Intel-XE Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] drm/xe: Tear down kernel mappings in release_notify
@ 2026-11-02  8:26 Arvind Yadav
  2026-11-02  8:46 ` sashiko-bot
                   ` (3 more replies)
  0 siblings, 4 replies; 6+ messages in thread
From: Arvind Yadav @ 2026-11-02  8:26 UTC (permalink / raw)
  To: intel-xe, dri-devel
  Cc: matthew.brost, himal.prasad.ghimiray, thomas.hellstrom,
	rodrigo.vivi, stable

xe_gem_object_free() calls __xe_bo_vunmap() without holding the BO
reservation. The last GEM reference does not exclude TTM eviction,
which takes a separate reference on the TTM BO.

Eviction can free the resource while ttm_bo_kunmap() is using it.
ttm_mem_io_free() can then clear bus.addr and bus.offset in the freed
resource. This is consistent with the 16 zeroed bytes reported by
SLUB for a resource freed by xe_ttm_vram_mgr_del() during eviction.

Move __xe_bo_vunmap() to xe_ttm_bo_release_notify(). It runs when the
TTM BO refcount reaches zero, so eviction and swapout can no longer
take a reference, and before TTM frees the resource and backing pages.

Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Cc: stable@vger.kernel.org
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Himal Prasad Ghimiray <himal.prasad.ghimiray@intel.com>
Cc: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Arvind Yadav <arvind.yadav@intel.com>
---
 drivers/gpu/drm/xe/xe_bo.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
index 42a6aa1a2e4a..b7a982a9d81a 100644
--- a/drivers/gpu/drm/xe/xe_bo.c
+++ b/drivers/gpu/drm/xe/xe_bo.c
@@ -1866,6 +1866,12 @@ static void xe_ttm_bo_release_notify(struct ttm_buffer_object *ttm_bo)
 	bo = ttm_to_xe_bo(ttm_bo);
 	xe_assert(xe_bo_device(bo), !(bo->created && kref_read(&ttm_bo->base.refcount)));
 
+	/*
+	 * The TTM BO refcount is zero, so eviction and swapout cannot
+	 * take a reference. Unmap before TTM frees the backing store.
+	 */
+	__xe_bo_vunmap(bo);
+
 	if (!xe_ttm_bo_lock_in_destructor(ttm_bo))
 		return;
 
@@ -2056,7 +2062,6 @@ static void xe_gem_object_free(struct drm_gem_object *obj)
 	 * driver ttm callbacks is allowed to use the ttm_buffer_object
 	 * refcount directly if needed.
 	 */
-	__xe_bo_vunmap(gem_to_xe_bo(obj));
 	ttm_bo_fini(container_of(obj, struct ttm_buffer_object, base));
 }
 
-- 
2.43.0


^ permalink raw reply related	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2026-11-02  9:55 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-02  8:26 [PATCH] drm/xe: Tear down kernel mappings in release_notify Arvind Yadav
2026-11-02  8:46 ` sashiko-bot
2026-11-02  9:04   ` Yadav, Arvind
2026-11-02  8:54 ` ✓ CI.KUnit: success for " Patchwork
2026-11-02  9:28 ` ✓ Xe.CI.BAT: " Patchwork
2026-11-02  9:55 ` ✓ Xe.CI.FULL: " Patchwork

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox