Man Yue Mo: Gaining kernel code execution on an MTE-enabled Pixel 8

On gaming PCs, the GPU can still access host RAM directly over PCIe. E.g. Vulkan on AMD offers three memory heaps: one device-local (VRAM), one device-local and host-visible (~256MB of VRAM that's mapped into the host's physical address space), and one non-device-local (the whole of host RAM; "Can use as a fall-back when GPU device runs out of memory") (https://gpuopen.com/learn/vulkan-device-memory/). VRAM and RAM are physically distinct and have very different performance and caching behaviour, but otherwise they can be used largely interchangeably.

I think that means it is no more inherently secure than the fully-shared-memory model of mobile GPUs. Both rely on IOMMUs etc (and the drivers that configure them) to prevent one process using the GPU to read another process's memory or to bypass other protections.

(Modern game consoles also have fully shared memory. PCs with discrete GPUs are the outlier - I guess it's largely for historical reasons, where PC GPUs were originally add-on cards on a slow bus and therefore had to use their own GPU-local memory, and then system designers saw no need to optimise host RAM for GPU-like access patterns because anyone who cared about performance was already using discrete GPUs, so integrated GPUs were slow and bad, and that architecture persisted despite the major drawbacks.)