10000 Update cert firmware version to print hot fix and build numbers by ManojTakasi · Pull Request #1164 · amd/xdna-driver · GitHub
[go: up one dir, main page]

Skip to content

Update cert firmware version to print hot fix and build numbers#1164

Merged
NishadSaraf merged 1 commit intoamd:mainfrom
ManojTakasi:cert_version
Mar 11, 2026
Merged

Update cert firmware version to print hot fix and build numbers#1164
NishadSaraf merged 1 commit intoamd:mainfrom
ManojTakasi:cert_version

Conversation

@ManojTakasi
Copy link
Contributor

Update cert firmware version to print hot fix and build numbers.

XRT
Version : 2.23.0
Branch : HEAD
Hash : f8e923a4168dd552e02810de81288c34b416a0b4
Hash Date : Tue, 3 Mar 2026 10:59:04 -0800
amdxdna Version : 2.23.0_20260310, d410d8e3690a1362baff460d638c398f7ade4158
zocl Version : 2.21.0, f8e923a4168dd552e02810de81288c34b416a0b4
UC Firmware Version : 1.0.0.28, c8fbd0929042060d0fa4cffeff4dbc9577c7d5fe
UC Build Date : 2026-03-10

Copilot AI review requested due to automatic review settings March 10, 2026 10:22
@ManojTakasi ManojTakasi requested a review from xdavidz as a code owner March 10, 2026 10:22
Copy link
Contributor
Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the VE2 “cert/UC firmware version” reporting path so that hotfix (patch) and build numbers are surfaced end-to-end (kernel → ioctl/uapi struct → shim query output).

Changes:

  • Populate shim’s firmware_version patch/build from the ioctl’s hotfix/build fields instead of forcing them to 0.
  • Extend the kernel’s cached firmware version and debug logging to include hotfix/build.
  • Update the local uAPI query struct to include hotfix/build while keeping the overall struct size stable.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file
File Description
src/shim_ve2/xdna_device.cpp Uses fw_version.hotfix/build to fill patch/build in the shim query result.
src/include/uapi/drm_local/amdxdna_accel.h Adds hotfix/build to the VE2 firmware query struct and adjusts git_hash length to preserve struct size.
src/driver/amdxdna/ve2_fw.h Extends the kernel-side cached firmware version struct with hotfix/build.
src/driver/amdxdna/ve2_fw.c Stores hotfix/build from firmware and logs full major.minor.hotfix.build.
src/driver/amdxdna/ve2_debug.c Returns hotfix/build to userspace via the query ioctl.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines 18 to 25
struct ve2_firmware_version {
u8 major;
u8 minor;
char git_hash[VE2_FW_HASH_STRING_LENGTH];
char date[VE2_FW_DATE_STRING_LENGTH];
u8 hotfix;
u8 build;
};
Copy link
Copilot AI Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

struct ve2_firmware_version is smaller than VE2_CERT_VERSION_SIZE (0x40). In ve2_store_firmware_version() the driver reads VE2_CERT_VERSION_SIZE bytes from firmware into a buffer sized as sizeof(struct ve2_firmware_version), which can overflow and corrupt memory. Consider defining an on-wire/padded 0x40-byte struct (or adding an explicit reserved/padding array + static assert on size), or changing the read size to sizeof(*version)/allocating VE2_CERT_VERSION_SIZE bytes and then parsing safely.

Copilot uses AI. Check for mistakes.
Comment on lines +36 to +37
c_version->hotfix = version->hotfix;
c_version->build = version->build;
Copy link
Copilot AI Mar 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assigning c_version->hotfix/build from version->hotfix/build relies on version containing valid data, but ve2_store_firmware_version() currently reads VE2_CERT_VERSION_SIZE (0x40) bytes into version allocated with sizeof(*version) (see earlier in the function). This can overflow and also make these new fields unreliable. Please make the read/allocation size match the buffer size (or read only sizeof(*version) / use a padded on-wire struct).

Copilot uses AI. Check for mistakes.
@maxzhen maxzhen requested a review from NishadSaraf March 10, 2026 15:53
Copy link
Collaborator
@maxzhen maxzhen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please remove the mention of "ve2" from all data structures in amdxdna_accel.h since this file contains interfaces common across all aie2p/aie4/ve2 drivers.

@ManojTakasi ManojTakasi force-pushed the cert_version branch 2 times, most recently from 3094315 to d1e892c Compare March 11, 2026 06:36
Copilot AI review requested due to automatic review settings March 11, 2026 06:36
Copy link
Contributor
Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

src/driver/amdxdna/ve2_debug.c:431

  • For GET_INFO queries, other handlers in this repo either copy out min(args->buffer_size, sizeof(version)) or return -ENOBUFS and update args->buffer_size with the required size. Here ve2_get_firmware_version() returns -EINVAL when the buffer is too small and does not report the required size, which makes the ioctl harder to use and inconsistent with e.g. aie4_query_firmware_version()/aie2_query_firmware_version().
	if (args->buffer_size < sizeof(version))
		return -EINVAL;

	if (copy_to_user((u64_to_user_ptr(args->buffer)), &version, sizeof(version)))
		return -EFAULT;

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +24 to 26
u8 build;
};

Copy link
Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ve2_store_firmware_version() reads VE2_CERT_VERSION_SIZE (0x40) bytes into a struct ve2_firmware_version buffer, but this struct is smaller (currently 56 bytes). This creates an out-of-bounds write in the read path. Fix by making the struct layout match the on-device blob size (e.g., add explicit padding / __packed + static assert), or change the read size to sizeof(struct ve2_firmware_version) if 0x40 is not required.

Suggested change
u8 build;
};
u8 build;
/* Pad to match VE2_CERT_VERSION_SIZE (0x40) bytes from firmware blob */
u8 reserved[8];
};
_Static_assert(sizeof(struct ve2_firmware_version) == VE2_CERT_VERSION_SIZE,
"ve2_firmware_version size must match VE2_CERT_VERSION_SIZE");

Copilot uses AI. Check for mistakes.
Comment on lines +411 to 415
struct amdxdna_dev_hdl *hdl = xdna->dev_handle;
struct ve2_firmware_version *fver = &hdl->fw_version;
struct amdxdna_drm_query_ve2_firmware_version version;
struct amdxdna_drm_query_firmware_version version;

if (!fver)
Copy link
Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fver is assigned as &hdl->fw_version, so the if (!fver) check can never be true. If the intent is to validate pointers, the code should check xdna/xdna->dev_handle before dereferencing xdna->dev_handle/hdl->fw_version (otherwise a NULL dev_handle would crash before the check).

Copilot uses AI. Check for mistakes.
@ManojTakasi ManojTakasi force-pushed the cert_version branch 2 times, most recently from 2955651 to 67a86f6 Compare March 11, 2026 07:17
Copilot AI review requested due to automatic review settings March 11, 2026 07:17
Copy link
Contributor
Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.


💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@ManojTakasi
Copy link
Contributor Author

Hi @maxzhen, I’ve removed the structure completely and am now using the existing amdxdna_drm_query_firmware_version, since the date and hash are no longer required in the examine report (we are already printing these values in the dmesg log). Could you please review and let me know if any further changes are needed?

maxzhen
maxzhen previously approved these changes Mar 11, 2026
Copilot AI review requested due to automatic review settings March 11, 2026 20:56
@NishadSaraf NishadSaraf dismissed stale reviews from chvamshi-xilinx and maxzhen via 0695189 March 11, 2026 20:56
Copy link
Contributor
Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review is ineligible. To be eligible to request a review, you need a paid Copilot license, or your organization must enable Copilot code review.

Update cert version to print hot fix and build numbers.
Temporarily remove cert firmware version query.

Signed-off-by: Takasi, Manoj <Manoj.Takasi@amd.com>
Signed-off-by: Nishad Saraf <nishads@amd.com>
@NishadSaraf NishadSaraf merged commit 149fb13 into amd:main Mar 11, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants

0