[PATCH v3 1/2] drm/xe: Assign ioctl xe file handler to vm in xe_vm_create

[Matthew Auld]

On 11/08/2025 11:43, Piórkowski, Piotr wrote:
> From: Piotr Piórkowski <piotr.piorkowski at intel.com>
> 
> In several code paths, such as xe_pt_create(), the vm->xef field is used
> to determine whether a VM originates from userspace or the kernel.
> 
> Previously, this handler was only assigned in xe_vm_create_ioctl(),
> after the VM was created by xe_vm_create(). However, xe_vm_create()
> triggers page table creation, and that function assumes vm->xef should
> be already set. This could lead to incorrect origin detection.
> 
> To fix this problem and ensure consistency in the initialization of
> the VM object, let's move the assignment of this handler to
> xe_vm_create.
> 
> v2:
>   - take reference to the xe file object only when xef is not NULL
>   - release the reference to the xe file object on the error path (Matthew)
> 
> Fixes: 7f387e6012b6 ("drm/xe: add XE_BO_FLAG_PINNED_LATE_RESTORE")
> Signed-off-by: Piotr Piórkowski <piotr.piorkowski at intel.com>
> Cc: Matthew Auld <matthew.auld at intel.com>

Reviewed-by: Matthew Auld <matthew.auld at intel.com>

> ---
>   drivers/gpu/drm/xe/xe_migrate.c    |  2 +-
>   drivers/gpu/drm/xe/xe_pxp_submit.c |  2 +-
>   drivers/gpu/drm/xe/xe_vm.c         | 11 ++++++-----
>   drivers/gpu/drm/xe/xe_vm.h         |  2 +-
>   4 files changed, 9 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
> index ac9f4d4988d2..915fccea7aeb 100644
> --- a/drivers/gpu/drm/xe/xe_migrate.c
> +++ b/drivers/gpu/drm/xe/xe_migrate.c
> @@ -411,7 +411,7 @@ int xe_migrate_init(struct xe_migrate *m)
>   
>   	/* Special layout, prepared below.. */
>   	vm = xe_vm_create(xe, XE_VM_FLAG_MIGRATION |
> -			  XE_VM_FLAG_SET_TILE_ID(tile));
> +			  XE_VM_FLAG_SET_TILE_ID(tile), NULL);
>   	if (IS_ERR(vm))
>   		return PTR_ERR(vm);
>   
> diff --git a/drivers/gpu/drm/xe/xe_pxp_submit.c b/drivers/gpu/drm/xe/xe_pxp_submit.c
> index d92ec0f515b0..ca95f2a4d4ef 100644
> --- a/drivers/gpu/drm/xe/xe_pxp_submit.c
> +++ b/drivers/gpu/drm/xe/xe_pxp_submit.c
> @@ -101,7 +101,7 @@ static int allocate_gsc_client_resources(struct xe_gt *gt,
>   	xe_assert(xe, hwe);
>   
>   	/* PXP instructions must be issued from PPGTT */
> -	vm = xe_vm_create(xe, XE_VM_FLAG_GSC);
> +	vm = xe_vm_create(xe, XE_VM_FLAG_GSC, NULL);
>   	if (IS_ERR(vm))
>   		return PTR_ERR(vm);
>   
> diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
> index 148a2425006f..157e11bd2121 100644
> --- a/drivers/gpu/drm/xe/xe_vm.c
> +++ b/drivers/gpu/drm/xe/xe_vm.c
> @@ -1640,7 +1640,7 @@ static void xe_vm_free_scratch(struct xe_vm *vm)
>   	}
>   }
>   
> -struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags)
> +struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags, struct xe_file *xef)
>   {
>   	struct drm_gem_object *vm_resv_obj;
>   	struct xe_vm *vm;
> @@ -1661,9 +1661,10 @@ struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags)
>   	vm->xe = xe;
>   
>   	vm->size = 1ull << xe->info.va_bits;
> -
>   	vm->flags = flags;
>   
> +	if (xef)
> +		vm->xef = xe_file_get(xef);
>   	/**
>   	 * GSC VMs are kernel-owned, only used for PXP ops and can sometimes be
>   	 * manipulated under the PXP mutex. However, the PXP mutex can be taken
> @@ -1814,6 +1815,8 @@ struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags)
>   	for_each_tile(tile, xe, id)
>   		xe_range_fence_tree_fini(&vm->rftree[id]);
>   	ttm_lru_bulk_move_fini(&xe->ttm, &vm->lru_bulk_move);
> +	if (vm->xef)
> +		xe_file_put(vm->xef);
>   	kfree(vm);
>   	if (flags & XE_VM_FLAG_LR_MODE)
>   		xe_pm_runtime_put(xe);
> @@ -2097,7 +2100,7 @@ int xe_vm_create_ioctl(struct drm_device *dev, void *data,
>   	if (args->flags & DRM_XE_VM_CREATE_FLAG_FAULT_MODE)
>   		flags |= XE_VM_FLAG_FAULT_MODE;
>   
> -	vm = xe_vm_create(xe, flags);
> +	vm = xe_vm_create(xe, flags, xef);
>   	if (IS_ERR(vm))
>   		return PTR_ERR(vm);
>   
> @@ -2113,8 +2116,6 @@ int xe_vm_create_ioctl(struct drm_device *dev, void *data,
>   		vm->usm.asid = asid;
>   	}
>   
> -	vm->xef = xe_file_get(xef);
> -
>   	/* Record BO memory for VM pagetable created against client */
>   	for_each_tile(tile, xe, id)
>   		if (vm->pt_root[id])
> diff --git a/drivers/gpu/drm/xe/xe_vm.h b/drivers/gpu/drm/xe/xe_vm.h
> index 3475a118f666..2f213737c7e5 100644
> --- a/drivers/gpu/drm/xe/xe_vm.h
> +++ b/drivers/gpu/drm/xe/xe_vm.h
> @@ -26,7 +26,7 @@ struct xe_sync_entry;
>   struct xe_svm_range;
>   struct drm_exec;
>   
> -struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags);
> +struct xe_vm *xe_vm_create(struct xe_device *xe, u32 flags, struct xe_file *xef);
>   
>   struct xe_vm *xe_vm_lookup(struct xe_file *xef, u32 id);
>   int xe_vma_cmp_vma_cb(const void *key, const struct rb_node *node);