From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D190256510D for ; Tue, 8 Sep 2026 22:04:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905095; cv=none; b=CMAfE5us20kL5JG462pKxfU0C5ASqPIg341xltIGWZPVc9wrmBdie3x/AN7zPWKWamLcDABXT+wk6JdcfDBMB5/ksUw9yVMDpzaBLQW+BPzg1c2ngWKxIbXfUSjh3zw8luR618TwBII5M/2WvP70Db7KHQkS2I3urbzlejpQEQk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905095; c=relaxed/simple; bh=+J7RZfgL5AzajAk1mEDu7gK55yvVTLK8+CL9C+Luh6g=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=FcN8YQk8Jyr/iBslPC2BuzmikLeUSM6SnzHuo8BqitGLgi1pqsVNO+49us2tOlgzPbeaalXjRBYSOpWH5SH83wbi7QsP8ka/OIM8vM4TjkMzuZI0l8YWv44e2kaCkI6bQBMUuFI9tI2/uEnYbbqJrtqYf1RfwDVFGRI4r3/N45s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Z9Sbuyd5; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Z9Sbuyd5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 20C351F00A3D; Tue, 8 Sep 2026 22:04:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905093; bh=ai8d/z/jR8St5LaF9248MzOc4BaNMXKIfXmoxvaaQR8=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Z9Sbuyd5soYPLUogOkXYWQxJ5DOum41oY9eGKtVprQupwojEkYtALmxRNx0Qi/U4g 6KgVZcsXAyM8EPITlGzTag0rMP+7QcI9J9Ox/0bgbpk+UH4fUjnTmTrmk28nfbnPf4 d9ui/wsKi9EMVvUq/CnFSgNqAehDCgXVlmUrUSwJMF1oB3oEtNT4aRgptqy5Xmp5J4 87NAxj5yh4nAhU6bwHFxU0YSIZY3294nBlLtJDwKMvL76SyPgg1TgB0Q8ZL1N5zkDy F3w47xTgIMxM5YA1X+MAMpcUV2aZoTgKkR42c//kqdFt1GlIm0X6pCv+BzO8uYGh14 F22Rqa6O8PFgQ== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:38 -0500 Subject: [PATCH v3 01/22] accel: ethosu: Suspend after initialization Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-1-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The initial runtime-PM reference is held only while initializing the NPU. Release it synchronously from ethosu_init() after the final hardware access, before registering the DRM device. This keeps the runtime-PM setup and initial reference handling together and leaves the autosuspend configuration in place for subsequent jobs. Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_drv.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index 8108622de258..df76253d01a6 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -338,6 +338,8 @@ static int ethosu_init(struct ethosu_device *ethosudev) ethosudev->npu_info.sram_size / 1024, ethosudev->npu_info.pmu_counters); =20 + pm_runtime_put_sync_suspend(ethosudev->base.dev); + return 0; } =20 @@ -376,10 +378,6 @@ static int ethosu_probe(struct platform_device *pdev) return ret; =20 ret =3D drm_dev_register(ðosudev->base, 0); - if (ret) - pm_runtime_dont_use_autosuspend(ethosudev->base.dev); - - pm_runtime_put_autosuspend(ethosudev->base.dev); return ret; } =20 --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 91595568FCE for ; Tue, 8 Sep 2026 22:04:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905095; cv=none; b=Um542fNvqphLhPNnEl9JjTrcKP2Hy8/YjFgASMOEfVdH8/2ClO/vQFaMMXtZwBPdGOlDtnqKnRo+CbTQEpbK/+UZ1q/STeoeW+9ZtWiHQj4ntCK3eKOV6crQn8e+fyg9Q+yuBCCYIxIaGOW3qQBtO75cX2FbFTm3yqf9t/xRHiE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905095; c=relaxed/simple; bh=f9n4aPiCpynxGQAg8kyfMGDEBPvJBrLNnhdyFudXwpI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=a9J6gf3gadoInUCxsY8rvl/0tPWTVNLJuxBvi9zQSYojCWSxic7fgrbEPiHcGltDUhAg75hYbF0ktRo/mUmHJErtWNcn10G7KOGYGX6S7XkRqYnSQvP6oOR2ZqhOP5JqdqCLgpQ/e4flaZN6Hnoq6eYnmOH2p2gLXC6z7ujKKFs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OakRzItU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OakRzItU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43F6A1F00A3A; Tue, 8 Sep 2026 22:04:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905094; bh=B++ChOOJS0KMKO8mbkmrvvELnBJLVRMq96OfPvDS7js=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=OakRzItUAnfI0vHAjR7TSUDbPjtXFsvWGVvzZirbPOPe1PzIwuzQPsKI3ubMlmxvK P6JarMzvZfttSVZadEPJAlKfspsLD0YuDqJbMKuTIVqGur0uETM3VTRh4jnPQDSVB5 KCik+MQNzuAvyxpBmQ6a1PIJxUdPZwlhoHbGjJchNEuaZ3utluA15HGHOw0a+vu/n+ eeEx5az6JEMQCy5Y7Tw/hrd1UaibxAsZkCc5/DO4DOxLK9IEGYq6/ieCEASfl8u70U sDrccrRqfX1+nXnn0DzeaYV270Lh9lPzcAREPnqn9aR28tTwRdSYgG5RDITEajYLsm WnIj5uYZq6EQA== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:39 -0500 Subject: [PATCH v3 02/22] accel: ethosu: Ensure suspended on removal Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-2-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, sashiko-bot@kernel.org X-Mailer: b4 0.16-dev If device removal occurs before an auto-suspend timeout occurs, the suspend is cancelled and the device will be left with clocks running. Make the remove() callback check this and force a suspend if the device is currently active. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Reported-by: sashiko-bot@kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v3: - New patch --- drivers/accel/ethosu/ethosu_drv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index df76253d01a6..1f6fb5d18cf2 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -387,6 +387,10 @@ static void ethosu_remove(struct platform_device *pdev) =20 drm_dev_unregister(ðosudev->base); ethosu_job_fini(ethosudev); + + if (pm_runtime_get_if_active(&pdev->dev)) + pm_runtime_put_sync_suspend(&pdev->dev); + if (ethosudev->sram) gen_pool_free(ethosudev->srampool, (unsigned long)ethosudev->sram, ethosudev->npu_info.sram_size); --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0964D56B87E for ; Tue, 8 Sep 2026 22:04:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905097; cv=none; b=KMSbNqMPIFT0MViQDINeBBEYbGhPPSzBcAohSOLXdKqgTJbwJA9tQA9b0pPfeIBVNW3+y7k1MuSgYmjdmd5sEMYaKHAcmpCJNiKgTJg90JTVKf/hXan7f9p4uemJ5TgJWaGIUQur9ljWI3CvuJuptyq7m38s951qgr/vr9bUSnE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905097; c=relaxed/simple; bh=7cDVW5k7uv+yCCX/FOtnQsCs0zUnRL+ulmsnKVge8Xk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=dFBfOYbJiXnVY0OEkyltri6cvLSTIaG91y0PZgr7P8/495G99lY9pKjQcOzC8m8JoXf7R+TbdJjyDke6VyjMBJS1/785y8i/8bEqK7LkKA+o8HZnhZAEBWW10FNxg0MMpoReLHvydcOLoe+QdPe1xpDvrFi5qpuxywZ250eBZDc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=QcIgNaHn; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="QcIgNaHn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7142F1F00A3D; Tue, 8 Sep 2026 22:04:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905095; bh=qwUK2PGPRP9N49QDc9653gAgUPcVpEE3+mhOYY7c0D4=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=QcIgNaHnvXKOcubmt/xp5UWcjJDPUO0ISoikgJFGKAmrV4uQS0Y4fM6WlljzC0NaB ls1zUlsZ4FmxDA94LbK0I+iwMckHWpPKXa2m3Jdm/KhR3t/EyFQCHSrKaGdPXem8Fu Uzv/8nW10Bmq0WTwZmYIUbm/OJhO07FbiNaJBPPyK3A3b4FOg3BWGIuHK0RUyWlKX2 n2Et8WmKsiBN0zMcewDD3on1T1H75orxWg4W21/jYV7vYPnkbAhK6cqlAhnvn6/npA /ZUVt9dEGGdOZb2P2TkpkW+BEJGRm9SzDVU4XNmqpCvAbvnM7MX34p5mkYX0O4KUhf HJLC2UptOXqbQ== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:40 -0500 Subject: [PATCH v3 03/22] accel: ethosu: Fix probe error cleanup Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-3-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Once the job scheduler has been initialized, failures from ethosu_init() or drm_dev_register() return from probe without tearing it down. The registration failure also leaves the SRAM-pool allocation in use, because the platform remove callback is not called after a failed probe. Unwind the initialized resources on both paths. Also do not call drm_sched_fini() after a failed drm_sched_init(): the scheduler initializer already unwinds its partial setup, while drm_sched_fini() requires a successfully initialized scheduler. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - Adjust for previous patch reworking runtime-PM suspend --- drivers/accel/ethosu/ethosu_drv.c | 13 ++++++++++++- drivers/accel/ethosu/ethosu_job.c | 6 +----- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index 1f6fb5d18cf2..2c8d735767b2 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -375,9 +375,20 @@ static int ethosu_probe(struct platform_device *pdev) =20 ret =3D ethosu_init(ethosudev); if (ret) - return ret; + goto err_job_fini; =20 ret =3D drm_dev_register(ðosudev->base, 0); + if (ret) + goto err_sram_free; + + return 0; + +err_sram_free: + if (ethosudev->sram) + gen_pool_free(ethosudev->srampool, (unsigned long)ethosudev->sram, + ethosudev->npu_info.sram_size); +err_job_fini: + ethosu_job_fini(ethosudev); return ret; } =20 diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethos= u_job.c index 8dce74db0cb4..ec65305e0cd7 100644 --- a/drivers/accel/ethosu/ethosu_job.c +++ b/drivers/accel/ethosu/ethosu_job.c @@ -355,14 +355,10 @@ int ethosu_job_init(struct ethosu_device *edev) ret =3D drm_sched_init(&edev->sched, &args); if (ret) { dev_err(dev, "Failed to create scheduler: %d\n", ret); - goto err_sched; + return ret; } =20 return 0; - -err_sched: - drm_sched_fini(&edev->sched); - return ret; } =20 void ethosu_job_fini(struct ethosu_device *dev) --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6435957ED9C for ; Tue, 8 Sep 2026 22:04:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905098; cv=none; b=jEOVNB96pL9ReMIl7mxahdTo9yrgBbN0eKByQoeluV+QRkYsuMh9C8CXPtLqgbZo/ISmqp/GAaRtLlVUm8iheEsM0YCaG3tEyJd1MuUeu2BCQK+G8WqUXMv5ynTYBdQS3+v81B0dXb2+KCS1/w903idesqWCUT4WpNs7kEWIDoQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905098; c=relaxed/simple; bh=p5UYbpdKw37Jh9rs8f/88LT8YHJj93VvAxwxLrha4Dg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=GipmwnSCqNSNn9Amzv4/m4G5Y10Mh7nlQq2vMpobYKowunCfukiIZSfRDyVOCAPje5XLNfLVZEktHB1yKNmurulQL+QReTJvaRm+kYhvbNFapxPDHvh5tIr2X9DlTnJKz43Iug3euzYbJlLmAPzF3nUP8op+ueZY87nAkuDNi1E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=caULk3RE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="caULk3RE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D072D1F00A3A; Tue, 8 Sep 2026 22:04:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905097; bh=pMwdKDpEcWsTGjIiaUuqOVn+pPdk1SNCMZVTViM1TFA=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=caULk3REutEieb20hePXT+BBppeQHgxSaquW6i8m0kent+gWkj2fk1cG6x82iMZfy LgUbSlO2x0WomwE0CGXy2nO/9GMNcSVUOkkJ8/gp5dWQ5UP750WJMiZYvK66xI93q8 uCo7RlC1ZH2SUw5twkRM24ZTjIcUvwa0IPqDW0BRb0FtjD2kWOXImKyHsaCYkUbpUV nu60jvCNSeGXjHiWMAw8vAWGbAMOGRWcwQGIATXyhAEs9psH045S7RiLuEOqGfOWFC FJnX9D/RZCu+tMfg5VmIxl1BZepCCoqQYfzIi8rxwLjuzG9+37gd/y+DVynNRolaH+ CmbhLp7hlIj8Q== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:41 -0500 Subject: [PATCH v3 04/22] accel: ethosu: Disable clocks on PM setup failure Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-4-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev ethosu_init() enables the clocks directly to reset and query the NPU before runtime PM takes over. If runtime-PM setup fails, the error path returns while those clocks remain enabled. Disable the clocks before returning the setup error to balance the initial direct resume. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_drv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index 2c8d735767b2..9d063daa1aa7 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -311,8 +311,10 @@ static int ethosu_init(struct ethosu_device *ethosudev) pm_runtime_set_autosuspend_delay(ethosudev->base.dev, 50); pm_runtime_use_autosuspend(ethosudev->base.dev); ret =3D devm_pm_runtime_set_active_enabled(ethosudev->base.dev); - if (ret) + if (ret) { + ethosu_device_suspend(ethosudev->base.dev); return ret; + } pm_runtime_get_noresume(ethosudev->base.dev); =20 ethosudev->npu_info.id =3D id =3D readl_relaxed(ethosudev->regs + NPU_REG= _ID); --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 483D456B848 for ; Tue, 8 Sep 2026 22:04:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905099; cv=none; b=agyxW5FoYpZGh5zsPYZs9ZctBUNwlHoqP0cCI9AZxaCb+pUYcs9bZNIFYddrG9L8Ps4CYmP/zJjToRR1PoTM67EFr/OMBEoDNMkCur1WNNT4oUke58EoUU9WFKaVMA3zzFlwQW+eMLPgys2vwS12J7A9YAId+sZHtGavgYaWtKs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905099; c=relaxed/simple; bh=hb2IGok6xcbmfJtXJDgTvf+32L/u6qDR2uGJpjJE3VU=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=IQUXu1BEfP0O95oXsShk2c6lKayMk9AaQmbyHJuDgQxg8alEOTiaERJh+LzO8e2xbqH3BSj9cTda9WCE5EF2DWl/G1Z8Qpr7eNxixXFej2hOC8YetCgTsf+zLBeOIwgtd6/vD23lwBy/OQG9gg/T2t5altoxV4sFWmi/V55Uuh4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KWy3ygku; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KWy3ygku" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 010FB1F00A3E; Tue, 8 Sep 2026 22:04:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905098; bh=BSE/1dmV9/OlXUyEoOlbChcyMLLbhJNQh9ObguX2hFg=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=KWy3ygkuKMMALDFZMD3F1kdmflmOnlMZkqF/IBSZIQMF1+oaC/GUfh+Jo7p7dcTzu v+aWDpTRyITg/+mCn1Qk6V7VZ9aje1aihtcnMVPkFXK+xNa1urtmsC6tWIiJk7odao ZbwrRBl8e1YgX4kvGRdtXSACRbxMmSXW4n3sHFJTbz97KwJYLdKzRMsAuALQoRySf9 8m3tSBvRBzDjBFf4lN2QVR0ToWw/KLLxnOwuHuMtc5cKUl+6PdbsfucM/L+l2rIlie +VYE2LRBtV6Fr2PKOyO3wMMuTIhm6AVE09GlryFkofLLBKwG6b6YIorSPN2Lw9Nsu8 DD/rDt6AXM4Iw== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:42 -0500 Subject: [PATCH v3 05/22] accel: ethosu: Quiesce jobs before scheduler teardown Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-5-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev An NPU job can complete while driver removal tears down the scheduler. Its IRQ handler could then access scheduler state after it has been destroyed. Stop scheduler submission and timeout work, reset the NPU, and synchronize its IRQ before finalizing the scheduler. Add a cancel_job callback so drm_sched_fini() signals queued jobs with -ECANCELED; their runtime-PM references are then released during normal job cleanup. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v3: - Add dma_fence_was_initialized() check in job cancel (sashiko) v2: - new patch --- drivers/accel/ethosu/ethosu_drv.c | 4 ++-- drivers/accel/ethosu/ethosu_drv.h | 2 ++ drivers/accel/ethosu/ethosu_job.c | 23 ++++++++++++++++++++++- 3 files changed, 26 insertions(+), 3 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_drv.c b/drivers/accel/ethosu/ethos= u_drv.c index 9d063daa1aa7..06e432854ce7 100644 --- a/drivers/accel/ethosu/ethosu_drv.c +++ b/drivers/accel/ethosu/ethosu_drv.c @@ -216,7 +216,7 @@ static const struct drm_driver ethosu_drm_driver =3D { #define U85_MEM_ATTR0_CFG 0x00000000 #define U85_MEM_ATTR2_CFG 0x000000b7 =20 -static int ethosu_reset(struct ethosu_device *ethosudev) +int ethosu_device_reset(struct ethosu_device *ethosudev) { int ret; u32 reg; @@ -263,7 +263,7 @@ static int ethosu_device_resume(struct device *dev) if (ret) return ret; =20 - ret =3D ethosu_reset(ethosudev); + ret =3D ethosu_device_reset(ethosudev); if (!ret) return 0; =20 diff --git a/drivers/accel/ethosu/ethosu_drv.h b/drivers/accel/ethosu/ethos= u_drv.h index 2193bc51d425..f59c845c758b 100644 --- a/drivers/accel/ethosu/ethosu_drv.h +++ b/drivers/accel/ethosu/ethosu_drv.h @@ -11,6 +11,8 @@ struct ethosu_device; struct drm_device; struct drm_file; =20 +int ethosu_device_reset(struct ethosu_device *ethosudev); + struct ethosu_file_priv { struct ethosu_device *edev; struct drm_sched_entity sched_entity; diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethos= u_job.c index ec65305e0cd7..a1443cd0c5b0 100644 --- a/drivers/accel/ethosu/ethosu_job.c +++ b/drivers/accel/ethosu/ethosu_job.c @@ -189,6 +189,17 @@ static void ethosu_job_free(struct drm_sched_job *sche= d_job) ethosu_job_put(job); } =20 +static void ethosu_job_cancel(struct drm_sched_job *sched_job) +{ + struct ethosu_job *job =3D to_ethosu_job(sched_job); + + if (dma_fence_was_initialized(job->done_fence) && + !dma_fence_is_signaled(job->done_fence)) { + dma_fence_set_error(job->done_fence, -ECANCELED); + dma_fence_signal(job->done_fence); + } +} + static void ethosu_switch_perfmon(struct ethosu_device *ethosu, struct ethosu_job *job) { @@ -315,7 +326,8 @@ static enum drm_gpu_sched_stat ethosu_job_timedout(stru= ct drm_sched_job *bad) static const struct drm_sched_backend_ops ethosu_sched_ops =3D { .run_job =3D ethosu_job_run, .timedout_job =3D ethosu_job_timedout, - .free_job =3D ethosu_job_free + .free_job =3D ethosu_job_free, + .cancel_job =3D ethosu_job_cancel, }; =20 int ethosu_job_init(struct ethosu_device *edev) @@ -363,6 +375,15 @@ int ethosu_job_init(struct ethosu_device *edev) =20 void ethosu_job_fini(struct ethosu_device *dev) { + drm_sched_wqueue_stop(&dev->sched); + cancel_delayed_work_sync(&dev->sched.work_tdr); + + if (READ_ONCE(dev->in_flight_job)) { + WRITE_ONCE(dev->in_flight_job, NULL); + ethosu_device_reset(dev); + } + + synchronize_irq(dev->irq); drm_sched_fini(&dev->sched); } =20 --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68B8658B6C4 for ; Tue, 8 Sep 2026 22:04:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905100; cv=none; b=tL3DLCc9kCscLPawm9hGA6j0CpjeL2yP1ffxJWOk06Ziw9am97AR8TgUThchDjt+VgkLO9LyhNZ2QAiFTEP8EyxSMn1QgavDNnJtxZwKu4j3f57dHKFPPQKl280M9ggu1QYEI8Njez5pTLsBZNPKBkS3Zn1PPYZHkOyQKy8OHFo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905100; c=relaxed/simple; bh=KXjID5zwEnS/6i0i4yKo05v9d2iAqpm2hWmsH3xdD6c=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=A/A926Fwpy5a4PRTO9KAGwnSMxcgKDL14Yq8H/mdANuUdZwX9b8n+akPdkNkG0H+DZrIT5GXXZn742LLPiaoj+7+DnG3o5TzKRU7T6Jk+SOmn0L2J7drqJsyepTWMnZjNcYi7YMNB+nxeTRCNzvhxyfPn3rAqeCsBUMn4MauC2o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=V47tf8M2; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="V47tf8M2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1AA431F00A3A; Tue, 8 Sep 2026 22:04:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905099; bh=MWrrQYUhx+9Xsk9gELQ0A3vmgKNDW3R1AUupsQHIcE4=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=V47tf8M21es2gsJFShqGh0OT7Wu7y7TV3PL+6zVD+h6IihAVfftXqBkz8LZ5tS8Ak K80ayyzR3G1k5KjDLgtd8F5sfTIjqYYKFLNRLt8EIrOFZIkGX8zxzkI4uIRlzXcKM5 wn0M3QKDBg/yFEm7e76LkFeIijKJEA66wNQP5lg52ZjfoE6XJ7TAiEAJ/mYT2Bmenv aARMAT5oCw4PtALaub0eimraeZIhmTwgkb2YdklkMD2uOjanUMkJFLFDNND9wrfFyl 8vHoooi6XEFzwLjsr3zJQT7lLyol1DCy8JHbdtcXyoRcyc/vqzOzvLcslUuiyXpUaR i2A8nK1MCn95g== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:43 -0500 Subject: [PATCH v3 06/22] accel: ethosu: Prevent command stream export Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-6-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Command stream BOs are validated at creation time, but the generic PRIME export path can expose their backing memory to a DMA-BUF importer. The importer can then modify the command stream before the NPU executes it. Reject PRIME export for validated command stream BOs while retaining generic export for data BOs. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v3: - new patch --- drivers/accel/ethosu/ethosu_gem.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 9afe2549ec84..c046aee42687 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -6,6 +6,7 @@ #include =20 #include +#include =20 #include "ethosu_device.h" #include "ethosu_gem.h" @@ -30,9 +31,18 @@ static int ethosu_gem_mmap(struct drm_gem_object *obj, s= truct vm_area_struct *vm return drm_gem_dma_object_mmap(obj, vma); } =20 +static struct dma_buf *ethosu_gem_export(struct drm_gem_object *obj, int f= lags) +{ + if (to_ethosu_bo(obj)->info) + return ERR_PTR(-EPERM); + + return drm_gem_prime_export(obj, flags); +} + static const struct drm_gem_object_funcs ethosu_gem_funcs =3D { .free =3D ethosu_gem_free_object, .print_info =3D drm_gem_dma_object_print_info, + .export =3D ethosu_gem_export, .get_sg_table =3D drm_gem_dma_object_get_sg_table, .vmap =3D drm_gem_dma_object_vmap, .mmap =3D ethosu_gem_mmap, --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E6E455921E4 for ; Tue, 8 Sep 2026 22:05:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905102; cv=none; b=FPtDlO3K1tp1kN/yvhirVLWpmhJ6ZcDXhQyhAL4qy484l9E7ai61V3Yl4FR6on5WIHKeAGf/TN5qVUNyLghcRoZ9fkbW3nkYzDAyjMtvxm2+fbPlNBVV3M5CcXA/MUPO8u2gQGhoWyGNyvqFye+YJ6epZsJYKlQgxvL+6rxUqtY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905102; c=relaxed/simple; bh=ePs91XSM48zZM3SaAL6tnk9g2qNbUW6PvFwH6+mLMos=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=B/8uI+G7YcbbFbapr7oh2j0iL4QXn9TjU5lkVph59q8QYwSFJKw5hw4ZSI6AumfYEgDYc0A6mehBBCPvx8jjS3AGpAoaF7aso0qO8FB70hYFkaiZqbXOZ9Z/dG6V+0YssFgPIEwj9L3lIf8tPXG4SoITiUbc0vS2it5LTzGODDg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=WRr1FRpi; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="WRr1FRpi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 701401F00A3E; Tue, 8 Sep 2026 22:05:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905100; bh=sRBKq+2Umg2Iw+/V4MgGP4abKYY9eE606qemJj7IMBo=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=WRr1FRpinzIqkYXgjH92g2dXPRSg0QMLL4zSozziJRNd5xp7aOA+ii7e5aIrAKoc5 /dqzaZ17cV2DTquPLFFkkrtHvzHFg4/GID1/jsGTuqqXh7vbmGoP4PUp7JHAmtH5L4 X6PjVFXutNfTqC/VMiL5U/IGhrLHXGbENl1ZBrMZWwq0MY2Xbn7jADwGXnt/qecbOU zsTYjgWqFDNxYcwGQ6OGumBnrO09OOSxM+hpTCp30ro6i5E8zGUzI9Z9/vV3TegXKn gASK2w71thUVE5yd1xacivMWWMICQtmg2CW49uyBCYAp4WQlqqGxAfei62fYZdDDOP PpVQcwwoiEQbA== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:44 -0500 Subject: [PATCH v3 07/22] accel: ethosu: Move DMA mode to src/dst struct Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-7-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The DMA mode setting is independent for source and destination, so it should be part of the src/dst struct dma rather than the global DMA state. Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_gem.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index c046aee42687..2b9c98251c94 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -110,6 +110,7 @@ int ethosu_gem_create_with_handle(struct drm_file *file, =20 struct dma { s8 region; + s8 mode; u64 len; u64 offset; s64 stride[2]; @@ -118,7 +119,6 @@ struct dma { struct dma_state { u16 size0; u16 size1; - s8 mode; struct dma src; struct dma dst; }; @@ -171,7 +171,7 @@ static u64 cmd_to_addr(u32 *cmd) static u64 dma_length(struct ethosu_validated_cmdstream_info *info, struct dma_state *dma_st, struct dma *dma) { - s8 mode =3D dma_st->mode; + s8 mode =3D dma->mode; u64 len =3D dma->len; =20 if (len =3D=3D U64_MAX) @@ -664,13 +664,14 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, st.dma.src.region =3D -1; else st.dma.src.region =3D param & 0x7; - st.dma.mode =3D (param >> 9) & 0x3; + st.dma.src.mode =3D (param >> 9) & 0x3; break; case NPU_SET_DMA0_DST_REGION: if (param & 0x100) st.dma.dst.region =3D -1; else st.dma.dst.region =3D param & 0x7; + st.dma.dst.mode =3D (param >> 9) & 0x3; break; case NPU_SET_DMA0_SIZE0: st.dma.size0 =3D param; --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 251E95964E9 for ; Tue, 8 Sep 2026 22:05:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905104; cv=none; b=lA3c0orKs0JrL+XJox+m11O866S44XetHUopeR0b1xqAfLJ8MxwPlUUT2cV1Ih7uU46PjbfLy8xGj9UYUf9Mw1eD0yXzmo/jGNtKgj1uRB66dwZxi6fnuVctnzWgXHDJoNWL1jGAJbAOhbNPvMNn82iWvX4+jcFfw1Iq2cccX3s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905104; c=relaxed/simple; bh=HfiQYpNCJELEMLHLh9I3Vc268beJdoqbQOa6TV6CAzg=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=kwzS7VZZ0V7IO53C56ZasaZ4JDPucNFbW3ALSA+eog7vEO0AEXJwG3bIOWFZcP3ahW9BIdiWAjHUfcCfROMDqIn9e3u2W1oQz+UTonWIsXZBCcXx0maoNzvbDCD8F4GbufTFduZogFZ6zU6lNQ+q3R1ZiclqgkhIYlH5ZHvLXEw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=lnZnaUnj; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="lnZnaUnj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9376A1F00A3A; Tue, 8 Sep 2026 22:05:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905101; bh=KgbJ416OZO8ZW8InEm+gz7FbCDIUnJn7jp+Il5iT8zs=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=lnZnaUnjgt1VJuBRw5vR3q2c9CH/a1bT7MfpzM94keMQX8m14ybmUjmrMDyy/VwWG +EdLo3fVPJg+k62L3dyD8Ms8k1+UVMSwXR48P3qAHYuBStW6F6GhvgMuOEjNkzVluP hyvwNo91C6ZX6MjEoJ43+YKqwfRYCBlMuwiMXqaSeMQIvIchY4jrf/9vwNXdPJF15q qQJdr9/N6GJlGQpzMP8y1YDnAjpeg+mComfA8/rz7YFz9OMykQG1YxZoVrsLUxKMi5 gkEKY8GhqRwsNxUJRGWDaOVeF4OlV+qo7RVYkuh4c3V9SXjBXCfkVOgiJzFThqwsEV fe4IHBJrvKdwg== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:45 -0500 Subject: [PATCH v3 08/22] accel: ethosu: Track command stream register setup Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-8-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The current method of tracking command stream state initializing state tracking to illegal values and assuming unaccessed registers are 0 is proving inadequate with additional validation. Instead, track all the registers in a bitmap as the register address space is fairly small. CMD1 opcodes overlap CMD0 after bit 14 is stripped, so maintain a separate bitmap for each bank. Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v3: - Fix return value in dma_params_valid() v2: - new patch --- drivers/accel/ethosu/ethosu_gem.c | 269 +++++++++++++++++++++++++++++++++-= ---- 1 file changed, 234 insertions(+), 35 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 2b9c98251c94..1e9ffacbc394 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only or MIT /* Copyright 2025 Arm, Ltd. */ =20 +#include #include #include #include @@ -148,7 +149,12 @@ struct feat_matrix { u8 pad_right; }; =20 +#define NPU_CMD0_REGS 0x200 +#define NPU_CMD1_REGS 0x100 + struct cmd_state { + DECLARE_BITMAP(cmd0, NPU_CMD0_REGS); + DECLARE_BITMAP(cmd1, NPU_CMD1_REGS); struct dma_state dma; struct buffer scale[2]; struct buffer weight[4]; @@ -159,8 +165,29 @@ struct cmd_state { =20 static void cmd_state_init(struct cmd_state *st) { - /* Initialize to all 1s to detect missing setup */ - memset(st, 0xff, sizeof(*st)); + memset(st, 0, sizeof(*st)); +} + +static void cmd_state_set_reg(struct cmd_state *st, u16 cmd) +{ + u16 reg =3D cmd & ~BIT(14); + + if (cmd & BIT(14)) { + if (reg < NPU_CMD1_REGS) + __set_bit(reg, st->cmd1); + } else if (reg < NPU_CMD0_REGS) { + __set_bit(reg, st->cmd0); + } +} + +static bool cmd_state_reg_is_set(struct cmd_state *st, u16 cmd) +{ + u16 reg =3D cmd & ~BIT(14); + + if (cmd & BIT(14)) + return reg < NPU_CMD1_REGS && test_bit(reg, st->cmd1); + + return reg < NPU_CMD0_REGS && test_bit(reg, st->cmd0); } =20 static u64 cmd_to_addr(u32 *cmd) @@ -168,13 +195,54 @@ static u64 cmd_to_addr(u32 *cmd) return (((u64)cmd[0] & 0xff0000) << 16) | cmd[1]; } =20 -static u64 dma_length(struct ethosu_validated_cmdstream_info *info, - struct dma_state *dma_st, struct dma *dma) +static bool dma_use_src_stride(struct ethosu_device *edev, + const struct dma_state *dma_st, const struct dma *dma) +{ + return ethosu_is_u65(edev) || dma =3D=3D &dma_st->src; +} + +static bool dma_params_valid(struct ethosu_device *edev, struct cmd_state = *st, + const struct dma_state *dma_st, + const struct dma *dma, + u16 region_cmd, u16 addr_cmd) +{ + s8 mode =3D dma->mode; + + if (!cmd_state_reg_is_set(st, region_cmd) || + !cmd_state_reg_is_set(st, addr_cmd) || + !cmd_state_reg_is_set(st, NPU_SET_DMA0_LEN) || mode < 0 || mode > 2) + return false; + + if (mode >=3D 1 && + !cmd_state_reg_is_set(st, dma_use_src_stride(edev, dma_st, dma) ? + NPU_SET_DMA0_SRC_STRIDE0 : + NPU_SET_DMA0_DST_STRIDE0)) + return false; + if (mode =3D=3D 2 && + !cmd_state_reg_is_set(st, dma_use_src_stride(edev, dma_st, dma) ? + NPU_SET_DMA0_SRC_STRIDE1 : + NPU_SET_DMA0_DST_STRIDE1)) + return false; + + if (mode >=3D 1 && + (!cmd_state_reg_is_set(st, NPU_SET_DMA0_SIZE0) || !dma_st->size0)) + return false; + if (mode =3D=3D 2 && + (!cmd_state_reg_is_set(st, NPU_SET_DMA0_SIZE1) || !dma_st->size1)) + return false; + + return true; +} + +static u64 dma_length(struct ethosu_device *edev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st, struct dma_state *dma_st, + struct dma *dma, u16 region_cmd, u16 addr_cmd) { s8 mode =3D dma->mode; u64 len =3D dma->len; =20 - if (len =3D=3D U64_MAX) + if (!dma_params_valid(edev, st, dma_st, dma, region_cmd, addr_cmd)) return U64_MAX; =20 if (mode >=3D 1) { @@ -209,17 +277,98 @@ static bool feat_matrix_chained(struct ethosu_device = *edev, struct feat_matrix * return !ethosu_is_u65(edev) && storage =3D=3D 2; } =20 +enum feat_matrix_type { + FEAT_MATRIX_IFM, + FEAT_MATRIX_OFM, + FEAT_MATRIX_IFM2, +}; + +static u16 feat_matrix_base_cmd(enum feat_matrix_type type) +{ + switch (type) { + case FEAT_MATRIX_IFM: + return NPU_SET_IFM_BASE0; + case FEAT_MATRIX_OFM: + return NPU_SET_OFM_BASE0; + case FEAT_MATRIX_IFM2: + return NPU_SET_IFM2_BASE0; + } + + return 0; +} + +static int feat_matrix_validate(struct ethosu_device *edev, + struct cmd_state *st, struct feat_matrix *fm, + enum feat_matrix_type type) +{ + u32 format; + u16 stride_cmd; + + switch (type) { + case FEAT_MATRIX_IFM: + if (!cmd_state_reg_is_set(st, NPU_SET_IFM_REGION) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_PRECISION) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_DEPTH_M1)) + return -EINVAL; + if (feat_matrix_chained(edev, fm)) + return 0; + if (!cmd_state_reg_is_set(st, NPU_SET_IFM_WIDTH0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_HEIGHT0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_HEIGHT1_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_STRIDE_Y)) + return -EINVAL; + break; + case FEAT_MATRIX_OFM: + if (!cmd_state_reg_is_set(st, NPU_SET_OFM_REGION) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_PRECISION) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_DEPTH_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_WIDTH_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_HEIGHT_M1)) + return -EINVAL; + if (feat_matrix_chained(edev, fm)) + return 0; + if (!cmd_state_reg_is_set(st, NPU_SET_OFM_WIDTH0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_HEIGHT0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_HEIGHT1_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_STRIDE_Y)) + return -EINVAL; + break; + case FEAT_MATRIX_IFM2: + if (!cmd_state_reg_is_set(st, NPU_SET_IFM2_REGION) || + !cmd_state_reg_is_set(st, NPU_SET_IFM2_PRECISION)) + return -EINVAL; + if (feat_matrix_chained(edev, fm)) + return 0; + if (!cmd_state_reg_is_set(st, NPU_SET_IFM2_WIDTH0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM2_HEIGHT0_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM2_HEIGHT1_M1) || + !cmd_state_reg_is_set(st, NPU_SET_IFM2_STRIDE_Y)) + return -EINVAL; + break; + } + + format =3D (fm->precision >> 6) & 0x3; + stride_cmd =3D feat_matrix_base_cmd(type) + (format ? 6 : 4); + if (!cmd_state_reg_is_set(st, stride_cmd)) + return -EINVAL; + + return 0; +} static u64 feat_matrix_length(struct ethosu_device *edev, struct ethosu_validated_cmdstream_info *info, - struct feat_matrix *fm, + struct cmd_state *st, struct feat_matrix *fm, + enum feat_matrix_type type, u32 x, u32 y, u32 c, bool ofm) { u32 element_size, storage =3D ethosu_is_u65(edev) ? 0 : fm->precision >> = 14; int tile =3D 0; u64 addr; + u64 offset; =20 if (fm->region < 0) return U64_MAX; + if (feat_matrix_validate(edev, st, fm, type)) + return U64_MAX; =20 if (feat_matrix_chained(edev, fm)) return 0; @@ -247,24 +396,39 @@ static u64 feat_matrix_length(struct ethosu_device *e= dev, default: return U64_MAX; } - if (fm->base[tile] =3D=3D U64_MAX) + if (!cmd_state_reg_is_set(st, feat_matrix_base_cmd(type) + tile)) return U64_MAX; =20 - addr =3D fm->base[tile] + y * fm->stride_y; + if (check_mul_overflow(y, (u64)fm->stride_y, &offset) || + check_add_overflow(fm->base[tile], offset, &addr)) + return U64_MAX; =20 switch ((fm->precision >> 6) & 0x3) { // format case 0: //nhwc: element_size =3D BIT((fm->precision >> (ofm ? 1 : 2)) & 0x3); - addr +=3D x * fm->stride_x + c * element_size; + if (check_mul_overflow(x, (u64)fm->stride_x, &offset) || + check_add_overflow(addr, offset, &addr) || + check_mul_overflow(c, element_size, &offset) || + check_add_overflow(addr, offset, &addr)) + return U64_MAX; break; case 1: //nhcwb16: element_size =3D BIT((fm->precision >> (ofm ? 1 : 2)) & 0x3); =20 - addr +=3D (c / 16) * fm->stride_c + (16 * x + (c & 0xf)) * element_size; + if (check_mul_overflow(c / 16, (u64)fm->stride_c, &offset) || + check_add_overflow(addr, offset, &addr) || + check_mul_overflow(16 * x + (c & 0xf), element_size, &offset) || + check_add_overflow(addr, offset, &addr)) + return U64_MAX; break; + default: + return U64_MAX; } =20 - info->region_size[fm->region] =3D max(info->region_size[fm->region], addr= + 1); + if (check_add_overflow(addr, 1ULL, &offset)) + return U64_MAX; + + info->region_size[fm->region] =3D max(info->region_size[fm->region], offs= et); =20 return addr; } @@ -278,7 +442,13 @@ static int calc_sizes(struct drm_device *ddev, u64 len; =20 if (ifm) { - if (st->ifm.stride_kernel =3D=3D U16_MAX) + if (!cmd_state_reg_is_set(st, NPU_SET_KERNEL_WIDTH_M1) || + !cmd_state_reg_is_set(st, NPU_SET_KERNEL_HEIGHT_M1) || + !cmd_state_reg_is_set(st, NPU_SET_KERNEL_STRIDE) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_TOP) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_LEFT) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_RIGHT) || + !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_BOTTOM)) return -EINVAL; u32 stride_y =3D ((st->ifm.stride_kernel >> 8) & 0x2) + ((st->ifm.stride_kernel >> 1) & 0x1) + 1; @@ -292,8 +462,9 @@ static int calc_sizes(struct drm_device *ddev, if (ifm_height < 0 || ifm_width < 0) return -EINVAL; =20 - len =3D feat_matrix_length(edev, info, &st->ifm, ifm_width, - ifm_height, st->ifm.depth, false); + len =3D feat_matrix_length(edev, info, st, &st->ifm, + FEAT_MATRIX_IFM, ifm_width, ifm_height, + st->ifm.depth, false); dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", op, st->ifm.region, st->ifm.base[0], len); if (len =3D=3D U64_MAX) @@ -301,8 +472,9 @@ static int calc_sizes(struct drm_device *ddev, } =20 if (ifm2) { - len =3D feat_matrix_length(edev, info, &st->ifm2, st->ifm.depth, - 0, st->ofm.depth, false); + len =3D feat_matrix_length(edev, info, st, &st->ifm2, + FEAT_MATRIX_IFM2, st->ifm.depth, 0, + st->ofm.depth, false); dev_dbg(ddev->dev, "op %d: IFM2:%d:0x%llx-0x%llx\n", op, st->ifm2.region, st->ifm2.base[0], len); if (len =3D=3D U64_MAX) @@ -313,8 +485,9 @@ static int calc_sizes(struct drm_device *ddev, dev_dbg(ddev->dev, "op %d: W:%d:0x%llx-0x%llx\n", op, st->weight[0].region, st->weight[0].base, st->weight[0].base + st->weight[0].length - 1); - if (st->weight[0].region < 0 || st->weight[0].base =3D=3D U64_MAX || - st->weight[0].length =3D=3D U32_MAX) + if (!cmd_state_reg_is_set(st, NPU_SET_WEIGHT_REGION) || + !cmd_state_reg_is_set(st, NPU_SET_WEIGHT_BASE) || + !cmd_state_reg_is_set(st, NPU_SET_WEIGHT_LENGTH)) return -EINVAL; info->region_size[st->weight[0].region] =3D max(info->region_size[st->weight[0].region], @@ -325,16 +498,18 @@ static int calc_sizes(struct drm_device *ddev, dev_dbg(ddev->dev, "op %d: S:%d:0x%llx-0x%llx\n", op, st->scale[0].region, st->scale[0].base, st->scale[0].base + st->scale[0].length - 1); - if (st->scale[0].region < 0 || st->scale[0].base =3D=3D U64_MAX || - st->scale[0].length =3D=3D U32_MAX) + if (!cmd_state_reg_is_set(st, NPU_SET_SCALE_REGION) || + !cmd_state_reg_is_set(st, NPU_SET_SCALE_BASE) || + !cmd_state_reg_is_set(st, NPU_SET_SCALE_LENGTH)) return -EINVAL; info->region_size[st->scale[0].region] =3D max(info->region_size[st->scale[0].region], st->scale[0].base + st->scale[0].length); } =20 - len =3D feat_matrix_length(edev, info, &st->ofm, st->ofm.width, - st->ofm.height[2], st->ofm.depth, true); + len =3D feat_matrix_length(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, + st->ofm.width, st->ofm.height[2], st->ofm.depth, + true); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); if (len =3D=3D U64_MAX) @@ -359,8 +534,8 @@ static int calc_sizes_elemwise(struct drm_device *ddev, width =3D st->ifm.broadcast & 0x2 ? 0 : st->ofm.width; depth =3D st->ifm.broadcast & 0x4 ? 0 : st->ofm.depth; =20 - len =3D feat_matrix_length(edev, info, &st->ifm, width, - height, depth, false); + len =3D feat_matrix_length(edev, info, st, &st->ifm, + FEAT_MATRIX_IFM, width, height, depth, false); dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", op, st->ifm.region, st->ifm.base[0], len); if (len =3D=3D U64_MAX) @@ -372,16 +547,17 @@ static int calc_sizes_elemwise(struct drm_device *dde= v, width =3D st->ifm2.broadcast & 0x2 ? 0 : st->ofm.width; depth =3D st->ifm2.broadcast & 0x4 ? 0 : st->ofm.depth; =20 - len =3D feat_matrix_length(edev, info, &st->ifm2, width, - height, depth, false); + len =3D feat_matrix_length(edev, info, st, &st->ifm2, + FEAT_MATRIX_IFM2, width, height, depth, false); dev_dbg(ddev->dev, "op %d: IFM2:%d:0x%llx-0x%llx\n", op, st->ifm2.region, st->ifm2.base[0], len); if (len =3D=3D U64_MAX) return -EINVAL; } =20 - len =3D feat_matrix_length(edev, info, &st->ofm, st->ofm.width, - st->ofm.height[2], st->ofm.depth, true); + len =3D feat_matrix_length(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, + st->ofm.width, st->ofm.height[2], st->ofm.depth, + true); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); if (len =3D=3D U64_MAX) @@ -436,6 +612,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, addr =3D cmd_to_addr(cmds); } =20 + cmd_state_set_reg(&st, cmd); + switch (cmd) { case NPU_OP_STOP: if (i !=3D size / 4 - 1) @@ -443,8 +621,10 @@ static int ethosu_gem_cmdstream_copy_and_validate(stru= ct drm_device *ddev, ends_with_stop =3D true; break; case NPU_OP_DMA_START: - srclen =3D dma_length(info, &st.dma, &st.dma.src); - dstlen =3D dma_length(info, &st.dma, &st.dma.dst); + srclen =3D dma_length(edev, info, &st, &st.dma, &st.dma.src, + NPU_SET_DMA0_SRC_REGION, NPU_SET_DMA0_SRC); + dstlen =3D dma_length(edev, info, &st, &st.dma, &st.dma.dst, + NPU_SET_DMA0_DST_REGION, NPU_SET_DMA0_DST); if (srclen =3D=3D U64_MAX || dstlen =3D=3D U64_MAX) return -EINVAL; =20 @@ -455,16 +635,28 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, st.dma.dst.region, st.dma.dst.offset, dstlen); break; case NPU_OP_CONV: - case NPU_OP_DEPTHWISE: use_ifm2 =3D param & 0x1; // weights_ifm2 + if (!cmd_state_reg_is_set(&st, NPU_SET_OFM_PRECISION)) + return -EINVAL; use_scale =3D !(st.ofm.precision & 0x100); ret =3D calc_sizes(ddev, info, cmd, &st, true, use_ifm2, !use_ifm2, use_scale); if (ret) return ret; break; + case NPU_OP_DEPTHWISE: + if (!cmd_state_reg_is_set(&st, NPU_SET_OFM_PRECISION)) + return -EINVAL; + use_scale =3D !(st.ofm.precision & 0x100); + ret =3D calc_sizes(ddev, info, cmd, &st, true, false, true, + use_scale); + if (ret) + return ret; + break; case NPU_OP_POOL: use_ifm =3D param !=3D 0x4; // pooling mode + if (!cmd_state_reg_is_set(&st, NPU_SET_OFM_PRECISION)) + return -EINVAL; use_scale =3D !(st.ofm.precision & 0x100); ret =3D calc_sizes(ddev, info, cmd, &st, use_ifm, false, false, use_scale); @@ -472,11 +664,18 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, return ret; break; case NPU_OP_ELEMENTWISE: - use_scale =3D ethosu_is_u65(edev) ? + if (!ethosu_is_u65(edev) && + !cmd_state_reg_is_set(&st, NPU_SET_IFM_BROADCAST)) + return -EINVAL; + use_ifm2 =3D (param !=3D 5) && (param !=3D 6) && + (param !=3D 7) && (param !=3D 0x24); + if (use_ifm2 && + !cmd_state_reg_is_set(&st, NPU_SET_IFM2_BROADCAST)) + return -EINVAL; + use_scale =3D use_ifm2 && (ethosu_is_u65(edev) ? (st.ifm2.broadcast & 0x80) : - (st.ifm2.broadcast =3D=3D 8); - use_ifm2 =3D !(use_scale || (param =3D=3D 5) || - (param =3D=3D 6) || (param =3D=3D 7) || (param =3D=3D 0x24)); + (st.ifm2.broadcast =3D=3D 8)); + use_ifm2 =3D use_ifm2 && !use_scale; use_ifm =3D st.ifm.broadcast !=3D 8; ret =3D calc_sizes_elemwise(ddev, info, cmd, &st, use_ifm, use_ifm2); if (ret) --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8CCD559C984 for ; Tue, 8 Sep 2026 22:05:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905105; cv=none; b=SqV3/4DyVzaZQ/Gv5WyTDo0pIsqRvO4nwRPH/4lPh/FzN5OX8laZpyuw+VDFegWbJ0M43D/vAzYaqEszuHzBOOQReRv3NbqOWNJSVcKLXVEkz4KJIqIm5VDTIOELjWIociFiVVrV62ls7Obx0vFGesVPXykIoq+YuFz/VpQJRFs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905105; c=relaxed/simple; bh=FbefwW1eZASfx88uMrOevD/fzvnmLdy4GhljWjat4wk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=iumbfoyrt3fAxjtktF9ZC+OpjOWrsGPfcMsbM979ThxsQqHcETgrRjecj6whjU8ov8AzXr7cE0rpRmV0w/IQsfOKeUjT5OuzKep4aVMASD2QZMPCTranzVpthgOFNyuQgzpIHcCxnl2NNKlxiOYeJhCEnzahTVc5Anr0esj4tvs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=V/GUlM5B; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="V/GUlM5B" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EB4F21F00A3D; Tue, 8 Sep 2026 22:05:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905104; bh=q5CMo4WNSM4ju2lnbqf0rXaRmZc8RgBpR2ruwkdpQ50=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=V/GUlM5BCPyFYhPEHi2Jb+nM/J7dlUuHlhnjY0lP+UJrptBVgzcGjgoaCu9jCiLtd DShMgX8Vu9DfwZeozD7w5tsf0mVzJsDjVNhVzG4LObKDSkq5vqfzJCirQvrEruA73S Fzh9ZFTrZOKUoDa7tcnOXlBqOOGx7UIHe5Xyz1tIjkEV05ssmOeUsqp3SmH/2jd2qQ d8UZ/I4wsnL30V7zFA5sn44YPrPos0Y+ngAkYY0uvyzplwxa0Jildc2WFT/oArSYn8 41jW+0v+4uyQeFHRykyr7AqR9yLCI8J3ee2dWfnhJIHEKmheBjSIBuYnIbxS6fT4pV 4jvZMRehbLyEw== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:46 -0500 Subject: [PATCH v3 09/22] accel: ethosu: Factor buffer bounds checks Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-9-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Move the repeated command-stream buffer range validation into a helper in preparation for validating all weight and scale streams. Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - Adjust due to previous patch --- drivers/accel/ethosu/ethosu_gem.c | 37 +++++++++++++++++++++++++----------= -- 1 file changed, 25 insertions(+), 12 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 1e9ffacbc394..2707b7df5dbe 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -433,6 +433,25 @@ static u64 feat_matrix_length(struct ethosu_device *ed= ev, return addr; } =20 +static int buffer_size(struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st, struct buffer *buf, s8 region, + u16 region_cmd, u16 base_cmd, u16 length_cmd) +{ + u64 end; + + if (region < 0 || !cmd_state_reg_is_set(st, region_cmd) || + !cmd_state_reg_is_set(st, base_cmd) || + !cmd_state_reg_is_set(st, length_cmd)) + return -EINVAL; + + if (check_add_overflow(buf->base, (u64)buf->length, &end)) + return -EINVAL; + + info->region_size[region] =3D max(info->region_size[region], end); + + return 0; +} + static int calc_sizes(struct drm_device *ddev, struct ethosu_validated_cmdstream_info *info, u16 op, struct cmd_state *st, @@ -485,26 +504,20 @@ static int calc_sizes(struct drm_device *ddev, dev_dbg(ddev->dev, "op %d: W:%d:0x%llx-0x%llx\n", op, st->weight[0].region, st->weight[0].base, st->weight[0].base + st->weight[0].length - 1); - if (!cmd_state_reg_is_set(st, NPU_SET_WEIGHT_REGION) || - !cmd_state_reg_is_set(st, NPU_SET_WEIGHT_BASE) || - !cmd_state_reg_is_set(st, NPU_SET_WEIGHT_LENGTH)) + if (buffer_size(info, st, &st->weight[0], st->weight[0].region, + NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT_BASE, + NPU_SET_WEIGHT_LENGTH)) return -EINVAL; - info->region_size[st->weight[0].region] =3D - max(info->region_size[st->weight[0].region], - st->weight[0].base + st->weight[0].length); } =20 if (scale) { dev_dbg(ddev->dev, "op %d: S:%d:0x%llx-0x%llx\n", op, st->scale[0].region, st->scale[0].base, st->scale[0].base + st->scale[0].length - 1); - if (!cmd_state_reg_is_set(st, NPU_SET_SCALE_REGION) || - !cmd_state_reg_is_set(st, NPU_SET_SCALE_BASE) || - !cmd_state_reg_is_set(st, NPU_SET_SCALE_LENGTH)) + if (buffer_size(info, st, &st->scale[0], st->scale[0].region, + NPU_SET_SCALE_REGION, NPU_SET_SCALE_BASE, + NPU_SET_SCALE_LENGTH)) return -EINVAL; - info->region_size[st->scale[0].region] =3D - max(info->region_size[st->scale[0].region], - st->scale[0].base + st->scale[0].length); } =20 len =3D feat_matrix_length(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F52B5650E3 for ; Tue, 8 Sep 2026 22:05:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905106; cv=none; b=Zs1F17NzjBGEMqAFNpNHQQjvMz4EL/ftamex/WC+ws1mCKMuIIK+aZgYpux3RqAVYbi9+1B8Ic1xhIj4P1lH7bqPDarsct+wJb1CH+N3Xhty0JJBtczC/FCmWoObTa3sX0HbVtooBj6Rmmt3UtepcAJj+tls5eGrvcWpX8Ju8/U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905106; c=relaxed/simple; bh=loC8Ki9qdbzxMvlajA8IK/yuRR1JUHkGme+5rYN08yk=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=CnLnfMpQNfEvi/3O2Ix9axBktEOsVArlkLOdT7AEIc3aVC2A6HxyeZgnQzX6asFla0DPZaJ8oOH+BZrhtWSRYDroDQY+Iy6F9o5Z30MhhqhCDnmK8pj1LbO9CB5XX1/LBGftz17GVGszAhONdAArYpPjpPL8wg6oRmo4aeqz/tM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=HlbryeCT; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="HlbryeCT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1944B1F00A3E; Tue, 8 Sep 2026 22:05:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905105; bh=7lTXSTxsnG6cCBOxmONeX8M6z6q5cJvZx27kO/M+lUo=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=HlbryeCTMH+OOBxr4hM0n+6B8dQKDAwT7qzPE1TBHtwJGzWmWp5NZ8VC7FNvx1Zz7 K4sxjEtWmEW87+VvXpnDQt0DYFZfXEJtKTLc1TZMZK3CLo9HdrMt/+yzWYPDh2Wm1W PER4ZVmhRzTc4pjx9RFlwTByoTqNpZV0mS6mEhI5ja27C3ScYbXI8krQTprkscS8Uk wlno/gv+tKbUpWGf92uR4yUQ5q/2jwQ5n+Tapk0yX9xcAQ5FJjSHSRxjKklcFAlxCn TVQWqmsRf28+Qgtw9AtLLoStCSvBIzwJnhjofaNYz7Z93f4mQlUNXtcWpb4/NdntYp F1GQbw6VrZtHw== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:47 -0500 Subject: [PATCH v3 10/22] accel: ethosu: Fix NHCWB16 bounds calculation Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-10-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, sashiko-bot@kernel.org X-Mailer: b4 0.16-dev The Ethos-U NPU inherently processes NHCWB16 data in 16-channel bricks. The NHCWB16 address calculation uses the final channel of the last accessed brick. If the channel depth modulo 16 is less than 15, the hardware will still read or write the full 16-element brick. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Reported-by: sashiko-bot@kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v3: - new patch --- drivers/accel/ethosu/ethosu_gem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 2707b7df5dbe..6f6712f4efd1 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -415,9 +415,10 @@ static u64 feat_matrix_length(struct ethosu_device *ed= ev, case 1: //nhcwb16: element_size =3D BIT((fm->precision >> (ofm ? 1 : 2)) & 0x3); =20 + /* NHCWB16 accesses the complete final channel brick. */ if (check_mul_overflow(c / 16, (u64)fm->stride_c, &offset) || check_add_overflow(addr, offset, &addr) || - check_mul_overflow(16 * x + (c & 0xf), element_size, &offset) || + check_mul_overflow(16 * x + 15, element_size, &offset) || check_add_overflow(addr, offset, &addr)) return U64_MAX; break; --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E7D8C57ED8E for ; Tue, 8 Sep 2026 22:05:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905108; cv=none; b=o/hWqU/WLNV70h+mSJZjO+Cs6ryki/+ki5iwqYU+4nsx4tk3QdgfaJi+kr/784EKuaseJCKXpMcFGS4nXOnIbXA0KAUePbTTzQxZKG73T5hWydBBgQApQ0UyN6dy3/CAADztofeYADoyGnM0TGCoB8GHID8mNkTJcKdvIoJPHSk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905108; c=relaxed/simple; bh=XbH+ElM+P2sPvM43Dt4k7TCdw/5sneGfblJvjtRdQww=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=JewglaAcl4621bfNThcFboRMVUkckkJEgV+0TvYMS+XzOcj5ET3o/AiKBWb5zpYDM2MzCnaG5kFoHifgiETf56bBqFvZ6JD8i435JwLcsGnzJDCgcm/hMwge6v0AJDfg2Zcq3AqrlGwgQP8HqsukiJcbxFKDj1sy42NxQI7MMng= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=GJDWz+zH; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="GJDWz+zH" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43FEE1F00A3D; Tue, 8 Sep 2026 22:05:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905106; bh=x1CU1YU3r6fb1ZoOvXn8W7FcD1J/3so288U26VwNAxk=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=GJDWz+zHAlm5DrOo/25nw6MPCjwXxJglSzCNHkRoRPgJNM0nMlEtewGPpm8ebFyRv 21u9+xQf/SM/ayQAtywjTfr9G1G8ng4+Qi1UwBO040nk9Kg6qJcjOXOfvn+sGEGd6o 8DfFb0tFQ19XYDxxIsv+p6IoeMOxfVsTmke55a4eVQGRTiAzyalFfru8mky23B1Qp5 mgEAh46DRBh13bx1kE3ZEmAgUySCanOHLWFPgW5JhYZKOabEP0l7V32DmPDacGcuqZ hMw6VDSQJHoZC/AdxTXxsfOu/NjWqV58/9YU84sxKB3uZbf7JJDwdm3nb7uw4dT2YG c7JxMNYgtCdhQ== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:48 -0500 Subject: [PATCH v3 11/22] accel: ethosu: Validate secondary streams Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-11-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The command-stream validator records the additional U65 scale and weight stream addresses and the U85 weight decoder addresses, but only checked stream 0 against its region buffer. Check every configured secondary stream against the matching weight or scale region before accepting a kernel operation. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - Adjust for register state tracking --- drivers/accel/ethosu/ethosu_gem.c | 33 ++++++++++++++++++++++++++++----- 1 file changed, 28 insertions(+), 5 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 6f6712f4efd1..abfb173e1008 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -436,13 +436,17 @@ static u64 feat_matrix_length(struct ethosu_device *e= dev, =20 static int buffer_size(struct ethosu_validated_cmdstream_info *info, struct cmd_state *st, struct buffer *buf, s8 region, - u16 region_cmd, u16 base_cmd, u16 length_cmd) + u16 region_cmd, u16 base_cmd, u16 length_cmd, bool optional) { u64 end; + bool base_set =3D cmd_state_reg_is_set(st, base_cmd); + bool length_set =3D cmd_state_reg_is_set(st, length_cmd); + + if (optional && !base_set && !length_set) + return 0; =20 if (region < 0 || !cmd_state_reg_is_set(st, region_cmd) || - !cmd_state_reg_is_set(st, base_cmd) || - !cmd_state_reg_is_set(st, length_cmd)) + !base_set || !length_set) return -EINVAL; =20 if (check_add_overflow(buf->base, (u64)buf->length, &end)) @@ -507,7 +511,20 @@ static int calc_sizes(struct drm_device *ddev, st->weight[0].base + st->weight[0].length - 1); if (buffer_size(info, st, &st->weight[0], st->weight[0].region, NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT_BASE, - NPU_SET_WEIGHT_LENGTH)) + NPU_SET_WEIGHT_LENGTH, false)) + return -EINVAL; + + if (buffer_size(info, st, &st->weight[1], st->weight[0].region, + NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT1_BASE, + NPU_SET_WEIGHT1_LENGTH, true) || + buffer_size(info, st, &st->weight[3], st->weight[0].region, + NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT3_BASE, + NPU_SET_WEIGHT3_LENGTH, true)) + return -EINVAL; + if (!ethosu_is_u65(edev) && + buffer_size(info, st, &st->weight[2], st->weight[0].region, + NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT2_BASE, + NPU_SET_WEIGHT2_LENGTH, true)) return -EINVAL; } =20 @@ -517,7 +534,13 @@ static int calc_sizes(struct drm_device *ddev, st->scale[0].base + st->scale[0].length - 1); if (buffer_size(info, st, &st->scale[0], st->scale[0].region, NPU_SET_SCALE_REGION, NPU_SET_SCALE_BASE, - NPU_SET_SCALE_LENGTH)) + NPU_SET_SCALE_LENGTH, false)) + return -EINVAL; + + if (ethosu_is_u65(edev) && + buffer_size(info, st, &st->scale[1], st->scale[0].region, + NPU_SET_SCALE_REGION, NPU_SET_SCALE1_BASE, + NPU_SET_SCALE1_LENGTH, true)) return -EINVAL; } =20 --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E1D15650EC for ; Tue, 8 Sep 2026 22:05:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905109; cv=none; b=UkKCsc0BMsKBeEARb3ZY7mQ4izlFgrBkm1U44gR5BHD+e0/Jlw5lYDHKM+hYhROpVTEnC96vMpwci94YL5N+IUM1RGsRC7KS+RvQ08iaGAGd9xdf8X0WX0sysUnuDPW1uX7CxNsgzm+DoWlJ2cOQGyNNPa617HPMYS04ytVtLRk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905109; c=relaxed/simple; bh=D0IVYPx+s/L006LL8Lo4pkh/8doqKmE/VvRQCs5lXCI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Bi5e+ExiY83IRfhG9OnB7G/ZBoPON0hsKQvOZpwdfa5ep0RFEql7Ajhf2KStj8kFEUe8ZbbLeV6qgUMRGFiS/qoB5xuOHI9PNBIHltEbYAFBtM7fZxzEu7cyPatdTdsAWTCdGN15oMME7whBCDmpSH1L/8KrzukfPJqnC4sF7MY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=BaNvvATV; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="BaNvvATV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7EBD11F00A3E; Tue, 8 Sep 2026 22:05:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905107; bh=PJfjk3HVbDnKacfZNk8oE66LNr679YyAwv2fhXFqBt8=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=BaNvvATVC+1DJIwFYdKEgZnDGqLXXTyED6xv6Bh/SrgaPn3hxD1bD1HZQILMfpVCC eoADNpRUXd0Jv6PziXrO/jq1LMl3qy76UrE71/YWJUAr9IvLSSWVB7D0zbz8j2AMjX 9OELfRGEW3lHhOFo9UXrj0FY3mghcBpP7Y93cuO4ElY0IZgACZ5Jbwm/FAQkxea0q6 0M1necsmNgW1ATcP16G/QJ6SibO0Neu+U/1gD2L1O/DGTM6fNMKY6+nn0goKM8m4WS d7mrnrvpckeCiUn8M4iDZVJ8ZoAcA95ZhKWS2qX1e26/hFoq+cglRnyzoMwn2r2ZR7 +oNI5lHjAG3CQ== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:49 -0500 Subject: [PATCH v3 12/22] accel: ethosu: Reject unsupported commands Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-12-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The command-stream validator does not model U85 branches, indexed DMA, or OFM transposes. A branch can bypass the linear validation state, indexed DMA accesses an unchecked index buffer, and a transpose changes the feature-map address calculation. Reject those commands and configurations, as well as the reserved DMA stride mode and feature-map formats. Reject command-stream IRQs because they can signal job completion before later commands finish. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - no changes --- drivers/accel/ethosu/ethosu_device.h | 4 ++++ drivers/accel/ethosu/ethosu_gem.c | 19 +++++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index 1eca8590e68d..c330048dbcca 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -86,14 +86,18 @@ struct gen_pool; #define PMU_EV_TYPE_CYCLES 0x11 #define PMU_EV_TYPE_IDLE 0x20 =20 +#define NPU_DMA_REGION_INDEX_MODE BIT(11) + enum ethosu_cmds { NPU_OP_STOP =3D 0x0, + NPU_OP_IRQ =3D 0x1, NPU_OP_CONV =3D 0x2, NPU_OP_DEPTHWISE =3D 0x3, NPU_OP_POOL =3D 0x5, NPU_OP_ELEMENTWISE =3D 0x6, NPU_OP_RESIZE =3D 0x7, // U85 only NPU_OP_DMA_START =3D 0x10, + NPU_OP_BRANCH =3D 0x4100, // U85 only NPU_SET_IFM_PAD_TOP =3D 0x100, NPU_SET_IFM_PAD_LEFT =3D 0x101, NPU_SET_IFM_PAD_RIGHT =3D 0x102, diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index abfb173e1008..5d4e89783139 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -652,6 +652,9 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, cmd_state_set_reg(&st, cmd); =20 switch (cmd) { + case NPU_OP_BRANCH: + case NPU_OP_IRQ: + return -EINVAL; case NPU_OP_STOP: if (i !=3D size / 4 - 1) return -EINVAL; @@ -745,6 +748,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, st.ifm.depth =3D param; break; case NPU_SET_IFM_PRECISION: + if (((param >> 6) & 0x3) > 1) + return -EINVAL; st.ifm.precision =3D param; break; case NPU_SET_IFM_BROADCAST: @@ -788,6 +793,10 @@ static int ethosu_gem_cmdstream_copy_and_validate(stru= ct drm_device *ddev, st.ofm.depth =3D param; break; case NPU_SET_OFM_PRECISION: + if (((param >> 6) & 0x3) > 1) + return -EINVAL; + if (!ethosu_is_u65(edev) && (param & GENMASK(13, 11))) + return -EINVAL; st.ofm.precision =3D param; break; case NPU_SET_OFM_REGION: @@ -822,6 +831,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, st.ifm2.broadcast =3D param; break; case NPU_SET_IFM2_PRECISION: + if (((param >> 6) & 0x3) > 1) + return -EINVAL; st.ifm2.precision =3D param; break; case NPU_SET_IFM2_REGION: @@ -896,18 +907,26 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, break; =20 case NPU_SET_DMA0_SRC_REGION: + if (param & NPU_DMA_REGION_INDEX_MODE) + return -EINVAL; if (param & 0x100) st.dma.src.region =3D -1; else st.dma.src.region =3D param & 0x7; st.dma.src.mode =3D (param >> 9) & 0x3; + if (st.dma.src.mode =3D=3D 3) + return -EINVAL; break; case NPU_SET_DMA0_DST_REGION: + if (param & NPU_DMA_REGION_INDEX_MODE) + return -EINVAL; if (param & 0x100) st.dma.dst.region =3D -1; else st.dma.dst.region =3D param & 0x7; st.dma.dst.mode =3D (param >> 9) & 0x3; + if (st.dma.dst.mode =3D=3D 3) + return -EINVAL; break; case NPU_SET_DMA0_SIZE0: st.dma.size0 =3D param; --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 00558581236 for ; Tue, 8 Sep 2026 22:05:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905111; cv=none; b=BzA3q29Bxn9ac5S5tu2I6VbPDlyjld5Qg+AmLyjB9WHVn+CuLHm+FKZvkyPh2gHpQU56NyYBdqsEALx/cTQZuBEtVx70r0CEQqzTS6zh5rqG6gXLQjPSLTMM4xiw54Tv7BCt1UPbwJRWXrs+xeVo7xsoRRd12Fo9vcoqXPlyGIo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905111; c=relaxed/simple; bh=sfQhAvFPhwIa+sk343JXpyAwj/i+oOsLW5CDXTog1Oc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=bWErIfoUC9GJNzlF/cdhBY9ESjnQnOsdvAUTf5iJ4qvgXjmiVhn9/9Wc0p1zhVgf1BU1usuOxXl2XiPXwkq37xJOcwB08d/Gwm7nyrK12Kqq/rYf5GsTjNsRhMDb85RoVXpLruT+QnbnMO5KWeM2g45O8vidoTyOrRLvtT4AqAM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=mGb2tNyz; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="mGb2tNyz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A467B1F00A3F; Tue, 8 Sep 2026 22:05:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905108; bh=wQ38CeQVxfxCLL11wS5WjaU8X5ollLIrbqI1T/Ql4J0=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=mGb2tNyzS1M+C2XxcIPZivNu8WtLXWOaN1QOG6/nWedtoocl/gV1PVAZZG7IxZM92 j84G4P3gtRPG5hulnW7pMZFQQHWhP8h7wRYKKfk6jupaYhWV6JCqjWWiI3mblJJ7Zj scYj73vO2o9VV7YKGizqSu2G+d0RUfc9I+uS8PtQzpNgb2yqkZuD4ppPRcEuSkSdmH dnljEyPZRRLAQrl5PA4hWyZm2dcP0fbCeZvit6AlYA0kFC2XH6UzP1/I5AZkXv5KmM zk9hZsxEsYiwDAgRYe9gZV6K+D6n5uwGSumGZvI31MMzPPAbNWdajuBfZuCWIulYJa mzqwPYoo63KMw== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:50 -0500 Subject: [PATCH v3 13/22] accel: ethosu: Validate all feature map tiles Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-13-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The command-stream validator checked only the final feature-map coordinate. For tiled tensors, this can leave an earlier tile base address unchecked even though the operation accesses it. Check the final coordinate of every tile touched by an operation. Also treat U65 feature maps as 2x2 tiled: its precision rounding bits are not the U85 storage encoding. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v3: - Fix for storage mode 0 intermediate tile calculations v2: - no changes --- drivers/accel/ethosu/ethosu_gem.c | 145 ++++++++++++++++++++++++++++++----= ---- 1 file changed, 117 insertions(+), 28 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 5d4e89783139..11aa3f4dd0e7 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -434,6 +434,94 @@ static u64 feat_matrix_length(struct ethosu_device *ed= ev, return addr; } =20 +static int feat_matrix_check_location(struct ethosu_device *edev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st, struct feat_matrix *fm, + enum feat_matrix_type type, u32 x, u32 y, + u32 c, bool ofm, u64 *max_len) +{ + u64 len; + + len =3D feat_matrix_length(edev, info, st, fm, type, x, y, c, ofm); + if (len =3D=3D U64_MAX) + return -EINVAL; + + *max_len =3D max(*max_len, len); + return 0; +} + +static int feat_matrix_size(struct ethosu_device *edev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st, struct feat_matrix *fm, + enum feat_matrix_type type, + u32 x, u32 y, u32 c, bool ofm, u64 *max_len) +{ + u32 storage =3D ethosu_is_u65(edev) ? 0 : fm->precision >> 14; + int ret; + + *max_len =3D 0; + + if (storage =3D=3D 0) { + ret =3D feat_matrix_check_location(edev, info, st, fm, type, 0, 0, + c, ofm, max_len); + if (ret) + return ret; + + ret =3D feat_matrix_check_location(edev, info, st, fm, type, + min(x, (u32)fm->width0), + min(y, (u32)fm->height[0]), c, ofm, + max_len); + if (ret) + return ret; + + if (fm->width0 < x) { + ret =3D feat_matrix_check_location(edev, info, st, fm, type, x, + min(y, (u32)fm->height[1]), c, + ofm, max_len); + if (ret) + return ret; + } + + if (fm->height[0] < y) { + ret =3D feat_matrix_check_location(edev, info, st, fm, type, + min(x, (u32)fm->width0), y, c, + ofm, max_len); + if (ret) + return ret; + } + + if (fm->width0 < x && fm->height[1] < y) + return feat_matrix_check_location(edev, info, st, fm, type, + x, y, c, ofm, max_len); + + return 0; + } + + if (storage =3D=3D 1) { + ret =3D feat_matrix_check_location(edev, info, st, fm, type, x, 0, c, + ofm, max_len); + if (ret) + return ret; + if (fm->height[0] < fm->height[1] && fm->height[1] <=3D y) { + ret =3D feat_matrix_check_location(edev, info, st, fm, type, x, + fm->height[1], c, ofm, + max_len); + if (ret) + return ret; + } + if (fm->height[1] < y) { + ret =3D feat_matrix_check_location(edev, info, st, fm, type, x, + fm->height[1] + 1, c, ofm, + max_len); + if (ret) + return ret; + } + } + + return feat_matrix_check_location(edev, info, st, fm, type, x, y, c, ofm, + max_len); +} + static int buffer_size(struct ethosu_validated_cmdstream_info *info, struct cmd_state *st, struct buffer *buf, s8 region, u16 region_cmd, u16 base_cmd, u16 length_cmd, bool optional) @@ -464,6 +552,7 @@ static int calc_sizes(struct drm_device *ddev, { struct ethosu_device *edev =3D to_ethosu_device(ddev); u64 len; + int ret; =20 if (ifm) { if (!cmd_state_reg_is_set(st, NPU_SET_KERNEL_WIDTH_M1) || @@ -486,23 +575,22 @@ static int calc_sizes(struct drm_device *ddev, if (ifm_height < 0 || ifm_width < 0) return -EINVAL; =20 - len =3D feat_matrix_length(edev, info, st, &st->ifm, - FEAT_MATRIX_IFM, ifm_width, ifm_height, - st->ifm.depth, false); + ret =3D feat_matrix_size(edev, info, st, &st->ifm, FEAT_MATRIX_IFM, + ifm_width, ifm_height, st->ifm.depth, false, + &len); dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", op, st->ifm.region, st->ifm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 if (ifm2) { - len =3D feat_matrix_length(edev, info, st, &st->ifm2, - FEAT_MATRIX_IFM2, st->ifm.depth, 0, - st->ofm.depth, false); + ret =3D feat_matrix_size(edev, info, st, &st->ifm2, FEAT_MATRIX_IFM2, + st->ifm.depth, 0, st->ofm.depth, false, &len); dev_dbg(ddev->dev, "op %d: IFM2:%d:0x%llx-0x%llx\n", op, st->ifm2.region, st->ifm2.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 if (weight) { @@ -544,13 +632,13 @@ static int calc_sizes(struct drm_device *ddev, return -EINVAL; } =20 - len =3D feat_matrix_length(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, - st->ofm.width, st->ofm.height[2], st->ofm.depth, - true); + ret =3D feat_matrix_size(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, + st->ofm.width, st->ofm.height[2], st->ofm.depth, + true, &len); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; if (!feat_matrix_chained(edev, &st->ofm)) info->output_region[st->ofm.region] =3D true; =20 @@ -565,18 +653,19 @@ static int calc_sizes_elemwise(struct drm_device *dde= v, struct ethosu_device *edev =3D to_ethosu_device(ddev); u32 height, width, depth; u64 len; + int ret; =20 if (ifm) { height =3D st->ifm.broadcast & 0x1 ? 0 : st->ofm.height[2]; width =3D st->ifm.broadcast & 0x2 ? 0 : st->ofm.width; depth =3D st->ifm.broadcast & 0x4 ? 0 : st->ofm.depth; =20 - len =3D feat_matrix_length(edev, info, st, &st->ifm, - FEAT_MATRIX_IFM, width, height, depth, false); + ret =3D feat_matrix_size(edev, info, st, &st->ifm, FEAT_MATRIX_IFM, + width, height, depth, false, &len); dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", op, st->ifm.region, st->ifm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 if (ifm2) { @@ -584,21 +673,21 @@ static int calc_sizes_elemwise(struct drm_device *dde= v, width =3D st->ifm2.broadcast & 0x2 ? 0 : st->ofm.width; depth =3D st->ifm2.broadcast & 0x4 ? 0 : st->ofm.depth; =20 - len =3D feat_matrix_length(edev, info, st, &st->ifm2, - FEAT_MATRIX_IFM2, width, height, depth, false); + ret =3D feat_matrix_size(edev, info, st, &st->ifm2, FEAT_MATRIX_IFM2, + width, height, depth, false, &len); dev_dbg(ddev->dev, "op %d: IFM2:%d:0x%llx-0x%llx\n", op, st->ifm2.region, st->ifm2.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; } =20 - len =3D feat_matrix_length(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, - st->ofm.width, st->ofm.height[2], st->ofm.depth, - true); + ret =3D feat_matrix_size(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, + st->ofm.width, st->ofm.height[2], st->ofm.depth, + true, &len); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); - if (len =3D=3D U64_MAX) - return -EINVAL; + if (ret) + return ret; if (!feat_matrix_chained(edev, &st->ofm)) info->output_region[st->ofm.region] =3D true; =20 --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3EDD85A0AA3 for ; Tue, 8 Sep 2026 22:05:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905111; cv=none; b=Bu4VuGX2UAQFIZ49jcYK/RLGwooyo9gjUGmqel6iYr8mKjGuPSODqCRglFGzRobAyEeHpNXwGzr/AXGxD+zbZBToyYYcotRi/qF7Ad5mtyVf1vbdAlqWj3X/xawsBcDvCqTyg0nZrgpDyC1v8OnETmF4XlpKyo1ALygNd8uVDVA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905111; c=relaxed/simple; bh=zwsT/pnGyFspWzYneumucjHa2ZlO3sfy0p84Molq83Y=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=c3Nx9y4p3GRD64+SJntdVpiPOpKFBORCECnY3kCl5aXGEV0LZBg6hp617DZwr5hj8T2CRB3uTqWbR8o0Mi4YUNPiNJRQnPOnF6wCbvrFOzSbhcEGF2gr5WXGMK/hdjK4F5jLfjm4JGtxlx0HOHaQYqlR51H/Av3TuYlyHk2a2UY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Vx8Knk28; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Vx8Knk28" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF07D1F00A3A; Tue, 8 Sep 2026 22:05:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905110; bh=81+2lTuoLtNrrFz1cjX0UEXbYP1lwwUoV5MIK36Dgqc=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Vx8Knk28Kc8ND3QWDC+qXD1kMPPNCkoFWn2f2bq+y2Y01KjrSASkxa+vvAJEpDuiG hkOprJXcJgAaduSVt/U4DDEXe5wtxsWX8Iv+CqhtkbG/AeeDpswA31fA3iHOFReiXb J0c8QaQJYkS9FVw+sAYrXSuL/7rgioC2LruYeWkAE4Rb7xPhmB1hMEXwqAnEnk/5r3 k2yqu1fkFSr6/CT5AAPUjnJX9oBPVK6goQLW/PtNAgzftq1qzTqdbvLWFvTkF0uxEp wYgbdGoMZi38LcNkxKESa0elzDjITzU7Npb6XmtzxRR8HubCwX6g6YnP9mW/gEgtW7 NKA6p3rq0U5Dw== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:51 -0500 Subject: [PATCH v3 14/22] accel: ethosu: Account for feature map element size Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-14-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The feature map bounds calculation currently accounts for only one byte of the final element. This can leave the tail of B16, B32, and B64 elements outside the validated buffer. Use the feature map element size when calculating the final byte. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_gem.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 11aa3f4dd0e7..974cf562ef49 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -426,7 +426,7 @@ static u64 feat_matrix_length(struct ethosu_device *ede= v, return U64_MAX; } =20 - if (check_add_overflow(addr, 1ULL, &offset)) + if (check_add_overflow(addr, (u64)element_size, &offset)) return U64_MAX; =20 info->region_size[fm->region] =3D max(info->region_size[fm->region], offs= et); --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68F6E5A984C for ; Tue, 8 Sep 2026 22:05:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905112; cv=none; b=IIxth+mf5N8PzTPRUIBIiTrs1jT0Y0bZOIdpX2B+FG/iBllS0vGcZFfEZcLQvMzNw2CE4B3jYJTNnkwC6pWtq/IQQIHORfYL0Wl9RCrQ4Kgj2z7cnN+hqHV+SMllASBEqJeYznnObAb0ZYWnD5j4j3SMmcpxMmx41/Rdxp70jtw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905112; c=relaxed/simple; bh=0jmRBkJRVQ+tKVOMAA9UYqvR+5po1RMjjJH4m5UVaAo=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=dSexLJvXH1M2aJrxw4VvviQ2Fk4EuTPVzzDDT5+icbr3TsiOcmezNlYAR4Ld+q+SVaCkV6je4yG0eR9TnNc7NmJpG/SWexlGVuRZs4hC5y5nnY3rLpAPADiUgqzX9XSf85gSw5n6tA+kNIO9yabXPQNUuNR8WqvPPlgWFAiKocY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Io/FoVmV; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Io/FoVmV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 196911F00A3D; Tue, 8 Sep 2026 22:05:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905111; bh=uyB42ZmQyZPlt1IJ4g+w6zDkaYw4xb65yD2EjFjyBOU=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Io/FoVmVXznOZYV0Ts5fPiDSlsENBvaOgtw0hiMurzAkUT2uoiL9+OppOcJy1H95L Qy0VBvNcFNXbS5LTKmLUAU8fwCFL18pnlcarY67SIaw763fSFh35iHAxj7cleIpL+T H8Tr/TnN7tKy14fHYG3Sr8Q4lw6C8v19CxxG+gRdnyct2QsgiOpSWASP9OWSiGsN16 ZIOXBCLck59wxa+1bwlx2X7nuB7kW/VGIRH0WhVSpv7HNtdXiXDh1cQujJ/65Vut4w gAAabslNO9K1f1pg/h6Kvkv+tV5TM5vczpsAOcFpbkMtufDsoxB+I4DoKC6gkA0NSU 7jnZJxRlgHK0A== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:52 -0500 Subject: [PATCH v3 15/22] accel: ethosu: Validate convolution parameter Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-15-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The U65 NPU_OP_CONV command has no parameter fields, but the validator interpreted bit zero as the U85 weights_ifm2 field. A crafted U65 stream could consequently make validation skip the weight buffer that hardware accesses. Require a zero parameter on U65 and reject the reserved U85 parameter bits. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_device.h | 1 + drivers/accel/ethosu/ethosu_gem.c | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index c330048dbcca..d7e1e3c8ca12 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -87,6 +87,7 @@ struct gen_pool; #define PMU_EV_TYPE_IDLE 0x20 =20 #define NPU_DMA_REGION_INDEX_MODE BIT(11) +#define NPU_OP_CONV_WEIGHTS_IFM2 BIT(0) =20 enum ethosu_cmds { NPU_OP_STOP =3D 0x0, diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 974cf562ef49..9c86f9062f55 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -764,7 +764,10 @@ static int ethosu_gem_cmdstream_copy_and_validate(stru= ct drm_device *ddev, st.dma.dst.region, st.dma.dst.offset, dstlen); break; case NPU_OP_CONV: - use_ifm2 =3D param & 0x1; // weights_ifm2 + if ((ethosu_is_u65(edev) && param) || (param & ~NPU_OP_CONV_WEIGHTS_IFM= 2)) + return -EINVAL; + + use_ifm2 =3D param & NPU_OP_CONV_WEIGHTS_IFM2; if (!cmd_state_reg_is_set(&st, NPU_SET_OFM_PRECISION)) return -EINVAL; use_scale =3D !(st.ofm.precision & 0x100); --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8FFF859B67F for ; Tue, 8 Sep 2026 22:05:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905113; cv=none; b=PBz1B/SLdg/FDImn9zfZBpWh4f3crrdOSMoWSDXpGk50WdDMjddlwEBFyj8XFi9Al9S/at+w2Ay1eeYzeWWyqiRfoiqVQZPcHfIiQBKuhaIZNKDbRECOLSdLcVg/4LymZ8vWglRUdUR6Tv/ByUsqQIUIf483K5IqUt1UB4sAmEM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905113; c=relaxed/simple; bh=ViYnDclAaYkDXinYD9Si1bmAVW5kTf756dmZcXP29gE=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=JnILaDkeqHoYFQ2vELNMwaaR8CjJW4ZzV7Ms9f6TTiYy1Np8RhPQ/enqQ+bELMeddxx8DyHUzysplVkz3xnFJTfHe5zbDTRSyt8AQBB2VsAFI60PK2Bf5C2LNj9ztr9/rXwNfXyQaAs1hr81tYZ8yZxi1Rlp2UmtbCTUsY9angQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=iGqTIJBT; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="iGqTIJBT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 455B01F00A3A; Tue, 8 Sep 2026 22:05:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905112; bh=ixbXO59RWk0QWsLMam6PsqGUwplyTBwXbjm2NXGcMBo=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=iGqTIJBTOoO4iFzQOL7qU2RABOnuX3VbAyTBRcQYDac8juIWtJ833Mmvl7Tb8q3M6 rvqk8IN3Zcy71mSb0yCKyPKfz/iART9Un0OmASwxppFVvB8dWltOPKMa9reGiZUNtk s2GWXLMOA1EwX7k8E5cQ7x2fP/uNgScHiLgbRtipbJNnnuZrud0sn5ARR6OLgvJNW4 o0TuKiCBbnQjQabHdvRojQmEEYhGyaCh75g7Gm1t2XYNw/xsKbNguZzeCgIH/2kn2E 6MNBR3/B09i3hZd54kK7KCth9fOXIaZc5IQtnwNDJBWvIBjf/zVOVZQamJJ6YHhAbM H/SZaXPTEAItQ== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:53 -0500 Subject: [PATCH v3 16/22] accel: ethosu: Account for kernel dilation in IFM size Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-16-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Kernel dilation increases the input feature-map area accessed by a kernel operation. Include the x and y dilation settings when calculating the required IFM bounds. Without this, a command stream using x2 dilation can access IFM memory past the range validated by the driver. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_device.h | 2 ++ drivers/accel/ethosu/ethosu_gem.c | 10 ++++++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index d7e1e3c8ca12..8e23fdbf7f8a 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -88,6 +88,8 @@ struct gen_pool; =20 #define NPU_DMA_REGION_INDEX_MODE BIT(11) #define NPU_OP_CONV_WEIGHTS_IFM2 BIT(0) +#define NPU_KERNEL_DILATION_X BIT(3) +#define NPU_KERNEL_DILATION_Y BIT(4) =20 enum ethosu_cmds { NPU_OP_STOP =3D 0x0, diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 9c86f9062f55..578d1b5b955c 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -567,10 +567,16 @@ static int calc_sizes(struct drm_device *ddev, ((st->ifm.stride_kernel >> 1) & 0x1) + 1; u32 stride_x =3D ((st->ifm.stride_kernel >> 5) & 0x2) + (st->ifm.stride_kernel & 0x1) + 1; + u32 dilation_y =3D 1 + !!(st->ifm.stride_kernel & + NPU_KERNEL_DILATION_Y); + u32 dilation_x =3D 1 + !!(st->ifm.stride_kernel & + NPU_KERNEL_DILATION_X); s32 ifm_height =3D st->ofm.height[2] * stride_y + - st->ifm.height[2] - (st->ifm.pad_top + st->ifm.pad_bottom); + st->ifm.height[2] * dilation_y - + (st->ifm.pad_top + st->ifm.pad_bottom); s32 ifm_width =3D st->ofm.width * stride_x + - st->ifm.width - (st->ifm.pad_left + st->ifm.pad_right); + st->ifm.width * dilation_x - + (st->ifm.pad_left + st->ifm.pad_right); =20 if (ifm_height < 0 || ifm_width < 0) return -EINVAL; --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B07335AA668 for ; Tue, 8 Sep 2026 22:05:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905115; cv=none; b=CGSm5Bng/MtNtP804cJoNlg73QX3p4nPya6sGW7XPF3J0PutGruLZhJX0E+6RaKJ3ifVSA34RZEyluBijOzv9sXPYVDT7g/2fP3z1SpDT+HdlqsnogVlG7U1rQbIwjJ+hTcZOwUn+AiZ8SSs3/ujZaS/NQvdndTFAHFUNSPYqBw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905115; c=relaxed/simple; bh=5cy2w482j7GDHGCDyO1M1GrR4ueMaCSgw5sYMoLH1eM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=AxtzPP/8IuVYVczzHjBqNNMUr1qXY1vIpvbSPqgOg6cFrKbdjdidSfWgg86JF8NR90HBS3ry2HgDHFu232TbyydO16fxxJ35Qon54FhL+7TNTZWYb4PanVybj6lgrD5VE2+KTkaergxRtfOb6PhOi8lPzJ9rc578VluGJo4fYX0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=WSwgjDQo; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="WSwgjDQo" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53F3A1F00A3D; Tue, 8 Sep 2026 22:05:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905113; bh=23Vj12u5uLbYesugUdSCoTd9GIaMsirFDh+buPYQwfY=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=WSwgjDQoUcNDnpymdNQ8lHmy/aDUEZqJvuJg6XgjfJW0VLmi5L+ecJqoYllmxrCYE HBDIKPcKV6ga/Cr+cYKO/x/bFPI6thhg92SCFE1GaATiBVwBj9PNd97p5vnMgA2p3A taexFKrekUANqXEmw2sMvEpxfQ1ioqo/nETX4e1li0SKeBgARpMosHOJhyNMO1bXRy Ws+4yflhSZm1DXYMh1j+I3vEnWc+IOveFfPPzfxNlGNKS//hNWgXe3smIG9n72/lGb FvWwO++9RH6+LJ4s6cFN426iu1WXHXrJRt4BNDDgK+FLVNKQVq/p3GaPnTeIB5d4s9 AvfkGwx6xE8EA== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:54 -0500 Subject: [PATCH v3 17/22] accel: ethosu: Reject reserved command encodings Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-17-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The command stream contains a 10-bit opcode and a two-bit command control field. Reject reserved opcode and control encodings in the switch default case so they cannot be interpreted differently by the validator and hardware. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_device.h | 3 +++ drivers/accel/ethosu/ethosu_gem.c | 12 +++++++----- 2 files changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index 8e23fdbf7f8a..68e2969b6f79 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -91,6 +91,9 @@ struct gen_pool; #define NPU_KERNEL_DILATION_X BIT(3) #define NPU_KERNEL_DILATION_Y BIT(4) =20 +#define NPU_CMD_CTRL_CMD1 BIT(14) +#define NPU_CMD_RESERVED_MASK (BIT(15) | GENMASK(13, 10)) + enum ethosu_cmds { NPU_OP_STOP =3D 0x0, NPU_OP_IRQ =3D 0x1, diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 578d1b5b955c..f4bd31018e56 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -170,9 +170,9 @@ static void cmd_state_init(struct cmd_state *st) =20 static void cmd_state_set_reg(struct cmd_state *st, u16 cmd) { - u16 reg =3D cmd & ~BIT(14); + u16 reg =3D cmd & ~NPU_CMD_CTRL_CMD1; =20 - if (cmd & BIT(14)) { + if (cmd & NPU_CMD_CTRL_CMD1) { if (reg < NPU_CMD1_REGS) __set_bit(reg, st->cmd1); } else if (reg < NPU_CMD0_REGS) { @@ -182,9 +182,9 @@ static void cmd_state_set_reg(struct cmd_state *st, u16= cmd) =20 static bool cmd_state_reg_is_set(struct cmd_state *st, u16 cmd) { - u16 reg =3D cmd & ~BIT(14); + u16 reg =3D cmd & ~NPU_CMD_CTRL_CMD1; =20 - if (cmd & BIT(14)) + if (cmd & NPU_CMD_CTRL_CMD1) return reg < NPU_CMD1_REGS && test_bit(reg, st->cmd1); =20 return reg < NPU_CMD0_REGS && test_bit(reg, st->cmd0); @@ -733,7 +733,7 @@ static int ethosu_gem_cmdstream_copy_and_validate(struc= t drm_device *ddev, cmd =3D cmds[0]; param =3D cmds[0] >> 16; =20 - if (cmd & 0x4000) { + if (cmd & NPU_CMD_CTRL_CMD1) { if (get_user(cmds[1], ucmds++)) return -EFAULT; =20 @@ -1054,6 +1054,8 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, st.dma.src.len =3D st.dma.dst.len =3D addr; break; default: + if (cmd & NPU_CMD_RESERVED_MASK) + return -EINVAL; break; } } --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F7E35AA695 for ; Tue, 8 Sep 2026 22:05:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905117; cv=none; b=SJG5XVtxl5qBrUX3tK0c1AWK/XN790eK9iEpLA2zeYq7xD4O61vEVpS6QXrJzUvGwuUJ9eq5MUfWG4cxa6zTopXtyjt6AceZL8pXYpD7MC8n/ClFabOSiuEXj+LH/43Vog3iY/QKWTaNCIlRTO4Xt8hq6hzVWIpSj/aDpDXw3Fs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905117; c=relaxed/simple; bh=TEGCY1oSZn0wBN6NqrVGkn6X0iPUooWENZh6XAJ4RNM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=ciDaJUE2b3arNWXug5jwb5Sx8uOUQQM7jWjhH261KOj9NZhfuYhGsD6ZTb6nfBRHVjQ8hvlJyTrpLEnuLWVnGOTxuiZLp10j38P9PJFVoYmkYmpiSU76XoMbdy7PAprbElTWNI+C8tS4WjRHgO/HUeMbFxqRqHZYDwMyYGBCkfA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Wr/jO7OO; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Wr/jO7OO" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AE4AF1F00A3A; Tue, 8 Sep 2026 22:05:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905115; bh=PdV0AOoH1dpzqPdrrBZkkma6g3SaDeLzWLyMXKL4BJw=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Wr/jO7OOuNWyZiWRnnb7E0eWmFIRBu/sU/4l7uqgsGY3+RfIb7gXXu4+OUT1Z9UGn d7Ds4QEDklaq0hmIFpt+nr4ECVM0LsNPdofoH1CaIOVTq3g3xS2VmEAujs2ToRYbDb d+OYYkb8gq14aSopL5ZAO+aYOSY0b+oVWLV9V9laOjwcoMklZ53H6xwBAtWeqvOMgw rgp4i2FWyh+JtK9Md+sB/dQrCTLTauDagaDbKxOG5BDYT5NiplAAnlVFs/h9Z4nHGX TcZHenRiNMMDeiYfOGd8HEY/CSSd641yON8FA9YS4WS+NVWh8SDrA2pf/1Jad7ZO7+ Hd13DZgQ3/6jQ== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:55 -0500 Subject: [PATCH v3 18/22] accel: ethosu: Validate accumulator input Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-18-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The U85 ACC_FORMAT command can select IFM2 as the accumulator input. This is used by null-pool operations and can also be used by convolution. Track this selection and validate the IFM2 feature map against the OFM extent before submitting the operation. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_device.h | 4 ++++ drivers/accel/ethosu/ethosu_gem.c | 42 ++++++++++++++++++++++++++++++++= ++++ 2 files changed, 46 insertions(+) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index 68e2969b6f79..6b9d093d73e6 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -126,6 +126,7 @@ enum ethosu_cmds { NPU_SET_KERNEL_WIDTH_M1 =3D 0x120, NPU_SET_KERNEL_HEIGHT_M1 =3D 0x121, NPU_SET_KERNEL_STRIDE =3D 0x122, + NPU_SET_ACC_FORMAT =3D 0x124, NPU_SET_WEIGHT_REGION =3D 0x128, NPU_SET_SCALE_REGION =3D 0x129, NPU_SET_DMA0_SRC_REGION =3D 0x130, @@ -180,6 +181,9 @@ enum ethosu_cmds { NPU_SET_WEIGHT3_LENGTH =3D 0x4095, }; =20 +#define NPU_ACC_FORMAT_INPUT_MASK GENMASK(5, 4) +#define NPU_ACC_INPUT_IFM2 2 + #define ETHOSU_SRAM_REGION 2 /* Matching Vela compiler */ =20 struct ethosu_perfmon; diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index f4bd31018e56..632a2352491a 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -155,6 +155,7 @@ struct feat_matrix { struct cmd_state { DECLARE_BITMAP(cmd0, NPU_CMD0_REGS); DECLARE_BITMAP(cmd1, NPU_CMD1_REGS); + bool acc_input_ifm2; struct dma_state dma; struct buffer scale[2]; struct buffer weight[4]; @@ -522,6 +523,32 @@ static int feat_matrix_size(struct ethosu_device *edev, max_len); } =20 +static int +calc_acc_input_size(struct drm_device *ddev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st) +{ + struct ethosu_device *edev =3D to_ethosu_device(ddev); + u64 len; + int ret; + + if (!ethosu_is_u65(edev) && + !cmd_state_reg_is_set(st, NPU_SET_ACC_FORMAT)) + return -EINVAL; + + if (!st->acc_input_ifm2) + return 0; + + /* The accumulator has one input value for each OFM element. */ + ret =3D feat_matrix_size(edev, info, st, &st->ifm2, + FEAT_MATRIX_IFM2, st->ofm.width, + st->ofm.height[2], st->ofm.depth, false, &len); + dev_dbg(ddev->dev, "ACC IFM2:%d:0x%llx-0x%llx\n", + st->ifm2.region, st->ifm2.base[0], len); + + return ret; +} + static int buffer_size(struct ethosu_validated_cmdstream_info *info, struct cmd_state *st, struct buffer *buf, s8 region, u16 region_cmd, u16 base_cmd, u16 length_cmd, bool optional) @@ -643,6 +670,9 @@ static int calc_sizes(struct drm_device *ddev, true, &len); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); + if (ret) + return ret; + ret =3D calc_acc_input_size(ddev, info, st); if (ret) return ret; if (!feat_matrix_chained(edev, &st->ofm)) @@ -692,6 +722,9 @@ static int calc_sizes_elemwise(struct drm_device *ddev, true, &len); dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", op, st->ofm.region, st->ofm.base[0], len); + if (ret) + return ret; + ret =3D calc_acc_input_size(ddev, info, st); if (ret) return ret; if (!feat_matrix_chained(edev, &st->ofm)) @@ -830,6 +863,15 @@ static int ethosu_gem_cmdstream_copy_and_validate(stru= ct drm_device *ddev, case NPU_SET_KERNEL_STRIDE: st.ifm.stride_kernel =3D param; break; + case NPU_SET_ACC_FORMAT: + if (!ethosu_is_u65(edev)) { + u32 acc_input =3D FIELD_GET(NPU_ACC_FORMAT_INPUT_MASK, param); + + if (acc_input > NPU_ACC_INPUT_IFM2) + return -EINVAL; + st.acc_input_ifm2 =3D acc_input =3D=3D NPU_ACC_INPUT_IFM2; + } + break; case NPU_SET_IFM_PAD_TOP: st.ifm.pad_top =3D param & 0x7f; break; --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 498EE58FD03 for ; Tue, 8 Sep 2026 22:05:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905118; cv=none; b=OwDK1wnb/q3cHE+aJAk/RhIOkLItgPEbZY7KJ9QHeJFbmF+Q/i+NYHUdo3n4awmDzPvkgkWYhbUaJsk/A8M6j8olibA3JEBLz1ueKsfg9pmK6ZFhhU6VD7OhEjQ0wDGgChfL9sPMx6HnbDXBLpC5MKokeopIO1xv3b38EZMthco= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905118; c=relaxed/simple; bh=buld4M1eIUiFG5ErgnoIgdkW3xN4wuZw2Raf5W7Z4JY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=powG11XUYgMY5ycBLQ4NVwpE1kGFe1oZuDEGgPBAC9Kh0i1RY/HERdGbEULpxHxjSe7Ng6GDa3l3cM+6nO/sAG4GJdNayo0Az+GW4BGuZKeMMEH76uyztfEWiukextF4fZDtB4wB97Qr9ygRUonb5QN8iBYoezqniBqNwQuLT2A= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=d1PMoXaI; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="d1PMoXaI" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CB81A1F00A3F; Tue, 8 Sep 2026 22:05:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905117; bh=U6w7FzzToBcqLrZZeveYx7xMc69WBjwh8N7NR4MDbeA=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=d1PMoXaIpksor+CnaYLxqVc0kxzQ+XNpq9T3fkhmwXCtJd8Ex4EKXqKLH57u/TaKN b08d+xHY//I6+aZvQsXmx25YS9PVZaVqhNi3AjTkbZqxMpUd+IlS3sFH4+DSL1S0kr AjWTjBHrbGYcARWiZ5E1lv3DFTZ/X9adRZM3lp7k37JVynMdnbc7bR08uJdXF3rm7o VwmKSih6MEvq3J0JvDj5Oeilh2w1Z1cZarN2M5IermWxjmvCE2nKf6XHmqr+yUM6GM eD2V43y+uT00nWpearw5QiXrfDj1CnbfgliGKJs5pc7n4Ci/zUeD66PFiTo7AU/IDt PqIfvsooFhGlA== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:56 -0500 Subject: [PATCH v3 19/22] accel: ethosu: Restrict dynamic IFM2 weights Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-19-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev The validator bounds dynamic IFM2 weights as a 1x1 weight matrix, but did not enforce the corresponding kernel shape. A larger crafted kernel could make the NPU access beyond the validated IFM2 feature map. Reject dynamic-weight convolutions whose kernel is not 1x1. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - new patch --- drivers/accel/ethosu/ethosu_gem.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 632a2352491a..df26ccd50a96 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -590,6 +590,9 @@ static int calc_sizes(struct drm_device *ddev, !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_RIGHT) || !cmd_state_reg_is_set(st, NPU_SET_IFM_PAD_BOTTOM)) return -EINVAL; + /* Dynamic IFM2 weights are only supported for 1x1 convolutions. */ + if (ifm2 && (st->ifm.width || st->ifm.height[2])) + return -EINVAL; u32 stride_y =3D ((st->ifm.stride_kernel >> 8) & 0x2) + ((st->ifm.stride_kernel >> 1) & 0x1) + 1; u32 stride_x =3D ((st->ifm.stride_kernel >> 5) & 0x2) + --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E0DD5AEC48 for ; Tue, 8 Sep 2026 22:05:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905119; cv=none; b=e4JzkdeAreVe/Uw/sDVcgKD/RP76qfMQC5A/X3BwBRS6j0Z+GmyVK9qGcOPDZbwolwL9zWhNEhWvhbib2/PWue9kZladSO11QSGZgSxSADMhtV65Raz9GWcFfG9kWlNDUCIzrTUebemyZOeD2U2Wz8RAgbZQ9vSpmhJTbCdlcVU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905119; c=relaxed/simple; bh=HJh1R7SejY4Q2lRhBd07mQH/N6j1dCRwvRwv2GLT96U=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=EUoMWgoFfHXKogqDM/JMWZqlkOejgCDxicvyQsz7kEiuJlnyFx5xWlN7eWktAZXQ+6GO2bRqGexiPCtoFpqTNsFybiP+QMcEI511ljcE1QznRAf/zBZC4bClvgM747HaWW+tWa+VjCGpc6JiuP0X8aPUyETJ4n6qKzSLddDVXPc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bN9Gi6dD; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bN9Gi6dD" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E78AC1F00A3D; Tue, 8 Sep 2026 22:05:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905118; bh=/PMxlOlJmhWneaMxKb4QJrl9dOPgJlMhSq6rhV9wd4E=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=bN9Gi6dDg6wzRuzOyi1Hck23I23JShNFF8gQZftbgeutcPZpa63W/2ccRUGWhhK1K 7Yi7XQ9UsKq+vP2wBbo3PcoVSi/25BBKMhRCoqdfx8dusWuAlTAV5PLEhLvaWU4ktt /OATmlpW6dk+LTXxpCruCEhWW8P418e+olEHYHpnFdQhJwcTeQ6nU+FhuhmDc2cbuM mWLfG5by595RYvp0KdLnFGMC/uqELmgpIV/1R8aiZLKpFBF1TL4xs9ZifA1tZBuNlu t+uNN67hD1yntQQFVvSk6D9RUjsZXxzJ7BvS5a6e2G5lnf9dD4pfRmMjQkpvMnn+Wz WWbWwaQqEgaig== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:57 -0500 Subject: [PATCH v3 20/22] accel: ethosu: Split U65 and U85 DMA length validation Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-20-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Ethos-U65 and Ethos-U85 have slightly different DMA programming models. The U65 has skip values added on to the size whereas U85 has signed stride values. The U65 shares the skip values for source and destination whereas the U85 has independent settings for source and destination. The current validation only correctly handles U65 constraints and only for source 2D/3D mode. Split the shared DMA length calculation into U65 and U85 specific versions adding U65 destination 2D/3D mode and U85 constraints. Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v3: - Fix U65 destination stride/skip handling v2: - new patch --- drivers/accel/ethosu/ethosu_gem.c | 114 ++++++++++++++++++++++++++++++----= ---- 1 file changed, 91 insertions(+), 23 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index df26ccd50a96..82699050a670 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -235,40 +235,92 @@ static bool dma_params_valid(struct ethosu_device *ed= ev, struct cmd_state *st, return true; } =20 -static u64 dma_length(struct ethosu_device *edev, - struct ethosu_validated_cmdstream_info *info, - struct cmd_state *st, struct dma_state *dma_st, - struct dma *dma, u16 region_cmd, u16 addr_cmd) +static u64 dma_length_finish(struct ethosu_validated_cmdstream_info *info, + const struct dma *dma, u64 len) +{ + if (dma->region >=3D 0) { + u64 end; + + if (check_add_overflow(len, dma->offset, &end)) + return U64_MAX; + info->region_size[dma->region] =3D + max(info->region_size[dma->region], end); + } + + return len; +} + +static u64 dma_length_u65(struct ethosu_validated_cmdstream_info *info, + struct dma_state *dma_st, + struct dma *dma) { s8 mode =3D dma->mode; u64 len =3D dma->len; =20 - if (!dma_params_valid(edev, st, dma_st, dma, region_cmd, addr_cmd)) - return U64_MAX; + if (mode >=3D 1) { + if (check_add_overflow(len, (u64)dma->stride[0], &len) || + check_mul_overflow(len, (u64)dma_st->size0, &len)) + return U64_MAX; + } + if (mode =3D=3D 2) { + if (check_add_overflow(len, (u64)dma->stride[1], &len) || + check_mul_overflow(len, (u64)dma_st->size1, &len)) + return U64_MAX; + } + + return dma_length_finish(info, dma, len); +} + +static u64 dma_length_u85(struct ethosu_validated_cmdstream_info *info, + struct dma_state *dma_st, + struct dma *dma) +{ + s8 mode =3D dma->mode; + s64 min =3D 0; + u64 max =3D dma->len; + s64 stride; =20 if (mode >=3D 1) { - if (dma->stride[0] < 0 && (u64)(-dma->stride[0]) > len) + if (check_mul_overflow(dma->stride[0], + (s64)dma_st->size0, &stride)) return U64_MAX; - len +=3D dma->stride[0]; - if (check_mul_overflow(len, (u64)dma_st->size0, &len)) + if (stride < 0) { + if (check_add_overflow(min, stride, &min)) + return U64_MAX; + } else if (check_add_overflow(max, (u64)stride, &max)) { return U64_MAX; + } } if (mode =3D=3D 2) { - if (dma->stride[1] < 0 && (u64)(-dma->stride[1]) > len) + if (check_mul_overflow(dma->stride[1], + (s64)dma_st->size1, &stride)) return U64_MAX; - len +=3D dma->stride[1]; - if (check_mul_overflow(len, (u64)dma_st->size1, &len)) + if (stride < 0) { + if (check_add_overflow(min, stride, &min)) + return U64_MAX; + } else if (check_add_overflow(max, (u64)stride, &max)) { return U64_MAX; + } } - if (dma->region >=3D 0) { - u64 end; =20 - if (check_add_overflow(len, dma->offset, &end)) - return U64_MAX; - info->region_size[dma->region] =3D max(info->region_size[dma->region], e= nd); - } + if (min < 0 && -(u64)min > dma->offset) + return U64_MAX; =20 - return len; + return dma_length_finish(info, dma, max); +} + +static u64 dma_length(struct ethosu_device *edev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st, struct dma_state *dma_st, + struct dma *dma, u16 region_cmd, u16 addr_cmd) +{ + if (!dma_params_valid(edev, st, dma_st, dma, region_cmd, addr_cmd)) + return U64_MAX; + + if (ethosu_is_u65(edev)) + return dma_length_u65(info, dma_st, dma); + + return dma_length_u85(info, dma_st, dma); } =20 static bool feat_matrix_chained(struct ethosu_device *edev, struct feat_ma= trix *fm) @@ -1078,16 +1130,32 @@ static int ethosu_gem_cmdstream_copy_and_validate(s= truct drm_device *ddev, st.dma.size1 =3D param; break; case NPU_SET_DMA0_SRC_STRIDE0: - st.dma.src.stride[0] =3D ((s64)addr << 24) >> 24; + if (ethosu_is_u65(edev)) { + st.dma.src.stride[0] =3D addr; + st.dma.dst.stride[0] =3D addr; + } else { + st.dma.src.stride[0] =3D sign_extend64(addr, 39); + } break; case NPU_SET_DMA0_SRC_STRIDE1: - st.dma.src.stride[1] =3D ((s64)addr << 24) >> 24; + if (ethosu_is_u65(edev)) { + st.dma.src.stride[1] =3D addr; + st.dma.dst.stride[1] =3D addr; + } else { + st.dma.src.stride[1] =3D sign_extend64(addr, 39); + } break; case NPU_SET_DMA0_DST_STRIDE0: - st.dma.dst.stride[0] =3D ((s64)addr << 24) >> 24; + if (!ethosu_is_u65(edev)) + st.dma.dst.stride[0] =3D sign_extend64(addr, 39); + else + return -EINVAL; break; case NPU_SET_DMA0_DST_STRIDE1: - st.dma.dst.stride[1] =3D ((s64)addr << 24) >> 24; + if (!ethosu_is_u65(edev)) + st.dma.dst.stride[1] =3D sign_extend64(addr, 39); + else + return -EINVAL; break; case NPU_SET_DMA0_SRC: st.dma.src.offset =3D addr; --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 61D395908CE for ; Tue, 8 Sep 2026 22:05:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905120; cv=none; b=pArjPYCvty+sZ6f1AFl4dx3f41zdeaOFaBB/+OfucID1gJey73VqAEEVDLe7obVXJSsk2d4GZzOHC4uDTXcH3Bw/JhiBrR84lWegxl4BQc0DHsQhm8RQOGlLUW4uAgjFb2UA/+q36+yGj+QN027eJ5+j8yFTxwtWK4V5uQPqUPI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905120; c=relaxed/simple; bh=fLQlyLC68D6I9KHylHvtWoUb4w7IJMLU3Nf6aXixN7U=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=al1DJbkS88uTLbeVrwuZVyTBjnzLDgSXGQ5qqA9WsjBBAh3gjx4yjPYL38E3t3AozF1wn4w5gXP6oHRYZcTmclr0ttrWhOxMNwTaFBYBUrMXF+kjpd1GORafPt6AZPJsM53WFK+6on2sWskMAE/fg+4p63TQ7PGWHVkXLhvFLZc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Ez9zBeDV; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Ez9zBeDV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1348F1F00A3A; Tue, 8 Sep 2026 22:05:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905119; bh=QEUV28WflTnYeXb75F34zYPsqWJDRc4cP7Dds+IHxSk=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=Ez9zBeDVnBoT/bUpJDTKW9sxtN4mRpoEfJkIiz8GOaokymAOBlbdijJqZLmMpI+XD fLnkXWVRBvliHaSzFdIpkCpNagK+VsvLULyoQg0pEM7rAprwt4b7TsW6mNe835UFY7 tQG1F7sBUkYRTH8UIHffgQe4r9tofJ0UT1Ov0FVLAAJUJjFDaW6Z0608RDTnon7fVT 1LjKmzvQ/cuUecoIAzVOYndM16RnpbrO7xMi97y2WVRqvWKo2e6qqI7IolYsHbx88Z bvMf7VF/XZzJxJFspwF3PuZMonQVDr4DeEd8CGNLfDK876z6qYo/B7ikoJMFSBsM+2 afWsmskwDKZzg== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:58 -0500 Subject: [PATCH v3 21/22] accel: ethosu: Validate OFM transpose Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-21-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev U85 OFM dimensions are specified before transposition, while tile bases and strides address the transposed feature map. Permute the output endpoint before validating its tile and stride accesses. Allow the defined U85 transpose encodings and reject the two reserved encodings. Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v2: - no change --- drivers/accel/ethosu/ethosu_device.h | 1 + drivers/accel/ethosu/ethosu_gem.c | 58 ++++++++++++++++++++++++++++++++= ++-- 2 files changed, 57 insertions(+), 2 deletions(-) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index 6b9d093d73e6..3f1fa0a36bd9 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -90,6 +90,7 @@ struct gen_pool; #define NPU_OP_CONV_WEIGHTS_IFM2 BIT(0) #define NPU_KERNEL_DILATION_X BIT(3) #define NPU_KERNEL_DILATION_Y BIT(4) +#define NPU_OFM_TRANSPOSE_MASK GENMASK(13, 11) =20 #define NPU_CMD_CTRL_CMD1 BIT(14) #define NPU_CMD_RESERVED_MASK (BIT(15) | GENMASK(13, 10)) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 82699050a670..1c64e27a0d99 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -407,6 +407,52 @@ static int feat_matrix_validate(struct ethosu_device *= edev, =20 return 0; } + +static int feat_matrix_permute(struct ethosu_device *edev, + struct feat_matrix *fm, u32 *x, u32 *y, + u32 *c, bool ofm) +{ + u32 width =3D *x; + u32 height =3D *y; + u32 depth =3D *c; + u32 transpose; + + if (ethosu_is_u65(edev) || !ofm) + return 0; + + transpose =3D FIELD_GET(NPU_OFM_TRANSPOSE_MASK, fm->precision); + + switch (transpose) { + case 0: /* HWC */ + break; + case 1: /* WHC */ + *x =3D height; + *y =3D width; + break; + case 2: /* HCW */ + *x =3D depth; + *c =3D width; + break; + case 3: /* WCH */ + *x =3D depth; + *y =3D width; + *c =3D height; + break; + case 6: /* CHW */ + *x =3D height; + *y =3D depth; + *c =3D width; + break; + case 7: /* CWH */ + *y =3D depth; + *c =3D height; + break; + default: + return -EINVAL; + } + + return 0; +} static u64 feat_matrix_length(struct ethosu_device *edev, struct ethosu_validated_cmdstream_info *info, struct cmd_state *st, struct feat_matrix *fm, @@ -513,6 +559,9 @@ static int feat_matrix_size(struct ethosu_device *edev, int ret; =20 *max_len =3D 0; + ret =3D feat_matrix_permute(edev, fm, &x, &y, &c, ofm); + if (ret) + return ret; =20 if (storage =3D=3D 0) { ret =3D feat_matrix_check_location(edev, info, st, fm, type, 0, 0, @@ -990,8 +1039,13 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, case NPU_SET_OFM_PRECISION: if (((param >> 6) & 0x3) > 1) return -EINVAL; - if (!ethosu_is_u65(edev) && (param & GENMASK(13, 11))) - return -EINVAL; + if (!ethosu_is_u65(edev)) { + switch (FIELD_GET(NPU_OFM_TRANSPOSE_MASK, param)) { + case 4: + case 5: + return -EINVAL; + } + } st.ofm.precision =3D param; break; case NPU_SET_OFM_REGION: --=20 2.53.0 From nobody Fri Sep 25 20:02:37 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8DC4356B864 for ; Tue, 8 Sep 2026 22:05:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905122; cv=none; b=A4d/8yLQwL7/IW4Bsslj0dP1Zt9tT5J0f/8f+9Td7UIMgFIphJlBZIyHFt2nuCIHe6zEsBT7uFENdM5uCGk3QBy+kngHRWV8c45RDyo0gK66Yxnr8qQdoKye835K8XelFBspQJdyYr826LDRe7WjAX5uS9nhsc4ztZXNy8Sofzg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788905122; c=relaxed/simple; bh=yWa/oGy2+9TupneNyrUGG2Ro2INXcGj4oDU0ef76290=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Oz4VoeD+tvLFv0690CooB+pPajAm9j0tDT9EmHZq6avPXFW7faEQl6UrHhuoOjSzzjPQi/Cwx4k8FkIkP4uKyCKBHkgUR6NMEkNYKppmoEMRMP1ioGrDLrLmxM4cIiT73YRSudKPACGQDWmbcPttdQSA9yt57yaK2AnrPLZdnFw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=iqTCOC9o; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="iqTCOC9o" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3F2B01F00A3D; Tue, 8 Sep 2026 22:05:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788905120; bh=PtHxBuERSuyDsNbMey8v57YUZ5rF4WyVF+ag08LoT/M=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=iqTCOC9oWLBTqD6S8o8ccLGf9xsjfunE2+snd1PxrAHRb0o0wRqmLC9F10AI42suF GYYtgbeLEGz5SGwtC3LECcvHUQOYSRkoujxTezsr31krWhKhT4A++p5NrLNL4xkI17 lbiNW3NY2Lwmqt/urdEY9pqibOHNCkJNZ5/pUtV1TWUXhXvkBjBFARmveRLh4yCOnT aNCHpsJ9N02NnZFhZWqOiZwnBppAFi2FGKsqJbPsx3uxiAiIe3yKUUoM8LkLJmzK3k Ju8MrXMI6BMOP+7I8ndrfLUkAv1qCjLnPKaQ17p6RU63mUI3N/Aag5itljBqWeK0T5 +koH7m5q/HSLg== From: "Rob Herring (Arm)" Date: Tue, 08 Sep 2026 17:04:59 -0500 Subject: [PATCH v3 22/22] accel: ethosu: Validate resize operations Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260908-ethosu-fixes-v3-22-490fe215286f@kernel.org> References: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> In-Reply-To: <20260908-ethosu-fixes-v3-0-490fe215286f@kernel.org> To: Tomeu Vizoso , Oded Gabbay , Frank Li , Thomas Zimmermann Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev Resize input coordinates are controlled by the scale, offset, and step registers. Require those values to be explicitly programmed, validate the scale and step relationships, and use a conservative coordinate bound when validating the input feature map. This prevents retained or malformed resize state from accessing beyond the validated input feature-map buffer. Assisted-by: LLM Signed-off-by: Rob Herring (Arm) --- v3: - Fix width and height calculations to account for kernel size reported by sashiko v2: - new patch --- drivers/accel/ethosu/ethosu_device.h | 8 ++ drivers/accel/ethosu/ethosu_gem.c | 161 +++++++++++++++++++++++++++++++= +++- 2 files changed, 168 insertions(+), 1 deletion(-) diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/et= hosu_device.h index 3f1fa0a36bd9..2974173bbc40 100644 --- a/drivers/accel/ethosu/ethosu_device.h +++ b/drivers/accel/ethosu/ethosu_device.h @@ -120,6 +120,8 @@ enum ethosu_cmds { NPU_SET_OFM_HEIGHT_M1 =3D 0x112, NPU_SET_OFM_DEPTH_M1 =3D 0x113, NPU_SET_OFM_PRECISION =3D 0x114, + NPU_SET_OFM_BLK_WIDTH_M1 =3D 0x115, + NPU_SET_OFM_BLK_HEIGHT_M1 =3D 0x116, NPU_SET_OFM_WIDTH0_M1 =3D 0x11a, NPU_SET_OFM_HEIGHT0_M1 =3D 0x11b, NPU_SET_OFM_HEIGHT1_M1 =3D 0x11c, @@ -130,6 +132,10 @@ enum ethosu_cmds { NPU_SET_ACC_FORMAT =3D 0x124, NPU_SET_WEIGHT_REGION =3D 0x128, NPU_SET_SCALE_REGION =3D 0x129, + NPU_SET_RESIZE_X_SCALE_N_M1 =3D 0x12a, + NPU_SET_RESIZE_Y_SCALE_N_M1 =3D 0x12b, + NPU_SET_RESIZE_X_OFFSET =3D 0x12c, + NPU_SET_RESIZE_Y_OFFSET =3D 0x12d, NPU_SET_DMA0_SRC_REGION =3D 0x130, NPU_SET_DMA0_DST_REGION =3D 0x131, NPU_SET_DMA0_SIZE0 =3D 0x132, @@ -180,6 +186,8 @@ enum ethosu_cmds { NPU_SET_WEIGHT2_LENGTH =3D 0x4093, NPU_SET_WEIGHT3_BASE =3D 0x4094, NPU_SET_WEIGHT3_LENGTH =3D 0x4095, + NPU_SET_RESIZE_X =3D 0x4096, + NPU_SET_RESIZE_Y =3D 0x4097, }; =20 #define NPU_ACC_FORMAT_INPUT_MASK GENMASK(5, 4) diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethos= u_gem.c index 1c64e27a0d99..5c824668f493 100644 --- a/drivers/accel/ethosu/ethosu_gem.c +++ b/drivers/accel/ethosu/ethosu_gem.c @@ -149,6 +149,15 @@ struct feat_matrix { u8 pad_right; }; =20 +struct resize_axis { + u16 scale_n; + s16 offset; + u16 one_step_int; + u16 one_step_mod; + u16 blk_step_int; + u16 blk_step_mod; +}; + #define NPU_CMD0_REGS 0x200 #define NPU_CMD1_REGS 0x100 =20 @@ -162,6 +171,9 @@ struct cmd_state { struct feat_matrix ofm; struct feat_matrix ifm; struct feat_matrix ifm2; + u16 ofm_blk_width; + u16 ofm_blk_height; + struct resize_axis resize[2]; }; =20 static void cmd_state_init(struct cmd_state *st) @@ -650,6 +662,98 @@ calc_acc_input_size(struct drm_device *ddev, return ret; } =20 +static int resize_axis_size(struct cmd_state *st, int axis, u16 ofm_size, + u16 ofm_blk_size, u32 *size) +{ + struct resize_axis *resize =3D &st->resize[axis]; + u64 one_step, blk_step, coord; + + if (resize->offset < -(s16)resize->scale_n || + resize->offset >=3D resize->scale_n || + resize->one_step_mod >=3D resize->scale_n || + resize->blk_step_mod >=3D resize->scale_n) + return -EINVAL; + + one_step =3D resize->one_step_int * resize->scale_n + + resize->one_step_mod; + blk_step =3D resize->blk_step_int * resize->scale_n + + resize->blk_step_mod; + if (check_mul_overflow((u64)ofm_blk_size, one_step, &coord) || + blk_step !=3D coord) + return -EINVAL; + + if (check_mul_overflow((u64)ofm_size, one_step, &coord) || + check_add_overflow(coord, (u64)resize->scale_n - 1, &coord)) + return -EINVAL; + + coord =3D div_u64(coord, resize->scale_n); + if (coord >=3D U32_MAX) + return -EINVAL; + + *size =3D coord + 1; + return 0; +} + + +static int calc_sizes_resize(struct drm_device *ddev, + struct ethosu_validated_cmdstream_info *info, + struct cmd_state *st) +{ + struct ethosu_device *edev =3D to_ethosu_device(ddev); + u32 ifm_width, ifm_height; + u64 len; + int ret; + + if (!cmd_state_reg_is_set(st, NPU_SET_KERNEL_WIDTH_M1) || + !cmd_state_reg_is_set(st, NPU_SET_KERNEL_HEIGHT_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_BLK_WIDTH_M1) || + !cmd_state_reg_is_set(st, NPU_SET_OFM_BLK_HEIGHT_M1) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_X_SCALE_N_M1) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_Y_SCALE_N_M1) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_X_OFFSET) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_Y_OFFSET) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_X) || + !cmd_state_reg_is_set(st, NPU_SET_RESIZE_Y)) + return -EINVAL; + + ret =3D resize_axis_size(st, 0, st->ofm.width, st->ofm_blk_width, + &ifm_width); + if (ret) + return ret; + ret =3D resize_axis_size(st, 1, st->ofm.height[2], st->ofm_blk_height, + &ifm_height); + if (ret) + return ret; + + if (check_add_overflow(ifm_width, (u32)st->ifm.width, &ifm_width) || + check_add_overflow(ifm_height, (u32)st->ifm.height[2], &ifm_height)) + return -EINVAL; + + ret =3D feat_matrix_size(edev, info, st, &st->ifm, FEAT_MATRIX_IFM, + ifm_width, ifm_height, st->ifm.depth, false, &len); + dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", NPU_OP_RESIZE, + st->ifm.region, st->ifm.base[0], len); + if (ret) + return ret; + + ret =3D feat_matrix_size(edev, info, st, &st->ofm, FEAT_MATRIX_OFM, + st->ofm.width, st->ofm.height[2], st->ofm.depth, + true, &len); + dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", NPU_OP_RESIZE, + st->ofm.region, st->ofm.base[0], len); + if (ret) + return ret; + + ret =3D calc_acc_input_size(ddev, info, st); + if (ret) + return ret; + + if (!feat_matrix_chained(edev, &st->ofm)) + info->output_region[st->ofm.region] =3D true; + + return 0; +} + static int buffer_size(struct ethosu_validated_cmdstream_info *info, struct cmd_state *st, struct buffer *buf, s8 region, u16 region_cmd, u16 base_cmd, u16 length_cmd, bool optional) @@ -957,7 +1061,12 @@ static int ethosu_gem_cmdstream_copy_and_validate(str= uct drm_device *ddev, return ret; break; case NPU_OP_RESIZE: // U85 only - return -EINVAL; + if (ethosu_is_u65(edev) || param > 2) + return -EINVAL; + ret =3D calc_sizes_resize(ddev, info, &st); + if (ret) + return ret; + break; case NPU_SET_KERNEL_WIDTH_M1: st.ifm.width =3D param; break; @@ -1048,6 +1157,12 @@ static int ethosu_gem_cmdstream_copy_and_validate(st= ruct drm_device *ddev, } st.ofm.precision =3D param; break; + case NPU_SET_OFM_BLK_WIDTH_M1: + st.ofm_blk_width =3D param & 0x7f; + break; + case NPU_SET_OFM_BLK_HEIGHT_M1: + st.ofm_blk_height =3D param & 0x7f; + break; case NPU_SET_OFM_REGION: st.ofm.region =3D param & 0x7; break; @@ -1118,6 +1233,34 @@ static int ethosu_gem_cmdstream_copy_and_validate(st= ruct drm_device *ddev, case NPU_SET_SCALE_REGION: st.scale[0].region =3D param & 0x7; break; + case NPU_SET_RESIZE_X_SCALE_N_M1: + if (ethosu_is_u65(edev)) + break; + if (param & GENMASK(15, 11)) + return -EINVAL; + st.resize[0].scale_n =3D param + 1; + break; + case NPU_SET_RESIZE_Y_SCALE_N_M1: + if (ethosu_is_u65(edev)) + break; + if (param & GENMASK(15, 11)) + return -EINVAL; + st.resize[1].scale_n =3D param + 1; + break; + case NPU_SET_RESIZE_X_OFFSET: + if (ethosu_is_u65(edev)) + break; + if (param & GENMASK(15, 12)) + return -EINVAL; + st.resize[0].offset =3D sign_extend32(param, 11); + break; + case NPU_SET_RESIZE_Y_OFFSET: + if (ethosu_is_u65(edev)) + break; + if (param & GENMASK(15, 12)) + return -EINVAL; + st.resize[1].offset =3D sign_extend32(param, 11); + break; case NPU_SET_WEIGHT_BASE: st.weight[0].base =3D addr; break; @@ -1154,6 +1297,22 @@ static int ethosu_gem_cmdstream_copy_and_validate(st= ruct drm_device *ddev, case NPU_SET_WEIGHT3_LENGTH: st.weight[3].length =3D cmds[1]; break; + case NPU_SET_RESIZE_X: + case NPU_SET_RESIZE_Y: + if (ethosu_is_u65(edev)) + break; + if ((cmds[0] & BIT(31)) || + (cmds[1] & (GENMASK(31, 27) | GENMASK(15, 11)))) + return -EINVAL; + st.resize[cmd - NPU_SET_RESIZE_X].one_step_int =3D + FIELD_GET(GENMASK(19, 16), cmds[0]); + st.resize[cmd - NPU_SET_RESIZE_X].blk_step_int =3D + FIELD_GET(GENMASK(30, 20), cmds[0]); + st.resize[cmd - NPU_SET_RESIZE_X].one_step_mod =3D + FIELD_GET(GENMASK(10, 0), cmds[1]); + st.resize[cmd - NPU_SET_RESIZE_X].blk_step_mod =3D + FIELD_GET(GENMASK(26, 16), cmds[1]); + break; =20 case NPU_SET_DMA0_SRC_REGION: if (param & NPU_DMA_REGION_INDEX_MODE) --=20 2.53.0