FAILED: patch "[PATCH] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR" failed to apply to 7.1-stable tree

FAILED: patch "[PATCH] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR" failed to apply to 7.1-stable tree

[gregkh]

The patch below does not apply to the 7.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-7.1.y
git checkout FETCH_HEAD
git cherry-pick -x 4d58d7535e826a3175527b6174502f0db319d7f6
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026072909-boil-smartness-3be9@gregkh' --subject-prefix 'PATCH 7.1.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 4d58d7535e826a3175527b6174502f0db319d7f6 Mon Sep 17 00:00:00 2001
From: Jia Yao <jia.yao@intel.com>
Date: Fri, 17 Apr 2026 05:59:17 +0000
Subject: [PATCH] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR

Add validation in xe_vm_bind_ioctl() to reject PAT indices
with XE_COH_NONE coherency mode when used with
DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR.

CPU address mirror mappings use system memory that is CPU
cached, which makes them incompatible with COH_NONE PAT
indices. Allowing COH_NONE with CPU cached buffers is a
security risk, as the GPU may bypass CPU caches and read
stale sensitive data from DRAM.

Although CPU_ADDR_MIRROR does not create an immediate
mapping, the backing system memory is still CPU cached.
Apply the same PAT coherency restrictions as
DRM_XE_VM_BIND_OP_MAP_USERPTR.

v2:
- Correct fix tag

v6:
- No change

v7:
- Correct fix tag

v8:
- Rebase

v9:
- Limit the restrictions to iGPU

v10:
- Just add the iGPU logic but keep dGPU logic

Fixes: b43e864af0d4 ("drm/xe/uapi: Add DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR")
Cc: <stable@vger.kernel.org> # v6.15+
Cc: Shuicheng Lin <shuicheng.lin@intel.com>
Cc: Mathew Alwin <alwin.mathew@intel.com>
Cc: Michal Mrozek <michal.mrozek@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Matthew Auld <matthew.auld@intel.com>
Signed-off-by: Jia Yao <jia.yao@intel.com>
Reviewed-by: Matthew Auld <matthew.auld@intel.com>
Acked-by: Michal Mrozek <michal.mrozek@intel.com>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Link: https://patch.msgid.link/20260417055917.2027459-3-jia.yao@intel.com

diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 5f4220125c76..c3836f6eab35 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -3658,6 +3658,8 @@ static int vm_bind_ioctl_check_args(struct xe_device *xe, struct xe_vm *vm,
 				 op == DRM_XE_VM_BIND_OP_MAP_USERPTR) ||
 		    XE_IOCTL_DBG(xe, coh_mode == XE_COH_NONE &&
 				 op == DRM_XE_VM_BIND_OP_MAP_USERPTR) ||
+		    XE_IOCTL_DBG(xe, !IS_DGFX(xe) && coh_mode == XE_COH_NONE &&
+				 is_cpu_addr_mirror) ||
 		    XE_IOCTL_DBG(xe, xe_device_is_l2_flush_optimized(xe) &&
 				 (op == DRM_XE_VM_BIND_OP_MAP_USERPTR ||
 				  is_cpu_addr_mirror) &&

RE: FAILED: patch "[PATCH] drm/xe/uapi: Reject coh_none PAT index for CPU_ADDR_MIRROR" failed to apply to 7.1-stable tree

[Yao, Jia]

The fix is already present in linux-7.1.y at xe_vm.c:3694. No action needed.

> -----Original Message-----
> From: gregkh@linuxfoundation.org <gregkh@linuxfoundation.org>
> Sent: Wednesday, July 29, 2026 3:37 AM
> To: Yao, Jia <jia.yao@intel.com>; Mathew, Alwin <alwin.mathew@intel.com>;
> Auld, Matthew <matthew.auld@intel.com>; Brost, Matthew
> <matthew.brost@intel.com>; Mrozek, Michal <michal.mrozek@intel.com>;
> Lin, Shuicheng <shuicheng.lin@intel.com>; stable@vger.kernel.org
> Cc: stable@vger.kernel.org
> Subject: FAILED: patch "[PATCH] drm/xe/uapi: Reject coh_none PAT index for
> CPU_ADDR_MIRROR" failed to apply to 7.1-stable tree
> 
> 
> The patch below does not apply to the 7.1-stable tree.
> If someone wants it applied there, or to any other stable or longterm tree,
> then please email the backport, including the original git commit id to
> <stable@vger.kernel.org>.
> 
> To reproduce the conflict and resubmit, you may use the following commands:
> 
> git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
> linux-7.1.y git checkout FETCH_HEAD git cherry-pick -x
> 4d58d7535e826a3175527b6174502f0db319d7f6
> # <resolve conflicts, build, test, etc.> git commit -s git send-email --to
> '<stable@vger.kernel.org>' --in-reply-to '2026072909-boil-smartness-
> 3be9@gregkh' --subject-prefix 'PATCH 7.1.y' 'HEAD^..'
> 
> Possible dependencies:
> 
> 
> 
> thanks,
> 
> greg k-h
> 
> ------------------ original commit in Linus's tree ------------------
> 
> From 4d58d7535e826a3175527b6174502f0db319d7f6 Mon Sep 17
> 00:00:00 2001
> From: Jia Yao <jia.yao@intel.com>
> Date: Fri, 17 Apr 2026 05:59:17 +0000
> Subject: [PATCH] drm/xe/uapi: Reject coh_none PAT index for
> CPU_ADDR_MIRROR
> 
> Add validation in xe_vm_bind_ioctl() to reject PAT indices with XE_COH_NONE
> coherency mode when used with
> DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR.
> 
> CPU address mirror mappings use system memory that is CPU cached, which
> makes them incompatible with COH_NONE PAT indices. Allowing COH_NONE
> with CPU cached buffers is a security risk, as the GPU may bypass CPU caches
> and read stale sensitive data from DRAM.
> 
> Although CPU_ADDR_MIRROR does not create an immediate mapping, the
> backing system memory is still CPU cached.
> Apply the same PAT coherency restrictions as
> DRM_XE_VM_BIND_OP_MAP_USERPTR.
> 
> v2:
> - Correct fix tag
> 
> v6:
> - No change
> 
> v7:
> - Correct fix tag
> 
> v8:
> - Rebase
> 
> v9:
> - Limit the restrictions to iGPU
> 
> v10:
> - Just add the iGPU logic but keep dGPU logic
> 
> Fixes: b43e864af0d4 ("drm/xe/uapi: Add
> DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR")
> Cc: <stable@vger.kernel.org> # v6.15+
> Cc: Shuicheng Lin <shuicheng.lin@intel.com>
> Cc: Mathew Alwin <alwin.mathew@intel.com>
> Cc: Michal Mrozek <michal.mrozek@intel.com>
> Cc: Matthew Brost <matthew.brost@intel.com>
> Cc: Matthew Auld <matthew.auld@intel.com>
> Signed-off-by: Jia Yao <jia.yao@intel.com>
> Reviewed-by: Matthew Auld <matthew.auld@intel.com>
> Acked-by: Michal Mrozek <michal.mrozek@intel.com>
> Signed-off-by: Matthew Auld <matthew.auld@intel.com>
> Link: https://patch.msgid.link/20260417055917.2027459-3-
> jia.yao@intel.com
> 
> diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c index
> 5f4220125c76..c3836f6eab35 100644
> --- a/drivers/gpu/drm/xe/xe_vm.c
> +++ b/drivers/gpu/drm/xe/xe_vm.c
> @@ -3658,6 +3658,8 @@ static int vm_bind_ioctl_check_args(struct
> xe_device *xe, struct xe_vm *vm,
>  				 op ==
> DRM_XE_VM_BIND_OP_MAP_USERPTR) ||
>  		    XE_IOCTL_DBG(xe, coh_mode == XE_COH_NONE &&
>  				 op ==
> DRM_XE_VM_BIND_OP_MAP_USERPTR) ||
> +		    XE_IOCTL_DBG(xe, !IS_DGFX(xe) && coh_mode ==
> XE_COH_NONE &&
> +				 is_cpu_addr_mirror) ||
>  		    XE_IOCTL_DBG(xe, xe_device_is_l2_flush_optimized(xe) &&
>  				 (op ==
> DRM_XE_VM_BIND_OP_MAP_USERPTR ||
>  				  is_cpu_addr_mirror) &&