@ static int ethosu_sram_init(struct ethosu_device *ethos= udev) ethosudev->npu_info.sram_size, ðosudev->sramphys); if (!ethosudev->sram) { + ethosudev->npu_info.sram_size =3D 0; dev_err(ethosudev->base.dev, "failed to allocate from SRAM pool\n"); return -ENOMEM; } --=20 2.53.0 From nobody Sun Sep 27 00:35:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1CF7731F9A5 for ; Thu, 27 Aug 2026 20:33:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862812; cv=none; b=b20ygB67ryggRLWZhHgFuYpBzsZ0AkNbVCY4gRIgDPbP2ZJHQDcbkmlJtMGD9cdiOLDReAq4++UhyxvCwFVjHAaTTzZLdblCF7pu39fsvEb+Tz4YEo/2oJO5t/7VtOfbmsQnvuFqaLmyUEX6wWQROm+Wkx13SJvkRAL3r/Xjiyo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862812; c=relaxed/simple; bh=3BAaltnCkbdgENCRtuIxeD3voB1ggAQUkOZ4SyHFgWo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Or0Yk1lIFMWyZkCCcS5yL9jnhcLXVRXXygAd0BZsdc86DToINqmBlDa4+jNIsyx5sKtryU5/4B4EelIX28feIUlozeMge+ixCOocEYPsB2rkmwejpH7jg/qBF1HcV8DYfUEyfe0A01c+h2loKYo+kmMM7Ajdi5pbD4/UXoWBifc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FZjBjz2i; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FZjBjz2i" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C0E11F00A3F; Thu, 27 Aug 2026 20:33:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787862801; bh=dN++67rDjyqdMbNr9GA584bXADDlqA1mW/Fue7rbdF0=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=FZjBjz2iuHmvca0Joxx8flKYOPpCp2GjHnzDVk39GGYuo495dslkA14YDTSpu0kr5 d7F5AZM9rklq78LNtaPlkQU7ZZqmEGYnedtbLKOhmkEsQ8q/COJZkQl2p6zJLigTiY bakfQroTL0zkJxnIVATv2MTIDtQN9QA0rZz950od/Hb10qhNv9qkG2igD0mH3cc/4/ EJzCcdwNOvEFjpDiy4I1hSOWi5ea1t7grQb+Rr9w+UDgRD0/3vIkw9k5TMME1xHzy5 YCpKzkvC0p/aYNQVjXQHvXK9L2frwZriiP7tG/zLXzFkTWdITYkl/mo4xIdI2LeeTV N9Eql8oqAXY5Q== From: "Rob Herring (Arm)" Date: Thu, 27 Aug 2026 15:33:04 -0500 Subject: [PATCH 05/11] accel: ethosu: Ensure SRAM region size matches job Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260827-ethosu-fixes-v1-5-346f9ea8791c@kernel.org> References: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> In-Reply-To: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register is skipped and a stale base address from a prior job is used. Check the region size against the job's SRAM size instead of just the size of the SRAM. The job's SRAM size was already checked against the total SRAM size. Fixes: 9cff90774872 ("accel: ethosu: Validate SRAM size on submit") Cc: stable@vger.kernel.org Signed-off-by: Rob Herring (Arm) Reviewed-by: Frank Li --- drivers/accel/ethosu/ethosu_job.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethos= u_job.c index c33f2877b385..0982722a9195 100644 --- a/drivers/accel/ethosu/ethosu_job.c +++ b/drivers/accel/ethosu/ethosu_job.c @@ -441,13 +441,13 @@ static int ethosu_ioctl_submit_job(struct drm_device = *dev, struct drm_file *file if (!cmd_info->region_size[i]) continue; if (i =3D=3D ETHOSU_SRAM_REGION) { - if (cmd_info->region_size[i] <=3D edev->npu_info.sram_size) + if (cmd_info->region_size[i] <=3D ejob->sram_size) continue; =20 dev_err(dev->dev, - "cmd stream region %d size greater than SRAM size (%llu > %u)\n", + "cmd stream region %d size greater than job SRAM size (%llu > %u)\n", i, cmd_info->region_size[i], - edev->npu_info.sram_size); + ejob->sram_size); ret =3D -EINVAL; goto out_cleanup_job; } --=20 2.53.0 From nobody Sun Sep 27 00:35:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1C82E307AC7 for ; Thu, 27 Aug 2026 20:33:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862809; cv=none; b=emsmikwcKoba6Z2uu984OnoP0t98SXI6T9Db1xBdwPLKrAU3c3QkBeb7QXKO+UBQm19O/AI4vaSgB/WkbH9Yr8fRT8YjC/TvAH1Gso0jndrWkX1sy+d0gHgPPf2Avcqhnz5KXyDUd4O4kZg4ED7rkFd0nfrawnkude6gj/wkl6s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862809; c=relaxed/simple; bh=JL448ACxsasqagv0UZWbVOd855N/jHYJAj8LxB9DKkc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=BfPDm7NtzplVPNEfEmLxKV07pTgHPQHq0SRQEbIhFOEyFgMIwwquFZJunPbIbaqcn33ZZY6DZEJcwg4/Nix7iIhcWqqdQ5sqA97bIfUNoSUfGJr1Au6q5L0SSwKlF0UwbnW7LuDAXhzZPBFrY0g8RCbDFYdifrmrPzvj6I2ZV1E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Jh7hjHX7; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Jh7hjHX7" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 36FBA1F00AC4; Thu, 27 Aug 2026 20:33:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787862802; bh=O3KjHmD0IPMWcLD9Xn+YXTCqHQcBqnsYviRiyVpX+NE=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Jh7hjHX7iGtT1ug25dVup8Smp11OoN4Nq5b/Wpp9jIB6B/50iPybYaWXAeAzmX2Zv NnJbjzF1TUlwclczDSizbHOSinYOgYijwB9BOHOJ4DblJ08qE6WaTv2SPgpxjhIHj8 di6HT6vFRrOJUeF1P9lUkhZjaPWvbY/tJGuKUyXhAQ7i9L0PaSe6Vk8DVXdsGnLbzA IGxfQD+KFl3RwBrOWSd84HPgBY6iH2nLBnzFdvPZ43fXVASFGkoJkwRZQc180EIlzo Y6Ank4A48SPAljZ5fOJgPD4wU6FyvxQz5hHJUlkuIGXfBkTaNgOlIbPdBoNFyjCB/a euSpLK/Dg7yrg== From: "Rob Herring (Arm)" Date: Thu, 27 Aug 2026 15:33:05 -0500 Subject: [PATCH 06/11] accel: ethosu: Fix probe error cleanup Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260827-ethosu-fixes-v1-6-346f9ea8791c@kernel.org> References: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> In-Reply-To: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Once the job scheduler has been initialized, failures from ethosu_init() or drm_dev_register() return from probe without tearing it down. The registration failure also leaves the SRAM-pool allocation in use, because the platform remove callback is not called after a failed probe. Unwind the initialized resources on both paths. Also do not call drm_sched_fini() after a failed drm_sched_init(): the scheduler initializer already unwinds its partial setup, while drm_sched_fini() requires a successfully initialized scheduler. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- drivers/accel/ethosu/ethosu_drv.c | 14 ++++++++++++-- drivers/accel/ethosu/ethosu_job.c | 6 +----- 2 files changed, 13 insertions(+), 7 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index f1af7b3ea038..41ecfc623d42 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -371,13 +371,23 @@ static int ethosu_probe(struct platform_device *pdev) =20 ret =3D ethosu_init(ethosudev); if (ret) - return ret; + goto err_job_fini; =20 ret =3D drm_dev_register(ðosudev->base, 0); if (ret) - pm_runtime_dont_use_autosuspend(ethosudev->base.dev); + goto err_pm_runtime; + + pm_runtime_put_autosuspend(ethosudev->base.dev); + return 0; =20 +err_pm_runtime: + pm_runtime_dont_use_autosuspend(ethosudev->base.dev); pm_runtime_put_autosuspend(ethosudev->base.dev); + if (ethosudev->sram) + gen_pool_free(ethosudev->srampool, (unsigned long)ethosudev->sram, + ethosudev->npu_info.sram_size); +err_job_fini: + ethosu_job_fini(ethosudev); return ret; } =20 diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethos= u_job.c index 0982722a9195..7cadd75ad0ba 100644 --- a/drivers/accel/ethosu/ethosu_job.c +++ b/drivers/accel/ethosu/ethosu_job.c @@ -349,14 +349,10 @@ int ethosu_job_init(struct ethosu_device *edev) ret =3D drm_sched_init(&edev->sched, &args); if (ret) { dev_err(dev, "Failed to create scheduler: %d\n", ret); - goto err_sched; + return ret; } =20 return 0; - -err_sched: - drm_sched_fini(&edev->sched); - return ret; } =20 void ethosu_job_fini(struct ethosu_device *dev) --=20 2.53.0 From nobody Sun Sep 27 00:35:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 01F4B374E67 for ; Thu, 27 Aug 2026 20:33:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862813; cv=none; b=oyzoaPVf2eS/hfZDsG2jyY40ug+y9HCUUfZkC386Kwzn5D2z9cvUs81AYCoGd5uqtOzvefSd2hMkV52sXdA8QW7OcW2FqgK2RUoXAgoEVmuZDpF2Z+JV9XJKA7X1HrPg+i9zkEnJ/m9VpnZCfV0BYIISCIfYJrqoweQmM4A9/B0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862813; c=relaxed/simple; bh=TiTIpixjiEKj1j35oZPlylmbEf1lYrJOisUGxThKzBE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=AJjo8KXxwMADtQdxp4S/MGqVTgBZIHRx9UiQ67eChJc2ZuPmH7PLe3Z/x2pvQLQK6MaNqHiCIUvnrWRdMz3Sanwzhez4bRJ6sczqLn+Q5Xrffecq+tX7AGxrQ+ZQX/gsJexvjEKKpN51vEBX8E3E/Bnx0JpH1etD9kezKYVOOUc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JBfuPI9R; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JBfuPI9R" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 11ADD1F00ACA; Thu, 27 Aug 2026 20:33:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787862803; bh=euVg/tOwg5ulL53VFnnSZJZdeTLzg/FGZY1xwhIMPMY=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=JBfuPI9RdPMrhn3lVUSCqZyqwzvidM74e3isdluBD7J6yYxsCyX0qgY2Add2hOZuY DgOnuHK2loRzlARS1Qo6c8MqtgmfIQih7f2iJs2PGhtLVI3szs1/iFbFfJ8tsZ3y6s XkFrVjxPpFN2FvA+daaS7ud3IC84Drn54dBZlZOMolIuraFbaWWbc/YXbBVZUXkhGC I81zzsTczmTjJ6VswHCfDiQtfDS5zwp3JMJj3i6Ro2T6PDNF5JaEcd1EAQGo+uByiK Lrr54V584oMPbESYIk8wXhAhIEyrE5F44vLoAV6FRzvk5vKibdJWbkLCXqVt59nU/3 8AMG79mXYmOig== From: "Rob Herring (Arm)" Date: Thu, 27 Aug 2026 15:33:06 -0500 Subject: [PATCH 07/11] accel: ethosu: Factor buffer bounds checks Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260827-ethosu-fixes-v1-7-346f9ea8791c@kernel.org> References: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> In-Reply-To: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Move the repeated command-stream buffer range validation into a helper in preparation for validating all weight and scale streams. Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) Reviewed-by: Frank Li --- drivers/accel/ethosu/ethosu_gem.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index eda9f42239be..9fce7caeeb9a 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -259,6 +259,22 @@ static u64 feat_matrix_length(struct ethosu_device *ed= ev, return addr; } =20 +static int buffer_size(struct ethosu_validated_cmdstream_info *info, + struct buffer *buf, s8 region) +{ + u64 end; + + if (region < 0 || buf->base =3D=3D U64_MAX || buf->length =3D=3D U32_MAX) + return -EINVAL; + + if (check_add_overflow(buf->base, (u64)buf->length, &end)) + return -EINVAL; + + info->region_size[region] =3D max(info->region_size[region], end); + + return 0; +} + static int calc_sizes(struct drm_device *ddev, struct ethosu_validated_cmdstream_info *info, u16 op, struct cmd_state *st, @@ -303,24 +319,16 @@ static int calc_sizes(struct drm_device *ddev, dev_dbg(ddev->dev, "op %d: W:%d:0x%llx-0x%llx\n", op, st->weight[0].region, st->weight[0].base, st->weight[0].base + st->weight[0].length - 1); - if (st->weight[0].region < 0 || st->weight[0].base =3D=3D U64_MAX || - st->weight[0].length =3D=3D U32_MAX) + if (buffer_size(info, &st->weight[0], st->weight[0].region)) return -EINVAL; - info->region_size[st->weight[0].region] =3D - max(info->region_size[st->weight[0].region], - st->weight[0].base + st->weight[0].length); } =20 if (scale) { dev_dbg(ddev->dev, "op %d: S:%d:0x%llx-0x%llx\n", op, st->scale[0].region, st->scale[0].base, st->scale[0].base + st->scale[0].length - 1); - if (st->scale[0].region < 0 || st->scale[0].base =3D=3D U64_MAX || - st->scale[0].length =3D=3D U32_MAX) + if (buffer_size(info, &st->scale[0], st->scale[0].region)) return -EINVAL; - info->region_size[st->scale[0].region] =3D - max(info->region_size[st->scale[0].region], - st->scale[0].base + st->scale[0].length); } =20 len =3D feat_matrix_length(edev, info, &st->ofm, st->ofm.width, --=20 2.53.0 From nobody Sun Sep 27 00:35:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9672936E466 for ; Thu, 27 Aug 2026 20:33:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862812; cv=none; b=KP2hobLetBXbW0hk+5T9m7iD1FMzcqR2wfHFlihJqpyT0AVNjTJxFHzty7P7ON4hHBm2clCCBvDDjl4SvLuqOeK+oqp0kdLnJBj3agM6zIFmz0QiZa8AaHLK0MoGA96/vR+ZFVVxhmlexdQ/smRCNUeHtciLD5RC6SqNpxrrSVU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862812; c=relaxed/simple; bh=AA6t6PxVHGhAqlHnhQ/mznRkK6lhMb6izEIp6UPyr8k=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=uHbIhg3vD9BvwgbBbyOASFdHEXwVkL+9MEaW0iSBDQ+3RWIQLWGDNHNFTX4Rq0hMbQUPCZWw3wKioKf+hgk5ClZAdG6Q3C/HQ91huA5CfUSBDF9XSgMRfXDzmttudX82zow2cFQj9NkCW0F3uVTpCV6lCMBuNU7GprTn2vPOkFc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=BKhvmget; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="BKhvmget" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F33791F00ADB; Thu, 27 Aug 2026 20:33:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787862804; bh=soqnG960tBHGLpWSzIdlomnC6GrsL7rtWYMUTaVI+vo=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=BKhvmgetFhBeRwz1VwBKvv6FI+f8RZtJ8HFBshs8gmvWtMdUICqTgwWbPhgZeJLLV hieQOB3QAgu2zgfuGJZ8bAdJ6J4FIMgSUtJLirYXaio8+a1sGPFfLgPXU/uTjXJrb1 Lr705/uq8Ob5YwR8RK7TxY0Y6ekiEwsvQgfslFiq8FaGy3wsqC9xSfvmpi4Dswidce tAR8vXoei/yUC0mx9LKqvhUNfvQy88lyJLisdLfBnFAsW97GhC6xO/y6ATLsKxs+OS PbmhOMix6M8gfO92uf/Ko/JO5zOKPHH/uCT8Aeux+foWyq3Q+093EvV2LQKGuQX4ix wduBSZGvniB1g== From: "Rob Herring (Arm)" Date: Thu, 27 Aug 2026 15:33:07 -0500 Subject: [PATCH 08/11] accel: ethosu: Validate secondary streams Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260827-ethosu-fixes-v1-8-346f9ea8791c@kernel.org> References: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> In-Reply-To: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The command-stream validator records the additional U65 scale and weight stream addresses and the U85 weight decoder addresses, but only checked stream 0 against its region buffer. Check every configured secondary stream against the matching weight or scale region before accepting a kernel operation. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- drivers/accel/ethosu/ethosu_gem.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 9fce7caeeb9a..3d1f4121db4f 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -321,6 +321,15 @@ static int calc_sizes(struct drm_device *ddev, st->weight[0].base + st->weight[0].length - 1); if (buffer_size(info, &st->weight[0], st->weight[0].region)) return -EINVAL; + + for (int i =3D 1; i < ARRAY_SIZE(st->weight); i++) { + if (st->weight[i].base =3D=3D U64_MAX && + st->weight[i].length =3D=3D U32_MAX) + continue; + + if (buffer_size(info, &st->weight[i], st->weight[0].region)) + return -EINVAL; + } } =20 if (scale) { @@ -329,6 +338,12 @@ static int calc_sizes(struct drm_device *ddev, st->scale[0].base + st->scale[0].length - 1); if (buffer_size(info, &st->scale[0], st->scale[0].region)) return -EINVAL; + + if (ethosu_is_u65(edev) && + (st->scale[1].base !=3D U64_MAX || + st->scale[1].length !=3D U32_MAX) && + buffer_size(info, &st->scale[1], st->scale[0].region)) + return -EINVAL; } =20 len =3D feat_matrix_length(edev, info, &st->ofm, st->ofm.width, --=20 2.53.0 From nobody Sun Sep 27 00:35:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9777036E478 for ; Thu, 27 Aug 2026 20:33:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862813; cv=none; b=BXCRDdztRKWiE8FeqalpPtReG42aT4LIv3VSZO8M4VESm0QPsVlIK3UX1zmT7CieqKrlVelX9jTr+6TmBZeIPmqyMOaytL5aaN/ld4S2iivFwWqXdEL2PsAsgpKqH0rCY85OYxScYJOKwsdf8Otw+68O3ueJibsazOxsECUcZtw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862813; c=relaxed/simple; bh=7FumC1pNsTLUEptHxQcCA1J8qTAqILNyAAyQPeNrjik=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=MTSLkxIm0G1t7huvi3rmHC4fVLS57rp2FF6EElEhc/fymNSBhu7gOCTaEZPhfYjlGhxpL1jG64Bas7DHM8EsCAVwBrVvB/Kju9JhMoYU8jAq0KRvBFDU48uwBG60Ac/W3slUeYyGsDq5PLgQxAlcAnbLb+QJkkgsZmPwByxKWVs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=UiBXzmLq; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="UiBXzmLq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E92C41F00A3D; Thu, 27 Aug 2026 20:33:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787862805; bh=nK2vnT+Di1V2VnSDnpyvtfiTC5KnQ3JoJi/nSooDR/8=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=UiBXzmLqdRSOoJ/ny3yk6fKgGMVMCuS30pEzkK+K72iGhCXquojzd4ihd64JzxpoR RZOa64N9QHG3sPPur/9/qLtPXyv0/tWWVCGmxAjWspzIQlqspbAthEayvmsR4DXXkg JBx8OnvvFd5HObiCxCfylaSP9nrJSeNgE6qFw/RUg3aHQpoFzQlhgqv9xkXYhTkSTB NQ78vpppPhTeyfRILknxULagvahDeZ5QTL1G7xFmdhoItsf3d8rPMPV1KBoS2eiQ5u 5f0cobeJzChbBYBdwNp0zwP+S9PovF7x9MrEF1mp4iVvJxf4xm3II22jEqvSg/YjZu Ka+eckfz+xe3w== From: "Rob Herring (Arm)" Date: Thu, 27 Aug 2026 15:33:08 -0500 Subject: [PATCH 09/11] accel: ethosu: Reject unsupported commands Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260827-ethosu-fixes-v1-9-346f9ea8791c@kernel.org> References: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> In-Reply-To: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The command-stream validator does not model U85 branches, indexed DMA, or OFM transposes. A branch can bypass the linear validation state, indexed DMA accesses an unchecked index buffer, and a transpose changes the feature-map address calculation. Reject those commands and configurations, as well as the reserved DMA stride mode and feature-map formats. Reject command-stream IRQs because they can signal job completion before later commands finish. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) Reviewed-by: Frank Li --- drivers/accel/ethosu/ethosu_device.h | 4 ++++ drivers/accel/ethosu/ethosu_gem.c | 17 +++++++++++++++++ 2 files changed, 21 insertions(+) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index 1eca8590e68d..c330048dbcca 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -86,14 +86,18 @@ struct gen_pool; #define PMU_EV_TYPE_CYCLES 0x11 #define PMU_EV_TYPE_IDLE 0x20 =20 +#define NPU_DMA_REGION_INDEX_MODE BIT(11) + enum ethosu_cmds { NPU_OP_STOP =3D 0x0, + NPU_OP_IRQ =3D 0x1, NPU_OP_CONV =3D 0x2, NPU_OP_DEPTHWISE =3D 0x3, NPU_OP_POOL =3D 0x5, NPU_OP_ELEMENTWISE =3D 0x6, NPU_OP_RESIZE =3D 0x7, // U85 only NPU_OP_DMA_START =3D 0x10, + NPU_OP_BRANCH =3D 0x4100, // U85 only NPU_SET_IFM_PAD_TOP =3D 0x100, NPU_SET_IFM_PAD_LEFT =3D 0x101, NPU_SET_IFM_PAD_RIGHT =3D 0x102, diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 3d1f4121db4f..2aafbfe95a8c 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -450,6 +450,9 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, } =20 switch (cmd) { + case NPU_OP_BRANCH: + case NPU_OP_IRQ: + return -EINVAL; case NPU_OP_STOP: if (i !=3D size / 4 - 1) return -EINVAL; @@ -522,6 +525,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, st.ifm.depth =3D param; break; case NPU_SET_IFM_PRECISION: + if (((param >> 6) & 0x3) > 1) + return -EINVAL; st.ifm.precision =3D param; break; case NPU_SET_IFM_BROADCAST: @@ -565,6 +570,10 @@ static int ethosu_gem_cmdstream_copy_and_validate(stru= ct drm_device *ddev, st.ofm.depth =3D param; break; case NPU_SET_OFM_PRECISION: + if (((param >> 6) & 0x3) > 1) + return -EINVAL; + if (!ethosu_is_u65(edev) && (param & GENMASK(13, 11))) + return -EINVAL; st.ofm.precision =3D param; break; case NPU_SET_OFM_REGION: @@ -599,6 +608,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, st.ifm2.broadcast =3D param; break; case NPU_SET_IFM2_PRECISION: + if (((param >> 6) & 0x3) > 1) + return -EINVAL; st.ifm2.precision =3D param; break; case NPU_SET_IFM2_REGION: @@ -673,13 +684,19 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, break; =20 case NPU_SET_DMA0_SRC_REGION: + if (param & NPU_DMA_REGION_INDEX_MODE) + return -EINVAL; if (param & 0x100) st.dma.src.region =3D -1; else st.dma.src.region =3D param & 0x7; st.dma.mode =3D (param >> 9) & 0x3; + if (st.dma.mode =3D=3D 3) + return -EINVAL; break; case NPU_SET_DMA0_DST_REGION: + if (param & NPU_DMA_REGION_INDEX_MODE) + return -EINVAL; if (param & 0x100) st.dma.dst.region =3D -1; else --=20 2.53.0 From nobody Sun Sep 27 00:35:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 766152853FD for ; Thu, 27 Aug 2026 20:33:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862815; cv=none; b=WguhBz4vPSNnOLw49u9gBRH63RcUNI7ODGbRcTvfzbA610YTS1r//ZLTyyIw26TUojavVB/aBEUmGR/20/HyI+jMV+eRXX/7anM0cRabzHVwTi+BvIlXbFEFoVGa2mIirslYXOz2qH0wwZHWfcvGUAT6SAcnFQ2BseceTBcI0QA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862815; c=relaxed/simple; bh=n2kh5q+H+wEQw72ia/fWfq4TL4RlVO7TpkSK1rNF9NU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=D1KoPYyNcdS79kd22foAqCGUXCJN90toSpZtxne77BNTE/vzpqeKzyXqqLrjb/FHPUrEdTWreiaeux+coulndFiKuox3Ys1ROx3kYiO6ZLrAqBbzVyJl9fH9y5BPJ+sF2zq6LI6em2BjBcs/Eu1Rwv+YHdlfqahGNheiWiVwm9I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=aUBfTRFB; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="aUBfTRFB" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CE8041F00A3A; Thu, 27 Aug 2026 20:33:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787862806; bh=c1XIfes4dLS5aZUdWRq1Bq8zM42TeR/T/LY3819Ic3A=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=aUBfTRFBgK8zW3Pal0buE743Z7lMPkJMbbshE0kYVIg4jw4OeVcgS/rIDb0JxUk6C nPNbwOZ7VNM9mdj5cVOeJXgfCTWHHpUFi6NaoKqbY8Mriv0FYNFdzrEFkX2nTvIMZt CLWiQ2b1yyI6CRPuwASX8SatLbijD4KysMHARb7oOGoaxnpa4CpRRLgV90XCbtkVqF nv8+uj3h4mFctxoWs/TPTKhJA248ZIGiLKNwQAqmBzaRfIR2DEI4zAE8rub58VlPq5 dvpvkfQB2DJxELWNcRAYPups57UHEEtmLKCNoQQwyfDWpKlhB5euJDYnDuHeD4ae8S b4S1o1hLUxm8w== From: "Rob Herring (Arm)" Date: Thu, 27 Aug 2026 15:33:09 -0500 Subject: [PATCH 10/11] accel: ethosu: Validate all feature map tiles Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260827-ethosu-fixes-v1-10-346f9ea8791c@kernel.org> References: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> In-Reply-To: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The command-stream validator checked only the final feature-map coordinate. For tiled tensors, this can leave an earlier tile base address unchecked even though the operation accesses it. Check the final coordinate of every tile touched by an operation. Also treat U65 feature maps as 2x2 tiled: its precision rounding bits are not the U85 storage encoding. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- drivers/accel/ethosu/ethosu_gem.c | 117 ++++++++++++++++++++++++++++++----= ---- 1 file changed, 93 insertions(+), 24 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 2aafbfe95a8c..a042e650f626 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -259,6 +259,72 @@ static u64 feat_matrix_length(struct ethosu_device *ed= ev, return addr; } =20 +static int feat_matrix_check_location(struct ethosu_device *edev, + struct ethosu_validated_cmdstream_info *info, + struct feat_matrix *fm, u32 x, u32 y, u32 c, + bool ofm, u64 *max_len) +{ + u64 len; + + len =3D feat_matrix_length(edev, info, fm, x, y, c, ofm); + if (len =3D=3D U64_MAX) + return -EINVAL; + + *max_len =3D max(*max_len, len); + return 0; +} + +static int feat_matrix_size(struct ethosu_device *edev, + struct ethosu_validated_cmdstream_info *info, + struct feat_matrix *fm, + u32 x, u32 y, u32 c, bool ofm, u64 *max_len) +{ + u32 storage =3D ethosu_is_u65(edev) ? 0 : fm->precision >> 14; + int ret; + + *max_len =3D 0; + + if (ethosu_is_u65(edev) || storage =3D=3D 0) { + for (int xi =3D 0; xi < 2; xi++) { + for (int yi =3D 0; yi < 2; yi++) { + ret =3D feat_matrix_check_location(edev, info, fm, + xi ? x : 0, + yi ? y : 0, c, ofm, + max_len); + if (ret) + return ret; + } + } + return 0; + } + + if (storage =3D=3D 1) { + ret =3D feat_matrix_check_location(edev, info, fm, x, 0, c, + ofm, max_len); + if (ret) + return ret; + if (fm->height[0] < fm->height[1] && fm->height[1] <=3D y) { + ret =3D feat_matrix_check_location(edev, info, fm, x, + fm->height[1], c, ofm, + max_len); + if (ret) + return ret; + } + if (fm->height[1] < y) { + ret =3D feat_matrix_check_location(edev, info, fm, x, + fm->height[1] + 1, c, ofm, + max_len); + if (ret) + return ret; + } + return feat_matrix_check_location(edev, info, fm, x, y, c, + ofm, max_len); + } + + return feat_matrix_check_location(edev, info, fm, x, y, c, ofm, + max_len); +} + static int buffer_size(struct ethosu_validated_cmdstream_info *info, struct buffer *buf, s8 region) { @@ -282,6 +348,7 @@ static int calc_sizes(struct drm_device *ddev, { struct ethosu_device *edev =3D to_ethosu_device(ddev); u64 len; + int ret; =20 if (ifm) { if (st->ifm.stride_kernel =3D=3D U16_MAX) @@ -298,21 +365,22 @@ static int calc_sizes(struct drm_device *ddev, if (ifm_height < 0 || ifm_width < 0) return -EINVAL; =20 - len =3D feat_matrix_length(edev, info, &st->ifm, ifm_width, - ifm_height, st->ifm.depth, false); + ret =3D feat_matrix_size(edev, info, &st->ifm, + ifm_width, ifm_height, st->ifm.depth, false, + &len); dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", op, st->ifm.region, st->ifm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 if (ifm2) { - len =3D feat_matrix_length(edev, info, &st->ifm2, st->ifm.depth, - 0, st->ofm.depth, false); + ret =3D feat_matrix_size(edev, info, &st->ifm2, + st->ifm.depth, 0, st->ofm.depth, false, &len); dev_dbg(ddev->dev, "op %d: IFM2:%d:0x%llx-0x%llx\n", op, st->ifm2.region, st->ifm2.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 if (weight) { @@ -346,12 +414,12 @@ static int calc_sizes(struct drm_device *ddev, return -EINVAL; } =20 - len =3D feat_matrix_length(edev, info, &st->ofm, st->ofm.width, - st->ofm.height[2], st->ofm.depth, true); + ret =3D feat_matrix_size(edev, info, &st->ofm, st->ofm.width, + st->ofm.height[2], st->ofm.depth, true, &len); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; if (!feat_matrix_chained(edev, &st->ofm)) info->output_region[st->ofm.region] =3D true; =20 @@ -366,18 +434,19 @@ static int calc_sizes_elemwise(struct drm_device *dde= v, struct ethosu_device *edev =3D to_ethosu_device(ddev); u32 height, width, depth; u64 len; + int ret; =20 if (ifm) { height =3D st->ifm.broadcast & 0x1 ? 0 : st->ofm.height[2]; width =3D st->ifm.broadcast & 0x2 ? 0 : st->ofm.width; depth =3D st->ifm.broadcast & 0x4 ? 0 : st->ofm.depth; =20 - len =3D feat_matrix_length(edev, info, &st->ifm, width, - height, depth, false); + ret =3D feat_matrix_size(edev, info, &st->ifm, width, height, + depth, false, &len); dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", op, st->ifm.region, st->ifm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 if (ifm2) { @@ -385,20 +454,20 @@ static int calc_sizes_elemwise(struct drm_device *dde= v, width =3D st->ifm2.broadcast & 0x2 ? 0 : st->ofm.width; depth =3D st->ifm2.broadcast & 0x4 ? 0 : st->ofm.depth; =20 - len =3D feat_matrix_length(edev, info, &st->ifm2, width, - height, depth, false); + ret =3D feat_matrix_size(edev, info, &st->ifm2, width, height, + depth, false, &len); dev_dbg(ddev->dev, "op %d: IFM2:%d:0x%llx-0x%llx\n", op, st->ifm2.region, st->ifm2.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 - len =3D feat_matrix_length(edev, info, &st->ofm, st->ofm.width, - st->ofm.height[2], st->ofm.depth, true); + ret =3D feat_matrix_size(edev, info, &st->ofm, st->ofm.width, + st->ofm.height[2], st->ofm.depth, true, &len); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; if (!feat_matrix_chained(edev, &st->ofm)) info->output_region[st->ofm.region] =3D true; =20 --=20 2.53.0 From nobody Sun Sep 27 00:35:08 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AAFA029D27D for ; Thu, 27 Aug 2026 20:33:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862818; cv=none; b=LqMkAe0ASHk3HcmmVN4Ex69rxtQbvkvNElFNKPttq7q/SnpBO6TTiwMG5MSg9XnpLW81JRf5Z6NIIrWWvX2T28prfWs7QlOBBvfLkX8vzclv3oGGZvotaxcMLGLi5qAhdKdqlhIoIOVwJIgA9uYHeAsvjAIVrX4pJwu+JEYJPkw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787862818; c=relaxed/simple; bh=huEt1lMN433bAjsn6Lg3/b+Uv2boty/Am2Kn/arZixE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=uFzCtqQpMVwvL0kZHsJ8Iq/6v7jB5BpEgdpiuiZI5wx6NcPgYZbfHsKRCo/V5vyiNQpnghL9IkmT6r41FeUUs86d80r7s9Nxhf/REMFs0HpPdwWWJ8RVfa8GiRDMIeARcfR59DD8DSsYsgh0kDIbv9ssc/E7VXoAK2OAJXEEtEg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ghoQbs1r; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ghoQbs1r" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B54D31F00A3E; Thu, 27 Aug 2026 20:33:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787862806; bh=S09KMKeejzD64bM7Mo69fZD6EyqOgGCSj8/rAtNwTt8=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=ghoQbs1rBX4gZHHxLvGMeDqxgTlWT2vHzff0iBVNoRcycqoL75Np82wQYoH+JRLAU OGjsyzodrEjIv4HgUNhPHcii8Vota2epXwmRD7ZCneKzcMO5YBNAtI1ZeFOanMqhfo HD/3rhRTiCnD22wYn5LxpzCt2HeZUrDE2LsW4nXUXfnA4joERkfGxs3X/aIpKuRDxw G0BrhMLvpKq3MunURfO7uYc7WhNDLcucVrkeQ+WsxAvlCWFUZdEKkI8o33Yidv/Zs2 BKIaTMSkDybaOfVfushMnM9iV0sQ58hdVwYY+H6OUg720dphSLQfY8qxdqG7MWbKBu sxSCEBqGF7VeQ== From: "Rob Herring (Arm)" Date: Thu, 27 Aug 2026 15:33:10 -0500 Subject: [PATCH 11/11] accel: ethosu: Validate OFM transpose Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260827-ethosu-fixes-v1-11-346f9ea8791c@kernel.org> References: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> In-Reply-To: <20260827-ethosu-fixes-v1-0-346f9ea8791c@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev U85 OFM dimensions are specified before transposition, while tile bases and strides address the transposed feature map. Permute the output endpoint before validating its tile and stride accesses. Allow the defined U85 transpose encodings and reject the two reserved encodings. Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- drivers/accel/ethosu/ethosu_device.h | 1 + drivers/accel/ethosu/ethosu_gem.c | 58 ++++++++++++++++++++++++++++++++= ++-- 2 files changed, 57 insertions(+), 2 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index c330048dbcca..1731c43aa045 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -87,6 +87,7 @@ struct gen_pool; #define PMU_EV_TYPE_IDLE 0x20 =20 #define NPU_DMA_REGION_INDEX_MODE BIT(11) +#define NPU_OFM_TRANSPOSE_MASK GENMASK(13, 11) =20 enum ethosu_cmds { NPU_OP_STOP =3D 0x0, diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index a042e650f626..ad36fb8b3b30 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -199,6 +199,52 @@ static bool feat_matrix_chained(struct ethosu_device *= edev, struct feat_matrix * return !ethosu_is_u65(edev) && storage =3D=3D 2; } =20 +static int feat_matrix_permute(struct ethosu_device *edev, + struct feat_matrix *fm, u32 *x, u32 *y, + u32 *c, bool ofm) +{ + u32 width =3D *x; + u32 height =3D *y; + u32 depth =3D *c; + u32 transpose; + + if (ethosu_is_u65(edev) || !ofm) + return 0; + + transpose =3D FIELD_GET(NPU_OFM_TRANSPOSE_MASK, fm->precision); + + switch (transpose) { + case 0: /* HWC */ + break; + case 1: /* WHC */ + *x =3D height; + *y =3D width; + break; + case 2: /* HCW */ + *x =3D depth; + *c =3D width; + break; + case 3: /* WCH */ + *x =3D depth; + *y =3D width; + *c =3D height; + break; + case 6: /* CHW */ + *x =3D height; + *y =3D depth; + *c =3D width; + break; + case 7: /* CWH */ + *y =3D depth; + *c =3D height; + break; + default: + return -EINVAL; + } + + return 0; +} + static u64 feat_matrix_length(struct ethosu_device *edev, struct ethosu_validated_cmdstream_info *info, struct feat_matrix *fm, @@ -283,6 +329,9 @@ static int feat_matrix_size(struct ethosu_device *edev, int ret; =20 *max_len =3D 0; + ret =3D feat_matrix_permute(edev, fm, &x, &y, &c, ofm); + if (ret) + return ret; =20 if (ethosu_is_u65(edev) || storage =3D=3D 0) { for (int xi =3D 0; xi < 2; xi++) { @@ -641,8 +690,13 @@ static int ethosu_gem_cmdstream_copy_and_validate(stru= ct drm_device *ddev, case NPU_SET_OFM_PRECISION: if (((param >> 6) & 0x3) > 1) return -EINVAL; - if (!ethosu_is_u65(edev) && (param & GENMASK(13, 11))) - return -EINVAL; + if (!ethosu_is_u65(edev)) { + switch (FIELD_GET(NPU_OFM_TRANSPOSE_MASK, param)) { + case 4: + case 5: + return -EINVAL; + } + } st.ofm.precision =3D param; break; case NPU_SET_OFM_REGION: --=20 2.53.0