From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 24F982F6577 for ; Sat, 5 Sep 2026 00:43:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569024; cv=none; b=e5MwQ5cb8JUSosC5JCwxcIWJ+SsD8g0uHRDGZgmWY8fV9vFc3VcSRo88JhJ63iush6icCuuBYyr6uCE2Ag3lVMNhgUtm9/0C7IiWu+ssAzRqVBawV9I0q7wyTSh94Ax35y4LNe/7UyWMJ8928BvRAqBnqH5Xw08tOPMo0OXDGrI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569024; c=relaxed/simple; bh=+J7RZfgL5AzajAk1mEDu7gK55yvVTLK8+CL9C+Luh6g=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=VMtJED6CBIh4Y/D4ldb4aA4jS9xEDV3fXcfBzT/Zkb37G0HQnXzBUx3dgo26bFEfnXtYgCMhJZPClrV5UNG5f0MzeiyzWgda/uX7ztSEZnfgzWrpVXTSzlWM26sC7/u9mFlNSeqyu+WhyCxluo0nRoVpP3IRNHvDxiMxDJHH3bI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fmg3u+gO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fmg3u+gO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 894121F00A3E; Sat, 5 Sep 2026 00:43:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569022; bh=ai8d/z/jR8St5LaF9248MzOc4BaNMXKIfXmoxvaaQR8=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=fmg3u+gO26cscy/kVF7NaHY5xew3/RlZBHW2BhVS2DMWWEueiFnddNpz7Qh8V4cMs GcGS8muP8rHUoO/xK6vjnTAry0ab6FjGFY9l3HuHwGo6bOP0/9apsFdfol628O1I1L p+UQ5ezM2YATHcdGPXPjQzyiIzyP/pCmJjWyaYfivgrfwWL5s9eVlatyclKUfTzV6v XFxLH6BfvEOaQ5Yr/J4kwdBZ0joOTwi7o4Jg4w5KadjzvxUSEyEsLCnvQym1rCzrjz +sREwZchTgq0/Rs1rZwkhLzIXDx0bvsETmlVLt+OtNHIInsZp8Sp2UdComS2qFqA2D RSRX7rFkmbGSw== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:20 -0500 Subject: [PATCH v2 01/19] accel: ethosu: Suspend after initialization Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-1-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The initial runtime-PM reference is held only while initializing the NPU. Release it synchronously from ethosu_init() after the final hardware access, before registering the DRM device. This keeps the runtime-PM setup and initial reference handling together and leaves the autosuspend configuration in place for subsequent jobs. Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_drv.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index 8108622de258..df76253d01a6 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -338,6 +338,8 @@ static int ethosu_init(struct ethosu_device *ethosudev) ethosudev->npu_info.sram_size / 1024, ethosudev->npu_info.pmu_counters); =20 + pm_runtime_put_sync_suspend(ethosudev->base.dev); + return 0; } =20 @@ -376,10 +378,6 @@ static int ethosu_probe(struct platform_device *pdev) return ret; =20 ret =3D drm_dev_register(ðosudev->base, 0); - if (ret) - pm_runtime_dont_use_autosuspend(ethosudev->base.dev); - - pm_runtime_put_autosuspend(ethosudev->base.dev); return ret; } =20 --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A17412FBE1F for ; Sat, 5 Sep 2026 00:43:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569025; cv=none; b=cWxgNJiNkLEuG//aBm23CN3XQ3Ui97TsgKsOcveQC8v6kayJAY4HVRDnYLSNAViOJegSrjDvT35ORn3gFFX2EGMjM3qPguEqa6vYt6kcZVHxO9cA7bVKCOHetp3vT6KRoz1jrrv5DObE0laqss9m0KIEI1uuWRjk9FeQU0TAhPI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569025; c=relaxed/simple; bh=KALISCleQiLUoj5uIbbj+6E2d/lbdP+ozOyYlmDO3Bo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=XOS3OCoZqvSluADdQlSeXsobCJJjfI+ULlv8D66tLfp22aOwLAZ28Uf3cpi3/Vb73Le+29Irrn90cW/loOc7RjGl+nPnl27BeqVnk1lsHz1ZbKhnFkedPYfZoxVYcsOuXBmLY5uEY/3q++Ynm84HwRvD4YcmlIfOb0wfuPl4Jbc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=D4N/ws20; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="D4N/ws20" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 000C51F00A3D; Sat, 5 Sep 2026 00:43:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569024; bh=mqjpar+f+Cbdq0pcg7A44i7twxcYoQfNarTSIk1nh1I=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=D4N/ws2031xrS0VVK2n/p92pVVAXHWTnmNjUpCldYgvY5M6YP4tIOwHoxDiJdIHiM qwYJvkTZgS96Sb9IxXsc2BrHkoqHNAdtQNLo5K7Iu1llqaJz7pcXA+7ivVuWxhQAAU t/y+C47gui4QrntSq/QUzF7dZhuhLg2NA8uwG5rACRDqcLfoNibHZVtXZLhNERQZL8 ByOoXkSTjYB7U9GLX3OO4bJPvrWQQM5GW6PFmM6jWPHCug+oYuXF494x9gq5ZSN6ET ybJSumPbIkqqW526GjSc7R63xKSPL2TdOtDZUi0CzNnyjB1cYPMzH5rRLpIssd5VXc 4OLEzd7+wVT6g== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:21 -0500 Subject: [PATCH v2 02/19] accel: ethosu: Fix probe error cleanup Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-2-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Once the job scheduler has been initialized, failures from ethosu_init() or drm_dev_register() return from probe without tearing it down. The registration failure also leaves the SRAM-pool allocation in use, because the platform remove callback is not called after a failed probe. Unwind the initialized resources on both paths. Also do not call drm_sched_fini() after a failed drm_sched_init(): the scheduler initializer already unwinds its partial setup, while drm_sched_fini() requires a successfully initialized scheduler. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - Adjust for previous patch reworking runtime-PM suspend --- drivers/accel/ethosu/ethosu_drv.c | 13 ++++++++++++- drivers/accel/ethosu/ethosu_job.c | 6 +----- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index df76253d01a6..c684e28ac787 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -375,9 +375,20 @@ static int ethosu_probe(struct platform_device *pdev) =20 ret =3D ethosu_init(ethosudev); if (ret) - return ret; + goto err_job_fini; =20 ret =3D drm_dev_register(ðosudev->base, 0); + if (ret) + goto err_sram_free; + + return 0; + +err_sram_free: + if (ethosudev->sram) + gen_pool_free(ethosudev->srampool, (unsigned long)ethosudev->sram, + ethosudev->npu_info.sram_size); +err_job_fini: + ethosu_job_fini(ethosudev); return ret; } =20 diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethos= u_job.c index 8dce74db0cb4..ec65305e0cd7 100644 --- a/drivers/accel/ethosu/ethosu_job.c +++ b/drivers/accel/ethosu/ethosu_job.c @@ -355,14 +355,10 @@ int ethosu_job_init(struct ethosu_device *edev) ret =3D drm_sched_init(&edev->sched, &args); if (ret) { dev_err(dev, "Failed to create scheduler: %d\n", ret); - goto err_sched; + return ret; } =20 return 0; - -err_sched: - drm_sched_fini(&edev->sched); - return ret; } =20 void ethosu_job_fini(struct ethosu_device *dev) --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 11E923033E7 for ; Sat, 5 Sep 2026 00:43:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569027; cv=none; b=BLMlWuy3IG4e628PvV6lswWN3xGAvQxkKNb4p+3SxKIZft7AvM7JwJvOu3ifZkr5QtEsV6QGqvFkSP/m49uZmiSKOif4jlDrkkduoPuxjIvVR6sKrP5K7xeDYG0B70zTR+M3ueDPM0Wu8yj2UwZk1q+8a6NzSaNUdem/cUyJHfM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569027; c=relaxed/simple; bh=DooIFk028qBeQa3mhFoyjGFs7t0X6ukl2lMVluYwVpE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Trs2LjabL7czg9UfJCzMYiceIWJRyzGSe/Hz5g7s4XCr5tFwq+QRV2dY46EQCVVDRXSjfk3tYtl1Ot0ydQ3LxSbsrvfzsBfZt23TC5G2bWgu2j0LQb97xkV8185JBFvJY6xQubuRmlf4vBRU30DzWlt5STla+Jp1x2aDxUtFPJc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=TvTq2pz8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="TvTq2pz8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7ACCC1F00A3E; Sat, 5 Sep 2026 00:43:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569025; bh=/EC9ZBX0cgu1a8NTQofCZuIZlpK7/v0NjA/+edl44jM=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=TvTq2pz87OVmpG2aXnDtzAISUiLGEoenKMAESoy6WoEMnisEdTUBGWulmQpaO4Zy/ gQodzxC9GPjDw6D8K+wRiXg3sgrtxG6Mewx2xirK5eBfXKlCoSaQCJIp3xGicIC0y4 mhO3vcyz8Mt8nuNAlJ+M6+BOU54L+OsJpKDGLxXakh1O7u3S89/qkzp8O1UpTG6njb aQDecBqvQ8+u2Wean9gORMJJPZnw7r8plefEx8rg8lOcL4RjbwKx86urrEc/i4DCG9 k1t75aaSCOa/uyE7+tH/5xBytEpktQij0Ok12ON/GQvEJNdpBi258JhJnoKPAkZHu+ N88c2IXGUd1AQ== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:22 -0500 Subject: [PATCH v2 03/19] accel: ethosu: Disable clocks on PM setup failure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-3-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev ethosu_init() enables the clocks directly to reset and query the NPU before runtime PM takes over. If runtime-PM setup fails, the error path returns while those clocks remain enabled. Disable the clocks before returning the setup error to balance the initial direct resume. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_drv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index c684e28ac787..65b148e770e5 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -311,8 +311,10 @@ static int ethosu_init(struct ethosu_device *ethosudev) pm_runtime_set_autosuspend_delay(ethosudev->base.dev, 50); pm_runtime_use_autosuspend(ethosudev->base.dev); ret =3D devm_pm_runtime_set_active_enabled(ethosudev->base.dev); - if (ret) + if (ret) { + ethosu_device_suspend(ethosudev->base.dev); return ret; + } pm_runtime_get_noresume(ethosudev->base.dev); =20 ethosudev->npu_info.id =3D id =3D readl_relaxed(ethosudev->regs + NPU_REG= _ID); --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7FBC13090C6 for ; Sat, 5 Sep 2026 00:43:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569028; cv=none; b=T72a7vM4HFZoltRiJKGQVSQj3K/UewkpR8EiZATDHqEBp3YOaEAcFtXqg8aqsnOU09xzkOU84f6rnwNv+A/POqtClk+I+UdFQ1y7JWbeQcD74+oyJBA2q50/Vk6ZzRFaJIEyJsdZLfectbwgH2O5qaZbXmIr8LMPlPp7mydSy4k= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569028; c=relaxed/simple; bh=CEnFEeP5i2FWdd13JmEtmHAS+xtm8q7U7okSMimiSzY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=N9JRIbDbGMoDyMF9ReZ38iFvuU7yfqb6+5kWtiGMRA7CHPlRgy2TpqSNN4RTP+PUHocCVGGXO791y4393Zye1nlPzbiANOSjz5P4Eh9BV97kGbF/uD7f9RQH5t3izrrhbbDyfhlyVVKcjre5kRY1k/zZwn+NXpOmZn6vpnUlbdk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OmY6eeFf; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OmY6eeFf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EAC241F00A3D; Sat, 5 Sep 2026 00:43:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569027; bh=VA5xoQf037drhq5+1N2WYwe4lAlKlXMyH8lLNPBodKI=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=OmY6eeFfcPNgJaDw9+5zPgNugZTjotgsy07v+XE697dX7lOnhglp4SRrsHmCf5T/i VBrMXknZhzAeET80kz3DMebBzc41xVA7JvIh6Cvq+uUXpbKgZrXcPdYaKmESVH8rCh nm+rjr2AxsmaMbXyiwkauIrnICSpEcTqFa/p2za68fygDHo8dtRgB895gTGyZ964FY dzGX+dTzShwLJXV464aGLrWMjAY7kS1Ivz5INGB+497iOf/CFlg9zNBzuA3faYF45r Ed7gm+3eCIEYrKZKffP9tP1N5jSNeVMg+BXZdgzn5fQR7/FqrKC7Fc3Jt8u7z6a2a7 KMlq3Cssdf++g== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:23 -0500 Subject: [PATCH v2 04/19] accel: ethosu: Quiesce jobs before scheduler teardown Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-4-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev An NPU job can complete while driver removal tears down the scheduler. Its IRQ handler could then access scheduler state after it has been destroyed. Stop scheduler submission and timeout work, reset the NPU, and synchronize its IRQ before finalizing the scheduler. Add a cancel_job callback so drm_sched_fini() signals queued jobs with -ECANCELED; their runtime-PM references are then released during normal job cleanup. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_drv.c | 4 ++-- drivers/accel/ethosu/ethosu_drv.h | 2 ++ drivers/accel/ethosu/ethosu_job.c | 22 +++++++++++++++++++++- 3 files changed, 25 insertions(+), 3 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index 65b148e770e5..0918fd9b7041 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -216,7 +216,7 @@ static const struct drm_driver ethosu_drm_driver =3D { #define U85_MEM_ATTR0_CFG 0x00000000 #define U85_MEM_ATTR2_CFG 0x000000b7 =20 -static int ethosu_reset(struct ethosu_device *ethosudev) +int ethosu_device_reset(struct ethosu_device *ethosudev) { int ret; u32 reg; @@ -263,7 +263,7 @@ static int ethosu_device_resume(struct device *dev) if (ret) return ret; =20 - ret =3D ethosu_reset(ethosudev); + ret =3D ethosu_device_reset(ethosudev); if (!ret) return 0; =20 diff --git a/drivers/accel/ethosu/ethosu_drv.h b/drivers/accel/ethosu/ethos= u_drv.h index 2193bc51d425..f59c845c758b 100644 --- a/drivers/accel/ethosu/ethosu_drv.h +++ b/drivers/accel/ethosu/ethosu_drv.h @@ -11,6 +11,8 @@ struct ethosu_device; struct drm_device; struct drm_file; =20 +int ethosu_device_reset(struct ethosu_device *ethosudev); + struct ethosu_file_priv { struct ethosu_device *edev; struct drm_sched_entity sched_entity; diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethos= u_job.c index ec65305e0cd7..74a1136635f8 100644 --- a/drivers/accel/ethosu/ethosu_job.c +++ b/drivers/accel/ethosu/ethosu_job.c @@ -189,6 +189,16 @@ static void ethosu_job_free(struct drm_sched_job *sche= d_job) ethosu_job_put(job); } =20 +static void ethosu_job_cancel(struct drm_sched_job *sched_job) +{ + struct ethosu_job *job =3D to_ethosu_job(sched_job); + + if (!dma_fence_is_signaled(job->done_fence)) { + dma_fence_set_error(job->done_fence, -ECANCELED); + dma_fence_signal(job->done_fence); + } +} + static void ethosu_switch_perfmon(struct ethosu_device *ethosu, struct ethosu_job *job) { @@ -315,7 +325,8 @@ static enum drm_gpu_sched_stat ethosu_job_timedout(stru= ct drm_sched_job *bad) static const struct drm_sched_backend_ops ethosu_sched_ops =3D { .run_job =3D ethosu_job_run, .timedout_job =3D ethosu_job_timedout, - .free_job =3D ethosu_job_free + .free_job =3D ethosu_job_free, + .cancel_job =3D ethosu_job_cancel, }; =20 int ethosu_job_init(struct ethosu_device *edev) @@ -363,6 +374,15 @@ int ethosu_job_init(struct ethosu_device *edev) =20 void ethosu_job_fini(struct ethosu_device *dev) { + drm_sched_wqueue_stop(&dev->sched); + cancel_delayed_work_sync(&dev->sched.work_tdr); + + if (READ_ONCE(dev->in_flight_job)) { + WRITE_ONCE(dev->in_flight_job, NULL); + ethosu_device_reset(dev); + } + + synchronize_irq(dev->irq); drm_sched_fini(&dev->sched); } =20 --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8E9030C177 for ; Sat, 5 Sep 2026 00:43:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569030; cv=none; b=Ov4gdQhe4mcGhyQ2YL1ihJOzuOfFJVuF9OBpU2IQsnYzfr+PzuJZZHUyyYGBz5PqrlFKurW5EQID+mvQdF1apbgKA/Ds45sMbLxFTXEYbjVqNZzbXvVYXFjTX5RVXwo5qK/nt6WMIf+dDtlNWYkANSTaxdupyKvIDLJCBKsvnRM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569030; c=relaxed/simple; bh=7eUBDLudMkGkT63X+Dx93W3Wqkc9rmjtXvjtp4sc9FU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=mQ6Z+J1fcTndoVMa4eh5445z6EryOTnDLpGxpiNpXFDfb42sCx0MTjjlv8IK2V8RQCyfhKszYQgWAPKvk8T/Cc0XbS4kyrmgFE1UavOVQtmGPlNwNtNgfje58vXtln/ik3Qupn+vlpFJA0pr8bOO1xR27NylTKiCzfNLLfMOk8g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=BVCu0lFz; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="BVCu0lFz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 56EBA1F00A3E; Sat, 5 Sep 2026 00:43:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569028; bh=mTQURhigd+JG9LmMdZx3Ar/nyO0G3Iv5Sv1pMVcbF2I=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=BVCu0lFzOAo5srtX0gxb4xUVdOYxgIqnnaIMuHABL+VjHPT6SEP54HOKxQJL4T2Rl ijIWtfPDeyrTDAVO+5d+idRbFYb8E1TVQCdaNZZfAv811MF+eXaPDaOed27N/8aNz3 T2N4V2Jl5xStO3wE3WbBHvszOxhPjNAS4Zpu31FEixsdQ004QO+vWB5Kr26h9JTo5I jA89TUfes6C4VA2wtx3S75jjWL2L1L9LmFHryPSDBEjKABkRu9p6H52nRTPMT+zQUO qKp3qxUjqqzRgU5QxwiHZRsiIjREB7n+5wuZ4b/x3ty8D4mpwbe0jCWkSkceI2TcOS WGptfxh2uBoAA== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:24 -0500 Subject: [PATCH v2 05/19] accel: ethosu: Move DMA mode to src/dst struct Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-5-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The DMA mode setting is independent for source and destination, so it should be part of the src/dst struct dma rather than the global DMA state. Signed-off-by: Rob Herring (Arm) --- drivers/accel/ethosu/ethosu_gem.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 9afe2549ec84..408b93350dd7 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -100,6 +100,7 @@ int ethosu_gem_create_with_handle(struct drm_file *file, =20 struct dma { s8 region; + s8 mode; u64 len; u64 offset; s64 stride[2]; @@ -108,7 +109,6 @@ struct dma { struct dma_state { u16 size0; u16 size1; - s8 mode; struct dma src; struct dma dst; }; @@ -161,7 +161,7 @@ static u64 cmd_to_addr(u32 *cmd) static u64 dma_length(struct ethosu_validated_cmdstream_info *info, struct dma_state *dma_st, struct dma *dma) { - s8 mode =3D dma_st->mode; + s8 mode =3D dma->mode; u64 len =3D dma->len; =20 if (len =3D=3D U64_MAX) @@ -654,13 +654,14 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, st.dma.src.region =3D -1; else st.dma.src.region =3D param & 0x7; - st.dma.mode =3D (param >> 9) & 0x3; + st.dma.src.mode =3D (param >> 9) & 0x3; break; case NPU_SET_DMA0_DST_REGION: if (param & 0x100) st.dma.dst.region =3D -1; else st.dma.dst.region =3D param & 0x7; + st.dma.dst.mode =3D (param >> 9) & 0x3; break; case NPU_SET_DMA0_SIZE0: st.dma.size0 =3D param; --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C12230C168 for ; Sat, 5 Sep 2026 00:43:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569031; cv=none; b=RslwuEBYqNuviJK8Wl1BAV+4VpJNYMwPm9U6em0h7rpYaeX+Sq2stR2Q6OnWHO+BAuXjHgjoIPtXhK2fqmE1/CveBJIE56rPhERySbQd7aeEs5kAwP3iDBle+p040/8Q17CXSO8nSTevz2zNtDVmkQMkQvG3qF+0uRXhLGkgkUk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569031; c=relaxed/simple; bh=a5685hrfmfYkGd/qr/r6d+2gUHfF2mYBNMk2Jwv0F6w=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Tp93ZG0twtqw3RadLRV/MO0D8ZOmhR9GAjYz6V7ritTu6he32BsIpWyEWXyxV3dLG3F4SWSNcvabV5YjPTuKokBOgwMMH8g+3XBMSr4jP7GJz2c2lzXP4qqhs7ErqUe7GG76U4SdsVUXqAbxGKX/uY+PVA8Dx3CJu/X6wiNYFjk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=TbnClPjg; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="TbnClPjg" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B8C571F00A3D; Sat, 5 Sep 2026 00:43:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569030; bh=hLPmGyrp1Nqs23v0/BMeJbf2q3FonxtrvxyxVa/qgCw=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=TbnClPjgQiMGxD2zR8jwMJ2pTA58+tgQrO800qP3ZBuZEICUErV5SZeh5WliLlji5 LUm2ydFH1m2E6ALCzcBWYgJf2Z0oOlYGr451x86KygJXk7MOypGZpz5Ug+gjgQjC8Z Zh0vixT3XXy6DhJbVo5hoQBmD/9zxwtqZ9DU7NrXUhcDUee6yprHVQrRNy/znX8xqH bm+wLkRqiep9qgYqjGh4ESNwcepHv0YPR5R6TvSU8YkLS+i63jqJanYfxM9uLhpVuS Cc5kiTvM616ZzECx+nRu8Cj/LNNGISK+0/nA4D+Fm3F/7f7sg6nEf5GC9AY0m+ItL2 d/tDbrMKPFz4A== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:25 -0500 Subject: [PATCH v2 06/19] accel: ethosu: Track command stream register setup Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-6-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The current method of tracking command stream state initializing state tracking to illegal values and assuming unaccessed registers are 0 is proving inadequate with additional validation. Instead, track all the registers in a bitmap as the register address space is fairly small. CMD1 opcodes overlap CMD0 after bit 14 is stripped, so maintain a separate bitmap for each bank. Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_gem.c | 269 +++++++++++++++++++++++++++++++++-= ---- 1 file changed, 234 insertions(+), 35 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 408b93350dd7..8a44a5d89bce 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only or MIT /* Copyright 2025 Arm, Ltd. */ =20 +#include #include #include #include @@ -138,7 +139,12 @@ struct feat_matrix { u8 pad_right; }; =20 +#define NPU_CMD0_REGS 0x200 +#define NPU_CMD1_REGS 0x100 + struct cmd_state { + DECLARE_BITMAP(cmd0, NPU_CMD0_REGS); + DECLARE_BITMAP(cmd1, NPU_CMD1_REGS); struct dma_state dma; struct buffer scale[2]; struct buffer weight[4]; @@ -149,8 +155,29 @@ struct cmd_state { =20 static void cmd_state_init(struct cmd_state *st) { - /* Initialize to all 1s to detect missing setup */ - memset(st, 0xff, sizeof(*st)); + memset(st, 0, sizeof(*st)); +} + +static void cmd_state_set_reg(struct cmd_state *st, u16 cmd) +{ + u16 reg =3D cmd & ~BIT(14); + + if (cmd & BIT(14)) { + if (reg < NPU_CMD1_REGS) + __set_bit(reg, st->cmd1); + } else if (reg < NPU_CMD0_REGS) { + __set_bit(reg, st->cmd0); + } +} + +static bool cmd_state_reg_is_set(struct cmd_state *st, u16 cmd) +{ + u16 reg =3D cmd & ~BIT(14); + + if (cmd & BIT(14)) + return reg < NPU_CMD1_REGS && test_bit(reg, st->cmd1); + + return reg < NPU_CMD0_REGS && test_bit(reg, st->cmd0); } =20 static u64 cmd_to_addr(u32 *cmd) @@ -158,13 +185,54 @@ static u64 cmd_to_addr(u32 *cmd) return (((u64)cmd[0] & 0xff0000) << 16) | cmd[1]; } =20 -static u64 dma_length(struct ethosu_validated_cmdstream_info *info, - struct dma_state *dma_st, struct dma *dma) +static bool dma_use_src_stride(struct ethosu_device *edev, + const struct dma_state *dma_st, const struct dma *dma) +{ + return ethosu_is_u65(edev) || dma =3D=3D &dma_st->src; +} + +static bool dma_params_valid(struct ethosu_device *edev, struct cmd_state = *st, + const struct dma_state *dma_st, + const struct dma *dma, + u16 region_cmd, u16 addr_cmd) +{ + s8 mode =3D dma->mode; + + if (!cmd_state_reg_is_set(st, region_cmd) || + !cmd_state_reg_is_set(st, addr_cmd) || + !cmd_state_reg_is_set(st, NPU_SET_DMA0_LEN) || mode < 0 || mode > 2) + return false; + + if (mode >=3D 1 && + !cmd_state_reg_is_set(st, dma_use_src_stride(edev, dma_st, dma) ? + NPU_SET_DMA0_SRC_STRIDE0 : + NPU_SET_DMA0_DST_STRIDE0)) + return U64_MAX; + if (mode =3D=3D 2 && + !cmd_state_reg_is_set(st, dma_use_src_stride(edev, dma_st, dma) ? + NPU_SET_DMA0_SRC_STRIDE1 : + NPU_SET_DMA0_DST_STRIDE1)) + return U64_MAX; + + if (mode >=3D 1 && + (!cmd_state_reg_is_set(st, NPU_SET_DMA0_SIZE0) || !dma_st->size0)) + return false; + if (mode =3D=3D 2 && + (!cmd_state_reg_is_set(st, NPU_SET_DMA0_SIZE1) || !dma_st->size1)) + return false; + + return true; +} + +static u64 dma_length(struct ethosu_device *edev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st, struct dma_state *dma_st, + struct dma *dma, u16 region_cmd, u16 addr_cmd) { s8 mode =3D dma->mode; u64 len =3D dma->len; =20 - if (len =3D=3D U64_MAX) + if (!dma_params_valid(edev, st, dma_st, dma, region_cmd, addr_cmd)) return U64_MAX; =20 if (mode >=3D 1) { @@ -199,17 +267,98 @@ static bool feat_matrix_chained(struct ethosu_device = *edev, struct feat_matrix * return !ethosu_is_u65(edev) && storage =3D=3D 2; } =20 +enum feat_matrix_type { + FEAT_MATRIX_IFM, + FEAT_MATRIX_OFM, + FEAT_MATRIX_IFM2, +}; + +static u16 feat_matrix_base_cmd(enum feat_matrix_type type) +{ + switch (type) { + case FEAT_MATRIX_IFM: + return NPU_SET_IFM_BASE0; + case FEAT_MATRIX_OFM: + return NPU_SET_OFM_BASE0; + case FEAT_MATRIX_IFM2: + return NPU_SET_IFM2_BASE0; + } + + return 0; +} + +static int feat_matrix_validate(struct ethosu_device *edev, + struct cmd_state *st, struct feat_matrix *fm, + enum feat_matrix_type type) +{ + u32 format; + u16 stride_cmd; + + switch (type) { + case FEAT_MATRIX_IFM: + if (!cmd_state_reg_is_set(st, NPU_SET_IFM_REGION) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_PRECISION) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_DEPTH_M1)) + return -EINVAL; + if (feat_matrix_chained(edev, fm)) + return 0; + if (!cmd_state_reg_is_set(st, NPU_SET_IFM_WIDTH0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_HEIGHT0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_HEIGHT1_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_STRIDE_Y)) + return -EINVAL; + break; + case FEAT_MATRIX_OFM: + if (!cmd_state_reg_is_set(st, NPU_SET_OFM_REGION) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_PRECISION) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_DEPTH_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_WIDTH_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_HEIGHT_M1)) + return -EINVAL; + if (feat_matrix_chained(edev, fm)) + return 0; + if (!cmd_state_reg_is_set(st, NPU_SET_OFM_WIDTH0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_HEIGHT0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_HEIGHT1_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_STRIDE_Y)) + return -EINVAL; + break; + case FEAT_MATRIX_IFM2: + if (!cmd_state_reg_is_set(st, NPU_SET_IFM2_REGION) || + !cmd_state_reg_is_set(st, NPU_SET_IFM2_PRECISION)) + return -EINVAL; + if (feat_matrix_chained(edev, fm)) + return 0; + if (!cmd_state_reg_is_set(st, NPU_SET_IFM2_WIDTH0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM2_HEIGHT0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM2_HEIGHT1_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM2_STRIDE_Y)) + return -EINVAL; + break; + } + + format =3D (fm->precision >> 6) & 0x3; + stride_cmd =3D feat_matrix_base_cmd(type) + (format ? 6 : 4); + if (!cmd_state_reg_is_set(st, stride_cmd)) + return -EINVAL; + + return 0; +} static u64 feat_matrix_length(struct ethosu_device *edev, struct ethosu_validated_cmdstream_info *info, - struct feat_matrix *fm, + struct cmd_state *st, struct feat_matrix *fm, + enum feat_matrix_type type, u32 x, u32 y, u32 c, bool ofm) { u32 element_size, storage =3D ethosu_is_u65(edev) ? 0 : fm->precision >> = 14; int tile =3D 0; u64 addr; + u64 offset; =20 if (fm->region < 0) return U64_MAX; + if (feat_matrix_validate(edev, st, fm, type)) + return U64_MAX; =20 if (feat_matrix_chained(edev, fm)) return 0; @@ -237,24 +386,39 @@ static u64 feat_matrix_length(struct ethosu_device *e= dev, default: return U64_MAX; } - if (fm->base[tile] =3D=3D U64_MAX) + if (!cmd_state_reg_is_set(st, feat_matrix_base_cmd(type) + tile)) return U64_MAX; =20 - addr =3D fm->base[tile] + y * fm->stride_y; + if (check_mul_overflow(y, (u64)fm->stride_y, &offset) || + check_add_overflow(fm->base[tile], offset, &addr)) + return U64_MAX; =20 switch ((fm->precision >> 6) & 0x3) { // format case 0: //nhwc: element_size =3D BIT((fm->precision >> (ofm ? 1 : 2)) & 0x3); - addr +=3D x * fm->stride_x + c * element_size; + if (check_mul_overflow(x, (u64)fm->stride_x, &offset) || + check_add_overflow(addr, offset, &addr) || + check_mul_overflow(c, element_size, &offset) || + check_add_overflow(addr, offset, &addr)) + return U64_MAX; break; case 1: //nhcwb16: element_size =3D BIT((fm->precision >> (ofm ? 1 : 2)) & 0x3); =20 - addr +=3D (c / 16) * fm->stride_c + (16 * x + (c & 0xf)) * element_size; + if (check_mul_overflow(c / 16, (u64)fm->stride_c, &offset) || + check_add_overflow(addr, offset, &addr) || + check_mul_overflow(16 * x + (c & 0xf), element_size, &offset) || + check_add_overflow(addr, offset, &addr)) + return U64_MAX; break; + default: + return U64_MAX; } =20 - info->region_size[fm->region] =3D max(info->region_size[fm->region], addr= + 1); + if (check_add_overflow(addr, 1ULL, &offset)) + return U64_MAX; + + info->region_size[fm->region] =3D max(info->region_size[fm->region], offs= et); =20 return addr; } @@ -268,7 +432,13 @@ static int calc_sizes(struct drm_device *ddev, u64 len; =20 if (ifm) { - if (st->ifm.stride_kernel =3D=3D U16_MAX) + if (!cmd_state_reg_is_set(st, NPU_SET_KERNEL_WIDTH_M1) || + !cmd_state_reg_is_set(st, NPU_SET_KERNEL_HEIGHT_M1) || + !cmd_state_reg_is_set(st, NPU_SET_KERNEL_STRIDE) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_TOP) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_LEFT) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_RIGHT) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_BOTTOM)) return -EINVAL; u32 stride_y =3D ((st->ifm.stride_kernel >> 8) & 0x2) + ((st->ifm.stride_kernel >> 1) & 0x1) + 1; @@ -282,8 +452,9 @@ static int calc_sizes(struct drm_device *ddev, if (ifm_height < 0 || ifm_width < 0) return -EINVAL; =20 - len =3D feat_matrix_length(edev, info, &st->ifm, ifm_width, - ifm_height, st->ifm.depth, false); + len =3D feat_matrix_length(edev, info, st, &st->ifm, + FEAT_MATRIX_IFM, ifm_width, ifm_height, + st->ifm.depth, false); dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", op, st->ifm.region, st->ifm.base[0], len); if (len =3D=3D U64_MAX) @@ -291,8 +462,9 @@ static int calc_sizes(struct drm_device *ddev, } =20 if (ifm2) { - len =3D feat_matrix_length(edev, info, &st->ifm2, st->ifm.depth, - 0, st->ofm.depth, false); + len =3D feat_matrix_length(edev, info, st, &st->ifm2, + FEAT_MATRIX_IFM2, st->ifm.depth, 0, + st->ofm.depth, false); dev_dbg(ddev->dev, "op %d: IFM2:%d:0x%llx-0x%llx\n", op, st->ifm2.region, st->ifm2.base[0], len); if (len =3D=3D U64_MAX) @@ -303,8 +475,9 @@ static int calc_sizes(struct drm_device *ddev, dev_dbg(ddev->dev, "op %d: W:%d:0x%llx-0x%llx\n", op, st->weight[0].region, st->weight[0].base, st->weight[0].base + st->weight[0].length - 1); - if (st->weight[0].region < 0 || st->weight[0].base =3D=3D U64_MAX || - st->weight[0].length =3D=3D U32_MAX) + if (!cmd_state_reg_is_set(st, NPU_SET_WEIGHT_REGION) || + !cmd_state_reg_is_set(st, NPU_SET_WEIGHT_BASE) || + !cmd_state_reg_is_set(st, NPU_SET_WEIGHT_LENGTH)) return -EINVAL; info->region_size[st->weight[0].region] =3D max(info->region_size[st->weight[0].region], @@ -315,16 +488,18 @@ static int calc_sizes(struct drm_device *ddev, dev_dbg(ddev->dev, "op %d: S:%d:0x%llx-0x%llx\n", op, st->scale[0].region, st->scale[0].base, st->scale[0].base + st->scale[0].length - 1); - if (st->scale[0].region < 0 || st->scale[0].base =3D=3D U64_MAX || - st->scale[0].length =3D=3D U32_MAX) + if (!cmd_state_reg_is_set(st, NPU_SET_SCALE_REGION) || + !cmd_state_reg_is_set(st, NPU_SET_SCALE_BASE) || + !cmd_state_reg_is_set(st, NPU_SET_SCALE_LENGTH)) return -EINVAL; info->region_size[st->scale[0].region] =3D max(info->region_size[st->scale[0].region], st->scale[0].base + st->scale[0].length); } =20 - len =3D feat_matrix_length(edev, info, &st->ofm, st->ofm.width, - st->ofm.height[2], st->ofm.depth, true); + len =3D feat_matrix_length(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, + st->ofm.width, st->ofm.height[2], st->ofm.depth, + true); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); if (len =3D=3D U64_MAX) @@ -349,8 +524,8 @@ static int calc_sizes_elemwise(struct drm_device *ddev, width =3D st->ifm.broadcast & 0x2 ? 0 : st->ofm.width; depth =3D st->ifm.broadcast & 0x4 ? 0 : st->ofm.depth; =20 - len =3D feat_matrix_length(edev, info, &st->ifm, width, - height, depth, false); + len =3D feat_matrix_length(edev, info, st, &st->ifm, + FEAT_MATRIX_IFM, width, height, depth, false); dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", op, st->ifm.region, st->ifm.base[0], len); if (len =3D=3D U64_MAX) @@ -362,16 +537,17 @@ static int calc_sizes_elemwise(struct drm_device *dde= v, width =3D st->ifm2.broadcast & 0x2 ? 0 : st->ofm.width; depth =3D st->ifm2.broadcast & 0x4 ? 0 : st->ofm.depth; =20 - len =3D feat_matrix_length(edev, info, &st->ifm2, width, - height, depth, false); + len =3D feat_matrix_length(edev, info, st, &st->ifm2, + FEAT_MATRIX_IFM2, width, height, depth, false); dev_dbg(ddev->dev, "op %d: IFM2:%d:0x%llx-0x%llx\n", op, st->ifm2.region, st->ifm2.base[0], len); if (len =3D=3D U64_MAX) return -EINVAL; } =20 - len =3D feat_matrix_length(edev, info, &st->ofm, st->ofm.width, - st->ofm.height[2], st->ofm.depth, true); + len =3D feat_matrix_length(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, + st->ofm.width, st->ofm.height[2], st->ofm.depth, + true); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); if (len =3D=3D U64_MAX) @@ -426,6 +602,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, addr =3D cmd_to_addr(cmds); } =20 + cmd_state_set_reg(&st, cmd); + switch (cmd) { case NPU_OP_STOP: if (i !=3D size / 4 - 1) @@ -433,8 +611,10 @@ static int ethosu_gem_cmdstream_copy_and_validate(stru= ct drm_device *ddev, ends_with_stop =3D true; break; case NPU_OP_DMA_START: - srclen =3D dma_length(info, &st.dma, &st.dma.src); - dstlen =3D dma_length(info, &st.dma, &st.dma.dst); + srclen =3D dma_length(edev, info, &st, &st.dma, &st.dma.src, + NPU_SET_DMA0_SRC_REGION, NPU_SET_DMA0_SRC); + dstlen =3D dma_length(edev, info, &st, &st.dma, &st.dma.dst, + NPU_SET_DMA0_DST_REGION, NPU_SET_DMA0_DST); if (srclen =3D=3D U64_MAX || dstlen =3D=3D U64_MAX) return -EINVAL; =20 @@ -445,16 +625,28 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, st.dma.dst.region, st.dma.dst.offset, dstlen); break; case NPU_OP_CONV: - case NPU_OP_DEPTHWISE: use_ifm2 =3D param & 0x1; // weights_ifm2 + if (!cmd_state_reg_is_set(&st, NPU_SET_OFM_PRECISION)) + return -EINVAL; use_scale =3D !(st.ofm.precision & 0x100); ret =3D calc_sizes(ddev, info, cmd, &st, true, use_ifm2, !use_ifm2, use_scale); if (ret) return ret; break; + case NPU_OP_DEPTHWISE: + if (!cmd_state_reg_is_set(&st, NPU_SET_OFM_PRECISION)) + return -EINVAL; + use_scale =3D !(st.ofm.precision & 0x100); + ret =3D calc_sizes(ddev, info, cmd, &st, true, false, true, + use_scale); + if (ret) + return ret; + break; case NPU_OP_POOL: use_ifm =3D param !=3D 0x4; // pooling mode + if (!cmd_state_reg_is_set(&st, NPU_SET_OFM_PRECISION)) + return -EINVAL; use_scale =3D !(st.ofm.precision & 0x100); ret =3D calc_sizes(ddev, info, cmd, &st, use_ifm, false, false, use_scale); @@ -462,11 +654,18 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, return ret; break; case NPU_OP_ELEMENTWISE: - use_scale =3D ethosu_is_u65(edev) ? + if (!ethosu_is_u65(edev) && + !cmd_state_reg_is_set(&st, NPU_SET_IFM_BROADCAST)) + return -EINVAL; + use_ifm2 =3D (param !=3D 5) && (param !=3D 6) && + (param !=3D 7) && (param !=3D 0x24); + if (use_ifm2 && + !cmd_state_reg_is_set(&st, NPU_SET_IFM2_BROADCAST)) + return -EINVAL; + use_scale =3D use_ifm2 && (ethosu_is_u65(edev) ? (st.ifm2.broadcast & 0x80) : - (st.ifm2.broadcast =3D=3D 8); - use_ifm2 =3D !(use_scale || (param =3D=3D 5) || - (param =3D=3D 6) || (param =3D=3D 7) || (param =3D=3D 0x24)); + (st.ifm2.broadcast =3D=3D 8)); + use_ifm2 =3D use_ifm2 && !use_scale; use_ifm =3D st.ifm.broadcast !=3D 8; ret =3D calc_sizes_elemwise(ddev, info, cmd, &st, use_ifm, use_ifm2); if (ret) --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BCFED31355B for ; Sat, 5 Sep 2026 00:43:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569032; cv=none; b=Tz17OL9oFA7gjlSemsMltHf3AiWoA7kGPGDCKWJCtz0WTuv9jp56q0fSI2eBGYP8UT2KVRiX+g5MARDru9eGDR8Yy5iZWGzdHR8BNjrPGvYf8oZMgdKnVZwPmsqLFab2EkEw0+naMZsKOffMnFx4nUd6LjEBqAJjNhqGZuEOKNo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569032; c=relaxed/simple; bh=RWZ+owyApEzt7vJY7ohQi7nsnGYhTgDktSF+4xrHn5c=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=DtR3SHAXyeWr36VkHAkuv5+uXNC3pvc4MttlRs98BGKu9d+HnN/HUYnfZd874yXeaM50RHvJrOeRIYxXeWWDovaKqUNROQDcDXrz41T7QD0AL+asYK7MtQOpxnISfdLTAIfLnOzhFxo7PGfWfMu/5nRs+xBN3LFL6SzSPGEqlX4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JtoiMqat; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JtoiMqat" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 391441F00A3E; Sat, 5 Sep 2026 00:43:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569031; bh=HV+rmbMI0lHJ4R40iFUVjvOrvTR2qsfW7BSm738+Y1o=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=JtoiMqatW+HYv1FkEvbA/mdafRmPT70WDLRTfD7mTE1O7Q6BDTHUmH4CykEPsvHx6 dcazBOTdkiTvp9S0FMndGS8979+qLxXFBkbD4Ksk3UJLDFIcP4kxlniSjohanNmy6n OCQjsMICGk2+QPvNNGthRHFyTdyvzKIMDD7UBeYKgFxK1tTXbWfVAN7c12MfijGwXE 1ELKoXzvCJ6GFFsRgLwAUo6SxOoTs+ySUOtEBWbQJULXUxRgOlpqBoEaORfQIp5uz5 K3c0vHgBXZVAwuleyLZKexNG7Q0N/MsmbuAvgLXiHOxPD/SePr35PmzbZzfHax1Xq+ pX34nyu1LIyrQ== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:26 -0500 Subject: [PATCH v2 07/19] accel: ethosu: Factor buffer bounds checks Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-7-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Move the repeated command-stream buffer range validation into a helper in preparation for validating all weight and scale streams. Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - Adjust due to previous patch --- drivers/accel/ethosu/ethosu_gem.c | 37 +++++++++++++++++++++++++----------= -- 1 file changed, 25 insertions(+), 12 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 8a44a5d89bce..0b1edf02d48e 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -423,6 +423,25 @@ static u64 feat_matrix_length(struct ethosu_device *ed= ev, return addr; } =20 +static int buffer_size(struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st, struct buffer *buf, s8 region, + u16 region_cmd, u16 base_cmd, u16 length_cmd) +{ + u64 end; + + if (region < 0 || !cmd_state_reg_is_set(st, region_cmd) || + !cmd_state_reg_is_set(st, base_cmd) || + !cmd_state_reg_is_set(st, length_cmd)) + return -EINVAL; + + if (check_add_overflow(buf->base, (u64)buf->length, &end)) + return -EINVAL; + + info->region_size[region] =3D max(info->region_size[region], end); + + return 0; +} + static int calc_sizes(struct drm_device *ddev, struct ethosu_validated_cmdstream_info *info, u16 op, struct cmd_state *st, @@ -475,26 +494,20 @@ static int calc_sizes(struct drm_device *ddev, dev_dbg(ddev->dev, "op %d: W:%d:0x%llx-0x%llx\n", op, st->weight[0].region, st->weight[0].base, st->weight[0].base + st->weight[0].length - 1); - if (!cmd_state_reg_is_set(st, NPU_SET_WEIGHT_REGION) || - !cmd_state_reg_is_set(st, NPU_SET_WEIGHT_BASE) || - !cmd_state_reg_is_set(st, NPU_SET_WEIGHT_LENGTH)) + if (buffer_size(info, st, &st->weight[0], st->weight[0].region, + NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT_BASE, + NPU_SET_WEIGHT_LENGTH)) return -EINVAL; - info->region_size[st->weight[0].region] =3D - max(info->region_size[st->weight[0].region], - st->weight[0].base + st->weight[0].length); } =20 if (scale) { dev_dbg(ddev->dev, "op %d: S:%d:0x%llx-0x%llx\n", op, st->scale[0].region, st->scale[0].base, st->scale[0].base + st->scale[0].length - 1); - if (!cmd_state_reg_is_set(st, NPU_SET_SCALE_REGION) || - !cmd_state_reg_is_set(st, NPU_SET_SCALE_BASE) || - !cmd_state_reg_is_set(st, NPU_SET_SCALE_LENGTH)) + if (buffer_size(info, st, &st->scale[0], st->scale[0].region, + NPU_SET_SCALE_REGION, NPU_SET_SCALE_BASE, + NPU_SET_SCALE_LENGTH)) return -EINVAL; - info->region_size[st->scale[0].region] =3D - max(info->region_size[st->scale[0].region], - st->scale[0].base + st->scale[0].length); } =20 len =3D feat_matrix_length(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 05786314B72 for ; Sat, 5 Sep 2026 00:43:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569034; cv=none; b=TaqVgMFNWyB45FM16kQNUUIavRcM3/SQMEOVUXTgLsD4y8vfwpvEtmdxXY7XHALmHhaGJYrxgBQAoxr1LwkmBN9Z+6bw6AVp48VpZy5baV1pIZznpvWape9c/7jrKylw+bvo0cDGsBAmvdLoWhEixckmQHsXGNNT6g3B4/B/vvg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569034; c=relaxed/simple; bh=/cG4ztpof+Db4sqDKVyLUFC4tL0GFZ7ZX5VzNUQ76E4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=FTIVm/8fUoNIhwRNYXe3WeTLkvUXhJMN+FA52bW0DxiJew7WdcpKr4LOe/5r5WbWgaVtRTa42pAGAntFF4g3QgBn/MMqJ/0xfbpcbdnoPr6jdsaKzeGIpL4koPpehU5VR8S9moziwTBMwgF4clbhD0VoE5j0BArMUH4u2bdRclA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MskpUoIT; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MskpUoIT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80FB91F00A3D; Sat, 5 Sep 2026 00:43:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569032; bh=CsWRvrZh1xggSySSlMAO6TDWRn7gIb/4nUy0Vmm7IDE=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=MskpUoIT5p8L16jErGkXU5tvirhkOXPwpgM4uCo3MT0xG/VCwvrfMWRFpJSY9HpgM qr2znskx778OA5YJ4lXNX6Q3wDoGn7NAsJdpb5hTThb0BXzERgQe7g/nPwT9V62E5p yKqim4NMtfeLop/ken5evcVgTps0G0igIjyV6tHcRoD8huJrocw5E3VTVavpcDnyEG Dgiqk7lVVnQpFkJ8h2tcekyGtFiMj31yKyn1o6VJ4vBJp4eELauXR2qKM/x+UCI5D+ QGQpNvYOBYaD0kYcmV3SEQdo4uSro+DA8SkFK3Kjwx1WM22lS6d9yMvVmcsEFcULPi gH7ShQbnAEmmg== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:27 -0500 Subject: [PATCH v2 08/19] accel: ethosu: Validate secondary streams Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-8-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The command-stream validator records the additional U65 scale and weight stream addresses and the U85 weight decoder addresses, but only checked stream 0 against its region buffer. Check every configured secondary stream against the matching weight or scale region before accepting a kernel operation. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - Adjust for register state tracking --- drivers/accel/ethosu/ethosu_gem.c | 33 ++++++++++++++++++++++++++++----- 1 file changed, 28 insertions(+), 5 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 0b1edf02d48e..ec2832eb9a07 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -425,13 +425,17 @@ static u64 feat_matrix_length(struct ethosu_device *e= dev, =20 static int buffer_size(struct ethosu_validated_cmdstream_info *info, struct cmd_state *st, struct buffer *buf, s8 region, - u16 region_cmd, u16 base_cmd, u16 length_cmd) + u16 region_cmd, u16 base_cmd, u16 length_cmd, bool optional) { u64 end; + bool base_set =3D cmd_state_reg_is_set(st, base_cmd); + bool length_set =3D cmd_state_reg_is_set(st, length_cmd); + + if (optional && !base_set && !length_set) + return 0; =20 if (region < 0 || !cmd_state_reg_is_set(st, region_cmd) || - !cmd_state_reg_is_set(st, base_cmd) || - !cmd_state_reg_is_set(st, length_cmd)) + !base_set || !length_set) return -EINVAL; =20 if (check_add_overflow(buf->base, (u64)buf->length, &end)) @@ -496,7 +500,20 @@ static int calc_sizes(struct drm_device *ddev, st->weight[0].base + st->weight[0].length - 1); if (buffer_size(info, st, &st->weight[0], st->weight[0].region, NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT_BASE, - NPU_SET_WEIGHT_LENGTH)) + NPU_SET_WEIGHT_LENGTH, false)) + return -EINVAL; + + if (buffer_size(info, st, &st->weight[1], st->weight[0].region, + NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT1_BASE, + NPU_SET_WEIGHT1_LENGTH, true) || + buffer_size(info, st, &st->weight[3], st->weight[0].region, + NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT3_BASE, + NPU_SET_WEIGHT3_LENGTH, true)) + return -EINVAL; + if (!ethosu_is_u65(edev) && + buffer_size(info, st, &st->weight[2], st->weight[0].region, + NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT2_BASE, + NPU_SET_WEIGHT2_LENGTH, true)) return -EINVAL; } =20 @@ -506,7 +523,13 @@ static int calc_sizes(struct drm_device *ddev, st->scale[0].base + st->scale[0].length - 1); if (buffer_size(info, st, &st->scale[0], st->scale[0].region, NPU_SET_SCALE_REGION, NPU_SET_SCALE_BASE, - NPU_SET_SCALE_LENGTH)) + NPU_SET_SCALE_LENGTH, false)) + return -EINVAL; + + if (ethosu_is_u65(edev) && + buffer_size(info, st, &st->scale[1], st->scale[0].region, + NPU_SET_SCALE_REGION, NPU_SET_SCALE1_BASE, + NPU_SET_SCALE1_LENGTH, true)) return -EINVAL; } =20 --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6A4D112CDBE for ; Sat, 5 Sep 2026 00:43:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569036; cv=none; b=hOWG63UhilxPnFJhqhEN20jtIjQW5bZ6w50sNjcMZ+sxAomXNZ4Ly2HkoE303vgkioGtinGc4sttAlx4EzxdiyCitX16jOeNhGJ5wjjx2vdbj2HkxUgPux3Dgv7TS+M/FztOlOTwUbiro1qGva87Ir0g6644vkLFcNm5djAWqYA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569036; c=relaxed/simple; bh=yce5xvY7O+7CZnWZ7p8VAMy6woPEKOXi/tOKiQ7Zpdw=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=OhMgIcKS0xf8Ybz2KKOXrvF/WXDlbBUusKDFLxGoi2gUF0SpRkENqnIrJsaR3xsmU5TKJnzcNy3muJD/GeTucIM50DjoAJ76YXZ1niIvCLi8xSvogfb4aym8qcEtvWiEmpwzlOHxtvgwoIa58GMYMniREn4gMFAv7WZmBNLrV2A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gui+71bi; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gui+71bi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F06B01F00A3F; Sat, 5 Sep 2026 00:43:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569034; bh=sO8nIB/KwR6kOV/L6ATBUFC+htalxp/LRbOr3G/stTo=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=gui+71biTd2qi2JzAVA383OnGYK/IYkHa5nnFdNlGOsiLq3IG/zdpf0JZ01ZAborP L7JTjQcFNUkscoibe2+i+SdxGuVOtU24t+Zl/t5HBzA9JG6GdAMDPYOSvuXo9/FScI TNPGhe9DPYzcb4g7VV+4cLr6zu6YMLAdaMQ1rsmLCTWv54QOrcLp2ZhWuG3AzhjB/J EHNzUbdwrUi6tlulRpvYjcbsahndoa4aUygoIgiGZ1PnWuFGD0bKZk0/9Tgaz1QFXy H+a1xkvejEOz7VkoYbzTfRDOpceIuKxa7TCG6uqpCCVa4IUJtxJBXZWnUJ05Cvscr5 uIf8oxRiDmCVA== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:28 -0500 Subject: [PATCH v2 09/19] accel: ethosu: Reject unsupported commands Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-9-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The command-stream validator does not model U85 branches, indexed DMA, or OFM transposes. A branch can bypass the linear validation state, indexed DMA accesses an unchecked index buffer, and a transpose changes the feature-map address calculation. Reject those commands and configurations, as well as the reserved DMA stride mode and feature-map formats. Reject command-stream IRQs because they can signal job completion before later commands finish. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - no changes --- drivers/accel/ethosu/ethosu_device.h | 4 ++++ drivers/accel/ethosu/ethosu_gem.c | 19 +++++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index 1eca8590e68d..c330048dbcca 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -86,14 +86,18 @@ struct gen_pool; #define PMU_EV_TYPE_CYCLES 0x11 #define PMU_EV_TYPE_IDLE 0x20 =20 +#define NPU_DMA_REGION_INDEX_MODE BIT(11) + enum ethosu_cmds { NPU_OP_STOP =3D 0x0, + NPU_OP_IRQ =3D 0x1, NPU_OP_CONV =3D 0x2, NPU_OP_DEPTHWISE =3D 0x3, NPU_OP_POOL =3D 0x5, NPU_OP_ELEMENTWISE =3D 0x6, NPU_OP_RESIZE =3D 0x7, // U85 only NPU_OP_DMA_START =3D 0x10, + NPU_OP_BRANCH =3D 0x4100, // U85 only NPU_SET_IFM_PAD_TOP =3D 0x100, NPU_SET_IFM_PAD_LEFT =3D 0x101, NPU_SET_IFM_PAD_RIGHT =3D 0x102, diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index ec2832eb9a07..c913c95e48ae 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -641,6 +641,9 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, cmd_state_set_reg(&st, cmd); =20 switch (cmd) { + case NPU_OP_BRANCH: + case NPU_OP_IRQ: + return -EINVAL; case NPU_OP_STOP: if (i !=3D size / 4 - 1) return -EINVAL; @@ -734,6 +737,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, st.ifm.depth =3D param; break; case NPU_SET_IFM_PRECISION: + if (((param >> 6) & 0x3) > 1) + return -EINVAL; st.ifm.precision =3D param; break; case NPU_SET_IFM_BROADCAST: @@ -777,6 +782,10 @@ static int ethosu_gem_cmdstream_copy_and_validate(stru= ct drm_device *ddev, st.ofm.depth =3D param; break; case NPU_SET_OFM_PRECISION: + if (((param >> 6) & 0x3) > 1) + return -EINVAL; + if (!ethosu_is_u65(edev) && (param & GENMASK(13, 11))) + return -EINVAL; st.ofm.precision =3D param; break; case NPU_SET_OFM_REGION: @@ -811,6 +820,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, st.ifm2.broadcast =3D param; break; case NPU_SET_IFM2_PRECISION: + if (((param >> 6) & 0x3) > 1) + return -EINVAL; st.ifm2.precision =3D param; break; case NPU_SET_IFM2_REGION: @@ -885,18 +896,26 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, break; =20 case NPU_SET_DMA0_SRC_REGION: + if (param & NPU_DMA_REGION_INDEX_MODE) + return -EINVAL; if (param & 0x100) st.dma.src.region =3D -1; else st.dma.src.region =3D param & 0x7; st.dma.src.mode =3D (param >> 9) & 0x3; + if (st.dma.src.mode =3D=3D 3) + return -EINVAL; break; case NPU_SET_DMA0_DST_REGION: + if (param & NPU_DMA_REGION_INDEX_MODE) + return -EINVAL; if (param & 0x100) st.dma.dst.region =3D -1; else st.dma.dst.region =3D param & 0x7; st.dma.dst.mode =3D (param >> 9) & 0x3; + if (st.dma.dst.mode =3D=3D 3) + return -EINVAL; break; case NPU_SET_DMA0_SIZE0: st.dma.size0 =3D param; --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BAF69316199 for ; Sat, 5 Sep 2026 00:43:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569037; cv=none; b=HoNqOE205uL9pryx1U33UqgMMekJlA7/W838OWecEfwasLuzCYgNaxEWdpibz7hVP6615xCeI+mOykyQAEyp6pnfmg2ValC7ShCs3B1MRLME+NpvuX+YV+78eC4TWOD99P6z8ihaeTt8B6l85VfLuE422j4Io5qlHM0clornPbE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569037; c=relaxed/simple; bh=nX1qucJJfrGat46oqOOUGOgzn7YvJ13jtIc22NGMwzU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=BmlvkjycKy8vYO/Z8hjsjYxJEKj5IE+ft/+B/ZBvsUbuuAL45zNEdc1hY+EMICfaBKk4tFdh3tv4Kl9ml6BkA6l24+qzNR3T7nv+RpwStrMMN2eotqwlus2KSYDV3owfQDvRkSVq4acbjB65yWLiKiY6HAxv7MpldTNWAyvMUgk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OWyUkZJI; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OWyUkZJI" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 60AD61F00A3D; Sat, 5 Sep 2026 00:43:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569035; bh=i579P5jAzhcYzZGpGhMbx5lVBMLlO7rm0XQy+8bmP84=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=OWyUkZJIjvIj3IkHwaeOCnM9oN0UKVkqzNnVO6tDjJvlLZiLNS9+EV3WgwTx0cdqC z4kN/grXFhdf6xLxofgM8e0RiMtTTYKCNxvm15ia/KllmuUVHjnlT3vBbj852POTo5 BC2WH3YhcEqfXH92dI7xm/YYjCv3hLS7LMY27p2HDhWt4jS55IBO8I3A+DKVl37HkT GzPuR7mjDnOg5If6Jav4pGxnSyiFuSQG0FHqDDOfxJhL/5rAUAbK3FsEBjtw62hcIN go+EbcgoFBioxJqIz2D5qfPrWQ/RTNHe3Wc7AfUaeVYmMcZht4V0eBXh/DUEXAWwpd RV5MW8oybdn1Q== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:29 -0500 Subject: [PATCH v2 10/19] accel: ethosu: Validate all feature map tiles Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-10-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The command-stream validator checked only the final feature-map coordinate. For tiled tensors, this can leave an earlier tile base address unchecked even though the operation accesses it. Check the final coordinate of every tile touched by an operation. Also treat U65 feature maps as 2x2 tiled: its precision rounding bits are not the U85 storage encoding. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - no changes --- drivers/accel/ethosu/ethosu_gem.c | 125 +++++++++++++++++++++++++++++-----= ---- 1 file changed, 97 insertions(+), 28 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index c913c95e48ae..c54496fa08f4 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -423,6 +423,74 @@ static u64 feat_matrix_length(struct ethosu_device *ed= ev, return addr; } =20 +static int feat_matrix_check_location(struct ethosu_device *edev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st, struct feat_matrix *fm, + enum feat_matrix_type type, u32 x, u32 y, + u32 c, bool ofm, u64 *max_len) +{ + u64 len; + + len =3D feat_matrix_length(edev, info, st, fm, type, x, y, c, ofm); + if (len =3D=3D U64_MAX) + return -EINVAL; + + *max_len =3D max(*max_len, len); + return 0; +} + +static int feat_matrix_size(struct ethosu_device *edev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st, struct feat_matrix *fm, + enum feat_matrix_type type, + u32 x, u32 y, u32 c, bool ofm, u64 *max_len) +{ + u32 storage =3D ethosu_is_u65(edev) ? 0 : fm->precision >> 14; + int ret; + + *max_len =3D 0; + + if (ethosu_is_u65(edev) || storage =3D=3D 0) { + for (int xi =3D 0; xi < 2; xi++) { + for (int yi =3D 0; yi < 2; yi++) { + ret =3D feat_matrix_check_location(edev, info, st, fm, type, + xi ? x : 0, + yi ? y : 0, c, ofm, + max_len); + if (ret) + return ret; + } + } + return 0; + } + + if (storage =3D=3D 1) { + ret =3D feat_matrix_check_location(edev, info, st, fm, type, x, 0, c, + ofm, max_len); + if (ret) + return ret; + if (fm->height[0] < fm->height[1] && fm->height[1] <=3D y) { + ret =3D feat_matrix_check_location(edev, info, st, fm, type, x, + fm->height[1], c, ofm, + max_len); + if (ret) + return ret; + } + if (fm->height[1] < y) { + ret =3D feat_matrix_check_location(edev, info, st, fm, type, x, + fm->height[1] + 1, c, ofm, + max_len); + if (ret) + return ret; + } + return feat_matrix_check_location(edev, info, st, fm, type, x, y, c, + ofm, max_len); + } + + return feat_matrix_check_location(edev, info, st, fm, type, x, y, c, ofm, + max_len); +} + static int buffer_size(struct ethosu_validated_cmdstream_info *info, struct cmd_state *st, struct buffer *buf, s8 region, u16 region_cmd, u16 base_cmd, u16 length_cmd, bool optional) @@ -453,6 +521,7 @@ static int calc_sizes(struct drm_device *ddev, { struct ethosu_device *edev =3D to_ethosu_device(ddev); u64 len; + int ret; =20 if (ifm) { if (!cmd_state_reg_is_set(st, NPU_SET_KERNEL_WIDTH_M1) || @@ -475,23 +544,22 @@ static int calc_sizes(struct drm_device *ddev, if (ifm_height < 0 || ifm_width < 0) return -EINVAL; =20 - len =3D feat_matrix_length(edev, info, st, &st->ifm, - FEAT_MATRIX_IFM, ifm_width, ifm_height, - st->ifm.depth, false); + ret =3D feat_matrix_size(edev, info, st, &st->ifm, FEAT_MATRIX_IFM, + ifm_width, ifm_height, st->ifm.depth, false, + &len); dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", op, st->ifm.region, st->ifm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 if (ifm2) { - len =3D feat_matrix_length(edev, info, st, &st->ifm2, - FEAT_MATRIX_IFM2, st->ifm.depth, 0, - st->ofm.depth, false); + ret =3D feat_matrix_size(edev, info, st, &st->ifm2, FEAT_MATRIX_IFM2, + st->ifm.depth, 0, st->ofm.depth, false, &len); dev_dbg(ddev->dev, "op %d: IFM2:%d:0x%llx-0x%llx\n", op, st->ifm2.region, st->ifm2.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 if (weight) { @@ -533,13 +601,13 @@ static int calc_sizes(struct drm_device *ddev, return -EINVAL; } =20 - len =3D feat_matrix_length(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, - st->ofm.width, st->ofm.height[2], st->ofm.depth, - true); + ret =3D feat_matrix_size(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, + st->ofm.width, st->ofm.height[2], st->ofm.depth, + true, &len); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; if (!feat_matrix_chained(edev, &st->ofm)) info->output_region[st->ofm.region] =3D true; =20 @@ -554,18 +622,19 @@ static int calc_sizes_elemwise(struct drm_device *dde= v, struct ethosu_device *edev =3D to_ethosu_device(ddev); u32 height, width, depth; u64 len; + int ret; =20 if (ifm) { height =3D st->ifm.broadcast & 0x1 ? 0 : st->ofm.height[2]; width =3D st->ifm.broadcast & 0x2 ? 0 : st->ofm.width; depth =3D st->ifm.broadcast & 0x4 ? 0 : st->ofm.depth; =20 - len =3D feat_matrix_length(edev, info, st, &st->ifm, - FEAT_MATRIX_IFM, width, height, depth, false); + ret =3D feat_matrix_size(edev, info, st, &st->ifm, FEAT_MATRIX_IFM, + width, height, depth, false, &len); dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", op, st->ifm.region, st->ifm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 if (ifm2) { @@ -573,21 +642,21 @@ static int calc_sizes_elemwise(struct drm_device *dde= v, width =3D st->ifm2.broadcast & 0x2 ? 0 : st->ofm.width; depth =3D st->ifm2.broadcast & 0x4 ? 0 : st->ofm.depth; =20 - len =3D feat_matrix_length(edev, info, st, &st->ifm2, - FEAT_MATRIX_IFM2, width, height, depth, false); + ret =3D feat_matrix_size(edev, info, st, &st->ifm2, FEAT_MATRIX_IFM2, + width, height, depth, false, &len); dev_dbg(ddev->dev, "op %d: IFM2:%d:0x%llx-0x%llx\n", op, st->ifm2.region, st->ifm2.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 - len =3D feat_matrix_length(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, - st->ofm.width, st->ofm.height[2], st->ofm.depth, - true); + ret =3D feat_matrix_size(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, + st->ofm.width, st->ofm.height[2], st->ofm.depth, + true, &len); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; if (!feat_matrix_chained(edev, &st->ofm)) info->output_region[st->ofm.region] =3D true; =20 --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 046F3314B72 for ; Sat, 5 Sep 2026 00:43:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569038; cv=none; b=LB7jBR3RbsRL9uVMZlG7XZhX8dl9s3JABdcovqHy+ZO7+RwdLInMrpxqQZhkEQtGYdcNTp0gljubQHEy1Om4YRxiHHra2jJctNgKUlRGatsvw2jKq3XgkYjrr+TDBpqJcGuBK8U9ZPPtqC8TevRDz14B7q+u6W2UyzwIB1Ilsyc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569038; c=relaxed/simple; bh=Lxl31UnJzWQ8rOwz3+HDvKzujOoNI+PujBdcWOTgdCQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=I6R4hJkg1HPmZ/Td+Ey3IWOTa2/Nyj3822fFHkyixiXkCVlJx8MP0mvcDiX+kdU6T81iqitoW1dk7DJHL4BehEwW+MT8SZiY9SCwTHp7+eMk6U3i6DQZ1hT+8OAq5MeA9XywTP0NI+GqPvtV8KL4fwoAl3S3tGXzoLPMLpTtc/Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=SnBjQ16r; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="SnBjQ16r" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A818F1F00A3E; Sat, 5 Sep 2026 00:43:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569036; bh=i9FIEzPfm/uew4CacS6zP4HA4rLMmusojNCkX4ydPTA=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=SnBjQ16rUQozMKgVtqIPpi0Cmy35PC6l5+zWvtXv1rnl/jkzm3dSxx3grrxUq9jYM 6+1qfW2eTlT62NsVamfgi10kQaGCBOExRzhzhq7m1/ejxxNsAN2g4qq8v8dGd5inz7 QsZRJ1XJh5TViv7hH/CsV6Zlx1u/hBj+gxx9ltoOmuziJyj3fLuFrC2NvybhDzMwRs KdGCDrldnfGv3J4QHXdWPReBli1G+5h2pXmeVUl4RuGJyaPcyfNbkJvvg3pGQ8llbw c7RNY0X3IRUvtHHp6mZjWXbyMAEt6/6tFWhSMsJ4GMAkg6InrtLODazQ0aY6Qr0wXq /cy1GvpAUXS7w== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:30 -0500 Subject: [PATCH v2 11/19] accel: ethosu: Account for feature map element size Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-11-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The feature map bounds calculation currently accounts for only one byte of the final element. This can leave the tail of B16, B32, and B64 elements outside the validated buffer. Use the feature map element size when calculating the final byte. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index c54496fa08f4..bca68fab0527 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -415,7 +415,7 @@ static u64 feat_matrix_length(struct ethosu_device *ede= v, return U64_MAX; } =20 - if (check_add_overflow(addr, 1ULL, &offset)) + if (check_add_overflow(addr, (u64)element_size, &offset)) return U64_MAX; =20 info->region_size[fm->region] =3D max(info->region_size[fm->region], offs= et); --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 845BF326945 for ; Sat, 5 Sep 2026 00:43:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569039; cv=none; b=PnwitaDMVsrdQYd+ONuKs10txbfWYuwpKXWYrkrsywpi73pJi2Tnhx57hk89jFgxcKmI4fm0rNQnBBAc2O4xmUFVEZrvgCjXAOEmKpUdRvuTiUA0IJMk7HTmv9A7OvTttNtyrB6LxrVrKsauIZd79VU/FCxOaJGDTG/nEEI7vec= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569039; c=relaxed/simple; bh=/RwCnv4v8jOVpi3A1II7WcwoWGlNyoxRSFgBzM0Q1VI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=E7NX0oyivhm9a43j2HGNAqFqJCiVqv33VmTBQBKYqZ9yRUSnYpa5rlhm/CsgIclxql5lsdsCWxBySwvpJQ8UpboroqUkhWInixS04xbSvk8YMNO8lrMcsURDPkJGCSxDY6kG/n93y3ByD96r8bYvvxRe+B5bwZKI07Zcwj55fls= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ovefgT/z; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ovefgT/z" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2791D1F00A3F; Sat, 5 Sep 2026 00:43:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569038; bh=dPB9D6QSCZEEXMqkqQJch5Q/B371Mby843THkvip74w=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=ovefgT/zedTqlPPjCh7b8J38ufTfaRPw0KKjvqVjVfRZutxz+tkJ1CeULR1lPGtT2 VubL3wkqU38cS32rJFg14/tUHNQCxgKoWaqCDBxbB5R+DplE74fIitVAhIeKzFijHG 48niboopdNIUh8OVd6UynD0REMZvQrF77StRszeHSA0H4gf6UAO7rAk8GoO4Nnpjw+ MOFLgyxiAE4KhHV/EFtZWEzsdijovQe8RIiHBZg1m8gnGWDRAwaF06571ulDAmO7kO lQ3QZ2eMt+RjW8FC+A4n7ckW+F9Dp1wPLC0Dg7lvbuFqXZYWcjcRZeKbc6kkofmEqW lsfXcwD/mbXYA== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:31 -0500 Subject: [PATCH v2 12/19] accel: ethosu: Validate convolution parameter Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-12-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The U65 NPU_OP_CONV command has no parameter fields, but the validator interpreted bit zero as the U85 weights_ifm2 field. A crafted U65 stream could consequently make validation skip the weight buffer that hardware accesses. Require a zero parameter on U65 and reject the reserved U85 parameter bits. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_device.h | 1 + drivers/accel/ethosu/ethosu_gem.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index c330048dbcca..d7e1e3c8ca12 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -87,6 +87,7 @@ struct gen_pool; #define PMU_EV_TYPE_IDLE 0x20 =20 #define NPU_DMA_REGION_INDEX_MODE BIT(11) +#define NPU_OP_CONV_WEIGHTS_IFM2 BIT(0) =20 enum ethosu_cmds { NPU_OP_STOP =3D 0x0, diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index bca68fab0527..d60a2a453302 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -733,7 +733,10 @@ static int ethosu_gem_cmdstream_copy_and_validate(stru= ct drm_device *ddev, st.dma.dst.region, st.dma.dst.offset, dstlen); break; case NPU_OP_CONV: - use_ifm2 =3D param & 0x1; // weights_ifm2 + if ((ethosu_is_u65(edev) && param) || (param & ~NPU_OP_CONV_WEIGHTS_IFM= 2)) + return -EINVAL; + + use_ifm2 =3D param & NPU_OP_CONV_WEIGHTS_IFM2; if (!cmd_state_reg_is_set(&st, NPU_SET_OFM_PRECISION)) return -EINVAL; use_scale =3D !(st.ofm.precision & 0x100); --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 32F643375D5 for ; Sat, 5 Sep 2026 00:43:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569041; cv=none; b=uBfMstWly+5O4MRKJljC8v1IJGNS76i1vkhGRXY3MKNL2U71uxkMJ0ugrwJNceU8bJ36XTX0bW5BgC/Vzb2w7c6nUHCySsjwLzhX+LBC8He2V/z9ylrhib5SRPP+gH54DaYWfagSsVAM+2ZuYVYczE6X+qR7IYBeULHE+Aohi7M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569041; c=relaxed/simple; bh=4FD78D0s5EkxjQSGpgWww5IPR/qwgwDPGSb3au56H5c=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=rDLavXPxWSMUotAW5pHMBOyO6ryEBSzWHcpprELOHWq7SlDCac//NxMxFcjy0GGb6Evo7pUZh5QrE0yIKWlnEsl8h+fh1JEOpze6+2k0sqgtq6Fc4WfgfIYOGAuD8VDr042MFLIp9PpyZA4ij6l5xYIEAkaQfyhwQoQndweX2sM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=nzjkDY7X; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="nzjkDY7X" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8D2B61F00A3D; Sat, 5 Sep 2026 00:43:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569039; bh=L3p3dOtxKM3kZeWqbQEMIGtwYcwhJiwLZnqu4yNzFOg=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=nzjkDY7XpAz95vaKdaaYASYI0ImOjJcjHXqtY/yWTwXeuto0+KcB49BSbvQP9JXRQ Is9/+Vpzh0X0lPfDhCbOzKJFbcjXpiBMudrDayH+2OBAag+yZpUfY43Vptoh/rm8uS E7BVRFXksA7CcuVlqeqH6vFkPCRSwX6/ld09+bDoRrsalfLXEXynQqkAlCar+vzoXb 8jTPxgiNi7m+AjhJlYtsjE5Xy3FuYh0cCSjyXQUc0uWARtrPf0i0xSRWGioPEIOK0m LEejnnKtvh5/iAjTexx6ITF2Z08ja/dwcWhvULvVnLR0E9gQhNDQzFVOgwJFYGj1qU A+/LkHzH5fGdA== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:32 -0500 Subject: [PATCH v2 13/19] accel: ethosu: Account for kernel dilation in IFM size Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-13-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Kernel dilation increases the input feature-map area accessed by a kernel operation. Include the x and y dilation settings when calculating the required IFM bounds. Without this, a command stream using x2 dilation can access IFM memory past the range validated by the driver. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_device.h | 2 ++ drivers/accel/ethosu/ethosu_gem.c | 10 ++++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index d7e1e3c8ca12..8e23fdbf7f8a 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -88,6 +88,8 @@ struct gen_pool; =20 #define NPU_DMA_REGION_INDEX_MODE BIT(11) #define NPU_OP_CONV_WEIGHTS_IFM2 BIT(0) +#define NPU_KERNEL_DILATION_X BIT(3) +#define NPU_KERNEL_DILATION_Y BIT(4) =20 enum ethosu_cmds { NPU_OP_STOP =3D 0x0, diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index d60a2a453302..63dd07791f31 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -536,10 +536,16 @@ static int calc_sizes(struct drm_device *ddev, ((st->ifm.stride_kernel >> 1) & 0x1) + 1; u32 stride_x =3D ((st->ifm.stride_kernel >> 5) & 0x2) + (st->ifm.stride_kernel & 0x1) + 1; + u32 dilation_y =3D 1 + !!(st->ifm.stride_kernel & + NPU_KERNEL_DILATION_Y); + u32 dilation_x =3D 1 + !!(st->ifm.stride_kernel & + NPU_KERNEL_DILATION_X); s32 ifm_height =3D st->ofm.height[2] * stride_y + - st->ifm.height[2] - (st->ifm.pad_top + st->ifm.pad_bottom); + st->ifm.height[2] * dilation_y - + (st->ifm.pad_top + st->ifm.pad_bottom); s32 ifm_width =3D st->ofm.width * stride_x + - st->ifm.width - (st->ifm.pad_left + st->ifm.pad_right); + st->ifm.width * dilation_x - + (st->ifm.pad_left + st->ifm.pad_right); =20 if (ifm_height < 0 || ifm_width < 0) return -EINVAL; --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4C7DE33A9FE for ; Sat, 5 Sep 2026 00:44:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569042; cv=none; b=rNhMWWXIgBHSffFt46uOG968yCoqrwVgcA/x0H0E19rDsp7yMbeotbmGup8RIeAWgw9q7IKlt23uKr6m4o7Ct9ZM+5T56ySjIvucHQOsyO7M6Y3QEMrgx6vN67hesVrPPaNN2cTjgPf0DgyovTHIzOFqzcp5trfPgGvPD4oQZPc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569042; c=relaxed/simple; bh=xChb89vz/qBYregUzx55WlBOoufurQmbpfWCFi4X+1o=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=MyYtFrjJRlQRX8eEvPDiXxOQQkuFYWuit3JGlmYDhH5v9EJxM1ELT3NQJITeeSkfmYIMWS4H013HrRUFdLT/mt1cE30/u7CKatzkvHHVDehUiTlUPWIF8c+naErQuU6M8A0Sh4j8K4cAp5cRfzXGeIaXvi0LzC6toLjodI4db94= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RwXBsjHe; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RwXBsjHe" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF2781F00A3F; Sat, 5 Sep 2026 00:44:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569041; bh=lGRAZN7XzFjvdOfVtkdB4GMBqVoTe1hIoxzfxau7AAI=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=RwXBsjHeB7NLnUM/qP6g+dmpEZWQRRaBQfZXlWXbUWGnt6Suwzqx4r/T5uM34o5fK jEIYaWGvD1VpytCy0YMap1zfGRQsAaQKDBBbcd+6cc1Joh8/22XwxBycEb/1r2ZbE3 zc/04KWuUSj3wO0y/6koUrXe7RpEKWgowxLCox41a6vd4INl7uSZdpzic+T3TqHgIP FryaJYtW88nEPTP9c/uuOll23g2yx3VvTpnLtW6QOyUamPierqt/LYTGL4qyktRKz7 ViJUzRwEq5UcOnYURxS2/3/bLefv2SvpbcyVP0GlartkBmHNqLix068UxjR+SQLMn3 ZtzH7JHqkwgWw== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:33 -0500 Subject: [PATCH v2 14/19] accel: ethosu: Reject reserved command encodings Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-14-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The command stream contains a 10-bit opcode and a two-bit command control field. Reject reserved opcode and control encodings in the switch default case so they cannot be interpreted differently by the validator and hardware. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_device.h | 3 +++ drivers/accel/ethosu/ethosu_gem.c | 12 +++++++----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index 8e23fdbf7f8a..68e2969b6f79 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -91,6 +91,9 @@ struct gen_pool; #define NPU_KERNEL_DILATION_X BIT(3) #define NPU_KERNEL_DILATION_Y BIT(4) =20 +#define NPU_CMD_CTRL_CMD1 BIT(14) +#define NPU_CMD_RESERVED_MASK (BIT(15) | GENMASK(13, 10)) + enum ethosu_cmds { NPU_OP_STOP =3D 0x0, NPU_OP_IRQ =3D 0x1, diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 63dd07791f31..d5c3a2c530dc 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -160,9 +160,9 @@ static void cmd_state_init(struct cmd_state *st) =20 static void cmd_state_set_reg(struct cmd_state *st, u16 cmd) { - u16 reg =3D cmd & ~BIT(14); + u16 reg =3D cmd & ~NPU_CMD_CTRL_CMD1; =20 - if (cmd & BIT(14)) { + if (cmd & NPU_CMD_CTRL_CMD1) { if (reg < NPU_CMD1_REGS) __set_bit(reg, st->cmd1); } else if (reg < NPU_CMD0_REGS) { @@ -172,9 +172,9 @@ static void cmd_state_set_reg(struct cmd_state *st, u16= cmd) =20 static bool cmd_state_reg_is_set(struct cmd_state *st, u16 cmd) { - u16 reg =3D cmd & ~BIT(14); + u16 reg =3D cmd & ~NPU_CMD_CTRL_CMD1; =20 - if (cmd & BIT(14)) + if (cmd & NPU_CMD_CTRL_CMD1) return reg < NPU_CMD1_REGS && test_bit(reg, st->cmd1); =20 return reg < NPU_CMD0_REGS && test_bit(reg, st->cmd0); @@ -702,7 +702,7 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, cmd =3D cmds[0]; param =3D cmds[0] >> 16; =20 - if (cmd & 0x4000) { + if (cmd & NPU_CMD_CTRL_CMD1) { if (get_user(cmds[1], ucmds++)) return -EFAULT; =20 @@ -1023,6 +1023,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, st.dma.src.len =3D st.dma.dst.len =3D addr; break; default: + if (cmd & NPU_CMD_RESERVED_MASK) + return -EINVAL; break; } } --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EE4043403F2 for ; Sat, 5 Sep 2026 00:44:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569044; cv=none; b=UF2FXaV0FucHwAPF75UTAdo9xsPJFdYAktDRsZym619u+R6IsjO+JqySohZra5y6+KL2hIcUI3nGa/G+wIpaWn6TZeAf/2tqLCfoqNIrRylPw52LTUBrYedVHkbeS+ng1w8rlyvzGOIWhO8gUoQPqslzQci9iiQOGIz41Tc0Kz0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569044; c=relaxed/simple; bh=391EmbYMLzYHWIt3dmG7s0TzDkExk1eqEf/OgOKgo6Y=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=D3co+bEwISCOrgQe3mbp1JE7AJfyolehw8UquCiscriouaL5Rmz6YgbxoBgjbr6cUpxrLZmKD2xHrEMLkLD81qaGXwFIfSDaQgjbTFMUXzzcTLEufy+JTChXJGNzuCPV2iwb+137+1CJ8z87icyH38XmqbI+MB6SEQm0Kx1gz4o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=cUkf/Ru5; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="cUkf/Ru5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3930C1F00A3D; Sat, 5 Sep 2026 00:44:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569042; bh=XF9OA4b6VIaFYhiwlBjDAlKanfkpMhSK31WBha0eHKs=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=cUkf/Ru5Uw3zFPHsLG6FDzUn3SUweRX+4uiUNiLO9bKPqqG2vVLgtuy7c3eKaHduf 9y3CJRCvJH+zz64Gxhxg7MFbCUG7l2C58Y64NU3yTbie0APrwBW18NE+9ERk5bUOlN 5VQOUM5oTnu/xY8dZWeD5muXhN7mr2RJgYqfB+AjLUdWFu5ilXdhNzDEHHL5OcY/T6 hlbz0Oy1IFJSGyPeyQLk+kxscIxt3SIa3tzx+YXu9U/edaLtL2vcJMQIdk10Fw9SHe IYs5aSyXZrVoLDXBRh+J/Hg4v0RUOukmgH1ShjKHnf4af9JxdnrS8Ts+PywrG4eua6 9W8y7GRr9Jq5g== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:34 -0500 Subject: [PATCH v2 15/19] accel: ethosu: Validate accumulator input Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-15-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The U85 ACC_FORMAT command can select IFM2 as the accumulator input. This is used by null-pool operations and can also be used by convolution. Track this selection and validate the IFM2 feature map against the OFM extent before submitting the operation. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_device.h | 4 ++++ drivers/accel/ethosu/ethosu_gem.c | 42 ++++++++++++++++++++++++++++++++= ++++ 2 files changed, 46 insertions(+) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index 68e2969b6f79..6b9d093d73e6 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -126,6 +126,7 @@ enum ethosu_cmds { NPU_SET_KERNEL_WIDTH_M1 =3D 0x120, NPU_SET_KERNEL_HEIGHT_M1 =3D 0x121, NPU_SET_KERNEL_STRIDE =3D 0x122, + NPU_SET_ACC_FORMAT =3D 0x124, NPU_SET_WEIGHT_REGION =3D 0x128, NPU_SET_SCALE_REGION =3D 0x129, NPU_SET_DMA0_SRC_REGION =3D 0x130, @@ -180,6 +181,9 @@ enum ethosu_cmds { NPU_SET_WEIGHT3_LENGTH =3D 0x4095, }; =20 +#define NPU_ACC_FORMAT_INPUT_MASK GENMASK(5, 4) +#define NPU_ACC_INPUT_IFM2 2 + #define ETHOSU_SRAM_REGION 2 /* Matching Vela compiler */ =20 struct ethosu_perfmon; diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index d5c3a2c530dc..05a3cc04e7d1 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -145,6 +145,7 @@ struct feat_matrix { struct cmd_state { DECLARE_BITMAP(cmd0, NPU_CMD0_REGS); DECLARE_BITMAP(cmd1, NPU_CMD1_REGS); + bool acc_input_ifm2; struct dma_state dma; struct buffer scale[2]; struct buffer weight[4]; @@ -491,6 +492,32 @@ static int feat_matrix_size(struct ethosu_device *edev, max_len); } =20 +static int +calc_acc_input_size(struct drm_device *ddev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st) +{ + struct ethosu_device *edev =3D to_ethosu_device(ddev); + u64 len; + int ret; + + if (!ethosu_is_u65(edev) && + !cmd_state_reg_is_set(st, NPU_SET_ACC_FORMAT)) + return -EINVAL; + + if (!st->acc_input_ifm2) + return 0; + + /* The accumulator has one input value for each OFM element. */ + ret =3D feat_matrix_size(edev, info, st, &st->ifm2, + FEAT_MATRIX_IFM2, st->ofm.width, + st->ofm.height[2], st->ofm.depth, false, &len); + dev_dbg(ddev->dev, "ACC IFM2:%d:0x%llx-0x%llx\n", + st->ifm2.region, st->ifm2.base[0], len); + + return ret; +} + static int buffer_size(struct ethosu_validated_cmdstream_info *info, struct cmd_state *st, struct buffer *buf, s8 region, u16 region_cmd, u16 base_cmd, u16 length_cmd, bool optional) @@ -612,6 +639,9 @@ static int calc_sizes(struct drm_device *ddev, true, &len); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); + if (ret) + return ret; + ret =3D calc_acc_input_size(ddev, info, st); if (ret) return ret; if (!feat_matrix_chained(edev, &st->ofm)) @@ -661,6 +691,9 @@ static int calc_sizes_elemwise(struct drm_device *ddev, true, &len); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); + if (ret) + return ret; + ret =3D calc_acc_input_size(ddev, info, st); if (ret) return ret; if (!feat_matrix_chained(edev, &st->ofm)) @@ -799,6 +832,15 @@ static int ethosu_gem_cmdstream_copy_and_validate(stru= ct drm_device *ddev, case NPU_SET_KERNEL_STRIDE: st.ifm.stride_kernel =3D param; break; + case NPU_SET_ACC_FORMAT: + if (!ethosu_is_u65(edev)) { + u32 acc_input =3D FIELD_GET(NPU_ACC_FORMAT_INPUT_MASK, param); + + if (acc_input > NPU_ACC_INPUT_IFM2) + return -EINVAL; + st.acc_input_ifm2 =3D acc_input =3D=3D NPU_ACC_INPUT_IFM2; + } + break; case NPU_SET_IFM_PAD_TOP: st.ifm.pad_top =3D param & 0x7f; break; --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EF38A3451D6 for ; Sat, 5 Sep 2026 00:44:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569045; cv=none; b=Kd5vYzSuWzgq62a/Uo6FK4wgNXuSaabigL6byUZUdIyuQEW6Td7s9jeYhBiWtpbIom+ijWvSM9CvY8lZPD+4W5gpV0DX62IQ9H7E42mWLcE4GE0bddsteSmSv2w1UommBrF5asF8O+H85XRLitNPbOLU4xYwSYM8ZmijYydhTV8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569045; c=relaxed/simple; bh=QDQ0NL3+zctS64M7k6f9fBZIcnsouwmDw0W1hZ4A8SY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=QzZJ9BCnWDWpmASrztHkZzxyGPeD9zQRmYL7W8Kn2Yfj9FCVgx7zWK6p1sEnNMfdC6sz1d8KPed9TfllTmuPWav2XwYAJIEIj3C/WlaO/AgWW3ZPVWYvFMYiJ1rVhANIEHhhWeSJ46PWbBI/dAlbfLuS1IKWzAqCtLNIZOPBfys= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gj2nwlVy; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gj2nwlVy" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 957A41F00A3E; Sat, 5 Sep 2026 00:44:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569043; bh=vbv8ezbF5P8e6EPBX5kWUWidqzFn8VsPYDI73nvDt34=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=gj2nwlVy70ETjO5lt+4c/5AS2VdN0D1Ilvuzud/eA10subPA07B9jzGNORRTU5U76 bEbgcLllnSBSyrhR0bfV7vOtvGZ87WgAYjCMpkWBZb76KSs/VeS8E0gnfR7qKEAzZy yn9nhKXnzZV29/wLW71mvZ1QwTgaNWvbFQB8hvmSghR5InIUgm7ejRJqUqwIk9E4aX htKDFCTDg8gFd1elKT692ufiSICvSPymyaI6RH2Yzg94j81wM3986xBaPrBTs7vvrW wCfHS6rxq3JjFR7iXmbtIWMmIyYFasUxNO4/FCxnwZr6yDVOSlSzOsHUMrqbiCzYtn s4apSYk26b5qg== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:35 -0500 Subject: [PATCH v2 16/19] accel: ethosu: Restrict dynamic IFM2 weights Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-16-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The validator bounds dynamic IFM2 weights as a 1x1 weight matrix, but did not enforce the corresponding kernel shape. A larger crafted kernel could make the NPU access beyond the validated IFM2 feature map. Reject dynamic-weight convolutions whose kernel is not 1x1. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_gem.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 05a3cc04e7d1..c3dad3f80c34 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -559,6 +559,9 @@ static int calc_sizes(struct drm_device *ddev, !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_RIGHT) || !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_BOTTOM)) return -EINVAL; + /* Dynamic IFM2 weights are only supported for 1x1 convolutions. */ + if (ifm2 && (st->ifm.width || st->ifm.height[2])) + return -EINVAL; u32 stride_y =3D ((st->ifm.stride_kernel >> 8) & 0x2) + ((st->ifm.stride_kernel >> 1) & 0x1) + 1; u32 stride_x =3D ((st->ifm.stride_kernel >> 5) & 0x2) + --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E035346E7D for ; Sat, 5 Sep 2026 00:44:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569046; cv=none; b=VPen3bRqi3FRpX8XM7qY51RKUBXKXjudSIeWkTWda163RfiglK57wVi4fAC6lOWdbri7PRT24nkFZGxGaIi/lxDtF9hy+W7hX5ckhdPrUEY0iy7y005ok9y1K+btZtzkPSbXD0PFm7loxT7oT0RH4/L1EG22xypz3jPOaSQ59gc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569046; c=relaxed/simple; bh=LeatAYDUtWP8EvUf0chp6YUHa7+7uwCncDxxgCseTUk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=u/BAWl5xcZvNZ/UYtGaDaKY/ee2RHaGnUGBkvN/hUMPHlUGkDG/Dk8saHcf6yoX6ctlb0/rvNcT2yyQ+q46XMbYdNVQfyZ/KaWShVvbgQhQQShlERgOKpmyVguEWM1RWBCFvIPm2pxcZcmy0jOTeNkV9fj9hYJLUrGdYmWdOYBU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=oo9dt2Mz; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="oo9dt2Mz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E2F6F1F00A3D; Sat, 5 Sep 2026 00:44:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569045; bh=Abb/qsORp6PxsrW1QG8TXfIjYHfZPcn8pVpMjsyREHc=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=oo9dt2MzEwkMRfVnymr7GW1Vm6d5h43plGtBMRkdM5E5Fqo/sozyAQfOViKZ3FgnE HJbEho6wPoE/J3codzMTUcb2LyWX2tKH9HngCch5HXnS25Jov3FGW2OPij90EdJrmX X2FzbdIr1r9apRgphgyAi/iwi/7ta+OLvVI5Len99u8954HZuu8mI/dNGfDvk7piGG fz6/gaJjz3o3emkqcFm1rLgG4yq2T9jwp/Wv+J4bV6/rDM20m8YaMPgHGejGhLbMUW /uzW/JP6ENHruE3DI4j+wja7BZDoldqlbiYRvEn9AoL7gl1YGiQZLszgLbwOKaEonY zJEFCQ1o+df5A== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:36 -0500 Subject: [PATCH v2 17/19] accel: ethosu: Split U65 and U85 DMA length validation Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-17-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Ethos-U65 and Ethos-U85 have slightly different DMA programming models. The U65 has skip values added on to the size whereas U85 has signed stride values. The U65 shares the skip values for source and destination whereas the U85 has independent settings for source and destination. The current validation only correctly handles U65 constraints. Split the shared DMA length calculation into U65 and U85 specific versions. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_gem.c | 110 ++++++++++++++++++++++++++++++----= ---- 1 file changed, 87 insertions(+), 23 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index c3dad3f80c34..559fbf55f12d 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -225,40 +225,92 @@ static bool dma_params_valid(struct ethosu_device *ed= ev, struct cmd_state *st, return true; } =20 -static u64 dma_length(struct ethosu_device *edev, - struct ethosu_validated_cmdstream_info *info, - struct cmd_state *st, struct dma_state *dma_st, - struct dma *dma, u16 region_cmd, u16 addr_cmd) +static u64 dma_length_finish(struct ethosu_validated_cmdstream_info *info, + const struct dma *dma, u64 len) +{ + if (dma->region >=3D 0) { + u64 end; + + if (check_add_overflow(len, dma->offset, &end)) + return U64_MAX; + info->region_size[dma->region] =3D + max(info->region_size[dma->region], end); + } + + return len; +} + +static u64 dma_length_u65(struct ethosu_validated_cmdstream_info *info, + struct dma_state *dma_st, + struct dma *dma) { s8 mode =3D dma->mode; u64 len =3D dma->len; =20 - if (!dma_params_valid(edev, st, dma_st, dma, region_cmd, addr_cmd)) - return U64_MAX; + if (mode >=3D 1) { + if (check_add_overflow(len, (u64)dma->stride[0], &len) || + check_mul_overflow(len, (u64)dma_st->size0, &len)) + return U64_MAX; + } + if (mode =3D=3D 2) { + if (check_add_overflow(len, (u64)dma->stride[1], &len) || + check_mul_overflow(len, (u64)dma_st->size1, &len)) + return U64_MAX; + } + + return dma_length_finish(info, dma, len); +} + +static u64 dma_length_u85(struct ethosu_validated_cmdstream_info *info, + struct dma_state *dma_st, + struct dma *dma) +{ + s8 mode =3D dma->mode; + s64 min =3D 0; + u64 max =3D dma->len; + s64 stride; =20 if (mode >=3D 1) { - if (dma->stride[0] < 0 && (u64)(-dma->stride[0]) > len) + if (check_mul_overflow(dma->stride[0], + (s64)dma_st->size0, &stride)) return U64_MAX; - len +=3D dma->stride[0]; - if (check_mul_overflow(len, (u64)dma_st->size0, &len)) + if (stride < 0) { + if (check_add_overflow(min, stride, &min)) + return U64_MAX; + } else if (check_add_overflow(max, (u64)stride, &max)) { return U64_MAX; + } } if (mode =3D=3D 2) { - if (dma->stride[1] < 0 && (u64)(-dma->stride[1]) > len) + if (check_mul_overflow(dma->stride[1], + (s64)dma_st->size1, &stride)) return U64_MAX; - len +=3D dma->stride[1]; - if (check_mul_overflow(len, (u64)dma_st->size1, &len)) + if (stride < 0) { + if (check_add_overflow(min, stride, &min)) + return U64_MAX; + } else if (check_add_overflow(max, (u64)stride, &max)) { return U64_MAX; + } } - if (dma->region >=3D 0) { - u64 end; =20 - if (check_add_overflow(len, dma->offset, &end)) - return U64_MAX; - info->region_size[dma->region] =3D max(info->region_size[dma->region], e= nd); - } + if (min < 0 && -(u64)min > dma->offset) + return U64_MAX; =20 - return len; + return dma_length_finish(info, dma, max); +} + +static u64 dma_length(struct ethosu_device *edev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st, struct dma_state *dma_st, + struct dma *dma, u16 region_cmd, u16 addr_cmd) +{ + if (!dma_params_valid(edev, st, dma_st, dma, region_cmd, addr_cmd)) + return U64_MAX; + + if (ethosu_is_u65(edev)) + return dma_length_u65(info, dma_st, dma); + + return dma_length_u85(info, dma_st, dma); } =20 static bool feat_matrix_chained(struct ethosu_device *edev, struct feat_ma= trix *fm) @@ -1047,16 +1099,28 @@ static int ethosu_gem_cmdstream_copy_and_validate(s= truct drm_device *ddev, st.dma.size1 =3D param; break; case NPU_SET_DMA0_SRC_STRIDE0: - st.dma.src.stride[0] =3D ((s64)addr << 24) >> 24; + if (ethosu_is_u65(edev)) + st.dma.dst.stride[0] =3D addr; + else + st.dma.src.stride[0] =3D sign_extend64(addr, 39); break; case NPU_SET_DMA0_SRC_STRIDE1: - st.dma.src.stride[1] =3D ((s64)addr << 24) >> 24; + if (ethosu_is_u65(edev)) + st.dma.dst.stride[1] =3D addr; + else + st.dma.src.stride[1] =3D sign_extend64(addr, 39); break; case NPU_SET_DMA0_DST_STRIDE0: - st.dma.dst.stride[0] =3D ((s64)addr << 24) >> 24; + if (!ethosu_is_u65(edev)) + st.dma.dst.stride[0] =3D sign_extend64(addr, 39); + else + return -EINVAL; break; case NPU_SET_DMA0_DST_STRIDE1: - st.dma.dst.stride[1] =3D ((s64)addr << 24) >> 24; + if (!ethosu_is_u65(edev)) + st.dma.dst.stride[1] =3D sign_extend64(addr, 39); + else + return -EINVAL; break; case NPU_SET_DMA0_SRC: st.dma.src.offset =3D addr; --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ACC9230D3E0 for ; Sat, 5 Sep 2026 00:44:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569047; cv=none; b=MLfp258x9B2qTPYRcGcdKP77BklSTj6cyumEn2LvbTkYUnrQoKdt21rLvLOizfY+bzjKno7yG587MfZ6YiUSyWlwHOSY2top2iwNG3FjhamjEdgVydIGOthxuhGU67/35WYtvWDul6tMURQFmx09HMbjnc5qbN0EDSiGEsUtzxw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569047; c=relaxed/simple; bh=YYEOhKlNIHdImXKG0A7oAqruF/Epu7xoXpsyERq/Uqo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=uVQQPkwa8fYlqvIDDZ5gg07Rjce0NWg3qK6NPM3pcQosd/9YET7YGNZsLOhMaSStK8nVgptemcI9vBSUFMc7RaXszecwQCUB91TLxgnBE3w0VAtIgFzgK9Jc068eZ6a/b971Kmy4MxMNJKsWD7tBmvAQKfFVGGNVQKVJJl7Llww= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KI3O7Yy8; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KI3O7Yy8" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5331C1F00A3F; Sat, 5 Sep 2026 00:44:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569046; bh=6K/PGkKcyOcx60p1c41wNeoY8KbyAykmrBz/08CNwuk=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=KI3O7Yy8zrylgobBpb/q6nTQXPuabNRtQpPoyTstYB3pUbsGf6MmZrjKvG7khYV/y YLSqObvA/CJweGs083LdHwWB7BbIQyGcrTs1DtpfvhuPxF7YdZVvkVB2gddZJqdp6T D6U9PfGdqPeHfcyTQflCpKsDbBPPS7K+4NfsgjSrO6wqIUdmfUxhHJSOTZq2o0YkMN pzDc1jirSWeOCxadzu3aqWQzq+vG95C3gGLXjyYRFI2J+AcRp4caNL+2/mTkyk2hMT blM4Xle5ZuSFSu8nye1E6mGbfImq2CcCC1r03B3x2QmEJWruQweorGORmIeFdlUtnK MSdcHNRe+/Fbg== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:37 -0500 Subject: [PATCH v2 18/19] accel: ethosu: Validate OFM transpose Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-18-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev U85 OFM dimensions are specified before transposition, while tile bases and strides address the transposed feature map. Permute the output endpoint before validating its tile and stride accesses. Allow the defined U85 transpose encodings and reject the two reserved encodings. Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - no change --- drivers/accel/ethosu/ethosu_device.h | 1 + drivers/accel/ethosu/ethosu_gem.c | 58 ++++++++++++++++++++++++++++++++= ++-- 2 files changed, 57 insertions(+), 2 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index 6b9d093d73e6..3f1fa0a36bd9 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -90,6 +90,7 @@ struct gen_pool; #define NPU_OP_CONV_WEIGHTS_IFM2 BIT(0) #define NPU_KERNEL_DILATION_X BIT(3) #define NPU_KERNEL_DILATION_Y BIT(4) +#define NPU_OFM_TRANSPOSE_MASK GENMASK(13, 11) =20 #define NPU_CMD_CTRL_CMD1 BIT(14) #define NPU_CMD_RESERVED_MASK (BIT(15) | GENMASK(13, 10)) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 559fbf55f12d..8114447891b2 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -397,6 +397,52 @@ static int feat_matrix_validate(struct ethosu_device *= edev, =20 return 0; } + +static int feat_matrix_permute(struct ethosu_device *edev, + struct feat_matrix *fm, u32 *x, u32 *y, + u32 *c, bool ofm) +{ + u32 width =3D *x; + u32 height =3D *y; + u32 depth =3D *c; + u32 transpose; + + if (ethosu_is_u65(edev) || !ofm) + return 0; + + transpose =3D FIELD_GET(NPU_OFM_TRANSPOSE_MASK, fm->precision); + + switch (transpose) { + case 0: /* HWC */ + break; + case 1: /* WHC */ + *x =3D height; + *y =3D width; + break; + case 2: /* HCW */ + *x =3D depth; + *c =3D width; + break; + case 3: /* WCH */ + *x =3D depth; + *y =3D width; + *c =3D height; + break; + case 6: /* CHW */ + *x =3D height; + *y =3D depth; + *c =3D width; + break; + case 7: /* CWH */ + *y =3D depth; + *c =3D height; + break; + default: + return -EINVAL; + } + + return 0; +} static u64 feat_matrix_length(struct ethosu_device *edev, struct ethosu_validated_cmdstream_info *info, struct cmd_state *st, struct feat_matrix *fm, @@ -502,6 +548,9 @@ static int feat_matrix_size(struct ethosu_device *edev, int ret; =20 *max_len =3D 0; + ret =3D feat_matrix_permute(edev, fm, &x, &y, &c, ofm); + if (ret) + return ret; =20 if (ethosu_is_u65(edev) || storage =3D=3D 0) { for (int xi =3D 0; xi < 2; xi++) { @@ -959,8 +1008,13 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, case NPU_SET_OFM_PRECISION: if (((param >> 6) & 0x3) > 1) return -EINVAL; - if (!ethosu_is_u65(edev) && (param & GENMASK(13, 11))) - return -EINVAL; + if (!ethosu_is_u65(edev)) { + switch (FIELD_GET(NPU_OFM_TRANSPOSE_MASK, param)) { + case 4: + case 5: + return -EINVAL; + } + } st.ofm.precision =3D param; break; case NPU_SET_OFM_REGION: --=20 2.53.0 From nobody Sat Sep 26 03:51:32 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1A3D03451D6 for ; Sat, 5 Sep 2026 00:44:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569049; cv=none; b=LXCEu6SzsbrH/PvKohEDdQwA3C6+AdGI7dltDRSVnAI2h/u+KrxZ2OkGvVDNol+BRP5b858qjrvVWDKQwk4NGVrFWJc2+Ln6DVaaBbHqdvRzPd5s4SBmGHBZ+hTlNHzDmg8S6gVu2+xu0SDRk9+fZ6M+JSf5VExatpz33T1ekHE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788569049; c=relaxed/simple; bh=7FvF0LsOOP/A5Gws/keC9jZqZEEc9tsbJ+BDq1qMj1c=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=n6T7ktToFx0CPVTyl+TBWmjGY9L3oTcJArxSxRbK5+Kq4EUzadjPArHLfiUewb8yYokFYpZX1TX1vGCgyOJFIDaKys4QLQe2EYPD1zvZa0R4HLS8xkdJ+cyKyq9+P0l2t3pcaI3fIAG/TnQw2l0er9LqEKnm2KJj/gPmnWPyqm0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=VBNKzIZL; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="VBNKzIZL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA7841F00A3D; Sat, 5 Sep 2026 00:44:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788569048; bh=gOf3VSIqxOmbHAVcGO5wfYGM1fC17JtOjg45s12VHI4=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=VBNKzIZLPp7+BITYZiWqTi2Sm58BKIc24t9M+9IclKApTLc4mbeqxOpe/00OjNfDA dzctUb8s9bukc+8oVNeNHeh32X7G7erhNvRlMuBJ2fwTZGJFQ8ao/K/JOOqVFnkBfv JrQG9xhh4Nm/174uGYa963rHbZURqNFCLj4nH1UzU0JAp+E9JmDMxBpDJZywgYyRPN 6c9DjLjFav74BH0X5ZW77qnwgnpoS5YC/dFIj8kNxerLherTYj7GFZ0Y/2And/4pBq /XfTipk5qXJhFJYSM7+TsQaDy5fGgHW4USC4Dc+Z0spjHlosXsi5gQObSqz2QsABV0 ntenCPiXg5OFQ== From: "Rob Herring (Arm)" Date: Fri, 04 Sep 2026 19:43:38 -0500 Subject: [PATCH v2 19/19] accel: ethosu: Validate resize operations Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260904-ethosu-fixes-v2-19-3767738756a4@kernel.org> References: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Resize input coordinates are controlled by the scale, offset, and step registers. Require those values to be explicitly programmed, validate the scale and step relationships, and use a conservative coordinate bound when validating the input feature map. This prevents retained or malformed resize state from accessing beyond the validated input feature-map buffer. Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_device.h | 8 ++ drivers/accel/ethosu/ethosu_gem.c | 159 +++++++++++++++++++++++++++++++= +++- 2 files changed, 166 insertions(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index 3f1fa0a36bd9..2974173bbc40 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -120,6 +120,8 @@ enum ethosu_cmds { NPU_SET_OFM_HEIGHT_M1 =3D 0x112, NPU_SET_OFM_DEPTH_M1 =3D 0x113, NPU_SET_OFM_PRECISION =3D 0x114, + NPU_SET_OFM_BLK_WIDTH_M1 =3D 0x115, + NPU_SET_OFM_BLK_HEIGHT_M1 =3D 0x116, NPU_SET_OFM_WIDTH0_M1 =3D 0x11a, NPU_SET_OFM_HEIGHT0_M1 =3D 0x11b, NPU_SET_OFM_HEIGHT1_M1 =3D 0x11c, @@ -130,6 +132,10 @@ enum ethosu_cmds { NPU_SET_ACC_FORMAT =3D 0x124, NPU_SET_WEIGHT_REGION =3D 0x128, NPU_SET_SCALE_REGION =3D 0x129, + NPU_SET_RESIZE_X_SCALE_N_M1 =3D 0x12a, + NPU_SET_RESIZE_Y_SCALE_N_M1 =3D 0x12b, + NPU_SET_RESIZE_X_OFFSET =3D 0x12c, + NPU_SET_RESIZE_Y_OFFSET =3D 0x12d, NPU_SET_DMA0_SRC_REGION =3D 0x130, NPU_SET_DMA0_DST_REGION =3D 0x131, NPU_SET_DMA0_SIZE0 =3D 0x132, @@ -180,6 +186,8 @@ enum ethosu_cmds { NPU_SET_WEIGHT2_LENGTH =3D 0x4093, NPU_SET_WEIGHT3_BASE =3D 0x4094, NPU_SET_WEIGHT3_LENGTH =3D 0x4095, + NPU_SET_RESIZE_X =3D 0x4096, + NPU_SET_RESIZE_Y =3D 0x4097, }; =20 #define NPU_ACC_FORMAT_INPUT_MASK GENMASK(5, 4) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 8114447891b2..67bee9612934 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -139,6 +139,15 @@ struct feat_matrix { u8 pad_right; }; =20 +struct resize_axis { + u16 scale_n; + s16 offset; + u16 one_step_int; + u16 one_step_mod; + u16 blk_step_int; + u16 blk_step_mod; +}; + #define NPU_CMD0_REGS 0x200 #define NPU_CMD1_REGS 0x100 =20 @@ -152,6 +161,9 @@ struct cmd_state { struct feat_matrix ofm; struct feat_matrix ifm; struct feat_matrix ifm2; + u16 ofm_blk_width; + u16 ofm_blk_height; + struct resize_axis resize[2]; }; =20 static void cmd_state_init(struct cmd_state *st) @@ -619,6 +631,96 @@ calc_acc_input_size(struct drm_device *ddev, return ret; } =20 +static int resize_axis_size(struct cmd_state *st, int axis, u16 ofm_size, + u16 ofm_blk_size, u32 *size) +{ + struct resize_axis *resize =3D &st->resize[axis]; + u64 one_step, blk_step, coord; + + if (resize->offset < -(s16)resize->scale_n || + resize->offset >=3D resize->scale_n || + resize->one_step_mod >=3D resize->scale_n || + resize->blk_step_mod >=3D resize->scale_n) + return -EINVAL; + + one_step =3D resize->one_step_int * resize->scale_n + + resize->one_step_mod; + blk_step =3D resize->blk_step_int * resize->scale_n + + resize->blk_step_mod; + if (check_mul_overflow((u64)ofm_blk_size, one_step, &coord) || + blk_step !=3D coord) + return -EINVAL; + + if (check_mul_overflow((u64)ofm_size, one_step, &coord) || + check_add_overflow(coord, (u64)resize->scale_n - 1, &coord)) + return -EINVAL; + + coord =3D div_u64(coord, resize->scale_n); + if (coord >=3D U32_MAX) + return -EINVAL; + + *size =3D coord + 1; + return 0; +} + + +static int calc_sizes_resize(struct drm_device *ddev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st) +{ + struct ethosu_device *edev =3D to_ethosu_device(ddev); + u32 ifm_width, ifm_height; + u64 len; + int ret; + + if (!cmd_state_reg_is_set(st, NPU_SET_KERNEL_WIDTH_M1) || + !cmd_state_reg_is_set(st, NPU_SET_KERNEL_HEIGHT_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_BLK_WIDTH_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_BLK_HEIGHT_M1) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_X_SCALE_N_M1) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_Y_SCALE_N_M1) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_X_OFFSET) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_Y_OFFSET) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_X) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_Y)) + return -EINVAL; + + ret =3D resize_axis_size(st, 0, st->ofm.width, st->ofm_blk_width, + &ifm_width); + if (ret) + return ret; + ret =3D resize_axis_size(st, 1, st->ofm.height[2], st->ofm_blk_height, + &ifm_height); + if (ret) + return ret; + + ret =3D feat_matrix_size(edev, info, st, &st->ifm, FEAT_MATRIX_IFM, + max(ifm_width, (u32)st->ifm.width), + max(ifm_height, (u32)st->ifm.height[2]), st->ifm.depth, + false, &len); + dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", NPU_OP_RESIZE, + st->ifm.region, st->ifm.base[0], len); + if (ret) + return ret; + + ret =3D feat_matrix_size(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, + st->ofm.width, st->ofm.height[2], st->ofm.depth, + true, &len); + dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", NPU_OP_RESIZE, + st->ofm.region, st->ofm.base[0], len); + if (ret) + return ret; + + ret =3D calc_acc_input_size(ddev, info, st); + if (ret) + return ret; + + if (!feat_matrix_chained(edev, &st->ofm)) + info->output_region[st->ofm.region] =3D true; + + return 0; +} + static int buffer_size(struct ethosu_validated_cmdstream_info *info, struct cmd_state *st, struct buffer *buf, s8 region, u16 region_cmd, u16 base_cmd, u16 length_cmd, bool optional) @@ -926,7 +1028,12 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, return ret; break; case NPU_OP_RESIZE: // U85 only - return -EINVAL; + if (ethosu_is_u65(edev) || param > 2) + return -EINVAL; + ret =3D calc_sizes_resize(ddev, info, &st); + if (ret) + return ret; + break; case NPU_SET_KERNEL_WIDTH_M1: st.ifm.width =3D param; break; @@ -1017,6 +1124,12 @@ static int ethosu_gem_cmdstream_copy_and_validate(st= ruct drm_device *ddev, } st.ofm.precision =3D param; break; + case NPU_SET_OFM_BLK_WIDTH_M1: + st.ofm_blk_width =3D param & 0x7f; + break; + case NPU_SET_OFM_BLK_HEIGHT_M1: + st.ofm_blk_height =3D param & 0x7f; + break; case NPU_SET_OFM_REGION: st.ofm.region =3D param & 0x7; break; @@ -1087,6 +1200,34 @@ static int ethosu_gem_cmdstream_copy_and_validate(st= ruct drm_device *ddev, case NPU_SET_SCALE_REGION: st.scale[0].region =3D param & 0x7; break; + case NPU_SET_RESIZE_X_SCALE_N_M1: + if (ethosu_is_u65(edev)) + break; + if (param & GENMASK(15, 11)) + return -EINVAL; + st.resize[0].scale_n =3D param + 1; + break; + case NPU_SET_RESIZE_Y_SCALE_N_M1: + if (ethosu_is_u65(edev)) + break; + if (param & GENMASK(15, 11)) + return -EINVAL; + st.resize[1].scale_n =3D param + 1; + break; + case NPU_SET_RESIZE_X_OFFSET: + if (ethosu_is_u65(edev)) + break; + if (param & GENMASK(15, 12)) + return -EINVAL; + st.resize[0].offset =3D sign_extend32(param, 11); + break; + case NPU_SET_RESIZE_Y_OFFSET: + if (ethosu_is_u65(edev)) + break; + if (param & GENMASK(15, 12)) + return -EINVAL; + st.resize[1].offset =3D sign_extend32(param, 11); + break; case NPU_SET_WEIGHT_BASE: st.weight[0].base =3D addr; break; @@ -1123,6 +1264,22 @@ static int ethosu_gem_cmdstream_copy_and_validate(st= ruct drm_device *ddev, case NPU_SET_WEIGHT3_LENGTH: st.weight[3].length =3D cmds[1]; break; + case NPU_SET_RESIZE_X: + case NPU_SET_RESIZE_Y: + if (ethosu_is_u65(edev)) + break; + if ((cmds[0] & BIT(31)) || + (cmds[1] & (GENMASK(31, 27) | GENMASK(15, 11)))) + return -EINVAL; + st.resize[cmd - NPU_SET_RESIZE_X].one_step_int =3D + FIELD_GET(GENMASK(19, 16), cmds[0]); + st.resize[cmd - NPU_SET_RESIZE_X].blk_step_int =3D + FIELD_GET(GENMASK(30, 20), cmds[0]); + st.resize[cmd - NPU_SET_RESIZE_X].one_step_mod =3D + FIELD_GET(GENMASK(10, 0), cmds[1]); + st.resize[cmd - NPU_SET_RESIZE_X].blk_step_mod =3D + FIELD_GET(GENMASK(26, 16), cmds[1]); + break; =20 case NPU_SET_DMA0_SRC_REGION: if (param & NPU_DMA_REGION_INDEX_MODE) --=20 2.53.0