Re: [RFC v2 7/9] drm/xe/vm: Prevent binding of purged buffer objects

["Yadav, Arvind" <arvind.yadav@intel.com>]

On 03-12-2025 00:27, Matthew Brost wrote:
> On Mon, Dec 01, 2025 at 11:20:17AM +0530, Arvind Yadav wrote:
>> Add validation in xe_vm_bind_ioctl_validate_bo() to reject MAP and
>> PREFETCH operations on purged buffer objects with -EINVAL.
>>
>> Problem:
>> When a BO is purged (XE_MADV_PURGEABLE_PURGED state), its backing pages
>> have been freed by the kernel. Without this check, VM_BIND operations
>> would proceed:
>>
>>   1. DRM_XE_VM_BIND_OP_MAP: Attempts to create GPU mappings to freed memory
>>      - xe_vma_ops_alloc() creates VMA pointing to invalid BO
>>      - Page tables populated with stale/invalid addresses
>>      - GPU access leads to undefined behavior or hangs
>>
>>   2. DRM_XE_VM_BIND_OP_PREFETCH: Attempts to migrate non-existent pages
>>      - Triggers BO validation in TTM
>>      - ttm_bo_validate() fails or crashes (no backing store)
>>      - Wasted work for permanently invalid BO
>>
>> With this check:
>>    - MAP/PREFETCH immediately fail with -EINVAL at ioctl boundary
>>    - Clear error message at syscall (better UX than deferred GPU hang)
>>    - Prevents creation of invalid GPU page table entries
>>
>> v2:
>>    - Clarify that purged BOs are permanently invalid (i915 semantics)
>>    - Remove incorrect claim about madvise(WILLNEED) restoring purged BOs
>>
>> Cc: Matthew Brost <matthew.brost@intel.com>
>> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
>> Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
>> ---
>>   drivers/gpu/drm/xe/xe_vm.c | 7 +++++++
>>   1 file changed, 7 insertions(+)
>>
>> diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
>> index d03e69524369..cc946bff9607 100644
>> --- a/drivers/gpu/drm/xe/xe_vm.c
>> +++ b/drivers/gpu/drm/xe/xe_vm.c
>> @@ -3482,6 +3482,13 @@ static int xe_vm_bind_ioctl_validate_bo(struct xe_device *xe, struct xe_bo *bo,
>>   		return -EINVAL;
>>   	}
>>   
>> +	/* Purged BOs are permanently invalid; reject new MAP/PREFETCH. */
>> +	if (XE_IOCTL_DBG(xe,
>> +			 xe_bo_is_purged(bo) &&
>> +			 (op == DRM_XE_VM_BIND_OP_MAP ||
>> +			  op == DRM_XE_VM_BIND_OP_PREFETCH)))
>> +		return -EINVAL;
> I'd move this check to later in the bind pipeline once we have BO's
> dma-resv lock to make this race free. I think vma_lock_and_validate is
> likely the correct function after drm_exec_lock_obj but before
> xe_bo_validate. Or you could just make xe_bo_validate fail if the object
> is purged.


Noted. I will move this check under vm_lock_and_validate.
Moving the purge check to xe_bo_validate() would break GPU page fault 
recovery for
purged BO-backed VMAs (preventing scratch PTE rebinds).


~Arvind


>
> Matt
>
>> +
>>   	/*
>>   	 * Some platforms require 64k VM_BIND alignment,
>>   	 * specifically those with XE_VRAM_FLAGS_NEED64K.
>> -- 
>> 2.43.0
>>