Hey,
On 7/23/26 12:03, Thomas Hellström wrote:
> Add ttm_bo_evict_cgroup() to evict buffer objects charged to a specific
> dmem cgroup pool from a resource manager's LRU until a byte target is
> met. Add ttm_resource_manager_set_dmem_region() to associate a dmem
> cgroup region with a resource manager; drivers supply their own
> dmem_cgroup_ops with ttm_resource_manager_dmem_reclaim as the reclaim
> function and the manager pointer as reclaim_priv in the dmem_cgroup_init
> to wire up TTM eviction as the reclaim callback.
>
> The eviction context is interruptible; signals abort the operation and
> propagate back through the write() syscall.
>
> Introduce a new mode for the bo LRU walker so that sleeping locks
> can be taken. This can be used when the caller doesn't hold any
> previous dma_resv locks, and where it intends to hold at most
> one lock at a time.
>
> Like the rest of the TTM eviction this should sooner than later
> be converted to full WW transactions.
>
> v3:
> - Fix ttm_resource_manager_set_dmem_region() storing an error pointer
> in man->cg unconditionally. (Sashiko-bot)
> - Fix kernel-doc function name format for ttm_bo_evict_cgroup() and
> ttm_resource_manager_set_dmem_region().
>
> v5:
> - Rebased on the introduction of struct dmem_cgroup_init.
> - Handle NULL region in ttm_resource_manager_set_dmem_region() to clear
> the reclaim callback, preventing use-after-free when the manager is
> torn down while the dmem region outlives it. (Sashiko-bot)
> - Return 0 on any progress (even partial eviction), -ENOSPC only when
> nothing was freed; fixes callers that expected 0 on partial success.
> - Document that the reclaim callback should return 0 if some progress
> was made, -ENOSPC if no progress at all, or another error for fatal
> failures.
>
> v8:
> - Fix ttm_resource_manager_set_dmem_region() using IS_ERR_OR_NULL(),
> which skipped the assignment for a NULL region and thus never
> cleared man->cg. Use IS_ERR() so that a NULL region detaches the
> region as the kernel-doc and the v5 changelog intended. (Sashiko-bot)
>
> Assisted-by: GitHub_Copilot:claude-sonnet-4.6
> Signed-off-by: Thomas Hellström <[email protected]>
> Reviewed-by: Maarten Lankhorst <[email protected]> #v7
> ---
> drivers/gpu/drm/ttm/ttm_bo.c | 95 +++++++++++++++++++++++++++++-
> drivers/gpu/drm/ttm/ttm_bo_util.c | 3 +-
> drivers/gpu/drm/ttm/ttm_resource.c | 52 ++++++++++++++++
> include/drm/ttm/ttm_bo.h | 10 ++++
> include/drm/ttm/ttm_resource.h | 7 +++
> 5 files changed, 163 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> index 3980f376e3ba..b2bbbb69add3 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> @@ -515,12 +515,20 @@ static s64 ttm_bo_evict_cb(struct ttm_lru_walk *walk,
> struct ttm_buffer_object *
> {
> struct ttm_bo_evict_walk *evict_walk =
> container_of(walk, typeof(*evict_walk), walk);
> + /* Capture size before eviction in case res is cleared. */
> + s64 bo_size = bo->base.size;
I just noticed this comment, a bo's size should be fixed, even if the backing
store is gone?
> s64 lret;
>
> if (!dmem_cgroup_state_evict_valuable(evict_walk->limit_pool,
> bo->resource->css,
> evict_walk->try_low,
> &evict_walk->hit_low))
> return 0;
>
> + /*
> + * evict_walk->place is NULL in cgroup drain mode. Drivers'
> + * eviction_valuable() callbacks must handle a NULL place, treating it
> + * as "any placement": the TTM base implementation already does so via
> + * ttm_resource_intersects().
> + */
> if (bo->pin_count || !bo->bdev->funcs->eviction_valuable(bo,
> evict_walk->place))
> return 0;
>
> @@ -536,11 +544,15 @@ static s64 ttm_bo_evict_cb(struct ttm_lru_walk *walk,
> struct ttm_buffer_object *
> goto out;
>
> evict_walk->evicted++;
> - if (evict_walk->res)
> + if (evict_walk->res) {
> lret = ttm_resource_alloc(evict_walk->evictor,
> evict_walk->place,
> evict_walk->res, NULL);
> - if (lret == 0)
> - return 1;
> + if (lret == 0)
> + return 1;
> + } else {
> + /* Cgroup drain: return bytes freed for byte-denominated
> progress. */
> + return bo_size;
> + }
> out:
> /* Errors that should terminate the walk. */
> if (lret == -ENOSPC)
> @@ -614,6 +626,83 @@ static int ttm_bo_evict_alloc(struct ttm_device *bdev,
> return 0;
> }
>
> +/**
> + * ttm_bo_evict_cgroup() - Evict buffer objects charged to a specific cgroup.
> + * @bdev: The TTM device.
> + * @man: The resource manager whose LRU to walk.
> + * @limit_pool: The cgroup pool state whose members should be evicted.
> + * @target_bytes: Number of bytes to free.
> + * @ctx: The TTM operation context.
> + *
> + * Walk the LRU of @man and evict buffer objects that are charged to the
> + * cgroup identified by @limit_pool, until at least @target_bytes have been
> + * freed. Mirrors the two-pass (trylock -> sleeping-lock, low-watermark)
> + * strategy used by ttm_bo_evict_alloc().
> + *
> + * Return: >= @target_bytes on full success, 0..target_bytes-1 if partial,
> + * negative error code on fatal error.
> + */
> +s64 ttm_bo_evict_cgroup(struct ttm_device *bdev,
> + struct ttm_resource_manager *man,
> + struct dmem_cgroup_pool_state *limit_pool,
> + s64 target_bytes,
> + struct ttm_operation_ctx *ctx)
> +{
> + struct ttm_bo_evict_walk evict_walk = {
> + .walk = {
> + .ops = &ttm_evict_walk_ops,
> + .arg = { .ctx = ctx },
> + },
> + .limit_pool = limit_pool,
> + /* place, evictor, res left NULL: selects cgroup drain mode */
> + };
> + s64 lret, pass;
> +
> + evict_walk.walk.arg.trylock_only = true;
> + lret = ttm_lru_walk_for_evict(&evict_walk.walk, bdev, man,
> target_bytes);
> + if (lret < 0 || lret >= target_bytes)
> + return lret;
> +
> + /* Second pass: also evict BOs at the low watermark. */
> + if (evict_walk.hit_low) {
> + evict_walk.try_low = true;
> + pass = ttm_lru_walk_for_evict(&evict_walk.walk, bdev, man,
> + target_bytes - lret);
> + if (pass < 0)
> + return pass;
> + lret += pass;
> + if (lret >= target_bytes)
> + return lret;
> + }
> +
> + /* Full sleeping-lock pass for remaining target. */
> + evict_walk.try_low = evict_walk.hit_low = false;
> + evict_walk.walk.arg.trylock_only = false;
> +
> +retry:
> + evict_walk.walk.arg.sleeping_lock = true;
> + do {
> + evict_walk.evicted = 0;
> + pass = ttm_lru_walk_for_evict(&evict_walk.walk, bdev, man,
> + target_bytes - lret);
> + if (pass < 0) {
> + lret = pass;
> + goto out;
> + }
> + lret += pass;
> + } while (lret < target_bytes && evict_walk.evicted);
> +
> + /* One more attempt if we hit the low limit during sleeping-lock pass.
> */
> + if (lret < target_bytes && evict_walk.hit_low && !evict_walk.try_low) {
> + evict_walk.try_low = true;
> + goto retry;
> + }
> +
> +out:
> + return lret;
> +}
> +EXPORT_SYMBOL(ttm_bo_evict_cgroup);
> +
> /**
> * ttm_bo_pin - Pin the buffer object.
> * @bo: The buffer object to pin
> diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c
> b/drivers/gpu/drm/ttm/ttm_bo_util.c
> index 3e3c201a0222..bd0b23ac2cc4 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
> @@ -999,7 +999,8 @@ __ttm_bo_lru_cursor_next(struct ttm_bo_lru_cursor *curs)
> bo = res->bo;
> if (ttm_lru_walk_trylock(curs, bo))
> bo_locked = true;
> - else if (!arg->ticket || arg->ctx->no_wait_gpu ||
> arg->trylock_only)
> + else if ((!arg->ticket && !arg->sleeping_lock) ||
> arg->ctx->no_wait_gpu ||
> + arg->trylock_only)
> continue;
>
> if (!ttm_bo_get_unless_zero(bo)) {
> diff --git a/drivers/gpu/drm/ttm/ttm_resource.c
> b/drivers/gpu/drm/ttm/ttm_resource.c
> index 154d6739256f..1ff4a470b083 100644
> --- a/drivers/gpu/drm/ttm/ttm_resource.c
> +++ b/drivers/gpu/drm/ttm/ttm_resource.c
> @@ -953,3 +953,55 @@ void ttm_resource_manager_create_debugfs(struct
> ttm_resource_manager *man,
> #endif
> }
> EXPORT_SYMBOL(ttm_resource_manager_create_debugfs);
> +
> +/**
> + * ttm_resource_manager_dmem_reclaim() - dmem cgroup reclaim callback for TTM
> + * resource managers.
> + * @pool: The dmem cgroup pool state for the cgroup being reclaimed.
> + * @target_bytes: Number of bytes to try to free.
> + * @priv: The &ttm_resource_manager pointer, passed as @init.reclaim_priv to
> + * dmem_cgroup_register_region().
> + *
> + * Drivers should use this as the @reclaim member of their own
> + * &struct dmem_cgroup_ops, with the &ttm_resource_manager pointer as
> + * @init.reclaim_priv.
> + *
> + * Return: 0 if some memory was freed, -ENOSPC if nothing was freed, or
> + * another negative error code on fatal failure.
> + */
> +int ttm_resource_manager_dmem_reclaim(struct dmem_cgroup_pool_state *pool,
> + u64 target_bytes, void *priv)
> +{
> + struct ttm_resource_manager *man = priv;
> + struct ttm_operation_ctx ctx = { .interruptible = true };
> + s64 freed;
> +
> + freed = ttm_bo_evict_cgroup(man->bdev, man, pool, target_bytes, &ctx);
> + if (freed < 0)
> + return freed;
> +
> + return freed > 0 ? 0 : -ENOSPC;
> +}
> +EXPORT_SYMBOL(ttm_resource_manager_dmem_reclaim);
> +
> +/**
> + * ttm_resource_manager_set_dmem_region() - Associate a dmem cgroup region
> with a
> + * resource manager.
> + * @man: The resource manager.
> + * @region: The dmem cgroup region to associate, may be NULL or IS_ERR().
> + *
> + * When @region is valid, stores it in @man->cg so that TTM can look up the
> + * associated pool during charging and eviction-target selection. When
> + * @region is %NULL, clears @man->cg to detach the region before teardown.
> + * An IS_ERR() @region is ignored, leaving @man->cg unchanged.
> + * The reclaim callback must be wired up using
> ttm_resource_manager_dmem_reclaim()
> + * in the driver's own &struct dmem_cgroup_ops, with the manager pointer as
> + * @init.reclaim_priv.
> + */
> +void ttm_resource_manager_set_dmem_region(struct ttm_resource_manager *man,
> + struct dmem_cgroup_region *region)
> +{
> + if (!IS_ERR(region))
> + man->cg = region;
> +}
> +EXPORT_SYMBOL(ttm_resource_manager_set_dmem_region);
> diff --git a/include/drm/ttm/ttm_bo.h b/include/drm/ttm/ttm_bo.h
> index 8310bc3d55f9..32791c4db2a9 100644
> --- a/include/drm/ttm/ttm_bo.h
> +++ b/include/drm/ttm/ttm_bo.h
> @@ -226,6 +226,11 @@ struct ttm_lru_walk_arg {
> struct ww_acquire_ctx *ticket;
> /** @trylock_only: Only use trylock for locking. */
> bool trylock_only;
> + /**
> + * @sleeping_lock: Use sleeping locks even with %NULL @ticket.
> + * @trylock_only has precedence over this field.
> + */
> + bool sleeping_lock;
> };
>
> /**
> @@ -431,6 +436,11 @@ void ttm_bo_unpin(struct ttm_buffer_object *bo);
> int ttm_bo_evict_first(struct ttm_device *bdev,
> struct ttm_resource_manager *man,
> struct ttm_operation_ctx *ctx);
> +s64 ttm_bo_evict_cgroup(struct ttm_device *bdev,
> + struct ttm_resource_manager *man,
> + struct dmem_cgroup_pool_state *limit_pool,
> + s64 target_bytes,
> + struct ttm_operation_ctx *ctx);
> int ttm_bo_access(struct ttm_buffer_object *bo, unsigned long offset,
> void *buf, int len, int write);
> vm_fault_t ttm_bo_vm_reserve(struct ttm_buffer_object *bo,
> diff --git a/include/drm/ttm/ttm_resource.h b/include/drm/ttm/ttm_resource.h
> index a5d386583fb6..32e485fdce9a 100644
> --- a/include/drm/ttm/ttm_resource.h
> +++ b/include/drm/ttm/ttm_resource.h
> @@ -39,6 +39,7 @@
>
> struct dentry;
> struct dmem_cgroup_device;
> +struct dmem_cgroup_region;
> struct drm_printer;
> struct ttm_device;
> struct ttm_resource_manager;
> @@ -477,6 +478,12 @@ void ttm_resource_manager_init(struct
> ttm_resource_manager *man,
> struct ttm_device *bdev,
> uint64_t size);
>
> +void ttm_resource_manager_set_dmem_region(struct ttm_resource_manager *man,
> + struct dmem_cgroup_region *region);
> +
> +int ttm_resource_manager_dmem_reclaim(struct dmem_cgroup_pool_state *pool,
> + u64 target_bytes, void *priv);
> +
> int ttm_resource_manager_evict_all(struct ttm_device *bdev,
> struct ttm_resource_manager *man);
>
