The U65 NPU_OP_CONV command has no parameter fields, but the
validator interpreted bit zero as the U85 weights_ifm2 field. A crafted
U65 stream could consequently make validation skip the weight buffer
that hardware accesses.
Require a zero parameter on U65 and reject the reserved U85 parameter
bits.
Fixes: 5a5e9c0228e6 ("accel: Add Arm Ethos-U NPU driver")
Cc: [email protected]
Assisted-by: LLM
Signed-off-by: Rob Herring (Arm) <[email protected]>
---
v2:
- new patch
---
drivers/accel/ethosu/ethosu_device.h | 1 +
drivers/accel/ethosu/ethosu_gem.c | 5 ++++-
2 files changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/accel/ethosu/ethosu_device.h
b/drivers/accel/ethosu/ethosu_device.h
index c330048dbcca..d7e1e3c8ca12 100644
--- a/drivers/accel/ethosu/ethosu_device.h
+++ b/drivers/accel/ethosu/ethosu_device.h
@@ -87,6 +87,7 @@ struct gen_pool;
#define PMU_EV_TYPE_IDLE 0x20
#define NPU_DMA_REGION_INDEX_MODE BIT(11)
+#define NPU_OP_CONV_WEIGHTS_IFM2 BIT(0)
enum ethosu_cmds {
NPU_OP_STOP = 0x0,
diff --git a/drivers/accel/ethosu/ethosu_gem.c
b/drivers/accel/ethosu/ethosu_gem.c
index 974cf562ef49..9c86f9062f55 100644
--- a/drivers/accel/ethosu/ethosu_gem.c
+++ b/drivers/accel/ethosu/ethosu_gem.c
@@ -764,7 +764,10 @@ static int ethosu_gem_cmdstream_copy_and_validate(struct
drm_device *ddev,
st.dma.dst.region, st.dma.dst.offset, dstlen);
break;
case NPU_OP_CONV:
- use_ifm2 = param & 0x1; // weights_ifm2
+ if ((ethosu_is_u65(edev) && param) || (param &
~NPU_OP_CONV_WEIGHTS_IFM2))
+ return -EINVAL;
+
+ use_ifm2 = param & NPU_OP_CONV_WEIGHTS_IFM2;
if (!cmd_state_reg_is_set(&st, NPU_SET_OFM_PRECISION))
return -EINVAL;
use_scale = !(st.ofm.precision & 0x100);
--
2.53.0
