Re: [RFC v2 3/9] drm/xe/bo: Prevent purging of shared buffer objects

[Matthew Brost <matthew.brost@intel.com>]

On Mon, Dec 01, 2025 at 11:20:13AM +0530, Arvind Yadav wrote:
> Introduce the `xe_bo_is_shared_locked()` inline helper to determine if a
> buffer object is shared across multiple clients or drivers. A buffer is
> considered shared if it is exported via dma-buf, imported, or has a
> handle count greater than one.
> 
> This check is critical for safely implementing purgeable memory. Purging
> a buffer that is shared would lead to data corruption for other clients
> that still hold a reference to it.
> 
> The kernel cannot safely determine when all clients are done with a
> shared buffer, so shared BOs must never be marked DONTNEED or purged.
> 
> The new helper is used in two key locations:
> 1.  In `xe_vm_madvise_purgeable_bo()`, to prevent userspace from
>     successfully marking a shared buffer as `DONTNEED`. This is the
>     primary safeguard against incorrect usage.
> 
> 2.  In `xe_bo_move()`, as a final safety check before the kernel
>     initiates a purge during eviction. This ensures that even if a
>     shared buffer were somehow marked `DONTNEED`, it would not be
>     purged.
> 
> Cc: Matthew Brost <matthew.brost@intel.com>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
> Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_bo.h | 30 ++++++++++++++++++++++++++++++
>  1 file changed, 30 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_bo.h b/drivers/gpu/drm/xe/xe_bo.h
> index b0a31c77e612..97edb38bf1ed 100644
> --- a/drivers/gpu/drm/xe/xe_bo.h
> +++ b/drivers/gpu/drm/xe/xe_bo.h
> @@ -478,4 +478,34 @@ static inline bool xe_bo_is_mem_type(struct xe_bo *bo, u32 mem_type)
>  	xe_bo_assert_held(bo);
>  	return bo->ttm.resource->mem_type == mem_type;
>  }
> +
> +/**
> + * xe_bo_is_shared_locked - Check if a buffer object is shared
> + * @bo: The buffer object to check
> + *
> + * Determines if a buffer object is considered shared, which includes:
> + * - Exported via dma-buf (obj->dma_buf is set)
> + * - Imported from another driver (obj->import_attach is set)
> + * - Referenced by multiple clients (handle_count > 1)
> + *
> + * This check is used to prevent data loss on shared content by avoiding
> + * certain operations like purging on buffers that other processes or
> + * drivers might still be using.
> + *
> + * Return: true if the buffer object is shared, false otherwise.
> + */
> +static inline bool xe_bo_is_shared_locked(const struct xe_bo *bo)
> +{
> +	const struct drm_gem_object *obj = &bo->ttm.base;
> +

It seems like everything below here should be a new drm gem helper.

> +	dma_resv_assert_held(obj->resv);
> +
> +	if (obj->dma_buf || obj->import_attach)
> +		return true;
> +
> +	if (obj->handle_count > 1)

So this covers the case when we prime fd to handle but we resolve to a
BO (i.e., we don't do a dma-buf attach, rather just take reference on BO
as the BO is from the same device)? I just want to make sure I'm
understanding this part correctly. If so, maybe throw a comment in here
or update the functions kernel doc a bit with a better explaination.

Matt 

> +		return true;
> +
> +	return false;
> +}
>  #endif
> -- 
> 2.43.0
>