--- /dev/null
+From 34a4dd45cf210c04fee773b0dbc350aec285f03c Mon Sep 17 00:00:00 2001
+From: Matthew Brost <matthew.brost@intel.com>
+Date: Wed, 1 Jul 2026 18:24:34 -0700
+Subject: drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthew Brost <matthew.brost@intel.com>
+
+commit 34a4dd45cf210c04fee773b0dbc350aec285f03c upstream.
+
+xe_vm_populate_pgtable() indexed the source PTE array (update->pt_entries)
+by the per-call loop counter, assuming each call starts at the first entry
+of the update. That holds for the CPU bind path
+(xe_migrate_update_pgtables_cpu), which populates a whole update in a single
+call, but not for the GPU bind path: write_pgtable() splits an update into
+MAX_PTE_PER_SDI (510) sized MI_STORE_DATA_IMM chunks, invoking the populate
+callback once per chunk with an advancing qword_ofs but a fresh command-
+buffer destination pointer.
+
+As a result, every chunk after the first re-read pt_entries from index 0
+instead of from its true offset, so PTEs beyond the first 510 entries of a
+single update were programmed with the wrong physical pages, shifting the
+mapping by exactly MAX_PTE_PER_SDI pages.
+
+This stayed latent because a single update only exceeds 510 qwords when a
+large (e.g. 2M) region is bound as individual 4K PTEs rather than a single
+huge-page entry, which happens when the backing store is sufficiently
+fragmented. It was surfaced by the BO defrag path, which deliberately
+rebinds such fragmented ranges via the GPU bind path, producing
+deterministic data corruption offset by 510 pages.
+
+Index pt_entries by the chunk's absolute offset relative to update->ofs so
+both the CPU and GPU paths pick the correct entries.
+
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Cc: stable@vger.kernel.org
+Assisted-by: GitHub_Copilot:claude-opus-4.8
+Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://patch.msgid.link/20260702012434.3861171-1-matthew.brost@intel.com
+(cherry picked from commit e6f2d0b757c4fb577a513c577140109d1d292a9a)
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_pt.c | 14 ++++++++++++--
+ 1 file changed, 12 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/xe/xe_pt.c
++++ b/drivers/gpu/drm/xe/xe_pt.c
+@@ -1025,12 +1025,22 @@ xe_vm_populate_pgtable(struct xe_migrate
+ u64 *ptr = data;
+ u32 i;
+
++ /*
++ * @qword_ofs is the absolute entry offset within the page table, while
++ * @ptes is indexed relative to @update->ofs (its first entry). The GPU
++ * path (write_pgtable) splits a single update into MAX_PTE_PER_SDI-sized
++ * chunks, calling this with an advancing @qword_ofs but a fresh @data
++ * pointer per chunk, so translate back into a @ptes index rather than
++ * assuming the chunk starts at ptes[0].
++ */
+ for (i = 0; i < num_qwords; i++) {
++ u32 idx = qword_ofs - update->ofs + i;
++
+ if (map)
+ xe_map_wr(tile_to_xe(tile), map, (qword_ofs + i) *
+- sizeof(u64), u64, ptes[i].pte);
++ sizeof(u64), u64, ptes[idx].pte);
+ else
+- ptr[i] = ptes[i].pte;
++ ptr[i] = ptes[idx].pte;
+ }
+ }
+
--- /dev/null
+From 62775525a27c3b0d56382e08ba81ee2d322058b6 Mon Sep 17 00:00:00 2001
+From: Nitin Gote <nitin.r.gote@intel.com>
+Date: Sat, 11 Jul 2026 00:40:28 +0530
+Subject: drm/xe: Hold a dma-buf reference for imported BOs
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Nitin Gote <nitin.r.gote@intel.com>
+
+commit 62775525a27c3b0d56382e08ba81ee2d322058b6 upstream.
+
+An imported dma-buf BO is created as a ttm_bo_type_sg BO whose
+reservation object is the exporter's dma_buf->resv. The importer,
+however, only takes a dma-buf reference after a successful
+dma_buf_dynamic_attach(). Until then nothing keeps the exporter alive,
+so if the exporter is freed while the BO still references its resv, a
+later access to that resv is a use-after-free:
+
+ Oops: general protection fault, probably for non-canonical address
+ 0x6b6b6b6b6b6b6b9c
+ Workqueue: ttm ttm_bo_delayed_delete [ttm]
+ RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0
+
+This can be reached on two paths:
+
+ - dma_buf_dynamic_attach() fails, or
+ - ttm_bo_init_reserved() fails during BO creation.
+
+In both cases the BO already has bo->base.resv pointing at the exporter
+resv, and sg BOs are always torn down via ttm_bo_delayed_delete(), which
+locks bo->base.resv asynchronously - potentially after the exporter has
+been freed.
+
+Take the dma-buf reference in xe_bo_init_locked(), before
+ttm_bo_init_reserved(), so it also covers a creation failure there, and
+release it in xe_ttm_bo_destroy(). The reference is held for the whole
+BO lifetime, keeping the shared resv alive on every path.
+
+v2:
+ - Reworked the fix to avoid creating the imported sg BO before
+ dma_buf_dynamic_attach() succeeds.
+ - Attach with importer_priv == NULL and make invalidate_mappings ignore
+ incomplete imports.
+
+v3:
+ - Dropped the xe-side reordering approach since importer_priv must be
+ valid when dma_buf_dynamic_attach() publishes the attachment.
+ - Per Christian's suggestion on the v1 thread, keyed the check on
+ import_attach rather than removing the sg guard entirely.
+ - Fixes both xe and amdgpu in a single TTM patch.
+
+v4:
+ - Moved import_attach check to after dma_resv_copy_fences() so fences
+ are copied before returning for successful imports (Thomas).
+ - Removed exporter-alive claim from commit message (Thomas).
+
+v5:
+ - Add drm/xe patch to keep imported sg BOs off the LRU before attach
+ succeeds; the TTM fix alone is not sufficient for xe if the BO is
+ already LRU-visible. (Thomas)
+ v4 patch:
+ https://patchwork.freedesktop.org/patch/736663/?series=169129&rev=2
+ - Patch 1 (drm/ttm) carries Christian's Reviewed-by from v4.
+
+v6:
+ - Reworked the fix based on Thomas' suggestion. Instead of the TTM resv
+ individualization (v1-v5) plus the xe off-LRU/placement handling (v5),
+ just hold a dma-buf reference for the imported BO lifetime so the
+ shared resv can never be freed while the BO still references it.
+ Single xe patch, no TTM change. (Thomas)
+ - Take the reference in xe_bo_init_locked() before ttm_bo_init_reserved()
+ so a TTM creation failure is covered too (Thomas).
+ - Dropped the v5 series (drm/ttm + drm/xe off-LRU); the off-LRU approach
+ also regressed in CI BAT via ttm_bo_pipeline_gutting() creating a ghost
+ BO that outlived the exporter.
+ Link to v5: https://patchwork.freedesktop.org/series/169984/
+
+v7:
+ - Move changelog above --- so it stays in the commit message.
+ - Reorder changelog entries oldest-to-newest. (Thomas)
+
+Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8023
+Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
+Cc: stable@vger.kernel.org
+Cc: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
+Cc: Christian Konig <christian.koenig@amd.com>
+Cc: Matthew Auld <matthew.auld@intel.com>
+Suggested-by: Thomas Hellstrom <thomas.hellstrom@linux.intel.com>
+Assisted-by: GitHub_Copilot:claude-sonnet-4.6
+Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Nitin Gote <nitin.r.gote@intel.com>
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Link: https://patch.msgid.link/20260710191027.260160-2-nitin.r.gote@intel.com
+(cherry picked from commit 3516f3fae6be35642f8f06f8a218da6425c0306a)
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_bo.c | 24 ++++++++++++++++++++----
+ drivers/gpu/drm/xe/xe_bo.h | 3 ++-
+ drivers/gpu/drm/xe/xe_bo_types.h | 2 ++
+ drivers/gpu/drm/xe/xe_dma_buf.c | 2 +-
+ 4 files changed, 25 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
+index 4c80bac67622..ddbaf4242c79 100644
+--- a/drivers/gpu/drm/xe/xe_bo.c
++++ b/drivers/gpu/drm/xe/xe_bo.c
+@@ -1349,7 +1349,7 @@ int xe_bo_notifier_prepare_pinned(struct xe_bo *bo)
+ backup = xe_bo_init_locked(xe, NULL, NULL, bo->ttm.base.resv, NULL, xe_bo_size(bo),
+ DRM_XE_GEM_CPU_CACHING_WB, ttm_bo_type_kernel,
+ XE_BO_FLAG_SYSTEM | XE_BO_FLAG_NEEDS_CPU_ACCESS |
+- XE_BO_FLAG_PINNED, &exec);
++ XE_BO_FLAG_PINNED, NULL, &exec);
+ if (IS_ERR(backup)) {
+ drm_exec_retry_on_contention(&exec);
+ ret = PTR_ERR(backup);
+@@ -1490,7 +1490,7 @@ int xe_bo_evict_pinned(struct xe_bo *bo)
+ xe_bo_size(bo),
+ DRM_XE_GEM_CPU_CACHING_WB, ttm_bo_type_kernel,
+ XE_BO_FLAG_SYSTEM | XE_BO_FLAG_NEEDS_CPU_ACCESS |
+- XE_BO_FLAG_PINNED, &exec);
++ XE_BO_FLAG_PINNED, NULL, &exec);
+ if (IS_ERR(backup)) {
+ drm_exec_retry_on_contention(&exec);
+ ret = PTR_ERR(backup);
+@@ -1826,6 +1826,8 @@ static void xe_ttm_bo_destroy(struct ttm_buffer_object *ttm_bo)
+
+ if (bo->ttm.base.import_attach)
+ drm_prime_gem_destroy(&bo->ttm.base, NULL);
++ if (bo->dma_buf)
++ dma_buf_put(bo->dma_buf);
+ drm_gem_object_release(&bo->ttm.base);
+
+ xe_assert(xe, list_empty(&ttm_bo->base.gpuva.list));
+@@ -2283,6 +2285,8 @@ void xe_bo_free(struct xe_bo *bo)
+ * @cpu_caching: The cpu caching used for system memory backing store.
+ * @type: The TTM buffer object type.
+ * @flags: XE_BO_FLAG_ flags.
++ * @dma_buf: The dma-buf to reference for the BO lifetime (imported BOs),
++ * or NULL.
+ * @exec: The drm_exec transaction to use for exhaustive eviction.
+ *
+ * Initialize or create an xe buffer object. On failure, any allocated buffer
+@@ -2294,7 +2298,8 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo,
+ struct xe_tile *tile, struct dma_resv *resv,
+ struct ttm_lru_bulk_move *bulk, size_t size,
+ u16 cpu_caching, enum ttm_bo_type type,
+- u32 flags, struct drm_exec *exec)
++ u32 flags, struct dma_buf *dma_buf,
++ struct drm_exec *exec)
+ {
+ struct ttm_operation_ctx ctx = {
+ .interruptible = true,
+@@ -2383,6 +2388,17 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo,
+ placement = (type == ttm_bo_type_sg ||
+ bo->flags & XE_BO_FLAG_DEFER_BACKING) ? &sys_placement :
+ &bo->placement;
++
++ /*
++ * For imported BOs, keep the exporter dma-buf alive for the BO
++ * lifetime. Taken before ttm_bo_init_reserved() to also cover a
++ * creation failure there. Released in xe_ttm_bo_destroy().
++ */
++ if (dma_buf) {
++ get_dma_buf(dma_buf);
++ bo->dma_buf = dma_buf;
++ }
++
+ err = ttm_bo_init_reserved(&xe->ttm, &bo->ttm, type,
+ placement, alignment,
+ &ctx, NULL, resv, xe_ttm_bo_destroy);
+@@ -2500,7 +2516,7 @@ __xe_bo_create_locked(struct xe_device *xe,
+ vm && !xe_vm_in_fault_mode(vm) &&
+ flags & XE_BO_FLAG_USER ?
+ &vm->lru_bulk_move : NULL, size,
+- cpu_caching, type, flags, exec);
++ cpu_caching, type, flags, NULL, exec);
+ if (IS_ERR(bo))
+ return bo;
+
+diff --git a/drivers/gpu/drm/xe/xe_bo.h b/drivers/gpu/drm/xe/xe_bo.h
+index 6340317f7d2e..7ae1d9ac0574 100644
+--- a/drivers/gpu/drm/xe/xe_bo.h
++++ b/drivers/gpu/drm/xe/xe_bo.h
+@@ -118,7 +118,8 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo,
+ struct xe_tile *tile, struct dma_resv *resv,
+ struct ttm_lru_bulk_move *bulk, size_t size,
+ u16 cpu_caching, enum ttm_bo_type type,
+- u32 flags, struct drm_exec *exec);
++ u32 flags, struct dma_buf *dma_buf,
++ struct drm_exec *exec);
+ struct xe_bo *xe_bo_create_locked(struct xe_device *xe, struct xe_tile *tile,
+ struct xe_vm *vm, size_t size,
+ enum ttm_bo_type type, u32 flags,
+diff --git a/drivers/gpu/drm/xe/xe_bo_types.h b/drivers/gpu/drm/xe/xe_bo_types.h
+index fcc63ae3f455..e45f24301050 100644
+--- a/drivers/gpu/drm/xe/xe_bo_types.h
++++ b/drivers/gpu/drm/xe/xe_bo_types.h
+@@ -36,6 +36,8 @@ struct xe_bo {
+ struct xe_bo *backup_obj;
+ /** @parent_obj: Ref to parent bo if this a backup_obj */
+ struct xe_bo *parent_obj;
++ /** @dma_buf: Imported dma-buf ref to keep its resv alive. */
++ struct dma_buf *dma_buf;
+ /** @flags: flags for this buffer object */
+ u32 flags;
+ /** @vm: VM this BO is attached to, for extobj this will be NULL */
+diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c
+index 8a920e58245c..bf0728838ead 100644
+--- a/drivers/gpu/drm/xe/xe_dma_buf.c
++++ b/drivers/gpu/drm/xe/xe_dma_buf.c
+@@ -302,7 +302,7 @@ xe_dma_buf_create_obj(struct drm_device *dev, struct dma_buf *dma_buf)
+
+ bo = xe_bo_init_locked(xe, NULL, NULL, resv, NULL, dma_buf->size,
+ 0, /* Will require 1way or 2way for vm_bind */
+- ttm_bo_type_sg, XE_BO_FLAG_SYSTEM, &exec);
++ ttm_bo_type_sg, XE_BO_FLAG_SYSTEM, dma_buf, &exec);
+ drm_exec_retry_on_contention(&exec);
+ if (IS_ERR(bo)) {
+ ret = PTR_ERR(bo);
+--
+2.55.0
+
--- /dev/null
+From e70086a3a06d276b4a5d9a2c51c9330c6cf72780 Mon Sep 17 00:00:00 2001
+From: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Date: Mon, 15 Jun 2026 15:42:19 -0700
+Subject: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ashutosh Dixit <ashutosh.dixit@intel.com>
+
+commit e70086a3a06d276b4a5d9a2c51c9330c6cf72780 upstream.
+
+Unconditionally whitelisting OA registers is a security violation. Set
+RING_FORCE_TO_NONPRIV_DENY bit in OA nonpriv slots, so that OA registers
+don't get whitelisted by default after probe, gt reset, resume and engine
+reset.
+
+Fixes: 828a8eaf37c3 ("drm/xe/oa: Add MMIO trigger support")
+Cc: stable@vger.kernel.org # v6.12+
+Suggested-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
+Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
+Link: https://patch.msgid.link/20260615224227.34880-2-ashutosh.dixit@intel.com
+(cherry picked from commit 90511bdcfda97211c01f1d945d4ea616578d8fca)
+Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_reg_whitelist.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/xe/xe_reg_whitelist.c
++++ b/drivers/gpu/drm/xe/xe_reg_whitelist.c
+@@ -90,10 +90,12 @@ static const struct xe_rtp_entry_sr regi
+ RING_FORCE_TO_NONPRIV_ACCESS_RW))
+ },
+
++#define WHITELIST_DENY(r, f) WHITELIST(r, (f) | RING_FORCE_TO_NONPRIV_DENY)
++
+ #define WHITELIST_OA_MMIO_TRG(trg, status, head) \
+- WHITELIST(trg, RING_FORCE_TO_NONPRIV_ACCESS_RW), \
+- WHITELIST(status, RING_FORCE_TO_NONPRIV_ACCESS_RD), \
+- WHITELIST(head, RING_FORCE_TO_NONPRIV_ACCESS_RD | RING_FORCE_TO_NONPRIV_RANGE_4)
++ WHITELIST_DENY(trg, RING_FORCE_TO_NONPRIV_ACCESS_RW), \
++ WHITELIST_DENY(status, RING_FORCE_TO_NONPRIV_ACCESS_RD), \
++ WHITELIST_DENY(head, RING_FORCE_TO_NONPRIV_ACCESS_RD | RING_FORCE_TO_NONPRIV_RANGE_4)
+
+ #define WHITELIST_OAG_MMIO_TRG \
+ WHITELIST_OA_MMIO_TRG(OAG_MMIOTRIGGER, OAG_OASTATUS, OAG_OAHEADPTR)
projects / thirdparty / kernel / stable-queue.git / commitdiff
