From: "Rob Herring (Arm)" <robh@kernel.org>
To: Tomeu Vizoso <tomeu@tomeuvizoso.net>,
Oded Gabbay <ogabbay@kernel.org>, Frank Li <Frank.Li@nxp.com>,
Thomas Zimmermann <tzimmermann@suse.de>
Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2 13/19] accel: ethosu: Account for kernel dilation in IFM size
Date: Fri, 04 Sep 2026 19:43:32 -0500 [thread overview]
Message-ID: <20260904-ethosu-fixes-v2-13-3767738756a4@kernel.org> (raw)
In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org>
Kernel dilation increases the input feature-map area accessed by a
kernel operation. Include the x and y dilation settings when
calculating the required IFM bounds.
Without this, a command stream using x2 dilation can access IFM
memory past the range validated by the driver.
Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
---
v2:
- new patch
---
drivers/accel/ethosu/ethosu_device.h | 2 ++
drivers/accel/ethosu/ethosu_gem.c | 10 ++++++++--
2 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/ethosu_device.h
index d7e1e3c8ca12..8e23fdbf7f8a 100644
--- a/drivers/accel/ethosu/ethosu_device.h
+++ b/drivers/accel/ethosu/ethosu_device.h
@@ -88,6 +88,8 @@ struct gen_pool;
#define NPU_DMA_REGION_INDEX_MODE BIT(11)
#define NPU_OP_CONV_WEIGHTS_IFM2 BIT(0)
+#define NPU_KERNEL_DILATION_X BIT(3)
+#define NPU_KERNEL_DILATION_Y BIT(4)
enum ethosu_cmds {
NPU_OP_STOP = 0x0,
diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethosu_gem.c
index d60a2a453302..63dd07791f31 100644
--- a/drivers/accel/ethosu/ethosu_gem.c
+++ b/drivers/accel/ethosu/ethosu_gem.c
@@ -536,10 +536,16 @@ static int calc_sizes(struct drm_device *ddev,
((st->ifm.stride_kernel >> 1) & 0x1) + 1;
u32 stride_x = ((st->ifm.stride_kernel >> 5) & 0x2) +
(st->ifm.stride_kernel & 0x1) + 1;
+ u32 dilation_y = 1 + !!(st->ifm.stride_kernel &
+ NPU_KERNEL_DILATION_Y);
+ u32 dilation_x = 1 + !!(st->ifm.stride_kernel &
+ NPU_KERNEL_DILATION_X);
s32 ifm_height = st->ofm.height[2] * stride_y +
- st->ifm.height[2] - (st->ifm.pad_top + st->ifm.pad_bottom);
+ st->ifm.height[2] * dilation_y -
+ (st->ifm.pad_top + st->ifm.pad_bottom);
s32 ifm_width = st->ofm.width * stride_x +
- st->ifm.width - (st->ifm.pad_left + st->ifm.pad_right);
+ st->ifm.width * dilation_x -
+ (st->ifm.pad_left + st->ifm.pad_right);
if (ifm_height < 0 || ifm_width < 0)
return -EINVAL;
--
2.53.0
next prev parent reply other threads:[~2026-09-05 0:43 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-05 0:43 [PATCH v2 00/19] accel: ethosu: Another batch of fixes Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 01/19] accel: ethosu: Suspend after initialization Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 02/19] accel: ethosu: Fix probe error cleanup Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 03/19] accel: ethosu: Disable clocks on PM setup failure Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 04/19] accel: ethosu: Quiesce jobs before scheduler teardown Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 05/19] accel: ethosu: Move DMA mode to src/dst struct Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 06/19] accel: ethosu: Track command stream register setup Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 07/19] accel: ethosu: Factor buffer bounds checks Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 08/19] accel: ethosu: Validate secondary streams Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 09/19] accel: ethosu: Reject unsupported commands Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 10/19] accel: ethosu: Validate all feature map tiles Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 11/19] accel: ethosu: Account for feature map element size Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 12/19] accel: ethosu: Validate convolution parameter Rob Herring (Arm)
2026-09-05 0:43 ` Rob Herring (Arm) [this message]
2026-09-05 0:43 ` [PATCH v2 14/19] accel: ethosu: Reject reserved command encodings Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 15/19] accel: ethosu: Validate accumulator input Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 16/19] accel: ethosu: Restrict dynamic IFM2 weights Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 17/19] accel: ethosu: Split U65 and U85 DMA length validation Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 18/19] accel: ethosu: Validate OFM transpose Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 19/19] accel: ethosu: Validate resize operations Rob Herring (Arm)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260904-ethosu-fixes-v2-13-3767738756a4@kernel.org \
--to=robh@kernel.org \
--cc=Frank.Li@nxp.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ogabbay@kernel.org \
--cc=tomeu@tomeuvizoso.net \
--cc=tzimmermann@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®