Linaro-mm-sig October 2026

linaro-mm-sig@lists.linaro.org

21 participants
57 discussions

Start a nNew thread

Re: [PATCH v11 08/13] nvme-pci: add SGL support for the dmabuf path

by Christoph Hellwig

Looks good: Reviewed-by: Christoph Hellwig <hch(a)lst.de>

1 week

Re: [PATCH v11 07/13] nvme-pci: implement dma-buf backed requests

by Christoph Hellwig

Looks good: Reviewed-by: Christoph Hellwig <hch(a)lst.de>

1 week

Re: [PATCH v11 04/13] block: introduce dma map backed bio type

by Christoph Hellwig

On Wed, Oct 14, 2026 at 12:02:02PM +0100, Pavel Begunkov wrote: > Premapped buffers don't require a generic bio_vec since these have > already been dma mapped. Repurpose the bi_io_vec space to store dmabuf > maps as they are mutually exclusive. > > The bio splitting differs from the normal path because it's already > pre-mapped and for the block layer it's just an offset into the dma-buf. > The actual segmentation is only available to the importer driver and not > the block layer, however, it doesn't contain alignment gaps and we don't > have to check it. For the same reason we can't precisely split by the > number of segments, but we use ->min_seg_shift stored in the map to > calculate the minimum number of bytes a request consisting of > lim->max_segments full segments can cover and split by that. It's > stricter and can add extra splitting. E.g. for a {4K, 4G} segmentation, > the min segment size is 4K, and we'll split it into bios of > (4K * lim->max_segments) bytes each, but it should be good enough for > now to cover the most popular use cases. > > Suggested-by: Keith Busch <kbusch(a)kernel.org> > Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> > --- > block/bio.c | 15 +++++++++-- > block/blk-merge.c | 52 +++++++++++++++++++++++++++++++++++++++ > block/blk-mq.c | 6 +++++ > block/fops.c | 2 +- > include/linux/bio.h | 9 ++++--- > include/linux/blk-mq.h | 7 ++++++ > include/linux/blk_types.h | 14 ++++++++++- > include/linux/bvec.h | 3 ++- > 8 files changed, 99 insertions(+), 9 deletions(-) > > diff --git a/block/bio.c b/block/bio.c > index b48091c7663f..1e0d9714c541 100644 > --- a/block/bio.c > +++ b/block/bio.c > @@ -881,7 +881,11 @@ static int __bio_clone(struct bio *bio, struct bio *bio_src, gfp_t gfp) > bio->bi_write_stream = bio_src->bi_write_stream; > bio->bi_bvec_gap_bit = bio_src->bi_bvec_gap_bit; > bio->bi_iter = bio_src->bi_iter; > - bio->bi_io_vec = bio_src->bi_io_vec; > + > + if (op_is_dmabuf(bio->bi_opf)) > + bio->bi_dmabuf_map = bio_src->bi_dmabuf_map; > + else > + bio->bi_io_vec = bio_src->bi_io_vec; > > if (bio->bi_bdev) { > if (bio->bi_bdev == bio_src->bi_bdev && > @@ -1204,16 +1208,23 @@ EXPORT_SYMBOL_GPL(__bio_release_pages); > > bool bio_iov_iter_set(struct bio *bio, const struct iov_iter *iter) > { > - if (!iov_iter_is_bvec(iter)) > + if (!iov_iter_is_bvec(iter) && !iov_iter_is_dmabuf_map(iter)) > return false; > > WARN_ON_ONCE(bio->bi_max_vecs); > > + static_assert(offsetof(struct bio, bi_io_vec) == > + offsetof(struct bio, bi_dmabuf_map)); > + static_assert(offsetof(struct iov_iter, bvec) == > + offsetof(struct iov_iter, dmabuf_map)); > + > bio->bi_io_vec = (struct bio_vec *)iter->bvec; > bio->bi_iter.bi_idx = 0; > bio->bi_iter.bi_offset = iter->iov_offset; > bio->bi_iter.bi_size = iov_iter_count(iter); > bio_set_flag(bio, BIO_CLONED); > + if (iov_iter_is_dmabuf_map(iter)) > + bio->bi_opf |= REQ_NOMERGE | REQ_DMABUF; > return true; > } > > diff --git a/block/blk-merge.c b/block/blk-merge.c > index 258a726071d1..501ddc01c449 100644 > --- a/block/blk-merge.c > +++ b/block/blk-merge.c > @@ -9,6 +9,7 @@ > #include <linux/blk-integrity.h> > #include <linux/part_stat.h> > #include <linux/blk-cgroup.h> > +#include <linux/dma-buf-io.h> > > #include <trace/events/block.h> > > @@ -319,6 +320,41 @@ static inline unsigned int bvec_seg_gap(struct bio_vec *bvprv, > return bv->bv_offset | (bvprv->bv_offset + bvprv->bv_len); > } > > +static inline int bio_split_io_at_dmabuf(struct bio *bio, > + const struct queue_limits *lim, unsigned *segs, > + unsigned max_bytes, unsigned len_align_mask, > + unsigned start_align_mask) > +{ > + unsigned bytes = min(bio->bi_iter.bi_size, max_bytes); > + unsigned seg_shift = bio->bi_dmabuf_map->min_seg_shift; > + unsigned offset = bio->bi_iter.bi_offset & ((1U << seg_shift) - 1); > + u64 max_segs_bytes; > + > + /* > + * dma-buf maps don't expose the underlying segmentation, but they're > + * guaranteed to not have alignment gaps, we only need to check the > + * start and length alignment. > + */ > + if ((bio->bi_iter.bi_offset & start_align_mask) || > + (bio->bi_iter.bi_size & len_align_mask)) > + return -EINVAL; > + > + /* Presented as a single contiguous range into the dma-buf */ > + *segs = 1; > + > + /* > + * Limit by the number of segments by using the minimal segment size. > + * Any I/O consisting of N full segments should be able to cover at > + * least N multiplied by the segment size. It's stricter than walking > + * the segments and might cause extra splitting. > + */ > + max_segs_bytes = (u64)lim->max_segments << seg_shift; > + bytes = min_t(u64, bytes, max_segs_bytes - offset); > + if (bytes != bio->bi_iter.bi_size) > + return bytes; > + return 0; > +} > + > /** > * bio_split_io_at - check if and where to split a bio > * @bio: [in] bio to be split > @@ -346,6 +382,19 @@ int bio_split_io_at(struct bio *bio, const struct queue_limits *lim, > len_align_mask |= (bc->bc_key->crypto_cfg.data_unit_size - 1); > } > > + if (op_is_dmabuf(bio->bi_opf)) { > + int ret; > + > + ret = bio_split_io_at_dmabuf(bio, lim, &nsegs, max_bytes, > + len_align_mask, start_align_mask); > + if (ret < 0) > + return ret; > + if (!ret) > + goto out; > + bytes = ret; > + goto split; > + } > + > bio_for_each_bvec(bv, bio, iter) { > if (bv.bv_offset & start_align_mask || > bv.bv_len & len_align_mask) > @@ -376,6 +425,7 @@ int bio_split_io_at(struct bio *bio, const struct queue_limits *lim, > bvprvp = &bvprv; > } > > +out: > *segs = nsegs; > bio->bi_bvec_gap_bit = ffs(gaps); > return 0; > @@ -493,6 +543,8 @@ unsigned int blk_recalc_rq_segments(struct request *rq) > > if (!rq->bio) > return 0; > + if (op_is_dmabuf(rq->bio->bi_opf)) > + return 1; > > switch (bio_op(rq->bio)) { > case REQ_OP_DISCARD: > diff --git a/block/blk-mq.c b/block/blk-mq.c > index e929f94b25c7..1b7f8cbbda8b 100644 > --- a/block/blk-mq.c > +++ b/block/blk-mq.c > @@ -3150,6 +3150,12 @@ void blk_mq_submit_bio(struct bio *bio) > goto queue_exit; > } > > + if (unlikely(op_is_dmabuf(bio->bi_opf) && > + bdev_has_integrity_csum(bio->bi_bdev))) { > + bio_endio_status(bio, BLK_STS_NOTSUPP); Wrong indentation, conditions are never indented the same level as the following code block, even with the weirdest preferences. /me note the patch from Anuj on the list actually got this right.. Otherwise looks good: Reviewed-by: Christoph Hellwig <hch(a)lst.de>

1 week

Re: [PATCH v2] dma-buf/test: add KUnit case for dma_fence_dedup_array() empty input

by Christian König

On 10/14/26 04:49, Baineng Shou wrote: > Add a KUnit case verifying that dma_fence_dedup_array() returns 0, > not 1, when called with num_fences == 0. This locks down the > contract documented in the kernel-doc and prevents a regression > of commit 77a9298741f8 ("dma-fence: Make dma_fence_dedup_array() > robust against 0-count input"). > > Suggested-by: Christian König <christian.koenig(a)amd.com> > Reviewed-by: Christian König <christian.koenig(a)amd.com> > Signed-off-by: Baineng Shou <shoubaineng(a)gmail.com> Thanks for the reminder, I had to wait for the -fixes backmerge to push this. I've just pushed the patch to drm-misc-next. Regards, Christian. > --- > > Changes in v2: > - Add Reviewed-by from Christian. > - Rebase onto v7.3-rc7. > > drivers/dma-buf/st-dma-fence-unwrap.c | 10 ++++++++++ > 1 file changed, 10 insertions(+) > > diff --git a/drivers/dma-buf/st-dma-fence-unwrap.c b/drivers/dma-buf/st-dma-fence-unwrap.c > index 4d9d313b460c..c5353b36f0e4 100644 > --- a/drivers/dma-buf/st-dma-fence-unwrap.c > +++ b/drivers/dma-buf/st-dma-fence-unwrap.c > @@ -370,6 +370,15 @@ static void test_unwrap_merge_seqno(struct kunit *test) > dma_fence_put(f1); > } > > +static void test_dedup_empty(struct kunit *test) > +{ > + struct dma_fence *fence[1] = { NULL }; > + int ret; > + > + ret = dma_fence_dedup_array(fence, 0); > + KUNIT_EXPECT_EQ(test, ret, 0); > +} > + > static void test_unwrap_merge_order(struct kunit *test) > { > struct dma_fence *fence, *f1, *f2, *a1, *a2, *c1, *c2; > @@ -595,6 +604,7 @@ static struct kunit_case dma_fence_unwrap_cases[] = { > KUNIT_CASE(test_unwrap_merge_order), > KUNIT_CASE(test_unwrap_merge_complex), > KUNIT_CASE(test_unwrap_merge_complex_seqno), > + KUNIT_CASE(test_dedup_empty), > {} > }; >

1 week

Re: [PATCH v11 01/13] dma-buf: introduce initial file I/O infrastructure

by Christian König

On 10/14/26 13:01, Pavel Begunkov wrote: > The goal is to be able to natively use dma-buf in the read-write / IO > path. This patch adds basic building blocks serving as a glue and API > between drivers and upper layer subsystems providing the uAPI. Later > patches implement it for NVMe raw block devices and expose it to the > user space via io_uring. > > There are two main objects. struct dma_buf_io_ctx and struct > dma_buf_io_map. The ctx is used during initial registration and serves > as an interface between the upper layer user like io_uring and to the > importer subsystem / driver. The map represents the actual dma map > established for the target device[s] with dma_buf_map_attachment() and > stored in a device specific format. The context is created via a new > file operation ->init_dma_buf_io_ctx. > > The ctx-map separation exists to facilitate map invalidation (see > dma_buf_io_invalidate_mappings()). A ctx can create > multiple maps during its lifetime, but there can only be no more than > one (active) map attached to it. Invalidation drops the active map > if present, and any new I/O request will try to create a new one. > > The primary task of dma_buf_io_map is to count requests using it > and wait for their completion when we want to destroy the DMA map. > > [un]mapping and any work with dma addresses is delegated to the > importer driver via an ops table stored in the ctx, see struct > dma_buf_io_ops. Only the target driver / subsystem knows about devices > it wants to use the dma-buf with, especially in case of multi-device > filesystems or stacking in the future. > > Acked-by: Matthew Brost <matthew.brost(a)intel.com> > Tested-by: Matthew Brost <matthew.brost(a)intel.com> > Acked-by: Christian König <christian.koenig(a)amd.com> > Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> > --- > drivers/dma-buf/Makefile | 2 +- > drivers/dma-buf/dma-buf-io.c | 229 +++++++++++++++++++++++++++++++++++ > include/linux/dma-buf-io.h | 125 +++++++++++++++++++ > include/linux/fs.h | 2 + > 4 files changed, 357 insertions(+), 1 deletion(-) > create mode 100644 drivers/dma-buf/dma-buf-io.c > create mode 100644 include/linux/dma-buf-io.h > > diff --git a/drivers/dma-buf/Makefile b/drivers/dma-buf/Makefile > index b25d7550bacf..523731b0f83e 100644 > --- a/drivers/dma-buf/Makefile > +++ b/drivers/dma-buf/Makefile > @@ -1,6 +1,6 @@ > # SPDX-License-Identifier: GPL-2.0-only > obj-y := dma-buf.o dma-fence.o dma-fence-array.o dma-fence-chain.o \ > - dma-fence-unwrap.o dma-resv.o dma-buf-mapping.o > + dma-fence-unwrap.o dma-resv.o dma-buf-mapping.o dma-buf-io.o > obj-$(CONFIG_DMABUF_HEAPS) += dma-heap.o > obj-$(CONFIG_DMABUF_HEAPS) += heaps/ > obj-$(CONFIG_SYNC_FILE) += sync_file.o > diff --git a/drivers/dma-buf/dma-buf-io.c b/drivers/dma-buf/dma-buf-io.c > new file mode 100644 > index 000000000000..21296bd3dde1 > --- /dev/null > +++ b/drivers/dma-buf/dma-buf-io.c > @@ -0,0 +1,229 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > +/* > + * Common infrastructure for supporing dma-buf in the I/O path. > + * > + * Copyright (C) 2026 Pavel Begunkov <asml.silence(a)gmail.com> > + */ > +#include <linux/dma-buf-io.h> > +#include <linux/dma-resv.h> > + > +static void dma_buf_io_map_release(struct dma_buf_io_map *map) > +{ > + struct dma_buf_io_ctx *ctx = map->ctx; > + > + dma_resv_assert_held(ctx->dmabuf->resv); > + > + percpu_ref_exit(&map->refs); > + ctx->dev_ops->unmap(ctx, map); > +} > + > +static void dma_buf_io_map_refs_cb(struct percpu_ref *ref) > +{ > + struct dma_buf_io_map *map = container_of(ref, struct dma_buf_io_map, refs); > + > + complete(&map->drained); > +} > + > +static void dma_buf_io_kill_map(struct dma_buf_io_ctx *ctx) > +{ > + struct dma_buf_io_map *map; > + > + dma_resv_assert_held(ctx->dmabuf->resv); > + > + map = rcu_dereference_protected(ctx->map, > + dma_resv_held(ctx->dmabuf->resv)); > + if (!map) > + return; > + > + rcu_assign_pointer(ctx->map, NULL); > + percpu_ref_kill(&map->refs); > + /* make sure the map is not visible via ctx->map */ > + synchronize_rcu_expedited(); > + wait_for_completion(&map->drained); > + dma_buf_io_map_release(map); > +} > + > +int dma_buf_io_init_map(struct dma_buf_io_ctx *ctx, struct dma_buf_io_map *map, > + struct sg_table *sgt) You somehow forgotten the kerneldoc I asked for here. Apart from that still looks good, but I had only time to skim over it. Regards, Christian. > +{ > + unsigned seg_shift = ~0U; > + struct scatterlist *sg; > + unsigned long tmp; > + int ret; > + > + for_each_sgtable_dma_sg(sgt, sg, tmp) > + seg_shift = min(seg_shift, __ffs(sg_dma_len(sg))); > + > + ret = percpu_ref_init(&map->refs, dma_buf_io_map_refs_cb, 0, GFP_KERNEL); > + if (ret) > + return ret; > + init_completion(&map->drained); > + map->min_seg_shift = seg_shift; > + map->ctx = ctx; > + return 0; > +} > +EXPORT_SYMBOL_NS_GPL(dma_buf_io_init_map, "DMA_BUF"); > + > +static struct dma_buf_io_map *__dma_buf_io_create_map(struct dma_buf_io_ctx *ctx) > +{ > + struct dma_buf *dmabuf = ctx->dmabuf; > + struct dma_buf_io_map *map; > + long ret; > + > + dma_resv_assert_held(dmabuf->resv); > + > + if (ctx->is_dead) > + return ERR_PTR(-ENOENT); > + > + map = __dma_buf_io_get_map(ctx); > + if (map) > + return map; > + > + map = ctx->dev_ops->map(ctx); > + if (IS_ERR(map)) > + return map; > + > + if (WARN_ON_ONCE(!map->min_seg_shift)) > + return ERR_PTR(-EFAULT); > + > + ret = dma_resv_wait_timeout(dmabuf->resv, DMA_RESV_USAGE_KERNEL, > + true, MAX_SCHEDULE_TIMEOUT); > + if (ret <= 0) { > + if (!ret) > + ret = -EAGAIN; > + dma_buf_io_map_release(map); > + return ERR_PTR(ret); > + } > + > + /* get a reference for the caller */ > + percpu_ref_get(&map->refs); > + rcu_assign_pointer(ctx->map, map); > + return map; > +} > + > +/** > + * dma_buf_io_create_map - Create a new or reference an existing map. > + * @ctx: [in] dma-buf I/O context > + * > + * A slow path part of dma_buf_io_get_map() and shouldn't be used directly. > + * Behaves in the same way but allowed to block. > + * > + * Returns a map on success, or ERR_PTR encoded errno otherwise. > + */ > +struct dma_buf_io_map *dma_buf_io_create_map(struct dma_buf_io_ctx *ctx) > +{ > + struct dma_buf_io_map *map; > + int ret; > + > + ret = dma_resv_lock_interruptible(ctx->dmabuf->resv, NULL); > + if (ret) > + return ERR_PTR(ret); > + > + map = __dma_buf_io_create_map(ctx); > + dma_resv_unlock(ctx->dmabuf->resv); > + return map; > +} > + > +static void dma_buf_io_ctx_shutdown(struct dma_buf_io_ctx *ctx) > +{ > + dma_resv_lock(ctx->dmabuf->resv, NULL); > + ctx->is_dead = true; > + dma_buf_io_kill_map(ctx); > + dma_resv_unlock(ctx->dmabuf->resv); > +} > + > +/* > + * dma_buf_io_ctx_create - create a new dma-buf I/O context for the given file. > + * @file: [in] file for which the context is created > + * @dmabuf: [in] buffer to create a context from > + * @dir: [in] direction of DMA transfers > + * @out_ctx [out] resulting ctx > + * > + * Create a new I/O context from the given DMA buffer for the given file. > + * It only works with files implementing ->init_dma_buf_io_ctx and fails > + * with -EOPNOTSUPP otherwise. Once created, the user can create a map > + * and use it to issue I/O like read / write requests to @file. > + */ > +int dma_buf_io_ctx_create(struct file *file, > + struct dma_buf *dmabuf, > + enum dma_data_direction dir, > + struct dma_buf_io_ctx **out_ctx) > +{ > + struct dma_buf_io_ctx *ctx; > + int ret; > + > + if (!file->f_op->init_dma_buf_io_ctx) > + return -EOPNOTSUPP; > + > + ctx = kzalloc_obj(*ctx); > + if (!ctx) > + return -ENOMEM; > + ctx->dir = dir; > + ctx->dmabuf = dmabuf; > + get_dma_buf(dmabuf); > + > + ret = file->f_op->init_dma_buf_io_ctx(file, ctx); > + if (ret) { > + kfree(ctx); > + dma_buf_put(dmabuf); > + return ret; > + } > + > + if (WARN_ON_ONCE(!ctx->dev_ops || > + !ctx->dev_ops->map || > + !ctx->dev_ops->unmap || > + !ctx->dev_ops->release)) > + return -EINVAL; > + > + *out_ctx = ctx; > + return 0; > +} > + > +/** > + * dma_buf_io_ctx_release - destroy the I/O context > + * @ctx: [in] dma-buf I/O context > + * > + * Destroy the context. It makes sure all maps are waited on and destroyed, > + * and can block for I/O to complete. It detaches from the importer and > + * destroys all its resources via the ->release callback, and frees the > + * context. > + */ > +void dma_buf_io_ctx_release(struct dma_buf_io_ctx *ctx) > +{ > + dma_buf_io_ctx_shutdown(ctx); > + > + if (WARN_ON_ONCE(rcu_dereference_protected(ctx->map, true))) > + return; > + > + ctx->dev_ops->release(ctx); > + dma_buf_put(ctx->dmabuf); > + kfree(ctx); > +} > + > +/** > + * dma_buf_io_invalidate_mappings - invalidate the current map > + * @ctx: [in] dma-buf I/O context > + * > + * Importer's helper for invalidating the current map. Waits for all I/O > + * using the map to complete and destroyes the map. Called with the > + * dma-buf reservation lock held. > + */ > +void dma_buf_io_invalidate_mappings(struct dma_buf_io_ctx *ctx) > +{ > + dma_buf_io_kill_map(ctx); > +} > +EXPORT_SYMBOL_NS_GPL(dma_buf_io_invalidate_mappings, "DMA_BUF"); > + > +/** > + * dma_buf_io_detach - detach the @ctx from the importer. > + * @ctx: [in] dma-buf I/O context > + * > + * Importer's helper for removing the I/O ctx. It kills all maps and > + * prevents creation of new ones. Upon return it's safe for the importer > + * to release all its resources such as dma-buf attachments. > + */ > +void dma_buf_io_detach(struct dma_buf_io_ctx *ctx) > +{ > + dma_buf_io_ctx_shutdown(ctx); > +} > +EXPORT_SYMBOL_NS_GPL(dma_buf_io_detach, "DMA_BUF"); > diff --git a/include/linux/dma-buf-io.h b/include/linux/dma-buf-io.h > new file mode 100644 > index 000000000000..b9bbeca1744f > --- /dev/null > +++ b/include/linux/dma-buf-io.h > @@ -0,0 +1,125 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > +#ifndef __DMA_BUF_IO_H__ > +#define __DMA_BUF_IO_H__ > + > +#include <linux/dma-buf.h> > + > +struct dma_buf_io_ctx; > +struct dma_buf_io_map; > + > +struct dma_buf_io_ops { > + /* > + * Create a new map for the given ctx. Called with the reservation > + * lock held. > + */ > + struct dma_buf_io_map *(*map)(struct dma_buf_io_ctx *ctx); > + > + /* > + * Clean up device specific parts of the @map. Called with the > + * reservation lock held. > + */ > + void (*unmap)(struct dma_buf_io_ctx *ctx, struct dma_buf_io_map *map); > + > + /* > + * The user tries to destroy the ctx. Release all device specific > + * parts of the token. > + */ > + void (*release)(struct dma_buf_io_ctx *); > +}; > + > +struct dma_buf_io_map { > + /* > + * Counts attached requests and other users. Device specific unmapping > + * is deferred until all refs are dropped. > + */ > + struct percpu_ref refs; > + /* > + * Shift for the minimum segment size of the mapping. > + */ > + unsigned min_seg_shift; > + > + struct dma_buf_io_ctx *ctx; > + struct completion drained; > +}; > + > +struct dma_buf_io_ctx { > + struct dma_buf_io_map __rcu *map; > + struct dma_buf *dmabuf; > + enum dma_data_direction dir; > + bool is_dead; > + > + void *dev_priv; > + const struct dma_buf_io_ops *dev_ops; > +}; > + > +int dma_buf_io_ctx_create(struct file *file, > + struct dma_buf *dmabuf, > + enum dma_data_direction dir, > + struct dma_buf_io_ctx **ctx); > +void dma_buf_io_ctx_release(struct dma_buf_io_ctx *ctx); > + > +struct dma_buf_io_map *dma_buf_io_create_map(struct dma_buf_io_ctx *ctx); > + > +static inline struct dma_buf_io_map * > +__dma_buf_io_get_map(struct dma_buf_io_ctx *ctx) > +{ > + struct dma_buf_io_map *map; > + > + guard(rcu)(); > + > + map = rcu_dereference(ctx->map); > + if (unlikely(!map || !percpu_ref_tryget_live_rcu(&map->refs))) > + return NULL; > + > + return map; > +} > + > +/** > + * dma_buf_io_get_map - Create a new or reference an existing map. > + * @ctx: [in] dma-buf I/O context > + * @nowait: [in] specifies whether it's allowed to block > + * > + * Create a new or acquire an existing map. When succeeds, it returns > + * a referenced map, which should eventually be put down with > + * dma_buf_io_map_drop(). If @nowait is set and the function would block, > + * it return -EAGAIN, and the caller is expected to retry from a context > + * where blocking is allowed. > + * > + * Returns a map on success, or ERR_PTR encoded errno otherwise. > + */ > +static inline struct dma_buf_io_map * > +dma_buf_io_get_map(struct dma_buf_io_ctx *ctx, bool nowait) > +{ > + struct dma_buf_io_map *map; > + > + map = __dma_buf_io_get_map(ctx); > + if (likely(map)) > + return map; > + > + if (nowait) > + return ERR_PTR(-EAGAIN); > + return dma_buf_io_create_map(ctx); > +} > + > +/** > + * dma_buf_io_map_drop - Drop the map. > + * @map: [in] dma-buf I/O map > + * > + * Put down a reference for the @map acquired via dma_buf_io_get_map(). > + * Should be called as soon as I/O is completed. > + */ > +static inline void dma_buf_io_map_drop(struct dma_buf_io_map *map) > +{ > + percpu_ref_put(&map->refs); > +} > + > +/* > + * Device API > + */ > + > +void dma_buf_io_invalidate_mappings(struct dma_buf_io_ctx *ctx); > +int dma_buf_io_init_map(struct dma_buf_io_ctx *ctx, struct dma_buf_io_map *map, > + struct sg_table *sgt); > +void dma_buf_io_detach(struct dma_buf_io_ctx *ctx); > + > +#endif > diff --git a/include/linux/fs.h b/include/linux/fs.h > index f9d1e05e8ae6..05c1ff495732 100644 > --- a/include/linux/fs.h > +++ b/include/linux/fs.h > @@ -1914,6 +1914,7 @@ struct dir_context { > #define COPY_FILE_SPLICE (1 << 0) > > struct io_uring_cmd; > +struct dma_buf_io_ctx; > struct offset_ctx; > > struct file_operations { > @@ -1960,6 +1961,7 @@ struct file_operations { > int (*uring_cmd_iopoll)(struct io_uring_cmd *, struct io_comp_batch *, > unsigned int poll_flags); > int (*mmap_prepare)(struct vm_area_desc *); > + int (*init_dma_buf_io_ctx)(struct file *, struct dma_buf_io_ctx *); > } __randomize_layout; > > /* Supports async buffered reads */

1 week

Re: [PATCH v9 00/13] Add dmabuf read/write via io_uring

by Christoph Hellwig

On Mon, Oct 12, 2026 at 02:21:41PM -0600, Jens Axboe wrote: > I've queued this series up for some testing, in a separate branch. JFYI. More testing it obviously good. I've been waiting for addressing of the Sashiko comments on the nvme patches before doing more ACKs, and while I can't really judge the code those in the dma-buf code also look somewhat serious. So it would be useful to get them addressed and the series reposted. Same for folding in the PI vs dmabuf fix from Anuj, although making the combination work would of course be even better.

1 week, 1 day

Re: [RFC PATCH 0/3] dma-buf: warn-only mode for DMABUF_DEBUG

by Sumit Semwal

Hi Karl, On Tue, 13 Oct 2026 at 00:21, Karl Mehltretter <kmehltretter(a)gmail.com> wrote: > > On Mon, Oct 12, 2026 at 10:12:02AM +0100, Thorsten Leemhuis wrote: > > > > What's the status here given that 7.3 will likely be released in a few > > days? Note, I can see from the discussion that this is a complex problem > > that can't be quickly solved. That's how it is sometimes. But I wonder > > if the current state of things is the best compromise for now or if > > Rob's revert or some other option would be better. > > > > I think reverting my commit 143755bdabaa ("dma-buf: Make DMABUF_DEBUG > default to y on DEBUG_KERNEL kernels") is the best interim solution for > v7.3. > > Christian, Sumit, could one of you apply Jianfeng's revert before the > final release? > > https://lore.kernel.org/r/20260926022026.10539-1-liujianfeng1994@gmail.com/ > > Thanks, > Karl I have pushed the revert to drm-misc-fixes; I'll request Dave to push it out to Linus along with drm-fixes. We should revisit this for the next cycle in a couple of weeks for sure. Best, Sumit.

1 week, 1 day

[PATCH v3 0/3] dma-buf: dmabuf->file release-time cleanup

by Matt Evans

Hi all, A fix for DMABUF's file-release path, to set dmabuf->file = NULL when the struct file itself is being freed and avoid a stale pointer lingering. Previously it could be assumed that dmabuf->file was always valid until .release was called, but commit 4ab59c3c638c6 ("dma-buf: Move dma_buf_release() from fops to dentry_ops") separated dentry release (calls .release) from file release (can happen before .release). Setting the pointer to NULL clearly delimits the period in which it points to a valid struct file. Raw dmabuf->file access is bad news unless the file is known to have a reference held (for example, during export). A single-threaded problem scenario is a dentry held open (e.g. using O_PATH) but the file closed; .release is not called, so the exporter was unaware that dmabuf->file became stale. Exporter activities using dmabuf->file then led to a UAF. Or, threads racing concurrent access with a file closing. VFIO uses get_file_active(&dmabuf->file), which is a UAF when the pointer goes stale. Alex Mastro has created a VFIO-centric reproducer [1], which shows up with KASAN. To fix, dmabuf->file is either valid or NULL. get_file_active() is then safe and a recommended way to access dmabuf->file without an existing reference. The only possible outcomes are for it to get a reference to the file, to observe a valid pointer but the file in the DEAD state (being closed, fail), or NULL (fail). Patch [3/3] sets the pointer NULL when the file closes, which get_file_active() handles correctly. vmwgfx was identified as doing a problematic dmabuf->file dereference. Although already a UAF, making dmabuf->file = NULL turns it into an oops. So, patch [1/3] correspondingly converts vmwgfx to use get_file_active() too. i915 GVT unsafely dereferences dmabuf->file for a trivial debug printout after the file reference moves to the dmabuf's fd, so patch [2/3] dereferences in the safe window. Added comments to highlight that dmabuf->file could go away before .release, and to use get_file_active() if a reference isn't otherwise already held. Thanks, Matt [1]: https://github.com/opsound/vfio-dmabuf-lab/blob/main/tests/vfio_dmabuf_opat… Changes: v3: - Better comment for struct dma_buf's file (refer to synchronisation against ->release). - Added trivial i915 patch to remove unsafe debug dmabuf->file accesss. v2: https://lore.kernel.org/all/20261009123601.94079-1-matt@ozlabs.org/ "v1" was the single "dma-buf: Annul dmabuf->file on file release" patch: https://lore.kernel.org/all/f8efaabd-c06e-4f04-8cfa-489c148e37ba@ozlabs.org/ Matt Evans (3): drm/vmwgfx: Use get_file_active() for dmabuf->file drm/i915/gvt: Read dmabuf->file only while valid dma-buf: Annul dmabuf->file on file release drivers/dma-buf/dma-buf.c | 21 ++++++++++++++++++--- drivers/gpu/drm/i915/gvt/dmabuf.c | 5 +++-- drivers/gpu/drm/vmwgfx/ttm_object.c | 2 +- include/linux/dma-buf.h | 5 ++++- 4 files changed, 26 insertions(+), 7 deletions(-) -- 2.47.3

1 week, 1 day

Re: [RFC PATCH 0/3] dma-buf: warn-only mode for DMABUF_DEBUG

by Sumit Semwal

Hi Karl, On Tue, 13 Oct, 2026, 12:21 am Karl Mehltretter, <kmehltretter(a)gmail.com> wrote: > On Mon, Oct 12, 2026 at 10:12:02AM +0100, Thorsten Leemhuis wrote: > > > > What's the status here given that 7.3 will likely be released in a few > > days? Note, I can see from the discussion that this is a complex problem > > that can't be quickly solved. That's how it is sometimes. But I wonder > > if the current state of things is the best compromise for now or if > > Rob's revert or some other option would be better. > > > > I think reverting my commit 143755bdabaa ("dma-buf: Make DMABUF_DEBUG > default to y on DEBUG_KERNEL kernels") is the best interim solution for > v7.3. > > Christian, Sumit, could one of you apply Jianfeng's revert before the > final release? > > https://lore.kernel.org/r/20260926022026.10539-1-liujianfeng1994@gmail.com/ > > Ok, I'll try and revert it for 7.3. We may need to reapply it for the next cycle along with the solution Rob and folks are working on. Thanks, > Karl > Best, Sumit. >

1 week, 1 day

Re: [RFC PATCH v8 02/14] mm: Zero memory during shared memory transitions

by Aneesh Kumar K.V

Kiryl Shutsemau <kas(a)kernel.org> writes: > On Thu, Sep 24, 2026 at 03:35:17PM +0530, Aneesh Kumar K.V (Arm) wrote: >> diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c >> index f904a636d449..1f1f39082391 100644 >> --- a/arch/x86/coco/tdx/tdx.c >> +++ b/arch/x86/coco/tdx/tdx.c >> @@ -978,6 +978,9 @@ static bool tdx_enc_status_changed(unsigned long vaddr, int numpages, bool enc) >> static int tdx_enc_status_change_prepare(unsigned long vaddr, int numpages, >> bool enc) >> { >> + if (!enc) >> + memset((void *)vaddr, 0, (size_t)numpages << PAGE_SHIFT); >> + >> /* >> * Only handle shared->private conversion here. >> * See the comment in tdx_early_init(). > > This doesn't make sense to me. > > On TDX the memset zeroes a page that is about to be dropped. > MapGPA(shared) makes the VMM back the GPA with different memory, and > what the guest reads afterwards through the shared mapping is whatever > the host has there. > Does TDX require the guest contents to be preserved when pages are converted to shared? The memset() is done here because CoCo shared-memory allocations now ignore __GFP_ZERO and instead always zero the memory explicitly. For CoCo architectures such as CCA, this must be done after the memory is converted to shared because shared memory uses a different encryption context. The full patch avoids zeroing the memory twice. If __GFP_ZERO is used for a CoCo shared-page allocation, the page is first zeroed during allocation, then converted to shared, and must be zeroed again. I only changed Arm CCA in this series because I was unsure whether the other architectures required similar changes. Therefore, every CoCo architecture other than CCA currently performs the memset() before conversion, while CCA performs it afterward. If the host expects to see the guest contents from before the conversion to shared, we will have to pass the allocation flags down to these helpers and perform the memset() only when __GFP_ZERO was requested, along the lines of: https://lore.kernel.org/all/yq5aa4p82sqt.fsf@kernel.org To keep the changes minimal, the current approach always performs the memset() rather than passing down a flag. -aneesh

1 week, 1 day

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig October 2026