Re: [PATCH 1/2] drm/xe: only evict CCS buffers from TT on iGPU

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] drm/xe: missing ttm_bo_unmap_virtual() before xe_ttm_bo_purge()
  in eviction
--

commit 0a382553920cfe97389f0ff2b7a78f7419640c3e
Author: Matthew Auld <matthew.auld@intel.com>

drm/xe: only evict CCS buffers from TT on iGPU

This commit changes xe_bo_evict_all_user() on iGPU platforms with Flat CCS
to walk the XE_PL_TT LRU and only evict or purge buffers with initialized
CCS state rather than evicting all buffers in TT.

> diff --git a/drivers/gpu/drm/xe/xe_bo_evict.c b/drivers/gpu/drm/xe/xe_bo_evict.c
> index 7661fca7f278f..1f95769c4a562 100644
> --- a/drivers/gpu/drm/xe/xe_bo_evict.c
> +++ b/drivers/gpu/drm/xe/xe_bo_evict.c
[ ... ]
> @@ -104,8 +106,46 @@ void xe_bo_notifier_unprepare_all_pinned(struct xe_device *xe)
>  				    xe_bo_notifier_unprepare_pinned);
>  }
>  
> +static int xe_bo_evict_all_ccs(struct ttm_resource_manager *man)
> +{
> +	struct ttm_operation_ctx ctx = {
> +		.interruptible = false,
> +		.no_wait_gpu = false,
> +	};
> +	struct ttm_lru_walk_arg arg = {
> +		.ctx = &ctx,
> +		.sleeping_lock = true,
> +	};
> +	struct ttm_bo_lru_cursor cursor;
> +	struct ttm_buffer_object *ttm_bo;
> +	int ret = 0;
> +
> +	ttm_bo_lru_for_each_reserved_guarded(&cursor, man, &arg, ttm_bo) {
> +		struct xe_bo *bo;
> +
> +		if (!xe_bo_is_xe_bo(ttm_bo) || ttm_bo->deleted)
> +			continue;
> +
> +		bo = ttm_to_xe_bo(ttm_bo);
> +		if (xe_bo_is_pinned(bo) || !xe_bo_needs_ccs_pages(bo) ||
> +		    !bo->ccs_cleared)
> +			continue;
> +
> +		if (xe_bo_madv_is_dontneed(bo))
> +			ret = xe_ttm_bo_purge(ttm_bo, &ctx);

[Severity: High]
Does calling xe_ttm_bo_purge() directly without ttm_bo_unmap_virtual()
leave userspace CPU mmap PTEs pointing to freed backing pages?

When a CPU-faulted BO is marked DONTNEED via xe_vm_madvise_ioctl(),
PTE invalidation is deferred until the BO is moved or purged.  Previously,
ttm_resource_manager_evict_all() went through ttm_bo_handle_move_mem(),
which calls ttm_bo_unmap_virtual() before invoking xe_bo_move() ->
xe_ttm_bo_purge().

Calling xe_ttm_bo_purge() directly here runs xe_bo_move_notify() (which
only unmaps kernel vmaps) and then calls ttm_bo_validate() with an empty
placement, which goes straight to ttm_bo_pipeline_gutting() and frees the
pages back to the TTM page pool without unmapping userspace CPU PTEs.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106-s4-opti-v1-0-5edaea2c6d31@intel.com?part=1