From 7cf85c190814c209cb182eaba39e184c1655faa9 Mon Sep 17 00:00:00 2001 From: Matthew Auld Date: Tue, 8 Sep 2026 17:50:54 +0100 Subject: drm/xe/mmio_gem: reject VM_EXEC and drop VM_DONTCOPY MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Hardware MMIO registers should never be executable; reject VM_EXEC at mmap time and clear VM_MAYEXEC to prevent later mprotect attempts. Also drop VM_DONTCOPY so that child processes across fork() can inherit the mapping and lazily fault in the PFNs, matching standard DRM GEM semantics and making the existing drm_gem_vm_open() callback functional. This aligns with existing PCI_BARRIER, which will use this in the next patch. We don't want any noticeable behaviour change there, since this will be user visible. This will also be the first user. Assisted-by: LLM Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Tejas Upadhyay Cc: Matthew Brost Cc: Ilia Levi Reviewed-by: Thomas Hellström Link: https://patch.msgid.link/20260908165046.1393557-17-matthew.auld@intel.com --- drivers/gpu/drm/xe/xe_mmio_gem.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/xe/xe_mmio_gem.c b/drivers/gpu/drm/xe/xe_mmio_gem.c index 5ffe03d36190..3cdc9538957d 100644 --- a/drivers/gpu/drm/xe/xe_mmio_gem.c +++ b/drivers/gpu/drm/xe/xe_mmio_gem.c @@ -177,9 +177,12 @@ static int xe_mmio_gem_mmap(struct drm_gem_object *base, struct vm_area_struct * if ((vma->vm_flags & VM_SHARED) == 0) return -EINVAL; + if (vma->vm_flags & VM_EXEC) + return -EINVAL; + vma->vm_page_prot = pgprot_noncached(vma_get_page_prot(vma)); - vm_flags_set(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP | - VM_DONTCOPY | VM_NORESERVE); + vm_flags_mod(vma, VM_IO | VM_PFNMAP | VM_DONTEXPAND | VM_DONTDUMP | + VM_NORESERVE, VM_MAYEXEC); /* Defer actual mapping to the fault handler. */ return 0; -- cgit v1.2.3