Re: [PATCH v2 1/4] drm/xe: Hold a device reference across deferred VM destruction

[Yadav, Sanjay Kumar]

On 28-10-2026 17:51, Arvind Yadav wrote:

xe_vm_free() is the drm_gpuvm vm_free callback. It hands the final
teardown to vm_destroy_work_func() on a workqueue and returns.

drm_gpuvm_free() drops its device reference immediately after the
callback returns:

        gpuvm->ops->vm_free(gpuvm);
        drm_dev_put(drm);

vm_destroy_work_func() then keeps using device state: xe_pm_runtime_put()
for an LR mode VM, ttm_lru_bulk_move_fini() on xe->ttm, and the tile
iteration. If the freed VM held the last device reference, the work runs
against a released xe_device.

Take a device reference in xe_vm_free() and drop it once
vm_destroy_work_func() has finished using the device.

Cc: Matthew Brost <matthew.br...@intel.com>
Cc: Thomas Hellström <thomas.hellst...@linux.intel.com>
Cc: Himal Prasad Ghimiray <himal.prasad.ghimi...@intel.com>
Cc: Rodrigo Vivi <rodrigo.v...@intel.com>
Assisted-by: LLM
Reviewed-by: Matthew Brost <matthew.br...@intel.com>
Signed-off-by: Arvind Yadav <arvind.ya...@intel.com>

Tested-by: Sanjay Yadav <sanjay.kumar.ya...@intel.com>

---
  drivers/gpu/drm/xe/xe_vm.c | 11 ++++++++---
  1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/drivers/gpu/drm/xe/xe_vm.c b/drivers/gpu/drm/xe/xe_vm.c
index 823e264319a1..a1a4eaf3165f 100644
--- a/drivers/gpu/drm/xe/xe_vm.c
+++ b/drivers/gpu/drm/xe/xe_vm.c
@@ -2108,6 +2108,8 @@ static void vm_destroy_work_func(struct work_struct *w)
                xe_file_put(vm->xef);

kfree(vm);

+
+       drm_dev_put(&xe->drm);
  }

static void xe_vm_free(struct drm_gpuvm *gpuvm)

@@ -2115,10 +2117,13 @@ static void xe_vm_free(struct drm_gpuvm *gpuvm)
        struct xe_vm *vm = container_of(gpuvm, struct xe_vm, gpuvm);

/*

-        * To destroy the VM we need to be able to sleep.
-        * drm_gpuvm keeps at least one device reference at this
-        * point so xe->destroy_wq must still be alive.
+        * drm_gpuvm drops its device reference as soon as this callback
+        * returns, but vm_destroy_work_func() still uses device state. Hold a
+        * reference across the deferred work.
         */
+       drm_dev_get(&vm->xe->drm);
+
+       /* To destroy the VM we need to be able to sleep */
        queue_work(vm->xe->destroy_wq, &vm->destroy_work);
  }