The command-stream validator records the additional U65 scale and
weight stream addresses and the U85 weight decoder addresses, but only
checked stream 0 against its region buffer.
Check every configured secondary stream against the matching weight or
scale region before accepting a kernel operation.
Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Rob Herring (Arm) <[email protected]>
---
v2:
- Adjust for register state tracking
---
drivers/accel/ethosu/ethosu_gem.c | 33 ++++++++++++++++++++++++++++-----
1 file changed, 28 insertions(+), 5 deletions(-)
diff --git a/drivers/accel/ethosu/ethosu_gem.c
b/drivers/accel/ethosu/ethosu_gem.c
index 6f6712f4efd1..abfb173e1008 100644
--- a/drivers/accel/ethosu/ethosu_gem.c
+++ b/drivers/accel/ethosu/ethosu_gem.c
@@ -436,13 +436,17 @@ static u64 feat_matrix_length(struct ethosu_device *edev,
static int buffer_size(struct ethosu_validated_cmdstream_info *info,
struct cmd_state *st, struct buffer *buf, s8 region,
- u16 region_cmd, u16 base_cmd, u16 length_cmd)
+ u16 region_cmd, u16 base_cmd, u16 length_cmd, bool
optional)
{
u64 end;
+ bool base_set = cmd_state_reg_is_set(st, base_cmd);
+ bool length_set = cmd_state_reg_is_set(st, length_cmd);
+
+ if (optional && !base_set && !length_set)
+ return 0;
if (region < 0 || !cmd_state_reg_is_set(st, region_cmd) ||
- !cmd_state_reg_is_set(st, base_cmd) ||
- !cmd_state_reg_is_set(st, length_cmd))
+ !base_set || !length_set)
return -EINVAL;
if (check_add_overflow(buf->base, (u64)buf->length, &end))
@@ -507,7 +511,20 @@ static int calc_sizes(struct drm_device *ddev,
st->weight[0].base + st->weight[0].length - 1);
if (buffer_size(info, st, &st->weight[0], st->weight[0].region,
NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT_BASE,
- NPU_SET_WEIGHT_LENGTH))
+ NPU_SET_WEIGHT_LENGTH, false))
+ return -EINVAL;
+
+ if (buffer_size(info, st, &st->weight[1], st->weight[0].region,
+ NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT1_BASE,
+ NPU_SET_WEIGHT1_LENGTH, true) ||
+ buffer_size(info, st, &st->weight[3], st->weight[0].region,
+ NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT3_BASE,
+ NPU_SET_WEIGHT3_LENGTH, true))
+ return -EINVAL;
+ if (!ethosu_is_u65(edev) &&
+ buffer_size(info, st, &st->weight[2], st->weight[0].region,
+ NPU_SET_WEIGHT_REGION, NPU_SET_WEIGHT2_BASE,
+ NPU_SET_WEIGHT2_LENGTH, true))
return -EINVAL;
}
@@ -517,7 +534,13 @@ static int calc_sizes(struct drm_device *ddev,
st->scale[0].base + st->scale[0].length - 1);
if (buffer_size(info, st, &st->scale[0], st->scale[0].region,
NPU_SET_SCALE_REGION, NPU_SET_SCALE_BASE,
- NPU_SET_SCALE_LENGTH))
+ NPU_SET_SCALE_LENGTH, false))
+ return -EINVAL;
+
+ if (ethosu_is_u65(edev) &&
+ buffer_size(info, st, &st->scale[1], st->scale[0].region,
+ NPU_SET_SCALE_REGION, NPU_SET_SCALE1_BASE,
+ NPU_SET_SCALE1_LENGTH, true))
return -EINVAL;
}
--
2.53.0
