From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 11:11:03 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v6.1.179~67 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=53f186cb62592e4d63dd83f543e68b795082b7dd;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: drm-xe-fix-pte-index-in-xe_vm_populate_pgtable-for-chunked-binds.patch drm-xe-return-error-on-non-migratable-faults-requiring-devmem.patch --- diff --git a/queue-6.18/drm-xe-fix-pte-index-in-xe_vm_populate_pgtable-for-chunked-binds.patch b/queue-6.18/drm-xe-fix-pte-index-in-xe_vm_populate_pgtable-for-chunked-binds.patch new file mode 100644 index 0000000000..49e7f82bb7 --- /dev/null +++ b/queue-6.18/drm-xe-fix-pte-index-in-xe_vm_populate_pgtable-for-chunked-binds.patch @@ -0,0 +1,76 @@ +From 34a4dd45cf210c04fee773b0dbc350aec285f03c Mon Sep 17 00:00:00 2001 +From: Matthew Brost +Date: Wed, 1 Jul 2026 18:24:34 -0700 +Subject: drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Brost + +commit 34a4dd45cf210c04fee773b0dbc350aec285f03c upstream. + +xe_vm_populate_pgtable() indexed the source PTE array (update->pt_entries) +by the per-call loop counter, assuming each call starts at the first entry +of the update. That holds for the CPU bind path +(xe_migrate_update_pgtables_cpu), which populates a whole update in a single +call, but not for the GPU bind path: write_pgtable() splits an update into +MAX_PTE_PER_SDI (510) sized MI_STORE_DATA_IMM chunks, invoking the populate +callback once per chunk with an advancing qword_ofs but a fresh command- +buffer destination pointer. + +As a result, every chunk after the first re-read pt_entries from index 0 +instead of from its true offset, so PTEs beyond the first 510 entries of a +single update were programmed with the wrong physical pages, shifting the +mapping by exactly MAX_PTE_PER_SDI pages. + +This stayed latent because a single update only exceeds 510 qwords when a +large (e.g. 2M) region is bound as individual 4K PTEs rather than a single +huge-page entry, which happens when the backing store is sufficiently +fragmented. It was surfaced by the BO defrag path, which deliberately +rebinds such fragmented ranges via the GPU bind path, producing +deterministic data corruption offset by 510 pages. + +Index pt_entries by the chunk's absolute offset relative to update->ofs so +both the CPU and GPU paths pick the correct entries. + +Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") +Cc: stable@vger.kernel.org +Assisted-by: GitHub_Copilot:claude-opus-4.8 +Signed-off-by: Matthew Brost +Reviewed-by: Matthew Auld +Link: https://patch.msgid.link/20260702012434.3861171-1-matthew.brost@intel.com +(cherry picked from commit e6f2d0b757c4fb577a513c577140109d1d292a9a) +Signed-off-by: Thomas Hellström +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_pt.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_pt.c ++++ b/drivers/gpu/drm/xe/xe_pt.c +@@ -999,12 +999,22 @@ xe_vm_populate_pgtable(struct xe_migrate + u64 *ptr = data; + u32 i; + ++ /* ++ * @qword_ofs is the absolute entry offset within the page table, while ++ * @ptes is indexed relative to @update->ofs (its first entry). The GPU ++ * path (write_pgtable) splits a single update into MAX_PTE_PER_SDI-sized ++ * chunks, calling this with an advancing @qword_ofs but a fresh @data ++ * pointer per chunk, so translate back into a @ptes index rather than ++ * assuming the chunk starts at ptes[0]. ++ */ + for (i = 0; i < num_qwords; i++) { ++ u32 idx = qword_ofs - update->ofs + i; ++ + if (map) + xe_map_wr(tile_to_xe(tile), map, (qword_ofs + i) * +- sizeof(u64), u64, ptes[i].pte); ++ sizeof(u64), u64, ptes[idx].pte); + else +- ptr[i] = ptes[i].pte; ++ ptr[i] = ptes[idx].pte; + } + } + diff --git a/queue-6.18/drm-xe-return-error-on-non-migratable-faults-requiring-devmem.patch b/queue-6.18/drm-xe-return-error-on-non-migratable-faults-requiring-devmem.patch new file mode 100644 index 0000000000..67383248ff --- /dev/null +++ b/queue-6.18/drm-xe-return-error-on-non-migratable-faults-requiring-devmem.patch @@ -0,0 +1,44 @@ +From 136fb61ba8571076dc5d49350a0e6d002d740b74 Mon Sep 17 00:00:00 2001 +From: Matthew Brost +Date: Wed, 17 Jun 2026 06:51:01 -0700 +Subject: drm/xe: Return error on non-migratable faults requiring devmem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Brost + +commit 136fb61ba8571076dc5d49350a0e6d002d740b74 upstream. + +Non-migratable faults that require devmem incorrectly jump to the 'out' +label, which squashes the error code intended to be returned to the +upper layers. Fix this by returning -EACCES instead. + +Reported-by: Sashiko +Fixes: 4208fac3dce5 ("drm/xe: Add more SVM GT stats") +Cc: stable@vger.kernel.org +Signed-off-by: Matthew Brost +Reviewed-by: Francois Dugast +Link: https://patch.msgid.link/20260617135101.1245574-1-matthew.brost@intel.com +(cherry picked from commit c4508edb2c723de93717272488ea65b165637eac) +Signed-off-by: Thomas Hellström +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_svm.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_svm.c ++++ b/drivers/gpu/drm/xe/xe_svm.c +@@ -1074,10 +1074,8 @@ retry: + + xe_svm_range_fault_count_stats_incr(gt, range); + +- if (ctx.devmem_only && !range->base.pages.flags.migrate_devmem) { +- err = -EACCES; +- goto out; +- } ++ if (ctx.devmem_only && !range->base.pages.flags.migrate_devmem) ++ return -EACCES; + + if (xe_svm_range_is_valid(range, tile, ctx.devmem_only)) { + xe_svm_range_valid_fault_count_stats_incr(gt, range); diff --git a/queue-6.18/series b/queue-6.18/series index c8086d2b69..425e07c54b 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -351,3 +351,5 @@ drm-displayid-fix-tiled-display-topology-id-size.patch drm-i915-gem-add-missing-nospec-on-parallel-submit-slot.patch drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch drm-radeon-fix-r100_copy_blit-for-large-bos.patch +drm-xe-return-error-on-non-migratable-faults-requiring-devmem.patch +drm-xe-fix-pte-index-in-xe_vm_populate_pgtable-for-chunked-binds.patch