<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/drivers/gpu/drm/xe/xe_migrate.c, branch v6.16</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>drm/xe/migrate: Fix alignment check</title>
<updated>2025-07-17T12:51:51+00:00</updated>
<author>
<name>Lucas De Marchi</name>
<email>lucas.demarchi@intel.com</email>
</author>
<published>2025-07-10T21:34:41+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=057a7d66f98eda9257e46fe44ee5750e0a6eec66'/>
<id>057a7d66f98eda9257e46fe44ee5750e0a6eec66</id>
<content type='text'>
The check would fail if the address is unaligned, but not when
accounting the offset. Instead of `buf | offset` it should have
been `buf + offset`. To make it more readable and also drop the
uintptr_t, just use the IS_ALIGNED() macro.

Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access")
Reviewed-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Link: https://lore.kernel.org/r/20250710-migrate-aligned-v1-1-44003ef3c078@intel.com
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
(cherry picked from commit 81e139db6900503a2e68009764054fad128fbf95)
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The check would fail if the address is unaligned, but not when
accounting the offset. Instead of `buf | offset` it should have
been `buf + offset`. To make it more readable and also drop the
uintptr_t, just use the IS_ALIGNED() macro.

Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access")
Reviewed-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Link: https://lore.kernel.org/r/20250710-migrate-aligned-v1-1-44003ef3c078@intel.com
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
(cherry picked from commit 81e139db6900503a2e68009764054fad128fbf95)
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe/migrate: fix copy direction in access_memory</title>
<updated>2025-07-17T12:45:19+00:00</updated>
<author>
<name>Matthew Auld</name>
<email>matthew.auld@intel.com</email>
</author>
<published>2025-07-10T13:41:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=1381c231c1267480f721b06528c3a230f43f2ac5'/>
<id>1381c231c1267480f721b06528c3a230f43f2ac5</id>
<content type='text'>
After we do the modification on the host side, ensure we write the
result back to VRAM and not the other way around, otherwise the
modification will be lost if treated like a read.

Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access")
Signed-off-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Link: https://lore.kernel.org/r/20250710134128.800756-2-matthew.auld@intel.com
(cherry picked from commit c12fe703cab93f9d8bfe0ff32b58e7b1fd52be1f)
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
After we do the modification on the host side, ensure we write the
result back to VRAM and not the other way around, otherwise the
modification will be lost if treated like a read.

Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access")
Signed-off-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Link: https://lore.kernel.org/r/20250710134128.800756-2-matthew.auld@intel.com
(cherry picked from commit c12fe703cab93f9d8bfe0ff32b58e7b1fd52be1f)
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe/bmg: fix compressed VRAM handling</title>
<updated>2025-07-08T03:57:17+00:00</updated>
<author>
<name>Matthew Auld</name>
<email>matthew.auld@intel.com</email>
</author>
<published>2025-07-01T10:39:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=fee58ca135a7b979c8b75e6d2eac60d695f9209b'/>
<id>fee58ca135a7b979c8b75e6d2eac60d695f9209b</id>
<content type='text'>
There looks to be an issue in our compression handling when the BO pages
are very fragmented, where we choose to skip the identity map and
instead fall back to emitting the PTEs by hand when migrating memory,
such that we can hopefully do more work per blit operation. However in
such a case we need to ensure the src PTEs are correctly tagged with a
compression enabled PAT index on dgpu xe2+, otherwise the copy will
simply treat the src memory as uncompressed, leading to corruption if
the memory was compressed by the user.

To fix this pass along use_comp_pat into emit_pte() on the src side, to
indicate that compression should be considered.

v2 (Jonathan): tweak the commit message

Fixes: 523f191cc0c7 ("drm/xe/xe_migrate: Handle migration logic for xe2+ dgfx")
Signed-off-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Cc: Himal Prasad Ghimiray &lt;himal.prasad.ghimiray@intel.com&gt;
Cc: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Cc: Akshata Jahagirdar &lt;akshata.jahagirdar@intel.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v6.12+
Reviewed-by: Jonathan Cavitt &lt;jonathan.cavitt@intel.com&gt;
Link: https://lore.kernel.org/r/20250701103949.83116-2-matthew.auld@intel.com
(cherry picked from commit f7a2fd776e57bd6468644bdecd91ab3aba57ba58)
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
There looks to be an issue in our compression handling when the BO pages
are very fragmented, where we choose to skip the identity map and
instead fall back to emitting the PTEs by hand when migrating memory,
such that we can hopefully do more work per blit operation. However in
such a case we need to ensure the src PTEs are correctly tagged with a
compression enabled PAT index on dgpu xe2+, otherwise the copy will
simply treat the src memory as uncompressed, leading to corruption if
the memory was compressed by the user.

To fix this pass along use_comp_pat into emit_pte() on the src side, to
indicate that compression should be considered.

v2 (Jonathan): tweak the commit message

Fixes: 523f191cc0c7 ("drm/xe/xe_migrate: Handle migration logic for xe2+ dgfx")
Signed-off-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Cc: Himal Prasad Ghimiray &lt;himal.prasad.ghimiray@intel.com&gt;
Cc: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Cc: Akshata Jahagirdar &lt;akshata.jahagirdar@intel.com&gt;
Cc: &lt;stable@vger.kernel.org&gt; # v6.12+
Reviewed-by: Jonathan Cavitt &lt;jonathan.cavitt@intel.com&gt;
Link: https://lore.kernel.org/r/20250701103949.83116-2-matthew.auld@intel.com
(cherry picked from commit f7a2fd776e57bd6468644bdecd91ab3aba57ba58)
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe: Fix out-of-bounds field write in MI_STORE_DATA_IMM</title>
<updated>2025-07-01T20:04:00+00:00</updated>
<author>
<name>Jia Yao</name>
<email>jia.yao@intel.com</email>
</author>
<published>2025-06-12T22:46:20+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=2d5cff2b4bc567dcaad7ab5b46c973ba534cc062'/>
<id>2d5cff2b4bc567dcaad7ab5b46c973ba534cc062</id>
<content type='text'>
According to Bspec, bits 0~9 of MI_STORE_DATA_IMM must not exceed 0x3FE.
The macro MI_SDI_NUM_QW(x) evaluates to 2 * x + 1, which means the
condition 2 * x + 1 &lt;= 0x3FE must be satisfied. Therefore, the maximum
valid value for x is 0x1FE, not 0x1FF.

v2
 - Replace 0x1fe with macro MAX_PTE_PER_SDI (Auld, Matthew &amp; Patelczyk, Maciej)

v3
 - Change macro MAX_PTE_PER_SDI from 0x1fe to 0x1feU (De Marchi, Lucas)

Bspec: 60246

Fixes: 9c44fd5f6e8a ("drm/xe: Add migrate layer functions for SVM support")
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Cc: Brian3 Nguyen &lt;brian3.nguyen@intel.com&gt;
Cc: Alex Zuo &lt;alex.zuo@intel.com&gt;
Cc: Matthew Auld &lt;matthew.auld@intel.com&gt;
Cc: Maciej Patelczyk &lt;maciej.patelczyk@intel.com&gt;
Cc: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
Suggested-by: Shuicheng Lin &lt;shuicheng.lin@intel.com&gt;
Signed-off-by: Jia Yao &lt;jia.yao@intel.com&gt;
Reviewed-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
Reviewed-by: Maciej Patelczyk &lt;maciej.patelczyk@intel.com&gt;
Link: https://lore.kernel.org/r/20250612224620.161105-1-jia.yao@intel.com
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
(cherry picked from commit c038bdba98c9f6a36378044a9d4385531a194d3e)
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
According to Bspec, bits 0~9 of MI_STORE_DATA_IMM must not exceed 0x3FE.
The macro MI_SDI_NUM_QW(x) evaluates to 2 * x + 1, which means the
condition 2 * x + 1 &lt;= 0x3FE must be satisfied. Therefore, the maximum
valid value for x is 0x1FE, not 0x1FF.

v2
 - Replace 0x1fe with macro MAX_PTE_PER_SDI (Auld, Matthew &amp; Patelczyk, Maciej)

v3
 - Change macro MAX_PTE_PER_SDI from 0x1fe to 0x1feU (De Marchi, Lucas)

Bspec: 60246

Fixes: 9c44fd5f6e8a ("drm/xe: Add migrate layer functions for SVM support")
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Cc: Brian3 Nguyen &lt;brian3.nguyen@intel.com&gt;
Cc: Alex Zuo &lt;alex.zuo@intel.com&gt;
Cc: Matthew Auld &lt;matthew.auld@intel.com&gt;
Cc: Maciej Patelczyk &lt;maciej.patelczyk@intel.com&gt;
Cc: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
Suggested-by: Shuicheng Lin &lt;shuicheng.lin@intel.com&gt;
Signed-off-by: Jia Yao &lt;jia.yao@intel.com&gt;
Reviewed-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
Reviewed-by: Maciej Patelczyk &lt;maciej.patelczyk@intel.com&gt;
Link: https://lore.kernel.org/r/20250612224620.161105-1-jia.yao@intel.com
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
(cherry picked from commit c038bdba98c9f6a36378044a9d4385531a194d3e)
Signed-off-by: Lucas De Marchi &lt;lucas.demarchi@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access</title>
<updated>2025-04-24T22:51:39+00:00</updated>
<author>
<name>Matthew Brost</name>
<email>matthew.brost@intel.com</email>
</author>
<published>2025-04-23T17:17:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=270172f64b114451876c1b68912653e72ab99f38'/>
<id>270172f64b114451876c1b68912653e72ab99f38</id>
<content type='text'>
Add migrate layer functions to access VRAM and update
xe_ttm_access_memory to use for non-visible access and large (more than
16k) BO access. 8G devcoreump on BMG observed 3 minute CPU copy time vs.
3s GPU copy time.

v4:
 - Fix non-page aligned accesses
 - Add support for small / unaligned access
 - Update commit message indicating migrate used for large accesses (Auld)
 - Fix warning in xe_res_cursor for non-zero offset
v5:
 - Fix 32 bit build (CI)
v6:
 - Rebase and use SVM migration copy functions
v7:
 - Fix build error (CI)
v8:
 - Remove ifdef around VRAM copy functions (CI)
 - Use break statement in dma unmmaping (Jonathan)
 - Use if/else rather than goto (Jonathan)
 - Use single return point (Jonathan)

Signed-off-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Jonathan Cavitt &lt;jonathan.cavitt@intel.com&gt;
Link: https://lore.kernel.org/r/20250423171725.597955-3-matthew.brost@intel.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Add migrate layer functions to access VRAM and update
xe_ttm_access_memory to use for non-visible access and large (more than
16k) BO access. 8G devcoreump on BMG observed 3 minute CPU copy time vs.
3s GPU copy time.

v4:
 - Fix non-page aligned accesses
 - Add support for small / unaligned access
 - Update commit message indicating migrate used for large accesses (Auld)
 - Fix warning in xe_res_cursor for non-zero offset
v5:
 - Fix 32 bit build (CI)
v6:
 - Rebase and use SVM migration copy functions
v7:
 - Fix build error (CI)
v8:
 - Remove ifdef around VRAM copy functions (CI)
 - Use break statement in dma unmmaping (Jonathan)
 - Use if/else rather than goto (Jonathan)
 - Use single return point (Jonathan)

Signed-off-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Jonathan Cavitt &lt;jonathan.cavitt@intel.com&gt;
Link: https://lore.kernel.org/r/20250423171725.597955-3-matthew.brost@intel.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe: unconditionally apply PINNED for pin_map()</title>
<updated>2025-04-04T10:41:08+00:00</updated>
<author>
<name>Matthew Auld</name>
<email>matthew.auld@intel.com</email>
</author>
<published>2025-04-03T10:24:46+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=8e8e9c26631c4305cc0e3a18c625cb8e5cf110bf'/>
<id>8e8e9c26631c4305cc0e3a18c625cb8e5cf110bf</id>
<content type='text'>
Some users apply PINNED and some don't when using pin_map(). The pin in
pin_map() should imply PINNED so just unconditionally apply it and clean
up all users.

Signed-off-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Cc: Satyanarayana K V P &lt;satyanarayana.k.v.p@intel.com&gt;
Cc: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Satyanarayana K V P &lt;satyanarayana.k.v.p@intel.com&gt;
Link: https://lore.kernel.org/r/20250403102440.266113-14-matthew.auld@intel.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Some users apply PINNED and some don't when using pin_map(). The pin in
pin_map() should imply PINNED so just unconditionally apply it and clean
up all users.

Signed-off-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Cc: Satyanarayana K V P &lt;satyanarayana.k.v.p@intel.com&gt;
Cc: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Satyanarayana K V P &lt;satyanarayana.k.v.p@intel.com&gt;
Link: https://lore.kernel.org/r/20250403102440.266113-14-matthew.auld@intel.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe/migrate: ignore CCS for kernel objects</title>
<updated>2025-04-04T10:41:04+00:00</updated>
<author>
<name>Matthew Auld</name>
<email>matthew.auld@intel.com</email>
</author>
<published>2025-04-03T10:24:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=58fa61ce4a0d13614a98479734b7f1ac2027615a'/>
<id>58fa61ce4a0d13614a98479734b7f1ac2027615a</id>
<content type='text'>
For kernel BOs we don't clear the CCS state on creation, therefore we
should be careful to ignore it when copying pages. In a future patch we
opt for using the copy path here for kernel BOs, so this now needs to be
considered.

v2:
 - Drop bogus asserts (CI)

Signed-off-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Cc: Satyanarayana K V P &lt;satyanarayana.k.v.p@intel.com&gt;
Cc: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Satyanarayana K V P &lt;satyanarayana.k.v.p@intel.com&gt;
Link: https://lore.kernel.org/r/20250403102440.266113-12-matthew.auld@intel.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
For kernel BOs we don't clear the CCS state on creation, therefore we
should be careful to ignore it when copying pages. In a future patch we
opt for using the copy path here for kernel BOs, so this now needs to be
considered.

v2:
 - Drop bogus asserts (CI)

Signed-off-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Cc: Satyanarayana K V P &lt;satyanarayana.k.v.p@intel.com&gt;
Cc: Thomas Hellström &lt;thomas.hellstrom@linux.intel.com&gt;
Cc: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Satyanarayana K V P &lt;satyanarayana.k.v.p@intel.com&gt;
Link: https://lore.kernel.org/r/20250403102440.266113-12-matthew.auld@intel.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe: avoid plain 64-bit division</title>
<updated>2025-03-28T18:28:24+00:00</updated>
<author>
<name>Arnd Bergmann</name>
<email>arnd@arndb.de</email>
</author>
<published>2025-03-24T21:06:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c9092257506af4985c085103714c403812a5bdcb'/>
<id>c9092257506af4985c085103714c403812a5bdcb</id>
<content type='text'>
Building the xe driver for i386 results in a link time warning:

x86_64-linux-ld: drivers/gpu/drm/xe/xe_migrate.o: in function `xe_migrate_vram':
xe_migrate.c:(.text+0x1e15): undefined reference to `__udivdi3'

Avoid this by using DIV_U64_ROUND_UP() instead of DIV_ROUND_UP().  The driver
is unlikely to be used on 32=bit hardware, so the extra cost here is not
too important.

Fixes: 9c44fd5f6e8a ("drm/xe: Add migrate layer functions for SVM support")
Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Link: https://lore.kernel.org/r/20250324210612.2927194-1-arnd@kernel.org
Reviewed-by: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
Signed-off-by: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Building the xe driver for i386 results in a link time warning:

x86_64-linux-ld: drivers/gpu/drm/xe/xe_migrate.o: in function `xe_migrate_vram':
xe_migrate.c:(.text+0x1e15): undefined reference to `__udivdi3'

Avoid this by using DIV_U64_ROUND_UP() instead of DIV_ROUND_UP().  The driver
is unlikely to be used on 32=bit hardware, so the extra cost here is not
too important.

Fixes: 9c44fd5f6e8a ("drm/xe: Add migrate layer functions for SVM support")
Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
Link: https://lore.kernel.org/r/20250324210612.2927194-1-arnd@kernel.org
Reviewed-by: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
Signed-off-by: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe: Use local fence in error path of xe_migrate_clear</title>
<updated>2025-03-27T22:30:57+00:00</updated>
<author>
<name>Matthew Brost</name>
<email>matthew.brost@intel.com</email>
</author>
<published>2025-03-11T18:29:15+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=762b7e95362170b3e13a8704f38d5e47eca4ba74'/>
<id>762b7e95362170b3e13a8704f38d5e47eca4ba74</id>
<content type='text'>
The intent of the error path in xe_migrate_clear is to wait on locally
generated fence and then return. The code is waiting on m-&gt;fence which
could be the local fence but this is only stable under the job mutex
leading to a possible UAF. Fix code to wait on local fence.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Link: https://lore.kernel.org/r/20250311182915.3606291-1-matthew.brost@intel.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The intent of the error path in xe_migrate_clear is to wait on locally
generated fence and then return. The code is waiting on m-&gt;fence which
could be the local fence but this is only stable under the job mutex
leading to a possible UAF. Fix code to wait on local fence.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Signed-off-by: Matthew Brost &lt;matthew.brost@intel.com&gt;
Reviewed-by: Matthew Auld &lt;matthew.auld@intel.com&gt;
Link: https://lore.kernel.org/r/20250311182915.3606291-1-matthew.brost@intel.com
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/xe/migrate: Switch from drm to dev managed actions</title>
<updated>2025-03-27T12:36:09+00:00</updated>
<author>
<name>Aradhya Bhatia</name>
<email>aradhya.bhatia@intel.com</email>
</author>
<published>2025-03-26T15:19:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=c045e03634ab677ef9351e9b350da78b5c9d7961'/>
<id>c045e03634ab677ef9351e9b350da78b5c9d7961</id>
<content type='text'>
Change the scope of the migrate subsystem to be dev managed instead of
drm managed.

The parent pci struct &amp;device, that the xe struct &amp;drm_device is a part
of, gets removed when a hot unplug is triggered, which causes the
underlying iommu group to get destroyed as well.

The migrate subsystem, which handles the lifetime of the page-table tree
(pt) BO, doesn't get a chance to keep the BO back during the hot unplug,
as all the references to DRM haven't been put back.
When all the references to DRM are indeed put back later, the migrate
subsystem tries to put back the pt BO. Since the underlying iommu group
has been already destroyed, a kernel NULL ptr dereference takes place
while attempting to keep back the pt BO.

Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/3914
Suggested-by: Thomas Hellstrom &lt;thomas.hellstrom@intel.com&gt;
Reviewed-by: Tejas Upadhyay &lt;tejas.upadhyay@intel.com&gt;
Signed-off-by: Aradhya Bhatia &lt;aradhya.bhatia@intel.com&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20250326151929.1495972-1-aradhya.bhatia@intel.com
Signed-off-by: Tejas Upadhyay &lt;tejas.upadhyay@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Change the scope of the migrate subsystem to be dev managed instead of
drm managed.

The parent pci struct &amp;device, that the xe struct &amp;drm_device is a part
of, gets removed when a hot unplug is triggered, which causes the
underlying iommu group to get destroyed as well.

The migrate subsystem, which handles the lifetime of the page-table tree
(pt) BO, doesn't get a chance to keep the BO back during the hot unplug,
as all the references to DRM haven't been put back.
When all the references to DRM are indeed put back later, the migrate
subsystem tries to put back the pt BO. Since the underlying iommu group
has been already destroyed, a kernel NULL ptr dereference takes place
while attempting to keep back the pt BO.

Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/3914
Suggested-by: Thomas Hellstrom &lt;thomas.hellstrom@intel.com&gt;
Reviewed-by: Tejas Upadhyay &lt;tejas.upadhyay@intel.com&gt;
Signed-off-by: Aradhya Bhatia &lt;aradhya.bhatia@intel.com&gt;
Link: https://patchwork.freedesktop.org/patch/msgid/20250326151929.1495972-1-aradhya.bhatia@intel.com
Signed-off-by: Tejas Upadhyay &lt;tejas.upadhyay@intel.com&gt;
</pre>
</div>
</content>
</entry>
</feed>
