[PATCH v5 0/2] drm/xe: PAT index validation for CPU_ADDR_MIRROR and madvise

Jia Yao
2026-03-16T16:42:57Z

This series strengthens PAT index validation to reject unsafe
configurations for CPU cached memory, preventing cases where the GPU may
bypass CPU caches and observe stale or sensitive data.

Patch 1 enforces PAT validation for the madvise ioctl path, ensuring
XE_COH_NONE cannot be used on CPU cached buffers, including CPU address
mirror and userptr-backed memory.

Patch 2 applies the same validation to vm_bind, treating
DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR the same as MAP_USERPTR with
respect to permissible PAT indices.

Both patches close a security gap affecting CPU cached memory access
when incoherent PAT values are used.

Changes since v5:
- Added an additional Fixes tag to correctly reference the root cause
patch enabling the problematic PAT behavior.

Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe")
Fixes: e1fbc4f18d5b ("drm/xe/uapi: support pat_index selection with vm_bind")
Cc: stable@vger.kernel.org # v6.18
Cc: Shuicheng Lin <shuicheng.lin@intel.com>
Cc: Mathew Alwin <alwin.mathew@intel.com>
Cc: Michal Mrozek <michal.mrozek@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>

Jia Yao (2):
drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in
madvise
drm/xe: Reject coh_none PAT index for CPU_ADDR_MIRROR

drivers/gpu/drm/xe/xe_vm.c | 2 +-
drivers/gpu/drm/xe/xe_vm_madvise.c | 45 ++++++++++++++++++++++++++++++
2 files changed, 46 insertions(+), 1 deletion(-)

--
2.43.0