From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 11:11:13 +0000 (+0200) Subject: 7.1-stable patches X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=a004c7865da03ea2e6c8cdc5a00ee606c86e0c39;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: drm-xe-fix-pte-index-in-xe_vm_populate_pgtable-for-chunked-binds.patch drm-xe-hold-a-dma-buf-reference-for-imported-bos.patch drm-xe-oa-fix-offset-alignment-for-mert-whitelist_oa_mert_mmio_trg.patch drm-xe-return-error-on-non-migratable-faults-requiring-devmem.patch drm-xe-rtp-add-ring_force_to_nonpriv_deny-to-oa-whitelists.patch --- diff --git a/queue-7.1/drm-xe-fix-pte-index-in-xe_vm_populate_pgtable-for-chunked-binds.patch b/queue-7.1/drm-xe-fix-pte-index-in-xe_vm_populate_pgtable-for-chunked-binds.patch new file mode 100644 index 0000000000..ef0e30e77b --- /dev/null +++ b/queue-7.1/drm-xe-fix-pte-index-in-xe_vm_populate_pgtable-for-chunked-binds.patch @@ -0,0 +1,76 @@ +From 34a4dd45cf210c04fee773b0dbc350aec285f03c Mon Sep 17 00:00:00 2001 +From: Matthew Brost +Date: Wed, 1 Jul 2026 18:24:34 -0700 +Subject: drm/xe: Fix PTE index in xe_vm_populate_pgtable() for chunked binds +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Brost + +commit 34a4dd45cf210c04fee773b0dbc350aec285f03c upstream. + +xe_vm_populate_pgtable() indexed the source PTE array (update->pt_entries) +by the per-call loop counter, assuming each call starts at the first entry +of the update. That holds for the CPU bind path +(xe_migrate_update_pgtables_cpu), which populates a whole update in a single +call, but not for the GPU bind path: write_pgtable() splits an update into +MAX_PTE_PER_SDI (510) sized MI_STORE_DATA_IMM chunks, invoking the populate +callback once per chunk with an advancing qword_ofs but a fresh command- +buffer destination pointer. + +As a result, every chunk after the first re-read pt_entries from index 0 +instead of from its true offset, so PTEs beyond the first 510 entries of a +single update were programmed with the wrong physical pages, shifting the +mapping by exactly MAX_PTE_PER_SDI pages. + +This stayed latent because a single update only exceeds 510 qwords when a +large (e.g. 2M) region is bound as individual 4K PTEs rather than a single +huge-page entry, which happens when the backing store is sufficiently +fragmented. It was surfaced by the BO defrag path, which deliberately +rebinds such fragmented ranges via the GPU bind path, producing +deterministic data corruption offset by 510 pages. + +Index pt_entries by the chunk's absolute offset relative to update->ofs so +both the CPU and GPU paths pick the correct entries. + +Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") +Cc: stable@vger.kernel.org +Assisted-by: GitHub_Copilot:claude-opus-4.8 +Signed-off-by: Matthew Brost +Reviewed-by: Matthew Auld +Link: https://patch.msgid.link/20260702012434.3861171-1-matthew.brost@intel.com +(cherry picked from commit e6f2d0b757c4fb577a513c577140109d1d292a9a) +Signed-off-by: Thomas Hellström +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_pt.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_pt.c ++++ b/drivers/gpu/drm/xe/xe_pt.c +@@ -1025,12 +1025,22 @@ xe_vm_populate_pgtable(struct xe_migrate + u64 *ptr = data; + u32 i; + ++ /* ++ * @qword_ofs is the absolute entry offset within the page table, while ++ * @ptes is indexed relative to @update->ofs (its first entry). The GPU ++ * path (write_pgtable) splits a single update into MAX_PTE_PER_SDI-sized ++ * chunks, calling this with an advancing @qword_ofs but a fresh @data ++ * pointer per chunk, so translate back into a @ptes index rather than ++ * assuming the chunk starts at ptes[0]. ++ */ + for (i = 0; i < num_qwords; i++) { ++ u32 idx = qword_ofs - update->ofs + i; ++ + if (map) + xe_map_wr(tile_to_xe(tile), map, (qword_ofs + i) * +- sizeof(u64), u64, ptes[i].pte); ++ sizeof(u64), u64, ptes[idx].pte); + else +- ptr[i] = ptes[i].pte; ++ ptr[i] = ptes[idx].pte; + } + } + diff --git a/queue-7.1/drm-xe-hold-a-dma-buf-reference-for-imported-bos.patch b/queue-7.1/drm-xe-hold-a-dma-buf-reference-for-imported-bos.patch new file mode 100644 index 0000000000..f575d7ac8a --- /dev/null +++ b/queue-7.1/drm-xe-hold-a-dma-buf-reference-for-imported-bos.patch @@ -0,0 +1,224 @@ +From 62775525a27c3b0d56382e08ba81ee2d322058b6 Mon Sep 17 00:00:00 2001 +From: Nitin Gote +Date: Sat, 11 Jul 2026 00:40:28 +0530 +Subject: drm/xe: Hold a dma-buf reference for imported BOs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nitin Gote + +commit 62775525a27c3b0d56382e08ba81ee2d322058b6 upstream. + +An imported dma-buf BO is created as a ttm_bo_type_sg BO whose +reservation object is the exporter's dma_buf->resv. The importer, +however, only takes a dma-buf reference after a successful +dma_buf_dynamic_attach(). Until then nothing keeps the exporter alive, +so if the exporter is freed while the BO still references its resv, a +later access to that resv is a use-after-free: + + Oops: general protection fault, probably for non-canonical address + 0x6b6b6b6b6b6b6b9c + Workqueue: ttm ttm_bo_delayed_delete [ttm] + RIP: 0010:mutex_can_spin_on_owner+0x3f/0xc0 + +This can be reached on two paths: + + - dma_buf_dynamic_attach() fails, or + - ttm_bo_init_reserved() fails during BO creation. + +In both cases the BO already has bo->base.resv pointing at the exporter +resv, and sg BOs are always torn down via ttm_bo_delayed_delete(), which +locks bo->base.resv asynchronously - potentially after the exporter has +been freed. + +Take the dma-buf reference in xe_bo_init_locked(), before +ttm_bo_init_reserved(), so it also covers a creation failure there, and +release it in xe_ttm_bo_destroy(). The reference is held for the whole +BO lifetime, keeping the shared resv alive on every path. + +v2: + - Reworked the fix to avoid creating the imported sg BO before + dma_buf_dynamic_attach() succeeds. + - Attach with importer_priv == NULL and make invalidate_mappings ignore + incomplete imports. + +v3: + - Dropped the xe-side reordering approach since importer_priv must be + valid when dma_buf_dynamic_attach() publishes the attachment. + - Per Christian's suggestion on the v1 thread, keyed the check on + import_attach rather than removing the sg guard entirely. + - Fixes both xe and amdgpu in a single TTM patch. + +v4: + - Moved import_attach check to after dma_resv_copy_fences() so fences + are copied before returning for successful imports (Thomas). + - Removed exporter-alive claim from commit message (Thomas). + +v5: + - Add drm/xe patch to keep imported sg BOs off the LRU before attach + succeeds; the TTM fix alone is not sufficient for xe if the BO is + already LRU-visible. (Thomas) + v4 patch: + https://patchwork.freedesktop.org/patch/736663/?series=169129&rev=2 + - Patch 1 (drm/ttm) carries Christian's Reviewed-by from v4. + +v6: + - Reworked the fix based on Thomas' suggestion. Instead of the TTM resv + individualization (v1-v5) plus the xe off-LRU/placement handling (v5), + just hold a dma-buf reference for the imported BO lifetime so the + shared resv can never be freed while the BO still references it. + Single xe patch, no TTM change. (Thomas) + - Take the reference in xe_bo_init_locked() before ttm_bo_init_reserved() + so a TTM creation failure is covered too (Thomas). + - Dropped the v5 series (drm/ttm + drm/xe off-LRU); the off-LRU approach + also regressed in CI BAT via ttm_bo_pipeline_gutting() creating a ghost + BO that outlived the exporter. + Link to v5: https://patchwork.freedesktop.org/series/169984/ + +v7: + - Move changelog above --- so it stays in the commit message. + - Reorder changelog entries oldest-to-newest. (Thomas) + +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8023 +Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") +Cc: stable@vger.kernel.org +Cc: Thomas Hellstrom +Cc: Christian Konig +Cc: Matthew Auld +Suggested-by: Thomas Hellstrom +Assisted-by: GitHub_Copilot:claude-sonnet-4.6 +Reviewed-by: Thomas Hellström +Signed-off-by: Nitin Gote +Signed-off-by: Matthew Auld +Link: https://patch.msgid.link/20260710191027.260160-2-nitin.r.gote@intel.com +(cherry picked from commit 3516f3fae6be35642f8f06f8a218da6425c0306a) +Signed-off-by: Thomas Hellström +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_bo.c | 24 ++++++++++++++++++++---- + drivers/gpu/drm/xe/xe_bo.h | 3 ++- + drivers/gpu/drm/xe/xe_bo_types.h | 2 ++ + drivers/gpu/drm/xe/xe_dma_buf.c | 2 +- + 4 files changed, 25 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c +index 4c80bac67622..ddbaf4242c79 100644 +--- a/drivers/gpu/drm/xe/xe_bo.c ++++ b/drivers/gpu/drm/xe/xe_bo.c +@@ -1349,7 +1349,7 @@ int xe_bo_notifier_prepare_pinned(struct xe_bo *bo) + backup = xe_bo_init_locked(xe, NULL, NULL, bo->ttm.base.resv, NULL, xe_bo_size(bo), + DRM_XE_GEM_CPU_CACHING_WB, ttm_bo_type_kernel, + XE_BO_FLAG_SYSTEM | XE_BO_FLAG_NEEDS_CPU_ACCESS | +- XE_BO_FLAG_PINNED, &exec); ++ XE_BO_FLAG_PINNED, NULL, &exec); + if (IS_ERR(backup)) { + drm_exec_retry_on_contention(&exec); + ret = PTR_ERR(backup); +@@ -1490,7 +1490,7 @@ int xe_bo_evict_pinned(struct xe_bo *bo) + xe_bo_size(bo), + DRM_XE_GEM_CPU_CACHING_WB, ttm_bo_type_kernel, + XE_BO_FLAG_SYSTEM | XE_BO_FLAG_NEEDS_CPU_ACCESS | +- XE_BO_FLAG_PINNED, &exec); ++ XE_BO_FLAG_PINNED, NULL, &exec); + if (IS_ERR(backup)) { + drm_exec_retry_on_contention(&exec); + ret = PTR_ERR(backup); +@@ -1826,6 +1826,8 @@ static void xe_ttm_bo_destroy(struct ttm_buffer_object *ttm_bo) + + if (bo->ttm.base.import_attach) + drm_prime_gem_destroy(&bo->ttm.base, NULL); ++ if (bo->dma_buf) ++ dma_buf_put(bo->dma_buf); + drm_gem_object_release(&bo->ttm.base); + + xe_assert(xe, list_empty(&ttm_bo->base.gpuva.list)); +@@ -2283,6 +2285,8 @@ void xe_bo_free(struct xe_bo *bo) + * @cpu_caching: The cpu caching used for system memory backing store. + * @type: The TTM buffer object type. + * @flags: XE_BO_FLAG_ flags. ++ * @dma_buf: The dma-buf to reference for the BO lifetime (imported BOs), ++ * or NULL. + * @exec: The drm_exec transaction to use for exhaustive eviction. + * + * Initialize or create an xe buffer object. On failure, any allocated buffer +@@ -2294,7 +2298,8 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo, + struct xe_tile *tile, struct dma_resv *resv, + struct ttm_lru_bulk_move *bulk, size_t size, + u16 cpu_caching, enum ttm_bo_type type, +- u32 flags, struct drm_exec *exec) ++ u32 flags, struct dma_buf *dma_buf, ++ struct drm_exec *exec) + { + struct ttm_operation_ctx ctx = { + .interruptible = true, +@@ -2383,6 +2388,17 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo, + placement = (type == ttm_bo_type_sg || + bo->flags & XE_BO_FLAG_DEFER_BACKING) ? &sys_placement : + &bo->placement; ++ ++ /* ++ * For imported BOs, keep the exporter dma-buf alive for the BO ++ * lifetime. Taken before ttm_bo_init_reserved() to also cover a ++ * creation failure there. Released in xe_ttm_bo_destroy(). ++ */ ++ if (dma_buf) { ++ get_dma_buf(dma_buf); ++ bo->dma_buf = dma_buf; ++ } ++ + err = ttm_bo_init_reserved(&xe->ttm, &bo->ttm, type, + placement, alignment, + &ctx, NULL, resv, xe_ttm_bo_destroy); +@@ -2500,7 +2516,7 @@ __xe_bo_create_locked(struct xe_device *xe, + vm && !xe_vm_in_fault_mode(vm) && + flags & XE_BO_FLAG_USER ? + &vm->lru_bulk_move : NULL, size, +- cpu_caching, type, flags, exec); ++ cpu_caching, type, flags, NULL, exec); + if (IS_ERR(bo)) + return bo; + +diff --git a/drivers/gpu/drm/xe/xe_bo.h b/drivers/gpu/drm/xe/xe_bo.h +index 6340317f7d2e..7ae1d9ac0574 100644 +--- a/drivers/gpu/drm/xe/xe_bo.h ++++ b/drivers/gpu/drm/xe/xe_bo.h +@@ -118,7 +118,8 @@ struct xe_bo *xe_bo_init_locked(struct xe_device *xe, struct xe_bo *bo, + struct xe_tile *tile, struct dma_resv *resv, + struct ttm_lru_bulk_move *bulk, size_t size, + u16 cpu_caching, enum ttm_bo_type type, +- u32 flags, struct drm_exec *exec); ++ u32 flags, struct dma_buf *dma_buf, ++ struct drm_exec *exec); + struct xe_bo *xe_bo_create_locked(struct xe_device *xe, struct xe_tile *tile, + struct xe_vm *vm, size_t size, + enum ttm_bo_type type, u32 flags, +diff --git a/drivers/gpu/drm/xe/xe_bo_types.h b/drivers/gpu/drm/xe/xe_bo_types.h +index fcc63ae3f455..e45f24301050 100644 +--- a/drivers/gpu/drm/xe/xe_bo_types.h ++++ b/drivers/gpu/drm/xe/xe_bo_types.h +@@ -36,6 +36,8 @@ struct xe_bo { + struct xe_bo *backup_obj; + /** @parent_obj: Ref to parent bo if this a backup_obj */ + struct xe_bo *parent_obj; ++ /** @dma_buf: Imported dma-buf ref to keep its resv alive. */ ++ struct dma_buf *dma_buf; + /** @flags: flags for this buffer object */ + u32 flags; + /** @vm: VM this BO is attached to, for extobj this will be NULL */ +diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c +index 8a920e58245c..bf0728838ead 100644 +--- a/drivers/gpu/drm/xe/xe_dma_buf.c ++++ b/drivers/gpu/drm/xe/xe_dma_buf.c +@@ -302,7 +302,7 @@ xe_dma_buf_create_obj(struct drm_device *dev, struct dma_buf *dma_buf) + + bo = xe_bo_init_locked(xe, NULL, NULL, resv, NULL, dma_buf->size, + 0, /* Will require 1way or 2way for vm_bind */ +- ttm_bo_type_sg, XE_BO_FLAG_SYSTEM, &exec); ++ ttm_bo_type_sg, XE_BO_FLAG_SYSTEM, dma_buf, &exec); + drm_exec_retry_on_contention(&exec); + if (IS_ERR(bo)) { + ret = PTR_ERR(bo); +-- +2.55.0 + diff --git a/queue-7.1/drm-xe-oa-fix-offset-alignment-for-mert-whitelist_oa_mert_mmio_trg.patch b/queue-7.1/drm-xe-oa-fix-offset-alignment-for-mert-whitelist_oa_mert_mmio_trg.patch new file mode 100644 index 0000000000..548502c2d1 --- /dev/null +++ b/queue-7.1/drm-xe-oa-fix-offset-alignment-for-mert-whitelist_oa_mert_mmio_trg.patch @@ -0,0 +1,38 @@ +From 959b5016e4646b55fd2fd0438932e4c4e9ce171f Mon Sep 17 00:00:00 2001 +From: Ashutosh Dixit +Date: Mon, 29 Jun 2026 10:26:34 -0700 +Subject: drm/xe/oa: Fix offset alignment for MERT WHITELIST_OA_MERT_MMIO_TRG +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ashutosh Dixit + +commit 959b5016e4646b55fd2fd0438932e4c4e9ce171f upstream. + +'head' argument for WHITELIST_OA_MERT_MMIO_TRG was previously wrong (not +multiple of 16). Fix this. + +Fixes: ec02e49f21bc ("drm/xe/rtp: Whitelist OAMERT MMIO trigger registers") +Cc: stable@vger.kernel.org +Reviewed-by: Umesh Nerlige Ramappa +Signed-off-by: Ashutosh Dixit +Link: https://patch.msgid.link/20260629172634.1100983-1-ashutosh.dixit@intel.com +(cherry picked from commit f6c23e4589bdc69a5d2f79aed5c5bddd5d406cbe) +Signed-off-by: Thomas Hellström +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_reg_whitelist.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/xe/xe_reg_whitelist.c ++++ b/drivers/gpu/drm/xe/xe_reg_whitelist.c +@@ -110,7 +110,7 @@ static const struct xe_rtp_entry_sr regi + OAM_HEAD_POINTER(XE_OAM_SCMI_1_BASE_ADJ)) + + #define WHITELIST_OA_MERT_MMIO_TRG \ +- WHITELIST_OA_MMIO_TRG(OAMERT_MMIO_TRG, OAMERT_STATUS, OAMERT_HEAD_POINTER) ++ WHITELIST_OA_MMIO_TRG(OAMERT_MMIO_TRG, OAMERT_STATUS, OAMERT_TAIL_POINTER) + + { XE_RTP_NAME("oag_mmio_trg_rcs"), + XE_RTP_RULES(GRAPHICS_VERSION_RANGE(1200, XE_RTP_END_VERSION_UNDEFINED), diff --git a/queue-7.1/drm-xe-return-error-on-non-migratable-faults-requiring-devmem.patch b/queue-7.1/drm-xe-return-error-on-non-migratable-faults-requiring-devmem.patch new file mode 100644 index 0000000000..b93214d81d --- /dev/null +++ b/queue-7.1/drm-xe-return-error-on-non-migratable-faults-requiring-devmem.patch @@ -0,0 +1,44 @@ +From 136fb61ba8571076dc5d49350a0e6d002d740b74 Mon Sep 17 00:00:00 2001 +From: Matthew Brost +Date: Wed, 17 Jun 2026 06:51:01 -0700 +Subject: drm/xe: Return error on non-migratable faults requiring devmem +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Brost + +commit 136fb61ba8571076dc5d49350a0e6d002d740b74 upstream. + +Non-migratable faults that require devmem incorrectly jump to the 'out' +label, which squashes the error code intended to be returned to the +upper layers. Fix this by returning -EACCES instead. + +Reported-by: Sashiko +Fixes: 4208fac3dce5 ("drm/xe: Add more SVM GT stats") +Cc: stable@vger.kernel.org +Signed-off-by: Matthew Brost +Reviewed-by: Francois Dugast +Link: https://patch.msgid.link/20260617135101.1245574-1-matthew.brost@intel.com +(cherry picked from commit c4508edb2c723de93717272488ea65b165637eac) +Signed-off-by: Thomas Hellström +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_svm.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_svm.c ++++ b/drivers/gpu/drm/xe/xe_svm.c +@@ -1255,10 +1255,8 @@ retry: + + xe_svm_range_fault_count_stats_incr(gt, range); + +- if (ctx.devmem_only && !range->base.pages.flags.migrate_devmem) { +- err = -EACCES; +- goto out; +- } ++ if (ctx.devmem_only && !range->base.pages.flags.migrate_devmem) ++ return -EACCES; + + if (xe_svm_range_is_valid(range, tile, ctx.devmem_only, dpagemap)) { + xe_svm_range_valid_fault_count_stats_incr(gt, range); diff --git a/queue-7.1/drm-xe-rtp-add-ring_force_to_nonpriv_deny-to-oa-whitelists.patch b/queue-7.1/drm-xe-rtp-add-ring_force_to_nonpriv_deny-to-oa-whitelists.patch new file mode 100644 index 0000000000..d2163d2f15 --- /dev/null +++ b/queue-7.1/drm-xe-rtp-add-ring_force_to_nonpriv_deny-to-oa-whitelists.patch @@ -0,0 +1,48 @@ +From e70086a3a06d276b4a5d9a2c51c9330c6cf72780 Mon Sep 17 00:00:00 2001 +From: Ashutosh Dixit +Date: Mon, 15 Jun 2026 15:42:19 -0700 +Subject: drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ashutosh Dixit + +commit e70086a3a06d276b4a5d9a2c51c9330c6cf72780 upstream. + +Unconditionally whitelisting OA registers is a security violation. Set +RING_FORCE_TO_NONPRIV_DENY bit in OA nonpriv slots, so that OA registers +don't get whitelisted by default after probe, gt reset, resume and engine +reset. + +Fixes: 828a8eaf37c3 ("drm/xe/oa: Add MMIO trigger support") +Cc: stable@vger.kernel.org # v6.12+ +Suggested-by: Umesh Nerlige Ramappa +Signed-off-by: Ashutosh Dixit +Reviewed-by: Umesh Nerlige Ramappa +Link: https://patch.msgid.link/20260615224227.34880-2-ashutosh.dixit@intel.com +(cherry picked from commit 90511bdcfda97211c01f1d945d4ea616578d8fca) +Signed-off-by: Thomas Hellström +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_reg_whitelist.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/xe/xe_reg_whitelist.c ++++ b/drivers/gpu/drm/xe/xe_reg_whitelist.c +@@ -90,10 +90,12 @@ static const struct xe_rtp_entry_sr regi + RING_FORCE_TO_NONPRIV_ACCESS_RW)) + }, + ++#define WHITELIST_DENY(r, f) WHITELIST(r, (f) | RING_FORCE_TO_NONPRIV_DENY) ++ + #define WHITELIST_OA_MMIO_TRG(trg, status, head) \ +- WHITELIST(trg, RING_FORCE_TO_NONPRIV_ACCESS_RW), \ +- WHITELIST(status, RING_FORCE_TO_NONPRIV_ACCESS_RD), \ +- WHITELIST(head, RING_FORCE_TO_NONPRIV_ACCESS_RD | RING_FORCE_TO_NONPRIV_RANGE_4) ++ WHITELIST_DENY(trg, RING_FORCE_TO_NONPRIV_ACCESS_RW), \ ++ WHITELIST_DENY(status, RING_FORCE_TO_NONPRIV_ACCESS_RD), \ ++ WHITELIST_DENY(head, RING_FORCE_TO_NONPRIV_ACCESS_RD | RING_FORCE_TO_NONPRIV_RANGE_4) + + #define WHITELIST_OAG_MMIO_TRG \ + WHITELIST_OA_MMIO_TRG(OAG_MMIOTRIGGER, OAG_OASTATUS, OAG_OAHEADPTR) diff --git a/queue-7.1/series b/queue-7.1/series index fe805ad4df..cf959b3d9f 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -398,3 +398,8 @@ drm-i915-mtl-enable-pps-before-pll.patch drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch drm-radeon-fix-r100_copy_blit-for-large-bos.patch drm-xe-display-skip-force_wc-and-vm_bound-check-for-external-dma-bufs.patch +drm-xe-return-error-on-non-migratable-faults-requiring-devmem.patch +drm-xe-oa-fix-offset-alignment-for-mert-whitelist_oa_mert_mmio_trg.patch +drm-xe-rtp-add-ring_force_to_nonpriv_deny-to-oa-whitelists.patch +drm-xe-fix-pte-index-in-xe_vm_populate_pgtable-for-chunked-binds.patch +drm-xe-hold-a-dma-buf-reference-for-imported-bos.patch