--- /dev/null
+From stable+bounces-294442-greg=kroah.com@vger.kernel.org Sun Aug 2 02:10:20 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Aug 2026 20:07:03 -0400
+Subject: drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable()
+To: stable@vger.kernel.org
+Cc: "Ville Syrjälä" <ville.syrjala@linux.intel.com>, "Ankit Nautiyal" <ankit.k.nautiyal@intel.com>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20260802000705.2176332-1-sashal@kernel.org>
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+[ Upstream commit 4b274b0b61ab2a529e5c22e9aa033f3028e639fc ]
+
+There's no point in doing all the other checks in
+intel_vrr_is_capable() if the platform doesn't support VRR at all
+Check HAS_VRR() before wasting time on the other checks.
+
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20251020185038.4272-23-ville.syrjala@linux.intel.com
+Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Stable-dep-of: f8a9262c7a6f ("drm/i915/vrr: require valid min/max vfreq for VRR")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_vrr.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_vrr.c
++++ b/drivers/gpu/drm/i915/display/intel_vrr.c
+@@ -22,6 +22,9 @@ bool intel_vrr_is_capable(struct intel_c
+ const struct drm_display_info *info = &connector->base.display_info;
+ struct intel_dp *intel_dp;
+
++ if (!HAS_VRR(display))
++ return false;
++
+ /*
+ * DP Sink is capable of VRR video timings if
+ * Ignore MSA bit is set in DPCD.
+@@ -46,8 +49,7 @@ bool intel_vrr_is_capable(struct intel_c
+ return false;
+ }
+
+- return HAS_VRR(display) &&
+- info->monitor_range.max_vfreq - info->monitor_range.min_vfreq > 10;
++ return info->monitor_range.max_vfreq - info->monitor_range.min_vfreq > 10;
+ }
+
+ bool intel_vrr_is_in_range(struct intel_connector *connector, int vrefresh)
--- /dev/null
+From stable+bounces-294443-greg=kroah.com@vger.kernel.org Sun Aug 2 02:07:18 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Aug 2026 20:07:04 -0400
+Subject: drm/i915/vrr: require valid min/max vfreq for VRR
+To: stable@vger.kernel.org
+Cc: Jani Nikula <jani.nikula@intel.com>, Martin Hodo <martin.hodo@intel.com>, Ankit Nautiyal <ankit.k.nautiyal@intel.com>, Joonas Lahtinen <joonas.lahtinen@linux.intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260802000705.2176332-2-sashal@kernel.org>
+
+From: Jani Nikula <jani.nikula@intel.com>
+
+[ Upstream commit f8a9262c7a6fc2de9802e14b0228114f0333869e ]
+
+Ensure the EDID provided min/max vfreq are valid. Most scenarios are
+already covered (by coincidence) through the checks in
+intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit
+about it. At worst, a zero min_vfreq could lead to a division by zero in
+intel_vrr_compute_vmax().
+
+Discovered using AI-assisted static analysis confirmed by Intel Product
+Security.
+
+Reported-by: Martin Hodo <martin.hodo@intel.com>
+Fixes: 117cd09ba528 ("drm/i915/display/dp: Compute VRR state in atomic_check")
+Cc: stable@vger.kernel.org # v5.12+
+Cc: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Reviewed-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
+Link: https://patch.msgid.link/20260625131040.1051272-1-jani.nikula@intel.com
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+(cherry picked from commit 1765cf59f517b02f3b0591fe5120930d08bddeb6)
+Signed-off-by: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_vrr.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/i915/display/intel_vrr.c
++++ b/drivers/gpu/drm/i915/display/intel_vrr.c
+@@ -49,6 +49,10 @@ bool intel_vrr_is_capable(struct intel_c
+ return false;
+ }
+
++ if (!info->monitor_range.min_vfreq || !info->monitor_range.max_vfreq ||
++ info->monitor_range.min_vfreq > info->monitor_range.max_vfreq)
++ return false;
++
+ return info->monitor_range.max_vfreq - info->monitor_range.min_vfreq > 10;
+ }
+
--- /dev/null
+From stable+bounces-294449-greg=kroah.com@vger.kernel.org Sun Aug 2 03:49:27 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Aug 2026 21:49:14 -0400
+Subject: drm/xe: Add page reclamation info to device info
+To: stable@vger.kernel.org
+Cc: Oak Zeng <oak.zeng@intel.com>, Brian Nguyen <brian3.nguyen@intel.com>, Shuicheng Lin <shuicheng.lin@intel.com>, Matthew Brost <matthew.brost@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260802014916.504747-3-sashal@kernel.org>
+
+From: Oak Zeng <oak.zeng@intel.com>
+
+[ Upstream commit 9b1a0e0a15c97987fdf56a615f3d13995bafd042 ]
+
+Starting from Xe3p, HW adds a feature assisting range based page
+reclamation. Introduce a bit in device info to indicate whether
+device has such capability.
+
+Signed-off-by: Oak Zeng <oak.zeng@intel.com>
+Signed-off-by: Brian Nguyen <brian3.nguyen@intel.com>
+Reviewed-by: Shuicheng Lin <shuicheng.lin@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20251212213225.3564537-15-brian3.nguyen@intel.com
+Stable-dep-of: 6384271ac1ac ("drm/xe/pt: Reset current_op in xe_pt_update_ops_init()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_device_types.h | 2 ++
+ drivers/gpu/drm/xe/xe_pci.c | 1 +
+ drivers/gpu/drm/xe/xe_pci_types.h | 1 +
+ 3 files changed, 4 insertions(+)
+
+--- a/drivers/gpu/drm/xe/xe_device_types.h
++++ b/drivers/gpu/drm/xe/xe_device_types.h
+@@ -305,6 +305,8 @@ struct xe_device {
+ * pcode mailbox commands.
+ */
+ u8 has_mbx_power_limits:1;
++ /** @info.has_page_reclaim_hw_assist: Device supports page reclamation feature */
++ u8 has_page_reclaim_hw_assist:1;
+ /** @info.has_pxp: Device has PXP support */
+ u8 has_pxp:1;
+ /** @info.has_range_tlb_inval: Has range based TLB invalidations */
+--- a/drivers/gpu/drm/xe/xe_pci.c
++++ b/drivers/gpu/drm/xe/xe_pci.c
+@@ -591,6 +591,7 @@ static int xe_info_init_early(struct xe_
+ xe->info.has_heci_cscfi = desc->has_heci_cscfi;
+ xe->info.has_late_bind = desc->has_late_bind;
+ xe->info.has_llc = desc->has_llc;
++ xe->info.has_page_reclaim_hw_assist = desc->has_page_reclaim_hw_assist;
+ xe->info.has_pxp = desc->has_pxp;
+ xe->info.has_sriov = desc->has_sriov;
+ xe->info.skip_guc_pc = desc->skip_guc_pc;
+--- a/drivers/gpu/drm/xe/xe_pci_types.h
++++ b/drivers/gpu/drm/xe/xe_pci_types.h
+@@ -42,6 +42,7 @@ struct xe_device_desc {
+ u8 has_late_bind:1;
+ u8 has_llc:1;
+ u8 has_mbx_power_limits:1;
++ u8 has_page_reclaim_hw_assist:1;
+ u8 has_pxp:1;
+ u8 has_sriov:1;
+ u8 needs_scratch:1;
--- /dev/null
+From stable+bounces-294450-greg=kroah.com@vger.kernel.org Sun Aug 2 03:49:32 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Aug 2026 21:49:15 -0400
+Subject: drm/xe/pt: Reset current_op in xe_pt_update_ops_init()
+To: stable@vger.kernel.org
+Cc: "Zongyao Bai" <zongyao.bai@intel.com>, "Matthew Auld" <matthew.auld@intel.com>, "Matthew Brost" <matthew.brost@intel.com>, "Thomas Hellström" <thomas.hellstrom@linux.intel.com>, "Sasha Levin" <sashal@kernel.org>
+Message-ID: <20260802014916.504747-4-sashal@kernel.org>
+
+From: Zongyao Bai <zongyao.bai@intel.com>
+
+[ Upstream commit 6384271ac1ac0099198d15df79212a19ebdb929d ]
+
+xe_pt_update_ops_init() fails to reset current_op to 0. On the
+vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside
+the xe_validation_guard() / drm_exec_until_all_locked() loop. When
+that loop retries due to lock contention or OOM eviction
+(drm_exec_retry_on_contention() / xe_validation_retry_on_oom()),
+xe_pt_update_ops_prepare() runs again on the same vops, and each
+call to bind_op_prepare() increments current_op without resetting it.
+
+After N retries current_op exceeds the array size allocated by
+xe_vma_ops_alloc(), causing an out-of-bounds write into
+SLUB-poisoned memory and a subsequent UAF crash in
+xe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind.
+
+Also reset needs_svm_lock and needs_invalidation which are derived in
+the same prepare pass and would otherwise cause wrong migrate ops
+selection and redundant TLB invalidation on retry.
+
+Fix this by resetting current_op, needs_svm_lock and needs_invalidation
+in xe_pt_update_ops_init().
+
+v2 (Matt):
+ - Add details in commit message.
+ - Add Fixes tag and Cc to stable@vger.kernel.org
+
+Fixes: e8babb280b5e ("drm/xe: Convert multiple bind ops into single job")
+Suggested-by: Matthew Auld <matthew.auld@intel.com>
+Cc: stable@vger.kernel.org
+Assisted-by: GitHub-Copilot:claude-sonnet-4.6
+Signed-off-by: Zongyao Bai <zongyao.bai@intel.com>
+Reviewed-by: Matthew Brost <matthew.brost@intel.com>
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Link: https://patch.msgid.link/20260714232433.2737533-1-zongyao.bai@intel.com
+(cherry picked from commit 046045543e530605c441063535e7dca0075369a6)
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_pt.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/xe/xe_pt.c
++++ b/drivers/gpu/drm/xe/xe_pt.c
+@@ -2153,8 +2153,11 @@ static void
+ xe_pt_update_ops_init(struct xe_vm_pgtable_update_ops *pt_update_ops)
+ {
+ init_llist_head(&pt_update_ops->deferred);
++ pt_update_ops->current_op = 0;
+ pt_update_ops->start = ~0x0ull;
+ pt_update_ops->last = 0x0ull;
++ pt_update_ops->needs_svm_lock = false;
++ pt_update_ops->needs_invalidation = false;
+ }
+
+ /**
--- /dev/null
+From stable+bounces-294448-greg=kroah.com@vger.kernel.org Sun Aug 2 03:49:26 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Aug 2026 21:49:13 -0400
+Subject: drm/xe: Stub out new pagefault layer
+To: stable@vger.kernel.org
+Cc: Matthew Brost <matthew.brost@intel.com>, Lucas De Marchi <lucas.demarchi@intel.com>, Francois Dugast <francois.dugast@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260802014916.504747-2-sashal@kernel.org>
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+[ Upstream commit 620a09fb0bddf387f418663478b48ca4ba62b6d6 ]
+
+Stub out the new page fault layer and add kernel documentation. This is
+intended as a replacement for the GT page fault layer, enabling multiple
+producers to hook into a shared page fault consumer interface.
+
+v2:
+ - Fix kernel doc typo (checkpatch)
+ - Remove comment around GT (Stuart)
+ - Add explaination around reclaim (Francois)
+ - Add comment around u8 vs enum (Francois)
+ - Include engine instance (Stuart)
+v3:
+ - Fix XE_PAGEFAULT_TYPE_ATOMIC_ACCESS_VIOLATION kernel doc (Stuart)
+
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Tested-by: Francois Dugast <francois.dugast@intel.com>
+Link: https://patch.msgid.link/20251031165416.2871503-2-matthew.brost@intel.com
+Stable-dep-of: 6384271ac1ac ("drm/xe/pt: Reset current_op in xe_pt_update_ops_init()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/Makefile | 1
+ drivers/gpu/drm/xe/xe_pagefault.c | 65 +++++++++++++++
+ drivers/gpu/drm/xe/xe_pagefault.h | 19 ++++
+ drivers/gpu/drm/xe/xe_pagefault_types.h | 136 ++++++++++++++++++++++++++++++++
+ 4 files changed, 221 insertions(+)
+ create mode 100644 drivers/gpu/drm/xe/xe_pagefault.c
+ create mode 100644 drivers/gpu/drm/xe/xe_pagefault.h
+ create mode 100644 drivers/gpu/drm/xe/xe_pagefault_types.h
+
+--- a/drivers/gpu/drm/xe/Makefile
++++ b/drivers/gpu/drm/xe/Makefile
+@@ -94,6 +94,7 @@ xe-y += xe_bb.o \
+ xe_nvm.o \
+ xe_oa.o \
+ xe_observation.o \
++ xe_pagefault.o \
+ xe_pat.o \
+ xe_pci.o \
+ xe_pcode.o \
+--- /dev/null
++++ b/drivers/gpu/drm/xe/xe_pagefault.c
+@@ -0,0 +1,65 @@
++// SPDX-License-Identifier: MIT
++/*
++ * Copyright © 2025 Intel Corporation
++ */
++
++#include "xe_pagefault.h"
++#include "xe_pagefault_types.h"
++
++/**
++ * DOC: Xe page faults
++ *
++ * Xe page faults are handled in two layers. The producer layer interacts with
++ * hardware or firmware to receive and parse faults into struct xe_pagefault,
++ * then forwards them to the consumer. The consumer layer services the faults
++ * (e.g., memory migration, page table updates) and acknowledges the result back
++ * to the producer, which then forwards the results to the hardware or firmware.
++ * The consumer uses a page fault queue sized to absorb all potential faults and
++ * a multi-threaded worker to process them. Multiple producers are supported,
++ * with a single shared consumer.
++ *
++ * xe_pagefault.c implements the consumer layer.
++ */
++
++/**
++ * xe_pagefault_init() - Page fault init
++ * @xe: xe device instance
++ *
++ * Initialize Xe page fault state. Must be done after reading fuses.
++ *
++ * Return: 0 on Success, errno on failure
++ */
++int xe_pagefault_init(struct xe_device *xe)
++{
++ /* TODO - implement */
++ return 0;
++}
++
++/**
++ * xe_pagefault_reset() - Page fault reset for a GT
++ * @xe: xe device instance
++ * @gt: GT being reset
++ *
++ * Reset the Xe page fault state for a GT; that is, squash any pending faults on
++ * the GT.
++ */
++void xe_pagefault_reset(struct xe_device *xe, struct xe_gt *gt)
++{
++ /* TODO - implement */
++}
++
++/**
++ * xe_pagefault_handler() - Page fault handler
++ * @xe: xe device instance
++ * @pf: Page fault
++ *
++ * Sink the page fault to a queue (i.e., a memory buffer) and queue a worker to
++ * service it. Safe to be called from IRQ or process context. Reclaim safe.
++ *
++ * Return: 0 on success, errno on failure
++ */
++int xe_pagefault_handler(struct xe_device *xe, struct xe_pagefault *pf)
++{
++ /* TODO - implement */
++ return 0;
++}
+--- /dev/null
++++ b/drivers/gpu/drm/xe/xe_pagefault.h
+@@ -0,0 +1,19 @@
++/* SPDX-License-Identifier: MIT */
++/*
++ * Copyright © 2025 Intel Corporation
++ */
++
++#ifndef _XE_PAGEFAULT_H_
++#define _XE_PAGEFAULT_H_
++
++struct xe_device;
++struct xe_gt;
++struct xe_pagefault;
++
++int xe_pagefault_init(struct xe_device *xe);
++
++void xe_pagefault_reset(struct xe_device *xe, struct xe_gt *gt);
++
++int xe_pagefault_handler(struct xe_device *xe, struct xe_pagefault *pf);
++
++#endif
+--- /dev/null
++++ b/drivers/gpu/drm/xe/xe_pagefault_types.h
+@@ -0,0 +1,136 @@
++/* SPDX-License-Identifier: MIT */
++/*
++ * Copyright © 2025 Intel Corporation
++ */
++
++#ifndef _XE_PAGEFAULT_TYPES_H_
++#define _XE_PAGEFAULT_TYPES_H_
++
++#include <linux/workqueue.h>
++
++struct xe_gt;
++struct xe_pagefault;
++
++/** enum xe_pagefault_access_type - Xe page fault access type */
++enum xe_pagefault_access_type {
++ /** @XE_PAGEFAULT_ACCESS_TYPE_READ: Read access type */
++ XE_PAGEFAULT_ACCESS_TYPE_READ = 0,
++ /** @XE_PAGEFAULT_ACCESS_TYPE_WRITE: Write access type */
++ XE_PAGEFAULT_ACCESS_TYPE_WRITE = 1,
++ /** @XE_PAGEFAULT_ACCESS_TYPE_ATOMIC: Atomic access type */
++ XE_PAGEFAULT_ACCESS_TYPE_ATOMIC = 2,
++};
++
++/** enum xe_pagefault_type - Xe page fault type */
++enum xe_pagefault_type {
++ /** @XE_PAGEFAULT_TYPE_NOT_PRESENT: Not present */
++ XE_PAGEFAULT_TYPE_NOT_PRESENT = 0,
++ /** @XE_PAGEFAULT_TYPE_WRITE_ACCESS_VIOLATION: Write access violation */
++ XE_PAGEFAULT_TYPE_WRITE_ACCESS_VIOLATION = 1,
++ /** @XE_PAGEFAULT_TYPE_ATOMIC_ACCESS_VIOLATION: Atomic access violation */
++ XE_PAGEFAULT_TYPE_ATOMIC_ACCESS_VIOLATION = 2,
++};
++
++/** struct xe_pagefault_ops - Xe pagefault ops (producer) */
++struct xe_pagefault_ops {
++ /**
++ * @ack_fault: Ack fault
++ * @pf: Page fault
++ * @err: Error state of fault
++ *
++ * Page fault producer receives acknowledgment from the consumer and
++ * sends the result to the HW/FW interface.
++ */
++ void (*ack_fault)(struct xe_pagefault *pf, int err);
++};
++
++/**
++ * struct xe_pagefault - Xe page fault
++ *
++ * Generic page fault structure for communication between producer and consumer.
++ * Carefully sized to be 64 bytes. Upon a device page fault, the producer
++ * populates this structure, and the consumer copies it into the page-fault
++ * queue for deferred handling.
++ */
++struct xe_pagefault {
++ /**
++ * @gt: GT of fault
++ */
++ struct xe_gt *gt;
++ /**
++ * @consumer: State for the software handling the fault. Populated by
++ * the producer and may be modified by the consumer to communicate
++ * information back to the producer upon fault acknowledgment.
++ */
++ struct {
++ /** @consumer.page_addr: address of page fault */
++ u64 page_addr;
++ /** @consumer.asid: address space ID */
++ u32 asid;
++ /**
++ * @consumer.access_type: access type, u8 rather than enum to
++ * keep size compact
++ */
++ u8 access_type;
++ /**
++ * @consumer.fault_type: fault type, u8 rather than enum to
++ * keep size compact
++ */
++ u8 fault_type;
++#define XE_PAGEFAULT_LEVEL_NACK 0xff /* Producer indicates nack fault */
++ /** @consumer.fault_level: fault level */
++ u8 fault_level;
++ /** @consumer.engine_class: engine class */
++ u8 engine_class;
++ /** @consumer.engine_instance: engine instance */
++ u8 engine_instance;
++ /** consumer.reserved: reserved bits for future expansion */
++ u8 reserved[7];
++ } consumer;
++ /**
++ * @producer: State for the producer (i.e., HW/FW interface). Populated
++ * by the producer and should not be modified—or even inspected—by the
++ * consumer, except for calling operations.
++ */
++ struct {
++ /** @producer.private: private pointer */
++ void *private;
++ /** @producer.ops: operations */
++ const struct xe_pagefault_ops *ops;
++#define XE_PAGEFAULT_PRODUCER_MSG_LEN_DW 4
++ /**
++ * @producer.msg: page fault message, used by producer in fault
++ * acknowledgment to formulate response to HW/FW interface.
++ * Included in the page-fault message because the producer
++ * typically receives the fault in a context where memory cannot
++ * be allocated (e.g., atomic context or the reclaim path).
++ */
++ u32 msg[XE_PAGEFAULT_PRODUCER_MSG_LEN_DW];
++ } producer;
++};
++
++/**
++ * struct xe_pagefault_queue: Xe pagefault queue (consumer)
++ *
++ * Used to capture all device page faults for deferred processing. Size this
++ * queue to absorb the device’s worst-case number of outstanding faults.
++ */
++struct xe_pagefault_queue {
++ /**
++ * @data: Data in queue containing struct xe_pagefault, protected by
++ * @lock
++ */
++ void *data;
++ /** @size: Size of queue in bytes */
++ u32 size;
++ /** @head: Head pointer in bytes, moved by producer, protected by @lock */
++ u32 head;
++ /** @tail: Tail pointer in bytes, moved by consumer, protected by @lock */
++ u32 tail;
++ /** @lock: protects page fault queue */
++ spinlock_t lock;
++ /** @worker: to process page faults */
++ struct work_struct worker;
++};
++
++#endif
--- /dev/null
+From stable+bounces-294447-greg=kroah.com@vger.kernel.org Sun Aug 2 03:49:23 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 1 Aug 2026 21:49:12 -0400
+Subject: drm/xe: Use SVM range helpers in PT layer
+To: stable@vger.kernel.org
+Cc: Matthew Brost <matthew.brost@intel.com>, Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260802014916.504747-1-sashal@kernel.org>
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+[ Upstream commit 9ea9b45701ab50049a722450abc28346d1121e6e ]
+
+We have helpers SVM range start, end, and size. Use them in the PT
+layer rather than directly looking at the struct.
+
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
+Link: https://lore.kernel.org/r/20251022230122.922382-1-matthew.brost@intel.com
+Stable-dep-of: 6384271ac1ac ("drm/xe/pt: Reset current_op in xe_pt_update_ops_init()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_pt.c | 28 ++++++++++++++--------------
+ 1 file changed, 14 insertions(+), 14 deletions(-)
+
+--- a/drivers/gpu/drm/xe/xe_pt.c
++++ b/drivers/gpu/drm/xe/xe_pt.c
+@@ -715,7 +715,7 @@ xe_pt_stage_bind(struct xe_tile *tile, s
+ .vm = vm,
+ .tile = tile,
+ .curs = &curs,
+- .va_curs_start = range ? range->base.itree.start :
++ .va_curs_start = range ? xe_svm_range_start(range) :
+ xe_vma_start(vma),
+ .vma = vma,
+ .wupd.entries = entries,
+@@ -734,7 +734,7 @@ xe_pt_stage_bind(struct xe_tile *tile, s
+ }
+ if (xe_svm_range_has_dma_mapping(range)) {
+ xe_res_first_dma(range->base.pages.dma_addr, 0,
+- range->base.itree.last + 1 - range->base.itree.start,
++ xe_svm_range_size(range),
+ &curs);
+ xe_svm_range_debug(range, "BIND PREPARE - MIXED");
+ } else {
+@@ -778,8 +778,8 @@ xe_pt_stage_bind(struct xe_tile *tile, s
+
+ walk_pt:
+ ret = xe_pt_walk_range(&pt->base, pt->level,
+- range ? range->base.itree.start : xe_vma_start(vma),
+- range ? range->base.itree.last + 1 : xe_vma_end(vma),
++ range ? xe_svm_range_start(range) : xe_vma_start(vma),
++ range ? xe_svm_range_end(range) : xe_vma_end(vma),
+ &xe_walk.base);
+
+ *num_entries = xe_walk.wupd.num_used_entries;
+@@ -983,8 +983,8 @@ bool xe_pt_zap_ptes_range(struct xe_tile
+ if (!(pt_mask & BIT(tile->id)))
+ return false;
+
+- (void)xe_pt_walk_shared(&pt->base, pt->level, range->base.itree.start,
+- range->base.itree.last + 1, &xe_walk.base);
++ (void)xe_pt_walk_shared(&pt->base, pt->level, xe_svm_range_start(range),
++ xe_svm_range_end(range), &xe_walk.base);
+
+ return xe_walk.needs_invalidate;
+ }
+@@ -1711,8 +1711,8 @@ static unsigned int xe_pt_stage_unbind(s
+ struct xe_svm_range *range,
+ struct xe_vm_pgtable_update *entries)
+ {
+- u64 start = range ? range->base.itree.start : xe_vma_start(vma);
+- u64 end = range ? range->base.itree.last + 1 : xe_vma_end(vma);
++ u64 start = range ? xe_svm_range_start(range) : xe_vma_start(vma);
++ u64 end = range ? xe_svm_range_end(range) : xe_vma_end(vma);
+ struct xe_pt_stage_unbind_walk xe_walk = {
+ .base = {
+ .ops = &xe_pt_stage_unbind_ops,
+@@ -1922,7 +1922,7 @@ static int bind_range_prepare(struct xe_
+
+ vm_dbg(&xe_vma_vm(vma)->xe->drm,
+ "Preparing bind, with range [%lx...%lx)\n",
+- range->base.itree.start, range->base.itree.last);
++ xe_svm_range_start(range), xe_svm_range_end(range) - 1);
+
+ pt_op->vma = NULL;
+ pt_op->bind = true;
+@@ -1937,8 +1937,8 @@ static int bind_range_prepare(struct xe_
+ pt_op->num_entries, true);
+
+ xe_pt_update_ops_rfence_interval(pt_update_ops,
+- range->base.itree.start,
+- range->base.itree.last + 1);
++ xe_svm_range_start(range),
++ xe_svm_range_end(range));
+ ++pt_update_ops->current_op;
+ pt_update_ops->needs_svm_lock = true;
+
+@@ -2033,7 +2033,7 @@ static int unbind_range_prepare(struct x
+
+ vm_dbg(&vm->xe->drm,
+ "Preparing unbind, with range [%lx...%lx)\n",
+- range->base.itree.start, range->base.itree.last);
++ xe_svm_range_start(range), xe_svm_range_end(range) - 1);
+
+ pt_op->vma = XE_INVALID_VMA;
+ pt_op->bind = false;
+@@ -2044,8 +2044,8 @@ static int unbind_range_prepare(struct x
+
+ xe_vm_dbg_print_entries(tile_to_xe(tile), pt_op->entries,
+ pt_op->num_entries, false);
+- xe_pt_update_ops_rfence_interval(pt_update_ops, range->base.itree.start,
+- range->base.itree.last + 1);
++ xe_pt_update_ops_rfence_interval(pt_update_ops, xe_svm_range_start(range),
++ xe_svm_range_end(range));
+ ++pt_update_ops->current_op;
+ pt_update_ops->needs_svm_lock = true;
+ pt_update_ops->needs_invalidation |= xe_vm_has_scratch(vm) ||
drm-xe-vm-fix-bo-prefetch-with-consult_mem_advise_pref_loc.patch
drm-exec-remove-the-index-parameter-from-drm_exec_for_each_locked_obj.patch
drm-xe-wait-on-external-bo-kernel-fences-in-exec-ioctl.patch
+drm-i915-vrr-check-has_vrr-first-in-intel_vrr_is_capable.patch
+drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch
+drm-xe-use-svm-range-helpers-in-pt-layer.patch
+drm-xe-stub-out-new-pagefault-layer.patch
+drm-xe-add-page-reclamation-info-to-device-info.patch
+drm-xe-pt-reset-current_op-in-xe_pt_update_ops_init.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
