Linaro-mm-sig October 2026

linaro-mm-sig@lists.linaro.org

21 participants
57 discussions

Re: [PATCH 2/4] media: videobuf2: add opt-in DMA-BUF CPU access

by Tomasz Figa

On Mon, Oct 19, 2026 at 4:14 PM Karl Mehltretter <kmehltretter(a)gmail.com> wrote: > > Drivers must bracket CPU access to imported DMA-BUFs with > dma_buf_begin_cpu_access() and dma_buf_end_cpu_access(). > > Add a queue flag to do so from buf_prepare() through buf_finish(). Use > read access for output and write access for capture. Map imports > bidirectionally because CPU and device access directions are opposite. > Pass the mapping direction to attach_dmabuf() so USERPTR and MMAP keep > the queue's normal direction. This isn't right. For the regular vb2 mem ops (dma-sg, dma-contig), a buffer in the prepared state is expected to be ready for hardware usage, meaning only the hardware can access it until the buffer is finished. The vmalloc ops are special in a way that CPU is the "hardware". > > Keep this opt-in because some vb2-vmalloc drivers pass buffers to > hardware. End access in process context because DMA-BUF callbacks may > sleep. That is at least unexpected, but also probably wrong (I haven't checked all the drivers) - the vmalloc mem ops are expected to be used by drivers that only access the buffer contents from the CPU. Putting all the above together, what I think we need is: 1) prepare/finish ops in vb2_vmalloc_memops to invoke the dma_buf_begin/end_cpu_access() API if the buffer is backed by a DMA-buf, 2) some vb2 API for drivers using the regular (dma-) memops to invoke the dma_buf_begin/end_cpu_access() API for them when they need to perform some CPU accesses to the buffers - typically they would do that in their vb2_ops::buf_prepare/finish callbacks, but definitelly must not after the buffer is already prepared. It sounds like this series focuses on uvcvideo and vivid, which likely means that 1) alone would be enough to fix the original problem. WDYT? Best, Tomasz > > Assisted-by: LLM > Signed-off-by: Karl Mehltretter <kmehltretter(a)gmail.com> > --- > .../media/common/videobuf2/videobuf2-core.c | 83 ++++++++++++++++++- > .../common/videobuf2/videobuf2-dma-contig.c | 5 +- > .../media/common/videobuf2/videobuf2-dma-sg.c | 5 +- > .../common/videobuf2/videobuf2-vmalloc.c | 5 +- > include/media/videobuf2-core.h | 12 ++- > 5 files changed, 101 insertions(+), 9 deletions(-) > > diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c > index 460eaf4e82f78..d2a78cd0a86bb 100644 > --- a/drivers/media/common/videobuf2/videobuf2-core.c > +++ b/drivers/media/common/videobuf2/videobuf2-core.c > @@ -371,6 +371,65 @@ static void __vb2_buf_mem_finish(struct vb2_buffer *vb) > call_void_memop(vb, finish, vb->planes[plane].mem_priv); > } > > +/* Output buffers are read by the driver; capture buffers are written. */ > +static enum dma_data_direction vb2_cpu_access_dir(const struct vb2_queue *q) > +{ > + return q->is_output ? DMA_FROM_DEVICE : DMA_TO_DEVICE; > +} > + > +static bool __vb2_dmabuf_is_duplicate(const struct vb2_buffer *vb, > + unsigned int plane) > +{ > + unsigned int i; > + > + for (i = 0; i < plane; i++) > + if (vb->planes[i].dbuf == vb->planes[plane].dbuf) > + return true; > + > + return false; > +} > + > +static void __vb2_buf_end_cpu_access(struct vb2_buffer *vb, > + unsigned int num_planes) > +{ > + struct vb2_queue *q = vb->vb2_queue; > + enum dma_data_direction dir = vb2_cpu_access_dir(q); > + unsigned int plane; > + > + for (plane = 0; plane < num_planes; plane++) { > + int ret; > + > + if (__vb2_dmabuf_is_duplicate(vb, plane)) > + continue; > + > + ret = dma_buf_end_cpu_access(vb->planes[plane].dbuf, dir); > + if (ret) > + pr_warn_ratelimited("[%s] failed to end CPU access to dmabuf plane %u: %d\n", > + q->name, plane, ret); > + } > +} > + > +static int __vb2_buf_begin_cpu_access(struct vb2_buffer *vb) > +{ > + struct vb2_queue *q = vb->vb2_queue; > + enum dma_data_direction dir = vb2_cpu_access_dir(q); > + unsigned int plane; > + int ret; > + > + for (plane = 0; plane < vb->num_planes; plane++) { > + if (__vb2_dmabuf_is_duplicate(vb, plane)) > + continue; > + > + ret = dma_buf_begin_cpu_access(vb->planes[plane].dbuf, dir); > + if (ret) { > + __vb2_buf_end_cpu_access(vb, plane); > + return ret; > + } > + } > + > + return 0; > +} > + > /* > * __setup_offsets() - setup unique offsets ("cookies") for every plane in > * the buffer. > @@ -1423,6 +1482,9 @@ static int __prepare_dmabuf(struct vb2_buffer *vb) > } > > if (reacquired) { > + enum dma_data_direction attach_dir = q->uses_cpu_access ? > + DMA_BIDIRECTIONAL : q->dma_dir; > + > if (vb->planes[0].mem_priv) { > vb->copied_timestamp = 0; > call_void_vb_qop(vb, buf_cleanup, vb); > @@ -1453,7 +1515,8 @@ static int __prepare_dmabuf(struct vb2_buffer *vb) > vb, > q->alloc_devs[plane] ? : q->dev, > planes[plane].dbuf, > - planes[plane].length); > + planes[plane].length, > + attach_dir); > if (IS_ERR(mem_priv)) { > dprintk(q, 1, "failed to attach dmabuf\n"); > ret = PTR_ERR(mem_priv); > @@ -1504,9 +1567,21 @@ static int __prepare_dmabuf(struct vb2_buffer *vb) > } > } > > + if (q->uses_cpu_access) { > + ret = __vb2_buf_begin_cpu_access(vb); > + if (ret) { > + dprintk(q, 1, "failed to begin CPU access to dmabuf: %d\n", > + ret); > + call_void_vb_qop(vb, buf_cleanup, vb); > + goto err_put_vb2_buf; > + } > + } > + > ret = call_vb_qop(vb, buf_prepare, vb); > if (ret) { > dprintk(q, 1, "buffer preparation failed\n"); > + if (q->uses_cpu_access) > + __vb2_buf_end_cpu_access(vb, vb->num_planes); > call_void_vb_qop(vb, buf_cleanup, vb); > goto err_put_vb2_buf; > } > @@ -1756,6 +1831,8 @@ int vb2_core_remove_bufs(struct vb2_queue *q, unsigned int start, unsigned int c > > __vb2_buf_mem_finish(vb); > call_void_vb_qop(vb, buf_finish, vb); > + if (q->memory == VB2_MEMORY_DMABUF && q->uses_cpu_access) > + __vb2_buf_end_cpu_access(vb, vb->num_planes); > vb->prepared = 0; > } > > @@ -2160,6 +2237,8 @@ int vb2_core_dqbuf(struct vb2_queue *q, unsigned int *pindex, void *pb, > } > > call_void_vb_qop(vb, buf_finish, vb); > + if (q->memory == VB2_MEMORY_DMABUF && q->uses_cpu_access) > + __vb2_buf_end_cpu_access(vb, vb->num_planes); > vb->prepared = 0; > > if (pindex) > @@ -2296,6 +2375,8 @@ static void __vb2_queue_cancel(struct vb2_queue *q) > > if (vb->prepared) { > call_void_vb_qop(vb, buf_finish, vb); > + if (q->memory == VB2_MEMORY_DMABUF && q->uses_cpu_access) > + __vb2_buf_end_cpu_access(vb, vb->num_planes); > vb->prepared = 0; > } > __vb2_dqbuf(vb); > diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/drivers/media/common/videobuf2/videobuf2-dma-contig.c > index 9ce6284cd5f26..68c146c043fb1 100644 > --- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c > +++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c > @@ -768,7 +768,8 @@ static void vb2_dc_detach_dmabuf(void *mem_priv) > } > > static void *vb2_dc_attach_dmabuf(struct vb2_buffer *vb, struct device *dev, > - struct dma_buf *dbuf, unsigned long size) > + struct dma_buf *dbuf, unsigned long size, > + enum dma_data_direction dma_dir) > { > struct vb2_dc_buf *buf; > struct dma_buf_attachment *dba; > @@ -794,7 +795,7 @@ static void *vb2_dc_attach_dmabuf(struct vb2_buffer *vb, struct device *dev, > return dba; > } > > - buf->dma_dir = vb->vb2_queue->dma_dir; > + buf->dma_dir = dma_dir; > buf->size = size; > buf->db_attach = dba; > > diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c > index b1d0695cda260..ab03f9d31391a 100644 > --- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c > +++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c > @@ -616,7 +616,8 @@ static void vb2_dma_sg_detach_dmabuf(void *mem_priv) > } > > static void *vb2_dma_sg_attach_dmabuf(struct vb2_buffer *vb, struct device *dev, > - struct dma_buf *dbuf, unsigned long size) > + struct dma_buf *dbuf, unsigned long size, > + enum dma_data_direction dma_dir) > { > struct vb2_dma_sg_buf *buf; > struct dma_buf_attachment *dba; > @@ -640,7 +641,7 @@ static void *vb2_dma_sg_attach_dmabuf(struct vb2_buffer *vb, struct device *dev, > return dba; > } > > - buf->dma_dir = vb->vb2_queue->dma_dir; > + buf->dma_dir = dma_dir; > buf->size = size; > buf->db_attach = dba; > buf->vb = vb; > diff --git a/drivers/media/common/videobuf2/videobuf2-vmalloc.c b/drivers/media/common/videobuf2/videobuf2-vmalloc.c > index 63f023696f3ee..c38faa0188bc9 100644 > --- a/drivers/media/common/videobuf2/videobuf2-vmalloc.c > +++ b/drivers/media/common/videobuf2/videobuf2-vmalloc.c > @@ -402,7 +402,8 @@ static void vb2_vmalloc_detach_dmabuf(void *mem_priv) > static void *vb2_vmalloc_attach_dmabuf(struct vb2_buffer *vb, > struct device *dev, > struct dma_buf *dbuf, > - unsigned long size) > + unsigned long size, > + enum dma_data_direction dma_dir) > { > struct vb2_vmalloc_buf *buf; > > @@ -414,7 +415,7 @@ static void *vb2_vmalloc_attach_dmabuf(struct vb2_buffer *vb, > return ERR_PTR(-ENOMEM); > > buf->dbuf = dbuf; > - buf->dma_dir = vb->vb2_queue->dma_dir; > + buf->dma_dir = dma_dir; > buf->size = size; > > return buf; > diff --git a/include/media/videobuf2-core.h b/include/media/videobuf2-core.h > index 4b4f4c15c53a7..8dfe22fa4423c 100644 > --- a/include/media/videobuf2-core.h > +++ b/include/media/videobuf2-core.h > @@ -78,7 +78,8 @@ struct vb2_buffer; > * to the userspace, also optional. > * @attach_dmabuf: attach a shared &struct dma_buf for a hardware operation; > * used for DMABUF memory types; dev is the alloc device > - * dbuf is the shared dma_buf; returns ERR_PTR() on failure; > + * dbuf is the shared dma_buf; dma_dir is the DMA mapping > + * direction; returns ERR_PTR() on failure; > * allocator private per-buffer structure on success; > * this needs to be used for further accesses to the buffer. > * @detach_dmabuf: inform the exporter of the buffer that the current DMABUF > @@ -136,7 +137,8 @@ struct vb2_mem_ops { > void *(*attach_dmabuf)(struct vb2_buffer *vb, > struct device *dev, > struct dma_buf *dbuf, > - unsigned long size); > + unsigned long size, > + enum dma_data_direction dma_dir); > void (*detach_dmabuf)(void *buf_priv); > int (*map_dmabuf)(void *buf_priv); > void (*unmap_dmabuf)(void *buf_priv); > @@ -510,6 +512,11 @@ struct vb2_buf_ops { > * ->finish(). > * @non_coherent_mem: when set queue will attempt to allocate buffers using > * non-coherent memory. > + * @uses_cpu_access: the driver transfers buffer data with the CPU instead of > + * DMA. For imported dma-bufs, videobuf2 brackets the interval from > + * buf_prepare through buf_finish with dma_buf_begin_cpu_access() > + * and dma_buf_end_cpu_access(). Imported attachments use > + * bidirectional DMA mappings. > * @lock: pointer to a mutex that protects the &struct vb2_queue. The > * driver must set this to a mutex to let the v4l2 core serialize > * the queuing ioctls. This lock is used when waiting for a new > @@ -614,6 +621,7 @@ struct vb2_queue { > unsigned int uses_requests:1; > unsigned int allow_cache_hints:1; > unsigned int non_coherent_mem:1; > + unsigned int uses_cpu_access:1; > > struct mutex *lock; > void *owner; > -- > 2.47.3 >

3 hours, 3 minutes

Re: [PATCH 1/4] media: videobuf2: finish prepared buffers in VIDIOC_REMOVE_BUFS

by Tomasz Figa

Hi Karl, On Mon, Oct 19, 2026 at 4:14 PM Karl Mehltretter <kmehltretter(a)gmail.com> wrote: > > VIDIOC_PREPARE_BUF leaves a buffer DEQUEUED after calling buf_prepare() > and the prepare() memory operation. VIDIOC_REMOVE_BUFS accepts that state > but frees the buffer without calling the matching finish operations. > > With VIDEO_ADV_DEBUG, vivid reports: > > unbalanced counters for queue 000000009fa716f8, buffer 0: > buf_prepare: 1 buf_finish: 0 > prepare: 1 finish: 0 > > Finish prepared buffers before freeing them, as queue cancellation does. > > Fixes: a3293a85381e ("media: v4l2: Add REMOVE_BUFS ioctl") > Assisted-by: LLM > Signed-off-by: Karl Mehltretter <kmehltretter(a)gmail.com> > --- > drivers/media/common/videobuf2/videobuf2-core.c | 13 +++++++++++++ > 1 file changed, 13 insertions(+) Thanks for the patch. Please take a look at my comments inline. > > diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c > index b0a6084f17573..460eaf4e82f78 100644 > --- a/drivers/media/common/videobuf2/videobuf2-core.c > +++ b/drivers/media/common/videobuf2/videobuf2-core.c > @@ -1746,6 +1746,19 @@ int vb2_core_remove_bufs(struct vb2_queue *q, unsigned int start, unsigned int c > goto unlock; > } > } > + > + /* A buffer can be prepared without being queued. Finish it first. */ > + for (i = start; i < start + count; i++) { > + struct vb2_buffer *vb = vb2_get_buffer(q, i); > + > + if (!vb->prepared) > + continue; > + > + __vb2_buf_mem_finish(vb); > + call_void_vb_qop(vb, buf_finish, vb); > + vb->prepared = 0; > + } > + __vb2_queue_cancel() does much more than that, especially all the media request handling. In addition, this open coded handling just causes code duplication. Would it make more sense to refactor the relevant part of the buffer cancelation loop from __vb2_queue_cancel() into a helper function and call it here instead? Best, Tomasz > __vb2_queue_free(q, start, count); > dprintk(q, 2, "%u buffers removed\n", count); > > -- > 2.47.3 >

5 hours, 2 minutes

[PATCH RFC v2 0/8] memcg: dma-buf cgroup accounting and charge transfer

by Albert Esteve

This series adds memory cgroup accounting for dma-buf allocations, building on T.J. Mercier's earlier series [1] and incorporating feedback from the v1 and LPC discussions. Patch 1 introduces the MEMCG_DMABUF stat and charge/uncharge helpers. Rather than charging at the page level via __GFP_ACCOUNT (which would require every dma-buf exporter to implement charging, and makes cross-cgroup transfer impractical without access to backing pages), we track charges externally on struct dma_buf via a MEMCG_DMABUF stat counter and route all accounting through a single path, removing the __GFP_ACCOUNT flag from system-heap allocations to avoid double counting. Patch 2 adds a charge_fd field to DMA_HEAP_IOCTL_ALLOC, accepting either a pidfd or a cgroupfd to identify the target cgroup at allocation time. If the target cgroup cannot accommodate the charge, the allocation returns -ENOMEM. Patches 3-4 add LSM hooks for the two charge_fd flavours: security_dma_buf_charge_task() gates the pidfd path (target identified by task credentials) and security_dma_buf_charge_cgroup() gates the cgroupfd path (target identified by cgroup directory label). Patches 5-6 implement the SELinux side under a dma_buf object class with charge_task and charge_cgroup permissions. For charge_cgroup, the target SID is derived from the cgroup directory's SELinux label. Patch 7 adds DMA_BUF_IOCTL_XFER_CHARGE, a general ioctl on any dma-buf fd to transfer charges (or charge) post-allocation. This covers the double-hop allocator case (SurfaceFlinger -> gralloc) and works for buffers from any exporter (DRM, V4L2, etc.). If the receiving cgroup lacks capacity for the charge, the ioctl returns -ENOMEM and the original charge is preserved. Patch 8 adds selftests. Known limitations: - Single-owner model: a dma-buf carries one memcg charge regardless of how many processes share it. - Only memcg accounting. CMA heaps would additionally need dmem controller integration. - Charging CMA-backed heaps to memcg charges unreclaimable memory: when a cgroup hits its limit, try_charge_memcg() may trigger a reclaim pass that cannot free CMA pages. A future version could move charging into per-heap callbacks. - If a transfer of an uncharged buffer fails, the buffer remains uncharged. The allocator (userspace) is expected to handle this (e.g., retry, free, ...). - The LSM hook is intentionally narrow. Broader cgroup access controls could be a separate effort. [1] https://lore.kernel.org/cgroups/20230109213809.418135-1-tjmercier@google.co… Signed-off-by: Albert Esteve <aesteve(a)redhat.com> --- Changes in v2: - Move charge_pid_fd to charge_fd, accepting cgroupfd in addition to pidfd per Christian König. - New DMA_BUF_IOCTL_XFER_CHARGE ioctl for post-allocation charge transfer on any dma-buf, not just dma-heap buffers per Christian König and T.J. Mercier. - Moved __GFP_ACCOUNT removal to patch 1 per Barry Song. - dma-buf charge/uncharge helpers take struct dma_buf * directly to avoid the need for caller to manage size calculations. - Added test_xfer_charge_cgroupfd_self to dmabuf-heap selftests. - Added LSM and SELinux hooks for cgroupfd-based charging. - Rebased to v7.3-rc7. - Link to v1: https://lore.kernel.org/r/20260512-v2_20230123_tjmercier_google_com-v1-0-63… --- Albert Esteve (7): dma-heap: charge dma-buf memory via explicit memcg security: dma-buf: Add dma_buf_charge_task LSM hook security: dma-buf: Add dma_buf_charge_cgroup LSM hook selinux: Restrict cross-cgroup dma-buf charging selinux: Restrict dma-buf direct cgroup charging dma-buf: transfer memcg charges via DMA_BUF_IOCTL_XFER_CHARGE selftests/dmabuf-heaps: Add dma-buf memcg accounting tests T.J. Mercier (1): memcg: Add MEMCG_DMABUF accounting infrastructure Documentation/admin-guide/cgroup-v2.rst | 5 + drivers/dma-buf/dma-buf.c | 80 ++++++++ drivers/dma-buf/dma-heap.c | 72 ++++++- drivers/dma-buf/heaps/system_heap.c | 2 - include/linux/dma-buf.h | 4 + include/linux/lsm_hook_defs.h | 2 + include/linux/memcontrol.h | 29 +++ include/linux/security.h | 14 ++ include/uapi/linux/dma-buf.h | 26 +++ include/uapi/linux/dma-heap.h | 7 + mm/memcontrol.c | 94 +++++++++ security/security.c | 32 +++ security/selinux/hooks.c | 40 ++++ security/selinux/include/classmap.h | 1 + tools/testing/selftests/cgroup/Makefile | 2 +- tools/testing/selftests/cgroup/test_memcontrol.c | 145 +++++++++++++- tools/testing/selftests/dmabuf-heaps/config | 1 + tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 222 ++++++++++++++++++++- tools/testing/selftests/dmabuf-heaps/vmtest.sh | 205 +++++++++++++++++++ 19 files changed, 974 insertions(+), 9 deletions(-) --- base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907 change-id: 20260508-v2_20230123_tjmercier_google_com-f44fcfb16530 Best regards, -- Albert Esteve <aesteve(a)redhat.com>

5 hours, 20 minutes

[PATCH] dma-buf: Restore the scatterlist entry count before freeing

by Leon Romanovsky

From: Leon Romanovsky <leonro(a)nvidia.com> dma_buf_phys_vec_to_sgt() clears orig_nents to mark the returned table as DMA-only. Since sg_free_table() uses orig_nents to walk and free the scatterlist, dma_buf_free_sgt() leaks the allocation on every successful map/unmap cycle. Restore orig_nents from nents before freeing the table. The helper allocates the DMA list directly, so nents retains the allocation count, including for chained scatterlists. The reported kmemleak output was: KMEMLEAK LEAK: 2 driver-related leak(s) KMEMLEAK LEAK: unreferenced object 0xff11000125ceff00 (size 32): KMEMLEAK LEAK: comm dtr, pid 4432, jiffies 4295031027 KMEMLEAK LEAK: hex dump (first 32 bytes): KMEMLEAK LEAK: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ KMEMLEAK LEAK: 00 00 01 00 28 38 00 00 00 10 00 00 00 00 00 00 ....(8.......... KMEMLEAK LEAK: backtrace (crc 4e8077f2): KMEMLEAK LEAK: __kmalloc_noprof+0x451/0x8b0 KMEMLEAK LEAK: __sg_alloc_table+0x2a0/0x4d0 KMEMLEAK LEAK: sg_alloc_table+0x24/0x170 KMEMLEAK LEAK: dma_buf_phys_vec_to_sgt+0x84f/0xed0 KMEMLEAK LEAK: 0xffffffffa1ad21a8 KMEMLEAK LEAK: dma_buf_map_attachment+0x138/0x690 KMEMLEAK LEAK: ib_umem_dmabuf_map_pages+0x249/0xc90 [ib_core] KMEMLEAK LEAK: 0xffffffffa138f8d2 KMEMLEAK LEAK: 0xffffffffa1396abe KMEMLEAK LEAK: 0xffffffffa1331a5f KMEMLEAK LEAK: 0xffffffffa13320dd KMEMLEAK LEAK: 0xffffffffa1ad696d KMEMLEAK LEAK: 0xffffffffa1acecc7 KMEMLEAK LEAK: 0xffffffffa1acfd17 KMEMLEAK LEAK: __x64_sys_ioctl+0x72c/0x11f0 KMEMLEAK LEAK: do_syscall_64+0xa1/0x4f0 KMEMLEAK LEAK: unreferenced object 0xff1100016dbf3a80 (size 32): KMEMLEAK LEAK: comm dtr, pid 4432, jiffies 4295034705 KMEMLEAK LEAK: hex dump (first 32 bytes): KMEMLEAK LEAK: 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ KMEMLEAK LEAK: 00 20 10 00 28 38 00 00 00 10 00 00 00 00 00 00 . ..(8.......... Fixes: 3aa31a8bb11e ("dma-buf: provide phys_vec to scatter-gather mapping routine") Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com> --- drivers/dma-buf/dma-buf-mapping.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/dma-buf/dma-buf-mapping.c b/drivers/dma-buf/dma-buf-mapping.c index 833be519e1e6..cbdf99cb0e05 100644 --- a/drivers/dma-buf/dma-buf-mapping.c +++ b/drivers/dma-buf/dma-buf-mapping.c @@ -251,6 +251,8 @@ void dma_buf_free_sgt(struct dma_buf_attachment *attach, struct sg_table *sgt, sg_dma_len(sgl), dir, DMA_ATTR_MMIO); } + /* Restore the allocation count cleared for the DMA-only table. */ + sgt->orig_nents = sgt->nents; sg_free_table(sgt); kfree(dma->state); kfree(dma); --- base-commit: 39d3758108bb0ef9da484062d65288bbe9cada0e change-id: 20261013-dma-buf-fixes-99dd3fd00f48 Best regards, -- Leon Romanovsky <leonro(a)nvidia.com>

6 hours, 1 minute

Re: [PATCH] dma-buf: Add DMA_BUF_IOCTL_SET_RELEASE_EVENTFD

by Christian König

On 10/21/26 11:08, Val Packett wrote: > Introduce a new ioctl that allows userspace to register an eventfd to get > notified when a dma-buf is released. > > The current use case comes from virtio-gpu device backends wishing to add > support for guest-owned buffers with host handles (CREATE_GUEST_HANDLE): > > * guest creates a guest-only blob resource on the virtgpu > * host creates a udmabuf from the iovecs sent by the guest > * guest attaches the resource to a cross-domain socket send operation > * guest immediately releases the resource (no longer needed by the guest) > * host sends the udmabuf to the compositor, but needs to delay responding > to the resource release request until the resource is *actually* free > on the host side, i.e. the compositor no longer uses it Interesting use case you have here. It doesn't sound to crazy, e.g. it can't deadlock the kernel or anything like that which we often see with dma-fence. > Signed-off-by: Val Packett <val(a)invisiblethingslab.com> > --- > > More background on the use case with extra links: > https://lore.kernel.org/virtio-comment/20260903021442.423274-1-val@invisibl… > > Funnily enough, gntdev-dmabuf (which is used on Xen hosts instead of > udmabuf for this) offers "a way" to "poll" for these release events > on its dmabufs (IOCTL_GNTDEV_DMABUF_EXP_WAIT_RELEASED), but it's unusable: > > * it's a blocking wait!! > * release does not happen while you still have the fd open, so: > * you can't just timeout and restart, you'd need the fd to restart; > * and the only way to even close the fd is from a different thread, > after some arbitrary timeout when hopefully the wait has started. Oh that made my day :D > The buffer lifecycle coordination we need this for applies to KVM as well > and it generally doesn't make sense to have this as a provider-specific > thing since it's not related to the provider in any way, it's just > something we want from dmabufs in general. I wouldn't put that on the DMA-buf file descriptor where basically anybody can mess with it. That is just an recipe for trouble. The better approach seems to be putting it into the udmabuf_ioctl(), so that from the very beginning you add the eventfd which signals when the udmabuf is released. If we need that for more implementations than just udmabuf, we can potentially add it to dma_buf_export_info so that exporters can provide the eventfd file descriptor directly on creation. Regards, Christian. > > Thanks, > ~val > > --- > drivers/dma-buf/dma-buf.c | 24 ++++++++++++++++++++++++ > include/linux/dma-buf.h | 3 +++ > include/uapi/linux/dma-buf.h | 1 + > 3 files changed, 28 insertions(+) > > diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c > index 36cdc342627e..1321fee73656 100644 > --- a/drivers/dma-buf/dma-buf.c > +++ b/drivers/dma-buf/dma-buf.c > @@ -17,6 +17,7 @@ > #include <linux/dma-fence.h> > #include <linux/dma-fence-unwrap.h> > #include <linux/anon_inodes.h> > +#include <linux/eventfd.h> > #include <linux/export.h> > #include <linux/debugfs.h> > #include <linux/list.h> > @@ -185,6 +186,11 @@ static void dma_buf_release(struct dentry *dentry) > if (dmabuf->resv == (struct dma_resv *)&dmabuf[1]) > dma_resv_fini(dmabuf->resv); > > + if (dmabuf->release_eventfd) { > + eventfd_signal(dmabuf->release_eventfd); > + eventfd_ctx_put(dmabuf->release_eventfd); > + } > + > WARN_ON(!list_empty(&dmabuf->attachments)); > module_put(dmabuf->owner); > kfree(dmabuf->name); > @@ -537,6 +543,21 @@ static long dma_buf_import_sync_file(struct dma_buf *dmabuf, > } > #endif > > +static long dma_buf_set_release_eventfd(struct dma_buf *dmabuf, > + u32 fd) > +{ > + struct eventfd_ctx *ev_fd_ctx = eventfd_ctx_fdget(fd); > + > + if (IS_ERR(ev_fd_ctx)) > + return PTR_ERR(ev_fd_ctx); > + > + if (dmabuf->release_eventfd) > + eventfd_ctx_put(dmabuf->release_eventfd); > + > + dmabuf->release_eventfd = ev_fd_ctx; > + return 0; > +} > + > static long dma_buf_ioctl(struct file *file, > unsigned int cmd, unsigned long arg) > { > @@ -587,6 +608,9 @@ static long dma_buf_ioctl(struct file *file, > return dma_buf_import_sync_file(dmabuf, (const void __user *)arg); > #endif > > + case DMA_BUF_IOCTL_SET_RELEASE_EVENTFD: > + return dma_buf_set_release_eventfd(dmabuf, (u32)arg); > + > default: > return -ENOTTY; > } > diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h > index d15b2b31d3c9..07b4a589a793 100644 > --- a/include/linux/dma-buf.h > +++ b/include/linux/dma-buf.h > @@ -429,6 +429,9 @@ struct dma_buf { > > __poll_t active; > } cb_in, cb_out; > + > + /** @release_eventfd: for userspace release notification */ > + struct eventfd_ctx *release_eventfd; > }; > > /** > diff --git a/include/uapi/linux/dma-buf.h b/include/uapi/linux/dma-buf.h > index e827c9d20c5d..566dea778ad0 100644 > --- a/include/uapi/linux/dma-buf.h > +++ b/include/uapi/linux/dma-buf.h > @@ -179,5 +179,6 @@ struct dma_buf_import_sync_file { > #define DMA_BUF_SET_NAME_B _IOW(DMA_BUF_BASE, 1, __u64) > #define DMA_BUF_IOCTL_EXPORT_SYNC_FILE _IOWR(DMA_BUF_BASE, 2, struct dma_buf_export_sync_file) > #define DMA_BUF_IOCTL_IMPORT_SYNC_FILE _IOW(DMA_BUF_BASE, 3, struct dma_buf_import_sync_file) > +#define DMA_BUF_IOCTL_SET_RELEASE_EVENTFD _IOW(DMA_BUF_BASE, 4, __u32) > > #endif

7 hours, 18 minutes

[PATCH RFC 00/26] Add DMA-buf mapping types and convert vfio/iommufd to use them

by Jason Gunthorpe

Since its introduction, DMA-buf has only supported using scatterlist for the exporter and importer to exchange address information. This is not sufficient for all use cases as dma_addr_t is a very specific and limited type that should not be abused for things unrelated to the DMA API. There are several motivations for addressing this now: 1) VFIO to IOMMUFD and KVM requires a physical address, not a dma_addr_t scatterlist, it cannot be represented in the scatterlist structure 2) xe vGPU requires the host driver to accept a DMABUF from VFIO of its own VF and convert it into an internal VRAM address on the PF 3) We are starting to look at replacement datastructures for scatterlist 4) Ideas around UALink/etc are suggesting not using the DMA API None of these can sanely be achieved using scatterlist. Introduce a new mechanism called "mapping types" which allows DMA-buf to work with more map/unmap options than scatterlist. Each mapping type encompasses a full set of functions and data unique to itself. The core code provides a match-making system to select the best type offered by the exporter and importer to be the active mapping type for the attachment. Everything related to scatterlist is moved into a DMA-buf SGT mapping type, and into the "dma_buf_sgt_*" namespace for clarity. Existing exporters are moved over to explicitly declare SGT mapping types and importers are adjusted to use the dma_buf_sgt_* named importer helpers. Mapping types are designed to be extendable, a driver can declare its own mapping type for its internal private interconnect and use that without having to adjust the core code. The new attachment sequence starts with the importing driver declaring what mapping types it can accept: struct dma_buf_mapping_match imp_match[] = { DMA_BUF_IMAPPING_MY_DRIVER(dev, ...), DMA_BUF_IMAPPING_SGT(dev, false), }; attach = dma_buf_mapping_attach(dmabuf, imp_match, ...) Most drivers will do this via a dma_buf_sgt_*attach() helper. The exporting driver can then declare what mapping types it can supply: int exporter_match_mapping(struct dma_buf_match_args *args) { struct dma_buf_mapping_match exp_match[] = { DMA_BUF_EMAPPING_MY_DRIVER(my_ops, dev, ...), DMA_BUF_EMAPPING_SGT(sgt_ops, dev, false), DMA_BUF_EMAPPING_PAL(PAL_ops), }; return dma_buf_match_mapping(args, exp_match, ...); } Most drivers will do this via a helper: static const struct dma_buf_ops ops = { DMA_BUF_SIMPLE_SGT_EXP_MATCH(map_func, unmap_func) }; During dma_buf_mapping_attach() the core code will select a mutual match between the importer and exporter and record it as the active match in the attach->map_type. Each mapping type has its own types/function calls for mapping/unmapping, and storage in the attach->map_type for its information. As such each mapping type can offer function signatures and data that exactly matches its needs. This series goes through a sequence of: 1) Introduce the basic mapping type framework and the main components of the SGT mapping type 2) Automatically make all existing exporters and importers use core generated SGT mapping types so every attachment has a SGT mapping type 3) Convert all exporter drivers to natively create a SGT mapping type 4) Move all dma_buf_* functions and types that are related to SGT into dma_buf_sgt_* 5) Remove all the now-unused items that have been moved into SGT specific structures. 6) Demonstrate adding a new Physical Address List alongside SGT. Due to the high number of files touched I would expect this to be broken into phases, but this shows the entire picture. This is on github: https://github.com/jgunthorpe/linux/commits/dmabuf_map_type It is a followup to the discussion here: https://lore.kernel.org/dri-devel/20251027044712.1676175-1-vivek.kasireddy@… Jason Gunthorpe (26): dma-buf: Introduce DMA-buf mapping types dma-buf: Add the SGT DMA mapping type dma-buf: Add dma_buf_mapping_attach() dma-buf: Route SGT related actions through attach->map_type dma-buf: Allow single exporter drivers to avoid the match_mapping function drm: Check the SGT ops for drm_gem_map_dma_buf() dma-buf: Convert all the simple exporters to use SGT mapping type drm/vmwgfx: Use match_mapping instead of dummy calls accel/habanalabs: Use the SGT mapping type drm/xe/dma-buf: Use the SGT mapping type drm/amdgpu: Use the SGT mapping type vfio/pci: Change the DMA-buf exporter to use mapping_type dma-buf: Update dma_buf_phys_vec_to_sgt() to use the SGT mapping type iio: buffer: convert to use the SGT mapping type functionfs: convert to use the SGT mapping type dma-buf: Remove unused SGT stuff from the common structures treewide: Rename dma_buf_map_attachment(_unlocked) to dma_buf_sgt_ treewide: Rename dma_buf_unmap_attachment(_unlocked) to dma_buf_sgt_* treewide: Rename dma_buf_attach() to dma_buf_sgt_attach() treewide: Rename dma_buf_dynamic_attach() to dma_buf_sgt_dynamic_attach() dma-buf: Add the Physical Address List DMA mapping type vfio/pci: Add physical address list support to DMABUF iommufd: Use the PAL mapping type instead of a vfio function iommufd: Support DMA-bufs with multiple physical ranges iommufd/selftest: Check multi-phys DMA-buf scenarios dma-buf: Add kunit tests for mapping type Documentation/gpu/todo.rst | 2 +- drivers/accel/amdxdna/amdxdna_gem.c | 14 +- drivers/accel/amdxdna/amdxdna_ubuf.c | 10 +- drivers/accel/habanalabs/common/memory.c | 54 ++- drivers/accel/ivpu/ivpu_gem.c | 10 +- drivers/accel/ivpu/ivpu_gem_userptr.c | 11 +- drivers/accel/qaic/qaic_data.c | 8 +- drivers/dma-buf/Makefile | 1 + drivers/dma-buf/dma-buf-mapping.c | 186 ++++++++- drivers/dma-buf/dma-buf.c | 180 ++++++--- drivers/dma-buf/heaps/cma_heap.c | 12 +- drivers/dma-buf/heaps/system_heap.c | 13 +- drivers/dma-buf/st-dma-mapping.c | 373 ++++++++++++++++++ drivers/dma-buf/udmabuf.c | 8 +- drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 98 +++-- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 6 +- drivers/gpu/drm/armada/armada_gem.c | 33 +- drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- drivers/gpu/drm/drm_prime.c | 31 +- drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c | 18 +- drivers/gpu/drm/i915/gem/i915_gem_object.c | 2 +- .../drm/i915/gem/selftests/i915_gem_dmabuf.c | 8 +- .../gpu/drm/i915/gem/selftests/mock_dmabuf.c | 8 +- drivers/gpu/drm/msm/msm_gem_prime.c | 7 +- drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c | 11 +- drivers/gpu/drm/tegra/gem.c | 33 +- drivers/gpu/drm/virtio/virtgpu_prime.c | 23 +- drivers/gpu/drm/vmwgfx/vmwgfx_prime.c | 32 +- drivers/gpu/drm/xe/xe_bo.c | 18 +- drivers/gpu/drm/xe/xe_dma_buf.c | 61 +-- drivers/iio/industrialio-buffer.c | 15 +- drivers/infiniband/core/umem_dmabuf.c | 15 +- drivers/iommu/iommufd/io_pagetable.h | 4 +- drivers/iommu/iommufd/iommufd_private.h | 8 - drivers/iommu/iommufd/iommufd_test.h | 7 + drivers/iommu/iommufd/pages.c | 85 ++-- drivers/iommu/iommufd/selftest.c | 177 ++++++--- .../media/common/videobuf2/videobuf2-core.c | 2 +- .../common/videobuf2/videobuf2-dma-contig.c | 26 +- .../media/common/videobuf2/videobuf2-dma-sg.c | 21 +- .../common/videobuf2/videobuf2-vmalloc.c | 13 +- .../platform/nvidia/tegra-vde/dmabuf-cache.c | 9 +- drivers/misc/fastrpc.c | 21 +- drivers/tee/tee_heap.c | 13 +- drivers/usb/gadget/function/f_fs.c | 11 +- drivers/vfio/pci/vfio_pci_dmabuf.c | 79 ++-- drivers/xen/gntdev-dmabuf.c | 29 +- include/linux/dma-buf-mapping.h | 297 ++++++++++++++ include/linux/dma-buf.h | 168 ++++---- io_uring/zcrx.c | 9 +- net/core/devmem.c | 14 +- samples/vfio-mdev/mbochs.c | 10 +- sound/soc/fsl/fsl_asrc_m2m.c | 12 +- tools/testing/selftests/iommu/iommufd.c | 43 ++ tools/testing/selftests/iommu/iommufd_utils.h | 17 + 55 files changed, 1764 insertions(+), 614 deletions(-) create mode 100644 drivers/dma-buf/st-dma-mapping.c base-commit: c63e5a50e1dd291cd95b04291b028fdcaba4c534 -- 2.43.0

8 hours, 24 minutes

Re: [PATCH 09/13] drm/msm/dcp: Register DCP display pipeline

by Krzysztof Kozlowski

On 15/10/2026 09:38, Jayant Shekhar wrote: > The DCP firmware exposes display resources through capabilities rather than > through host-visible display registers. The MSM DRM backend therefore needs > to build its KMS objects from the firmware capabilities and device-tree > display graph. > > Complete DCP KMS registration, including power and IOMMU integration, > capability handling, display-graph parsing, and creation of DRM planes, > CRTCs, encoders, bridges, and connectors. > > Signed-off-by: Jayant Shekhar <jayant.shekhar(a)oss.qualcomm.com> > Assisted-by: LLM Your tag is the last one. Best regards, Krzysztof

8 hours, 56 minutes

Re: [PATCH 09/13] drm/msm/dcp: Register DCP display pipeline

by Krzysztof Kozlowski

On 15/10/2026 09:38, Jayant Shekhar wrote: > The DCP firmware exposes display resources through capabilities rather than > through host-visible display registers. The MSM DRM backend therefore needs > to build its KMS objects from the firmware capabilities and device-tree > display graph. ... > + > + remote_np = of_graph_get_remote_port_parent(ep_np); > + of_node_put(ep_np); > + if (!remote_np) > + continue; > + > + if (!of_device_is_available(remote_np)) { > + of_node_put(remote_np); > + continue; > + } > + > + if (of_node_name_prefix(remote_np, "dsi")) { Where did you document the ABI? > + if (dsi_idx >= ARRAY_SIZE(dpu_kms->dsi_bridge)) { > + dev_err(dev->dev, "too many DSI outputs\n"); > + ret = -E2BIG; > + goto out; > + } Best regards, Krzysztof

8 hours, 57 minutes

Re: [RFC PATCH 0/6] iommufd: harden DMA-BUF PAL setup and release

by Jason Gunthorpe

On Tue, Oct 20, 2026 at 10:16:26PM +1100, Alistair Popple wrote: > I haven't had a chance to look at these patches yet, but if some of them are > fixing bugs in Jason's series it might be best for us to fold them into that > series, with correct attribution of course. Anyway I will take a closer look in > the morning. Are any fixing bugs in tree right now? I think one of them is already applied from someone else.. Jason

1 day, 2 hours

Re: [PATCH RFC 03/26] dma-buf: Add dma_buf_mapping_attach()

by Christian König

On 10/16/26 22:26, Karl Mehltretter wrote: > On Tue, Feb 17, 2026 at 08:11:34PM -0400, Jason Gunthorpe wrote: >> + match_args.attach = attach; >> + if (dmabuf->ops->match_mapping) { >> + ret = dmabuf->ops->match_mapping(&match_args); >> + } >> + >> attach->dmabuf = dmabuf; >> attach->importer_ops = importer_ops; >> attach->importer_priv = importer_priv; > > I may misunderstand the intended contract. match_mapping() runs while the > attachment is still zeroed and without dmabuf->resv held. > > Patch 11's amdgpu callback needs importer_ops and importer_priv, so its XGMI > match cannot work here. Patch 12's VFIO callback asserts dmabuf->resv and > reads priv->vdev, which cleanup changes under that lock. > > Should the core initialize the attachment and hold dmabuf->resv for > match_mapping(), or should callbacks avoid attachment and lock-protected > state? Right. This completely misplaced. The matching can't be done at attachment time, but rather needs to be done before creating a mapping while holding the resv lock so that the matching decision can't change. Regards, Christian. > > Thanks, > Karl

1 day, 6 hours

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig October 2026