FAILED: patch "[PATCH] accel/ivpu: Validate firmware log buffer metadata" failed to apply to 6.6-stable tree

PATCH New [email protected] 2 participants 6 messages Sep 16

Subsystems (3)

Stable branch DRM compute accelerators drivers and framework DRM accel drivers for Intel VPU

lore

Share & tools

lore

[email protected]

author maintainer

2026-09-16 15:27 UTC #0 lore raw

The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 0724afc55c77c36c7feb9a7264b02aa7593c5c2d
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026091601-reply-pointy-7e61@gregkh' --subject-prefix 'PATCH 6.6.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 0724afc55c77c36c7feb9a7264b02aa7593c5c2d Mon Sep 17 00:00:00 2001
From: Magdalena Schulfer <[email protected]>
Date: Tue, 1 Sep 2026 14:57:48 +0200
Subject: [PATCH] accel/ivpu: Validate firmware log buffer metadata

The tracing log headers parsed by fw_log_print_buffer() reside in DMA-shared BOs that the NPU firmware can write to.

fw_log_from_bo() validated log->header_size and log->size, but fw_log_print_buffer() re-read those same fields from shared memory afterwards, allowing a TOCTOU where firmware changes them between the check and the use, and making the host dereference out-of-bounds addresses while printing logs.

Snapshot the validated values once with READ_ONCE() and pass them down explicitly in a new struct ivpu_fw_log_desc instead of re-reading them from the shared struct.

Cc [email protected]

Fixes d4e4257afa6e ("accel/ivpu: Add firmware tracing support")

Signed-off-by Magdalena Schulfer <[email protected]>

Signed-off-by Dawid Osuchowski <[email protected]>

Reviewed-by Karol Wachowski <[email protected]>

Signed-off-by Karol Wachowski <[email protected]>

Link https://patch.msgid.link/[email protected] open here

drivers/accel/ivpu/ivpu_fw_log.c +45 ~~-31~~

index 716467aa3156..4f9055aa9d33 100644
@@ -26,10 +26,17 @@ MODULE_PARM_DESC(fw_log_level,
 		 " error=" __stringify(IVPU_FW_LOG_ERROR)
 		 " fatal=" __stringify(IVPU_FW_LOG_FATAL));
 
+struct ivpu_fw_log_desc {
+	struct vpu_tracing_buffer_header *log;
+	u32 header_size;
+	u32 size;
+};
+
 static int fw_log_from_bo(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *offset,
-			  struct vpu_tracing_buffer_header **out_log)
+			  struct ivpu_fw_log_desc *desc)
 {
 	struct vpu_tracing_buffer_header *log;
+	u32 header_size, size;
 
 	if ((*offset + sizeof(*log)) > ivpu_bo_size(bo))
 		return -EINVAL;

@@ -39,26 +46,32 @@ static int fw_log_from_bo(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *off
 	if (log->vpu_canary_start != VPU_TRACING_BUFFER_CANARY)
 		return -EINVAL;
 
-	if (log->header_size < sizeof(*log) || log->header_size > 1024) {
-		ivpu_dbg(vdev, FW_BOOT, "Invalid header size 0x%x\n", log->header_size);
+	header_size = READ_ONCE(log->header_size);
+	size = READ_ONCE(log->size);
+
+	if (header_size < sizeof(*log) || header_size > 1024) {
+		ivpu_dbg(vdev, FW_BOOT, "Invalid header size 0x%x\n", header_size);
 		return -EINVAL;
 	}
-	if (log->size < log->header_size) {
-		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
+	if ((char *)log + size > (char *)ivpu_bo_vaddr(bo) + ivpu_bo_size(bo)) {
+		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", size);
 		return -EINVAL;
 	}
-	if ((char *)log + log->size > (char *)ivpu_bo_vaddr(bo) + ivpu_bo_size(bo)) {
-		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
+	if (size < header_size) {
+		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x < header size 0x%x\n",
+			 size, header_size);
 		return -EINVAL;
 	}
 
-	*out_log = log;
-	*offset += log->size;
+	desc->log = log;
+	desc->header_size = header_size;
+	desc->size = size;
+	*offset += size;
 
 	ivpu_dbg(vdev, FW_BOOT,
 		 "FW log name \"%s\", write offset 0x%x size 0x%x, wrap count %d, hdr version %d size %d format %d, alignment %d",
-		 log->name, log->write_index, log->size, log->wrap_count, log->header_version,
-		 log->header_size, log->format, log->alignment);
+		 log->name, log->write_index, size, log->wrap_count, log->header_version,
+		 header_size, log->format, log->alignment);
 
 	return 0;
 }

@@ -94,11 +107,12 @@ static void fw_log_print_lines(char *buffer, u32 size, struct drm_printer *p)
 		drm_printf(p, "%s", line);
 }
 
-static void fw_log_print_buffer(struct vpu_tracing_buffer_header *log, const char *prefix,
+static void fw_log_print_buffer(struct ivpu_fw_log_desc *desc, const char *prefix,
 				bool only_new_msgs, struct drm_printer *p)
 {
-	char *log_data = (void *)log + log->header_size;
-	u32 data_size = log->size - log->header_size;
+	struct vpu_tracing_buffer_header *log = desc->log;
+	char *log_data = (void *)log + desc->header_size;
+	u32 data_size = desc->size - desc->header_size;
 	u32 log_start = only_new_msgs ? READ_ONCE(log->read_index) : 0;
 	u32 log_end = READ_ONCE(log->write_index);

@@ -134,11 +148,11 @@ static void
 fw_log_print_all_in_bo(struct ivpu_device *vdev, const char *name,
 		       struct ivpu_bo *bo, bool only_new_msgs, struct drm_printer *p)
 {
-	struct vpu_tracing_buffer_header *log;
+	struct ivpu_fw_log_desc desc;
 	u32 next = 0;
 
-	while (fw_log_from_bo(vdev, bo, &next, &log) == 0)
-		fw_log_print_buffer(log, name, only_new_msgs, p);
+	while (fw_log_from_bo(vdev, bo, &next, &desc) == 0)
+		fw_log_print_buffer(&desc, name, only_new_msgs, p);
 }
 
 void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p)

@@ -149,36 +163,36 @@ void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_
 
 void ivpu_fw_log_mark_read(struct ivpu_device *vdev)
 {
-	struct vpu_tracing_buffer_header *log;
+	struct ivpu_fw_log_desc desc;
 	u32 next;
 
 	next = 0;
-	while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) {
-		log->read_index = READ_ONCE(log->write_index);
-		log->read_wrap_count = READ_ONCE(log->wrap_count);
+	while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &desc) == 0) {
+		desc.log->read_index = READ_ONCE(desc.log->write_index);
+		desc.log->read_wrap_count = READ_ONCE(desc.log->wrap_count);
 	}
 
 	next = 0;
-	while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) {
-		log->read_index = READ_ONCE(log->write_index);
-		log->read_wrap_count = READ_ONCE(log->wrap_count);
+	while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &desc) == 0) {
+		desc.log->read_index = READ_ONCE(desc.log->write_index);
+		desc.log->read_wrap_count = READ_ONCE(desc.log->wrap_count);
 	}
 }
 
 void ivpu_fw_log_reset(struct ivpu_device *vdev)
 {
-	struct vpu_tracing_buffer_header *log;
+	struct ivpu_fw_log_desc desc;
 	u32 next;
 
 	next = 0;
-	while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) {
-		log->read_index = 0;
-		log->read_wrap_count = 0;
+	while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &desc) == 0) {
+		desc.log->read_index = 0;
+		desc.log->read_wrap_count = 0;
 	}
 
 	next = 0;
-	while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) {
-		log->read_index = 0;
-		log->read_wrap_count = 0;
+	while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &desc) == 0) {
+		desc.log->read_index = 0;
+		desc.log->read_wrap_count = 0;
 	}
 }

Sasha Levin

maintainer

2026-09-16 18:55 UTC #1 lore raw

PATCH 1/5 accel/ivpu: Fix a typo

From: Andrew Kreimer <[email protected]>

[ Upstream commit 284a8908f5ec25355a831e3e2d87975d748e98dc ]

Fix a typo in comments.

Reported-by Matthew Wilcox <[email protected]>

Signed-off-by Andrew Kreimer <[email protected]>

Signed-off-by Simona Vetter <[email protected]>

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

Stable-dep-of: 0724afc55c77 ("accel/ivpu: Validate firmware log buffer metadata")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/accel/ivpu/vpu_boot_api.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/accel/ivpu/vpu_boot_api.h +1 -1

index 6b71be92ba653..88345070a9965 100644
@@ -8,7 +8,7 @@
 
 /*
  * =========== FW API version information beginning ================
- *  The bellow values will be used to construct the version info this way:
+ *  The below values will be used to construct the version info this way:
  *  fw_bin_header->api_version[VPU_BOOT_API_VER_ID] = (VPU_BOOT_API_VER_MAJOR << 16) |
  *  VPU_BOOT_API_VER_MINOR;
  *  VPU_BOOT_API_VER_PATCH will be ignored. KMD and compatibility is not affected if this changes.

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-09-16 18:55 UTC #2 lore raw

PATCH 2/5 accel/ivpu: Update VPU FW API headers

From: Andrzej Kacprowski <[email protected]>

[ Upstream commit a4293cc75348409f998c991c48cbe5532c438114 ]

This commit bumps:
- Boot API from 3.24.0 to 3.26.3
- JSM API from 3.16.0 to 3.25.0

Signed-off-by Andrzej Kacprowski <[email protected]>

Co-developed-by Tomasz Rusinowicz <[email protected]>

Signed-off-by Tomasz Rusinowicz <[email protected]>

Reviewed-by Jacek Lawrynowicz <[email protected]>

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

Signed-off-by Jacek Lawrynowicz <[email protected]>

Backport to 6.6: retain only the tracing-header read_wrap_count member needed by the firmware log printing changes preceding 0724afc55c77. Replace one reserved u32 so the tracing header size and subsequent field offsets stay unchanged.

Drop the unrelated Boot/JSM version bumps, scheduling, native-fence and power-management updates, together with the job queue conversion and message-name changes. This tree has older API definitions and lacks ivpu_jsm_msg_type_to_str(); importing those changes is unnecessary for firmware log metadata validation. No functions are added.

The separate firmware logging refactors and BO accessor changes are still required before the unmodified upstream target can apply to this tree.

[ sashal: Reduced backport -- upstream a4293cc753484 touches 4 file(s), this
backport carries 1. Not backported here:
drivers/accel/ivpu/ivpu_job.c drivers/accel/ivpu/ivpu_jsm_msg.c drivers/accel/ivpu/vpu_jsm_api.h
This note is generated from the file lists only; see the resolution record for the reasoning. ]

Stable-dep-of: 0724afc55c77 ("accel/ivpu: Validate firmware log buffer metadata")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/accel/ivpu/vpu_boot_api.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

drivers/accel/ivpu/vpu_boot_api.h +3 -1

index 88345070a9965..7d302693f4562 100644
@@ -301,7 +301,9 @@ struct vpu_tracing_buffer_header {
 	u32 host_canary_start;
 	/* offset from start of buffer for trace entries */
 	u32 read_index;
-	u32 pad_to_cache_line_size_0[14];
+	/* keeps track of wrapping on the reader side */
+	u32 read_wrap_count;
+	u32 pad_to_cache_line_size_0[13];
 	/* End of first cache line */
 
 	/**

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-09-16 18:55 UTC #3 lore raw

PATCH 3/5 accel/ivpu: Reset fw log on cold boot

In reply to Sasha Levin

From: Tomasz Rusinowicz <[email protected]>

[ Upstream commit 4b4d9e394b6f45ac26ac6144b31604c76b7e3705 ]

Add ivpu_fw_log_reset() that resets the read_index of all FW logs on cold boot so logs are properly read.

Signed-off-by Tomasz Rusinowicz <[email protected]>

Reviewed-by Jacek Lawrynowicz <[email protected]>

Reviewed-by Jeffrey Hugo <[email protected]>

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

Signed-off-by Jacek Lawrynowicz <[email protected]>

Stable-dep-of: 0724afc55c77 ("accel/ivpu: Validate firmware log buffer metadata")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/accel/ivpu/ivpu_fw_log.c | 14 ++++++++++++++
 drivers/accel/ivpu/ivpu_fw_log.h |  1 +
 drivers/accel/ivpu/ivpu_pm.c     |  1 +
 3 files changed, 16 insertions(+)

drivers/accel/ivpu/ivpu_fw_log.c +14 -0

index ccad9aa99e5d6..0ed29e5ac8e52 100644
@@ -144,3 +144,17 @@ void ivpu_fw_log_clear(struct ivpu_device *vdev)
 	while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0)
 		log_header->read_index = log_header->write_index;
 }
+
+void ivpu_fw_log_reset(struct ivpu_device *vdev)
+{
+	struct vpu_tracing_buffer_header *log_header;
+	u32 next;
+
+	next = 0;
+	while (fw_log_ptr(vdev, vdev->fw->mem_log_crit, &next, &log_header) == 0)
+		log_header->read_index = 0;
+
+	next = 0;
+	while (fw_log_ptr(vdev, vdev->fw->mem_log_verb, &next, &log_header) == 0)
+		log_header->read_index = 0;
+}

drivers/accel/ivpu/ivpu_fw_log.h +1 -0

index 0b2573f6f3151..692ee0f266a31 100644
@@ -27,6 +27,7 @@ extern unsigned int ivpu_log_level;
 
 void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p);
 void ivpu_fw_log_clear(struct ivpu_device *vdev);
+void ivpu_fw_log_reset(struct ivpu_device *vdev);
 
 static inline void ivpu_fw_log_dump(struct ivpu_device *vdev)
 {

drivers/accel/ivpu/ivpu_pm.c +1 -0

index ffff2496e8e8e..e17e4e6b037ee 100644
@@ -30,6 +30,7 @@ static void ivpu_pm_prepare_cold_boot(struct ivpu_device *vdev)
 
 	ivpu_cmdq_reset_all_contexts(vdev);
 	ivpu_ipc_reset(vdev);
+	ivpu_fw_log_reset(vdev);
 	ivpu_fw_load(vdev);
 	fw->entry_point = fw->cold_boot_entry_point;
 }

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-09-16 18:55 UTC #4 lore raw

PATCH 4/5 accel/ivpu: Refactor functions in ivpu_fw_log.c

In reply to Sasha Levin

From: Jacek Lawrynowicz <[email protected]>

[ Upstream commit 1fc1251149a76d3b75d7f4c94d9c4e081b7df6b4 ]

Make function names more consistent and (arguably) readable in fw log code. Add fw_log_print_all_in_bo() that remove duplicated code in ivpu_fw_log_print().

Reviewed-by Tomasz Rusinowicz <[email protected]>

Link https://patchwork.freedesktop.org/patch/msgid/[email protected]

Signed-off-by Jacek Lawrynowicz <[email protected]>

Backport to 6.6: keep the VPU log labels and the existing module parameter. Convert the existing ivpu_fw_log_print() into fw_log_print_all_in_bo() and move its two BO calls into the existing debugfs and dump callers. This preserves the number of functions; no helper or accessor functions are added. Rename the existing parser, line printer and mark-read entry point consistently with upstream.

Carry the log-printing prerequisites from 4bc988b470195 and the index bounds checks from dd1311bcf0e62 so 0724afc55c77 can be cherry-picked without conflicts. The tracing header already has read_wrap_count from an earlier dependency, and the log-size/header-size check is already present. Keep both checks and reset/update the reader wrap count.

Map the upstream BO accessor names to this branch's existing fields with local macros, avoiding the unrelated GEM conversion and additional functions. The target can then snapshot validated metadata and pass it to every log consumer without re-reading the shared size fields.

Include ivpu_fw_log.h in ivpu_pm.c: the preceding cold-boot dependency added an ivpu_fw_log_reset() call without its declaration in this tree.

Stable-dep-of: 0724afc55c77 ("accel/ivpu: Validate firmware log buffer metadata")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/accel/ivpu/ivpu_debugfs.c |   5 +-
 drivers/accel/ivpu/ivpu_fw_log.c  | 110 ++++++++++++++++++------------
 drivers/accel/ivpu/ivpu_fw_log.h  |   9 ++-
 drivers/accel/ivpu/ivpu_pm.c      |   1 +
 4 files changed, 76 insertions(+), 49 deletions(-)

drivers/accel/ivpu/ivpu_debugfs.c +3 -2

index 5e5996fd4f9f1..502a0a6468b5e 100644
@@ -119,7 +119,8 @@ static int fw_log_show(struct seq_file *s, void *v)
 	struct ivpu_device *vdev = s->private;
 	struct drm_printer p = drm_seq_file_printer(s);
 
-	ivpu_fw_log_print(vdev, true, &p);
+	fw_log_print_all_in_bo(vdev, "VPU critical", vdev->fw->mem_log_crit, true, &p);
+	fw_log_print_all_in_bo(vdev, "VPU verbose", vdev->fw->mem_log_verb, true, &p);
 	return 0;
 }

@@ -137,7 +138,7 @@ fw_log_fops_write(struct file *file, const char __user *user_buf, size_t size, l
 	if (!size)
 		return -EINVAL;
 
-	ivpu_fw_log_clear(vdev);
+	ivpu_fw_log_mark_read(vdev);
 	return size;
 }

drivers/accel/ivpu/ivpu_fw_log.c +66 ~~-44~~

176 lines not on this page · raw message

drivers/accel/ivpu/ivpu_fw_log.h +6 -3

index 692ee0f266a31..da17fab5ad3d8 100644
@@ -11,6 +11,7 @@
 #include <drm/drm_print.h>
 
 #include "ivpu_drv.h"
+#include "ivpu_fw.h"
 
 #define IVPU_FW_LOG_DEFAULT 0
 #define IVPU_FW_LOG_DEBUG   1

@@ -25,15 +26,17 @@ extern unsigned int ivpu_log_level;
 #define IVPU_FW_VERBOSE_BUFFER_LARGE_SIZE	SZ_8M
 #define IVPU_FW_CRITICAL_BUFFER_SIZE		SZ_512K
 
-void ivpu_fw_log_print(struct ivpu_device *vdev, bool only_new_msgs, struct drm_printer *p);
-void ivpu_fw_log_clear(struct ivpu_device *vdev);
+void fw_log_print_all_in_bo(struct ivpu_device *vdev, const char *name,
+			    struct ivpu_bo *bo, bool only_new_msgs, struct drm_printer *p);
+void ivpu_fw_log_mark_read(struct ivpu_device *vdev);
 void ivpu_fw_log_reset(struct ivpu_device *vdev);
 
 static inline void ivpu_fw_log_dump(struct ivpu_device *vdev)
 {
 	struct drm_printer p = drm_info_printer(vdev->drm.dev);
 
-	ivpu_fw_log_print(vdev, false, &p);
+	fw_log_print_all_in_bo(vdev, "VPU critical", vdev->fw->mem_log_crit, false, &p);
+	fw_log_print_all_in_bo(vdev, "VPU verbose", vdev->fw->mem_log_verb, false, &p);
 }
 
 #endif /* __IVPU_FW_LOG_H__ */

drivers/accel/ivpu/ivpu_pm.c +1 -0

index e17e4e6b037ee..3a59242b6a423 100644
@@ -13,6 +13,7 @@
 #include "ivpu_drv.h"
 #include "ivpu_hw.h"
 #include "ivpu_fw.h"
+#include "ivpu_fw_log.h"
 #include "ivpu_ipc.h"
 #include "ivpu_job.h"
 #include "ivpu_mmu.h"

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-09-16 18:56 UTC #5 lore raw

PATCH 5/5 accel/ivpu: Validate firmware log buffer metadata

In reply to Sasha Levin

From: Magdalena Schulfer <[email protected]>

[ Upstream commit 0724afc55c77c36c7feb9a7264b02aa7593c5c2d ]

The tracing log headers parsed by fw_log_print_buffer() reside in DMA-shared BOs that the NPU firmware can write to.

Snapshot the validated values once with READ_ONCE() and pass them down explicitly in a new struct ivpu_fw_log_desc instead of re-reading them from the shared struct.

Cc [email protected]

Fixes d4e4257afa6e ("accel/ivpu: Add firmware tracing support")

Signed-off-by Magdalena Schulfer <[email protected]>

Signed-off-by Dawid Osuchowski <[email protected]>

Reviewed-by Karol Wachowski <[email protected]>

Signed-off-by Karol Wachowski <[email protected]>

Link https://patch.msgid.link/[email protected] open here

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/accel/ivpu/ivpu_fw_log.c | 76 +++++++++++++++++++-------------
 1 file changed, 45 insertions(+), 31 deletions(-)

drivers/accel/ivpu/ivpu_fw_log.c +45 ~~-31~~

index 365f2d782cdde..86001beb91cc9 100644
@@ -30,10 +30,17 @@ MODULE_PARM_DESC(ivpu_log_level,
 		 " error=" __stringify(IVPU_FW_LOG_ERROR)
 		 " fatal=" __stringify(IVPU_FW_LOG_FATAL));
 
+struct ivpu_fw_log_desc {
+	struct vpu_tracing_buffer_header *log;
+	u32 header_size;
+	u32 size;
+};
+
 static int fw_log_from_bo(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *offset,
-			  struct vpu_tracing_buffer_header **out_log)
+			  struct ivpu_fw_log_desc *desc)
 {
 	struct vpu_tracing_buffer_header *log;
+	u32 header_size, size;
 
 	if ((*offset + sizeof(*log)) > ivpu_bo_size(bo))
 		return -EINVAL;

@@ -43,26 +50,32 @@ static int fw_log_from_bo(struct ivpu_device *vdev, struct ivpu_bo *bo, u32 *off
 	if (log->vpu_canary_start != VPU_TRACING_BUFFER_CANARY)
 		return -EINVAL;
 
-	if (log->header_size < sizeof(*log) || log->header_size > 1024) {
-		ivpu_dbg(vdev, FW_BOOT, "Invalid header size 0x%x\n", log->header_size);
+	header_size = READ_ONCE(log->header_size);
+	size = READ_ONCE(log->size);
+
+	if (header_size < sizeof(*log) || header_size > 1024) {
+		ivpu_dbg(vdev, FW_BOOT, "Invalid header size 0x%x\n", header_size);
 		return -EINVAL;
 	}
-	if (log->size < log->header_size) {
-		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
+	if ((char *)log + size > (char *)ivpu_bo_vaddr(bo) + ivpu_bo_size(bo)) {
+		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", size);
 		return -EINVAL;
 	}
-	if ((char *)log + log->size > (char *)ivpu_bo_vaddr(bo) + ivpu_bo_size(bo)) {
-		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x\n", log->size);
+	if (size < header_size) {
+		ivpu_dbg(vdev, FW_BOOT, "Invalid log size 0x%x < header size 0x%x\n",
+			 size, header_size);
 		return -EINVAL;
 	}
 
-	*out_log = log;
-	*offset += log->size;
+	desc->log = log;
+	desc->header_size = header_size;
+	desc->size = size;
+	*offset += size;
 
 	ivpu_dbg(vdev, FW_BOOT,
 		 "FW log name \"%s\", write offset 0x%x size 0x%x, wrap count %d, hdr version %d size %d format %d, alignment %d",
-		 log->name, log->write_index, log->size, log->wrap_count, log->header_version,
-		 log->header_size, log->format, log->alignment);
+		 log->name, log->write_index, size, log->wrap_count, log->header_version,
+		 header_size, log->format, log->alignment);
 
 	return 0;
 }

@@ -98,11 +111,12 @@ static void fw_log_print_lines(char *buffer, u32 size, struct drm_printer *p)
 		drm_printf(p, "%s", line);
 }
 
-static void fw_log_print_buffer(struct vpu_tracing_buffer_header *log, const char *prefix,
+static void fw_log_print_buffer(struct ivpu_fw_log_desc *desc, const char *prefix,
 				bool only_new_msgs, struct drm_printer *p)
 {
-	char *log_data = (void *)log + log->header_size;
-	u32 data_size = log->size - log->header_size;
+	struct vpu_tracing_buffer_header *log = desc->log;
+	char *log_data = (void *)log + desc->header_size;
+	u32 data_size = desc->size - desc->header_size;
 	u32 log_start = only_new_msgs ? READ_ONCE(log->read_index) : 0;
 	u32 log_end = READ_ONCE(log->write_index);

@@ -138,45 +152,45 @@ void
 fw_log_print_all_in_bo(struct ivpu_device *vdev, const char *name,
 		       struct ivpu_bo *bo, bool only_new_msgs, struct drm_printer *p)
 {
-	struct vpu_tracing_buffer_header *log;
+	struct ivpu_fw_log_desc desc;
 	u32 next = 0;
 
-	while (fw_log_from_bo(vdev, bo, &next, &log) == 0)
-		fw_log_print_buffer(log, name, only_new_msgs, p);
+	while (fw_log_from_bo(vdev, bo, &next, &desc) == 0)
+		fw_log_print_buffer(&desc, name, only_new_msgs, p);
 }
 
 void ivpu_fw_log_mark_read(struct ivpu_device *vdev)
 {
-	struct vpu_tracing_buffer_header *log;
+	struct ivpu_fw_log_desc desc;
 	u32 next;
 
 	next = 0;
-	while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) {
-		log->read_index = READ_ONCE(log->write_index);
-		log->read_wrap_count = READ_ONCE(log->wrap_count);
+	while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &desc) == 0) {
+		desc.log->read_index = READ_ONCE(desc.log->write_index);
+		desc.log->read_wrap_count = READ_ONCE(desc.log->wrap_count);
 	}
 
 	next = 0;
-	while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) {
-		log->read_index = READ_ONCE(log->write_index);
-		log->read_wrap_count = READ_ONCE(log->wrap_count);
+	while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &desc) == 0) {
+		desc.log->read_index = READ_ONCE(desc.log->write_index);
+		desc.log->read_wrap_count = READ_ONCE(desc.log->wrap_count);
 	}
 }
 
 void ivpu_fw_log_reset(struct ivpu_device *vdev)
 {
-	struct vpu_tracing_buffer_header *log;
+	struct ivpu_fw_log_desc desc;
 	u32 next;
 
 	next = 0;
-	while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &log) == 0) {
-		log->read_index = 0;
-		log->read_wrap_count = 0;
+	while (fw_log_from_bo(vdev, vdev->fw->mem_log_crit, &next, &desc) == 0) {
+		desc.log->read_index = 0;
+		desc.log->read_wrap_count = 0;
 	}
 
 	next = 0;
-	while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &log) == 0) {
-		log->read_index = 0;
-		log->read_wrap_count = 0;
+	while (fw_log_from_bo(vdev, vdev->fw->mem_log_verb, &next, &desc) == 0) {
+		desc.log->read_index = 0;
+		desc.log->read_wrap_count = 0;
 	}
 }

Signature · 1 line

2.53.0