[PATCH 1/4] ttm/bo: add an API to populate a bo before exporting.

[PATCH 1/4] ttm/bo: add an API to populate a bo before exporting.

[Dave Airlie]

From: Dave Airlie <airlied@redhat.com>

While discussing cgroups we noticed a problem where you could export
a BO to a dma-buf without having it ever being backed or accounted for.

This meant in low memory situations or eventually with cgroups, a
lower privledged process might cause the compositor to try and allocate
a lot of memory on it's behalf and this could fail. At least make
sure the exporter has managed to allocate the RAM at least once
before exporting the object.

This only applies currently to TTM_PL_SYSTEM objects, because
GTT objects get populated on first validate, and VRAM doesn't
use TT.

Reviewed-by: Christian Koenig <christian.koenig@amd.com>
Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Cc: Simona Vetter <simona.vetter@ffwll.ch>
Signed-off-by: Dave Airlie <airlied@redhat.com>
---
 drivers/gpu/drm/ttm/ttm_bo.c | 15 +++++++++++++++
 include/drm/ttm/ttm_bo.h     |  2 ++
 2 files changed, 17 insertions(+)

diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 273757974b9f..a815c7478d3f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1284,3 +1284,18 @@ int ttm_bo_populate(struct ttm_buffer_object *bo,
 	return 0;
 }
 EXPORT_SYMBOL(ttm_bo_populate);
+
+int ttm_bo_setup_export(struct ttm_buffer_object *bo,
+			struct ttm_operation_ctx *ctx)
+{
+	int ret;
+
+	ret = ttm_bo_reserve(bo, false, false, NULL);
+	if (ret != 0)
+		return ret;
+
+	ret = ttm_bo_populate(bo, bo->resource->placement & TTM_PL_FLAG_MEMCG, ctx);
+	ttm_bo_unreserve(bo);
+	return ret;
+}
+EXPORT_SYMBOL(ttm_bo_setup_export);
diff --git a/include/drm/ttm/ttm_bo.h b/include/drm/ttm/ttm_bo.h
index c33b3667ae76..cdc9f5d1b420 100644
--- a/include/drm/ttm/ttm_bo.h
+++ b/include/drm/ttm/ttm_bo.h
@@ -473,6 +473,8 @@ void ttm_bo_tt_destroy(struct ttm_buffer_object *bo);
 int ttm_bo_populate(struct ttm_buffer_object *bo,
 		    bool memcg_account,
 		    struct ttm_operation_ctx *ctx);
+int ttm_bo_setup_export(struct ttm_buffer_object *bo,
+			struct ttm_operation_ctx *ctx);
 
 /* Driver LRU walk helpers initially targeted for shrinking. */
 
-- 
2.50.1

[PATCH 2/4] amdgpu: populate buffers before exporting them.

[Dave Airlie]

From: Dave Airlie <airlied@redhat.com>

Before exporting a buffer, make sure it has been populated with
pages at least once.

Reviewed-by: Christian Koenig <christian.koenig@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
---
 drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
index ce27cb5bb05e..8561ad7f6180 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c
@@ -343,11 +343,23 @@ struct dma_buf *amdgpu_gem_prime_export(struct drm_gem_object *gobj,
 {
 	struct amdgpu_bo *bo = gem_to_amdgpu_bo(gobj);
 	struct dma_buf *buf;
+	struct ttm_operation_ctx ctx = {
+		.interruptible = true,
+		.no_wait_gpu = true,
+		/* We opt to avoid OOM on system pages allocations */
+		.gfp_retry_mayfail = true,
+		.allow_res_evict = false,
+	};
+	int ret;
 
 	if (amdgpu_ttm_tt_get_usermm(bo->tbo.ttm) ||
 	    bo->flags & AMDGPU_GEM_CREATE_VM_ALWAYS_VALID)
 		return ERR_PTR(-EPERM);
 
+	ret = ttm_bo_setup_export(&bo->tbo, &ctx);
+	if (ret)
+		return ERR_PTR(ret);
+
 	buf = drm_gem_prime_export(gobj, flags);
 	if (!IS_ERR(buf))
 		buf->ops = &amdgpu_dmabuf_ops;
-- 
2.50.1

[PATCH 3/4] nouveau: populate buffers before exporting them.

[Dave Airlie]

From: Dave Airlie <airlied@redhat.com>

Before exporting a buffer, make sure it has been populated with
pages at least once.

Signed-off-by: Dave Airlie <airlied@redhat.com>
---
 drivers/gpu/drm/nouveau/nouveau_prime.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/gpu/drm/nouveau/nouveau_prime.c b/drivers/gpu/drm/nouveau/nouveau_prime.c
index cd95446d6851..caab60fc62f6 100644
--- a/drivers/gpu/drm/nouveau/nouveau_prime.c
+++ b/drivers/gpu/drm/nouveau/nouveau_prime.c
@@ -108,9 +108,21 @@ struct dma_buf *nouveau_gem_prime_export(struct drm_gem_object *gobj,
 					 int flags)
 {
 	struct nouveau_bo *nvbo = nouveau_gem_object(gobj);
+	struct ttm_operation_ctx ctx = {
+		.interruptible = true,
+		.no_wait_gpu = true,
+		/* We opt to avoid OOM on system pages allocations */
+		.gfp_retry_mayfail = true,
+		.allow_res_evict = false,
+	};
+	int ret;
 
 	if (nvbo->no_share)
 		return ERR_PTR(-EPERM);
 
+	ret = ttm_bo_setup_export(&nvbo->bo, &ctx);
+	if (ret)
+		return ERR_PTR(ret);
+
 	return drm_gem_prime_export(gobj, flags);
 }
-- 
2.50.1

[PATCH 4/4] xe: populate buffers before exporting them.

[Dave Airlie]

From: Dave Airlie <airlied@redhat.com>

Before exporting a buffer, make sure it has been populated with
pages at least once.

Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
---
 drivers/gpu/drm/xe/xe_dma_buf.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c
index 346f857f3837..71b70e17bddd 100644
--- a/drivers/gpu/drm/xe/xe_dma_buf.c
+++ b/drivers/gpu/drm/xe/xe_dma_buf.c
@@ -191,10 +191,22 @@ struct dma_buf *xe_gem_prime_export(struct drm_gem_object *obj, int flags)
 {
 	struct xe_bo *bo = gem_to_xe_bo(obj);
 	struct dma_buf *buf;
+	struct ttm_operation_ctx ctx = {
+		.interruptible = true,
+		.no_wait_gpu = true,
+		/* We opt to avoid OOM on system pages allocations */
+		.gfp_retry_mayfail = true,
+		.allow_res_evict = false,
+	};
+	int ret;
 
 	if (bo->vm)
 		return ERR_PTR(-EPERM);
 
+	ret = ttm_bo_setup_export(&bo->ttm, &ctx);
+	if (ret)
+		return ERR_PTR(ret);
+
 	buf = drm_gem_prime_export(obj, flags);
 	if (!IS_ERR(buf))
 		buf->ops = &xe_dmabuf_ops;
-- 
2.50.1

Re: [PATCH 1/4] ttm/bo: add an API to populate a bo before exporting.

[Thomas Hellström]

On Thu, 2025-09-04 at 12:16 +1000, Dave Airlie wrote:
> From: Dave Airlie <airlied@redhat.com>
> 
> While discussing cgroups we noticed a problem where you could export
> a BO to a dma-buf without having it ever being backed or accounted
> for.
> 
> This meant in low memory situations or eventually with cgroups, a
> lower privledged process might cause the compositor to try and
> allocate
> a lot of memory on it's behalf and this could fail. At least make
> sure the exporter has managed to allocate the RAM at least once
> before exporting the object.
> 
> This only applies currently to TTM_PL_SYSTEM objects, because
> GTT objects get populated on first validate, and VRAM doesn't
> use TT.
> 
> Reviewed-by: Christian Koenig <christian.koenig@amd.com>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Simona Vetter <simona.vetter@ffwll.ch>
> Signed-off-by: Dave Airlie <airlied@redhat.com>

Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>

> ---
>  drivers/gpu/drm/ttm/ttm_bo.c | 15 +++++++++++++++
>  include/drm/ttm/ttm_bo.h     |  2 ++
>  2 files changed, 17 insertions(+)
> 
> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c
> b/drivers/gpu/drm/ttm/ttm_bo.c
> index 273757974b9f..a815c7478d3f 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> @@ -1284,3 +1284,18 @@ int ttm_bo_populate(struct ttm_buffer_object
> *bo,
>  	return 0;
>  }
>  EXPORT_SYMBOL(ttm_bo_populate);
> +
> +int ttm_bo_setup_export(struct ttm_buffer_object *bo,
> +			struct ttm_operation_ctx *ctx)
> +{
> +	int ret;
> +
> +	ret = ttm_bo_reserve(bo, false, false, NULL);
> +	if (ret != 0)
> +		return ret;
> +
> +	ret = ttm_bo_populate(bo, bo->resource->placement &
> TTM_PL_FLAG_MEMCG, ctx);
> +	ttm_bo_unreserve(bo);
> +	return ret;
> +}
> +EXPORT_SYMBOL(ttm_bo_setup_export);
> diff --git a/include/drm/ttm/ttm_bo.h b/include/drm/ttm/ttm_bo.h
> index c33b3667ae76..cdc9f5d1b420 100644
> --- a/include/drm/ttm/ttm_bo.h
> +++ b/include/drm/ttm/ttm_bo.h
> @@ -473,6 +473,8 @@ void ttm_bo_tt_destroy(struct ttm_buffer_object
> *bo);
>  int ttm_bo_populate(struct ttm_buffer_object *bo,
>  		    bool memcg_account,
>  		    struct ttm_operation_ctx *ctx);
> +int ttm_bo_setup_export(struct ttm_buffer_object *bo,
> +			struct ttm_operation_ctx *ctx);
>  
>  /* Driver LRU walk helpers initially targeted for shrinking. */
>  

Re: [PATCH 4/4] xe: populate buffers before exporting them.

[Thomas Hellström]

On Thu, 2025-09-04 at 12:16 +1000, Dave Airlie wrote:
> From: Dave Airlie <airlied@redhat.com>
> 
> Before exporting a buffer, make sure it has been populated with
> pages at least once.
> 
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Signed-off-by: Dave Airlie <airlied@redhat.com>

Reviewed-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>

> ---
>  drivers/gpu/drm/xe/xe_dma_buf.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c
> b/drivers/gpu/drm/xe/xe_dma_buf.c
> index 346f857f3837..71b70e17bddd 100644
> --- a/drivers/gpu/drm/xe/xe_dma_buf.c
> +++ b/drivers/gpu/drm/xe/xe_dma_buf.c
> @@ -191,10 +191,22 @@ struct dma_buf *xe_gem_prime_export(struct
> drm_gem_object *obj, int flags)
>  {
>  	struct xe_bo *bo = gem_to_xe_bo(obj);
>  	struct dma_buf *buf;
> +	struct ttm_operation_ctx ctx = {
> +		.interruptible = true,
> +		.no_wait_gpu = true,
> +		/* We opt to avoid OOM on system pages allocations
> */
> +		.gfp_retry_mayfail = true,
> +		.allow_res_evict = false,
> +	};
> +	int ret;
>  
>  	if (bo->vm)
>  		return ERR_PTR(-EPERM);
>  
> +	ret = ttm_bo_setup_export(&bo->ttm, &ctx);
> +	if (ret)
> +		return ERR_PTR(ret);
> +
>  	buf = drm_gem_prime_export(obj, flags);
>  	if (!IS_ERR(buf))
>  		buf->ops = &xe_dmabuf_ops;

Re: [PATCH 1/4] ttm/bo: add an API to populate a bo before exporting.

[Christian König]

On 04.09.25 04:16, Dave Airlie wrote:
> From: Dave Airlie <airlied@redhat.com>
> 
> While discussing cgroups we noticed a problem where you could export
> a BO to a dma-buf without having it ever being backed or accounted for.
> 
> This meant in low memory situations or eventually with cgroups, a
> lower privledged process might cause the compositor to try and allocate
> a lot of memory on it's behalf and this could fail. At least make
> sure the exporter has managed to allocate the RAM at least once
> before exporting the object.
> 
> This only applies currently to TTM_PL_SYSTEM objects, because
> GTT objects get populated on first validate, and VRAM doesn't
> use TT.
> 
> Reviewed-by: Christian Koenig <christian.koenig@amd.com>
> Cc: Thomas Hellström <thomas.hellstrom@linux.intel.com>
> Cc: Simona Vetter <simona.vetter@ffwll.ch>
> Signed-off-by: Dave Airlie <airlied@redhat.com>

Patches #1 and #2 Reviewed-by: Christian König <christian.koenig@amd.com>

I don't see patches #3 and #4 in my inbox, but I guess it's the same for other drivers.

Regards,
Christian.

> ---
>  drivers/gpu/drm/ttm/ttm_bo.c | 15 +++++++++++++++
>  include/drm/ttm/ttm_bo.h     |  2 ++
>  2 files changed, 17 insertions(+)
> 
> diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
> index 273757974b9f..a815c7478d3f 100644
> --- a/drivers/gpu/drm/ttm/ttm_bo.c
> +++ b/drivers/gpu/drm/ttm/ttm_bo.c
> @@ -1284,3 +1284,18 @@ int ttm_bo_populate(struct ttm_buffer_object *bo,
>  	return 0;
>  }
>  EXPORT_SYMBOL(ttm_bo_populate);
> +
> +int ttm_bo_setup_export(struct ttm_buffer_object *bo,
> +			struct ttm_operation_ctx *ctx)
> +{
> +	int ret;
> +
> +	ret = ttm_bo_reserve(bo, false, false, NULL);
> +	if (ret != 0)
> +		return ret;
> +
> +	ret = ttm_bo_populate(bo, bo->resource->placement & TTM_PL_FLAG_MEMCG, ctx);
> +	ttm_bo_unreserve(bo);
> +	return ret;
> +}
> +EXPORT_SYMBOL(ttm_bo_setup_export);
> diff --git a/include/drm/ttm/ttm_bo.h b/include/drm/ttm/ttm_bo.h
> index c33b3667ae76..cdc9f5d1b420 100644
> --- a/include/drm/ttm/ttm_bo.h
> +++ b/include/drm/ttm/ttm_bo.h
> @@ -473,6 +473,8 @@ void ttm_bo_tt_destroy(struct ttm_buffer_object *bo);
>  int ttm_bo_populate(struct ttm_buffer_object *bo,
>  		    bool memcg_account,
>  		    struct ttm_operation_ctx *ctx);
> +int ttm_bo_setup_export(struct ttm_buffer_object *bo,
> +			struct ttm_operation_ctx *ctx);
>  
>  /* Driver LRU walk helpers initially targeted for shrinking. */
>  

Re: [PATCH 1/4] ttm/bo: add an API to populate a bo before exporting.

[Danilo Krummrich]

On Thu Sep 4, 2025 at 4:16 AM CEST, Dave Airlie wrote:
> From: Dave Airlie <airlied@redhat.com>
>
> While discussing cgroups we noticed a problem where you could export
> a BO to a dma-buf without having it ever being backed or accounted for.
>
> This meant in low memory situations or eventually with cgroups, a
> lower privledged process might cause the compositor to try and allocate
> a lot of memory on it's behalf and this could fail. At least make
> sure the exporter has managed to allocate the RAM at least once
> before exporting the object.

The below use of TTM_PL_FLAG_MEMCG suggests that this goes on top of your cgroup
patch series. However, wouldn't a similar change make sense regardless?

Re: [PATCH 3/4] nouveau: populate buffers before exporting them.

[Danilo Krummrich]

On Thu Sep 4, 2025 at 4:16 AM CEST, Dave Airlie wrote:
> From: Dave Airlie <airlied@redhat.com>
>
> Before exporting a buffer, make sure it has been populated with
> pages at least once.

NIT: I'd add the rationale of why that's needed from patch 1 to the driver
patches as well.

> Signed-off-by: Dave Airlie <airlied@redhat.com>

Acked-by: Danilo Krummrich <dakr@kernel.org>

Re: [PATCH 1/4] ttm/bo: add an API to populate a bo before exporting.

[David Airlie]

On Tue, Sep 9, 2025 at 5:31 PM Danilo Krummrich <dakr@kernel.org> wrote:
>
> On Thu Sep 4, 2025 at 4:16 AM CEST, Dave Airlie wrote:
> > From: Dave Airlie <airlied@redhat.com>
> >
> > While discussing cgroups we noticed a problem where you could export
> > a BO to a dma-buf without having it ever being backed or accounted for.
> >
> > This meant in low memory situations or eventually with cgroups, a
> > lower privledged process might cause the compositor to try and allocate
> > a lot of memory on it's behalf and this could fail. At least make
> > sure the exporter has managed to allocate the RAM at least once
> > before exporting the object.
>
> The below use of TTM_PL_FLAG_MEMCG suggests that this goes on top of your cgroup
> patch series. However, wouldn't a similar change make sense regardless?

Indeed, I just rebased it onto misc-next and dropped that parameter today.

Dave.
>