From: Greg Kroah-Hartman Date: Fri, 7 Aug 2026 12:18:23 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v6.6.151~23 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dcef91ec845d3a08da0b6613be0fb3d47c501825;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: drm-i915-vrr-check-has_vrr-first-in-intel_vrr_is_capable.patch drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch drm-xe-add-page-reclamation-info-to-device-info.patch drm-xe-pt-reset-current_op-in-xe_pt_update_ops_init.patch drm-xe-stub-out-new-pagefault-layer.patch drm-xe-use-svm-range-helpers-in-pt-layer.patch --- diff --git a/queue-6.18/drm-i915-vrr-check-has_vrr-first-in-intel_vrr_is_capable.patch b/queue-6.18/drm-i915-vrr-check-has_vrr-first-in-intel_vrr_is_capable.patch new file mode 100644 index 0000000000..1fd849fd9d --- /dev/null +++ b/queue-6.18/drm-i915-vrr-check-has_vrr-first-in-intel_vrr_is_capable.patch @@ -0,0 +1,48 @@ +From stable+bounces-294442-greg=kroah.com@vger.kernel.org Sun Aug 2 02:10:20 2026 +From: Sasha Levin +Date: Sat, 1 Aug 2026 20:07:03 -0400 +Subject: drm/i915/vrr: Check HAS_VRR() first in intel_vrr_is_capable() +To: stable@vger.kernel.org +Cc: "Ville Syrjälä" , "Ankit Nautiyal" , "Sasha Levin" +Message-ID: <20260802000705.2176332-1-sashal@kernel.org> + +From: Ville Syrjälä + +[ Upstream commit 4b274b0b61ab2a529e5c22e9aa033f3028e639fc ] + +There's no point in doing all the other checks in +intel_vrr_is_capable() if the platform doesn't support VRR at all +Check HAS_VRR() before wasting time on the other checks. + +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20251020185038.4272-23-ville.syrjala@linux.intel.com +Reviewed-by: Ankit Nautiyal +Stable-dep-of: f8a9262c7a6f ("drm/i915/vrr: require valid min/max vfreq for VRR") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_vrr.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_vrr.c ++++ b/drivers/gpu/drm/i915/display/intel_vrr.c +@@ -22,6 +22,9 @@ bool intel_vrr_is_capable(struct intel_c + const struct drm_display_info *info = &connector->base.display_info; + struct intel_dp *intel_dp; + ++ if (!HAS_VRR(display)) ++ return false; ++ + /* + * DP Sink is capable of VRR video timings if + * Ignore MSA bit is set in DPCD. +@@ -46,8 +49,7 @@ bool intel_vrr_is_capable(struct intel_c + return false; + } + +- return HAS_VRR(display) && +- info->monitor_range.max_vfreq - info->monitor_range.min_vfreq > 10; ++ return info->monitor_range.max_vfreq - info->monitor_range.min_vfreq > 10; + } + + bool intel_vrr_is_in_range(struct intel_connector *connector, int vrefresh) diff --git a/queue-6.18/drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch b/queue-6.18/drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch new file mode 100644 index 0000000000..d00ac92ab6 --- /dev/null +++ b/queue-6.18/drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch @@ -0,0 +1,49 @@ +From stable+bounces-294443-greg=kroah.com@vger.kernel.org Sun Aug 2 02:07:18 2026 +From: Sasha Levin +Date: Sat, 1 Aug 2026 20:07:04 -0400 +Subject: drm/i915/vrr: require valid min/max vfreq for VRR +To: stable@vger.kernel.org +Cc: Jani Nikula , Martin Hodo , Ankit Nautiyal , Joonas Lahtinen , Sasha Levin +Message-ID: <20260802000705.2176332-2-sashal@kernel.org> + +From: Jani Nikula + +[ Upstream commit f8a9262c7a6fc2de9802e14b0228114f0333869e ] + +Ensure the EDID provided min/max vfreq are valid. Most scenarios are +already covered (by coincidence) through the checks in +intel_vrr_is_capable() and intel_vrr_is_in_range(), but be more explicit +about it. At worst, a zero min_vfreq could lead to a division by zero in +intel_vrr_compute_vmax(). + +Discovered using AI-assisted static analysis confirmed by Intel Product +Security. + +Reported-by: Martin Hodo +Fixes: 117cd09ba528 ("drm/i915/display/dp: Compute VRR state in atomic_check") +Cc: stable@vger.kernel.org # v5.12+ +Cc: Ankit Nautiyal +Reviewed-by: Ankit Nautiyal +Link: https://patch.msgid.link/20260625131040.1051272-1-jani.nikula@intel.com +Signed-off-by: Jani Nikula +(cherry picked from commit 1765cf59f517b02f3b0591fe5120930d08bddeb6) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_vrr.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/i915/display/intel_vrr.c ++++ b/drivers/gpu/drm/i915/display/intel_vrr.c +@@ -49,6 +49,10 @@ bool intel_vrr_is_capable(struct intel_c + return false; + } + ++ if (!info->monitor_range.min_vfreq || !info->monitor_range.max_vfreq || ++ info->monitor_range.min_vfreq > info->monitor_range.max_vfreq) ++ return false; ++ + return info->monitor_range.max_vfreq - info->monitor_range.min_vfreq > 10; + } + diff --git a/queue-6.18/drm-xe-add-page-reclamation-info-to-device-info.patch b/queue-6.18/drm-xe-add-page-reclamation-info-to-device-info.patch new file mode 100644 index 0000000000..2ec306bb9a --- /dev/null +++ b/queue-6.18/drm-xe-add-page-reclamation-info-to-device-info.patch @@ -0,0 +1,62 @@ +From stable+bounces-294449-greg=kroah.com@vger.kernel.org Sun Aug 2 03:49:27 2026 +From: Sasha Levin +Date: Sat, 1 Aug 2026 21:49:14 -0400 +Subject: drm/xe: Add page reclamation info to device info +To: stable@vger.kernel.org +Cc: Oak Zeng , Brian Nguyen , Shuicheng Lin , Matthew Brost , Sasha Levin +Message-ID: <20260802014916.504747-3-sashal@kernel.org> + +From: Oak Zeng + +[ Upstream commit 9b1a0e0a15c97987fdf56a615f3d13995bafd042 ] + +Starting from Xe3p, HW adds a feature assisting range based page +reclamation. Introduce a bit in device info to indicate whether +device has such capability. + +Signed-off-by: Oak Zeng +Signed-off-by: Brian Nguyen +Reviewed-by: Shuicheng Lin +Reviewed-by: Matthew Brost +Signed-off-by: Matthew Brost +Link: https://patch.msgid.link/20251212213225.3564537-15-brian3.nguyen@intel.com +Stable-dep-of: 6384271ac1ac ("drm/xe/pt: Reset current_op in xe_pt_update_ops_init()") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_device_types.h | 2 ++ + drivers/gpu/drm/xe/xe_pci.c | 1 + + drivers/gpu/drm/xe/xe_pci_types.h | 1 + + 3 files changed, 4 insertions(+) + +--- a/drivers/gpu/drm/xe/xe_device_types.h ++++ b/drivers/gpu/drm/xe/xe_device_types.h +@@ -305,6 +305,8 @@ struct xe_device { + * pcode mailbox commands. + */ + u8 has_mbx_power_limits:1; ++ /** @info.has_page_reclaim_hw_assist: Device supports page reclamation feature */ ++ u8 has_page_reclaim_hw_assist:1; + /** @info.has_pxp: Device has PXP support */ + u8 has_pxp:1; + /** @info.has_range_tlb_inval: Has range based TLB invalidations */ +--- a/drivers/gpu/drm/xe/xe_pci.c ++++ b/drivers/gpu/drm/xe/xe_pci.c +@@ -591,6 +591,7 @@ static int xe_info_init_early(struct xe_ + xe->info.has_heci_cscfi = desc->has_heci_cscfi; + xe->info.has_late_bind = desc->has_late_bind; + xe->info.has_llc = desc->has_llc; ++ xe->info.has_page_reclaim_hw_assist = desc->has_page_reclaim_hw_assist; + xe->info.has_pxp = desc->has_pxp; + xe->info.has_sriov = desc->has_sriov; + xe->info.skip_guc_pc = desc->skip_guc_pc; +--- a/drivers/gpu/drm/xe/xe_pci_types.h ++++ b/drivers/gpu/drm/xe/xe_pci_types.h +@@ -42,6 +42,7 @@ struct xe_device_desc { + u8 has_late_bind:1; + u8 has_llc:1; + u8 has_mbx_power_limits:1; ++ u8 has_page_reclaim_hw_assist:1; + u8 has_pxp:1; + u8 has_sriov:1; + u8 needs_scratch:1; diff --git a/queue-6.18/drm-xe-pt-reset-current_op-in-xe_pt_update_ops_init.patch b/queue-6.18/drm-xe-pt-reset-current_op-in-xe_pt_update_ops_init.patch new file mode 100644 index 0000000000..3f4f9d6f4e --- /dev/null +++ b/queue-6.18/drm-xe-pt-reset-current_op-in-xe_pt_update_ops_init.patch @@ -0,0 +1,66 @@ +From stable+bounces-294450-greg=kroah.com@vger.kernel.org Sun Aug 2 03:49:32 2026 +From: Sasha Levin +Date: Sat, 1 Aug 2026 21:49:15 -0400 +Subject: drm/xe/pt: Reset current_op in xe_pt_update_ops_init() +To: stable@vger.kernel.org +Cc: "Zongyao Bai" , "Matthew Auld" , "Matthew Brost" , "Thomas Hellström" , "Sasha Levin" +Message-ID: <20260802014916.504747-4-sashal@kernel.org> + +From: Zongyao Bai + +[ Upstream commit 6384271ac1ac0099198d15df79212a19ebdb929d ] + +xe_pt_update_ops_init() fails to reset current_op to 0. On the +vm_bind path, ops_execute() calls xe_pt_update_ops_prepare() inside +the xe_validation_guard() / drm_exec_until_all_locked() loop. When +that loop retries due to lock contention or OOM eviction +(drm_exec_retry_on_contention() / xe_validation_retry_on_oom()), +xe_pt_update_ops_prepare() runs again on the same vops, and each +call to bind_op_prepare() increments current_op without resetting it. + +After N retries current_op exceeds the array size allocated by +xe_vma_ops_alloc(), causing an out-of-bounds write into +SLUB-poisoned memory and a subsequent UAF crash in +xe_migrate_update_pgtables_cpu() when reading the corrupted pt_op->bind. + +Also reset needs_svm_lock and needs_invalidation which are derived in +the same prepare pass and would otherwise cause wrong migrate ops +selection and redundant TLB invalidation on retry. + +Fix this by resetting current_op, needs_svm_lock and needs_invalidation +in xe_pt_update_ops_init(). + +v2 (Matt): + - Add details in commit message. + - Add Fixes tag and Cc to stable@vger.kernel.org + +Fixes: e8babb280b5e ("drm/xe: Convert multiple bind ops into single job") +Suggested-by: Matthew Auld +Cc: stable@vger.kernel.org +Assisted-by: GitHub-Copilot:claude-sonnet-4.6 +Signed-off-by: Zongyao Bai +Reviewed-by: Matthew Brost +Signed-off-by: Matthew Brost +Link: https://patch.msgid.link/20260714232433.2737533-1-zongyao.bai@intel.com +(cherry picked from commit 046045543e530605c441063535e7dca0075369a6) +Signed-off-by: Thomas Hellström +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_pt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/xe/xe_pt.c ++++ b/drivers/gpu/drm/xe/xe_pt.c +@@ -2153,8 +2153,11 @@ static void + xe_pt_update_ops_init(struct xe_vm_pgtable_update_ops *pt_update_ops) + { + init_llist_head(&pt_update_ops->deferred); ++ pt_update_ops->current_op = 0; + pt_update_ops->start = ~0x0ull; + pt_update_ops->last = 0x0ull; ++ pt_update_ops->needs_svm_lock = false; ++ pt_update_ops->needs_invalidation = false; + } + + /** diff --git a/queue-6.18/drm-xe-stub-out-new-pagefault-layer.patch b/queue-6.18/drm-xe-stub-out-new-pagefault-layer.patch new file mode 100644 index 0000000000..e453178c1b --- /dev/null +++ b/queue-6.18/drm-xe-stub-out-new-pagefault-layer.patch @@ -0,0 +1,281 @@ +From stable+bounces-294448-greg=kroah.com@vger.kernel.org Sun Aug 2 03:49:26 2026 +From: Sasha Levin +Date: Sat, 1 Aug 2026 21:49:13 -0400 +Subject: drm/xe: Stub out new pagefault layer +To: stable@vger.kernel.org +Cc: Matthew Brost , Lucas De Marchi , Francois Dugast , Sasha Levin +Message-ID: <20260802014916.504747-2-sashal@kernel.org> + +From: Matthew Brost + +[ Upstream commit 620a09fb0bddf387f418663478b48ca4ba62b6d6 ] + +Stub out the new page fault layer and add kernel documentation. This is +intended as a replacement for the GT page fault layer, enabling multiple +producers to hook into a shared page fault consumer interface. + +v2: + - Fix kernel doc typo (checkpatch) + - Remove comment around GT (Stuart) + - Add explaination around reclaim (Francois) + - Add comment around u8 vs enum (Francois) + - Include engine instance (Stuart) +v3: + - Fix XE_PAGEFAULT_TYPE_ATOMIC_ACCESS_VIOLATION kernel doc (Stuart) + +Signed-off-by: Matthew Brost +Reviewed-by: Lucas De Marchi +Tested-by: Francois Dugast +Link: https://patch.msgid.link/20251031165416.2871503-2-matthew.brost@intel.com +Stable-dep-of: 6384271ac1ac ("drm/xe/pt: Reset current_op in xe_pt_update_ops_init()") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/Makefile | 1 + drivers/gpu/drm/xe/xe_pagefault.c | 65 +++++++++++++++ + drivers/gpu/drm/xe/xe_pagefault.h | 19 ++++ + drivers/gpu/drm/xe/xe_pagefault_types.h | 136 ++++++++++++++++++++++++++++++++ + 4 files changed, 221 insertions(+) + create mode 100644 drivers/gpu/drm/xe/xe_pagefault.c + create mode 100644 drivers/gpu/drm/xe/xe_pagefault.h + create mode 100644 drivers/gpu/drm/xe/xe_pagefault_types.h + +--- a/drivers/gpu/drm/xe/Makefile ++++ b/drivers/gpu/drm/xe/Makefile +@@ -94,6 +94,7 @@ xe-y += xe_bb.o \ + xe_nvm.o \ + xe_oa.o \ + xe_observation.o \ ++ xe_pagefault.o \ + xe_pat.o \ + xe_pci.o \ + xe_pcode.o \ +--- /dev/null ++++ b/drivers/gpu/drm/xe/xe_pagefault.c +@@ -0,0 +1,65 @@ ++// SPDX-License-Identifier: MIT ++/* ++ * Copyright © 2025 Intel Corporation ++ */ ++ ++#include "xe_pagefault.h" ++#include "xe_pagefault_types.h" ++ ++/** ++ * DOC: Xe page faults ++ * ++ * Xe page faults are handled in two layers. The producer layer interacts with ++ * hardware or firmware to receive and parse faults into struct xe_pagefault, ++ * then forwards them to the consumer. The consumer layer services the faults ++ * (e.g., memory migration, page table updates) and acknowledges the result back ++ * to the producer, which then forwards the results to the hardware or firmware. ++ * The consumer uses a page fault queue sized to absorb all potential faults and ++ * a multi-threaded worker to process them. Multiple producers are supported, ++ * with a single shared consumer. ++ * ++ * xe_pagefault.c implements the consumer layer. ++ */ ++ ++/** ++ * xe_pagefault_init() - Page fault init ++ * @xe: xe device instance ++ * ++ * Initialize Xe page fault state. Must be done after reading fuses. ++ * ++ * Return: 0 on Success, errno on failure ++ */ ++int xe_pagefault_init(struct xe_device *xe) ++{ ++ /* TODO - implement */ ++ return 0; ++} ++ ++/** ++ * xe_pagefault_reset() - Page fault reset for a GT ++ * @xe: xe device instance ++ * @gt: GT being reset ++ * ++ * Reset the Xe page fault state for a GT; that is, squash any pending faults on ++ * the GT. ++ */ ++void xe_pagefault_reset(struct xe_device *xe, struct xe_gt *gt) ++{ ++ /* TODO - implement */ ++} ++ ++/** ++ * xe_pagefault_handler() - Page fault handler ++ * @xe: xe device instance ++ * @pf: Page fault ++ * ++ * Sink the page fault to a queue (i.e., a memory buffer) and queue a worker to ++ * service it. Safe to be called from IRQ or process context. Reclaim safe. ++ * ++ * Return: 0 on success, errno on failure ++ */ ++int xe_pagefault_handler(struct xe_device *xe, struct xe_pagefault *pf) ++{ ++ /* TODO - implement */ ++ return 0; ++} +--- /dev/null ++++ b/drivers/gpu/drm/xe/xe_pagefault.h +@@ -0,0 +1,19 @@ ++/* SPDX-License-Identifier: MIT */ ++/* ++ * Copyright © 2025 Intel Corporation ++ */ ++ ++#ifndef _XE_PAGEFAULT_H_ ++#define _XE_PAGEFAULT_H_ ++ ++struct xe_device; ++struct xe_gt; ++struct xe_pagefault; ++ ++int xe_pagefault_init(struct xe_device *xe); ++ ++void xe_pagefault_reset(struct xe_device *xe, struct xe_gt *gt); ++ ++int xe_pagefault_handler(struct xe_device *xe, struct xe_pagefault *pf); ++ ++#endif +--- /dev/null ++++ b/drivers/gpu/drm/xe/xe_pagefault_types.h +@@ -0,0 +1,136 @@ ++/* SPDX-License-Identifier: MIT */ ++/* ++ * Copyright © 2025 Intel Corporation ++ */ ++ ++#ifndef _XE_PAGEFAULT_TYPES_H_ ++#define _XE_PAGEFAULT_TYPES_H_ ++ ++#include ++ ++struct xe_gt; ++struct xe_pagefault; ++ ++/** enum xe_pagefault_access_type - Xe page fault access type */ ++enum xe_pagefault_access_type { ++ /** @XE_PAGEFAULT_ACCESS_TYPE_READ: Read access type */ ++ XE_PAGEFAULT_ACCESS_TYPE_READ = 0, ++ /** @XE_PAGEFAULT_ACCESS_TYPE_WRITE: Write access type */ ++ XE_PAGEFAULT_ACCESS_TYPE_WRITE = 1, ++ /** @XE_PAGEFAULT_ACCESS_TYPE_ATOMIC: Atomic access type */ ++ XE_PAGEFAULT_ACCESS_TYPE_ATOMIC = 2, ++}; ++ ++/** enum xe_pagefault_type - Xe page fault type */ ++enum xe_pagefault_type { ++ /** @XE_PAGEFAULT_TYPE_NOT_PRESENT: Not present */ ++ XE_PAGEFAULT_TYPE_NOT_PRESENT = 0, ++ /** @XE_PAGEFAULT_TYPE_WRITE_ACCESS_VIOLATION: Write access violation */ ++ XE_PAGEFAULT_TYPE_WRITE_ACCESS_VIOLATION = 1, ++ /** @XE_PAGEFAULT_TYPE_ATOMIC_ACCESS_VIOLATION: Atomic access violation */ ++ XE_PAGEFAULT_TYPE_ATOMIC_ACCESS_VIOLATION = 2, ++}; ++ ++/** struct xe_pagefault_ops - Xe pagefault ops (producer) */ ++struct xe_pagefault_ops { ++ /** ++ * @ack_fault: Ack fault ++ * @pf: Page fault ++ * @err: Error state of fault ++ * ++ * Page fault producer receives acknowledgment from the consumer and ++ * sends the result to the HW/FW interface. ++ */ ++ void (*ack_fault)(struct xe_pagefault *pf, int err); ++}; ++ ++/** ++ * struct xe_pagefault - Xe page fault ++ * ++ * Generic page fault structure for communication between producer and consumer. ++ * Carefully sized to be 64 bytes. Upon a device page fault, the producer ++ * populates this structure, and the consumer copies it into the page-fault ++ * queue for deferred handling. ++ */ ++struct xe_pagefault { ++ /** ++ * @gt: GT of fault ++ */ ++ struct xe_gt *gt; ++ /** ++ * @consumer: State for the software handling the fault. Populated by ++ * the producer and may be modified by the consumer to communicate ++ * information back to the producer upon fault acknowledgment. ++ */ ++ struct { ++ /** @consumer.page_addr: address of page fault */ ++ u64 page_addr; ++ /** @consumer.asid: address space ID */ ++ u32 asid; ++ /** ++ * @consumer.access_type: access type, u8 rather than enum to ++ * keep size compact ++ */ ++ u8 access_type; ++ /** ++ * @consumer.fault_type: fault type, u8 rather than enum to ++ * keep size compact ++ */ ++ u8 fault_type; ++#define XE_PAGEFAULT_LEVEL_NACK 0xff /* Producer indicates nack fault */ ++ /** @consumer.fault_level: fault level */ ++ u8 fault_level; ++ /** @consumer.engine_class: engine class */ ++ u8 engine_class; ++ /** @consumer.engine_instance: engine instance */ ++ u8 engine_instance; ++ /** consumer.reserved: reserved bits for future expansion */ ++ u8 reserved[7]; ++ } consumer; ++ /** ++ * @producer: State for the producer (i.e., HW/FW interface). Populated ++ * by the producer and should not be modified—or even inspected—by the ++ * consumer, except for calling operations. ++ */ ++ struct { ++ /** @producer.private: private pointer */ ++ void *private; ++ /** @producer.ops: operations */ ++ const struct xe_pagefault_ops *ops; ++#define XE_PAGEFAULT_PRODUCER_MSG_LEN_DW 4 ++ /** ++ * @producer.msg: page fault message, used by producer in fault ++ * acknowledgment to formulate response to HW/FW interface. ++ * Included in the page-fault message because the producer ++ * typically receives the fault in a context where memory cannot ++ * be allocated (e.g., atomic context or the reclaim path). ++ */ ++ u32 msg[XE_PAGEFAULT_PRODUCER_MSG_LEN_DW]; ++ } producer; ++}; ++ ++/** ++ * struct xe_pagefault_queue: Xe pagefault queue (consumer) ++ * ++ * Used to capture all device page faults for deferred processing. Size this ++ * queue to absorb the device’s worst-case number of outstanding faults. ++ */ ++struct xe_pagefault_queue { ++ /** ++ * @data: Data in queue containing struct xe_pagefault, protected by ++ * @lock ++ */ ++ void *data; ++ /** @size: Size of queue in bytes */ ++ u32 size; ++ /** @head: Head pointer in bytes, moved by producer, protected by @lock */ ++ u32 head; ++ /** @tail: Tail pointer in bytes, moved by consumer, protected by @lock */ ++ u32 tail; ++ /** @lock: protects page fault queue */ ++ spinlock_t lock; ++ /** @worker: to process page faults */ ++ struct work_struct worker; ++}; ++ ++#endif diff --git a/queue-6.18/drm-xe-use-svm-range-helpers-in-pt-layer.patch b/queue-6.18/drm-xe-use-svm-range-helpers-in-pt-layer.patch new file mode 100644 index 0000000000..8b1688655c --- /dev/null +++ b/queue-6.18/drm-xe-use-svm-range-helpers-in-pt-layer.patch @@ -0,0 +1,118 @@ +From stable+bounces-294447-greg=kroah.com@vger.kernel.org Sun Aug 2 03:49:23 2026 +From: Sasha Levin +Date: Sat, 1 Aug 2026 21:49:12 -0400 +Subject: drm/xe: Use SVM range helpers in PT layer +To: stable@vger.kernel.org +Cc: Matthew Brost , Himal Prasad Ghimiray , Sasha Levin +Message-ID: <20260802014916.504747-1-sashal@kernel.org> + +From: Matthew Brost + +[ Upstream commit 9ea9b45701ab50049a722450abc28346d1121e6e ] + +We have helpers SVM range start, end, and size. Use them in the PT +layer rather than directly looking at the struct. + +Signed-off-by: Matthew Brost +Reviewed-by: Himal Prasad Ghimiray +Link: https://lore.kernel.org/r/20251022230122.922382-1-matthew.brost@intel.com +Stable-dep-of: 6384271ac1ac ("drm/xe/pt: Reset current_op in xe_pt_update_ops_init()") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_pt.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_pt.c ++++ b/drivers/gpu/drm/xe/xe_pt.c +@@ -715,7 +715,7 @@ xe_pt_stage_bind(struct xe_tile *tile, s + .vm = vm, + .tile = tile, + .curs = &curs, +- .va_curs_start = range ? range->base.itree.start : ++ .va_curs_start = range ? xe_svm_range_start(range) : + xe_vma_start(vma), + .vma = vma, + .wupd.entries = entries, +@@ -734,7 +734,7 @@ xe_pt_stage_bind(struct xe_tile *tile, s + } + if (xe_svm_range_has_dma_mapping(range)) { + xe_res_first_dma(range->base.pages.dma_addr, 0, +- range->base.itree.last + 1 - range->base.itree.start, ++ xe_svm_range_size(range), + &curs); + xe_svm_range_debug(range, "BIND PREPARE - MIXED"); + } else { +@@ -778,8 +778,8 @@ xe_pt_stage_bind(struct xe_tile *tile, s + + walk_pt: + ret = xe_pt_walk_range(&pt->base, pt->level, +- range ? range->base.itree.start : xe_vma_start(vma), +- range ? range->base.itree.last + 1 : xe_vma_end(vma), ++ range ? xe_svm_range_start(range) : xe_vma_start(vma), ++ range ? xe_svm_range_end(range) : xe_vma_end(vma), + &xe_walk.base); + + *num_entries = xe_walk.wupd.num_used_entries; +@@ -983,8 +983,8 @@ bool xe_pt_zap_ptes_range(struct xe_tile + if (!(pt_mask & BIT(tile->id))) + return false; + +- (void)xe_pt_walk_shared(&pt->base, pt->level, range->base.itree.start, +- range->base.itree.last + 1, &xe_walk.base); ++ (void)xe_pt_walk_shared(&pt->base, pt->level, xe_svm_range_start(range), ++ xe_svm_range_end(range), &xe_walk.base); + + return xe_walk.needs_invalidate; + } +@@ -1711,8 +1711,8 @@ static unsigned int xe_pt_stage_unbind(s + struct xe_svm_range *range, + struct xe_vm_pgtable_update *entries) + { +- u64 start = range ? range->base.itree.start : xe_vma_start(vma); +- u64 end = range ? range->base.itree.last + 1 : xe_vma_end(vma); ++ u64 start = range ? xe_svm_range_start(range) : xe_vma_start(vma); ++ u64 end = range ? xe_svm_range_end(range) : xe_vma_end(vma); + struct xe_pt_stage_unbind_walk xe_walk = { + .base = { + .ops = &xe_pt_stage_unbind_ops, +@@ -1922,7 +1922,7 @@ static int bind_range_prepare(struct xe_ + + vm_dbg(&xe_vma_vm(vma)->xe->drm, + "Preparing bind, with range [%lx...%lx)\n", +- range->base.itree.start, range->base.itree.last); ++ xe_svm_range_start(range), xe_svm_range_end(range) - 1); + + pt_op->vma = NULL; + pt_op->bind = true; +@@ -1937,8 +1937,8 @@ static int bind_range_prepare(struct xe_ + pt_op->num_entries, true); + + xe_pt_update_ops_rfence_interval(pt_update_ops, +- range->base.itree.start, +- range->base.itree.last + 1); ++ xe_svm_range_start(range), ++ xe_svm_range_end(range)); + ++pt_update_ops->current_op; + pt_update_ops->needs_svm_lock = true; + +@@ -2033,7 +2033,7 @@ static int unbind_range_prepare(struct x + + vm_dbg(&vm->xe->drm, + "Preparing unbind, with range [%lx...%lx)\n", +- range->base.itree.start, range->base.itree.last); ++ xe_svm_range_start(range), xe_svm_range_end(range) - 1); + + pt_op->vma = XE_INVALID_VMA; + pt_op->bind = false; +@@ -2044,8 +2044,8 @@ static int unbind_range_prepare(struct x + + xe_vm_dbg_print_entries(tile_to_xe(tile), pt_op->entries, + pt_op->num_entries, false); +- xe_pt_update_ops_rfence_interval(pt_update_ops, range->base.itree.start, +- range->base.itree.last + 1); ++ xe_pt_update_ops_rfence_interval(pt_update_ops, xe_svm_range_start(range), ++ xe_svm_range_end(range)); + ++pt_update_ops->current_op; + pt_update_ops->needs_svm_lock = true; + pt_update_ops->needs_invalidation |= xe_vm_has_scratch(vm) || diff --git a/queue-6.18/series b/queue-6.18/series index b5b6646404..f23f6a9c7a 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -384,3 +384,9 @@ drm-xe-vm-prevent-binding-of-purged-buffer-objects.patch drm-xe-vm-fix-bo-prefetch-with-consult_mem_advise_pref_loc.patch drm-exec-remove-the-index-parameter-from-drm_exec_for_each_locked_obj.patch drm-xe-wait-on-external-bo-kernel-fences-in-exec-ioctl.patch +drm-i915-vrr-check-has_vrr-first-in-intel_vrr_is_capable.patch +drm-i915-vrr-require-valid-min-max-vfreq-for-vrr.patch +drm-xe-use-svm-range-helpers-in-pt-layer.patch +drm-xe-stub-out-new-pagefault-layer.patch +drm-xe-add-page-reclamation-info-to-device-info.patch +drm-xe-pt-reset-current_op-in-xe_pt_update_ops_init.patch