[PATCH 0/3] Some fixes for purged BOs

[PATCH 0/3] Some fixes for purged BOs

[Matthew Auld]

Same as https://lore.kernel.org/intel-xe/20260624113837.342961-4-matthew.auld@intel.com/, but
pulling in one extra related fix.

-- 
2.54.0

[PATCH 1/3] drm/xe: fix NPD in bo_meminfo()

[Matthew Auld]

When a buffer object is purged, its ttm.resource is set to NULL via the
TTM pipeline gutting flow. However, the BO remains in the client's
object list until userspace explicitly closes the GEM handle. If memory
stats are queried during this time, accessing bo->ttm.resource->mem_type
will result in a NULL pointer dereference.

Fix this by safely skipping purged BOs in bo_meminfo, as they no longer
consume any memory.

User is getting NPD on device resume, and possible theory is that in
bo_move(), if we need to evict something to SYSTEM to save the CCS state,
but the BO is marked as dontneed, this won't trigger a move but will
nuke the pages, leaving us with a NULL bo resource. And the meminfo()
doesn't look ready to handle a NULL resource.

v2 (Sashiko):
 - There could potentially be other cases where we might end up with a
   NULL resource, so make this a general NULL check for now.

Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8419
Fixes: ad9843aac91a ("drm/xe/madvise: Implement purgeable buffer object support")
Assisted-by: Copilot:gemini-3.1-pro-preview
Reported-by: Matthew Schwartz <matthew.schwartz@linux.dev>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Arvind Yadav <arvind.yadav@intel.com>
---
 drivers/gpu/drm/xe/xe_drm_client.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_drm_client.c b/drivers/gpu/drm/xe/xe_drm_client.c
index 84b66147bf49..81020b4b344e 100644
--- a/drivers/gpu/drm/xe/xe_drm_client.c
+++ b/drivers/gpu/drm/xe/xe_drm_client.c
@@ -168,10 +168,20 @@ static void bo_meminfo(struct xe_bo *bo,
 		       struct drm_memory_stats stats[TTM_NUM_MEM_TYPES])
 {
 	u64 sz = xe_bo_size(bo);
-	u32 mem_type = bo->ttm.resource->mem_type;
+	u32 mem_type;
 
 	xe_bo_assert_held(bo);
 
+	/*
+	 * The resource can be NULL if the BO has been purged, plus maybe some
+	 * other cases. Either way there shouldn't be any memory to account for,
+	 * or a current resource to account this against, so skip for now.
+	 */
+	if (!bo->ttm.resource)
+		return;
+
+	mem_type = bo->ttm.resource->mem_type;
+
 	if (drm_gem_object_is_shared_for_memory_stats(&bo->ttm.base))
 		stats[mem_type].shared += sz;
 	else
-- 
2.54.0

Re: [PATCH 1/3] drm/xe: fix NPD in bo_meminfo()

[Matthew Brost]

On Thu, Jun 25, 2026 at 04:20:56PM +0100, Matthew Auld wrote:
> When a buffer object is purged, its ttm.resource is set to NULL via the
> TTM pipeline gutting flow. However, the BO remains in the client's
> object list until userspace explicitly closes the GEM handle. If memory
> stats are queried during this time, accessing bo->ttm.resource->mem_type
> will result in a NULL pointer dereference.
> 
> Fix this by safely skipping purged BOs in bo_meminfo, as they no longer
> consume any memory.
> 
> User is getting NPD on device resume, and possible theory is that in
> bo_move(), if we need to evict something to SYSTEM to save the CCS state,
> but the BO is marked as dontneed, this won't trigger a move but will
> nuke the pages, leaving us with a NULL bo resource. And the meminfo()
> doesn't look ready to handle a NULL resource.
> 
> v2 (Sashiko):
>  - There could potentially be other cases where we might end up with a
>    NULL resource, so make this a general NULL check for now.
> 
> Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8419
> Fixes: ad9843aac91a ("drm/xe/madvise: Implement purgeable buffer object support")
> Assisted-by: Copilot:gemini-3.1-pro-preview
> Reported-by: Matthew Schwartz <matthew.schwartz@linux.dev>
> Signed-off-by: Matthew Auld <matthew.auld@intel.com>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Matthew Brost <matthew.brost@intel.com>

Reviewed-by: Matthew Brost <matthew.brost@intel.com>

> Cc: Arvind Yadav <arvind.yadav@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_drm_client.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_drm_client.c b/drivers/gpu/drm/xe/xe_drm_client.c
> index 84b66147bf49..81020b4b344e 100644
> --- a/drivers/gpu/drm/xe/xe_drm_client.c
> +++ b/drivers/gpu/drm/xe/xe_drm_client.c
> @@ -168,10 +168,20 @@ static void bo_meminfo(struct xe_bo *bo,
>  		       struct drm_memory_stats stats[TTM_NUM_MEM_TYPES])
>  {
>  	u64 sz = xe_bo_size(bo);
> -	u32 mem_type = bo->ttm.resource->mem_type;
> +	u32 mem_type;
>  
>  	xe_bo_assert_held(bo);
>  
> +	/*
> +	 * The resource can be NULL if the BO has been purged, plus maybe some
> +	 * other cases. Either way there shouldn't be any memory to account for,
> +	 * or a current resource to account this against, so skip for now.
> +	 */
> +	if (!bo->ttm.resource)
> +		return;
> +
> +	mem_type = bo->ttm.resource->mem_type;
> +
>  	if (drm_gem_object_is_shared_for_memory_stats(&bo->ttm.base))
>  		stats[mem_type].shared += sz;
>  	else
> -- 
> 2.54.0
> 

[PATCH 2/3] drm/xe: account for dontneed in fdinfo purgeable

[Matthew Auld]

Now that Xe supports explicit madvise WILLNEED/DONTNEED states,
userspace can mark memory in any placement as eligible for purging.
Update bo_meminfo to also include any BO explicitly marked as DONTNEED
in the purgeable statistics, ensuring fdinfo accurately reflects all
memory offered up for reclamation.

v2 (Sashiko):
  - Also update the drm_print_memory_stats() so we don't mask out !=
    SYSTEM

Assisted-by: Copilot:gemini-3.1-pro-preview
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Arvind Yadav <arvind.yadav@intel.com>
---
 drivers/gpu/drm/xe/xe_drm_client.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_drm_client.c b/drivers/gpu/drm/xe/xe_drm_client.c
index 81020b4b344e..e116fb562c4c 100644
--- a/drivers/gpu/drm/xe/xe_drm_client.c
+++ b/drivers/gpu/drm/xe/xe_drm_client.c
@@ -193,7 +193,7 @@ static void bo_meminfo(struct xe_bo *bo,
 		if (!dma_resv_test_signaled(bo->ttm.base.resv,
 					    DMA_RESV_USAGE_BOOKKEEP))
 			stats[mem_type].active += sz;
-		else if (mem_type == XE_PL_SYSTEM)
+		else if (mem_type == XE_PL_SYSTEM || xe_bo_madv_is_dontneed(bo))
 			stats[mem_type].purgeable += sz;
 	}
 }
@@ -273,8 +273,7 @@ static void show_meminfo(struct drm_printer *p, struct drm_file *file)
 					       &stats[mem_type],
 					       DRM_GEM_OBJECT_ACTIVE |
 					       DRM_GEM_OBJECT_RESIDENT |
-					       (mem_type != XE_PL_SYSTEM ? 0 :
-					       DRM_GEM_OBJECT_PURGEABLE),
+					       DRM_GEM_OBJECT_PURGEABLE,
 					       xe_mem_type_to_name[mem_type]);
 		}
 	}
-- 
2.54.0

Re: [PATCH 2/3] drm/xe: account for dontneed in fdinfo purgeable

[Matthew Brost]

On Thu, Jun 25, 2026 at 04:20:57PM +0100, Matthew Auld wrote:
> Now that Xe supports explicit madvise WILLNEED/DONTNEED states,
> userspace can mark memory in any placement as eligible for purging.
> Update bo_meminfo to also include any BO explicitly marked as DONTNEED
> in the purgeable statistics, ensuring fdinfo accurately reflects all
> memory offered up for reclamation.
> 
> v2 (Sashiko):
>   - Also update the drm_print_memory_stats() so we don't mask out !=
>     SYSTEM
> 
> Assisted-by: Copilot:gemini-3.1-pro-preview
> Signed-off-by: Matthew Auld <matthew.auld@intel.com>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Matthew Brost <matthew.brost@intel.com>

Reviewed-by: Matthew Brost <matthew.brost@intel.com>

> Cc: Arvind Yadav <arvind.yadav@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_drm_client.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_drm_client.c b/drivers/gpu/drm/xe/xe_drm_client.c
> index 81020b4b344e..e116fb562c4c 100644
> --- a/drivers/gpu/drm/xe/xe_drm_client.c
> +++ b/drivers/gpu/drm/xe/xe_drm_client.c
> @@ -193,7 +193,7 @@ static void bo_meminfo(struct xe_bo *bo,
>  		if (!dma_resv_test_signaled(bo->ttm.base.resv,
>  					    DMA_RESV_USAGE_BOOKKEEP))
>  			stats[mem_type].active += sz;
> -		else if (mem_type == XE_PL_SYSTEM)
> +		else if (mem_type == XE_PL_SYSTEM || xe_bo_madv_is_dontneed(bo))
>  			stats[mem_type].purgeable += sz;
>  	}
>  }
> @@ -273,8 +273,7 @@ static void show_meminfo(struct drm_printer *p, struct drm_file *file)
>  					       &stats[mem_type],
>  					       DRM_GEM_OBJECT_ACTIVE |
>  					       DRM_GEM_OBJECT_RESIDENT |
> -					       (mem_type != XE_PL_SYSTEM ? 0 :
> -					       DRM_GEM_OBJECT_PURGEABLE),
> +					       DRM_GEM_OBJECT_PURGEABLE,
>  					       xe_mem_type_to_name[mem_type]);
>  		}
>  	}
> -- 
> 2.54.0
> 

[PATCH 3/3] drm/xe/pt: prevent invalid cursor access for purged BOs

[Matthew Auld]

During a page table walk for binding, xe_pt_stage_bind() explicitly
skips initializing the xe_res_cursor for purged BOs, treating them
similarly to NULL VMAs by only setting the cursor size.

However, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check
if the BO was purged before attempting to walk the cursor using
xe_res_dma() and xe_res_next(). Because the cursor was left
uninitialized for purged BOs, this falls through and triggers
warnings like:

  WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next

Fix this by explicitly checking if the BO is purged in both
xe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just
as we do for NULL VMAs, avoiding the invalid cursor accesses entirely.

As a precaution, also zero-initialize the cursor in xe_pt_stage_bind()
to ensure we don't pass garbage data into the page table walkers
if we ever hit a similar edge case in the future.

Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8418
Fixes: ad9843aac91a ("drm/xe/madvise: Implement purgeable buffer object support")
Assisted-by: Copilot:gemini-3.1-pro-preview
Reported-by: Matthew Schwartz <matthew.schwartz@linux.dev>
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Arvind Yadav <arvind.yadav@intel.com>
---
 drivers/gpu/drm/xe/xe_pt.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_pt.c b/drivers/gpu/drm/xe/xe_pt.c
index 0959e0e88a14..b1f6a96dab2e 100644
--- a/drivers/gpu/drm/xe/xe_pt.c
+++ b/drivers/gpu/drm/xe/xe_pt.c
@@ -433,6 +433,7 @@ xe_pt_insert_entry(struct xe_pt_stage_bind_walk *xe_walk, struct xe_pt *parent,
 static bool xe_pt_hugepte_possible(u64 addr, u64 next, unsigned int level,
 				   struct xe_pt_stage_bind_walk *xe_walk)
 {
+	struct xe_bo *bo = xe_vma_bo(xe_walk->vma);
 	u64 size, dma;
 
 	if (level > MAX_HUGEPTE_LEVEL)
@@ -446,8 +447,8 @@ static bool xe_pt_hugepte_possible(u64 addr, u64 next, unsigned int level,
 	if (next - xe_walk->va_curs_start > xe_walk->curs->size)
 		return false;
 
-	/* null VMA's do not have dma addresses */
-	if (xe_vma_is_null(xe_walk->vma))
+	/* null VMA's and purged BO's do not have dma addresses */
+	if (xe_vma_is_null(xe_walk->vma) || (bo && xe_bo_is_purged(bo)))
 		return true;
 
 	/* if we are clearing page table, no dma addresses*/
@@ -468,6 +469,7 @@ static bool xe_pt_hugepte_possible(u64 addr, u64 next, unsigned int level,
 static bool
 xe_pt_scan_64K(u64 addr, u64 next, struct xe_pt_stage_bind_walk *xe_walk)
 {
+	struct xe_bo *bo = xe_vma_bo(xe_walk->vma);
 	struct xe_res_cursor curs = *xe_walk->curs;
 
 	if (!IS_ALIGNED(addr, SZ_64K))
@@ -476,8 +478,8 @@ xe_pt_scan_64K(u64 addr, u64 next, struct xe_pt_stage_bind_walk *xe_walk)
 	if (next > xe_walk->l0_end_addr)
 		return false;
 
-	/* null VMA's do not have dma addresses */
-	if (xe_vma_is_null(xe_walk->vma))
+	/* null VMA's and purged BO's do not have dma addresses */
+	if (xe_vma_is_null(xe_walk->vma) || (bo && xe_bo_is_purged(bo)))
 		return true;
 
 	xe_res_next(&curs, addr - xe_walk->va_curs_start);
@@ -708,7 +710,7 @@ xe_pt_stage_bind(struct xe_tile *tile, struct xe_vma *vma,
 {
 	struct xe_device *xe = tile_to_xe(tile);
 	struct xe_bo *bo = xe_vma_bo(vma);
-	struct xe_res_cursor curs;
+	struct xe_res_cursor curs = {};
 	struct xe_vm *vm = xe_vma_vm(vma);
 	struct xe_pt_stage_bind_walk xe_walk = {
 		.base = {
-- 
2.54.0

Re: [PATCH 3/3] drm/xe/pt: prevent invalid cursor access for purged BOs

[Matthew Brost]

On Thu, Jun 25, 2026 at 04:20:58PM +0100, Matthew Auld wrote:
> During a page table walk for binding, xe_pt_stage_bind() explicitly
> skips initializing the xe_res_cursor for purged BOs, treating them
> similarly to NULL VMAs by only setting the cursor size.
> 
> However, xe_pt_hugepte_possible() and xe_pt_scan_64K() did not check
> if the BO was purged before attempting to walk the cursor using
> xe_res_dma() and xe_res_next(). Because the cursor was left
> uninitialized for purged BOs, this falls through and triggers
> warnings like:
> 
>   WARNING: drivers/gpu/drm/xe/xe_res_cursor.h:274 at xe_res_next
> 
> Fix this by explicitly checking if the BO is purged in both
> xe_pt_hugepte_possible() and xe_pt_scan_64K(), returning early just
> as we do for NULL VMAs, avoiding the invalid cursor accesses entirely.
> 
> As a precaution, also zero-initialize the cursor in xe_pt_stage_bind()
> to ensure we don't pass garbage data into the page table walkers
> if we ever hit a similar edge case in the future.
> 
> Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/work_items/8418
> Fixes: ad9843aac91a ("drm/xe/madvise: Implement purgeable buffer object support")
> Assisted-by: Copilot:gemini-3.1-pro-preview
> Reported-by: Matthew Schwartz <matthew.schwartz@linux.dev>
> Signed-off-by: Matthew Auld <matthew.auld@intel.com>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Matthew Brost <matthew.brost@intel.com>

Reviewed-by: Matthew Brost <matthew.brost@intel.com>

> Cc: Arvind Yadav <arvind.yadav@intel.com>
> ---
>  drivers/gpu/drm/xe/xe_pt.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_pt.c b/drivers/gpu/drm/xe/xe_pt.c
> index 0959e0e88a14..b1f6a96dab2e 100644
> --- a/drivers/gpu/drm/xe/xe_pt.c
> +++ b/drivers/gpu/drm/xe/xe_pt.c
> @@ -433,6 +433,7 @@ xe_pt_insert_entry(struct xe_pt_stage_bind_walk *xe_walk, struct xe_pt *parent,
>  static bool xe_pt_hugepte_possible(u64 addr, u64 next, unsigned int level,
>  				   struct xe_pt_stage_bind_walk *xe_walk)
>  {
> +	struct xe_bo *bo = xe_vma_bo(xe_walk->vma);
>  	u64 size, dma;
>  
>  	if (level > MAX_HUGEPTE_LEVEL)
> @@ -446,8 +447,8 @@ static bool xe_pt_hugepte_possible(u64 addr, u64 next, unsigned int level,
>  	if (next - xe_walk->va_curs_start > xe_walk->curs->size)
>  		return false;
>  
> -	/* null VMA's do not have dma addresses */
> -	if (xe_vma_is_null(xe_walk->vma))
> +	/* null VMA's and purged BO's do not have dma addresses */
> +	if (xe_vma_is_null(xe_walk->vma) || (bo && xe_bo_is_purged(bo)))
>  		return true;
>  
>  	/* if we are clearing page table, no dma addresses*/
> @@ -468,6 +469,7 @@ static bool xe_pt_hugepte_possible(u64 addr, u64 next, unsigned int level,
>  static bool
>  xe_pt_scan_64K(u64 addr, u64 next, struct xe_pt_stage_bind_walk *xe_walk)
>  {
> +	struct xe_bo *bo = xe_vma_bo(xe_walk->vma);
>  	struct xe_res_cursor curs = *xe_walk->curs;
>  
>  	if (!IS_ALIGNED(addr, SZ_64K))
> @@ -476,8 +478,8 @@ xe_pt_scan_64K(u64 addr, u64 next, struct xe_pt_stage_bind_walk *xe_walk)
>  	if (next > xe_walk->l0_end_addr)
>  		return false;
>  
> -	/* null VMA's do not have dma addresses */
> -	if (xe_vma_is_null(xe_walk->vma))
> +	/* null VMA's and purged BO's do not have dma addresses */
> +	if (xe_vma_is_null(xe_walk->vma) || (bo && xe_bo_is_purged(bo)))
>  		return true;
>  
>  	xe_res_next(&curs, addr - xe_walk->va_curs_start);
> @@ -708,7 +710,7 @@ xe_pt_stage_bind(struct xe_tile *tile, struct xe_vma *vma,
>  {
>  	struct xe_device *xe = tile_to_xe(tile);
>  	struct xe_bo *bo = xe_vma_bo(vma);
> -	struct xe_res_cursor curs;
> +	struct xe_res_cursor curs = {};
>  	struct xe_vm *vm = xe_vma_vm(vma);
>  	struct xe_pt_stage_bind_walk xe_walk = {
>  		.base = {
> -- 
> 2.54.0
>