From: Greg Kroah-Hartman Date: Fri, 7 Aug 2026 12:16:49 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v6.6.151~25 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=43c23bae6bd193ea14b10bb391d91820d43e9dd1;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: drm-xe-add-xe_migrate_resolve-wrapper-and-is_vram_resolve-support.patch drm-xe-bo-add-purgeable-bo-state-tracking-and-field-madv-to-xe_bo.patch drm-xe-pat-add-helper-to-query-compression-enable-status.patch drm-xe-vm-fix-bo-prefetch-with-consult_mem_advise_pref_loc.patch drm-xe-vm-prevent-binding-of-purged-buffer-objects.patch --- diff --git a/queue-6.18/drm-xe-add-xe_migrate_resolve-wrapper-and-is_vram_resolve-support.patch b/queue-6.18/drm-xe-add-xe_migrate_resolve-wrapper-and-is_vram_resolve-support.patch new file mode 100644 index 0000000000..edf33fcd7e --- /dev/null +++ b/queue-6.18/drm-xe-add-xe_migrate_resolve-wrapper-and-is_vram_resolve-support.patch @@ -0,0 +1,167 @@ +From stable+bounces-294376-greg=kroah.com@vger.kernel.org Sat Aug 1 16:05:13 2026 +From: Sasha Levin +Date: Sat, 1 Aug 2026 10:03:56 -0400 +Subject: drm/xe: add xe_migrate_resolve wrapper and is_vram_resolve support +To: stable@vger.kernel.org +Cc: Nitin Gote , Matthew Brost , Matthew Auld , Sasha Levin +Message-ID: <20260801140402.3645391-2-sashal@kernel.org> + +From: Nitin Gote + +[ Upstream commit be97fd06458d66a53aefb6d9429db0df734c81c0 ] + +Introduce an internal __xe_migrate_copy(..., is_vram_resolve) path and +expose a small wrapper xe_migrate_resolve() that calls it with +is_vram_resolve=true. + +For resolve/decompression operations we must ensure the copy code uses +the compression PAT index when appropriate; this change centralizes that +behavior and allows callers to schedule a resolve (decompress) operation +via the migrate API. + +v3: Fix kernel-doc warnings + +v2: (Matt) + - Simplify xe_migrate_resolve(), use single BO/resource; + remove copy_only_ccs argument as it's always false. + +Cc: Matthew Brost +Cc: Matthew Auld +Reviewed-by: Matthew Brost +Signed-off-by: Nitin Gote +Signed-off-by: Matthew Auld +Link: https://patch.msgid.link/20260304123758.3050386-7-nitin.r.gote@intel.com +Stable-dep-of: 7bc597ce74ba ("drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_migrate.c | 90 ++++++++++++++++++++++++++++------------ + drivers/gpu/drm/xe/xe_migrate.h | 4 + + 2 files changed, 67 insertions(+), 27 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_migrate.c ++++ b/drivers/gpu/drm/xe/xe_migrate.c +@@ -765,31 +765,13 @@ static u32 xe_migrate_ccs_copy(struct xe + return flush_flags; + } + +-/** +- * xe_migrate_copy() - Copy content of TTM resources. +- * @m: The migration context. +- * @src_bo: The buffer object @src is currently bound to. +- * @dst_bo: If copying between resources created for the same bo, set this to +- * the same value as @src_bo. If copying between buffer objects, set it to +- * the buffer object @dst is currently bound to. +- * @src: The source TTM resource. +- * @dst: The dst TTM resource. +- * @copy_only_ccs: If true copy only CCS metadata +- * +- * Copies the contents of @src to @dst: On flat CCS devices, +- * the CCS metadata is copied as well if needed, or if not present, +- * the CCS metadata of @dst is cleared for security reasons. +- * +- * Return: Pointer to a dma_fence representing the last copy batch, or +- * an error pointer on failure. If there is a failure, any copy operation +- * started by the function call has been synced. +- */ +-struct dma_fence *xe_migrate_copy(struct xe_migrate *m, +- struct xe_bo *src_bo, +- struct xe_bo *dst_bo, +- struct ttm_resource *src, +- struct ttm_resource *dst, +- bool copy_only_ccs) ++static struct dma_fence *__xe_migrate_copy(struct xe_migrate *m, ++ struct xe_bo *src_bo, ++ struct xe_bo *dst_bo, ++ struct ttm_resource *src, ++ struct ttm_resource *dst, ++ bool copy_only_ccs, ++ bool is_vram_resolve) + { + struct xe_gt *gt = m->tile->primary_gt; + struct xe_device *xe = gt_to_xe(gt); +@@ -810,8 +792,15 @@ struct dma_fence *xe_migrate_copy(struct + bool copy_ccs = xe_device_has_flat_ccs(xe) && + xe_bo_needs_ccs_pages(src_bo) && xe_bo_needs_ccs_pages(dst_bo); + bool copy_system_ccs = copy_ccs && (!src_is_vram || !dst_is_vram); +- bool use_comp_pat = type_device && xe_device_has_flat_ccs(xe) && +- GRAPHICS_VER(xe) >= 20 && src_is_vram && !dst_is_vram; ++ ++ /* ++ * For decompression operation, always use the compression PAT index. ++ * Otherwise, only use the compression PAT index for device memory ++ * when copying from VRAM to system memory. ++ */ ++ bool use_comp_pat = is_vram_resolve || (type_device && ++ xe_device_has_flat_ccs(xe) && ++ GRAPHICS_VER(xe) >= 20 && src_is_vram && !dst_is_vram); + + /* Copying CCS between two different BOs is not supported yet. */ + if (XE_WARN_ON(copy_ccs && src_bo != dst_bo)) +@@ -971,6 +960,53 @@ err_sync: + } + + /** ++ * xe_migrate_copy() - Copy content of TTM resources. ++ * @m: The migration context. ++ * @src_bo: The buffer object @src is currently bound to. ++ * @dst_bo: If copying between resources created for the same bo, set this to ++ * the same value as @src_bo. If copying between buffer objects, set it to ++ * the buffer object @dst is currently bound to. ++ * @src: The source TTM resource. ++ * @dst: The dst TTM resource. ++ * @copy_only_ccs: If true copy only CCS metadata ++ * ++ * Copies the contents of @src to @dst: On flat CCS devices, ++ * the CCS metadata is copied as well if needed, or if not present, ++ * the CCS metadata of @dst is cleared for security reasons. ++ * ++ * Return: Pointer to a dma_fence representing the last copy batch, or ++ * an error pointer on failure. If there is a failure, any copy operation ++ * started by the function call has been synced. ++ */ ++struct dma_fence *xe_migrate_copy(struct xe_migrate *m, ++ struct xe_bo *src_bo, ++ struct xe_bo *dst_bo, ++ struct ttm_resource *src, ++ struct ttm_resource *dst, ++ bool copy_only_ccs) ++{ ++ return __xe_migrate_copy(m, src_bo, dst_bo, src, dst, copy_only_ccs, false); ++} ++ ++/** ++ * xe_migrate_resolve() - Resolve and decompress a buffer object if required. ++ * @m: The migrate context ++ * @bo: The buffer object to resolve ++ * @res: The reservation object ++ * ++ * Wrapper around __xe_migrate_copy() with is_vram_resolve set to true ++ * to trigger decompression if needed. ++ * ++ * Return: A dma_fence that signals on completion, or an ERR_PTR on failure. ++ */ ++struct dma_fence *xe_migrate_resolve(struct xe_migrate *m, ++ struct xe_bo *bo, ++ struct ttm_resource *res) ++{ ++ return __xe_migrate_copy(m, bo, bo, res, res, false, true); ++} ++ ++/** + * xe_migrate_lrc() - Get the LRC from migrate context. + * @migrate: Migrate context. + * +--- a/drivers/gpu/drm/xe/xe_migrate.h ++++ b/drivers/gpu/drm/xe/xe_migrate.h +@@ -127,6 +127,10 @@ struct dma_fence *xe_migrate_copy(struct + struct ttm_resource *dst, + bool copy_only_ccs); + ++struct dma_fence *xe_migrate_resolve(struct xe_migrate *m, ++ struct xe_bo *bo, ++ struct ttm_resource *res); ++ + int xe_migrate_ccs_rw_copy(struct xe_tile *tile, struct xe_exec_queue *q, + struct xe_bo *src_bo, + struct ttm_resource *new_mem, diff --git a/queue-6.18/drm-xe-bo-add-purgeable-bo-state-tracking-and-field-madv-to-xe_bo.patch b/queue-6.18/drm-xe-bo-add-purgeable-bo-state-tracking-and-field-madv-to-xe_bo.patch new file mode 100644 index 0000000000..6f0f723e75 --- /dev/null +++ b/queue-6.18/drm-xe-bo-add-purgeable-bo-state-tracking-and-field-madv-to-xe_bo.patch @@ -0,0 +1,132 @@ +From stable+bounces-294377-greg=kroah.com@vger.kernel.org Sat Aug 1 16:04:45 2026 +From: Sasha Levin +Date: Sat, 1 Aug 2026 10:03:57 -0400 +Subject: drm/xe/bo: Add purgeable bo state tracking and field madv to xe_bo +To: stable@vger.kernel.org +Cc: "Arvind Yadav" , "Thomas Hellström" , "Himal Prasad Ghimiray" , "Matthew Brost" , "Sasha Levin" +Message-ID: <20260801140402.3645391-3-sashal@kernel.org> + +From: Arvind Yadav + +[ Upstream commit b67427f939ccf038a658badb02dd948c7b516248 ] + +Add infrastructure for tracking purgeable state of buffer objects. +This includes: + +Introduce enum xe_madv_purgeable_state with three states: + - XE_MADV_PURGEABLE_WILLNEED (0): BO is needed and should not be + purged. This is the default state for all BOs. + + - XE_MADV_PURGEABLE_DONTNEED (1): BO is not currently needed and + can be purged by the kernel under memory pressure to reclaim + resources. Only non-shared BOs can be marked as DONTNEED. + + - XE_MADV_PURGEABLE_PURGED (2): BO has been purged by the kernel. + Accessing a purged BO results in error. Follows i915 semantics + where once purged, the BO remains permanently invalid ("once + purged, always purged"). + +Add madv_purgeable field to struct xe_bo for state tracking + of purgeable state across concurrent access paths + +Cc: Thomas Hellström +Cc: Himal Prasad Ghimiray +Reviewed-by: Matthew Brost +Signed-off-by: Arvind Yadav +Signed-off-by: Matthew Brost +Link: https://patch.msgid.link/20260326130843.3545241-3-arvind.yadav@intel.com +Stable-dep-of: 7bc597ce74ba ("drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_bo.h | 56 +++++++++++++++++++++++++++++++++++++++ + drivers/gpu/drm/xe/xe_bo_types.h | 6 ++++ + 2 files changed, 62 insertions(+) + +--- a/drivers/gpu/drm/xe/xe_bo.h ++++ b/drivers/gpu/drm/xe/xe_bo.h +@@ -84,6 +84,28 @@ + + #define XE_PCI_BARRIER_MMAP_OFFSET (0x50 << XE_PTE_SHIFT) + ++/** ++ * enum xe_madv_purgeable_state - Buffer object purgeable state enumeration ++ * ++ * This enum defines the possible purgeable states for a buffer object, ++ * allowing userspace to provide memory usage hints to the kernel for ++ * better memory management under pressure. ++ * ++ * @XE_MADV_PURGEABLE_WILLNEED: The buffer object is needed and should not be purged. ++ * This is the default state. ++ * @XE_MADV_PURGEABLE_DONTNEED: The buffer object is not currently needed and can be ++ * purged by the kernel under memory pressure. ++ * @XE_MADV_PURGEABLE_PURGED: The buffer object has been purged by the kernel. ++ * ++ * Accessing a purged buffer will result in an error. Per i915 semantics, ++ * once purged, a BO remains permanently invalid and must be destroyed and recreated. ++ */ ++enum xe_madv_purgeable_state { ++ XE_MADV_PURGEABLE_WILLNEED, ++ XE_MADV_PURGEABLE_DONTNEED, ++ XE_MADV_PURGEABLE_PURGED, ++}; ++ + struct sg_table; + + struct xe_bo *xe_bo_alloc(void); +@@ -213,6 +235,40 @@ static inline bool xe_bo_is_protected(co + return bo->pxp_key_instance; + } + ++/** ++ * xe_bo_is_purged() - Check if buffer object has been purged ++ * @bo: The buffer object to check ++ * ++ * Checks if the buffer object's backing store has been discarded by the ++ * kernel due to memory pressure after being marked as purgeable (DONTNEED). ++ * Once purged, the BO cannot be restored and any attempt to use it will fail. ++ * ++ * Context: Caller must hold the BO's dma-resv lock ++ * Return: true if the BO has been purged, false otherwise ++ */ ++static inline bool xe_bo_is_purged(struct xe_bo *bo) ++{ ++ xe_bo_assert_held(bo); ++ return bo->madv_purgeable == XE_MADV_PURGEABLE_PURGED; ++} ++ ++/** ++ * xe_bo_madv_is_dontneed() - Check if BO is marked as DONTNEED ++ * @bo: The buffer object to check ++ * ++ * Checks if userspace has marked this BO as DONTNEED (i.e., its contents ++ * are not currently needed and can be discarded under memory pressure). ++ * This is used internally to decide whether a BO is eligible for purging. ++ * ++ * Context: Caller must hold the BO's dma-resv lock ++ * Return: true if the BO is marked DONTNEED, false otherwise ++ */ ++static inline bool xe_bo_madv_is_dontneed(struct xe_bo *bo) ++{ ++ xe_bo_assert_held(bo); ++ return bo->madv_purgeable == XE_MADV_PURGEABLE_DONTNEED; ++} ++ + static inline void xe_bo_unpin_map_no_vm(struct xe_bo *bo) + { + if (likely(bo)) { +--- a/drivers/gpu/drm/xe/xe_bo_types.h ++++ b/drivers/gpu/drm/xe/xe_bo_types.h +@@ -110,6 +110,12 @@ struct xe_bo { + * from default + */ + u64 min_align; ++ ++ /** ++ * @madv_purgeable: user space advise on BO purgeability, protected ++ * by BO's dma-resv lock. ++ */ ++ u32 madv_purgeable; + }; + + #endif diff --git a/queue-6.18/drm-xe-pat-add-helper-to-query-compression-enable-status.patch b/queue-6.18/drm-xe-pat-add-helper-to-query-compression-enable-status.patch new file mode 100644 index 0000000000..d4a88b014f --- /dev/null +++ b/queue-6.18/drm-xe-pat-add-helper-to-query-compression-enable-status.patch @@ -0,0 +1,70 @@ +From stable+bounces-294375-greg=kroah.com@vger.kernel.org Sat Aug 1 16:04:36 2026 +From: Sasha Levin +Date: Sat, 1 Aug 2026 10:03:55 -0400 +Subject: drm/xe/pat: Add helper to query compression enable status +To: stable@vger.kernel.org +Cc: Xin Wang , Nitin Gote , Sanjay Yadav , Matt Roper , Matthew Auld , Sasha Levin +Message-ID: <20260801140402.3645391-1-sashal@kernel.org> + +From: Xin Wang + +[ Upstream commit b2bce0e551e89af37cfcb1b1158d80f369eeea3f ] + +Add xe_pat_index_get_comp_en() helper function to check whether +compression is enabled for a given PAT index by extracting the +XE2_COMP_EN bit from the PAT table entry. + +There are no current users, however there are multiple in-flight series +which will all use this helper. + +CC: Nitin Gote +CC: Sanjay Yadav +CC: Matt Roper +Suggested-by: Matthew Auld +Signed-off-by: Xin Wang +Reviewed-by: Matt Roper +Reviewed-by: Nitin Gote +Reviewed-by: Matthew Auld +Reviewed-by: Sanjay Yadav +Signed-off-by: Matthew Auld +Link: https://patch.msgid.link/20251110221458.1864507-2-x.wang@intel.com +Stable-dep-of: 7bc597ce74ba ("drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_pat.c | 6 ++++++ + drivers/gpu/drm/xe/xe_pat.h | 10 ++++++++++ + 2 files changed, 16 insertions(+) + +--- a/drivers/gpu/drm/xe/xe_pat.c ++++ b/drivers/gpu/drm/xe/xe_pat.c +@@ -160,6 +160,12 @@ u16 xe_pat_index_get_coh_mode(struct xe_ + return xe->pat.table[pat_index].coh_mode; + } + ++bool xe_pat_index_get_comp_en(struct xe_device *xe, u16 pat_index) ++{ ++ WARN_ON(pat_index >= xe->pat.n_entries); ++ return !!(xe->pat.table[pat_index].value & XE2_COMP_EN); ++} ++ + static void program_pat(struct xe_gt *gt, const struct xe_pat_table_entry table[], + int n_entries) + { +--- a/drivers/gpu/drm/xe/xe_pat.h ++++ b/drivers/gpu/drm/xe/xe_pat.h +@@ -58,4 +58,14 @@ void xe_pat_dump(struct xe_gt *gt, struc + */ + u16 xe_pat_index_get_coh_mode(struct xe_device *xe, u16 pat_index); + ++/** ++ * xe_pat_index_get_comp_en - Extract the compression enable flag for ++ * the given pat_index. ++ * @xe: xe device ++ * @pat_index: The pat_index to query ++ * ++ * Return: true if compression is enabled for this pat_index, false otherwise. ++ */ ++bool xe_pat_index_get_comp_en(struct xe_device *xe, u16 pat_index); ++ + #endif diff --git a/queue-6.18/drm-xe-vm-fix-bo-prefetch-with-consult_mem_advise_pref_loc.patch b/queue-6.18/drm-xe-vm-fix-bo-prefetch-with-consult_mem_advise_pref_loc.patch new file mode 100644 index 0000000000..84e94897b9 --- /dev/null +++ b/queue-6.18/drm-xe-vm-fix-bo-prefetch-with-consult_mem_advise_pref_loc.patch @@ -0,0 +1,74 @@ +From stable+bounces-294381-greg=kroah.com@vger.kernel.org Sat Aug 1 16:11:07 2026 +From: Sasha Levin +Date: Sat, 1 Aug 2026 10:03:59 -0400 +Subject: drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC +To: stable@vger.kernel.org +Cc: "Himal Prasad Ghimiray" , "Martin Hodo" , "Matthew Brost" , "Thomas Hellström" +Message-ID: <20260801140402.3645391-5-sashal@kernel.org> + +From: Himal Prasad Ghimiray + +[ Upstream commit 7bc597ce74bab4153b2009c92eccf889e9d74044 ] + +When prefetch region is DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC for a BO VMA, +the code used it as an index into region_to_mem_type[], causing an +out-of-bounds access since the value is -1. + +Resolve the preferred location for BO VMAs directly: local VRAM on dGFX +(using the BO's tile placement) or system memory on iGPU. + +Discovered using AI-assisted static analysis confirmed by Intel Product +Security. + +v2: +-Fix null dereference + +Reported-by: Martin Hodo +Fixes: c1bb69a2e8e2 ("drm/xe/svm: Consult madvise preferred location in prefetch") +Cc: Matthew Brost +Cc: stable@vger.kernel.org +Reviewed-by: Matthew Brost +Link: https://patchwork.freedesktop.org/patch/msgid/20260624174943.2808767-2-himal.prasad.ghimiray@intel.com +Signed-off-by: Himal Prasad Ghimiray +(cherry picked from commit d9a4906ac03be9f6ed3f3b45c56c866b867fd75b) +Signed-off-by: Thomas Hellström +Signed-off-by: Review +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_vm.c | 25 ++++++++++++++++++++----- + 1 file changed, 20 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -3032,11 +3032,26 @@ static int op_lock_and_prep(struct drm_e + .request_decompress = false, + .check_purged = true, + }); +- if (!err && !xe_vma_has_no_bo(vma)) +- err = xe_bo_migrate(xe_vma_bo(vma), +- region_to_mem_type[region], +- NULL, +- exec); ++ if (!err && !xe_vma_has_no_bo(vma)) { ++ struct xe_bo *bo = xe_vma_bo(vma); ++ u32 mem_type; ++ ++ if (region == DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC) { ++ unsigned int i; ++ ++ mem_type = XE_PL_TT; ++ for (i = 0; i < bo->placement.num_placement; i++) { ++ if (mem_type_is_vram(bo->placements[i].mem_type)) { ++ mem_type = bo->placements[i].mem_type; ++ break; ++ } ++ } ++ } else { ++ mem_type = region_to_mem_type[region]; ++ } ++ ++ err = xe_bo_migrate(bo, mem_type, NULL, exec); ++ } + break; + } + default: diff --git a/queue-6.18/drm-xe-vm-prevent-binding-of-purged-buffer-objects.patch b/queue-6.18/drm-xe-vm-prevent-binding-of-purged-buffer-objects.patch new file mode 100644 index 0000000000..6b372969fd --- /dev/null +++ b/queue-6.18/drm-xe-vm-prevent-binding-of-purged-buffer-objects.patch @@ -0,0 +1,174 @@ +From stable+bounces-294378-greg=kroah.com@vger.kernel.org Sat Aug 1 16:04:52 2026 +From: Sasha Levin +Date: Sat, 1 Aug 2026 10:03:58 -0400 +Subject: drm/xe/vm: Prevent binding of purged buffer objects +To: stable@vger.kernel.org +Cc: "Arvind Yadav" , "Himal Prasad Ghimiray" , "Matthew Brost" , "Thomas Hellström" , "Sasha Levin" +Message-ID: <20260801140402.3645391-4-sashal@kernel.org> + +From: Arvind Yadav + +[ Upstream commit 4f44961eab8474a47de419113e1d46095f9b44e0 ] + +Add purge checking to vma_lock_and_validate() to block new mapping +operations on purged BOs while allowing cleanup operations to proceed. + +Purged BOs have their backing pages freed by the kernel. New +mapping operations (MAP, PREFETCH, REMAP) must be rejected with +-EINVAL to prevent GPU access to invalid memory. Cleanup +operations (UNMAP) must be allowed so applications can release +resources after detecting purge via the retained field. + +REMAP operations require mixed handling - reject new prev/next +VMAs if the BO is purged, but allow the unmap portion to proceed +for cleanup. + +The check_purged flag in struct xe_vma_lock_and_validate_flags +distinguishes between these cases: true for new mappings (must reject), +false for cleanup (allow). + +Cc: Himal Prasad Ghimiray +Cc: Matthew Brost +Reviewed-by: Thomas Hellström +Signed-off-by: Arvind Yadav +Signed-off-by: Matthew Brost +Link: https://patch.msgid.link/20260326130843.3545241-6-arvind.yadav@intel.com +Stable-dep-of: 7bc597ce74ba ("drm/xe/vm: Fix BO prefetch with CONSULT_MEM_ADVISE_PREF_LOC") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_vm.c | 79 ++++++++++++++++++++++++++++++++++++++------- + 1 file changed, 68 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_vm.c ++++ b/drivers/gpu/drm/xe/xe_vm.c +@@ -2834,8 +2834,22 @@ static void vm_bind_ioctl_ops_unwind(str + } + } + ++/** ++ * struct xe_vma_lock_and_validate_flags - Flags for vma_lock_and_validate() ++ * @res_evict: Allow evicting resources during validation ++ * @validate: Perform BO validation ++ * @request_decompress: Request BO decompression ++ * @check_purged: Reject operation if BO is purged ++ */ ++struct xe_vma_lock_and_validate_flags { ++ u32 res_evict : 1; ++ u32 validate : 1; ++ u32 request_decompress : 1; ++ u32 check_purged : 1; ++}; ++ + static int vma_lock_and_validate(struct drm_exec *exec, struct xe_vma *vma, +- bool res_evict, bool validate) ++ struct xe_vma_lock_and_validate_flags flags) + { + struct xe_bo *bo = xe_vma_bo(vma); + struct xe_vm *vm = xe_vma_vm(vma); +@@ -2844,10 +2858,19 @@ static int vma_lock_and_validate(struct + if (bo) { + if (!bo->vm) + err = drm_exec_lock_obj(exec, &bo->ttm.base); +- if (!err && validate) ++ ++ /* Reject new mappings to DONTNEED/purged BOs; allow cleanup operations */ ++ if (!err && flags.check_purged) { ++ if (xe_bo_madv_is_dontneed(bo)) ++ err = -EBUSY; /* BO marked purgeable */ ++ else if (xe_bo_is_purged(bo)) ++ err = -EINVAL; /* BO already purged */ ++ } ++ ++ if (!err && flags.validate) + err = xe_bo_validate(bo, vm, + !xe_vm_in_preempt_fence_mode(vm) && +- res_evict, exec); ++ flags.res_evict, exec); + } + + return err; +@@ -2933,9 +2956,13 @@ static int op_lock_and_prep(struct drm_e + case DRM_GPUVA_OP_MAP: + if (!op->map.invalidate_on_bind) + err = vma_lock_and_validate(exec, op->map.vma, +- res_evict, +- !xe_vm_in_fault_mode(vm) || +- op->map.immediate); ++ (struct xe_vma_lock_and_validate_flags) { ++ .res_evict = res_evict, ++ .validate = !xe_vm_in_fault_mode(vm) || ++ op->map.immediate, ++ .request_decompress = false, ++ .check_purged = true, ++ }); + break; + case DRM_GPUVA_OP_REMAP: + err = check_ufence(gpuva_to_vma(op->base.remap.unmap->va)); +@@ -2944,13 +2971,28 @@ static int op_lock_and_prep(struct drm_e + + err = vma_lock_and_validate(exec, + gpuva_to_vma(op->base.remap.unmap->va), +- res_evict, false); ++ (struct xe_vma_lock_and_validate_flags) { ++ .res_evict = res_evict, ++ .validate = false, ++ .request_decompress = false, ++ .check_purged = false, ++ }); + if (!err && op->remap.prev) + err = vma_lock_and_validate(exec, op->remap.prev, +- res_evict, true); ++ (struct xe_vma_lock_and_validate_flags) { ++ .res_evict = res_evict, ++ .validate = true, ++ .request_decompress = false, ++ .check_purged = true, ++ }); + if (!err && op->remap.next) + err = vma_lock_and_validate(exec, op->remap.next, +- res_evict, true); ++ (struct xe_vma_lock_and_validate_flags) { ++ .res_evict = res_evict, ++ .validate = true, ++ .request_decompress = false, ++ .check_purged = true, ++ }); + break; + case DRM_GPUVA_OP_UNMAP: + err = check_ufence(gpuva_to_vma(op->base.unmap.va)); +@@ -2959,7 +3001,12 @@ static int op_lock_and_prep(struct drm_e + + err = vma_lock_and_validate(exec, + gpuva_to_vma(op->base.unmap.va), +- res_evict, false); ++ (struct xe_vma_lock_and_validate_flags) { ++ .res_evict = res_evict, ++ .validate = false, ++ .request_decompress = false, ++ .check_purged = false, ++ }); + break; + case DRM_GPUVA_OP_PREFETCH: + { +@@ -2972,9 +3019,19 @@ static int op_lock_and_prep(struct drm_e + region <= ARRAY_SIZE(region_to_mem_type)); + } + ++ /* ++ * Prefetch attempts to migrate BO's backing store without ++ * repopulating it first. Purged BOs have no backing store ++ * to migrate, so reject the operation. ++ */ + err = vma_lock_and_validate(exec, + gpuva_to_vma(op->base.prefetch.va), +- res_evict, false); ++ (struct xe_vma_lock_and_validate_flags) { ++ .res_evict = res_evict, ++ .validate = false, ++ .request_decompress = false, ++ .check_purged = true, ++ }); + if (!err && !xe_vma_has_no_bo(vma)) + err = xe_bo_migrate(xe_vma_bo(vma), + region_to_mem_type[region], diff --git a/queue-6.18/series b/queue-6.18/series index e5119aa23b..833b82486f 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -377,3 +377,8 @@ drm-amdgpu-respect-placement-requirements-in-amdgpu_gtt_mgr-functions.patch drm-xe-guc-fix-buffer-overflow-in-steered-register-list-allocation.patch drm-amd-display-check-grph_flip-status-before-sendin.patch drm-amd-display-exit-idle-optimizations-before-progr.patch +drm-xe-pat-add-helper-to-query-compression-enable-status.patch +drm-xe-add-xe_migrate_resolve-wrapper-and-is_vram_resolve-support.patch +drm-xe-bo-add-purgeable-bo-state-tracking-and-field-madv-to-xe_bo.patch +drm-xe-vm-prevent-binding-of-purged-buffer-objects.patch +drm-xe-vm-fix-bo-prefetch-with-consult_mem_advise_pref_loc.patch