Re: [RFC v2 3/9] drm/xe/bo: Prevent purging of shared buffer objects

["Yadav, Arvind" <arvind.yadav@intel.com>]

On 02-12-2025 20:47, Matthew Brost wrote:
> On Tue, Dec 02, 2025 at 10:42:07AM +0100, Thomas Hellström wrote:
>> On Tue, 2025-12-02 at 09:12 +0530, Yadav, Arvind wrote:
>>> On 02-12-2025 04:40, Matthew Brost wrote:
>>>> On Mon, Dec 01, 2025 at 11:20:13AM +0530, Arvind Yadav wrote:
>>>>> Introduce the `xe_bo_is_shared_locked()` inline helper to
>>>>> determine if a
>>>>> buffer object is shared across multiple clients or drivers. A
>>>>> buffer is
>>>>> considered shared if it is exported via dma-buf, imported, or has
>>>>> a
>>>>> handle count greater than one.
>>>>>
>>>>> This check is critical for safely implementing purgeable memory.
>>>>> Purging
>>>>> a buffer that is shared would lead to data corruption for other
>>>>> clients
>>>>> that still hold a reference to it.
>>>>>
>>>>> The kernel cannot safely determine when all clients are done with
>>>>> a
>>>>> shared buffer, so shared BOs must never be marked DONTNEED or
>>>>> purged.
>>>>>
>>>>> The new helper is used in two key locations:
>>>>> 1.  In `xe_vm_madvise_purgeable_bo()`, to prevent userspace from
>>>>>       successfully marking a shared buffer as `DONTNEED`. This is
>>>>> the
>>>>>       primary safeguard against incorrect usage.
>>>>>
>>>>> 2.  In `xe_bo_move()`, as a final safety check before the kernel
>>>>>       initiates a purge during eviction. This ensures that even if
>>>>> a
>>>>>       shared buffer were somehow marked `DONTNEED`, it would not
>>>>> be
>>>>>       purged.
>>>>>
>>>>> Cc: Matthew Brost <matthew.brost@intel.com>
>>>>> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
>>>>> Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
>>>>> Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
>>>>> ---
>>>>>    drivers/gpu/drm/xe/xe_bo.h | 30 ++++++++++++++++++++++++++++++
>>>>>    1 file changed, 30 insertions(+)
>>>>>
>>>>> diff --git a/drivers/gpu/drm/xe/xe_bo.h
>>>>> b/drivers/gpu/drm/xe/xe_bo.h
>>>>> index b0a31c77e612..97edb38bf1ed 100644
>>>>> --- a/drivers/gpu/drm/xe/xe_bo.h
>>>>> +++ b/drivers/gpu/drm/xe/xe_bo.h
>>>>> @@ -478,4 +478,34 @@ static inline bool xe_bo_is_mem_type(struct
>>>>> xe_bo *bo, u32 mem_type)
>>>>>    	xe_bo_assert_held(bo);
>>>>>    	return bo->ttm.resource->mem_type == mem_type;
>>>>>    }
>>>>> +
>>>>> +/**
>>>>> + * xe_bo_is_shared_locked - Check if a buffer object is shared
>>>>> + * @bo: The buffer object to check
>>>>> + *
>>>>> + * Determines if a buffer object is considered shared, which
>>>>> includes:
>>>>> + * - Exported via dma-buf (obj->dma_buf is set)
>>>>> + * - Imported from another driver (obj->import_attach is set)
>>>>> + * - Referenced by multiple clients (handle_count > 1)
>>>>> + *
>>>>> + * This check is used to prevent data loss on shared content by
>>>>> avoiding
>>>>> + * certain operations like purging on buffers that other
>>>>> processes or
>>>>> + * drivers might still be using.
>>>>> + *
>>>>> + * Return: true if the buffer object is shared, false otherwise.
>>>>> + */
>>>>> +static inline bool xe_bo_is_shared_locked(const struct xe_bo
>>>>> *bo)
>>>>> +{
>>>>> +	const struct drm_gem_object *obj = &bo->ttm.base;
>>>>> +
>>>> It seems like everything below here should be a new drm gem helper.
>>> There is a DRM helper 'drm_gem_object_is_shared_for_memory_stats()',
>>> but
>>> it's
>>> specifically scoped for fdinfo memory accounting and doesn't check
>>> import_attach.
>>>>> +	dma_resv_assert_held(obj->resv);
>>>>> +
>>>>> +	if (obj->dma_buf || obj->import_attach)
>>>>> +		return true;
>>>>> +
>>>>> +	if (obj->handle_count > 1)
>>>> So this covers the case when we prime fd to handle but we resolve
>>>> to a
>>>> BO (i.e., we don't do a dma-buf attach, rather just take reference
>>>> on BO
>>>> as the BO is from the same device)? I just want to make sure I'm
>>>> understanding this part correctly. If so, maybe throw a comment in
>>>> here
>>>> or update the functions kernel doc a bit with a better
>>>> explaination.
>>> Yes, that's correct! The handle_count > 1 check covers exactly that
>>> scenario:
>>> When we do prime fd-to-handle but both processes are using the same
>>> xe
>>> device,
>>> we don't do a dma-buf attach. Instead, we just increment the
>>> reference
>>> count
>>> and handle_count on the same xe_bo.
>>> I will add and update the function with comments.
>> Arvind, Matt
>>
>> I think the correct way to check purgability support for shared buffers
>> is to loop over all vmas attached to the bo and check that they all say
>> WONTNEED? If they don't, the bo is not purgeable. This will also need a
>> check at VMA unbinding.
>>
> I think this makes sense. I haven't fully gotten through this series
> yet, but will consider this during the code reviews. I probably should
> apply this series in full before providing feedback.

Thomas, Matt

Agreed. I will reworked the purgeability logic exactly as you suggested.
Instead of relying on a “shared BO” helper, the driver now keeps a 
per-VMA purgeable_state,
and a BO becomes DONTNEED only when all VMAs attached to it report DONTNEED.

~Arvind

> Matt
>
>> /Thomas
>>
>>
>>
>>
>>
>>
>>> ~Arvind
>>>> Matt
>>>>
>>>>> +		return true;
>>>>> +
>>>>> +	return false;
>>>>> +}
>>>>>    #endif
>>>>> -- 
>>>>> 2.43.0
>>>>>