Re: [PATCH 11/11] drm/amdgpu/vce4: Fix VCE 4 firmware size and offsets

["Timur Kristóf" <timur.kristof@gmail.com>]

On Thursday, April 23, 2026 1:31:03 PM Central European Summer Time Christian 
König wrote:
> On 4/23/26 03:16, Timur Kristóf wrote:
> > The VCPU BO contains the actual FW at an offset, but
> > it was not calculated into the VCPU BO size.
> > Subtract this from the FW size to make sure there is
> > no out of bounds access.
> > 
> > This may fix VM faults when using VCE 4.
> > 
> > Cc: John Olender <john.olender@gmail.com>
> > Fixes: c1dc356a116c ("drm/amdgpu: add initial vce 4.0 support for vega10")
> > Signed-off-by: Timur Kristóf <timur.kristof@gmail.com>
> 
> Leo can you take a look at this? VCE4 doesn't use the classic VCE FW
> validation any more.
> 
> So I'm not sure we have nor need that here.
> 
> Regards,
> Christian.

Hi  Leo & Christian,

If you take a look at vce_v4_0_mc_resume() you can see that it initializes the 
firmware offset like this:

offset = AMDGPU_VCE_FIRMWARE_OFFSET;

Specifically for the non-PSP code path, this triggers exactly the same issue as 
VCE2-3, that this causes the STACK and DATA to be also offset, and hence the 
DATA will be out of bounds of the VCPU BO.

For the PSP code path, the STACK and DATA no longer depend on the firmware 
offset and size, so that is fortunately not an issue anymore. In that case 
however the driver still uses the same offset for the ucode.

Best regards,
Timur

> 
> > ---
> > 
> >  drivers/gpu/drm/amd/amdgpu/vce_v4_0.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v4_0.c
> > b/drivers/gpu/drm/amd/amdgpu/vce_v4_0.c index
> > 3309e7b8f2a2e..eaa3e05a52e59 100644
> > --- a/drivers/gpu/drm/amd/amdgpu/vce_v4_0.c
> > +++ b/drivers/gpu/drm/amd/amdgpu/vce_v4_0.c
> > @@ -281,7 +281,7 @@ static int vce_v4_0_sriov_start(struct amdgpu_device
> > *adev)> 
> >  						
mmVCE_LMI_VCPU_CACHE_64BIT_BAR2),
> >  						(adev-
>vce.gpu_addr >> 40) & 0xff);
> > 
> > -		size = VCE_V4_0_FW_SIZE;
> > +		size = VCE_V4_0_FW_SIZE - AMDGPU_VCE_FIRMWARE_OFFSET;
> > 
> >  		MMSCH_V1_0_INSERT_DIRECT_WT(SOC15_REG_OFFSET(VCE, 0,
> >  		mmVCE_VCPU_CACHE_SIZE0), size);
> >  		
> >  		offset = (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) 
? offset +
> >  		size : 0;