In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe: Flush LSC untyped L1 dataport cache after rcs\/ccs batches<\/p>\n
emit_render_cache_flush() sets PIPE_CONTROL0_HDC_PIPELINE_FLUSH to
\nflush the L2\/HDC data cache before fence signalling, but it never
\nrequests a flush of the LSC untyped L1 data cache via the ‘Untyped
\nData-Port Cache Flush Enable’ bit in PIPE_CONTROL DWord0[11].<\/p>\n
Per the Bspec, in 3D pipeline mode HDC Pipeline Flush is documented to
\nalso flush\/invalidate the untyped L1 cache, but only depending on how
\nHDC_CHICKEN0[13:11] is programmed. Starting with MTL, this coupling
\nbetween HDC Pipeline Flush and the untyped L1 cache flush no longer
\nholds in practice, regardless of how HDC_CHICKEN0 is programmed, so
\nrelying on it is not safe on newer platforms such as BMG. Mesa’s Vulkan
\ndriver (anv) has been assuming the kernel flushes both caches between
\nsubmissions, and hit user-visible corruption in apps such as Llama.cpp
\nbecause of this gap; it now works around it by flushing both caches
\nagain from userspace at the end of every command buffer.<\/p>\n
Correctness between submissions on the same queue is userspace’s
\nresponsibility and belongs in Mesa, not the kernel. However, for
\nsecurity we must ensure stale data can’t leak through the untyped L1
\ndataport cache once memory is reclaimed or evicted, which requires the
\nKMD to flush it before releasing memory for reuse.<\/p>\n
Prior to MTL, HDC_CHICKEN0 could be programmed (as already done for
\nDG2 via Wa_22010960976\/Wa_14013347512) to reliably keep HDC Pipeline
\nFlush coupled to the untyped L1 cache flush, so those platforms are
\nunaffected. Mesa’s own anv driver found that on MTL the HW
\ndisconnected the two independently of how HDC_CHICKEN0 is programmed,
\nand could not bring the old behavior back even by writing the register
\nby hand; see Mesa commit 7c2ff46a4fc3 (“anv: don’t prevent L1 untyped
\ncache flush in 3D mode”). The kernel can’t reliably request the flush
\nfrom the CS on MTL either, so restrict the new PIPE_CONTROL bit to
\nGRAPHICS_VERx100 >= 2000 (Xe2 and later), where it can be relied on.<\/p>\n
Explicitly set PIPE_CONTROL0_UNTYPED_DATAPORT_CACHE_FLUSH together
\nwith PIPE_CONTROL0_HDC_PIPELINE_FLUSH in emit_render_cache_flush() on
\nXe2 and later, so the L1 data cache is known clean before memory is
\nreleased for reuse, without depending on undocumented
\nplatform-specific HDC_CHICKEN0 behavior.<\/p>\n
Bspec: 56551
\n(cherry picked from commit 434514b6fe731e873808297c268fc52cdf4a1ce6)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/xe: Flush LSC untyped L1 dataport cache after rcs\/ccs batches<\/p>\n
emit_render_cache_flush() sets PIPE_CONTROL0_HDC_PIPELINE_FLUSH <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29052","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29052","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29052"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29052"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29052"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}