From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 70559F53D73 for ; Mon, 16 Mar 2026 16:43:00 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 373F010E2DD; Mon, 16 Mar 2026 16:43:00 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (2048-bit key; unprotected) header.d=intel.com header.i=@intel.com header.b="YiytAmpF"; dkim-atps=neutral Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.9]) by gabe.freedesktop.org (Postfix) with ESMTPS id E97B910E2DD for ; Mon, 16 Mar 2026 16:42:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1773679378; x=1805215378; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=qyfPteuWc+oHpiV0crwOxOWddDIRSMv914tnOFqikyU=; b=YiytAmpF8IUkucib9GcVd4aj5f1BsxN2i5cvh6vtl59K0QYF9zpv9f6y kBXRQBfg2zfy85qO0jx5IeK+5BCrtp2REuZkKwrqFN1iB8mGmIx+Yhoqm YibL2DLS+tBmzk6XpnE6DrttsyLfvmlG9EmANXUn4tqCvCTJRPmk9UBwq Kgq7UUn7Lw8aMmyOnV6bm5YDW1fwHWRx5glS1i/Ik57QtVJV8u1q6QZUd kREfLBOG1cmUxR8PeJE8nWlQby57Z1LqVuncYIMR+a+roCtEaM97UxunK 3MptxQoj5TWQyHMH+Nw8M18syIdOkmL89uGk9mFJSSdm495uQHS0Wp98F g==; X-CSE-ConnectionGUID: sOm2knGmSiCBnoAO+iSIlw== X-CSE-MsgGUID: rK7RDE6fTkmmvfnTJocPDA== X-IronPort-AV: E=McAfee;i="6800,10657,11731"; a="97308784" X-IronPort-AV: E=Sophos;i="6.23,124,1770624000"; d="scan'208";a="97308784" Received: from orviesa006.jf.intel.com ([10.64.159.146]) by orvoesa101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 16 Mar 2026 09:42:58 -0700 X-CSE-ConnectionGUID: G7x+sTvDRYuESNUNG7N7Og== X-CSE-MsgGUID: N6VGxwcISfaKfCtLytDyIg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,124,1770624000"; d="scan'208";a="221013872" Received: from dut6094bmgfrd.fm.intel.com ([10.80.55.31]) by orviesa006.jf.intel.com with ESMTP; 16 Mar 2026 09:42:58 -0700 From: Jia Yao To: intel-xe@lists.freedesktop.org Cc: Jia Yao , stable@vger.kernel.org, Shuicheng Lin , Mathew Alwin , Michal Mrozek , Matthew Brost , Matthew Auld Subject: [PATCH v6 2/2] drm/xe: Reject coh_none PAT index for CPU_ADDR_MIRROR Date: Mon, 16 Mar 2026 16:42:53 +0000 Message-ID: <20260316164253.262406-3-jia.yao@intel.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260316164253.262406-1-jia.yao@intel.com> References: <20260129000147.339361-1-jia.yao@intel.com> <20260316164253.262406-1-jia.yao@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: intel-xe@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel Xe graphics driver List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-xe-bounces@lists.freedesktop.org Sender: "Intel-xe" Add validation in xe_vm_bind_ioctl() to reject PAT indices with XE_COH_NONE coherency mode when used with DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR, consistent with the existing validation for DRM_XE_VM_BIND_OP_MAP_USERPTR. CPU address mirror mappings use system memory which is CPU cached, making them incompatible with COH_NONE PAT index. Using COH_NONE with CPU cached buffers is a security issue: GPU can bypass CPU caches and directly read stale sensitive data from DRAM, potentially leaking data from previously freed pages. Although CPU_ADDR_MIRROR mappings don't create actual memory mappings (the range is reserved for dynamic mapping on GPU page faults), the underlying system memory is still CPU cached, so the same PAT coherency restrictions as MAP_USERPTR should apply. v2: - Correct fix tag Fixes: e1fbc4f18d5b ("drm/xe/uapi: support pat_index selection with vm_bind") Cc: stable@vger.kernel.org # v6.18 Cc: Shuicheng Lin Cc: Mathew Alwin Cc: Michal Mrozek Cc: Matthew Brost Cc: Matthew Auld Signed-off-by: Jia Yao Reviewed-by: Matthew Auld --- drivers/gpu/drm/xe/xe_vm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c index 5572e12c2a7e..1c4b4a5eeadb 100644 --- a/drivers/gpu/drm/xe/xe_vm.c +++ b/drivers/gpu/drm/xe/xe_vm.c @@ -3491,7 +3491,7 @@ static int vm_bind_ioctl_check_args(struct xe_device *xe, struct xe_vm *vm, XE_IOCTL_DBG(xe, obj && op == DRM_XE_VM_BIND_OP_MAP_USERPTR) || XE_IOCTL_DBG(xe, coh_mode == XE_COH_NONE && - op == DRM_XE_VM_BIND_OP_MAP_USERPTR) || + (op == DRM_XE_VM_BIND_OP_MAP_USERPTR || is_cpu_addr_mirror)) || XE_IOCTL_DBG(xe, comp_en && op == DRM_XE_VM_BIND_OP_MAP_USERPTR) || XE_IOCTL_DBG(xe, op == DRM_XE_VM_BIND_OP_MAP_USERPTR && -- 2.43.0