On Wed, Nov 04, 2026 at 05:16:27PM -0800, Niranjana Vishwanathapura wrote:
> On Wed, Nov 04, 2026 at 01:52:28PM -0800, Matthew Brost wrote:
> > From: Thomas Hellström <[email protected]>
> >
> > Expose per-page-order DMA mapping counts for the system memory that the
> > xe driver maps for GPU access, split into two categories: TTM buffer
> > objects, and the GPU SVM / userptr ranges (which share a single
> > drm_gpusvm instance per VM).
> >
> > The stats are visible at:
> >
> > <debugfs>/dri/<N>/dma_mapped_pages
> >
> > and are broken out into two rows (bo, svm/userptr), one column per page
> > order, mirroring the layout of the TTM pool page_pool stat.
> >
> > For TTM BOs the per-order counts are derived from the DMA scatter-gather
> > table: each mapped segment is physically contiguous, so its page count is
> > split into the largest power-of-two runs (a segment of N pages contributes
> > a 2^k chunk for the largest k with 2^k <= N, repeated for the remainder).
> > Driving the accounting off the sg table rather than the pages[] array keeps
> > it correct even when pages[] entries are cleared while still DMA-mapped,
> > as happens on the defrag page-borrowing path. Dma-buf BOs are not
> > accounted for in dma_mapped_pages stats.
> >
> > For the SVM and userptr ranges the accounting is driven by the
> > drm_gpusvm @dma_map_account callback, which fires once per dma_addr[]
> > entry at the exact point the entry is DMA-mapped and unmapped. This
> > makes the accounting symmetric by construction and avoids driver-side
> > walks that could drift across migration, partial unmaps and the iova vs
> > non-iova paths. Only DRM_INTERCONNECT_SYSTEM entries are real DMA maps
> > and counted; device interconnect (VRAM, P2P) entries are skipped, so the
> > counter reflects only system pages actually mapped through the DMA layer.
> >
> > The callback is shared between the full SVM instance (fault mode) and the
> > core drm_gpusvm_pages-only instance used for userptr, so userptr
> > mappings are accounted in both the CONFIG_DRM_XE_GPUSVM=y and =n (but
> > CONFIG_DRM_GPUSVM=y) configurations, into the same svm/userptr counter.
> >
> > Since the counts are only ever consumed through debugfs, gate the counter
> > storage and all accounting on CONFIG_DEBUG_FS so that builds without
> > debugfs carry no extra atomic traffic or device state; the drm_gpusvm
> > callback is simply left unregistered in that case.
> >
> > On device teardown assert that every counter has returned to zero, to
> > catch any unbalanced accounting (a leaked DMA mapping) during testing.
> >
> > Assisted-by: LLM
> > Signed-off-by: Thomas Hellström <[email protected]>
> > Signed-off-by: Matthew Brost <[email protected]>
> > ---
> > drivers/gpu/drm/xe/xe_bo.c | 53 ++++++++++++++++++++---
> > drivers/gpu/drm/xe/xe_debugfs.c | 26 ++++++++++++
> > drivers/gpu/drm/xe/xe_device.c | 30 +++++++++++++
> > drivers/gpu/drm/xe/xe_device_types.h | 17 ++++++++
> > drivers/gpu/drm/xe/xe_svm.c | 44 ++++++++++++++++++-
> > drivers/gpu/drm/xe/xe_svm.h | 4 +-
> > drivers/gpu/drm/xe/xe_userptr.c | 63 ++++++++++++++++++++++++++++
> > drivers/gpu/drm/xe/xe_userptr.h | 1 +
> > 8 files changed, 230 insertions(+), 8 deletions(-)
> >
> > diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c
> > index 42a6aa1a2e4a..a8031cb9c74f 100644
> > --- a/drivers/gpu/drm/xe/xe_bo.c
> > +++ b/drivers/gpu/drm/xe/xe_bo.c
> > @@ -396,6 +396,50 @@ struct xe_ttm_tt {
> > bool purgeable;
> > };
> >
> > +/*
> > + * xe_tt_account_dma_pages - account DMA-mapped tt pages per order
> > + * @xe: the xe device
> > + * @xe_tt: the xe_ttm_tt whose sg table to walk
> > + * @sign: +1 to add, -1 to subtract
> > + *
> > + * Walk the tt's DMA scatter-gather table and split each (physically
> > + * contiguous) segment into the largest power-of-two page runs: a segment
> > of N
> > + * pages contributes a 2^k chunk for the largest k with 2^k <= N, repeated
> > for
> > + * the remainder. Accumulate the count of 2^k pages into
> > + * xe->mem.dma_mapped_pages[k]. Driving this off the sg table rather than
> > + * tt->pages keeps the accounting correct even when pages[] entries are
> > cleared
> > + * while still DMA-mapped (e.g. the defrag page-borrowing path).
> > + */
> > +#if IS_ENABLED(CONFIG_DEBUG_FS)
> > +static void xe_tt_account_dma_pages(struct xe_device *xe,
> > + struct xe_ttm_tt *xe_tt, int sign)
> > +{
> > + struct scatterlist *sg;
> > + unsigned int i;
> > +
> > + for_each_sgtable_sg(xe_tt->sg, sg, i) {
> > + unsigned long nr_pages = sg->length >> PAGE_SHIFT;
> > +
> > + while (nr_pages) {
> > + unsigned int order = min_t(unsigned int,
> > + __fls(nr_pages),
> > + MAX_PAGE_ORDER);
> > + unsigned long chunk = 1UL << order;
> > +
> > + atomic_long_add((long)chunk * sign,
> > + &xe->mem.dma_mapped_pages[order]);
> > +
>
> Here both array index and array value is clamped.
> But in the svm case below, only the array index is clamped, but not the value.
> I guess here we don't expect huge pages? If so, should we be clamping here
> or asserting if order is bigger than MAX_PAGE_ORDER?
>
What? I'm not following this at all.
The SVM case we clamp the index to the highest order + add the actual order.
Here we decompose a segment to into individual orders, clamping at the
highest order.
> > + nr_pages -= chunk;
> > + }
> > + }
> > +}
> > +#else
> > +static void xe_tt_account_dma_pages(struct xe_device *xe,
> > + struct xe_ttm_tt *xe_tt, int sign)
> > +{
> > +}
> > +#endif
> > +
> > static int xe_tt_map_sg(struct xe_device *xe, struct ttm_tt *tt)
> > {
> > struct xe_ttm_tt *xe_tt = container_of(tt, struct xe_ttm_tt, ttm);
> > @@ -425,6 +469,7 @@ static int xe_tt_map_sg(struct xe_device *xe, struct
> > ttm_tt *tt)
> > return ret;
> > }
> >
> > + xe_tt_account_dma_pages(xe, xe_tt, 1);
> > return 0;
> > }
> >
> > @@ -433,6 +478,7 @@ static void xe_tt_unmap_sg(struct xe_device *xe, struct
> > ttm_tt *tt)
> > struct xe_ttm_tt *xe_tt = container_of(tt, struct xe_ttm_tt, ttm);
> >
> > if (xe_tt->sg) {
> > + xe_tt_account_dma_pages(xe, xe_tt, -1);
> > dma_unmap_sgtable(xe->drm.dev, xe_tt->sg,
> > DMA_BIDIRECTIONAL, 0);
> > sg_free_table(xe_tt->sg);
> > @@ -1800,11 +1846,8 @@ int xe_bo_dma_unmap_pinned(struct xe_bo *bo)
> > ttm_bo->sg = NULL;
> > xe_tt->sg = NULL;
> > } else if (xe_tt->sg) {
> > -
> > dma_unmap_sgtable(ttm_to_xe_device(ttm_bo->bdev)->drm.dev,
> > - xe_tt->sg,
> > - DMA_BIDIRECTIONAL, 0);
> > - sg_free_table(xe_tt->sg);
> > - xe_tt->sg = NULL;
> > + xe_tt_unmap_sg(ttm_to_xe_device(ttm_bo->bdev),
> > + &xe_tt->ttm);
> > }
> > }
> >
> > diff --git a/drivers/gpu/drm/xe/xe_debugfs.c
> > b/drivers/gpu/drm/xe/xe_debugfs.c
> > index e59d4964d811..1a306b6523e7 100644
> > --- a/drivers/gpu/drm/xe/xe_debugfs.c
> > +++ b/drivers/gpu/drm/xe/xe_debugfs.c
> > @@ -7,6 +7,7 @@
> >
> > #include <linux/bits.h>
> > #include <linux/debugfs.h>
> > +#include <linux/mmzone.h>
> > #include <linux/fault-inject.h>
> > #include <linux/string_helpers.h>
> >
> > @@ -345,6 +346,28 @@ static int dgfx_pcie_link_residencies_show(struct
> > seq_file *m, void *data)
> > return 0;
> > }
> >
> > +static int dma_mapped_pages_show(struct seq_file *m, void *data)
> > +{
> > + struct xe_device *xe = m->private;
> > + unsigned int i;
> > +
> > + seq_printf(m, "%-11s ", "");
> > + for (i = 0; i < NR_PAGE_ORDERS; i++)
> > + seq_printf(m, " ---%2u---", i);
> > + seq_printf(m, "\n%-11s:", "bo");
> > + for (i = 0; i < NR_PAGE_ORDERS; i++)
> > + seq_printf(m, " %8lu",
> > + atomic_long_read(&xe->mem.dma_mapped_pages[i]));
> > + seq_printf(m, "\n%-11s:", "svm/userptr");
> > + for (i = 0; i < NR_PAGE_ORDERS; i++)
> > + seq_printf(m, " %8lu",
> > + atomic_long_read(&xe->mem.dma_mapped_pages_svm[i]));
>
> The array values are signed long, but printed as unsigned.
> Should we use '%8l' instead of '%8lu'?
>
If we ever underflow that is problem, I guess %8l would have that clear.
> Also, under each order column, we are not printing the number of pages
> of that order, but instead the 4kb page count mapped in that order.
> Is that intended?
Yes.
> As we are counting huge pages in the highest order bucket, counting the
> 4kb page count seems necessary here. But perhaps needs to be documented.
>
A segment can be larger NR_PAGE_ORDERS, thus we clamp large segments
into the highest order. I don't we really need much an explaination, the
debugfs clearly shows if we getting higher order pages, which is the
information we are looking for during debug of perf problems on iGPU.
> Niranjana
>
> > + seq_puts(m, "\n");
> > +
> > + return 0;
> > +}
> > +DEFINE_SHOW_ATTRIBUTE(dma_mapped_pages);
> > +
> > static const struct drm_info_list debugfs_list[] = {
> > {"info", info, 0},
> > { .name = "sriov_info", .show = sriov_info, },
> > @@ -765,6 +788,9 @@ void xe_debugfs_register(struct xe_device *xe)
> >
> > xe_ttm_vram_debugfs_init(xe, root);
> >
> > + debugfs_create_file("dma_mapped_pages", 0444, root, xe,
> > + &dma_mapped_pages_fops);
> > +
> > for_each_tile(tile, xe, tile_id)
> > xe_tile_debugfs_register(tile);
> >
> > diff --git a/drivers/gpu/drm/xe/xe_device.c b/drivers/gpu/drm/xe/xe_device.c
> > index 273e2c45fea9..c40bb8f7c697 100644
> > --- a/drivers/gpu/drm/xe/xe_device.c
> > +++ b/drivers/gpu/drm/xe/xe_device.c
> > @@ -377,12 +377,42 @@ bool xe_device_is_admin_only(const struct xe_device
> > *xe)
> > /* Number of allocated struct xe_device */
> > static atomic_t xe_device_count;
> >
> > +#if IS_ENABLED(CONFIG_DEBUG_FS)
> > +static void xe_device_assert_dma_pages_zero(struct xe_device *xe)
> > +{
> > + unsigned int i;
> > +
> > + /*
> > + * All BOs, userptr VMAs and SVM ranges must have been torn down by the
> > + * time the device is destroyed, so every DMA-mapped-pages counter must
> > + * have returned to zero. A non-zero value indicates unbalanced
> > + * accounting, i.e. a missing unmap-side decrement.
> > + */
> > + for (i = 0; i < NR_PAGE_ORDERS; i++) {
> > + xe_assert(xe, !atomic_long_read(&xe->mem.dma_mapped_pages[i]));
> > + xe_assert(xe,
> > !atomic_long_read(&xe->mem.dma_mapped_pages_svm[i]));
> > + }
>
> xe_assert() is only valid with CONFIG_DRM_XE_DEBUG.
> So, it is kind of tied to CONFIG_DRM_XE_DEBUG. So, it goes back to original
> comment as to if we should make it xe debug specific and only make the
> debugfs interface part CONFIG_DEBUG_FS specific?
> I am fine either way.
>
> > +}
> > +#else
> > +static void xe_device_assert_dma_pages_zero(struct xe_device *xe)
> > +{
> > +}
> > +#endif
> > +
> > static void xe_device_destroy(struct drm_device *dev, void *dummy)
> > {
> > struct xe_device *xe = to_xe_device(dev);
> >
> > xe_bo_dev_fini(&xe->bo_device);
> >
> > + /*
> > + * Assert the DMA-mapped-pages accounting only after xe_bo_dev_fini()
> > + * has flushed the async BO-free worker: BOs pending async free still
> > + * hold their DMA mappings (and counts) until the worker runs, so
> > + * asserting before the flush could trip a false positive.
> > + */
> > + xe_device_assert_dma_pages_zero(xe);
> > +
> > if (xe->preempt_fence_wq)
> > destroy_workqueue(xe->preempt_fence_wq);
> >
> > diff --git a/drivers/gpu/drm/xe/xe_device_types.h
> > b/drivers/gpu/drm/xe/xe_device_types.h
> > index d99881c6e1d5..e816db751da4 100644
> > --- a/drivers/gpu/drm/xe/xe_device_types.h
> > +++ b/drivers/gpu/drm/xe/xe_device_types.h
> > @@ -6,6 +6,7 @@
> > #ifndef _XE_DEVICE_TYPES_H_
> > #define _XE_DEVICE_TYPES_H_
> >
> > +#include <linux/mmzone.h>
> > #include <linux/pci.h>
> >
> > #include <drm/drm_device.h>
> > @@ -302,6 +303,22 @@ struct xe_device {
> > struct xe_shrinker *shrinker;
> > /** @mem.stolen_mgr: stolen memory manager. */
> > struct xe_ttm_stolen_mgr *stolen_mgr;
> > +#if IS_ENABLED(CONFIG_DEBUG_FS)
> > + /**
> > + * @mem.dma_mapped_pages: number of DMA-mapped pages per page
> > + * order currently live for this device, for TTM BOs. Only
> > + * accounted when CONFIG_DEBUG_FS is enabled, since it is solely
> > + * exposed through debugfs.
> > + */
> > + atomic_long_t dma_mapped_pages[NR_PAGE_ORDERS];
> > + /**
> > + * @mem.dma_mapped_pages_svm: number of DMA-mapped pages per
> > + * page order currently live for this device, for SVM ranges
> > + * and userptr VMAs (both share a single drm_gpusvm instance).
> > + * Only accounted when CONFIG_DEBUG_FS is enabled.
> > + */
> > + atomic_long_t dma_mapped_pages_svm[NR_PAGE_ORDERS];
> > +#endif
> > } mem;
> >
> > /** @sriov: device level virtualization data */
> > diff --git a/drivers/gpu/drm/xe/xe_svm.c b/drivers/gpu/drm/xe/xe_svm.c
> > index 909a602d091e..7a4988289749 100644
> > --- a/drivers/gpu/drm/xe/xe_svm.c
> > +++ b/drivers/gpu/drm/xe/xe_svm.c
> > @@ -845,10 +845,50 @@ static int xe_svm_get_pagemaps(struct xe_vm *vm)
> > }
> > #endif
> >
> > +#if IS_ENABLED(CONFIG_DEBUG_FS)
> > +/*
> > + * xe_svm_dma_map_account - drm_gpusvm DMA-mapping accounting callback
> > + * @gpusvm: The GPU SVM the mapping belongs to
> > + * @addr: The address descriptor of the chunk being (un)mapped
> > + * @sign: +1 when @addr was DMA-mapped, -1 when it is being unmapped
> > + *
> > + * Maintain per-order counts of the system-memory pages that the full SVM
> > + * instance (SVM ranges, and userptr VMAs in fault mode) has DMA-mapped
> > for GPU
> > + * access. Only DRM_INTERCONNECT_SYSTEM entries are real DMA maps and
> > counted;
> > + * device interconnect (VRAM, P2P) entries are skipped. The counts are
> > solely
> > + * exposed through debugfs, so the callback is only registered when
> > + * CONFIG_DEBUG_FS is enabled.
> > + */
> > +static void xe_svm_dma_map_account(struct drm_gpusvm *gpusvm,
> > + const struct drm_pagemap_addr *addr,
> > + int sign)
> > +{
> > + struct xe_device *xe = gpusvm_to_vm(gpusvm)->xe;
> > + unsigned int order = addr->order;
> > +
> > + if (addr->proto != DRM_INTERCONNECT_SYSTEM)
> > + return;
> > +
> > + /*
> > + * The CPU-PTE map order reported by hmm can exceed MAX_PAGE_ORDER
> > + * (e.g. an order-18 1GB mapping), so clamp the array index to avoid an
> > + * out-of-bounds access. Clamping is symmetric across the +1/-1 calls,
> > + * so the per-order counters stay balanced.
> > + */
> > + order = min(order, (unsigned int)NR_PAGE_ORDERS - 1);
> > +
> > + atomic_long_add((long)(1UL << addr->order) * sign,
> > + &xe->mem.dma_mapped_pages_svm[order]);
> > +}
>
> This seems identical to xe_userptr_dma_map_account() except that there
> gpusvm_to_vm() helper is not there, hence needs to be expanded.
> Can we combine these two helpers into one?
>
I guess one of files can export it and they can share code.
Matt
> > +#endif
> > +
> > static const struct drm_gpusvm_ops gpusvm_ops = {
> > .range_alloc = xe_svm_range_alloc,
> > .range_free = xe_svm_range_free,
> > .invalidate = xe_svm_invalidate,
> > +#if IS_ENABLED(CONFIG_DEBUG_FS)
> > + .dma_map_account = xe_svm_dma_map_account,
> > +#endif
> > };
> >
> > static const unsigned long fault_chunk_sizes[] = {
> > @@ -946,8 +986,8 @@ int xe_svm_init(struct xe_vm *vm)
> > }
> > } else {
> > err = drm_gpusvm_init(&vm->svm.gpusvm, "Xe SVM (simple)",
> > - NULL, 0, 0, 0, NULL,
> > - NULL, 0);
> > + NULL, 0, 0, 0,
> > + xe_userptr_gpusvm_ops_get(), NULL, 0);
> > if (err)
> > goto out_err;
> > }
> > diff --git a/drivers/gpu/drm/xe/xe_svm.h b/drivers/gpu/drm/xe/xe_svm.h
> > index ffc1cc808102..f8b908a74ba9 100644
> > --- a/drivers/gpu/drm/xe/xe_svm.h
> > +++ b/drivers/gpu/drm/xe/xe_svm.h
> > @@ -249,6 +249,7 @@ struct drm_pagemap *xe_drm_pagemap_from_fd(int fd, u32
> > region_instance);
> >
> > #else
> > #include <linux/interval_tree.h>
> > +#include "xe_userptr.h"
> > #include "xe_vm.h"
> >
> > struct drm_pagemap_addr;
> > @@ -296,7 +297,8 @@ int xe_svm_init(struct xe_vm *vm)
> > {
> > #if IS_ENABLED(CONFIG_DRM_GPUSVM)
> > return drm_gpusvm_init(&vm->svm.gpusvm, "Xe SVM (simple)",
> > - NULL, 0, 0, 0, NULL, NULL, 0);
> > + NULL, 0, 0, 0,
> > + xe_userptr_gpusvm_ops_get(), NULL, 0);
> > #else
> > return 0;
> > #endif
> > diff --git a/drivers/gpu/drm/xe/xe_userptr.c
> > b/drivers/gpu/drm/xe/xe_userptr.c
> > index 9c1dac0fce6f..40f97bd4751d 100644
> > --- a/drivers/gpu/drm/xe/xe_userptr.c
> > +++ b/drivers/gpu/drm/xe/xe_userptr.c
> > @@ -8,9 +8,72 @@
> >
> > #include <linux/mm.h>
> >
> > +#include <drm/drm_pagemap.h>
> > +
> > #include "xe_tlb_inval.h"
> > #include "xe_trace_bo.h"
> >
> > +#if IS_ENABLED(CONFIG_DEBUG_FS)
> > +/*
> > + * xe_userptr_dma_map_account - drm_gpusvm DMA-mapping accounting callback
> > + * @gpusvm: The GPU SVM the mapping belongs to
> > + * @addr: The address descriptor of the chunk being (un)mapped
> > + * @sign: +1 when @addr was DMA-mapped, -1 when it is being unmapped
> > + *
> > + * Account, per page order, the system-memory pages DMA-mapped for GPU
> > access
> > + * through the drm_gpusvm_pages instance shared by userptr (and, in fault
> > mode,
> > + * SVM). Only DRM_INTERCONNECT_SYSTEM entries are real DMA maps and
> > counted;
> > + * device interconnect (VRAM, P2P) entries are skipped. The counts are
> > solely
> > + * exposed through debugfs, so the callback is only registered when
> > + * CONFIG_DEBUG_FS is enabled.
> > + */
> > +static void xe_userptr_dma_map_account(struct drm_gpusvm *gpusvm,
> > + const struct drm_pagemap_addr *addr,
> > + int sign)
> > +{
> > + struct xe_vm *vm = container_of(gpusvm, struct xe_vm, svm.gpusvm);
> > + unsigned int order = addr->order;
> > +
> > + if (addr->proto != DRM_INTERCONNECT_SYSTEM)
> > + return;
> > +
> > + /*
> > + * The CPU-PTE map order reported by hmm can exceed MAX_PAGE_ORDER
> > + * (e.g. an order-18 1GB mapping), so clamp the array index to avoid an
> > + * out-of-bounds access. Clamping is symmetric across the +1/-1 calls,
> > + * so the per-order counters stay balanced.
> > + */
> > + order = min(order, (unsigned int)NR_PAGE_ORDERS - 1);
> > +
> > + atomic_long_add((long)(1UL << addr->order) * sign,
> > + &vm->xe->mem.dma_mapped_pages_svm[order]);
> > +}
> > +
> > +static const struct drm_gpusvm_ops xe_userptr_gpusvm_ops = {
> > + .dma_map_account = xe_userptr_dma_map_account,
> > +};
> > +#endif
> > +
> > +/**
> > + * xe_userptr_gpusvm_ops_get() - Accounting ops for the simple gpusvm
> > instance
> > + *
> > + * The core drm_gpusvm_pages-only instance used for userptr (and, in fault
> > + * mode, shared with SVM) is initialised with these ops so that DMA-mapped
> > + * system pages are accounted and exposed through debugfs. Returns NULL
> > when
> > + * CONFIG_DEBUG_FS is disabled, in which case no accounting is kept and the
> > + * instance is initialised without ops.
> > + *
> > + * Return: Pointer to the restricted &drm_gpusvm_ops, or NULL.
> > + */
> > +const struct drm_gpusvm_ops *xe_userptr_gpusvm_ops_get(void)
> > +{
> > +#if IS_ENABLED(CONFIG_DEBUG_FS)
> > + return &xe_userptr_gpusvm_ops;
> > +#else
> > + return NULL;
> > +#endif
> > +}
> > +
> > static void xe_userptr_assert_in_notifier(struct xe_vm *vm)
> > {
> > lockdep_assert(lockdep_is_held_type(&vm->svm.gpusvm.notifier_lock, 0) ||
> > diff --git a/drivers/gpu/drm/xe/xe_userptr.h
> > b/drivers/gpu/drm/xe/xe_userptr.h
> > index 2a3cd1b5efbb..1e9601be5713 100644
> > --- a/drivers/gpu/drm/xe/xe_userptr.h
> > +++ b/drivers/gpu/drm/xe/xe_userptr.h
> > @@ -108,6 +108,7 @@ int __xe_vm_userptr_needs_repin(struct xe_vm *vm);
> > int xe_vm_userptr_check_repin(struct xe_vm *vm);
> > int xe_vma_userptr_pin_pages(struct xe_userptr_vma *uvma);
> > int xe_vma_userptr_check_repin(struct xe_userptr_vma *uvma);
> > +const struct drm_gpusvm_ops *xe_userptr_gpusvm_ops_get(void);
> > #else
> > static inline void xe_userptr_remove(struct xe_userptr_vma *uvma) {}
> >
> > --
> > 2.34.1
> >
