Re: [RFC v2 3/9] drm/xe/bo: Prevent purging of shared buffer objects

[Matthew Brost <matthew.brost@intel.com>]

On Tue, Dec 02, 2025 at 10:42:07AM +0100, Thomas Hellström wrote:
> On Tue, 2025-12-02 at 09:12 +0530, Yadav, Arvind wrote:
> > 
> > On 02-12-2025 04:40, Matthew Brost wrote:
> > > On Mon, Dec 01, 2025 at 11:20:13AM +0530, Arvind Yadav wrote:
> > > > Introduce the `xe_bo_is_shared_locked()` inline helper to
> > > > determine if a
> > > > buffer object is shared across multiple clients or drivers. A
> > > > buffer is
> > > > considered shared if it is exported via dma-buf, imported, or has
> > > > a
> > > > handle count greater than one.
> > > > 
> > > > This check is critical for safely implementing purgeable memory.
> > > > Purging
> > > > a buffer that is shared would lead to data corruption for other
> > > > clients
> > > > that still hold a reference to it.
> > > > 
> > > > The kernel cannot safely determine when all clients are done with
> > > > a
> > > > shared buffer, so shared BOs must never be marked DONTNEED or
> > > > purged.
> > > > 
> > > > The new helper is used in two key locations:
> > > > 1.  In `xe_vm_madvise_purgeable_bo()`, to prevent userspace from
> > > >      successfully marking a shared buffer as `DONTNEED`. This is
> > > > the
> > > >      primary safeguard against incorrect usage.
> > > > 
> > > > 2.  In `xe_bo_move()`, as a final safety check before the kernel
> > > >      initiates a purge during eviction. This ensures that even if
> > > > a
> > > >      shared buffer were somehow marked `DONTNEED`, it would not
> > > > be
> > > >      purged.
> > > > 
> > > > Cc: Matthew Brost <matthew.brost@intel.com>
> > > > Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> > > > Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
> > > > Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
> > > > ---
> > > >   drivers/gpu/drm/xe/xe_bo.h | 30 ++++++++++++++++++++++++++++++
> > > >   1 file changed, 30 insertions(+)
> > > > 
> > > > diff --git a/drivers/gpu/drm/xe/xe_bo.h
> > > > b/drivers/gpu/drm/xe/xe_bo.h
> > > > index b0a31c77e612..97edb38bf1ed 100644
> > > > --- a/drivers/gpu/drm/xe/xe_bo.h
> > > > +++ b/drivers/gpu/drm/xe/xe_bo.h
> > > > @@ -478,4 +478,34 @@ static inline bool xe_bo_is_mem_type(struct
> > > > xe_bo *bo, u32 mem_type)
> > > >   	xe_bo_assert_held(bo);
> > > >   	return bo->ttm.resource->mem_type == mem_type;
> > > >   }
> > > > +
> > > > +/**
> > > > + * xe_bo_is_shared_locked - Check if a buffer object is shared
> > > > + * @bo: The buffer object to check
> > > > + *
> > > > + * Determines if a buffer object is considered shared, which
> > > > includes:
> > > > + * - Exported via dma-buf (obj->dma_buf is set)
> > > > + * - Imported from another driver (obj->import_attach is set)
> > > > + * - Referenced by multiple clients (handle_count > 1)
> > > > + *
> > > > + * This check is used to prevent data loss on shared content by
> > > > avoiding
> > > > + * certain operations like purging on buffers that other
> > > > processes or
> > > > + * drivers might still be using.
> > > > + *
> > > > + * Return: true if the buffer object is shared, false otherwise.
> > > > + */
> > > > +static inline bool xe_bo_is_shared_locked(const struct xe_bo
> > > > *bo)
> > > > +{
> > > > +	const struct drm_gem_object *obj = &bo->ttm.base;
> > > > +
> > > It seems like everything below here should be a new drm gem helper.
> > There is a DRM helper 'drm_gem_object_is_shared_for_memory_stats()',
> > but 
> > it's
> > specifically scoped for fdinfo memory accounting and doesn't check 
> > import_attach.
> > > > +	dma_resv_assert_held(obj->resv);
> > > > +
> > > > +	if (obj->dma_buf || obj->import_attach)
> > > > +		return true;
> > > > +
> > > > +	if (obj->handle_count > 1)
> > > So this covers the case when we prime fd to handle but we resolve
> > > to a
> > > BO (i.e., we don't do a dma-buf attach, rather just take reference
> > > on BO
> > > as the BO is from the same device)? I just want to make sure I'm
> > > understanding this part correctly. If so, maybe throw a comment in
> > > here
> > > or update the functions kernel doc a bit with a better
> > > explaination.
> > Yes, that's correct! The handle_count > 1 check covers exactly that 
> > scenario:
> > When we do prime fd-to-handle but both processes are using the same
> > xe 
> > device,
> > we don't do a dma-buf attach. Instead, we just increment the
> > reference 
> > count
> > and handle_count on the same xe_bo.
> > I will add and update the function with comments.
> 
> Arvind, Matt
> 
> I think the correct way to check purgability support for shared buffers
> is to loop over all vmas attached to the bo and check that they all say
> WONTNEED? If they don't, the bo is not purgeable. This will also need a
> check at VMA unbinding.
> 

I think this makes sense. I haven't fully gotten through this series
yet, but will consider this during the code reviews. I probably should
apply this series in full before providing feedback.

Matt 

> /Thomas
> 
> 
> 
> 
> 
> 
> > 
> > ~Arvind
> > > Matt
> > > 
> > > > +		return true;
> > > > +
> > > > +	return false;
> > > > +}
> > > >   #endif
> > > > -- 
> > > > 2.43.0
> > > > 
>