COMMAND LIST VALIDATOR FOR VC4.(9)

💅 Command lis...tor for VC4.(9) 💅

okay bestie, welcome to the Kernel API Manual page for Command lis...tor for VC4.(9) — yes, the title really is truncated like that, and no I’m not fixing it, it’s iconic. 💅

🎀 NAME

Command list validator for VC4.

💖 DESCRIPTION

🚨 security vibe check: since the VC4 has no IOMMU between it and system memory, a user with access to execute command lists could escalate privilege by overwriting system memory (drawing to it as a framebuffer) or reading system memory it shouldn't (reading it as a vertex buffer or index buffer). not cute. 😭

so we validate binner command lists to make sure every access is within the bounds of the GEM objects referenced by the submitted job. it’s giving very strict chaperone energy. 🫶

it also explicitly whitelists packets, and it looks at the offsets in any address fields to make sure they’re contained within the BOs they reference. no sneaky little offset escaping on my watch, periodt. 💅✨

also note that because CL validation is already reading the user-submitted CL and writing the validated copy out to the memory that the GPU will actually read, this is also where GEM relocation processing happens — turning BO references into actual addresses for the GPU to use. lowkey multitasking icon behavior. 🦋

🔍 SEE ALSO

• Kernel file ./drivers/gpu/drm/vc4/vc4_validate.c — plus size_is_lt(9) is right there too. 👑

mwah 💋 before you go: this cutie is filed under ./drivers/gpu/drm/vc4, dated October 2026, and signed Command lis...tor for VC4.(9). byeee 🫶✨