Re: [PATCH v3 7/8] dma-buf: transfer memcg charges via DMA_BUF_IOCTL_XFER_CHARGE

On 10/27/26 16:02, Albert Esteve wrote:

dma-heap already supports charging a specific cgroup at allocation time via charge_fd in DMA_HEAP_IOCTL_ALLOC. However, dma-bufs can originate from any exporter (DRM, V4L2, etc.), and the allocator may not know the final owner at allocation time.

Add DMA_BUF_IOCTL_XFER_CHARGE to transfer a dma-buf's memcg charge to a different cgroup after allocation. The target is identified by charge_fd, which may be a cgroupfd or a pidfd.

The transfer charges the new cgroup before uncharging the old one, preserving the original charge on failure. An atomic cmpxchg on dmabuf->memcg prevents races with concurrent transfers.

Not all dma-buf exporters back their buffers with reclaimable system memory. Some represent device registers, VRAM, or carved-out pools where size is not a meaningful memory cost. Add a memcg_account flag to dma_buf_export_info that exporters set when their buffers should participate in memcg accounting. The xfer ioctl returns -EOPNOTSUPP for buffers that do not set the flag. Currently only the system heap sets it, other exporters can opt in as needed.

Usage example: int cg_fd = open("/sys/fs/cgroup/clients/app1", O_RDONLY | O_DIRECTORY);

struct dma_buf_transfer_charge xfer = { .charge_fd = cg_fd, }; ioctl(dmabuf_fd, DMA_BUF_IOCTL_XFER_CHARGE, &xfer); /* charge now on app1's cgroup */ close(cg_fd);

Signed-off-by: Albert Esteve aesteve@redhat.com

drivers/dma-buf/dma-buf.c | 43 +++++++++++++++++++++++++++++++++++++ drivers/dma-buf/heaps/system_heap.c | 1 + include/linux/dma-buf.h | 5 +++++ include/linux/memcontrol.h | 9 ++++++++ include/uapi/linux/dma-buf.h | 26 ++++++++++++++++++++++ mm/memcontrol.c | 41 +++++++++++++++++++++++++++++++++++ 6 files changed, 125 insertions(+)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index f31f49ebd0af..07513ecedc10 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -540,6 +540,45 @@ static long dma_buf_import_sync_file(struct dma_buf *dmabuf, } #endif +/* Transfer a dma-buf's memcg charge; see struct dma_buf_transfer_charge */ +static long dma_buf_xfer_charge(struct dma_buf *dmabuf,

• 		const void __user *user_data)
  

+{

• struct dma_buf_transfer_charge arg;
• struct mem_cgroup *memcg;
• int ret = 0;
• if (copy_from_user(&arg, user_data, sizeof(arg)))

• return -EFAULT;
  

• if (!IS_ENABLED(CONFIG_MEMCG))

• return 0;
  

• if (arg.flags != 0)

• return -EINVAL;
  

• if (!dmabuf->memcg_account)

• return -EOPNOTSUPP;
  

• memcg = mem_cgroup_get_from_fd(arg.charge_fd);
• if (IS_ERR(memcg))

• return PTR_ERR(memcg);
  

• if (dmabuf->memcg == memcg)

• goto skip_transfer;
  

• if (!mem_cgroup_transfer_dmabuf_charge(dmabuf, memcg)) {

• ret = -ENOMEM;
  

• goto skip_transfer;
  

• }
• return 0;

+skip_transfer:

• mem_cgroup_put(memcg);
• return ret;

+}

static long dma_buf_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { @@ -590,6 +629,9 @@ static long dma_buf_ioctl(struct file *file, return dma_buf_import_sync_file(dmabuf, (const void __user *)arg); #endif

• case DMA_BUF_IOCTL_XFER_CHARGE:

• return dma_buf_xfer_charge(dmabuf, (const void __user *)arg);
  

• default: return -ENOTTY; }

@@ -750,6 +792,7 @@ struct dma_buf *dma_buf_export(const struct dma_buf_export_info *exp_info) dmabuf->size = exp_info->size; dmabuf->exp_name = exp_info->exp_name; dmabuf->owner = exp_info->owner;

• dmabuf->memcg_account = exp_info->memcg_account;

The initial charging should probably be done here as well.

This way DMA-buf heaps only needs to pass in the charge_fd and we can re-use the functionality for other DMA-buf exporters as well.

spin_lock_init(&dmabuf->name_lock); init_waitqueue_head(&dmabuf->poll); dmabuf->cb_in.poll = dmabuf->cb_out.poll = &dmabuf->poll; diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c index adeea8cd328b..a764167167ba 100644 --- a/drivers/dma-buf/heaps/system_heap.c +++ b/drivers/dma-buf/heaps/system_heap.c @@ -479,6 +479,7 @@ static struct dma_buf *system_heap_allocate(struct dma_heap *heap, exp_info.size = buffer->len; exp_info.flags = fd_flags; exp_info.priv = buffer;

• exp_info.memcg_account = true; dmabuf = dma_buf_export(&exp_info); if (IS_ERR(dmabuf)) { ret = PTR_ERR(dmabuf);

diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index 23ec0ff23fba..ac0ec88cab93 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -433,6 +433,9 @@ struct dma_buf { /** @memcg: the cgroup to which this buffer is currently attributed */ struct mem_cgroup *memcg;

• /** @memcg_account: account buffer memory to cgroup */
• bool memcg_account;

}; /** @@ -505,6 +508,7 @@ struct dma_buf_attachment {

• @flags: mode flags for the file
• @resv: reservation-object, NULL to allocate default one
• @priv: Attach private data of allocator to this buffer

• • @memcg_account: account buffer memory to cgroup
  • This structure holds the information required to export the buffer. Used
  • with dma_buf_export() only.

@@ -517,6 +521,7 @@ struct dma_buf_export_info { int flags; struct dma_resv *resv; void *priv;

• bool memcg_account;

}; /** diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h index 6b30baa79fa9..36fddafbef4e 100644 --- a/include/linux/memcontrol.h +++ b/include/linux/memcontrol.h @@ -679,6 +679,9 @@ bool mem_cgroup_reserve_dmabuf(struct mem_cgroup *memcg, gfp_t gfp, void mem_cgroup_commit_dmabuf(struct dma_buf *dmabuf, struct mem_cgroup *memcg, unsigned int nr_pages); +bool mem_cgroup_transfer_dmabuf_charge(struct dma_buf *dmabuf,

• 		       struct mem_cgroup *new_memcg);
  

void __mem_cgroup_uncharge(struct folio *folio); /** @@ -1206,6 +1209,12 @@ static inline void mem_cgroup_cancel_dmabuf(struct mem_cgroup *memcg, { } +static inline bool mem_cgroup_transfer_dmabuf_charge(struct dma_buf *dmabuf,

• 				     struct mem_cgroup *new_memcg)
  

+{

• return true;

+}

static inline void mem_cgroup_uncharge(struct folio *folio) { } diff --git a/include/uapi/linux/dma-buf.h b/include/uapi/linux/dma-buf.h index e827c9d20c5d..ea957f4b1d38 100644 --- a/include/uapi/linux/dma-buf.h +++ b/include/uapi/linux/dma-buf.h @@ -168,6 +168,31 @@ struct dma_buf_import_sync_file { __s32 fd; }; +/**

• • struct dma_buf_transfer_charge - Transfer a dma-buf's memcg charge
• • Any holder of a dma-buf file descriptor can perform a
• • DMA_BUF_IOCTL_XFER_CHARGE to attribute the buffer's memory
• • cost to a specific cgroup, or move it from one cgroup to
• • another. The ioctl charges the new cgroup before uncharging
• • the old one atomically. On failure the original charge is
• • preserved. If the buffer has no existing charge, a new
• • charge is established.
• */

+struct dma_buf_transfer_charge {

• /** @flags: Reserved, must be zero */
• __u32 flags; /* unused for now */
• /**

• * @charge_fd: File descriptor identifying the target cgroup.
  

• *
  

• * May be either a pidfd, in which case the charge moves to the
  

• * memory cgroup of the referenced process, or a cgroupfd obtained
  

• * by opening a cgroup v2 directory, in which case the charge moves
  

• * directly to that cgroup's memory controller.
  

• */
  

• __u32 charge_fd;

+};

#define DMA_BUF_BASE 'b' #define DMA_BUF_IOCTL_SYNC _IOW(DMA_BUF_BASE, 0, struct dma_buf_sync) @@ -179,5 +204,6 @@ struct dma_buf_import_sync_file { #define DMA_BUF_SET_NAME_B _IOW(DMA_BUF_BASE, 1, __u64) #define DMA_BUF_IOCTL_EXPORT_SYNC_FILE _IOWR(DMA_BUF_BASE, 2, struct dma_buf_export_sync_file) #define DMA_BUF_IOCTL_IMPORT_SYNC_FILE _IOW(DMA_BUF_BASE, 3, struct dma_buf_import_sync_file) +#define DMA_BUF_IOCTL_XFER_CHARGE _IOW(DMA_BUF_BASE, 4, struct dma_buf_transfer_charge) #endif diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 7b841b905759..3adc84fe6668 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5786,6 +5786,47 @@ void mem_cgroup_cancel_dmabuf(struct mem_cgroup *memcg, unsigned int nr_pages) refill_stock(memcg, nr_pages); } +/**

• • mem_cgroup_transfer_dmabuf_charge - move a dma-buf charge
• • @dmabuf: buffer to transfer charge
• • @new_memcg: target memcg; caller must hold a reference
• • Transfers the charge for @dmabuf to @new_memcg and, on
• • success, stores @new_memcg in @dmabuf->memcg.
• • Returns %true on success, %false if the charge against @new_memcg
• • failed or a concurrent transfer raced on @dmabuf->memcg.
• • On failure the caller retains its reference to @new_memcg.
• */

+bool mem_cgroup_transfer_dmabuf_charge(struct dma_buf *dmabuf,

• 		       struct mem_cgroup *new_memcg)
  

I would make that more generic instead of dmabuf specific. E.g. something like this:

bool mem_cgroup_transfer_charge(struct struct mem_cgroup **ptr_memcg, struct mem_cgroup *new_memcg, enum memcg_stat_item item, unsigned int nr_pages)

+{

• struct mem_cgroup *old_memcg = READ_ONCE(dmabuf->memcg);

• unsigned int nr_pages = PAGE_ALIGN(dmabuf->size) >> PAGE_SHIFT;

This way we can also document in the DMA-buf caller that this conversation must be ok when memcg_account is true.

Regards, Christian.

• if (mem_cgroup_disabled())

• return true;
  

• if (!mem_cgroup_reserve_dmabuf(new_memcg, GFP_KERNEL, nr_pages))

• return false;
  

• mod_memcg_state(new_memcg, MEMCG_DMABUF, nr_pages);
• if (cmpxchg(&dmabuf->memcg, old_memcg, new_memcg) != old_memcg) {

• mod_memcg_state(new_memcg, MEMCG_DMABUF, -nr_pages);
  

• mem_cgroup_cancel_dmabuf(new_memcg, nr_pages);
  

• return false;
  

• }
• if (old_memcg) {

• /* Uncharge old cgroup */
  

• mod_memcg_state(old_memcg, MEMCG_DMABUF, -nr_pages);
  

• mem_cgroup_cancel_dmabuf(old_memcg, nr_pages);
  

• mem_cgroup_put(old_memcg);
  

• }
• return true;

+}

/**

• mem_cgroup_uncharge_dmabuf - uncharge a dma-buf from its memcg
• @dmabuf: buffer to uncharge