Re: [RFC v2 3/9] drm/xe/bo: Prevent purging of shared buffer objects

["Thomas Hellström" <thomas.hellstrom@linux.intel.com>]

On Tue, 2025-12-02 at 09:12 +0530, Yadav, Arvind wrote:
> 
> On 02-12-2025 04:40, Matthew Brost wrote:
> > On Mon, Dec 01, 2025 at 11:20:13AM +0530, Arvind Yadav wrote:
> > > Introduce the `xe_bo_is_shared_locked()` inline helper to
> > > determine if a
> > > buffer object is shared across multiple clients or drivers. A
> > > buffer is
> > > considered shared if it is exported via dma-buf, imported, or has
> > > a
> > > handle count greater than one.
> > > 
> > > This check is critical for safely implementing purgeable memory.
> > > Purging
> > > a buffer that is shared would lead to data corruption for other
> > > clients
> > > that still hold a reference to it.
> > > 
> > > The kernel cannot safely determine when all clients are done with
> > > a
> > > shared buffer, so shared BOs must never be marked DONTNEED or
> > > purged.
> > > 
> > > The new helper is used in two key locations:
> > > 1.  In `xe_vm_madvise_purgeable_bo()`, to prevent userspace from
> > >      successfully marking a shared buffer as `DONTNEED`. This is
> > > the
> > >      primary safeguard against incorrect usage.
> > > 
> > > 2.  In `xe_bo_move()`, as a final safety check before the kernel
> > >      initiates a purge during eviction. This ensures that even if
> > > a
> > >      shared buffer were somehow marked `DONTNEED`, it would not
> > > be
> > >      purged.
> > > 
> > > Cc: Matthew Brost <matthew.brost@intel.com>
> > > Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> > > Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
> > > Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
> > > ---
> > >   drivers/gpu/drm/xe/xe_bo.h | 30 ++++++++++++++++++++++++++++++
> > >   1 file changed, 30 insertions(+)
> > > 
> > > diff --git a/drivers/gpu/drm/xe/xe_bo.h
> > > b/drivers/gpu/drm/xe/xe_bo.h
> > > index b0a31c77e612..97edb38bf1ed 100644
> > > --- a/drivers/gpu/drm/xe/xe_bo.h
> > > +++ b/drivers/gpu/drm/xe/xe_bo.h
> > > @@ -478,4 +478,34 @@ static inline bool xe_bo_is_mem_type(struct
> > > xe_bo *bo, u32 mem_type)
> > >   	xe_bo_assert_held(bo);
> > >   	return bo->ttm.resource->mem_type == mem_type;
> > >   }
> > > +
> > > +/**
> > > + * xe_bo_is_shared_locked - Check if a buffer object is shared
> > > + * @bo: The buffer object to check
> > > + *
> > > + * Determines if a buffer object is considered shared, which
> > > includes:
> > > + * - Exported via dma-buf (obj->dma_buf is set)
> > > + * - Imported from another driver (obj->import_attach is set)
> > > + * - Referenced by multiple clients (handle_count > 1)
> > > + *
> > > + * This check is used to prevent data loss on shared content by
> > > avoiding
> > > + * certain operations like purging on buffers that other
> > > processes or
> > > + * drivers might still be using.
> > > + *
> > > + * Return: true if the buffer object is shared, false otherwise.
> > > + */
> > > +static inline bool xe_bo_is_shared_locked(const struct xe_bo
> > > *bo)
> > > +{
> > > +	const struct drm_gem_object *obj = &bo->ttm.base;
> > > +
> > It seems like everything below here should be a new drm gem helper.
> There is a DRM helper 'drm_gem_object_is_shared_for_memory_stats()',
> but 
> it's
> specifically scoped for fdinfo memory accounting and doesn't check 
> import_attach.
> > > +	dma_resv_assert_held(obj->resv);
> > > +
> > > +	if (obj->dma_buf || obj->import_attach)
> > > +		return true;
> > > +
> > > +	if (obj->handle_count > 1)
> > So this covers the case when we prime fd to handle but we resolve
> > to a
> > BO (i.e., we don't do a dma-buf attach, rather just take reference
> > on BO
> > as the BO is from the same device)? I just want to make sure I'm
> > understanding this part correctly. If so, maybe throw a comment in
> > here
> > or update the functions kernel doc a bit with a better
> > explaination.
> Yes, that's correct! The handle_count > 1 check covers exactly that 
> scenario:
> When we do prime fd-to-handle but both processes are using the same
> xe 
> device,
> we don't do a dma-buf attach. Instead, we just increment the
> reference 
> count
> and handle_count on the same xe_bo.
> I will add and update the function with comments.

Arvind, Matt

I think the correct way to check purgability support for shared buffers
is to loop over all vmas attached to the bo and check that they all say
WONTNEED? If they don't, the bo is not purgeable. This will also need a
check at VMA unbinding.

/Thomas






> 
> ~Arvind
> > Matt
> > 
> > > +		return true;
> > > +
> > > +	return false;
> > > +}
> > >   #endif
> > > -- 
> > > 2.43.0
> > >