Re: [PATCH 2/4] drm/xe: Re-validate external pin under resv lock before VRAM purge

["Ghimiray, Himal Prasad" <himal.prasad.ghimiray@intel.com>]

On 01-10-2026 15:15, Tejas Upadhyay wrote:
> xe_ttm_vram_reserve_page_at_addr() checks xe_bo_is_user() &&
> xe_bo_is_pinned() while holding only mgr->lock, not the BO's
> reservation lock, since it must run before the owning BO is
> even known to be purgeable. A user BO can become pinned
> after that check passes but before xe_ttm_vram_purge_page()
> runs.
> 
> xe_ttm_vram_purge_page() takes the reservation lock but only
> rechecks xe_bo_is_pinned(), not xe_bo_is_user(). If the race
> is hit, it calls xe_bo_unpin() (the kernel-BO unpin path,
> not xe_bo_unpin_external())on an externally pinned BO and
> then purges its backing store while userspace/hardware still
> expects it to be resident.
> 
> Recheck xe_bo_is_user() && xe_bo_is_pinned() under the
> reservation lock and reject the purge, requesting SBR with
> -EIO the same way the caller's own critical-BO check
> already does.
> 
> Fixes: 7737f819e9f1 ("drm/xe/vram: Add VRAM page offline fault handler")
> Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com>
> ---
>   drivers/gpu/drm/xe/xe_ttm_vram_mgr.c | 20 ++++++++++++++++++++
>   1 file changed, 20 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c b/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c
> index 4c5837cdb996..ed79e4c6ba1a 100644
> --- a/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c
> +++ b/drivers/gpu/drm/xe/xe_ttm_vram_mgr.c
> @@ -687,6 +687,19 @@ static int xe_ttm_vram_purge_page(struct xe_device *xe, struct xe_bo *bo)
>   		goto out;
>   	}
>   
> +	/*
> +	 * The caller's user+pinned check was lockless (mgr->lock only), so an
> +	 * external pin can race in before we get here. Re-validate now that
> +	 * we hold the reservation lock and reject the purge instead of
> +	 * unpinning a BO userspace still expects to be resident. Request SBR
> +	 * the same way the caller's own critical-BO check does.
> +	 */
> +	if (xe_bo_is_user(bo) && xe_bo_is_pinned(bo)) {
> +		xe_bo_unlock(bo);
> +		ret = -EIO;
> +		goto out;
> +	}
> +
>   	xe_bo_set_purgeable_


Patch looks correct.
Reviewed-by: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>


state(bo, XE_MADV_PURGEABLE_DONTNEED);
>   	ttm_bo_unmap_virtual(&bo->ttm);   /* nuke CPU mmap + VRAM IO mappings */
>   	if (xe_bo_is_pinned(bo))
> @@ -851,6 +864,13 @@ static int xe_ttm_vram_reserve_page_at_addr(struct xe_device *xe, u64 addr,
>   		 */
>   		ret = xe_ttm_vram_purge_page(xe, pbo);
>   		xe_bo_put(pbo);
> +		if (ret == -EIO) {
> +			/* Raced into an external pin after the lockless check above */
> +			drm_err(&xe->drm,
> +				"%s: addr: 0x%llx became externally pinned, requesting SBR\n",
> +				__func__, addr);
> +			return ret;
> +		}
>   		if (ret)
>   			drm_warn(&xe->drm, "Purge failed at addr:0x%llx, ret:%d\n", addr, ret);
>   	}