* [PATCH 1/3] accel: ethosu: Fix job submit error clean-up refcount underflows
2026-02-18 22:21 [PATCH 0/3] accel: ethosu: Runtime PM refcounting and cmd stream validation fixes Rob Herring (Arm)
@ 2026-02-18 22:21 ` Rob Herring (Arm)
2026-02-20 15:01 ` Anders Roxell
2026-02-18 22:21 ` [PATCH 2/3] accel: ethosu: Fix NPU_OP_ELEMENTWISE validation with scalar Rob Herring (Arm)
2026-02-18 22:21 ` [PATCH 3/3] accel: ethosu: Handle possible underflow in IFM size calculations Rob Herring (Arm)
2 siblings, 1 reply; 7+ messages in thread
From: Rob Herring (Arm) @ 2026-02-18 22:21 UTC (permalink / raw)
To: Tomeu Vizoso, Anders Roxell, Oded Gabbay, Thomas Zimmermann, Frank Li
Cc: dri-devel, linux-kernel
If the job submit fails before adding the job to the scheduler queue
such as when the GEM buffer bounds checks fail, then doing a
ethosu_job_put() results in a pm_runtime_put_autosuspend() without the
corresponding pm_runtime_resume_and_get(). The dma_fence_put()'s are
also unnecessary, but seem to be harmless.
Split the ethosu_job_cleanup() function into 2 parts for the before
and after the job is queued.
Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
---
drivers/accel/ethosu/ethosu_job.c | 26 ++++++++++++++++++--------
1 file changed, 18 insertions(+), 8 deletions(-)
diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethosu_job.c
index 26e7a2f64d71..70a144803b09 100644
--- a/drivers/accel/ethosu/ethosu_job.c
+++ b/drivers/accel/ethosu/ethosu_job.c
@@ -143,23 +143,29 @@ static int ethosu_job_push(struct ethosu_job *job)
return ret;
}
+static void ethosu_job_err_cleanup(struct ethosu_job *job)
+{
+ unsigned int i;
+
+ for (i = 0; i < job->region_cnt; i++)
+ drm_gem_object_put(job->region_bo[i]);
+
+ drm_gem_object_put(job->cmd_bo);
+
+ kfree(job);
+}
+
static void ethosu_job_cleanup(struct kref *ref)
{
struct ethosu_job *job = container_of(ref, struct ethosu_job,
refcount);
- unsigned int i;
pm_runtime_put_autosuspend(job->dev->base.dev);
dma_fence_put(job->done_fence);
dma_fence_put(job->inference_done_fence);
- for (i = 0; i < job->region_cnt; i++)
- drm_gem_object_put(job->region_bo[i]);
-
- drm_gem_object_put(job->cmd_bo);
-
- kfree(job);
+ ethosu_job_err_cleanup(job);
}
static void ethosu_job_put(struct ethosu_job *job)
@@ -454,12 +460,16 @@ static int ethosu_ioctl_submit_job(struct drm_device *dev, struct drm_file *file
}
}
ret = ethosu_job_push(ejob);
+ if (!ret) {
+ ethosu_job_put(ejob);
+ return 0;
+ }
out_cleanup_job:
if (ret)
drm_sched_job_cleanup(&ejob->base);
out_put_job:
- ethosu_job_put(ejob);
+ ethosu_job_err_cleanup(ejob);
return ret;
}
--
2.51.0
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH 1/3] accel: ethosu: Fix job submit error clean-up refcount underflows
2026-02-18 22:21 ` [PATCH 1/3] accel: ethosu: Fix job submit error clean-up refcount underflows Rob Herring (Arm)
@ 2026-02-20 15:01 ` Anders Roxell
0 siblings, 0 replies; 7+ messages in thread
From: Anders Roxell @ 2026-02-20 15:01 UTC (permalink / raw)
To: Rob Herring (Arm)
Cc: Tomeu Vizoso, Oded Gabbay, Thomas Zimmermann, Frank Li,
dri-devel, linux-kernel
On Wed, 18 Feb 2026 at 23:22, Rob Herring (Arm) <robh@kernel.org> wrote:
>
> If the job submit fails before adding the job to the scheduler queue
> such as when the GEM buffer bounds checks fail, then doing a
> ethosu_job_put() results in a pm_runtime_put_autosuspend() without the
> corresponding pm_runtime_resume_and_get(). The dma_fence_put()'s are
> also unnecessary, but seem to be harmless.
>
> Split the ethosu_job_cleanup() function into 2 parts for the before
> and after the job is queued.
>
> Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
> Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-and-Tested-by: Anders Roxell <anders.roxell@linaro.org>
> ---
> drivers/accel/ethosu/ethosu_job.c | 26 ++++++++++++++++++--------
> 1 file changed, 18 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/accel/ethosu/ethosu_job.c b/drivers/accel/ethosu/ethosu_job.c
> index 26e7a2f64d71..70a144803b09 100644
> --- a/drivers/accel/ethosu/ethosu_job.c
> +++ b/drivers/accel/ethosu/ethosu_job.c
> @@ -143,23 +143,29 @@ static int ethosu_job_push(struct ethosu_job *job)
> return ret;
> }
>
> +static void ethosu_job_err_cleanup(struct ethosu_job *job)
> +{
> + unsigned int i;
> +
> + for (i = 0; i < job->region_cnt; i++)
> + drm_gem_object_put(job->region_bo[i]);
> +
> + drm_gem_object_put(job->cmd_bo);
> +
> + kfree(job);
> +}
> +
> static void ethosu_job_cleanup(struct kref *ref)
> {
> struct ethosu_job *job = container_of(ref, struct ethosu_job,
> refcount);
> - unsigned int i;
>
> pm_runtime_put_autosuspend(job->dev->base.dev);
>
> dma_fence_put(job->done_fence);
> dma_fence_put(job->inference_done_fence);
>
> - for (i = 0; i < job->region_cnt; i++)
> - drm_gem_object_put(job->region_bo[i]);
> -
> - drm_gem_object_put(job->cmd_bo);
> -
> - kfree(job);
> + ethosu_job_err_cleanup(job);
> }
>
> static void ethosu_job_put(struct ethosu_job *job)
> @@ -454,12 +460,16 @@ static int ethosu_ioctl_submit_job(struct drm_device *dev, struct drm_file *file
> }
> }
> ret = ethosu_job_push(ejob);
> + if (!ret) {
> + ethosu_job_put(ejob);
> + return 0;
> + }
>
> out_cleanup_job:
> if (ret)
> drm_sched_job_cleanup(&ejob->base);
> out_put_job:
> - ethosu_job_put(ejob);
> + ethosu_job_err_cleanup(ejob);
>
> return ret;
> }
>
> --
> 2.51.0
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 2/3] accel: ethosu: Fix NPU_OP_ELEMENTWISE validation with scalar
2026-02-18 22:21 [PATCH 0/3] accel: ethosu: Runtime PM refcounting and cmd stream validation fixes Rob Herring (Arm)
2026-02-18 22:21 ` [PATCH 1/3] accel: ethosu: Fix job submit error clean-up refcount underflows Rob Herring (Arm)
@ 2026-02-18 22:21 ` Rob Herring (Arm)
2026-02-20 15:02 ` Anders Roxell
2026-02-18 22:21 ` [PATCH 3/3] accel: ethosu: Handle possible underflow in IFM size calculations Rob Herring (Arm)
2 siblings, 1 reply; 7+ messages in thread
From: Rob Herring (Arm) @ 2026-02-18 22:21 UTC (permalink / raw)
To: Tomeu Vizoso, Anders Roxell, Oded Gabbay, Thomas Zimmermann, Frank Li
Cc: dri-devel, linux-kernel
The NPU_OP_ELEMENTWISE instruction uses a scalar value for IFM2 if the
IFM2_BROADCAST "scalar" mode is set. It is a bit (7) on the u65 and
part of a field (bits 3:0) on the u85. The driver was hardcoded to the
u85.
Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
---
drivers/accel/ethosu/ethosu_gem.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethosu_gem.c
index 473b5f5d7514..a735f860a119 100644
--- a/drivers/accel/ethosu/ethosu_gem.c
+++ b/drivers/accel/ethosu/ethosu_gem.c
@@ -417,7 +417,10 @@ static int ethosu_gem_cmdstream_copy_and_validate(struct drm_device *ddev,
return ret;
break;
case NPU_OP_ELEMENTWISE:
- use_ifm2 = !((st.ifm2.broadcast == 8) || (param == 5) ||
+ use_scale = ethosu_is_u65(edev) ?
+ (st.ifm2.broadcast & 0x80) :
+ (st.ifm2.broadcast == 8);
+ use_ifm2 = !(use_scale || (param == 5) ||
(param == 6) || (param == 7) || (param == 0x24));
use_ifm = st.ifm.broadcast != 8;
ret = calc_sizes_elemwise(ddev, info, cmd, &st, use_ifm, use_ifm2);
--
2.51.0
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH 2/3] accel: ethosu: Fix NPU_OP_ELEMENTWISE validation with scalar
2026-02-18 22:21 ` [PATCH 2/3] accel: ethosu: Fix NPU_OP_ELEMENTWISE validation with scalar Rob Herring (Arm)
@ 2026-02-20 15:02 ` Anders Roxell
0 siblings, 0 replies; 7+ messages in thread
From: Anders Roxell @ 2026-02-20 15:02 UTC (permalink / raw)
To: Rob Herring (Arm)
Cc: Tomeu Vizoso, Oded Gabbay, Thomas Zimmermann, Frank Li,
dri-devel, linux-kernel
On Wed, 18 Feb 2026 at 23:22, Rob Herring (Arm) <robh@kernel.org> wrote:
>
> The NPU_OP_ELEMENTWISE instruction uses a scalar value for IFM2 if the
> IFM2_BROADCAST "scalar" mode is set. It is a bit (7) on the u65 and
> part of a field (bits 3:0) on the u85. The driver was hardcoded to the
> u85.
>
> Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
> Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-and-Tested-by: Anders Roxell <anders.roxell@linaro.org>
> ---
> drivers/accel/ethosu/ethosu_gem.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethosu_gem.c
> index 473b5f5d7514..a735f860a119 100644
> --- a/drivers/accel/ethosu/ethosu_gem.c
> +++ b/drivers/accel/ethosu/ethosu_gem.c
> @@ -417,7 +417,10 @@ static int ethosu_gem_cmdstream_copy_and_validate(struct drm_device *ddev,
> return ret;
> break;
> case NPU_OP_ELEMENTWISE:
> - use_ifm2 = !((st.ifm2.broadcast == 8) || (param == 5) ||
> + use_scale = ethosu_is_u65(edev) ?
> + (st.ifm2.broadcast & 0x80) :
> + (st.ifm2.broadcast == 8);
> + use_ifm2 = !(use_scale || (param == 5) ||
> (param == 6) || (param == 7) || (param == 0x24));
> use_ifm = st.ifm.broadcast != 8;
> ret = calc_sizes_elemwise(ddev, info, cmd, &st, use_ifm, use_ifm2);
>
> --
> 2.51.0
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH 3/3] accel: ethosu: Handle possible underflow in IFM size calculations
2026-02-18 22:21 [PATCH 0/3] accel: ethosu: Runtime PM refcounting and cmd stream validation fixes Rob Herring (Arm)
2026-02-18 22:21 ` [PATCH 1/3] accel: ethosu: Fix job submit error clean-up refcount underflows Rob Herring (Arm)
2026-02-18 22:21 ` [PATCH 2/3] accel: ethosu: Fix NPU_OP_ELEMENTWISE validation with scalar Rob Herring (Arm)
@ 2026-02-18 22:21 ` Rob Herring (Arm)
2026-02-20 15:03 ` Anders Roxell
2 siblings, 1 reply; 7+ messages in thread
From: Rob Herring (Arm) @ 2026-02-18 22:21 UTC (permalink / raw)
To: Tomeu Vizoso, Anders Roxell, Oded Gabbay, Thomas Zimmermann, Frank Li
Cc: dri-devel, linux-kernel
If the command stream has larger padding sizes than the IFM and OFM
diminsions, then the calculations will underflow to a negative value.
The result is a very large region bounds which is caught on submit, but
it's better to catch it earlier.
Current mesa ethosu driver has a signedness bug which resulted in
padding of 127 (the max) and triggers this issue.
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
---
drivers/accel/ethosu/ethosu_gem.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethosu_gem.c
index a735f860a119..d1169001c83d 100644
--- a/drivers/accel/ethosu/ethosu_gem.c
+++ b/drivers/accel/ethosu/ethosu_gem.c
@@ -245,11 +245,14 @@ static int calc_sizes(struct drm_device *ddev,
((st->ifm.stride_kernel >> 1) & 0x1) + 1;
u32 stride_x = ((st->ifm.stride_kernel >> 5) & 0x2) +
(st->ifm.stride_kernel & 0x1) + 1;
- u32 ifm_height = st->ofm.height[2] * stride_y +
+ s32 ifm_height = st->ofm.height[2] * stride_y +
st->ifm.height[2] - (st->ifm.pad_top + st->ifm.pad_bottom);
- u32 ifm_width = st->ofm.width * stride_x +
+ s32 ifm_width = st->ofm.width * stride_x +
st->ifm.width - (st->ifm.pad_left + st->ifm.pad_right);
+ if (ifm_height < 0 || ifm_width < 0)
+ return -EINVAL;
+
len = feat_matrix_length(info, &st->ifm, ifm_width,
ifm_height, st->ifm.depth);
dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n",
--
2.51.0
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH 3/3] accel: ethosu: Handle possible underflow in IFM size calculations
2026-02-18 22:21 ` [PATCH 3/3] accel: ethosu: Handle possible underflow in IFM size calculations Rob Herring (Arm)
@ 2026-02-20 15:03 ` Anders Roxell
0 siblings, 0 replies; 7+ messages in thread
From: Anders Roxell @ 2026-02-20 15:03 UTC (permalink / raw)
To: Rob Herring (Arm)
Cc: Tomeu Vizoso, Oded Gabbay, Thomas Zimmermann, Frank Li,
dri-devel, linux-kernel
On Wed, 18 Feb 2026 at 23:22, Rob Herring (Arm) <robh@kernel.org> wrote:
>
> If the command stream has larger padding sizes than the IFM and OFM
> diminsions, then the calculations will underflow to a negative value.
Nit is "diminsions" -> "dimensions"
> The result is a very large region bounds which is caught on submit, but
> it's better to catch it earlier.
>
> Current mesa ethosu driver has a signedness bug which resulted in
> padding of 127 (the max) and triggers this issue.
>
> Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Reviewed-and-Tested-by: Anders Roxell <anders.roxell@linaro.org>
> ---
> drivers/accel/ethosu/ethosu_gem.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethosu_gem.c
> index a735f860a119..d1169001c83d 100644
> --- a/drivers/accel/ethosu/ethosu_gem.c
> +++ b/drivers/accel/ethosu/ethosu_gem.c
> @@ -245,11 +245,14 @@ static int calc_sizes(struct drm_device *ddev,
> ((st->ifm.stride_kernel >> 1) & 0x1) + 1;
> u32 stride_x = ((st->ifm.stride_kernel >> 5) & 0x2) +
> (st->ifm.stride_kernel & 0x1) + 1;
> - u32 ifm_height = st->ofm.height[2] * stride_y +
> + s32 ifm_height = st->ofm.height[2] * stride_y +
> st->ifm.height[2] - (st->ifm.pad_top + st->ifm.pad_bottom);
> - u32 ifm_width = st->ofm.width * stride_x +
> + s32 ifm_width = st->ofm.width * stride_x +
> st->ifm.width - (st->ifm.pad_left + st->ifm.pad_right);
>
> + if (ifm_height < 0 || ifm_width < 0)
> + return -EINVAL;
> +
> len = feat_matrix_length(info, &st->ifm, ifm_width,
> ifm_height, st->ifm.depth);
> dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n",
>
> --
> 2.51.0
>
^ permalink raw reply [flat|nested] 7+ messages in thread