Linaro-mm-sig October 2026

linaro-mm-sig@lists.linaro.org

25 participants
83 discussions

[PATCH] kselftests: dmabuf-heaps: Open heap device files O_RDONLY

by T.J. Mercier

Write permissions on the /dev/dma_heap/* device files are not required to issue ioctls and allocate dmabufs. Applications should be opening these file as O_RDONLY. The BPF dmabuf_iter selftest already does this. [1] Users are pointing to these selftests as examples of how use dmabuf, and encountering permission errors on systems where write permissions are not available on /dev/dma_heap/*. Apply the principle of least privilege to selftests which open dmabuf heaps by removing the write access mode and using O_RDONLY for the open() instead. The same is true for the vgem test using /dev/dri/card. [1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/too… Signed-off-by: T.J. Mercier <tjmercier(a)google.com> --- tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c b/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c index fc9694fc4e89..45b420e37c97 100644 --- a/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c +++ b/tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c @@ -48,7 +48,7 @@ static int open_vgem(void) snprintf(name, 80, "%s%u", drmstr, i); - fd = open(name, O_RDWR); + fd = open(name, O_RDONLY); if (fd < 0) continue; @@ -96,7 +96,7 @@ static int dmabuf_heap_open(char *name) if (ret < 0) ksft_exit_fail_msg("snprintf failed! %d\n", ret); - fd = open(buf, O_RDWR); + fd = open(buf, O_RDONLY); if (fd < 0) ksft_exit_fail_msg("open %s failed: %s\n", buf, strerror(errno)); base-commit: 9a11db68872055e6ead919bad04d6330851c522d -- 2.55.0.679.g6767b8d81c-goog

1 day, 11 hours

[PATCH v3 0/3] dma-buf: dmabuf->file release-time cleanup

by Matt Evans

Hi all, A fix for DMABUF's file-release path, to set dmabuf->file = NULL when the struct file itself is being freed and avoid a stale pointer lingering. Previously it could be assumed that dmabuf->file was always valid until .release was called, but commit 4ab59c3c638c6 ("dma-buf: Move dma_buf_release() from fops to dentry_ops") separated dentry release (calls .release) from file release (can happen before .release). Setting the pointer to NULL clearly delimits the period in which it points to a valid struct file. Raw dmabuf->file access is bad news unless the file is known to have a reference held (for example, during export). A single-threaded problem scenario is a dentry held open (e.g. using O_PATH) but the file closed; .release is not called, so the exporter was unaware that dmabuf->file became stale. Exporter activities using dmabuf->file then led to a UAF. Or, threads racing concurrent access with a file closing. VFIO uses get_file_active(&dmabuf->file), which is a UAF when the pointer goes stale. Alex Mastro has created a VFIO-centric reproducer [1], which shows up with KASAN. To fix, dmabuf->file is either valid or NULL. get_file_active() is then safe and a recommended way to access dmabuf->file without an existing reference. The only possible outcomes are for it to get a reference to the file, to observe a valid pointer but the file in the DEAD state (being closed, fail), or NULL (fail). Patch [3/3] sets the pointer NULL when the file closes, which get_file_active() handles correctly. vmwgfx was identified as doing a problematic dmabuf->file dereference. Although already a UAF, making dmabuf->file = NULL turns it into an oops. So, patch [1/3] correspondingly converts vmwgfx to use get_file_active() too. i915 GVT unsafely dereferences dmabuf->file for a trivial debug printout after the file reference moves to the dmabuf's fd, so patch [2/3] dereferences in the safe window. Added comments to highlight that dmabuf->file could go away before .release, and to use get_file_active() if a reference isn't otherwise already held. Thanks, Matt [1]: https://github.com/opsound/vfio-dmabuf-lab/blob/main/tests/vfio_dmabuf_opat… Changes: v3: - Better comment for struct dma_buf's file (refer to synchronisation against ->release). - Added trivial i915 patch to remove unsafe debug dmabuf->file accesss. v2: https://lore.kernel.org/all/20261009123601.94079-1-matt@ozlabs.org/ "v1" was the single "dma-buf: Annul dmabuf->file on file release" patch: https://lore.kernel.org/all/f8efaabd-c06e-4f04-8cfa-489c148e37ba@ozlabs.org/ Matt Evans (3): drm/vmwgfx: Use get_file_active() for dmabuf->file drm/i915/gvt: Read dmabuf->file only while valid dma-buf: Annul dmabuf->file on file release drivers/dma-buf/dma-buf.c | 21 ++++++++++++++++++--- drivers/gpu/drm/i915/gvt/dmabuf.c | 5 +++-- drivers/gpu/drm/vmwgfx/ttm_object.c | 2 +- include/linux/dma-buf.h | 5 ++++- 4 files changed, 26 insertions(+), 7 deletions(-) -- 2.47.3

1 week, 1 day

[PATCH v3 0/8] memcg: dma-buf cgroup accounting and charge transfer

by Albert Esteve

Shared-memory allocator services (e.g., Android's gralloc) allocate dma-bufs on behalf of client processes in different cgroups. Today those allocations are charged to the allocator's own cgroup, leaving client cgroups with no visibility into their actual memory consumption and defeating resource limits. This series adds memory cgroup accounting for dma-buf allocations, building on T.J. Mercier's earlier series [1] and incorporating feedback from previous versions and LPC discussions [2]. Patch 1 introduces the MEMCG_DMABUF stat and reserve/commit/cancel and uncharge helpers. Rather than charging at the page level via __GFP_ACCOUNT (which would require every dma-buf exporter to implement charging, and makes cross-cgroup transfer impractical without access to backing pages), we track charges externally on struct dma_buf via a MEMCG_DMABUF stat counter and route all accounting through a single path, removing the __GFP_ACCOUNT flag from system-heap allocations to avoid double counting. Patch 2 adds a charge_fd field to DMA_HEAP_IOCTL_ALLOC, accepting either a pidfd or a cgroupfd to identify the target cgroup at allocation time. If the target cgroup cannot accommodate the charge, the allocation returns -ENOMEM. Patches 3-6 add access control for cross-cgroup charging. Letting userspace decide who to charge needs to be a privileged operation because it has material impact on OOM decission and resource limits. We gate it via LSM hooks for the two charge_fd flavours: security_dma_buf_charge_task() gates the pidfd path (target identified by task credentials) and security_dma_buf_charge_cgroup() gates the cgroupfd path (target identified by cgroup directory label), with SELinux implementations under a dma_buf object class. Patch 7 adds DMA_BUF_IOCTL_XFER_CHARGE, a general ioctl on any dma-buf fd to transfer charges post-allocation. This covers the double-hop allocator case (SurfaceFlinger -> gralloc -> kernel) and works for buffers from any exporter (DRM, V4L2, etc.). A new memcg_account flag is added for dma_buf_export() to ensure that transfer/charge is only applied for buffers backed by reclaimable system memory. If the receiving cgroup lacks capacity for the charge, the ioctl returns -ENOMEM and the original charge is preserved. Patch 8 adds selftests. Known limitations: - Single-owner model: a dma-buf carries one memcg charge regardless of how many processes share it. - Only memcg accounting. CMA heaps would additionally need dmem controller integration. - If a transfer of an uncharged buffer fails, it remains uncharged. The allocator (userspace) is expected to handle this (retry, free, ...). - The LSM hooks are intentionally narrow. Broader cgroup access controls (e.g. for the memfd/kexec handover case [2]) could be a separate effort reusing the same pattern. - Only system heap sets memcg_account today. Other exporters (DRM, V4L2, etc.) can opt in by setting the flag, but are not covered by this series. [1] https://lore.kernel.org/cgroups/20230109213809.418135-1-tjmercier@google.co… [2] https://lpc.events/event/20/contributions/2416/ Signed-off-by: Albert Esteve <aesteve(a)redhat.com> --- Changes in v3: - Split mem_cgroup_charge_dmabuf() into reserve/commit/cancel three-phase API - Extract mem_cgroup_get_from_fd() helper shared by allocate and xfer paths - Rename __padding to flags in struct dma_buf_transfer_charge - Fix UAF race: move mod_memcg_state() before cmpxchg in transfer - Add memcg_account opt-in flag; xfer returns -EOPNOTSUPP if unset - Wrap dma_buf_charge_cgroup hook in #ifdef CONFIG_CGROUPS - Fix TOCTOU in SELinux charge_cgroup xattr length handling - Link to v2: https://lore.kernel.org/r/20261021-v2_20230123_tjmercier_google_com-v2-0-ef… Changes in v2: - Move charge_pid_fd to charge_fd, accepting cgroupfd in addition to pidfd per Christian König. - New DMA_BUF_IOCTL_XFER_CHARGE ioctl for post-allocation charge transfer on any dma-buf, not just dma-heap buffers per Christian König and T.J. Mercier. - Moved __GFP_ACCOUNT removal to patch 1 per Barry Song. - dma-buf charge/uncharge helpers take struct dma_buf * directly to avoid the need for caller to manage size calculations. - Added test_xfer_charge_cgroupfd_self to dmabuf-heap selftests. - Added LSM and SELinux hooks for cgroupfd-based charging. - Rebased to v7.3-rc7. - Link to v1: https://lore.kernel.org/r/20260512-v2_20230123_tjmercier_google_com-v1-0-63… --- Albert Esteve (7): dma-heap: charge dma-buf memory via explicit memcg security: dma-buf: Add dma_buf_charge_task LSM hook security: dma-buf: Add dma_buf_charge_cgroup LSM hook selinux: Restrict cross-cgroup dma-buf charging selinux: Restrict dma-buf direct cgroup charging dma-buf: transfer memcg charges via DMA_BUF_IOCTL_XFER_CHARGE selftests/dmabuf-heaps: Add dma-buf memcg accounting tests T.J. Mercier (1): memcg: Add MEMCG_DMABUF accounting infrastructure Documentation/admin-guide/cgroup-v2.rst | 5 + drivers/dma-buf/dma-buf.c | 46 ++++ drivers/dma-buf/dma-heap.c | 28 +- drivers/dma-buf/heaps/cma_heap.c | 3 +- drivers/dma-buf/heaps/system_heap.c | 22 +- drivers/tee/tee_heap.c | 3 +- include/linux/dma-buf.h | 9 + include/linux/dma-heap.h | 3 +- include/linux/lsm_hook_defs.h | 4 + include/linux/memcontrol.h | 52 ++++ include/linux/security.h | 18 ++ include/uapi/linux/dma-buf.h | 26 ++ include/uapi/linux/dma-heap.h | 7 + mm/memcontrol.c | 192 ++++++++++++++ security/security.c | 34 +++ security/selinux/hooks.c | 44 ++++ security/selinux/include/classmap.h | 1 + tools/testing/selftests/cgroup/Makefile | 2 +- tools/testing/selftests/cgroup/test_memcontrol.c | 290 ++++++++++++++++++++- tools/testing/selftests/dmabuf-heaps/config | 1 + tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 227 +++++++++++++++- tools/testing/selftests/dmabuf-heaps/vmtest.sh | 226 ++++++++++++++++ 22 files changed, 1228 insertions(+), 15 deletions(-) --- base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907 change-id: 20260508-v2_20230123_tjmercier_google_com-f44fcfb16530 Best regards, -- Albert Esteve <aesteve(a)redhat.com>

1 week, 1 day

Re: [PATCH] dma-buf: system_heap: Reject private mappings in system_heap_mmap()

by T.J. Mercier

On Fri, Oct 30, 2026 at 1:44 PM Chris Wiseman <chriswiseman(a)google.com> wrote: > > When commit 381295758792 ("dma-buf: system_heap: Rework system heap to > use sgtables instead of pagelists") stopped using heap_helpers.c and > added a custom system_heap_mmap(), the check rejecting private mappings > was dropped. > > Other exporters and buffer allocators reject private or copy-on-write > mappings in their mmap handlers: cma_heap_mmap() and mmap_udmabuf() > check that VM_SHARED or VM_MAYSHARE is set, and drm_gem_shmem_mmap() > and ttm_bo_mmap_obj() reject vma_is_cow_mapping(vma). > > However, system_heap_mmap() omits this check and calls remap_pfn_range() > even when userspace requests MAP_PRIVATE with PROT_WRITE. As a result, > subsequent CPU writes to a MAP_PRIVATE mapping of a system heap buffer > fault into do_wp_page() -> wp_page_copy(), silently allocating private > anonymous copy-on-write pages whose writes never reach the underlying > system heap buffer pages. > > Reject non-shared mappings in system_heap_mmap() with -EINVAL to match > cma_heap_mmap() and mmap_udmabuf(). > > Fixes: 381295758792 ("dma-buf: system_heap: Rework system heap to use sgtables instead of pagelists") > Cc: stable(a)vger.kernel.org > Signed-off-by: Chris Wiseman <chriswiseman(a)google.com> Reviewed-by: T.J. Mercier <tjmercier(a)google.com> I wonder if we should have this in dma_buf_mmap_internal() though. Any thoughts Sumit or Christian?

1 week, 1 day

Re: [PATCH 2/4] media: videobuf2: add opt-in DMA-BUF CPU access

by Nicolas Dufresne

Le jeudi 22 octobre 2026 à 06:04 +0200, Karl Mehltretter a écrit : > On Wed, Oct 21, 2026 at 05:03:19PM +0100, Nicolas Dufresne wrote: > > > I think the dma-buf API doesn't give us what we need. Cleaning the CPU > > > cache through end_cpu_access() when the producer is done writting to the > > > buffer is right in some use cases, but not in all of them. It assumes > > > that the next consumer will access the data through DMA, which isn't > > > always the case. What I think we need is to track the state of the > > > cache(s) in the dma_buf, and perform cache management operations > > > accordingly when needed. In the uvcvideo -> display use case for > > > instance, the dma_buf should track that the CPU cache is dirty when > > > finishing CPU access, and should be cleaned on the display side before > > > performing the DMA. In a use case where the producer would DMA to the > > > buffer, cache management would be skipped as the dma_buf would see that > > > the cache is not dirty. > > > > I also second this as the only viable option. Its not only about uvcvideo, but > > any memory imported by a driver doing DMA (which is not also the exporter). That > > includes udmabuf usage. These days, cache artifacts are visible with Intel > > display controllers, and Intel mobile GPU drivers. Note that GStreamer properly > > signal CPU read/write using DMABuf sync ioctl. > > > > For most Intel laptop user with GStreamer 1.28, these example produce artifacts > > on movement. To me, the solution is to track the cache state according to the > > access signalling (either userspace or driver), and let DMA user/consumer decide > > if a cache flush is needed. There is a obvious challenge in keeping this state > > coherent whenever there is multiple consumer, of if some broken application do > > concurrent write. Result for the last will always be undefined, but the dmabuf > > CPU cache state should not be undefined. > > > > For a persistently mapped attachment, where would the transition to > device access happen? > > dma_buf_map_attachment() may only run once, while the importer can > submit the buffer many times. Would this need a new per-attachment > operation before each submission, or can an existing event be used? In my perception, the mechanism in place, attach/detach and begin/end only work for very specific cases and breaks in most other case I can think of. > > I tested that distinction with one persistent V3D attachment on my Pi > 400 and Pi 500+: > > - If end_cpu_access() only recorded dirty state, with no sync before > submission, V3D read stale data in all 64 frames on both boards. > > - Synchronizing the attachment immediately before submission produced > 64/64 matching frames on both boards. > > This only covers V3D, but it seems that a dirty bit still needs a > device-side use event. Is that the model you had in mind? In my mind, we need to introduce new API. The problem with the being/end design is that it only works for specific pattern. Typically, on begin_cpu_access, you want to do specific action that ensure the CPU will see the right value in memory. One of these action could be to flush a device write cache for CPU read access. But unless only the exporter see these calls, and unless the device is the exporter, eveyrthing we have fall appart. With the new trend of always allocating from unified memory using dma heap, udmabuf and other non-device specific allocator, both device cache just breaks everything. Just like, an importer that need CPU write to be flushed breaks today. This last one seems obvious, just flush, but if the data came from another device, you might just kill the performance. I think if its just for the CPU cache state, to let importer that needs it know, we could introduce some sort of a bit mask (and some locking probably?) to help solve that. But we still leave the concept of device side memory cache broken. Nicolas > > Thanks, > Karl

1 week, 4 days

Re: [RFC PATCH 1/3] dma-buf: keep the DMA flags in the DMABUF_DEBUG copy

by Christian König

On 10/5/26 08:41, Karl Mehltretter wrote: > With DMABUF_DEBUG, dma_buf_map_attachment() hands the importer a copy > of the sg_table that keeps only sg_dma_address() and sg_dma_len(). The > dma_flags (SG_DMA_BUS_ADDRESS, SG_DMA_SWIOTLB) are dropped. > > The flags describe the DMA side of an entry, which is the side > importers may use. Copy them as well. > > This is not a bug fix. No importer reads the flags today. Their only > readers are dma-iommu, dma-direct and iommu_map_sg(), which are not > supposed to see an importer's copy at all. The warn mode added in the > next patch keeps its marker in dma_flags and lets importers that do > get there continue. They should then see the same flags as without > DMABUF_DEBUG. > > Assisted-by: LLM > Signed-off-by: Karl Mehltretter <kmehltretter(a)gmail.com> I've reviewed the patch and pushed it to drm-misc-fixes. Sorry for the delay, Christian. > --- > > Notes: > Built alone on x86_64 with NEED_SG_DMA_FLAGS=y (dma-buf.o, W=1). The > KUnit test in patch 3 checks the flags in the copy. It passes on x86_64 > under QEMU in strict and in warn mode. > > drivers/dma-buf/dma-buf.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c > index 4c9add51f9ef..b3d311acb883 100644 > --- a/drivers/dma-buf/dma-buf.c > +++ b/drivers/dma-buf/dma-buf.c > @@ -904,6 +904,10 @@ static int dma_buf_wrap_sg_table(struct sg_table **sg_table) > sg_assign_page(to_sg, NULL); > sg_dma_address(to_sg) = sg_dma_address(from_sg); > sg_dma_len(to_sg) = sg_dma_len(from_sg); > +#ifdef CONFIG_NEED_SG_DMA_FLAGS > + /* the flags describe the DMA side, e.g. SG_DMA_BUS_ADDRESS */ > + to_sg->dma_flags = from_sg->dma_flags; > +#endif > to_sg = sg_next(to_sg); > } >

1 week, 6 days

[PATCH] dma-buf: Restore the scatterlist entry count before freeing

by Leon Romanovsky

From: Leon Romanovsky <leonro(a)nvidia.com> dma_buf_phys_vec_to_sgt() clears orig_nents to mark the returned table as DMA-only. Since sg_free_table() uses orig_nents to walk and free the scatterlist, dma_buf_free_sgt() leaks the allocation on every successful map/unmap cycle. Restore orig_nents from nents before freeing the table. The helper allocates the DMA list directly, so nents retains the allocation count, including for chained scatterlists. The reported kmemleak output was: KMEMLEAK LEAK: 2 driver-related leak(s) KMEMLEAK LEAK: unreferenced object 0xff11000125ceff00 (size 32): KMEMLEAK LEAK: comm dtr, pid 4432, jiffies 4295031027 KMEMLEAK LEAK: hex dump (first 32 bytes): KMEMLEAK LEAK: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ KMEMLEAK LEAK: 00 00 01 00 28 38 00 00 00 10 00 00 00 00 00 00 ....(8.......... KMEMLEAK LEAK: backtrace (crc 4e8077f2): KMEMLEAK LEAK: __kmalloc_noprof+0x451/0x8b0 KMEMLEAK LEAK: __sg_alloc_table+0x2a0/0x4d0 KMEMLEAK LEAK: sg_alloc_table+0x24/0x170 KMEMLEAK LEAK: dma_buf_phys_vec_to_sgt+0x84f/0xed0 KMEMLEAK LEAK: 0xffffffffa1ad21a8 KMEMLEAK LEAK: dma_buf_map_attachment+0x138/0x690 KMEMLEAK LEAK: ib_umem_dmabuf_map_pages+0x249/0xc90 [ib_core] KMEMLEAK LEAK: 0xffffffffa138f8d2 KMEMLEAK LEAK: 0xffffffffa1396abe KMEMLEAK LEAK: 0xffffffffa1331a5f KMEMLEAK LEAK: 0xffffffffa13320dd KMEMLEAK LEAK: 0xffffffffa1ad696d KMEMLEAK LEAK: 0xffffffffa1acecc7 KMEMLEAK LEAK: 0xffffffffa1acfd17 KMEMLEAK LEAK: __x64_sys_ioctl+0x72c/0x11f0 KMEMLEAK LEAK: do_syscall_64+0xa1/0x4f0 KMEMLEAK LEAK: unreferenced object 0xff1100016dbf3a80 (size 32): KMEMLEAK LEAK: comm dtr, pid 4432, jiffies 4295034705 KMEMLEAK LEAK: hex dump (first 32 bytes): KMEMLEAK LEAK: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ KMEMLEAK LEAK: 00 20 10 00 28 38 00 00 00 10 00 00 00 00 00 00 . ..(8.......... Fixes: 3aa31a8bb11e ("dma-buf: provide phys_vec to scatter-gather mapping routine") Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> --- drivers/dma-buf/dma-buf-mapping.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/dma-buf/dma-buf-mapping.c b/drivers/dma-buf/dma-buf-mapping.c index 833be519e1e6..cbdf99cb0e05 100644 --- a/drivers/dma-buf/dma-buf-mapping.c +++ b/drivers/dma-buf/dma-buf-mapping.c @@ -251,6 +251,8 @@ void dma_buf_free_sgt(struct dma_buf_attachment *attach, struct sg_table *sgt, sg_dma_len(sgl), dir, DMA_ATTR_MMIO); } + /* Restore the allocation count cleared for the DMA-only table. */ + sgt->orig_nents = sgt->nents; sg_free_table(sgt); kfree(dma->state); kfree(dma); --- base-commit: 39d3758108bb0ef9da484062d65288bbe9cada0e change-id: 20261013-dma-buf-fixes-99dd3fd00f48 Best regards, -- Leon Romanovsky <leonro(a)nvidia.com>

1 week, 6 days

Re: [PATCH 23/26] treewide: Rename dma_buf_attach() to dma_buf_sgt_attach()

by Christian König

On 10/26/26 06:36, Alistair Popple wrote: > From: Jason Gunthorpe <jgg(a)nvidia.com> > > This attach function always creates a SGT mapping type importer. Yeah that is a clear NO-GO. The attachment should be the same for the new interface as well. Regards, Christian. > > Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> > --- > Documentation/gpu/todo.rst | 2 +- > drivers/accel/amdxdna/amdxdna_gem.c | 2 +- > drivers/accel/ivpu/ivpu_gem.c | 2 +- > drivers/accel/qaic/qaic_data.c | 2 +- > drivers/dma-buf/dma-buf.c | 14 +++++++------- > drivers/gpu/drm/armada/armada_gem.c | 2 +- > drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- > drivers/gpu/drm/drm_prime.c | 2 +- > drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c | 2 +- > .../gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c | 2 +- > drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c | 2 +- > drivers/gpu/drm/tegra/gem.c | 4 ++-- > drivers/iio/industrialio-buffer.c | 2 +- > .../media/common/videobuf2/videobuf2-dma-contig.c | 2 +- > drivers/media/common/videobuf2/videobuf2-dma-sg.c | 2 +- > .../media/platform/nvidia/tegra-vde/dmabuf-cache.c | 2 +- > drivers/misc/fastrpc.c | 2 +- > drivers/usb/gadget/function/f_fs.c | 2 +- > drivers/xen/gntdev-dmabuf.c | 2 +- > include/linux/dma-buf.h | 10 +++++----- > io_uring/zcrx.c | 2 +- > net/core/devmem.c | 2 +- > 22 files changed, 33 insertions(+), 33 deletions(-) > > diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst > index 14cf37590fc7..be0397c197f1 100644 > --- a/Documentation/gpu/todo.rst > +++ b/Documentation/gpu/todo.rst > @@ -633,7 +633,7 @@ Remove automatic page mapping from dma-buf importing > > When importing dma-bufs, the dma-buf and PRIME frameworks automatically map > imported pages into the importer's DMA area. drm_gem_prime_fd_to_handle() and > -drm_gem_prime_handle_to_fd() require that importers call dma_buf_attach() > +drm_gem_prime_handle_to_fd() require that importers call dma_buf_sgt_attach() > even if they never do actual device DMA, but only CPU access through > dma_buf_vmap(). This is a problem for USB devices, which do not support DMA > operations. > diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c > index a7e759bb0460..2b2f1e9fb9ec 100644 > --- a/drivers/accel/amdxdna/amdxdna_gem.c > +++ b/drivers/accel/amdxdna/amdxdna_gem.c > @@ -893,7 +893,7 @@ amdxdna_gem_prime_import(struct drm_device *dev, struct dma_buf *dma_buf) > > get_dma_buf(dma_buf); > > - attach = dma_buf_attach(dma_buf, dev->dev); > + attach = dma_buf_sgt_attach(dma_buf, dev->dev); > if (IS_ERR(attach)) { > ret = PTR_ERR(attach); > goto put_buf; > diff --git a/drivers/accel/ivpu/ivpu_gem.c b/drivers/accel/ivpu/ivpu_gem.c > index 8d6ed95ccc7c..d1c99b974a34 100644 > --- a/drivers/accel/ivpu/ivpu_gem.c > +++ b/drivers/accel/ivpu/ivpu_gem.c > @@ -219,7 +219,7 @@ struct drm_gem_object *ivpu_gem_prime_import(struct drm_device *dev, > struct ivpu_bo *bo; > int ret; > > - attach = dma_buf_attach(dma_buf, attach_dev); > + attach = dma_buf_sgt_attach(dma_buf, attach_dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c > index 92d49448df72..88331028b7bf 100644 > --- a/drivers/accel/qaic/qaic_data.c > +++ b/drivers/accel/qaic/qaic_data.c > @@ -850,7 +850,7 @@ struct drm_gem_object *qaic_gem_prime_import(struct drm_device *dev, struct dma_ > obj = &bo->base; > get_dma_buf(dma_buf); > > - attach = dma_buf_attach(dma_buf, dev->dev); > + attach = dma_buf_sgt_attach(dma_buf, dev->dev); > if (IS_ERR(attach)) { > ret = PTR_ERR(attach); > goto attach_fail; > diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c > index 12604c60122e..06bc25eff079 100644 > --- a/drivers/dma-buf/dma-buf.c > +++ b/drivers/dma-buf/dma-buf.c > @@ -671,7 +671,7 @@ static struct file *dma_buf_getfile(size_t size, int flags) > * 2. Userspace passes this file-descriptors to all drivers it wants this buffer > * to share with: First the file descriptor is converted to a &dma_buf using > * dma_buf_get(). Then the buffer is attached to the device using > - * dma_buf_attach(). > + * dma_buf_sgt_attach(). > * > * Up to this stage the exporter is still free to migrate or reallocate the > * backing storage. > @@ -966,7 +966,7 @@ dma_buf_pin_on_map(struct dma_buf_attachment *attach) > * 2. Importers must not hold the dma-buf reservation lock when calling these > * functions: > * > - * - dma_buf_attach() > + * - dma_buf_sgt_attach() > * - dma_buf_dynamic_attach() > * - dma_buf_detach() > * - dma_buf_export() > @@ -1100,15 +1100,15 @@ struct dma_buf_attachment *dma_buf_mapping_attach( > EXPORT_SYMBOL_NS_GPL(dma_buf_mapping_attach, "DMA_BUF"); > > /** > - * dma_buf_attach - Wrapper for dma_buf_mapping_attach > + * dma_buf_sgt_attach - Wrapper for dma_buf_mapping_attach > * @dmabuf: [in] buffer to attach device to. > * @dev: [in] device to be attached. > * > * Wrapper to call dma_buf_mapping_attach() for drivers which still use a static > * mapping. > */ > -struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf, > - struct device *dev) > +struct dma_buf_attachment *dma_buf_sgt_attach(struct dma_buf *dmabuf, > + struct device *dev) > { > struct dma_buf_mapping_match sgt_match[] = { > DMA_BUF_IMAPPING_SGT(dev, DMA_SGT_NO_P2P), > @@ -1117,7 +1117,7 @@ struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf, > return dma_buf_mapping_attach(dmabuf, sgt_match, ARRAY_SIZE(sgt_match), > NULL, NULL); > } > -EXPORT_SYMBOL_NS_GPL(dma_buf_attach, "DMA_BUF"); > +EXPORT_SYMBOL_NS_GPL(dma_buf_sgt_attach, "DMA_BUF"); > > /** > * dma_buf_dynamic_attach - Add the device to dma_buf's attachments list > @@ -1149,7 +1149,7 @@ EXPORT_SYMBOL_NS_GPL(dma_buf_dynamic_attach, "DMA_BUF"); > * @dmabuf: [in] buffer to detach from. > * @attach: [in] attachment to be detached; is free'd after this call. > * > - * Clean up a device attachment obtained by calling dma_buf_attach(). > + * Clean up a device attachment obtained by calling dma_buf_sgt_attach(). > * > * Optionally this calls &dma_buf_ops.detach for device-specific detach. > */ > diff --git a/drivers/gpu/drm/armada/armada_gem.c b/drivers/gpu/drm/armada/armada_gem.c > index 72c7cd2b3fb9..438f33304eab 100644 > --- a/drivers/gpu/drm/armada/armada_gem.c > +++ b/drivers/gpu/drm/armada/armada_gem.c > @@ -518,7 +518,7 @@ armada_gem_prime_import(struct drm_device *dev, struct dma_buf *buf) > } > } > > - attach = dma_buf_attach(buf, dev->dev); > + attach = dma_buf_sgt_attach(buf, dev->dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index d654a22a30de..9e937af2ee73 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -964,7 +964,7 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev, > return obj; > } > > - attach = dma_buf_attach(dma_buf, dev->dev); > + attach = dma_buf_sgt_attach(dma_buf, dev->dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c > index 3ffbe3d28929..3084e8c28e53 100644 > --- a/drivers/gpu/drm/drm_prime.c > +++ b/drivers/gpu/drm/drm_prime.c > @@ -999,7 +999,7 @@ struct drm_gem_object *drm_gem_prime_import_dev(struct drm_device *dev, > if (!dev->driver->gem_prime_import_sg_table) > return ERR_PTR(-EINVAL); > > - attach = dma_buf_attach(dma_buf, attach_dev); > + attach = dma_buf_sgt_attach(dma_buf, attach_dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c > index 7f939c281308..9865a7a9ad8f 100644 > --- a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c > +++ b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c > @@ -306,7 +306,7 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev, > return ERR_PTR(-E2BIG); > > /* need to attach */ > - attach = dma_buf_attach(dma_buf, dev->dev); > + attach = dma_buf_sgt_attach(dma_buf, dev->dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c > index 6b6d235fd3e9..3c193e6d9d11 100644 > --- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c > +++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c > @@ -287,7 +287,7 @@ static int igt_dmabuf_import_same_driver(struct drm_i915_private *i915, > goto out_import; > > /* Now try a fake an importer */ > - import_attach = dma_buf_attach(dmabuf, obj->base.dev->dev); > + import_attach = dma_buf_sgt_attach(dmabuf, obj->base.dev->dev); > if (IS_ERR(import_attach)) { > err = PTR_ERR(import_attach); > goto out_import; > diff --git a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c > index c549b94b2e8a..ca0962a99509 100644 > --- a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c > +++ b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c > @@ -115,7 +115,7 @@ struct drm_gem_object *omap_gem_prime_import(struct drm_device *dev, > } > } > > - attach = dma_buf_attach(dma_buf, dev->dev); > + attach = dma_buf_sgt_attach(dma_buf, dev->dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c > index f06826fe8366..803409824711 100644 > --- a/drivers/gpu/drm/tegra/gem.c > +++ b/drivers/gpu/drm/tegra/gem.c > @@ -81,7 +81,7 @@ static struct host1x_bo_mapping *tegra_bo_pin(struct device *dev, struct host1x_ > if (obj->dma_buf) { > struct dma_buf *buf = obj->dma_buf; > > - map->attach = dma_buf_attach(buf, dev); > + map->attach = dma_buf_sgt_attach(buf, dev); > if (IS_ERR(map->attach)) { > err = PTR_ERR(map->attach); > goto free; > @@ -475,7 +475,7 @@ static struct tegra_bo *tegra_bo_import(struct drm_device *drm, > * domain, map it first to the DRM device to get an sgt. > */ > if (tegra->domain) { > - attach = dma_buf_attach(buf, drm->dev); > + attach = dma_buf_sgt_attach(buf, drm->dev); > if (IS_ERR(attach)) { > err = PTR_ERR(attach); > goto free; > diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c > index f81154642bcd..abffbcc76c4c 100644 > --- a/drivers/iio/industrialio-buffer.c > +++ b/drivers/iio/industrialio-buffer.c > @@ -1717,7 +1717,7 @@ static int iio_buffer_attach_dmabuf(struct iio_dev_buffer_pair *ib, > goto err_free_priv; > } > > - attach = dma_buf_attach(dmabuf, dma_dev); > + attach = dma_buf_sgt_attach(dmabuf, dma_dev); > if (IS_ERR(attach)) { > err = PTR_ERR(attach); > goto err_dmabuf_put; > diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/drivers/media/common/videobuf2/videobuf2-dma-contig.c > index e13521b5c0e8..c7fa86cba8ad 100644 > --- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c > +++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c > @@ -789,7 +789,7 @@ static void *vb2_dc_attach_dmabuf(struct vb2_buffer *vb, struct device *dev, > buf->vb = vb; > > /* create attachment for the dmabuf with the user device */ > - dba = dma_buf_attach(dbuf, buf->dev); > + dba = dma_buf_sgt_attach(dbuf, buf->dev); > if (IS_ERR(dba)) { > pr_err("failed to attach dmabuf\n"); > kfree(buf); > diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c > index 59e346a5d48b..4c93b7f58e1f 100644 > --- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c > +++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c > @@ -638,7 +638,7 @@ static void *vb2_dma_sg_attach_dmabuf(struct vb2_buffer *vb, struct device *dev, > > buf->dev = dev; > /* create attachment for the dmabuf with the user device */ > - dba = dma_buf_attach(dbuf, buf->dev); > + dba = dma_buf_sgt_attach(dbuf, buf->dev); > if (IS_ERR(dba)) { > pr_err("failed to attach dmabuf\n"); > kfree(buf); > diff --git a/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c b/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c > index 55d58a4dbbe2..d80282ebe4b4 100644 > --- a/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c > +++ b/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c > @@ -96,7 +96,7 @@ int tegra_vde_dmabuf_cache_map(struct tegra_vde *vde, > goto ref; > } > > - attachment = dma_buf_attach(dmabuf, dev); > + attachment = dma_buf_sgt_attach(dmabuf, dev); > if (IS_ERR(attachment)) { > dev_err(dev, "Failed to attach dmabuf\n"); > err = PTR_ERR(attachment); > diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c > index 375ce39c78c9..24ae1038b634 100644 > --- a/drivers/misc/fastrpc.c > +++ b/drivers/misc/fastrpc.c > @@ -904,7 +904,7 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, > goto get_err; > } > > - map->attach = dma_buf_attach(map->buf, sess->dev); > + map->attach = dma_buf_sgt_attach(map->buf, sess->dev); > if (IS_ERR(map->attach)) { > dev_err(sess->dev, "Failed to attach dmabuf\n"); > err = PTR_ERR(map->attach); > diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c > index 4016edfa4c02..bfa24bcfe84c 100644 > --- a/drivers/usb/gadget/function/f_fs.c > +++ b/drivers/usb/gadget/function/f_fs.c > @@ -1549,7 +1549,7 @@ static int ffs_dmabuf_attach(struct file *file, int fd) > if (IS_ERR(dmabuf)) > return PTR_ERR(dmabuf); > > - attach = dma_buf_attach(dmabuf, gadget->dev.parent); > + attach = dma_buf_sgt_attach(dmabuf, gadget->dev.parent); > if (IS_ERR(attach)) { > err = PTR_ERR(attach); > goto err_dmabuf_put; > diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c > index cd851eb04a69..e7ffb546e717 100644 > --- a/drivers/xen/gntdev-dmabuf.c > +++ b/drivers/xen/gntdev-dmabuf.c > @@ -580,7 +580,7 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev, > gntdev_dmabuf->priv = priv; > gntdev_dmabuf->fd = fd; > > - attach = dma_buf_attach(dma_buf, dev); > + attach = dma_buf_sgt_attach(dma_buf, dev); > if (IS_ERR(attach)) { > ret = ERR_CAST(attach); > goto fail_free_obj; > diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h > index b264e1c4a9df..208752eb93d9 100644 > --- a/include/linux/dma-buf.h > +++ b/include/linux/dma-buf.h > @@ -77,7 +77,7 @@ struct dma_buf_ops { > /** > * @attach: > * > - * This is called from dma_buf_attach() to make sure that a given > + * This is called from dma_buf_sgt_attach() to make sure that a given > * &dma_buf_attachment.dev can access the provided &dma_buf. Exporters > * which support buffer objects in special locations like VRAM or > * device-specific carveout areas should check whether the buffer could > @@ -125,7 +125,7 @@ struct dma_buf_ops { > * exclusive with @cache_sgt_mapping. > * > * This is called automatically for non-dynamic importers from > - * dma_buf_attach(). > + * dma_buf_sgt_attach(). > * > * Note that similar to non-dynamic exporters in their @map_dma_buf > * callback the driver must guarantee that the memory is available for > @@ -513,7 +513,7 @@ struct dma_buf_attach_ops { > * and its user device(s). The list contains one attachment struct per device > * attached to the buffer. > * > - * An attachment is created by calling dma_buf_attach(), and released again by > + * An attachment is created by calling dma_buf_sgt_attach(), and released again by > * calling dma_buf_detach(). The DMA mapping itself needed to initiate a > * transfer is created by dma_buf_sgt_map_attachment() and freed again by calling > * dma_buf_sgt_unmap_attachment(). > @@ -591,8 +591,8 @@ static inline bool dma_buf_is_dynamic(struct dma_buf *dmabuf) > return !!dmabuf->ops->pin; > } > > -struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf, > - struct device *dev); > +struct dma_buf_attachment *dma_buf_sgt_attach(struct dma_buf *dmabuf, > + struct device *dev); > struct dma_buf_attachment * > dma_buf_dynamic_attach(struct dma_buf *dmabuf, struct device *dev, > const struct dma_buf_attach_ops *importer_ops, > diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c > index 67f74ce4f096..2cbf65b29f89 100644 > --- a/io_uring/zcrx.c > +++ b/io_uring/zcrx.c > @@ -175,7 +175,7 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq, > goto err; > } > > - mem->attach = dma_buf_attach(mem->dmabuf, ifq->dev); > + mem->attach = dma_buf_sgt_attach(mem->dmabuf, ifq->dev); > if (IS_ERR(mem->attach)) { > ret = PTR_ERR(mem->attach); > mem->attach = NULL; > diff --git a/net/core/devmem.c b/net/core/devmem.c > index f30fa375c9ab..d7c08da306cf 100644 > --- a/net/core/devmem.c > +++ b/net/core/devmem.c > @@ -234,7 +234,7 @@ net_devmem_bind_dmabuf(struct net_device *dev, void *vdev, > binding->dmabuf = dmabuf; > binding->direction = direction; > > - binding->attachment = dma_buf_attach(binding->dmabuf, dma_dev); > + binding->attachment = dma_buf_sgt_attach(binding->dmabuf, dma_dev); > if (IS_ERR(binding->attachment)) { > err = PTR_ERR(binding->attachment); > NL_SET_ERR_MSG(extack, "Failed to bind dmabuf to device");

2 weeks

Re: [PATCH 23/26] treewide: Rename dma_buf_attach() to dma_buf_sgt_attach()

by Christian König

On 10/27/26 14:34, Mikko Perttunen wrote: > On Tuesday, October 27, 2026 9:33 PM Jason Gunthorpe wrote: >> On Tue, Oct 27, 2026 at 12:42:32PM +0900, Mikko Perttunen wrote: >> >>>> This page-side use predates the series, so the fault is not itself a v2 >>>> regression. Is dma_buf_sgt_attach() valid for this call site, or does Tegra >>>> need a page/physical mapping type first? >>> >>> Sounds like a bug in TegraDRM; we should be using the DMA addr/length >>> for the explicit IOMMU mapping as the sgt attachment is for the dummy >>> DRM device explicitly intended to give us physical addresses. >> >> No, you cannot connect dmabuf to an iommu_domain. It is 100% always >> illegal. DMABUF does not support this. Do not pass sg_dma to iommu >> functions either. > > Sure, I agree -- so let's say it's a bug on top of the baseline crimes > TegraDRM commits :) Well the initial crime was to abuse sgt to transport dma addresses, don't document how all of this works and then be surprised when everything blew up. But yeah don't touch the pages in sgt exposed by DMA-buf, that is pretty much one of the most fundamental rules we have now. Regards, Christian. > >> >>> I'm currently in the process of removing the whole explicit IOMMU path >>> so if this only occurs with CONFIG_DMABUF_DEBUG enabled, I don't think >>> there's a pressing need to fix this before then. >> >> Yes I think this is probably the only way to fix it :| You have to >> always use the DMA API >> >> Jason >> > > > >

2 weeks

Re: [RFC PATCH v2 1/1] misc: fgds: introduce GPU-File direct I/O via dma-buf

by Christian König

On 10/27/26 10:08, Li Wang wrote: > From: Mengmeng Zhao <zhaomengmeng(a)kylinos.cn> > > This patch introduces a driver that allows moving data between a GPU > dma-buf and a regular file on NVME without staging it through the page > cache. Userspace registers the GPU dma-buf with the device, then issues > read and write requests via the device's ioctls. Each transfer is direct > I/O: an ITER_DMABUF_MAP iterator is passed to the file's read_iter or > write_iter, and the filesystem's iomap path submits REQ_DMABUF bios that > already carry the dma addresses. Why in the world is that still useful with Pavel work on io_uring? > > Signed-off-by: Mengmeng Zhao <zhaomengmeng(a)kylinos.cn> > Signed-off-by: Li Wang <liwang(a)kylinos.cn> > --- > .../userspace-api/ioctl/ioctl-number.rst | 2 + > drivers/dma-buf/dma-buf-io.c | 3 + > drivers/misc/Kconfig | 16 + > drivers/misc/Makefile | 1 + > drivers/misc/fgds.c | 506 ++++++++++++++++++ > fs/iomap/buffered-io.c | 11 + > fs/iomap/direct-io.c | 23 +- > fs/xfs/xfs_file.c | 4 + > include/linux/iov_iter.h | 4 + > include/uapi/linux/fgds.h | 124 +++++ > lib/iov_iter.c | 1 + > mm/filemap.c | 22 +- > 12 files changed, 713 insertions(+), 4 deletions(-) > create mode 100644 drivers/misc/fgds.c > create mode 100644 include/uapi/linux/fgds.h > > diff --git a/Documentation/userspace-api/ioctl/ioctl-number.rst b/Documentation/userspace-api/ioctl/ioctl-number.rst > index 2fc53093752d..5f93a252e773 100644 > --- a/Documentation/userspace-api/ioctl/ioctl-number.rst > +++ b/Documentation/userspace-api/ioctl/ioctl-number.rst > @@ -306,6 +306,8 @@ Code Seq# Include File Comments > 'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API > 'v' C0-FF linux/meye.h conflict! > 'w' all CERN SCI driver > +'x' 00-0F linux/fgds.h Fast GPU Direct Storage > + <mailto:liwang@kylinos.cn> > 'y' 00-1F packet based user level communications > <mailto:zapman@interlan.net> > 'z' 00-3F CAN bus card conflict! > diff --git a/drivers/dma-buf/dma-buf-io.c b/drivers/dma-buf/dma-buf-io.c > index 8440151de860..2ee4fc683c74 100644 > --- a/drivers/dma-buf/dma-buf-io.c > +++ b/drivers/dma-buf/dma-buf-io.c > @@ -135,6 +135,7 @@ struct dma_buf_io_map *dma_buf_io_create_map(struct dma_buf_io_ctx *ctx) > dma_resv_unlock(ctx->dmabuf->resv); > return map; > } > +EXPORT_SYMBOL_NS_GPL(dma_buf_io_create_map, "DMA_BUF"); Clear NAK to that. Those are FS layer helper functionalities for DMA-buf and not something drivers should ever need to mess with. Regards, Christian. > > static void dma_buf_io_ctx_shutdown(struct dma_buf_io_ctx *ctx) > { > @@ -190,6 +191,7 @@ int dma_buf_io_ctx_create(struct file *file, > *out_ctx = ctx; > return 0; > } > +EXPORT_SYMBOL_NS_GPL(dma_buf_io_ctx_create, "DMA_BUF"); > > /** > * dma_buf_io_ctx_release - Destroy the I/O context > @@ -211,6 +213,7 @@ void dma_buf_io_ctx_release(struct dma_buf_io_ctx *ctx) > dma_buf_put(ctx->dmabuf); > kfree(ctx); > } > +EXPORT_SYMBOL_NS_GPL(dma_buf_io_ctx_release, "DMA_BUF"); > > /** > * dma_buf_io_invalidate_mappings - Invalidate the current map > diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig > index 7364931dad3a..b85fd64d27ad 100644 > --- a/drivers/misc/Kconfig > +++ b/drivers/misc/Kconfig > @@ -568,6 +568,22 @@ config MCHP_LAN966X_PCI > - lan966x-miim (MDIO_MSCC_MIIM) > - lan966x-switch (LAN966X_SWITCH) > > +config FGDS > + tristate "Fast GPU Direct Storage support" > + depends on DMA_SHARED_BUFFER && BLOCK > + default n > + help > + This driver exposes a misc device that moves data between a GPU > + dma-buf and a regular file with synchronous read/write ioctls, > + submitting the transfer as direct I/O (REQ_DMABUF bios) through > + the file system's iomap DIO path without a page cache bounce > + buffer. > + > + To compile this driver as a module, choose M here: the module > + will be called fgds. > + > + If unsure, say N. > + > source "drivers/misc/c2port/Kconfig" > source "drivers/misc/eeprom/Kconfig" > source "drivers/misc/cb710/Kconfig" > diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile > index e8d8d5d88c0d..cd98ef3d008e 100644 > --- a/drivers/misc/Makefile > +++ b/drivers/misc/Makefile > @@ -70,4 +70,5 @@ obj-$(CONFIG_MCHP_LAN966X_PCI) += lan966x-pci.o > obj-y += keba/ > obj-y += amd-sbi/ > obj-$(CONFIG_MISC_RP1) += rp1/ > +obj-$(CONFIG_FGDS) += fgds.o > obj-$(CONFIG_INTEL_SSEI) += issei/ > diff --git a/drivers/misc/fgds.c b/drivers/misc/fgds.c > new file mode 100644 > index 000000000000..3929a6514d23 > --- /dev/null > +++ b/drivers/misc/fgds.c > @@ -0,0 +1,506 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* > + * Fast GPU Direct Storage via dma-buf. > + * > + * Copyright (C) 2026 KylinSoft. Co., Ltd. All rights reserved. > + * > + * Synchronous read/write ioctls that move data between a GPU dma-buf and > + * a regular file. > + */ > + > +#include <linux/blkdev.h> > +#include <linux/dma-buf.h> > +#include <linux/dma-buf-io.h> > +#include <linux/device.h> > +#include <linux/fcntl.h> > +#include <linux/fileattr.h> > +#include <linux/fs.h> > +#include <linux/fsnotify.h> > +#include <linux/magic.h> > +#include <linux/math.h> > +#include <linux/miscdevice.h> > +#include <linux/module.h> > +#include <linux/overflow.h> > +#include <linux/pagemap.h> > +#include <linux/sched/xacct.h> > +#include <linux/slab.h> > +#include <linux/uaccess.h> > +#include <linux/uio.h> > +#include <linux/xarray.h> > + > +#include <linux/fgds.h> > + > +static struct miscdevice fgds_misc; > + > +/* One registered buffer: a dma-buf bound to a block device. */ > +struct fgds_reg { > + struct kref kref; > + struct dma_buf_io_ctx *ctx; > + struct file *bdev_file; > + struct block_device *bdev; > + u64 size; > +}; > + > +/* State of one /dev/fgds open file description; handles are private to it. */ > +struct fgds_state { > + struct xarray regs; > + /* protects @regs and, with the reg kref, the lifetime of entries */ > + struct mutex lock; > +}; > + > +static void fgds_reg_release(struct kref *kref) > +{ > + struct fgds_reg *reg = container_of(kref, struct fgds_reg, kref); > + > + dma_buf_io_ctx_release(reg->ctx); > + fput(reg->bdev_file); > + kfree(reg); > +} > + > +static void fgds_reg_put(struct fgds_reg *reg) > +{ > + kref_put(&reg->kref, fgds_reg_release); > +} > + > +static struct fgds_state *fgds_state(struct file *file) > +{ > + return file->private_data; > +} > + > +/* > + * File and file-system level gate. > + */ > +static int fgds_gate(struct file *ffile) > +{ > + struct inode *inode = file_inode(ffile); > + struct super_block *sb = inode->i_sb; > + struct file_kattr fa; > + > + if (!S_ISREG(inode->i_mode)) > + return -EINVAL; > + if (sb->s_magic != XFS_SUPER_MAGIC) > + return -EOPNOTSUPP; > + if (IS_DAX(inode)) > + return -EOPNOTSUPP; > + if (mapping_stable_writes(inode->i_mapping)) > + return -EOPNOTSUPP; > + if (!sb->s_bdev) > + return -EOPNOTSUPP; > + if (bdev_is_zoned(sb->s_bdev)) > + return -EOPNOTSUPP; > + if (!sb->s_bdev->bd_disk->fops->init_dma_buf_io_ctx) > + return -EOPNOTSUPP; > + > + /* > + * Realtime inodes live on a separate device whose DMA setup is not > + * covered here. > + */ > + if (vfs_fileattr_get(ffile->f_path.dentry, &fa)) > + return -EOPNOTSUPP; > + if (fa.fsx_xflags & FS_XFLAG_REALTIME) > + return -EOPNOTSUPP; > + return 0; > +} > + > +static unsigned int fgds_file_align(struct inode *inode, bool write) > +{ > + unsigned int lbs = bdev_logical_block_size(inode->i_sb->s_bdev); > + > + if (!write) > + return lbs; > + return max(1U << inode->i_blkbits, lbs); > +} > + > +static unsigned int fgds_dma_align(struct inode *inode) > +{ > + return bdev_dma_alignment(inode->i_sb->s_bdev) + 1; > +} > + > +static struct fgds_reg *fgds_reg_get(struct fgds_state *state, u32 handle) > +{ > + struct fgds_reg *reg; > + > + mutex_lock(&state->lock); > + reg = xa_load(&state->regs, handle); > + if (reg) > + kref_get(&reg->kref); > + mutex_unlock(&state->lock); > + return reg; > +} > + > +static int fgds_unregister_handle(struct fgds_state *state, u32 handle) > +{ > + struct fgds_reg *reg; > + > + mutex_lock(&state->lock); > + reg = xa_erase(&state->regs, handle); > + mutex_unlock(&state->lock); > + if (reg) > + fgds_reg_put(reg); > + return reg ? 0 : -EINVAL; > +} > + > +static int fgds_register(struct file *file, struct fgds_register_args __user *uarg) > +{ > + struct fgds_register_args args; > + struct fgds_state *state = fgds_state(file); > + struct dma_buf_io_ctx *ctx = NULL; > + struct block_device *bdev; > + struct file *bdev_file; > + struct dma_buf *dbuf; > + struct fd bfdf; > + struct fgds_reg *reg; > + u32 id; > + int ret; > + > + if (copy_from_user(&args, uarg, sizeof(args))) > + return -EFAULT; > + if (args.handle || args.pad || args.reserved) > + return -EINVAL; > + > + dbuf = dma_buf_get(args.dfd); > + if (IS_ERR(dbuf)) > + return PTR_ERR(dbuf); > + > + bfdf = fdget(args.bdev_fd); > + if (fd_empty(bfdf)) { > + ret = -EBADF; > + goto out_dmabuf; > + } > + bdev_file = fd_file(bfdf); > + if (!S_ISBLK(file_inode(bdev_file)->i_mode)) { > + ret = -EINVAL; > + goto out_fdput; > + } > + /* blkdev_init_dma_buf_io_ctx() needs O_DIRECT. */ > + if (!(bdev_file->f_flags & O_DIRECT)) { > + ret = -EINVAL; > + goto out_fdput; > + } > + > + bdev = file_bdev(bdev_file); > + if (!bdev->bd_disk->fops->init_dma_buf_io_ctx) { > + ret = -EOPNOTSUPP; > + goto out_fdput; > + } > + > + ret = -ENOMEM; > + reg = kzalloc_obj(*reg); > + if (!reg) > + goto out_fdput; > + > + get_file(bdev_file); > + > + ret = dma_buf_io_ctx_create(bdev_file, dbuf, DMA_BIDIRECTIONAL, &ctx); > + if (ret) { > + dev_err(fgds_misc.this_device, > + "dma-buf-io context on %pg failed: %pe\n", > + bdev, ERR_PTR(ret)); > + goto out_file; > + } > + > + kref_init(&reg->kref); > + reg->ctx = ctx; > + reg->bdev_file = bdev_file; > + reg->bdev = bdev; > + reg->size = dbuf->size; > + > + mutex_lock(&state->lock); > + ret = xa_alloc(&state->regs, &id, reg, XA_LIMIT(1, UINT_MAX), > + GFP_KERNEL); > + if (ret) { > + mutex_unlock(&state->lock); > + goto out_ctx; > + } > + > + args.handle = id; > + /* the window must stay inside the buffer and within 32 bits */ > + args.max_doffset = min_t(u64, reg->size, UINT_MAX); > + > + if (copy_to_user(uarg, &args, sizeof(args))) { > + xa_erase(&state->regs, id); > + mutex_unlock(&state->lock); > + ret = -EFAULT; > + goto out_ctx; > + } > + mutex_unlock(&state->lock); > + > + fdput(bfdf); > + dma_buf_put(dbuf); > + return 0; > + > +out_ctx: > + dma_buf_io_ctx_release(ctx); > +out_file: > + fput(bdev_file); > + kfree(reg); > +out_fdput: > + fdput(bfdf); > +out_dmabuf: > + dma_buf_put(dbuf); > + return ret; > +} > + > +static int fgds_unregister(struct file *file, struct fgds_unregister_args __user *uarg) > +{ > + struct fgds_unregister_args args; > + > + if (copy_from_user(&args, uarg, sizeof(args))) > + return -EFAULT; > + if (args.reserved) > + return -EINVAL; > + return fgds_unregister_handle(fgds_state(file), args.handle); > +} > + > +/* > + * Launch one read_iter()/write_iter() call. > + * Returns the number of bytes the file system moved, or a negative > + * errno; a short read means the end of the file. > + */ > +static ssize_t fgds_do_rw(struct fgds_state *state, > + const struct fgds_rw_args *args, bool write) > +{ > + struct fgds_reg *reg; > + struct dma_buf_io_map *map; > + struct file *ffile; > + struct inode *inode; > + struct iov_iter iter; > + struct kiocb kiocb; > + struct fd fdf; > + ssize_t (*iter_fn)(struct kiocb *kiocb, struct iov_iter *i); > + unsigned int file_align, dma_align; > + u64 length = args->length; > + u64 dbuf_end; > + loff_t offset, end; > + ssize_t ret; > + > + if (args->flags) > + return -EINVAL; > + if (length > MAX_RW_COUNT) > + return -EINVAL; > + > + offset = args->offset; > + if (offset < 0 || check_add_overflow(offset, (loff_t)length, &end)) > + return -EINVAL; > + /* > + * The block layer's dma-buf iterator truncates the segment offset to > + * 32 bits, and the window must stay inside the registered buffer. > + */ > + if (check_add_overflow(args->doffset, length, &dbuf_end)) > + return -EINVAL; > + if (dbuf_end > UINT_MAX) > + return -EINVAL; > + > + fdf = fdget(args->ffd); > + if (fd_empty(fdf)) > + return -EBADF; > + ffile = fd_file(fdf); > + inode = file_inode(ffile); > + > + ret = -EINVAL; > + if (!S_ISREG(inode->i_mode) || (ffile->f_flags & O_APPEND)) > + goto out_fdput; > + > + if (write) { > + if (!(ffile->f_mode & FMODE_WRITE) || > + !(ffile->f_mode & FMODE_CAN_WRITE)) > + goto out_fdput; > + iter_fn = ffile->f_op->write_iter; > + } else { > + if (!(ffile->f_mode & FMODE_READ) || > + !(ffile->f_mode & FMODE_CAN_READ)) > + goto out_fdput; > + iter_fn = ffile->f_op->read_iter; > + } > + if (!iter_fn) { > + ret = -EOPNOTSUPP; > + goto out_fdput; > + } > + > + ret = fgds_gate(ffile); > + if (ret) > + goto out_fdput; > + > + reg = fgds_reg_get(state, args->handle); > + if (!reg) { > + ret = -EINVAL; > + goto out_fdput; > + } > + > + if (inode->i_sb->s_bdev != reg->bdev) { > + ret = -EXDEV; > + goto out_reg; > + } > + > + file_align = fgds_file_align(inode, write); > + dma_align = fgds_dma_align(inode); > + if ((offset | (loff_t)length) & (file_align - 1) || > + (args->doffset | (loff_t)length) & (dma_align - 1) || > + dbuf_end > reg->size || > + (!write && end > i_size_read(inode))) { > + ret = -EINVAL; > + goto out_reg; > + } > + > + ret = rw_verify_area(write ? WRITE : READ, ffile, &offset, length); > + if (ret) > + goto out_reg; > + if (write) > + inc_syscw(current); > + else > + inc_syscr(current); > + > + if (!length) { > + ret = 0; > + goto out_reg; > + } > + > + map = dma_buf_io_get_map(reg->ctx, false); > + if (IS_ERR(map)) { > + ret = PTR_ERR(map); > + if (ret != -EAGAIN) > + dev_err_ratelimited(fgds_misc.this_device, > + "dma-buf mapping failed on %pg: %pe\n", > + reg->bdev, ERR_PTR(ret)); > + goto out_reg; > + } > + > + /* > + * A direct I/O read would leave any cached pages of the range > + * stale, so flush and drop them before submitting. > + */ > + if (!write) { > + ret = filemap_write_and_wait_range(ffile->f_mapping, > + offset, end - 1); > + if (ret) > + goto out_map; > + ret = invalidate_inode_pages2_range(ffile->f_mapping, > + offset >> PAGE_SHIFT, > + (end - 1) >> PAGE_SHIFT); > + if (ret) { > + /* > + * Report a retryable error instead of letting > + * -EBUSY escape. > + */ > + if (ret == -EBUSY) > + ret = -EAGAIN; > + goto out_map; > + } > + } > + > + if (write) > + file_start_write(ffile); > + iov_iter_dmabuf_map(&iter, write ? ITER_SOURCE : ITER_DEST, > + map, args->doffset, length); > + init_sync_kiocb(&kiocb, ffile); > + kiocb.ki_flags |= IOCB_DIRECT; > + if (write) > + kiocb.ki_flags |= IOCB_WRITE; > + kiocb.ki_pos = offset; > + > + ret = iter_fn(&kiocb, &iter); > + if (WARN_ON_ONCE(ret == -EIOCBQUEUED)) > + ret = -EIO; > + if (write) > + file_end_write(ffile); > + > + if (ret > 0) { > + if (write) { > + fsnotify_modify(ffile); > + add_wchar(current, ret); > + } else { > + fsnotify_access(ffile); > + add_rchar(current, ret); > + } > + } > + > +out_map: > + dma_buf_io_map_drop(map); > +out_reg: > + fgds_reg_put(reg); > +out_fdput: > + fdput(fdf); > + return ret; > +} > + > +static long fgds_ioctl(struct file *file, unsigned int cmd, unsigned long arg) > +{ > + struct fgds_state *state = fgds_state(file); > + struct fgds_rw_args args; > + > + switch (cmd) { > + case FGDS_IOCTL_WRITE: > + case FGDS_IOCTL_READ: > + if (copy_from_user(&args, (void __user *)arg, sizeof(args))) > + return -EFAULT; > + return fgds_do_rw(state, &args, cmd == FGDS_IOCTL_WRITE); > + case FGDS_IOCTL_REGISTER_BUF: > + return fgds_register(file, (struct fgds_register_args __user *)arg); > + case FGDS_IOCTL_UNREGISTER_BUF: > + return fgds_unregister(file, (struct fgds_unregister_args __user *)arg); > + } > + return -ENOTTY; > +} > + > +static int fgds_open(struct inode *inode, struct file *file) > +{ > + struct fgds_state *state; > + > + state = kzalloc_obj(*state); > + if (!state) > + return -ENOMEM; > + > + xa_init_flags(&state->regs, XA_FLAGS_ALLOC); > + mutex_init(&state->lock); > + file->private_data = state; > + return 0; > +} > + > +static int fgds_release(struct inode *inode, struct file *file) > +{ > + struct fgds_state *state = fgds_state(file); > + struct fgds_reg *reg; > + unsigned long id; > + > + xa_for_each(&state->regs, id, reg) { > + xa_erase(&state->regs, id); > + fgds_reg_put(reg); > + } > + xa_destroy(&state->regs); > + mutex_destroy(&state->lock); > + kfree(state); > + return 0; > +} > + > +static const struct file_operations fgds_fops = { > + .owner = THIS_MODULE, > + .open = fgds_open, > + .release = fgds_release, > + .unlocked_ioctl = fgds_ioctl, > + .compat_ioctl = compat_ptr_ioctl, > +}; > + > +static struct miscdevice fgds_misc = { > + .minor = MISC_DYNAMIC_MINOR, > + .name = "fgds", > + .fops = &fgds_fops, > +}; > + > +static int __init fgds_init(void) > +{ > + return misc_register(&fgds_misc); > +} > + > +static void __exit fgds_exit(void) > +{ > + misc_deregister(&fgds_misc); > +} > + > +module_init(fgds_init); > +module_exit(fgds_exit); > + > +MODULE_LICENSE("GPL"); > +MODULE_IMPORT_NS("DMA_BUF"); > +MODULE_AUTHOR("Mengmeng Zhao <zhaomengmeng(a)kylinos.cn>, Li Wang <liwang(a)kylinos.cn>"); > +MODULE_DESCRIPTION("Fast GPU Direct Storage"); > +MODULE_VERSION("1.0.0"); > diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c > index 0a5ebfda90f1..a7ab28edab98 100644 > --- a/fs/iomap/buffered-io.c > +++ b/fs/iomap/buffered-io.c > @@ -1304,6 +1304,17 @@ iomap_file_buffered_write(struct kiocb *iocb, struct iov_iter *i, > }; > ssize_t ret; > > + /* > + * The copy helpers have no source for a dma-buf iterator: the copy > + * would move zero bytes, ->write_end() would reject the untouched > + * folio, fault_in_iov_iter_readable() reports the iterator as > + * readable, and the loop below would never advance. Refuse here > + * rather than at each caller's entry point, so no path can reach > + * the copy with such an iterator. > + */ > + if (iov_iter_is_dmabuf_map(i)) > + return -EOPNOTSUPP; > + > if (iocb->ki_flags & IOCB_NOWAIT) > iter.flags |= IOMAP_NOWAIT; > if (iocb->ki_flags & IOCB_DONTCACHE) > diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c > index 8b4039d16ce8..eccc07d53e9c 100644 > --- a/fs/iomap/direct-io.c > +++ b/fs/iomap/direct-io.c > @@ -595,8 +595,16 @@ static int iomap_dio_bio_iter(struct iomap_iter *iter, struct iomap_dio *dio) > > static int iomap_dio_hole_iter(struct iomap_iter *iter, struct iomap_dio *dio) > { > - loff_t length = iov_iter_zero(iomap_length(iter), dio->submit.iter); > + loff_t length; > > + /* > + * dmabuf maps do not support zero-filling holes or > + * unwritten extents. > + */ > + if (iov_iter_is_dmabuf_map(dio->submit.iter)) > + return -EOPNOTSUPP; > + > + length = iov_iter_zero(iomap_length(iter), dio->submit.iter); > dio->size += length; > if (!length) > return -EFAULT; > @@ -683,8 +691,8 @@ static int iomap_dio_iter(struct iomap_iter *iter, struct iomap_dio *dio) > * the correct total number of bytes transferred; this is essential for > * completing partial requests asynchronously. > * > - * Returns -ENOTBLK In case of a page invalidation invalidation failure for > - * writes. The callers needs to fall back to buffered I/O in this case. > + * Returns -ENOTBLK in case of a page cache invalidation failure for writes. > + * The caller needs to fall back to buffered I/O in this case. > */ > struct iomap_dio * > __iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, > @@ -794,6 +802,15 @@ __iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, > * the caller tries again. > */ > ret = -EAGAIN; > + } else if (iov_iter_is_dmabuf_map(iter)) { > + /* > + * Avoid -ENOTBLK (buffered fallback) > + * as dmabuf are not supported. Map > + * -EBUSY to -EAGAIN for transient > + * retires. > + */ > + if (ret == -EBUSY) > + ret = -EAGAIN; > } else { > /* fall back to buffered write */ > ret = -ENOTBLK; > diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c > index 426a67b813a7..f16e9cb63e9e 100644 > --- a/fs/xfs/xfs_file.c > +++ b/fs/xfs/xfs_file.c > @@ -1211,6 +1211,10 @@ xfs_file_write_iter( > return ret; > } > > + /* zoned and buffered I/O is not supported for dmabuf */ > + if (iov_iter_is_dmabuf_map(from)) > + return -EOPNOTSUPP; > + > if (xfs_is_zoned_inode(ip)) > return xfs_file_buffered_write_zoned(iocb, from); > return xfs_file_buffered_write(iocb, from); > diff --git a/include/linux/iov_iter.h b/include/linux/iov_iter.h > index 2f91884d733b..a3b99e6d8255 100644 > --- a/include/linux/iov_iter.h > +++ b/include/linux/iov_iter.h > @@ -376,6 +376,10 @@ size_t iterate_and_advance_kernel(struct iov_iter *iter, size_t len, void *priv, > return iterate_folioq(iter, len, priv, priv2, step); > if (iov_iter_is_xarray(iter)) > return iterate_xarray(iter, len, priv, priv2, step); > + if (iov_iter_is_dmabuf_map(iter)) { > + WARN_ON_ONCE(1); > + return 0; > + } > return iterate_discard(iter, len, priv, priv2, step); > } > > diff --git a/include/uapi/linux/fgds.h b/include/uapi/linux/fgds.h > new file mode 100644 > index 000000000000..9a721c92cde2 > --- /dev/null > +++ b/include/uapi/linux/fgds.h > @@ -0,0 +1,124 @@ > +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ > +/* > + * Fast GPU Direct Storage user-kernel ABI definitions. > + * > + * Copyright (C) 2026 KylinSoft. Co., Ltd. All rights reserved. > + * > + * Synchronous read/write ioctls that move data between a GPU dma-buf and > + * a regular file. > + */ > +#ifndef _FGDS_H > +#define _FGDS_H > + > +#include <linux/types.h> > +#include <linux/ioctl.h> > + > +/** > + * struct fgds_register_args - arguments for %FGDS_IOCTL_REGISTER_BUF > + * > + * @dfd: dma-buf file descriptor exported by the GPU runtime. > + * @bdev_fd: file descriptor of the underlying block device (the > + * device the target files live on), opened with %O_DIRECT. > + * The device is named separately from the file because: > + * building the dma-buf I/O context needs a file for the > + * device itself, and the device side requires %O_DIRECT > + * on that file, which a regular file descriptor cannot > + * provide. > + * @handle: Returned handle for use with the other ioctls. Handles > + * are private to the /dev/fgds file descriptor they were > + * created on and are released automatically when that > + * descriptor is closed. Output. > + * @pad: Must be 0. > + * @max_doffset: Largest accepted value of @doffset plus @length: the > + * window must stay inside the registered dma-buf and > + * within the 32-bit offset bound of the block-layer > + * dma-buf iterator, so this reports the smaller of the > + * dma-buf size and %UINT_MAX. Output. > + * @reserved: Must be 0. Extension slot for further output fields. > + * > + * A registered handle keeps the device attachment alive, and once a > + * transfer has mapped the buffer that mapping is held for the handle's > + * lifetime. > + * > + * Returns 0, or a negative errno. > + */ > +struct fgds_register_args { > + __s32 dfd; > + __s32 bdev_fd; > + __u32 handle; > + __u32 pad; > + __u64 max_doffset; > + __u64 reserved; > +}; > + > +/** > + * struct fgds_unregister_args - arguments for %FGDS_IOCTL_UNREGISTER_BUF > + * > + * @handle: Handle returned by %FGDS_IOCTL_REGISTER_BUF. Input. > + * @reserved: Must be 0. > + * > + * Returns 0, or -EINVAL if @handle is not registered on this file > + * descriptor. > + */ > +struct fgds_unregister_args { > + __u32 handle; > + __u32 reserved; > +}; > + > +/** > + * struct fgds_rw_args - arguments for %FGDS_IOCTL_WRITE / %FGDS_IOCTL_READ > + * > + * @handle: Handle from %FGDS_IOCTL_REGISTER_BUF naming both the > + * dma-buf and the block device to transfer between. Input. > + * @ffd: Regular file descriptor. %O_DIRECT is not required on > + * it, fgds forces the direct I/O path itself. Its file > + * system's device must match the one registered with > + * @handle or the transfer fails with %EXDEV. Input. > + * @offset: Byte offset inside the file. Input. > + * @length: Transfer length in bytes. Unlike pread() and pwrite(), > + * which silently truncate an oversized request, fgds rejects > + * it with %EINVAL. Input. > + * @doffset: Byte offset inside the dma-buf, i.e. the start of the > + * window the transfer reads from or writes to. Input. > + * @flags: Must be 0. Input. > + * > + * Like pread() and pwrite(), the ioctl returns the number of bytes > + * transferred or a negative errno. A return value below @length means a > + * read stopped at the end of the file, or a write clamped by the calling > + * process' RLIMIT_FSIZE. > + * > + * Contract and failure modes: > + * > + * - Alignment is enforced on two independent axes, both answered by > + * statx() with %STATX_DIOALIGN. The file side applies to @offset and > + * @length: the device logical block size for a read, the max of that > + * and the file system block size for a write. The buffer side applies > + * to @doffset and @length: the device DMA alignment. A transfer must > + * satisfy both axes at once. > + * - Ranges backed by file holes or unwritten extents are not supported > + * for reads and fail with %EOPNOTSUPP: there is no page cache bounce > + * to serve zeros from, and GPU memory is generally not CPU accessible. > + * - Writes past the end of the file go through the file system's own > + * direct I/O extend path; no preallocation is performed by fgds. An > + * application that wants the space reserved must call fallocate() > + * itself first. > + * - Reads flush and drop any page cache of the transferred range before > + * submitting, so subsequent buffered reads observe the fresh data. > + */ > +struct fgds_rw_args { > + __u32 handle; > + __s32 ffd; > + __u64 offset; > + __u64 length; > + __u64 doffset; > + __u64 flags; > +}; > + > +#define FGDS_IOCTL_MAGIC 'x' > + > +#define FGDS_IOCTL_WRITE _IOW(FGDS_IOCTL_MAGIC, 1, struct fgds_rw_args) > +#define FGDS_IOCTL_READ _IOW(FGDS_IOCTL_MAGIC, 2, struct fgds_rw_args) > +#define FGDS_IOCTL_REGISTER_BUF _IOWR(FGDS_IOCTL_MAGIC, 3, struct fgds_register_args) > +#define FGDS_IOCTL_UNREGISTER_BUF _IOW(FGDS_IOCTL_MAGIC, 4, struct fgds_unregister_args) > + > +#endif /* _FGDS_H */ > diff --git a/lib/iov_iter.c b/lib/iov_iter.c > index 9b46f9ada8f9..b19bf7f5e4cf 100644 > --- a/lib/iov_iter.c > +++ b/lib/iov_iter.c > @@ -790,6 +790,7 @@ void iov_iter_dmabuf_map(struct iov_iter *i, unsigned int direction, > .iov_offset = off, > }; > } > +EXPORT_SYMBOL_GPL(iov_iter_dmabuf_map); > > /** > * iov_iter_discard - Initialise an I/O iterator that discards data > diff --git a/mm/filemap.c b/mm/filemap.c > index 6afec636881f..ab8a5391a699 100644 > --- a/mm/filemap.c > +++ b/mm/filemap.c > @@ -3013,6 +3013,14 @@ generic_file_read_iter(struct kiocb *iocb, struct iov_iter *iter) > return retval; > } > > + /* > + * Buffered I/O read is not supported for dmabuf; a short direct > + * read before this point stands on its own, as in > + * direct_write_fallback(). > + */ > + if (iov_iter_is_dmabuf_map(iter)) > + return retval > 0 ? retval : -EOPNOTSUPP; > + > return filemap_read(iocb, iter, retval); > } > EXPORT_SYMBOL(generic_file_read_iter); > @@ -4300,8 +4308,14 @@ generic_file_direct_write(struct kiocb *iocb, struct iov_iter *from) > */ > written = kiocb_invalidate_pages(iocb, write_len); > if (written) { > - if (written == -EBUSY) > + if (written == -EBUSY) { > + /* > + * Avoid fallback to buffered write for dmabuf. > + */ > + if (iov_iter_is_dmabuf_map(from)) > + return -EAGAIN; > return 0; > + } > return written; > } > > @@ -4353,6 +4367,12 @@ ssize_t generic_perform_write(struct kiocb *iocb, struct iov_iter *i) > long status = 0; > ssize_t written = 0; > > + /* > + * Buffered write is not supported for dmabuf. > + */ > + if (iov_iter_is_dmabuf_map(i)) > + return -EOPNOTSUPP; > + > do { > struct folio *folio; > size_t offset; /* Offset into folio */

2 weeks

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig October 2026