From: "Rob Herring (Arm)" <robh@kernel.org>
To: Tomeu Vizoso <tomeu@tomeuvizoso.net>,
Oded Gabbay <ogabbay@kernel.org>, Frank Li <Frank.Li@nxp.com>,
Thomas Zimmermann <tzimmermann@suse.de>
Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org
Subject: [PATCH v2 19/19] accel: ethosu: Validate resize operations
Date: Fri, 04 Sep 2026 19:43:38 -0500 [thread overview]
Message-ID: <20260904-ethosu-fixes-v2-19-3767738756a4@kernel.org> (raw)
In-Reply-To: <20260904-ethosu-fixes-v2-0-3767738756a4@kernel.org>
Resize input coordinates are controlled by the scale, offset, and step
registers. Require those values to be explicitly programmed, validate
the scale and step relationships, and use a conservative coordinate
bound when validating the input feature map.
This prevents retained or malformed resize state from accessing beyond
the validated input feature-map buffer.
Assisted-by: LLM
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
---
v2:
- new patch
---
drivers/accel/ethosu/ethosu_device.h | 8 ++
drivers/accel/ethosu/ethosu_gem.c | 159 ++++++++++++++++++++++++++++++++++-
2 files changed, 166 insertions(+), 1 deletion(-)
diff --git a/drivers/accel/ethosu/ethosu_device.h b/drivers/accel/ethosu/ethosu_device.h
index 3f1fa0a36bd9..2974173bbc40 100644
--- a/drivers/accel/ethosu/ethosu_device.h
+++ b/drivers/accel/ethosu/ethosu_device.h
@@ -120,6 +120,8 @@ enum ethosu_cmds {
NPU_SET_OFM_HEIGHT_M1 = 0x112,
NPU_SET_OFM_DEPTH_M1 = 0x113,
NPU_SET_OFM_PRECISION = 0x114,
+ NPU_SET_OFM_BLK_WIDTH_M1 = 0x115,
+ NPU_SET_OFM_BLK_HEIGHT_M1 = 0x116,
NPU_SET_OFM_WIDTH0_M1 = 0x11a,
NPU_SET_OFM_HEIGHT0_M1 = 0x11b,
NPU_SET_OFM_HEIGHT1_M1 = 0x11c,
@@ -130,6 +132,10 @@ enum ethosu_cmds {
NPU_SET_ACC_FORMAT = 0x124,
NPU_SET_WEIGHT_REGION = 0x128,
NPU_SET_SCALE_REGION = 0x129,
+ NPU_SET_RESIZE_X_SCALE_N_M1 = 0x12a,
+ NPU_SET_RESIZE_Y_SCALE_N_M1 = 0x12b,
+ NPU_SET_RESIZE_X_OFFSET = 0x12c,
+ NPU_SET_RESIZE_Y_OFFSET = 0x12d,
NPU_SET_DMA0_SRC_REGION = 0x130,
NPU_SET_DMA0_DST_REGION = 0x131,
NPU_SET_DMA0_SIZE0 = 0x132,
@@ -180,6 +186,8 @@ enum ethosu_cmds {
NPU_SET_WEIGHT2_LENGTH = 0x4093,
NPU_SET_WEIGHT3_BASE = 0x4094,
NPU_SET_WEIGHT3_LENGTH = 0x4095,
+ NPU_SET_RESIZE_X = 0x4096,
+ NPU_SET_RESIZE_Y = 0x4097,
};
#define NPU_ACC_FORMAT_INPUT_MASK GENMASK(5, 4)
diff --git a/drivers/accel/ethosu/ethosu_gem.c b/drivers/accel/ethosu/ethosu_gem.c
index 8114447891b2..67bee9612934 100644
--- a/drivers/accel/ethosu/ethosu_gem.c
+++ b/drivers/accel/ethosu/ethosu_gem.c
@@ -139,6 +139,15 @@ struct feat_matrix {
u8 pad_right;
};
+struct resize_axis {
+ u16 scale_n;
+ s16 offset;
+ u16 one_step_int;
+ u16 one_step_mod;
+ u16 blk_step_int;
+ u16 blk_step_mod;
+};
+
#define NPU_CMD0_REGS 0x200
#define NPU_CMD1_REGS 0x100
@@ -152,6 +161,9 @@ struct cmd_state {
struct feat_matrix ofm;
struct feat_matrix ifm;
struct feat_matrix ifm2;
+ u16 ofm_blk_width;
+ u16 ofm_blk_height;
+ struct resize_axis resize[2];
};
static void cmd_state_init(struct cmd_state *st)
@@ -619,6 +631,96 @@ calc_acc_input_size(struct drm_device *ddev,
return ret;
}
+static int resize_axis_size(struct cmd_state *st, int axis, u16 ofm_size,
+ u16 ofm_blk_size, u32 *size)
+{
+ struct resize_axis *resize = &st->resize[axis];
+ u64 one_step, blk_step, coord;
+
+ if (resize->offset < -(s16)resize->scale_n ||
+ resize->offset >= resize->scale_n ||
+ resize->one_step_mod >= resize->scale_n ||
+ resize->blk_step_mod >= resize->scale_n)
+ return -EINVAL;
+
+ one_step = resize->one_step_int * resize->scale_n +
+ resize->one_step_mod;
+ blk_step = resize->blk_step_int * resize->scale_n +
+ resize->blk_step_mod;
+ if (check_mul_overflow((u64)ofm_blk_size, one_step, &coord) ||
+ blk_step != coord)
+ return -EINVAL;
+
+ if (check_mul_overflow((u64)ofm_size, one_step, &coord) ||
+ check_add_overflow(coord, (u64)resize->scale_n - 1, &coord))
+ return -EINVAL;
+
+ coord = div_u64(coord, resize->scale_n);
+ if (coord >= U32_MAX)
+ return -EINVAL;
+
+ *size = coord + 1;
+ return 0;
+}
+
+
+static int calc_sizes_resize(struct drm_device *ddev,
+ struct ethosu_validated_cmdstream_info *info,
+ struct cmd_state *st)
+{
+ struct ethosu_device *edev = to_ethosu_device(ddev);
+ u32 ifm_width, ifm_height;
+ u64 len;
+ int ret;
+
+ if (!cmd_state_reg_is_set(st, NPU_SET_KERNEL_WIDTH_M1) ||
+ !cmd_state_reg_is_set(st, NPU_SET_KERNEL_HEIGHT_M1) ||
+ !cmd_state_reg_is_set(st, NPU_SET_OFM_BLK_WIDTH_M1) ||
+ !cmd_state_reg_is_set(st, NPU_SET_OFM_BLK_HEIGHT_M1) ||
+ !cmd_state_reg_is_set(st, NPU_SET_RESIZE_X_SCALE_N_M1) ||
+ !cmd_state_reg_is_set(st, NPU_SET_RESIZE_Y_SCALE_N_M1) ||
+ !cmd_state_reg_is_set(st, NPU_SET_RESIZE_X_OFFSET) ||
+ !cmd_state_reg_is_set(st, NPU_SET_RESIZE_Y_OFFSET) ||
+ !cmd_state_reg_is_set(st, NPU_SET_RESIZE_X) ||
+ !cmd_state_reg_is_set(st, NPU_SET_RESIZE_Y))
+ return -EINVAL;
+
+ ret = resize_axis_size(st, 0, st->ofm.width, st->ofm_blk_width,
+ &ifm_width);
+ if (ret)
+ return ret;
+ ret = resize_axis_size(st, 1, st->ofm.height[2], st->ofm_blk_height,
+ &ifm_height);
+ if (ret)
+ return ret;
+
+ ret = feat_matrix_size(edev, info, st, &st->ifm, FEAT_MATRIX_IFM,
+ max(ifm_width, (u32)st->ifm.width),
+ max(ifm_height, (u32)st->ifm.height[2]), st->ifm.depth,
+ false, &len);
+ dev_dbg(ddev->dev, "op %d: IFM:%d:0x%llx-0x%llx\n", NPU_OP_RESIZE,
+ st->ifm.region, st->ifm.base[0], len);
+ if (ret)
+ return ret;
+
+ ret = feat_matrix_size(edev, info, st, &st->ofm, FEAT_MATRIX_OFM,
+ st->ofm.width, st->ofm.height[2], st->ofm.depth,
+ true, &len);
+ dev_dbg(ddev->dev, "op %d: OFM:%d:0x%llx-0x%llx\n", NPU_OP_RESIZE,
+ st->ofm.region, st->ofm.base[0], len);
+ if (ret)
+ return ret;
+
+ ret = calc_acc_input_size(ddev, info, st);
+ if (ret)
+ return ret;
+
+ if (!feat_matrix_chained(edev, &st->ofm))
+ info->output_region[st->ofm.region] = true;
+
+ return 0;
+}
+
static int buffer_size(struct ethosu_validated_cmdstream_info *info,
struct cmd_state *st, struct buffer *buf, s8 region,
u16 region_cmd, u16 base_cmd, u16 length_cmd, bool optional)
@@ -926,7 +1028,12 @@ static int ethosu_gem_cmdstream_copy_and_validate(struct drm_device *ddev,
return ret;
break;
case NPU_OP_RESIZE: // U85 only
- return -EINVAL;
+ if (ethosu_is_u65(edev) || param > 2)
+ return -EINVAL;
+ ret = calc_sizes_resize(ddev, info, &st);
+ if (ret)
+ return ret;
+ break;
case NPU_SET_KERNEL_WIDTH_M1:
st.ifm.width = param;
break;
@@ -1017,6 +1124,12 @@ static int ethosu_gem_cmdstream_copy_and_validate(struct drm_device *ddev,
}
st.ofm.precision = param;
break;
+ case NPU_SET_OFM_BLK_WIDTH_M1:
+ st.ofm_blk_width = param & 0x7f;
+ break;
+ case NPU_SET_OFM_BLK_HEIGHT_M1:
+ st.ofm_blk_height = param & 0x7f;
+ break;
case NPU_SET_OFM_REGION:
st.ofm.region = param & 0x7;
break;
@@ -1087,6 +1200,34 @@ static int ethosu_gem_cmdstream_copy_and_validate(struct drm_device *ddev,
case NPU_SET_SCALE_REGION:
st.scale[0].region = param & 0x7;
break;
+ case NPU_SET_RESIZE_X_SCALE_N_M1:
+ if (ethosu_is_u65(edev))
+ break;
+ if (param & GENMASK(15, 11))
+ return -EINVAL;
+ st.resize[0].scale_n = param + 1;
+ break;
+ case NPU_SET_RESIZE_Y_SCALE_N_M1:
+ if (ethosu_is_u65(edev))
+ break;
+ if (param & GENMASK(15, 11))
+ return -EINVAL;
+ st.resize[1].scale_n = param + 1;
+ break;
+ case NPU_SET_RESIZE_X_OFFSET:
+ if (ethosu_is_u65(edev))
+ break;
+ if (param & GENMASK(15, 12))
+ return -EINVAL;
+ st.resize[0].offset = sign_extend32(param, 11);
+ break;
+ case NPU_SET_RESIZE_Y_OFFSET:
+ if (ethosu_is_u65(edev))
+ break;
+ if (param & GENMASK(15, 12))
+ return -EINVAL;
+ st.resize[1].offset = sign_extend32(param, 11);
+ break;
case NPU_SET_WEIGHT_BASE:
st.weight[0].base = addr;
break;
@@ -1123,6 +1264,22 @@ static int ethosu_gem_cmdstream_copy_and_validate(struct drm_device *ddev,
case NPU_SET_WEIGHT3_LENGTH:
st.weight[3].length = cmds[1];
break;
+ case NPU_SET_RESIZE_X:
+ case NPU_SET_RESIZE_Y:
+ if (ethosu_is_u65(edev))
+ break;
+ if ((cmds[0] & BIT(31)) ||
+ (cmds[1] & (GENMASK(31, 27) | GENMASK(15, 11))))
+ return -EINVAL;
+ st.resize[cmd - NPU_SET_RESIZE_X].one_step_int =
+ FIELD_GET(GENMASK(19, 16), cmds[0]);
+ st.resize[cmd - NPU_SET_RESIZE_X].blk_step_int =
+ FIELD_GET(GENMASK(30, 20), cmds[0]);
+ st.resize[cmd - NPU_SET_RESIZE_X].one_step_mod =
+ FIELD_GET(GENMASK(10, 0), cmds[1]);
+ st.resize[cmd - NPU_SET_RESIZE_X].blk_step_mod =
+ FIELD_GET(GENMASK(26, 16), cmds[1]);
+ break;
case NPU_SET_DMA0_SRC_REGION:
if (param & NPU_DMA_REGION_INDEX_MODE)
--
2.53.0
prev parent reply other threads:[~2026-09-05 0:44 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-05 0:43 [PATCH v2 00/19] accel: ethosu: Another batch of fixes Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 01/19] accel: ethosu: Suspend after initialization Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 02/19] accel: ethosu: Fix probe error cleanup Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 03/19] accel: ethosu: Disable clocks on PM setup failure Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 04/19] accel: ethosu: Quiesce jobs before scheduler teardown Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 05/19] accel: ethosu: Move DMA mode to src/dst struct Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 06/19] accel: ethosu: Track command stream register setup Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 07/19] accel: ethosu: Factor buffer bounds checks Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 08/19] accel: ethosu: Validate secondary streams Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 09/19] accel: ethosu: Reject unsupported commands Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 10/19] accel: ethosu: Validate all feature map tiles Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 11/19] accel: ethosu: Account for feature map element size Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 12/19] accel: ethosu: Validate convolution parameter Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 13/19] accel: ethosu: Account for kernel dilation in IFM size Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 14/19] accel: ethosu: Reject reserved command encodings Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 15/19] accel: ethosu: Validate accumulator input Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 16/19] accel: ethosu: Restrict dynamic IFM2 weights Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 17/19] accel: ethosu: Split U65 and U85 DMA length validation Rob Herring (Arm)
2026-09-05 0:43 ` [PATCH v2 18/19] accel: ethosu: Validate OFM transpose Rob Herring (Arm)
2026-09-05 0:43 ` Rob Herring (Arm) [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260904-ethosu-fixes-v2-19-3767738756a4@kernel.org \
--to=robh@kernel.org \
--cc=Frank.Li@nxp.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=linux-kernel@vger.kernel.org \
--cc=ogabbay@kernel.org \
--cc=tomeu@tomeuvizoso.net \
--cc=tzimmermann@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®