[PATCH v5 0/2] drm/xe: PAT index validation for CPU_ADDR_MIRROR and

Jia Yao
2026-03-16T07:23:18Z

This patch series strengthens PAT index validation to reject unsafe
configurations for CPU cached memory, fixing a potential security issue
where GPU could bypass CPU caches and read stale sensitive data.

The first patch adds validation to the madvise ioctl path, rejecting
XE_COH_NONE PAT indices when applied to CPU cached buffers (including
CPU address mirror and userptr mappings).

The second patch extends this validation to the vm_bind ioctl path,
ensuring DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR is treated the same as
DRM_XE_VM_BIND_OP_MAP_USERPTR with respect to PAT index requirements.

Fixes: ada7486c5668 ("drm/xe: Implement madvise ioctl for xe")
Cc: stable@vger.kernel.org # v6.18
Cc: Shuicheng Lin <shuicheng.lin@intel.com>
Cc: Mathew Alwin <alwin.mathew@intel.com>
Cc: Michal Mrozek <michal.mrozek@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>

Jia Yao (2):
drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in
madvise
drm/xe: Reject coh_none PAT index for CPU_ADDR_MIRROR

drivers/gpu/drm/xe/xe_vm.c | 2 +-
drivers/gpu/drm/xe/xe_vm_madvise.c | 46 +++++++++++++++++++++++++++++-
2 files changed, 46 insertions(+), 2 deletions(-)

--
2.43.0