Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

24 participants
3677 discussions

[PATCH v3 0/8] memcg: dma-buf cgroup accounting and charge transfer

by Albert Esteve

Shared-memory allocator services (e.g., Android's gralloc) allocate dma-bufs on behalf of client processes in different cgroups. Today those allocations are charged to the allocator's own cgroup, leaving client cgroups with no visibility into their actual memory consumption and defeating resource limits. This series adds memory cgroup accounting for dma-buf allocations, building on T.J. Mercier's earlier series [1] and incorporating feedback from previous versions and LPC discussions [2]. Patch 1 introduces the MEMCG_DMABUF stat and reserve/commit/cancel and uncharge helpers. Rather than charging at the page level via __GFP_ACCOUNT (which would require every dma-buf exporter to implement charging, and makes cross-cgroup transfer impractical without access to backing pages), we track charges externally on struct dma_buf via a MEMCG_DMABUF stat counter and route all accounting through a single path, removing the __GFP_ACCOUNT flag from system-heap allocations to avoid double counting. Patch 2 adds a charge_fd field to DMA_HEAP_IOCTL_ALLOC, accepting either a pidfd or a cgroupfd to identify the target cgroup at allocation time. If the target cgroup cannot accommodate the charge, the allocation returns -ENOMEM. Patches 3-6 add access control for cross-cgroup charging. Letting userspace decide who to charge needs to be a privileged operation because it has material impact on OOM decission and resource limits. We gate it via LSM hooks for the two charge_fd flavours: security_dma_buf_charge_task() gates the pidfd path (target identified by task credentials) and security_dma_buf_charge_cgroup() gates the cgroupfd path (target identified by cgroup directory label), with SELinux implementations under a dma_buf object class. Patch 7 adds DMA_BUF_IOCTL_XFER_CHARGE, a general ioctl on any dma-buf fd to transfer charges post-allocation. This covers the double-hop allocator case (SurfaceFlinger -> gralloc -> kernel) and works for buffers from any exporter (DRM, V4L2, etc.). A new memcg_account flag is added for dma_buf_export() to ensure that transfer/charge is only applied for buffers backed by reclaimable system memory. If the receiving cgroup lacks capacity for the charge, the ioctl returns -ENOMEM and the original charge is preserved. Patch 8 adds selftests. Known limitations: - Single-owner model: a dma-buf carries one memcg charge regardless of how many processes share it. - Only memcg accounting. CMA heaps would additionally need dmem controller integration. - If a transfer of an uncharged buffer fails, it remains uncharged. The allocator (userspace) is expected to handle this (retry, free, ...). - The LSM hooks are intentionally narrow. Broader cgroup access controls (e.g. for the memfd/kexec handover case [2]) could be a separate effort reusing the same pattern. - Only system heap sets memcg_account today. Other exporters (DRM, V4L2, etc.) can opt in by setting the flag, but are not covered by this series. [1] https://lore.kernel.org/cgroups/20230109213809.418135-1-tjmercier@google.co… [2] https://lpc.events/event/20/contributions/2416/ Signed-off-by: Albert Esteve <aesteve(a)redhat.com> --- Changes in v3: - Split mem_cgroup_charge_dmabuf() into reserve/commit/cancel three-phase API - Extract mem_cgroup_get_from_fd() helper shared by allocate and xfer paths - Rename __padding to flags in struct dma_buf_transfer_charge - Fix UAF race: move mod_memcg_state() before cmpxchg in transfer - Add memcg_account opt-in flag; xfer returns -EOPNOTSUPP if unset - Wrap dma_buf_charge_cgroup hook in #ifdef CONFIG_CGROUPS - Fix TOCTOU in SELinux charge_cgroup xattr length handling - Link to v2: https://lore.kernel.org/r/20261021-v2_20230123_tjmercier_google_com-v2-0-ef… Changes in v2: - Move charge_pid_fd to charge_fd, accepting cgroupfd in addition to pidfd per Christian König. - New DMA_BUF_IOCTL_XFER_CHARGE ioctl for post-allocation charge transfer on any dma-buf, not just dma-heap buffers per Christian König and T.J. Mercier. - Moved __GFP_ACCOUNT removal to patch 1 per Barry Song. - dma-buf charge/uncharge helpers take struct dma_buf * directly to avoid the need for caller to manage size calculations. - Added test_xfer_charge_cgroupfd_self to dmabuf-heap selftests. - Added LSM and SELinux hooks for cgroupfd-based charging. - Rebased to v7.3-rc7. - Link to v1: https://lore.kernel.org/r/20260512-v2_20230123_tjmercier_google_com-v1-0-63… --- Albert Esteve (7): dma-heap: charge dma-buf memory via explicit memcg security: dma-buf: Add dma_buf_charge_task LSM hook security: dma-buf: Add dma_buf_charge_cgroup LSM hook selinux: Restrict cross-cgroup dma-buf charging selinux: Restrict dma-buf direct cgroup charging dma-buf: transfer memcg charges via DMA_BUF_IOCTL_XFER_CHARGE selftests/dmabuf-heaps: Add dma-buf memcg accounting tests T.J. Mercier (1): memcg: Add MEMCG_DMABUF accounting infrastructure Documentation/admin-guide/cgroup-v2.rst | 5 + drivers/dma-buf/dma-buf.c | 46 ++++ drivers/dma-buf/dma-heap.c | 28 +- drivers/dma-buf/heaps/cma_heap.c | 3 +- drivers/dma-buf/heaps/system_heap.c | 22 +- drivers/tee/tee_heap.c | 3 +- include/linux/dma-buf.h | 9 + include/linux/dma-heap.h | 3 +- include/linux/lsm_hook_defs.h | 4 + include/linux/memcontrol.h | 52 ++++ include/linux/security.h | 18 ++ include/uapi/linux/dma-buf.h | 26 ++ include/uapi/linux/dma-heap.h | 7 + mm/memcontrol.c | 192 ++++++++++++++ security/security.c | 34 +++ security/selinux/hooks.c | 44 ++++ security/selinux/include/classmap.h | 1 + tools/testing/selftests/cgroup/Makefile | 2 +- tools/testing/selftests/cgroup/test_memcontrol.c | 290 ++++++++++++++++++++- tools/testing/selftests/dmabuf-heaps/config | 1 + tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 227 +++++++++++++++- tools/testing/selftests/dmabuf-heaps/vmtest.sh | 226 ++++++++++++++++ 22 files changed, 1228 insertions(+), 15 deletions(-) --- base-commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907 change-id: 20260508-v2_20230123_tjmercier_google_com-f44fcfb16530 Best regards, -- Albert Esteve <aesteve(a)redhat.com>

10 hours, 1 minute

Re: [PATCH 23/26] treewide: Rename dma_buf_attach() to dma_buf_sgt_attach()

by Christian König

On 10/26/26 06:36, Alistair Popple wrote: > From: Jason Gunthorpe <jgg(a)nvidia.com> > > This attach function always creates a SGT mapping type importer. Yeah that is a clear NO-GO. The attachment should be the same for the new interface as well. Regards, Christian. > > Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> > --- > Documentation/gpu/todo.rst | 2 +- > drivers/accel/amdxdna/amdxdna_gem.c | 2 +- > drivers/accel/ivpu/ivpu_gem.c | 2 +- > drivers/accel/qaic/qaic_data.c | 2 +- > drivers/dma-buf/dma-buf.c | 14 +++++++------- > drivers/gpu/drm/armada/armada_gem.c | 2 +- > drivers/gpu/drm/drm_gem_shmem_helper.c | 2 +- > drivers/gpu/drm/drm_prime.c | 2 +- > drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c | 2 +- > .../gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c | 2 +- > drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c | 2 +- > drivers/gpu/drm/tegra/gem.c | 4 ++-- > drivers/iio/industrialio-buffer.c | 2 +- > .../media/common/videobuf2/videobuf2-dma-contig.c | 2 +- > drivers/media/common/videobuf2/videobuf2-dma-sg.c | 2 +- > .../media/platform/nvidia/tegra-vde/dmabuf-cache.c | 2 +- > drivers/misc/fastrpc.c | 2 +- > drivers/usb/gadget/function/f_fs.c | 2 +- > drivers/xen/gntdev-dmabuf.c | 2 +- > include/linux/dma-buf.h | 10 +++++----- > io_uring/zcrx.c | 2 +- > net/core/devmem.c | 2 +- > 22 files changed, 33 insertions(+), 33 deletions(-) > > diff --git a/Documentation/gpu/todo.rst b/Documentation/gpu/todo.rst > index 14cf37590fc7..be0397c197f1 100644 > --- a/Documentation/gpu/todo.rst > +++ b/Documentation/gpu/todo.rst > @@ -633,7 +633,7 @@ Remove automatic page mapping from dma-buf importing > > When importing dma-bufs, the dma-buf and PRIME frameworks automatically map > imported pages into the importer's DMA area. drm_gem_prime_fd_to_handle() and > -drm_gem_prime_handle_to_fd() require that importers call dma_buf_attach() > +drm_gem_prime_handle_to_fd() require that importers call dma_buf_sgt_attach() > even if they never do actual device DMA, but only CPU access through > dma_buf_vmap(). This is a problem for USB devices, which do not support DMA > operations. > diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c > index a7e759bb0460..2b2f1e9fb9ec 100644 > --- a/drivers/accel/amdxdna/amdxdna_gem.c > +++ b/drivers/accel/amdxdna/amdxdna_gem.c > @@ -893,7 +893,7 @@ amdxdna_gem_prime_import(struct drm_device *dev, struct dma_buf *dma_buf) > > get_dma_buf(dma_buf); > > - attach = dma_buf_attach(dma_buf, dev->dev); > + attach = dma_buf_sgt_attach(dma_buf, dev->dev); > if (IS_ERR(attach)) { > ret = PTR_ERR(attach); > goto put_buf; > diff --git a/drivers/accel/ivpu/ivpu_gem.c b/drivers/accel/ivpu/ivpu_gem.c > index 8d6ed95ccc7c..d1c99b974a34 100644 > --- a/drivers/accel/ivpu/ivpu_gem.c > +++ b/drivers/accel/ivpu/ivpu_gem.c > @@ -219,7 +219,7 @@ struct drm_gem_object *ivpu_gem_prime_import(struct drm_device *dev, > struct ivpu_bo *bo; > int ret; > > - attach = dma_buf_attach(dma_buf, attach_dev); > + attach = dma_buf_sgt_attach(dma_buf, attach_dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c > index 92d49448df72..88331028b7bf 100644 > --- a/drivers/accel/qaic/qaic_data.c > +++ b/drivers/accel/qaic/qaic_data.c > @@ -850,7 +850,7 @@ struct drm_gem_object *qaic_gem_prime_import(struct drm_device *dev, struct dma_ > obj = &bo->base; > get_dma_buf(dma_buf); > > - attach = dma_buf_attach(dma_buf, dev->dev); > + attach = dma_buf_sgt_attach(dma_buf, dev->dev); > if (IS_ERR(attach)) { > ret = PTR_ERR(attach); > goto attach_fail; > diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c > index 12604c60122e..06bc25eff079 100644 > --- a/drivers/dma-buf/dma-buf.c > +++ b/drivers/dma-buf/dma-buf.c > @@ -671,7 +671,7 @@ static struct file *dma_buf_getfile(size_t size, int flags) > * 2. Userspace passes this file-descriptors to all drivers it wants this buffer > * to share with: First the file descriptor is converted to a &dma_buf using > * dma_buf_get(). Then the buffer is attached to the device using > - * dma_buf_attach(). > + * dma_buf_sgt_attach(). > * > * Up to this stage the exporter is still free to migrate or reallocate the > * backing storage. > @@ -966,7 +966,7 @@ dma_buf_pin_on_map(struct dma_buf_attachment *attach) > * 2. Importers must not hold the dma-buf reservation lock when calling these > * functions: > * > - * - dma_buf_attach() > + * - dma_buf_sgt_attach() > * - dma_buf_dynamic_attach() > * - dma_buf_detach() > * - dma_buf_export() > @@ -1100,15 +1100,15 @@ struct dma_buf_attachment *dma_buf_mapping_attach( > EXPORT_SYMBOL_NS_GPL(dma_buf_mapping_attach, "DMA_BUF"); > > /** > - * dma_buf_attach - Wrapper for dma_buf_mapping_attach > + * dma_buf_sgt_attach - Wrapper for dma_buf_mapping_attach > * @dmabuf: [in] buffer to attach device to. > * @dev: [in] device to be attached. > * > * Wrapper to call dma_buf_mapping_attach() for drivers which still use a static > * mapping. > */ > -struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf, > - struct device *dev) > +struct dma_buf_attachment *dma_buf_sgt_attach(struct dma_buf *dmabuf, > + struct device *dev) > { > struct dma_buf_mapping_match sgt_match[] = { > DMA_BUF_IMAPPING_SGT(dev, DMA_SGT_NO_P2P), > @@ -1117,7 +1117,7 @@ struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf, > return dma_buf_mapping_attach(dmabuf, sgt_match, ARRAY_SIZE(sgt_match), > NULL, NULL); > } > -EXPORT_SYMBOL_NS_GPL(dma_buf_attach, "DMA_BUF"); > +EXPORT_SYMBOL_NS_GPL(dma_buf_sgt_attach, "DMA_BUF"); > > /** > * dma_buf_dynamic_attach - Add the device to dma_buf's attachments list > @@ -1149,7 +1149,7 @@ EXPORT_SYMBOL_NS_GPL(dma_buf_dynamic_attach, "DMA_BUF"); > * @dmabuf: [in] buffer to detach from. > * @attach: [in] attachment to be detached; is free'd after this call. > * > - * Clean up a device attachment obtained by calling dma_buf_attach(). > + * Clean up a device attachment obtained by calling dma_buf_sgt_attach(). > * > * Optionally this calls &dma_buf_ops.detach for device-specific detach. > */ > diff --git a/drivers/gpu/drm/armada/armada_gem.c b/drivers/gpu/drm/armada/armada_gem.c > index 72c7cd2b3fb9..438f33304eab 100644 > --- a/drivers/gpu/drm/armada/armada_gem.c > +++ b/drivers/gpu/drm/armada/armada_gem.c > @@ -518,7 +518,7 @@ armada_gem_prime_import(struct drm_device *dev, struct dma_buf *buf) > } > } > > - attach = dma_buf_attach(buf, dev->dev); > + attach = dma_buf_sgt_attach(buf, dev->dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/gpu/drm/drm_gem_shmem_helper.c b/drivers/gpu/drm/drm_gem_shmem_helper.c > index d654a22a30de..9e937af2ee73 100644 > --- a/drivers/gpu/drm/drm_gem_shmem_helper.c > +++ b/drivers/gpu/drm/drm_gem_shmem_helper.c > @@ -964,7 +964,7 @@ struct drm_gem_object *drm_gem_shmem_prime_import_no_map(struct drm_device *dev, > return obj; > } > > - attach = dma_buf_attach(dma_buf, dev->dev); > + attach = dma_buf_sgt_attach(dma_buf, dev->dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c > index 3ffbe3d28929..3084e8c28e53 100644 > --- a/drivers/gpu/drm/drm_prime.c > +++ b/drivers/gpu/drm/drm_prime.c > @@ -999,7 +999,7 @@ struct drm_gem_object *drm_gem_prime_import_dev(struct drm_device *dev, > if (!dev->driver->gem_prime_import_sg_table) > return ERR_PTR(-EINVAL); > > - attach = dma_buf_attach(dma_buf, attach_dev); > + attach = dma_buf_sgt_attach(dma_buf, attach_dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c > index 7f939c281308..9865a7a9ad8f 100644 > --- a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c > +++ b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c > @@ -306,7 +306,7 @@ struct drm_gem_object *i915_gem_prime_import(struct drm_device *dev, > return ERR_PTR(-E2BIG); > > /* need to attach */ > - attach = dma_buf_attach(dma_buf, dev->dev); > + attach = dma_buf_sgt_attach(dma_buf, dev->dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c > index 6b6d235fd3e9..3c193e6d9d11 100644 > --- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c > +++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c > @@ -287,7 +287,7 @@ static int igt_dmabuf_import_same_driver(struct drm_i915_private *i915, > goto out_import; > > /* Now try a fake an importer */ > - import_attach = dma_buf_attach(dmabuf, obj->base.dev->dev); > + import_attach = dma_buf_sgt_attach(dmabuf, obj->base.dev->dev); > if (IS_ERR(import_attach)) { > err = PTR_ERR(import_attach); > goto out_import; > diff --git a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c > index c549b94b2e8a..ca0962a99509 100644 > --- a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c > +++ b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c > @@ -115,7 +115,7 @@ struct drm_gem_object *omap_gem_prime_import(struct drm_device *dev, > } > } > > - attach = dma_buf_attach(dma_buf, dev->dev); > + attach = dma_buf_sgt_attach(dma_buf, dev->dev); > if (IS_ERR(attach)) > return ERR_CAST(attach); > > diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c > index f06826fe8366..803409824711 100644 > --- a/drivers/gpu/drm/tegra/gem.c > +++ b/drivers/gpu/drm/tegra/gem.c > @@ -81,7 +81,7 @@ static struct host1x_bo_mapping *tegra_bo_pin(struct device *dev, struct host1x_ > if (obj->dma_buf) { > struct dma_buf *buf = obj->dma_buf; > > - map->attach = dma_buf_attach(buf, dev); > + map->attach = dma_buf_sgt_attach(buf, dev); > if (IS_ERR(map->attach)) { > err = PTR_ERR(map->attach); > goto free; > @@ -475,7 +475,7 @@ static struct tegra_bo *tegra_bo_import(struct drm_device *drm, > * domain, map it first to the DRM device to get an sgt. > */ > if (tegra->domain) { > - attach = dma_buf_attach(buf, drm->dev); > + attach = dma_buf_sgt_attach(buf, drm->dev); > if (IS_ERR(attach)) { > err = PTR_ERR(attach); > goto free; > diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c > index f81154642bcd..abffbcc76c4c 100644 > --- a/drivers/iio/industrialio-buffer.c > +++ b/drivers/iio/industrialio-buffer.c > @@ -1717,7 +1717,7 @@ static int iio_buffer_attach_dmabuf(struct iio_dev_buffer_pair *ib, > goto err_free_priv; > } > > - attach = dma_buf_attach(dmabuf, dma_dev); > + attach = dma_buf_sgt_attach(dmabuf, dma_dev); > if (IS_ERR(attach)) { > err = PTR_ERR(attach); > goto err_dmabuf_put; > diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/drivers/media/common/videobuf2/videobuf2-dma-contig.c > index e13521b5c0e8..c7fa86cba8ad 100644 > --- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c > +++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c > @@ -789,7 +789,7 @@ static void *vb2_dc_attach_dmabuf(struct vb2_buffer *vb, struct device *dev, > buf->vb = vb; > > /* create attachment for the dmabuf with the user device */ > - dba = dma_buf_attach(dbuf, buf->dev); > + dba = dma_buf_sgt_attach(dbuf, buf->dev); > if (IS_ERR(dba)) { > pr_err("failed to attach dmabuf\n"); > kfree(buf); > diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c > index 59e346a5d48b..4c93b7f58e1f 100644 > --- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c > +++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c > @@ -638,7 +638,7 @@ static void *vb2_dma_sg_attach_dmabuf(struct vb2_buffer *vb, struct device *dev, > > buf->dev = dev; > /* create attachment for the dmabuf with the user device */ > - dba = dma_buf_attach(dbuf, buf->dev); > + dba = dma_buf_sgt_attach(dbuf, buf->dev); > if (IS_ERR(dba)) { > pr_err("failed to attach dmabuf\n"); > kfree(buf); > diff --git a/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c b/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c > index 55d58a4dbbe2..d80282ebe4b4 100644 > --- a/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c > +++ b/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c > @@ -96,7 +96,7 @@ int tegra_vde_dmabuf_cache_map(struct tegra_vde *vde, > goto ref; > } > > - attachment = dma_buf_attach(dmabuf, dev); > + attachment = dma_buf_sgt_attach(dmabuf, dev); > if (IS_ERR(attachment)) { > dev_err(dev, "Failed to attach dmabuf\n"); > err = PTR_ERR(attachment); > diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c > index 375ce39c78c9..24ae1038b634 100644 > --- a/drivers/misc/fastrpc.c > +++ b/drivers/misc/fastrpc.c > @@ -904,7 +904,7 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, > goto get_err; > } > > - map->attach = dma_buf_attach(map->buf, sess->dev); > + map->attach = dma_buf_sgt_attach(map->buf, sess->dev); > if (IS_ERR(map->attach)) { > dev_err(sess->dev, "Failed to attach dmabuf\n"); > err = PTR_ERR(map->attach); > diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c > index 4016edfa4c02..bfa24bcfe84c 100644 > --- a/drivers/usb/gadget/function/f_fs.c > +++ b/drivers/usb/gadget/function/f_fs.c > @@ -1549,7 +1549,7 @@ static int ffs_dmabuf_attach(struct file *file, int fd) > if (IS_ERR(dmabuf)) > return PTR_ERR(dmabuf); > > - attach = dma_buf_attach(dmabuf, gadget->dev.parent); > + attach = dma_buf_sgt_attach(dmabuf, gadget->dev.parent); > if (IS_ERR(attach)) { > err = PTR_ERR(attach); > goto err_dmabuf_put; > diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c > index cd851eb04a69..e7ffb546e717 100644 > --- a/drivers/xen/gntdev-dmabuf.c > +++ b/drivers/xen/gntdev-dmabuf.c > @@ -580,7 +580,7 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev, > gntdev_dmabuf->priv = priv; > gntdev_dmabuf->fd = fd; > > - attach = dma_buf_attach(dma_buf, dev); > + attach = dma_buf_sgt_attach(dma_buf, dev); > if (IS_ERR(attach)) { > ret = ERR_CAST(attach); > goto fail_free_obj; > diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h > index b264e1c4a9df..208752eb93d9 100644 > --- a/include/linux/dma-buf.h > +++ b/include/linux/dma-buf.h > @@ -77,7 +77,7 @@ struct dma_buf_ops { > /** > * @attach: > * > - * This is called from dma_buf_attach() to make sure that a given > + * This is called from dma_buf_sgt_attach() to make sure that a given > * &dma_buf_attachment.dev can access the provided &dma_buf. Exporters > * which support buffer objects in special locations like VRAM or > * device-specific carveout areas should check whether the buffer could > @@ -125,7 +125,7 @@ struct dma_buf_ops { > * exclusive with @cache_sgt_mapping. > * > * This is called automatically for non-dynamic importers from > - * dma_buf_attach(). > + * dma_buf_sgt_attach(). > * > * Note that similar to non-dynamic exporters in their @map_dma_buf > * callback the driver must guarantee that the memory is available for > @@ -513,7 +513,7 @@ struct dma_buf_attach_ops { > * and its user device(s). The list contains one attachment struct per device > * attached to the buffer. > * > - * An attachment is created by calling dma_buf_attach(), and released again by > + * An attachment is created by calling dma_buf_sgt_attach(), and released again by > * calling dma_buf_detach(). The DMA mapping itself needed to initiate a > * transfer is created by dma_buf_sgt_map_attachment() and freed again by calling > * dma_buf_sgt_unmap_attachment(). > @@ -591,8 +591,8 @@ static inline bool dma_buf_is_dynamic(struct dma_buf *dmabuf) > return !!dmabuf->ops->pin; > } > > -struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf, > - struct device *dev); > +struct dma_buf_attachment *dma_buf_sgt_attach(struct dma_buf *dmabuf, > + struct device *dev); > struct dma_buf_attachment * > dma_buf_dynamic_attach(struct dma_buf *dmabuf, struct device *dev, > const struct dma_buf_attach_ops *importer_ops, > diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c > index 67f74ce4f096..2cbf65b29f89 100644 > --- a/io_uring/zcrx.c > +++ b/io_uring/zcrx.c > @@ -175,7 +175,7 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq, > goto err; > } > > - mem->attach = dma_buf_attach(mem->dmabuf, ifq->dev); > + mem->attach = dma_buf_sgt_attach(mem->dmabuf, ifq->dev); > if (IS_ERR(mem->attach)) { > ret = PTR_ERR(mem->attach); > mem->attach = NULL; > diff --git a/net/core/devmem.c b/net/core/devmem.c > index f30fa375c9ab..d7c08da306cf 100644 > --- a/net/core/devmem.c > +++ b/net/core/devmem.c > @@ -234,7 +234,7 @@ net_devmem_bind_dmabuf(struct net_device *dev, void *vdev, > binding->dmabuf = dmabuf; > binding->direction = direction; > > - binding->attachment = dma_buf_attach(binding->dmabuf, dma_dev); > + binding->attachment = dma_buf_sgt_attach(binding->dmabuf, dma_dev); > if (IS_ERR(binding->attachment)) { > err = PTR_ERR(binding->attachment); > NL_SET_ERR_MSG(extack, "Failed to bind dmabuf to device");

10 hours, 9 minutes

Re: [PATCH 23/26] treewide: Rename dma_buf_attach() to dma_buf_sgt_attach()

by Christian König

On 10/27/26 14:34, Mikko Perttunen wrote: > On Tuesday, October 27, 2026 9:33 PM Jason Gunthorpe wrote: >> On Tue, Oct 27, 2026 at 12:42:32PM +0900, Mikko Perttunen wrote: >> >>>> This page-side use predates the series, so the fault is not itself a v2 >>>> regression. Is dma_buf_sgt_attach() valid for this call site, or does Tegra >>>> need a page/physical mapping type first? >>> >>> Sounds like a bug in TegraDRM; we should be using the DMA addr/length >>> for the explicit IOMMU mapping as the sgt attachment is for the dummy >>> DRM device explicitly intended to give us physical addresses. >> >> No, you cannot connect dmabuf to an iommu_domain. It is 100% always >> illegal. DMABUF does not support this. Do not pass sg_dma to iommu >> functions either. > > Sure, I agree -- so let's say it's a bug on top of the baseline crimes > TegraDRM commits :) Well the initial crime was to abuse sgt to transport dma addresses, don't document how all of this works and then be surprised when everything blew up. But yeah don't touch the pages in sgt exposed by DMA-buf, that is pretty much one of the most fundamental rules we have now. Regards, Christian. > >> >>> I'm currently in the process of removing the whole explicit IOMMU path >>> so if this only occurs with CONFIG_DMABUF_DEBUG enabled, I don't think >>> there's a pressing need to fix this before then. >> >> Yes I think this is probably the only way to fix it :| You have to >> always use the DMA API >> >> Jason >> > > > >

11 hours, 20 minutes

Re: [RFC PATCH v2 1/1] misc: fgds: introduce GPU-File direct I/O via dma-buf

by Christian König

On 10/27/26 10:08, Li Wang wrote: > From: Mengmeng Zhao <zhaomengmeng(a)kylinos.cn> > > This patch introduces a driver that allows moving data between a GPU > dma-buf and a regular file on NVME without staging it through the page > cache. Userspace registers the GPU dma-buf with the device, then issues > read and write requests via the device's ioctls. Each transfer is direct > I/O: an ITER_DMABUF_MAP iterator is passed to the file's read_iter or > write_iter, and the filesystem's iomap path submits REQ_DMABUF bios that > already carry the dma addresses. Why in the world is that still useful with Pavel work on io_uring? > > Signed-off-by: Mengmeng Zhao <zhaomengmeng(a)kylinos.cn> > Signed-off-by: Li Wang <liwang(a)kylinos.cn> > --- > .../userspace-api/ioctl/ioctl-number.rst | 2 + > drivers/dma-buf/dma-buf-io.c | 3 + > drivers/misc/Kconfig | 16 + > drivers/misc/Makefile | 1 + > drivers/misc/fgds.c | 506 ++++++++++++++++++ > fs/iomap/buffered-io.c | 11 + > fs/iomap/direct-io.c | 23 +- > fs/xfs/xfs_file.c | 4 + > include/linux/iov_iter.h | 4 + > include/uapi/linux/fgds.h | 124 +++++ > lib/iov_iter.c | 1 + > mm/filemap.c | 22 +- > 12 files changed, 713 insertions(+), 4 deletions(-) > create mode 100644 drivers/misc/fgds.c > create mode 100644 include/uapi/linux/fgds.h > > diff --git a/Documentation/userspace-api/ioctl/ioctl-number.rst b/Documentation/userspace-api/ioctl/ioctl-number.rst > index 2fc53093752d..5f93a252e773 100644 > --- a/Documentation/userspace-api/ioctl/ioctl-number.rst > +++ b/Documentation/userspace-api/ioctl/ioctl-number.rst > @@ -306,6 +306,8 @@ Code Seq# Include File Comments > 'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API > 'v' C0-FF linux/meye.h conflict! > 'w' all CERN SCI driver > +'x' 00-0F linux/fgds.h Fast GPU Direct Storage > + <mailto:liwang@kylinos.cn> > 'y' 00-1F packet based user level communications > <mailto:zapman@interlan.net> > 'z' 00-3F CAN bus card conflict! > diff --git a/drivers/dma-buf/dma-buf-io.c b/drivers/dma-buf/dma-buf-io.c > index 8440151de860..2ee4fc683c74 100644 > --- a/drivers/dma-buf/dma-buf-io.c > +++ b/drivers/dma-buf/dma-buf-io.c > @@ -135,6 +135,7 @@ struct dma_buf_io_map *dma_buf_io_create_map(struct dma_buf_io_ctx *ctx) > dma_resv_unlock(ctx->dmabuf->resv); > return map; > } > +EXPORT_SYMBOL_NS_GPL(dma_buf_io_create_map, "DMA_BUF"); Clear NAK to that. Those are FS layer helper functionalities for DMA-buf and not something drivers should ever need to mess with. Regards, Christian. > > static void dma_buf_io_ctx_shutdown(struct dma_buf_io_ctx *ctx) > { > @@ -190,6 +191,7 @@ int dma_buf_io_ctx_create(struct file *file, > *out_ctx = ctx; > return 0; > } > +EXPORT_SYMBOL_NS_GPL(dma_buf_io_ctx_create, "DMA_BUF"); > > /** > * dma_buf_io_ctx_release - Destroy the I/O context > @@ -211,6 +213,7 @@ void dma_buf_io_ctx_release(struct dma_buf_io_ctx *ctx) > dma_buf_put(ctx->dmabuf); > kfree(ctx); > } > +EXPORT_SYMBOL_NS_GPL(dma_buf_io_ctx_release, "DMA_BUF"); > > /** > * dma_buf_io_invalidate_mappings - Invalidate the current map > diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig > index 7364931dad3a..b85fd64d27ad 100644 > --- a/drivers/misc/Kconfig > +++ b/drivers/misc/Kconfig > @@ -568,6 +568,22 @@ config MCHP_LAN966X_PCI > - lan966x-miim (MDIO_MSCC_MIIM) > - lan966x-switch (LAN966X_SWITCH) > > +config FGDS > + tristate "Fast GPU Direct Storage support" > + depends on DMA_SHARED_BUFFER && BLOCK > + default n > + help > + This driver exposes a misc device that moves data between a GPU > + dma-buf and a regular file with synchronous read/write ioctls, > + submitting the transfer as direct I/O (REQ_DMABUF bios) through > + the file system's iomap DIO path without a page cache bounce > + buffer. > + > + To compile this driver as a module, choose M here: the module > + will be called fgds. > + > + If unsure, say N. > + > source "drivers/misc/c2port/Kconfig" > source "drivers/misc/eeprom/Kconfig" > source "drivers/misc/cb710/Kconfig" > diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile > index e8d8d5d88c0d..cd98ef3d008e 100644 > --- a/drivers/misc/Makefile > +++ b/drivers/misc/Makefile > @@ -70,4 +70,5 @@ obj-$(CONFIG_MCHP_LAN966X_PCI) += lan966x-pci.o > obj-y += keba/ > obj-y += amd-sbi/ > obj-$(CONFIG_MISC_RP1) += rp1/ > +obj-$(CONFIG_FGDS) += fgds.o > obj-$(CONFIG_INTEL_SSEI) += issei/ > diff --git a/drivers/misc/fgds.c b/drivers/misc/fgds.c > new file mode 100644 > index 000000000000..3929a6514d23 > --- /dev/null > +++ b/drivers/misc/fgds.c > @@ -0,0 +1,506 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* > + * Fast GPU Direct Storage via dma-buf. > + * > + * Copyright (C) 2026 KylinSoft. Co., Ltd. All rights reserved. > + * > + * Synchronous read/write ioctls that move data between a GPU dma-buf and > + * a regular file. > + */ > + > +#include <linux/blkdev.h> > +#include <linux/dma-buf.h> > +#include <linux/dma-buf-io.h> > +#include <linux/device.h> > +#include <linux/fcntl.h> > +#include <linux/fileattr.h> > +#include <linux/fs.h> > +#include <linux/fsnotify.h> > +#include <linux/magic.h> > +#include <linux/math.h> > +#include <linux/miscdevice.h> > +#include <linux/module.h> > +#include <linux/overflow.h> > +#include <linux/pagemap.h> > +#include <linux/sched/xacct.h> > +#include <linux/slab.h> > +#include <linux/uaccess.h> > +#include <linux/uio.h> > +#include <linux/xarray.h> > + > +#include <linux/fgds.h> > + > +static struct miscdevice fgds_misc; > + > +/* One registered buffer: a dma-buf bound to a block device. */ > +struct fgds_reg { > + struct kref kref; > + struct dma_buf_io_ctx *ctx; > + struct file *bdev_file; > + struct block_device *bdev; > + u64 size; > +}; > + > +/* State of one /dev/fgds open file description; handles are private to it. */ > +struct fgds_state { > + struct xarray regs; > + /* protects @regs and, with the reg kref, the lifetime of entries */ > + struct mutex lock; > +}; > + > +static void fgds_reg_release(struct kref *kref) > +{ > + struct fgds_reg *reg = container_of(kref, struct fgds_reg, kref); > + > + dma_buf_io_ctx_release(reg->ctx); > + fput(reg->bdev_file); > + kfree(reg); > +} > + > +static void fgds_reg_put(struct fgds_reg *reg) > +{ > + kref_put(&reg->kref, fgds_reg_release); > +} > + > +static struct fgds_state *fgds_state(struct file *file) > +{ > + return file->private_data; > +} > + > +/* > + * File and file-system level gate. > + */ > +static int fgds_gate(struct file *ffile) > +{ > + struct inode *inode = file_inode(ffile); > + struct super_block *sb = inode->i_sb; > + struct file_kattr fa; > + > + if (!S_ISREG(inode->i_mode)) > + return -EINVAL; > + if (sb->s_magic != XFS_SUPER_MAGIC) > + return -EOPNOTSUPP; > + if (IS_DAX(inode)) > + return -EOPNOTSUPP; > + if (mapping_stable_writes(inode->i_mapping)) > + return -EOPNOTSUPP; > + if (!sb->s_bdev) > + return -EOPNOTSUPP; > + if (bdev_is_zoned(sb->s_bdev)) > + return -EOPNOTSUPP; > + if (!sb->s_bdev->bd_disk->fops->init_dma_buf_io_ctx) > + return -EOPNOTSUPP; > + > + /* > + * Realtime inodes live on a separate device whose DMA setup is not > + * covered here. > + */ > + if (vfs_fileattr_get(ffile->f_path.dentry, &fa)) > + return -EOPNOTSUPP; > + if (fa.fsx_xflags & FS_XFLAG_REALTIME) > + return -EOPNOTSUPP; > + return 0; > +} > + > +static unsigned int fgds_file_align(struct inode *inode, bool write) > +{ > + unsigned int lbs = bdev_logical_block_size(inode->i_sb->s_bdev); > + > + if (!write) > + return lbs; > + return max(1U << inode->i_blkbits, lbs); > +} > + > +static unsigned int fgds_dma_align(struct inode *inode) > +{ > + return bdev_dma_alignment(inode->i_sb->s_bdev) + 1; > +} > + > +static struct fgds_reg *fgds_reg_get(struct fgds_state *state, u32 handle) > +{ > + struct fgds_reg *reg; > + > + mutex_lock(&state->lock); > + reg = xa_load(&state->regs, handle); > + if (reg) > + kref_get(&reg->kref); > + mutex_unlock(&state->lock); > + return reg; > +} > + > +static int fgds_unregister_handle(struct fgds_state *state, u32 handle) > +{ > + struct fgds_reg *reg; > + > + mutex_lock(&state->lock); > + reg = xa_erase(&state->regs, handle); > + mutex_unlock(&state->lock); > + if (reg) > + fgds_reg_put(reg); > + return reg ? 0 : -EINVAL; > +} > + > +static int fgds_register(struct file *file, struct fgds_register_args __user *uarg) > +{ > + struct fgds_register_args args; > + struct fgds_state *state = fgds_state(file); > + struct dma_buf_io_ctx *ctx = NULL; > + struct block_device *bdev; > + struct file *bdev_file; > + struct dma_buf *dbuf; > + struct fd bfdf; > + struct fgds_reg *reg; > + u32 id; > + int ret; > + > + if (copy_from_user(&args, uarg, sizeof(args))) > + return -EFAULT; > + if (args.handle || args.pad || args.reserved) > + return -EINVAL; > + > + dbuf = dma_buf_get(args.dfd); > + if (IS_ERR(dbuf)) > + return PTR_ERR(dbuf); > + > + bfdf = fdget(args.bdev_fd); > + if (fd_empty(bfdf)) { > + ret = -EBADF; > + goto out_dmabuf; > + } > + bdev_file = fd_file(bfdf); > + if (!S_ISBLK(file_inode(bdev_file)->i_mode)) { > + ret = -EINVAL; > + goto out_fdput; > + } > + /* blkdev_init_dma_buf_io_ctx() needs O_DIRECT. */ > + if (!(bdev_file->f_flags & O_DIRECT)) { > + ret = -EINVAL; > + goto out_fdput; > + } > + > + bdev = file_bdev(bdev_file); > + if (!bdev->bd_disk->fops->init_dma_buf_io_ctx) { > + ret = -EOPNOTSUPP; > + goto out_fdput; > + } > + > + ret = -ENOMEM; > + reg = kzalloc_obj(*reg); > + if (!reg) > + goto out_fdput; > + > + get_file(bdev_file); > + > + ret = dma_buf_io_ctx_create(bdev_file, dbuf, DMA_BIDIRECTIONAL, &ctx); > + if (ret) { > + dev_err(fgds_misc.this_device, > + "dma-buf-io context on %pg failed: %pe\n", > + bdev, ERR_PTR(ret)); > + goto out_file; > + } > + > + kref_init(&reg->kref); > + reg->ctx = ctx; > + reg->bdev_file = bdev_file; > + reg->bdev = bdev; > + reg->size = dbuf->size; > + > + mutex_lock(&state->lock); > + ret = xa_alloc(&state->regs, &id, reg, XA_LIMIT(1, UINT_MAX), > + GFP_KERNEL); > + if (ret) { > + mutex_unlock(&state->lock); > + goto out_ctx; > + } > + > + args.handle = id; > + /* the window must stay inside the buffer and within 32 bits */ > + args.max_doffset = min_t(u64, reg->size, UINT_MAX); > + > + if (copy_to_user(uarg, &args, sizeof(args))) { > + xa_erase(&state->regs, id); > + mutex_unlock(&state->lock); > + ret = -EFAULT; > + goto out_ctx; > + } > + mutex_unlock(&state->lock); > + > + fdput(bfdf); > + dma_buf_put(dbuf); > + return 0; > + > +out_ctx: > + dma_buf_io_ctx_release(ctx); > +out_file: > + fput(bdev_file); > + kfree(reg); > +out_fdput: > + fdput(bfdf); > +out_dmabuf: > + dma_buf_put(dbuf); > + return ret; > +} > + > +static int fgds_unregister(struct file *file, struct fgds_unregister_args __user *uarg) > +{ > + struct fgds_unregister_args args; > + > + if (copy_from_user(&args, uarg, sizeof(args))) > + return -EFAULT; > + if (args.reserved) > + return -EINVAL; > + return fgds_unregister_handle(fgds_state(file), args.handle); > +} > + > +/* > + * Launch one read_iter()/write_iter() call. > + * Returns the number of bytes the file system moved, or a negative > + * errno; a short read means the end of the file. > + */ > +static ssize_t fgds_do_rw(struct fgds_state *state, > + const struct fgds_rw_args *args, bool write) > +{ > + struct fgds_reg *reg; > + struct dma_buf_io_map *map; > + struct file *ffile; > + struct inode *inode; > + struct iov_iter iter; > + struct kiocb kiocb; > + struct fd fdf; > + ssize_t (*iter_fn)(struct kiocb *kiocb, struct iov_iter *i); > + unsigned int file_align, dma_align; > + u64 length = args->length; > + u64 dbuf_end; > + loff_t offset, end; > + ssize_t ret; > + > + if (args->flags) > + return -EINVAL; > + if (length > MAX_RW_COUNT) > + return -EINVAL; > + > + offset = args->offset; > + if (offset < 0 || check_add_overflow(offset, (loff_t)length, &end)) > + return -EINVAL; > + /* > + * The block layer's dma-buf iterator truncates the segment offset to > + * 32 bits, and the window must stay inside the registered buffer. > + */ > + if (check_add_overflow(args->doffset, length, &dbuf_end)) > + return -EINVAL; > + if (dbuf_end > UINT_MAX) > + return -EINVAL; > + > + fdf = fdget(args->ffd); > + if (fd_empty(fdf)) > + return -EBADF; > + ffile = fd_file(fdf); > + inode = file_inode(ffile); > + > + ret = -EINVAL; > + if (!S_ISREG(inode->i_mode) || (ffile->f_flags & O_APPEND)) > + goto out_fdput; > + > + if (write) { > + if (!(ffile->f_mode & FMODE_WRITE) || > + !(ffile->f_mode & FMODE_CAN_WRITE)) > + goto out_fdput; > + iter_fn = ffile->f_op->write_iter; > + } else { > + if (!(ffile->f_mode & FMODE_READ) || > + !(ffile->f_mode & FMODE_CAN_READ)) > + goto out_fdput; > + iter_fn = ffile->f_op->read_iter; > + } > + if (!iter_fn) { > + ret = -EOPNOTSUPP; > + goto out_fdput; > + } > + > + ret = fgds_gate(ffile); > + if (ret) > + goto out_fdput; > + > + reg = fgds_reg_get(state, args->handle); > + if (!reg) { > + ret = -EINVAL; > + goto out_fdput; > + } > + > + if (inode->i_sb->s_bdev != reg->bdev) { > + ret = -EXDEV; > + goto out_reg; > + } > + > + file_align = fgds_file_align(inode, write); > + dma_align = fgds_dma_align(inode); > + if ((offset | (loff_t)length) & (file_align - 1) || > + (args->doffset | (loff_t)length) & (dma_align - 1) || > + dbuf_end > reg->size || > + (!write && end > i_size_read(inode))) { > + ret = -EINVAL; > + goto out_reg; > + } > + > + ret = rw_verify_area(write ? WRITE : READ, ffile, &offset, length); > + if (ret) > + goto out_reg; > + if (write) > + inc_syscw(current); > + else > + inc_syscr(current); > + > + if (!length) { > + ret = 0; > + goto out_reg; > + } > + > + map = dma_buf_io_get_map(reg->ctx, false); > + if (IS_ERR(map)) { > + ret = PTR_ERR(map); > + if (ret != -EAGAIN) > + dev_err_ratelimited(fgds_misc.this_device, > + "dma-buf mapping failed on %pg: %pe\n", > + reg->bdev, ERR_PTR(ret)); > + goto out_reg; > + } > + > + /* > + * A direct I/O read would leave any cached pages of the range > + * stale, so flush and drop them before submitting. > + */ > + if (!write) { > + ret = filemap_write_and_wait_range(ffile->f_mapping, > + offset, end - 1); > + if (ret) > + goto out_map; > + ret = invalidate_inode_pages2_range(ffile->f_mapping, > + offset >> PAGE_SHIFT, > + (end - 1) >> PAGE_SHIFT); > + if (ret) { > + /* > + * Report a retryable error instead of letting > + * -EBUSY escape. > + */ > + if (ret == -EBUSY) > + ret = -EAGAIN; > + goto out_map; > + } > + } > + > + if (write) > + file_start_write(ffile); > + iov_iter_dmabuf_map(&iter, write ? ITER_SOURCE : ITER_DEST, > + map, args->doffset, length); > + init_sync_kiocb(&kiocb, ffile); > + kiocb.ki_flags |= IOCB_DIRECT; > + if (write) > + kiocb.ki_flags |= IOCB_WRITE; > + kiocb.ki_pos = offset; > + > + ret = iter_fn(&kiocb, &iter); > + if (WARN_ON_ONCE(ret == -EIOCBQUEUED)) > + ret = -EIO; > + if (write) > + file_end_write(ffile); > + > + if (ret > 0) { > + if (write) { > + fsnotify_modify(ffile); > + add_wchar(current, ret); > + } else { > + fsnotify_access(ffile); > + add_rchar(current, ret); > + } > + } > + > +out_map: > + dma_buf_io_map_drop(map); > +out_reg: > + fgds_reg_put(reg); > +out_fdput: > + fdput(fdf); > + return ret; > +} > + > +static long fgds_ioctl(struct file *file, unsigned int cmd, unsigned long arg) > +{ > + struct fgds_state *state = fgds_state(file); > + struct fgds_rw_args args; > + > + switch (cmd) { > + case FGDS_IOCTL_WRITE: > + case FGDS_IOCTL_READ: > + if (copy_from_user(&args, (void __user *)arg, sizeof(args))) > + return -EFAULT; > + return fgds_do_rw(state, &args, cmd == FGDS_IOCTL_WRITE); > + case FGDS_IOCTL_REGISTER_BUF: > + return fgds_register(file, (struct fgds_register_args __user *)arg); > + case FGDS_IOCTL_UNREGISTER_BUF: > + return fgds_unregister(file, (struct fgds_unregister_args __user *)arg); > + } > + return -ENOTTY; > +} > + > +static int fgds_open(struct inode *inode, struct file *file) > +{ > + struct fgds_state *state; > + > + state = kzalloc_obj(*state); > + if (!state) > + return -ENOMEM; > + > + xa_init_flags(&state->regs, XA_FLAGS_ALLOC); > + mutex_init(&state->lock); > + file->private_data = state; > + return 0; > +} > + > +static int fgds_release(struct inode *inode, struct file *file) > +{ > + struct fgds_state *state = fgds_state(file); > + struct fgds_reg *reg; > + unsigned long id; > + > + xa_for_each(&state->regs, id, reg) { > + xa_erase(&state->regs, id); > + fgds_reg_put(reg); > + } > + xa_destroy(&state->regs); > + mutex_destroy(&state->lock); > + kfree(state); > + return 0; > +} > + > +static const struct file_operations fgds_fops = { > + .owner = THIS_MODULE, > + .open = fgds_open, > + .release = fgds_release, > + .unlocked_ioctl = fgds_ioctl, > + .compat_ioctl = compat_ptr_ioctl, > +}; > + > +static struct miscdevice fgds_misc = { > + .minor = MISC_DYNAMIC_MINOR, > + .name = "fgds", > + .fops = &fgds_fops, > +}; > + > +static int __init fgds_init(void) > +{ > + return misc_register(&fgds_misc); > +} > + > +static void __exit fgds_exit(void) > +{ > + misc_deregister(&fgds_misc); > +} > + > +module_init(fgds_init); > +module_exit(fgds_exit); > + > +MODULE_LICENSE("GPL"); > +MODULE_IMPORT_NS("DMA_BUF"); > +MODULE_AUTHOR("Mengmeng Zhao <zhaomengmeng(a)kylinos.cn>, Li Wang <liwang(a)kylinos.cn>"); > +MODULE_DESCRIPTION("Fast GPU Direct Storage"); > +MODULE_VERSION("1.0.0"); > diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c > index 0a5ebfda90f1..a7ab28edab98 100644 > --- a/fs/iomap/buffered-io.c > +++ b/fs/iomap/buffered-io.c > @@ -1304,6 +1304,17 @@ iomap_file_buffered_write(struct kiocb *iocb, struct iov_iter *i, > }; > ssize_t ret; > > + /* > + * The copy helpers have no source for a dma-buf iterator: the copy > + * would move zero bytes, ->write_end() would reject the untouched > + * folio, fault_in_iov_iter_readable() reports the iterator as > + * readable, and the loop below would never advance. Refuse here > + * rather than at each caller's entry point, so no path can reach > + * the copy with such an iterator. > + */ > + if (iov_iter_is_dmabuf_map(i)) > + return -EOPNOTSUPP; > + > if (iocb->ki_flags & IOCB_NOWAIT) > iter.flags |= IOMAP_NOWAIT; > if (iocb->ki_flags & IOCB_DONTCACHE) > diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c > index 8b4039d16ce8..eccc07d53e9c 100644 > --- a/fs/iomap/direct-io.c > +++ b/fs/iomap/direct-io.c > @@ -595,8 +595,16 @@ static int iomap_dio_bio_iter(struct iomap_iter *iter, struct iomap_dio *dio) > > static int iomap_dio_hole_iter(struct iomap_iter *iter, struct iomap_dio *dio) > { > - loff_t length = iov_iter_zero(iomap_length(iter), dio->submit.iter); > + loff_t length; > > + /* > + * dmabuf maps do not support zero-filling holes or > + * unwritten extents. > + */ > + if (iov_iter_is_dmabuf_map(dio->submit.iter)) > + return -EOPNOTSUPP; > + > + length = iov_iter_zero(iomap_length(iter), dio->submit.iter); > dio->size += length; > if (!length) > return -EFAULT; > @@ -683,8 +691,8 @@ static int iomap_dio_iter(struct iomap_iter *iter, struct iomap_dio *dio) > * the correct total number of bytes transferred; this is essential for > * completing partial requests asynchronously. > * > - * Returns -ENOTBLK In case of a page invalidation invalidation failure for > - * writes. The callers needs to fall back to buffered I/O in this case. > + * Returns -ENOTBLK in case of a page cache invalidation failure for writes. > + * The caller needs to fall back to buffered I/O in this case. > */ > struct iomap_dio * > __iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, > @@ -794,6 +802,15 @@ __iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, > * the caller tries again. > */ > ret = -EAGAIN; > + } else if (iov_iter_is_dmabuf_map(iter)) { > + /* > + * Avoid -ENOTBLK (buffered fallback) > + * as dmabuf are not supported. Map > + * -EBUSY to -EAGAIN for transient > + * retires. > + */ > + if (ret == -EBUSY) > + ret = -EAGAIN; > } else { > /* fall back to buffered write */ > ret = -ENOTBLK; > diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c > index 426a67b813a7..f16e9cb63e9e 100644 > --- a/fs/xfs/xfs_file.c > +++ b/fs/xfs/xfs_file.c > @@ -1211,6 +1211,10 @@ xfs_file_write_iter( > return ret; > } > > + /* zoned and buffered I/O is not supported for dmabuf */ > + if (iov_iter_is_dmabuf_map(from)) > + return -EOPNOTSUPP; > + > if (xfs_is_zoned_inode(ip)) > return xfs_file_buffered_write_zoned(iocb, from); > return xfs_file_buffered_write(iocb, from); > diff --git a/include/linux/iov_iter.h b/include/linux/iov_iter.h > index 2f91884d733b..a3b99e6d8255 100644 > --- a/include/linux/iov_iter.h > +++ b/include/linux/iov_iter.h > @@ -376,6 +376,10 @@ size_t iterate_and_advance_kernel(struct iov_iter *iter, size_t len, void *priv, > return iterate_folioq(iter, len, priv, priv2, step); > if (iov_iter_is_xarray(iter)) > return iterate_xarray(iter, len, priv, priv2, step); > + if (iov_iter_is_dmabuf_map(iter)) { > + WARN_ON_ONCE(1); > + return 0; > + } > return iterate_discard(iter, len, priv, priv2, step); > } > > diff --git a/include/uapi/linux/fgds.h b/include/uapi/linux/fgds.h > new file mode 100644 > index 000000000000..9a721c92cde2 > --- /dev/null > +++ b/include/uapi/linux/fgds.h > @@ -0,0 +1,124 @@ > +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ > +/* > + * Fast GPU Direct Storage user-kernel ABI definitions. > + * > + * Copyright (C) 2026 KylinSoft. Co., Ltd. All rights reserved. > + * > + * Synchronous read/write ioctls that move data between a GPU dma-buf and > + * a regular file. > + */ > +#ifndef _FGDS_H > +#define _FGDS_H > + > +#include <linux/types.h> > +#include <linux/ioctl.h> > + > +/** > + * struct fgds_register_args - arguments for %FGDS_IOCTL_REGISTER_BUF > + * > + * @dfd: dma-buf file descriptor exported by the GPU runtime. > + * @bdev_fd: file descriptor of the underlying block device (the > + * device the target files live on), opened with %O_DIRECT. > + * The device is named separately from the file because: > + * building the dma-buf I/O context needs a file for the > + * device itself, and the device side requires %O_DIRECT > + * on that file, which a regular file descriptor cannot > + * provide. > + * @handle: Returned handle for use with the other ioctls. Handles > + * are private to the /dev/fgds file descriptor they were > + * created on and are released automatically when that > + * descriptor is closed. Output. > + * @pad: Must be 0. > + * @max_doffset: Largest accepted value of @doffset plus @length: the > + * window must stay inside the registered dma-buf and > + * within the 32-bit offset bound of the block-layer > + * dma-buf iterator, so this reports the smaller of the > + * dma-buf size and %UINT_MAX. Output. > + * @reserved: Must be 0. Extension slot for further output fields. > + * > + * A registered handle keeps the device attachment alive, and once a > + * transfer has mapped the buffer that mapping is held for the handle's > + * lifetime. > + * > + * Returns 0, or a negative errno. > + */ > +struct fgds_register_args { > + __s32 dfd; > + __s32 bdev_fd; > + __u32 handle; > + __u32 pad; > + __u64 max_doffset; > + __u64 reserved; > +}; > + > +/** > + * struct fgds_unregister_args - arguments for %FGDS_IOCTL_UNREGISTER_BUF > + * > + * @handle: Handle returned by %FGDS_IOCTL_REGISTER_BUF. Input. > + * @reserved: Must be 0. > + * > + * Returns 0, or -EINVAL if @handle is not registered on this file > + * descriptor. > + */ > +struct fgds_unregister_args { > + __u32 handle; > + __u32 reserved; > +}; > + > +/** > + * struct fgds_rw_args - arguments for %FGDS_IOCTL_WRITE / %FGDS_IOCTL_READ > + * > + * @handle: Handle from %FGDS_IOCTL_REGISTER_BUF naming both the > + * dma-buf and the block device to transfer between. Input. > + * @ffd: Regular file descriptor. %O_DIRECT is not required on > + * it, fgds forces the direct I/O path itself. Its file > + * system's device must match the one registered with > + * @handle or the transfer fails with %EXDEV. Input. > + * @offset: Byte offset inside the file. Input. > + * @length: Transfer length in bytes. Unlike pread() and pwrite(), > + * which silently truncate an oversized request, fgds rejects > + * it with %EINVAL. Input. > + * @doffset: Byte offset inside the dma-buf, i.e. the start of the > + * window the transfer reads from or writes to. Input. > + * @flags: Must be 0. Input. > + * > + * Like pread() and pwrite(), the ioctl returns the number of bytes > + * transferred or a negative errno. A return value below @length means a > + * read stopped at the end of the file, or a write clamped by the calling > + * process' RLIMIT_FSIZE. > + * > + * Contract and failure modes: > + * > + * - Alignment is enforced on two independent axes, both answered by > + * statx() with %STATX_DIOALIGN. The file side applies to @offset and > + * @length: the device logical block size for a read, the max of that > + * and the file system block size for a write. The buffer side applies > + * to @doffset and @length: the device DMA alignment. A transfer must > + * satisfy both axes at once. > + * - Ranges backed by file holes or unwritten extents are not supported > + * for reads and fail with %EOPNOTSUPP: there is no page cache bounce > + * to serve zeros from, and GPU memory is generally not CPU accessible. > + * - Writes past the end of the file go through the file system's own > + * direct I/O extend path; no preallocation is performed by fgds. An > + * application that wants the space reserved must call fallocate() > + * itself first. > + * - Reads flush and drop any page cache of the transferred range before > + * submitting, so subsequent buffered reads observe the fresh data. > + */ > +struct fgds_rw_args { > + __u32 handle; > + __s32 ffd; > + __u64 offset; > + __u64 length; > + __u64 doffset; > + __u64 flags; > +}; > + > +#define FGDS_IOCTL_MAGIC 'x' > + > +#define FGDS_IOCTL_WRITE _IOW(FGDS_IOCTL_MAGIC, 1, struct fgds_rw_args) > +#define FGDS_IOCTL_READ _IOW(FGDS_IOCTL_MAGIC, 2, struct fgds_rw_args) > +#define FGDS_IOCTL_REGISTER_BUF _IOWR(FGDS_IOCTL_MAGIC, 3, struct fgds_register_args) > +#define FGDS_IOCTL_UNREGISTER_BUF _IOW(FGDS_IOCTL_MAGIC, 4, struct fgds_unregister_args) > + > +#endif /* _FGDS_H */ > diff --git a/lib/iov_iter.c b/lib/iov_iter.c > index 9b46f9ada8f9..b19bf7f5e4cf 100644 > --- a/lib/iov_iter.c > +++ b/lib/iov_iter.c > @@ -790,6 +790,7 @@ void iov_iter_dmabuf_map(struct iov_iter *i, unsigned int direction, > .iov_offset = off, > }; > } > +EXPORT_SYMBOL_GPL(iov_iter_dmabuf_map); > > /** > * iov_iter_discard - Initialise an I/O iterator that discards data > diff --git a/mm/filemap.c b/mm/filemap.c > index 6afec636881f..ab8a5391a699 100644 > --- a/mm/filemap.c > +++ b/mm/filemap.c > @@ -3013,6 +3013,14 @@ generic_file_read_iter(struct kiocb *iocb, struct iov_iter *iter) > return retval; > } > > + /* > + * Buffered I/O read is not supported for dmabuf; a short direct > + * read before this point stands on its own, as in > + * direct_write_fallback(). > + */ > + if (iov_iter_is_dmabuf_map(iter)) > + return retval > 0 ? retval : -EOPNOTSUPP; > + > return filemap_read(iocb, iter, retval); > } > EXPORT_SYMBOL(generic_file_read_iter); > @@ -4300,8 +4308,14 @@ generic_file_direct_write(struct kiocb *iocb, struct iov_iter *from) > */ > written = kiocb_invalidate_pages(iocb, write_len); > if (written) { > - if (written == -EBUSY) > + if (written == -EBUSY) { > + /* > + * Avoid fallback to buffered write for dmabuf. > + */ > + if (iov_iter_is_dmabuf_map(from)) > + return -EAGAIN; > return 0; > + } > return written; > } > > @@ -4353,6 +4367,12 @@ ssize_t generic_perform_write(struct kiocb *iocb, struct iov_iter *i) > long status = 0; > ssize_t written = 0; > > + /* > + * Buffered write is not supported for dmabuf. > + */ > + if (iov_iter_is_dmabuf_map(i)) > + return -EOPNOTSUPP; > + > do { > struct folio *folio; > size_t offset; /* Offset into folio */

11 hours, 51 minutes

Re: [RFC PATCH v2 1/1] misc: fgds: introduce GPU-File direct I/O via dma-buf

by Greg Kroah-Hartman

On Tue, Oct 27, 2026 at 07:03:29AM -0600, Jens Axboe wrote: > On 10/27/26 3:08 AM, Li Wang wrote: > > From: Mengmeng Zhao <zhaomengmeng(a)kylinos.cn> > > > > This patch introduces a driver that allows moving data between a GPU > > dma-buf and a regular file on NVME without staging it through the page > > cache. Userspace registers the GPU dma-buf with the device, then issues > > read and write requests via the device's ioctls. Each transfer is direct > > I/O: an ITER_DMABUF_MAP iterator is passed to the file's read_iter or > > write_iter, and the filesystem's iomap path submits REQ_DMABUF bios that > > already carry the dma addresses. > > > > Signed-off-by: Mengmeng Zhao <zhaomengmeng(a)kylinos.cn> > > Signed-off-by: Li Wang <liwang(a)kylinos.cn> > > --- > > .../userspace-api/ioctl/ioctl-number.rst | 2 + > > drivers/dma-buf/dma-buf-io.c | 3 + > > drivers/misc/Kconfig | 16 + > > drivers/misc/Makefile | 1 + > > drivers/misc/fgds.c | 506 ++++++++++++++++++ > > fs/iomap/buffered-io.c | 11 + > > fs/iomap/direct-io.c | 23 +- > > fs/xfs/xfs_file.c | 4 + > > include/linux/iov_iter.h | 4 + > > include/uapi/linux/fgds.h | 124 +++++ > > lib/iov_iter.c | 1 + > > mm/filemap.c | 22 +- > > 12 files changed, 713 insertions(+), 4 deletions(-) > > create mode 100644 drivers/misc/fgds.c > > create mode 100644 include/uapi/linux/fgds.h > > What's the point of this, when you can just use io_uring to do > the same?! Agreed, I thought that the summary of the last round of reviews was "this isn't needed at all". Li, what changed from that? thanks, greg k-h

11 hours, 51 minutes

Re: [PATCH 21/26] treewide: Rename dma_buf_map_attachment(_unlocked) to dma_buf_sgt_

by Christian König

On 10/26/26 06:36, Alistair Popple wrote: > From: Jason Gunthorpe <jgg(a)nvidia.com> > > This map function only works with SGT importers. > > Signed-off-by: Jason Gunthorpe <jgg(a)nvidia.com> > [ also rename the io_uring zcrx caller, which the unmap rename > used to pick up, so that this commit builds with CONFIG_IO_URING_ZCRX - apopple ] > Signed-off-by: Alistair Popple <apopple(a)nvidia.com> I would make that the first patch in the set since dropping sgt from the interface is probably something everybody can agree on. And sqash that together with renaming dma_buf_unmap_attachment(). Regarding the new name I think dma_buf_sgt_(un)map_attachment() is a bit long and has the sgt at the wrong location. I would name the functions dma_buf_map_sgt() and dma_buf_unmap_sgt(). Regards, Christian. > --- > drivers/accel/amdxdna/amdxdna_gem.c | 2 +- > drivers/accel/ivpu/ivpu_gem.c | 3 +- > drivers/accel/qaic/qaic_data.c | 4 +-- > drivers/dma-buf/dma-buf.c | 28 +++++++++---------- > drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 3 +- > drivers/gpu/drm/armada/armada_gem.c | 14 ++++++---- > drivers/gpu/drm/drm_prime.c | 2 +- > drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c | 4 +-- > .../drm/i915/gem/selftests/i915_gem_dmabuf.c | 3 +- > drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c | 2 +- > drivers/gpu/drm/tegra/gem.c | 6 ++-- > drivers/gpu/drm/virtio/virtgpu_prime.c | 2 +- > drivers/gpu/drm/xe/xe_bo.c | 2 +- > drivers/iio/industrialio-buffer.c | 2 +- > drivers/infiniband/core/umem_dmabuf.c | 4 +-- > .../media/common/videobuf2/videobuf2-core.c | 2 +- > .../common/videobuf2/videobuf2-dma-contig.c | 2 +- > .../media/common/videobuf2/videobuf2-dma-sg.c | 2 +- > .../platform/nvidia/tegra-vde/dmabuf-cache.c | 2 +- > drivers/misc/fastrpc.c | 3 +- > drivers/usb/gadget/function/f_fs.c | 2 +- > drivers/xen/gntdev-dmabuf.c | 2 +- > include/linux/dma-buf-mapping.h | 4 +-- > include/linux/dma-buf.h | 10 +++---- > io_uring/zcrx.c | 3 +- > net/core/devmem.c | 4 +-- > 26 files changed, 63 insertions(+), 54 deletions(-) > > diff --git a/drivers/accel/amdxdna/amdxdna_gem.c b/drivers/accel/amdxdna/amdxdna_gem.c > index 6253a720cc22..c679ec8230ff 100644 > --- a/drivers/accel/amdxdna/amdxdna_gem.c > +++ b/drivers/accel/amdxdna/amdxdna_gem.c > @@ -898,7 +898,7 @@ amdxdna_gem_prime_import(struct drm_device *dev, struct dma_buf *dma_buf) > goto put_buf; > } > > - sgt = dma_buf_map_attachment_unlocked(attach, DMA_BIDIRECTIONAL); > + sgt = dma_buf_sgt_map_attachment_unlocked(attach, DMA_BIDIRECTIONAL); > if (IS_ERR(sgt)) { > ret = PTR_ERR(sgt); > goto fail_detach; > diff --git a/drivers/accel/ivpu/ivpu_gem.c b/drivers/accel/ivpu/ivpu_gem.c > index 4f2005a8d496..0342a3fc9185 100644 > --- a/drivers/accel/ivpu/ivpu_gem.c > +++ b/drivers/accel/ivpu/ivpu_gem.c > @@ -54,7 +54,8 @@ static struct sg_table *ivpu_bo_map_attachment(struct ivpu_device *vdev, struct > > sgt = bo->base.sgt; > if (!sgt) { > - sgt = dma_buf_map_attachment(bo->base.base.import_attach, DMA_BIDIRECTIONAL); > + sgt = dma_buf_sgt_map_attachment(bo->base.base.import_attach, > + DMA_BIDIRECTIONAL); > if (IS_ERR(sgt)) > ivpu_err(vdev, "Failed to map BO in IOMMU: %ld\n", PTR_ERR(sgt)); > else > diff --git a/drivers/accel/qaic/qaic_data.c b/drivers/accel/qaic/qaic_data.c > index ef0351b6dc9b..b8de1a1e2ab9 100644 > --- a/drivers/accel/qaic/qaic_data.c > +++ b/drivers/accel/qaic/qaic_data.c > @@ -863,7 +863,7 @@ struct drm_gem_object *qaic_gem_prime_import(struct drm_device *dev, struct dma_ > > drm_gem_private_object_init(dev, obj, attach->dmabuf->size); > /* > - * skipping dma_buf_map_attachment() as we do not know the direction > + * skipping dma_buf_sgt_map_attachment() as we do not know the direction > * just yet. Once the direction is known in the subsequent IOCTL to > * attach slicing, we can do it then. > */ > @@ -889,7 +889,7 @@ static int qaic_prepare_import_bo(struct qaic_bo *bo, struct qaic_attach_slice_h > struct sg_table *sgt; > int ret; > > - sgt = dma_buf_map_attachment(obj->import_attach, hdr->dir); > + sgt = dma_buf_sgt_map_attachment(obj->import_attach, hdr->dir); > if (IS_ERR(sgt)) { > ret = PTR_ERR(sgt); > return ret; > diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c > index dc65752fb0fa..209a1dca19d0 100644 > --- a/drivers/dma-buf/dma-buf.c > +++ b/drivers/dma-buf/dma-buf.c > @@ -678,7 +678,7 @@ static struct file *dma_buf_getfile(size_t size, int flags) > * > * 3. Once the buffer is attached to all devices userspace can initiate DMA > * access to the shared buffer. In the kernel this is done by calling > - * dma_buf_map_attachment() and dma_buf_unmap_attachment(). > + * dma_buf_sgt_map_attachment() and dma_buf_unmap_attachment(). > * > * 4. Once a driver is done with a shared buffer it needs to call > * dma_buf_detach() (after cleaning up any mappings) and then release the > @@ -958,7 +958,7 @@ dma_buf_pin_on_map(struct dma_buf_attachment *attach) > * > * - dma_buf_pin() > * - dma_buf_unpin() > - * - dma_buf_map_attachment() > + * - dma_buf_sgt_map_attachment() > * - dma_buf_unmap_attachment() > * - dma_buf_vmap() > * - dma_buf_vunmap() > @@ -976,7 +976,7 @@ dma_buf_pin_on_map(struct dma_buf_attachment *attach) > * - dma_buf_mmap() > * - dma_buf_begin_cpu_access() > * - dma_buf_end_cpu_access() > - * - dma_buf_map_attachment_unlocked() > + * - dma_buf_sgt_map_attachment_unlocked() > * - dma_buf_unmap_attachment_unlocked() > * - dma_buf_vmap_unlocked() > * - dma_buf_vunmap_unlocked() > @@ -1302,7 +1302,7 @@ __dma_buf_sgt_map_attachment(struct dma_buf_attachment *attach, > } > > /** > - * dma_buf_map_attachment - Returns the scatterlist table of the attachment; > + * dma_buf_sgt_map_attachment - Returns the scatterlist table of the attachment; > * mapped into _device_ address space. Is a wrapper for map_dma_buf() of the > * dma_buf_ops. > * @attach: [in] attachment whose scatterlist is to be returned > @@ -1322,8 +1322,8 @@ __dma_buf_sgt_map_attachment(struct dma_buf_attachment *attach, > * Important: Dynamic importers must wait for the exclusive fence of the struct > * dma_resv attached to the DMA-BUF first. > */ > -struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach, > - enum dma_data_direction direction) > +struct sg_table *dma_buf_sgt_map_attachment(struct dma_buf_attachment *attach, > + enum dma_data_direction direction) > { > struct sg_table *sg_table; > int ret; > @@ -1346,7 +1346,7 @@ struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach, > > return sg_table; > } > -EXPORT_SYMBOL_NS_GPL(dma_buf_map_attachment, "DMA_BUF"); > +EXPORT_SYMBOL_NS_GPL(dma_buf_sgt_map_attachment, "DMA_BUF"); > > /* &dma_buf_mapping_type.map / .unmap for the SGT type */ > struct dma_buf_mapping *dma_buf_sgt_type_map(struct dma_buf_attachment *attach, > @@ -1382,17 +1382,17 @@ void dma_buf_sgt_type_unmap(struct dma_buf_attachment *attach, > } > > /** > - * dma_buf_map_attachment_unlocked - Returns the scatterlist table of the attachment; > + * dma_buf_sgt_map_attachment_unlocked - Returns the scatterlist table of the attachment; > * mapped into _device_ address space. Is a wrapper for map_dma_buf() of the > * dma_buf_ops. > * @attach: [in] attachment whose scatterlist is to be returned > * @direction: [in] direction of DMA transfer > * > - * Unlocked variant of dma_buf_map_attachment(). > + * Unlocked variant of dma_buf_sgt_map_attachment(). > */ > struct sg_table * > -dma_buf_map_attachment_unlocked(struct dma_buf_attachment *attach, > - enum dma_data_direction direction) > +dma_buf_sgt_map_attachment_unlocked(struct dma_buf_attachment *attach, > + enum dma_data_direction direction) > { > struct sg_table *sg_table; > > @@ -1402,12 +1402,12 @@ dma_buf_map_attachment_unlocked(struct dma_buf_attachment *attach, > return ERR_PTR(-EINVAL); > > dma_resv_lock(attach->dmabuf->resv, NULL); > - sg_table = dma_buf_map_attachment(attach, direction); > + sg_table = dma_buf_sgt_map_attachment(attach, direction); > dma_resv_unlock(attach->dmabuf->resv); > > return sg_table; > } > -EXPORT_SYMBOL_NS_GPL(dma_buf_map_attachment_unlocked, "DMA_BUF"); > +EXPORT_SYMBOL_NS_GPL(dma_buf_sgt_map_attachment_unlocked, "DMA_BUF"); > > /** > * dma_buf_unmap_attachment - unmaps and decreases usecount of the buffer;might > @@ -1417,7 +1417,7 @@ EXPORT_SYMBOL_NS_GPL(dma_buf_map_attachment_unlocked, "DMA_BUF"); > * @sg_table: [in] scatterlist info of the buffer to unmap > * @direction: [in] direction of DMA transfer > * > - * This unmaps a DMA mapping for @attached obtained by dma_buf_map_attachment(). > + * This unmaps a DMA mapping for @attached obtained by dma_buf_sgt_map_attachment(). > */ > void dma_buf_unmap_attachment(struct dma_buf_attachment *attach, > struct sg_table *sg_table, > diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c > index 016957cac1f2..169e1b27ff8e 100644 > --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c > +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c > @@ -954,7 +954,8 @@ static int amdgpu_ttm_backend_bind(struct ttm_device *bdev, > struct sg_table *sgt; > > attach = gtt->gobj->import_attach; > - sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL); > + sgt = dma_buf_sgt_map_attachment(attach, > + DMA_BIDIRECTIONAL); > if (IS_ERR(sgt)) > return PTR_ERR(sgt); > > diff --git a/drivers/gpu/drm/armada/armada_gem.c b/drivers/gpu/drm/armada/armada_gem.c > index 5cea1eab6e5c..506bc82f20d6 100644 > --- a/drivers/gpu/drm/armada/armada_gem.c > +++ b/drivers/gpu/drm/armada/armada_gem.c > @@ -531,7 +531,7 @@ armada_gem_prime_import(struct drm_device *dev, struct dma_buf *buf) > get_dma_buf(buf); > > /* > - * Don't call dma_buf_map_attachment() here - it maps the > + * Don't call dma_buf_sgt_map_attachment() here - it maps the > * scatterlist immediately for DMA, and this is not always > * an appropriate thing to do. > */ > @@ -542,20 +542,22 @@ int armada_gem_map_import(struct armada_gem_object *dobj) > { > int ret; > > - dobj->sgt = dma_buf_map_attachment_unlocked(dobj->obj.import_attach, > - DMA_TO_DEVICE); > + dobj->sgt = dma_buf_sgt_map_attachment_unlocked(dobj->obj.import_attach, > + DMA_TO_DEVICE); > if (IS_ERR(dobj->sgt)) { > ret = PTR_ERR(dobj->sgt); > dobj->sgt = NULL; > - DRM_ERROR("dma_buf_map_attachment() error: %d\n", ret); > + DRM_ERROR("dma_buf_sgt_map_attachment() error: %d\n", ret); > return ret; > } > if (dobj->sgt->nents > 1) { > - DRM_ERROR("dma_buf_map_attachment() returned an (unsupported) scattered list\n"); > + DRM_ERROR( > + "dma_buf_sgt_map_attachment() returned an (unsupported) scattered list\n"); > return -EINVAL; > } > if (sg_dma_len(dobj->sgt->sgl) < dobj->obj.size) { > - DRM_ERROR("dma_buf_map_attachment() returned a small buffer\n"); > + DRM_ERROR( > + "dma_buf_sgt_map_attachment() returned a small buffer\n"); > return -EINVAL; > } > dobj->dev_addr = sg_dma_address(dobj->sgt->sgl); > diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c > index 7792caf87883..330b64b3324a 100644 > --- a/drivers/gpu/drm/drm_prime.c > +++ b/drivers/gpu/drm/drm_prime.c > @@ -1005,7 +1005,7 @@ struct drm_gem_object *drm_gem_prime_import_dev(struct drm_device *dev, > > get_dma_buf(dma_buf); > > - sgt = dma_buf_map_attachment_unlocked(attach, DMA_BIDIRECTIONAL); > + sgt = dma_buf_sgt_map_attachment_unlocked(attach, DMA_BIDIRECTIONAL); > if (IS_ERR(sgt)) { > ret = PTR_ERR(sgt); > goto fail_detach; > diff --git a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c > index 5333e77e62e0..04c7b9a97681 100644 > --- a/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c > +++ b/drivers/gpu/drm/i915/gem/i915_gem_dmabuf.c > @@ -242,8 +242,8 @@ static int i915_gem_object_get_pages_dmabuf(struct drm_i915_gem_object *obj) > > assert_object_held(obj); > > - sgt = dma_buf_map_attachment(obj->base.import_attach, > - DMA_BIDIRECTIONAL); > + sgt = dma_buf_sgt_map_attachment(obj->base.import_attach, > + DMA_BIDIRECTIONAL); > if (IS_ERR(sgt)) > return PTR_ERR(sgt); > > diff --git a/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c b/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c > index 2fda549dd82d..fcfa819caa38 100644 > --- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c > +++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_dmabuf.c > @@ -293,7 +293,8 @@ static int igt_dmabuf_import_same_driver(struct drm_i915_private *i915, > goto out_import; > } > > - st = dma_buf_map_attachment_unlocked(import_attach, DMA_BIDIRECTIONAL); > + st = dma_buf_sgt_map_attachment_unlocked(import_attach, > + DMA_BIDIRECTIONAL); > if (IS_ERR(st)) { > err = PTR_ERR(st); > goto out_detach; > diff --git a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c > index 23beaeefab67..569ee2d3ab6f 100644 > --- a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c > +++ b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c > @@ -121,7 +121,7 @@ struct drm_gem_object *omap_gem_prime_import(struct drm_device *dev, > > get_dma_buf(dma_buf); > > - sgt = dma_buf_map_attachment_unlocked(attach, DMA_TO_DEVICE); > + sgt = dma_buf_sgt_map_attachment_unlocked(attach, DMA_TO_DEVICE); > if (IS_ERR(sgt)) { > ret = PTR_ERR(sgt); > goto fail_detach; > diff --git a/drivers/gpu/drm/tegra/gem.c b/drivers/gpu/drm/tegra/gem.c > index feb783ceb0d1..fcb9308f49f0 100644 > --- a/drivers/gpu/drm/tegra/gem.c > +++ b/drivers/gpu/drm/tegra/gem.c > @@ -87,7 +87,8 @@ static struct host1x_bo_mapping *tegra_bo_pin(struct device *dev, struct host1x_ > goto free; > } > > - map->sgt = dma_buf_map_attachment_unlocked(map->attach, direction); > + map->sgt = dma_buf_sgt_map_attachment_unlocked(map->attach, > + direction); > if (IS_ERR(map->sgt)) { > dma_buf_detach(buf, map->attach); > err = PTR_ERR(map->sgt); > @@ -480,7 +481,8 @@ static struct tegra_bo *tegra_bo_import(struct drm_device *drm, > goto free; > } > > - bo->sgt = dma_buf_map_attachment_unlocked(attach, DMA_TO_DEVICE); > + bo->sgt = dma_buf_sgt_map_attachment_unlocked(attach, > + DMA_TO_DEVICE); > if (IS_ERR(bo->sgt)) { > err = PTR_ERR(bo->sgt); > goto detach; > diff --git a/drivers/gpu/drm/virtio/virtgpu_prime.c b/drivers/gpu/drm/virtio/virtgpu_prime.c > index 3d5203ac19b6..de69590b5076 100644 > --- a/drivers/gpu/drm/virtio/virtgpu_prime.c > +++ b/drivers/gpu/drm/virtio/virtgpu_prime.c > @@ -164,7 +164,7 @@ int virtgpu_dma_buf_import_sgt(struct virtio_gpu_mem_entry **ents, > if (ret <= 0) > return ret < 0 ? ret : -ETIMEDOUT; > > - sgt = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL); > + sgt = dma_buf_sgt_map_attachment(attach, DMA_BIDIRECTIONAL); > if (IS_ERR(sgt)) > return PTR_ERR(sgt); > > diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c > index b4921a627ff3..4d93b8926ed6 100644 > --- a/drivers/gpu/drm/xe/xe_bo.c > +++ b/drivers/gpu/drm/xe/xe_bo.c > @@ -771,7 +771,7 @@ static int xe_bo_move_dmabuf(struct ttm_buffer_object *ttm_bo, > ttm_bo->sg = NULL; > } > > - sg = dma_buf_map_attachment(attach, DMA_BIDIRECTIONAL); > + sg = dma_buf_sgt_map_attachment(attach, DMA_BIDIRECTIONAL); > if (IS_ERR(sg)) > return PTR_ERR(sg); > > diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c > index a00985c92251..619181968ff9 100644 > --- a/drivers/iio/industrialio-buffer.c > +++ b/drivers/iio/industrialio-buffer.c > @@ -1730,7 +1730,7 @@ static int iio_buffer_attach_dmabuf(struct iio_dev_buffer_pair *ib, > priv->dir = buffer->direction == IIO_BUFFER_DIRECTION_IN > ? DMA_FROM_DEVICE : DMA_TO_DEVICE; > > - priv->sgt = dma_buf_map_attachment(attach, priv->dir); > + priv->sgt = dma_buf_sgt_map_attachment(attach, priv->dir); > if (IS_ERR(priv->sgt)) { > err = PTR_ERR(priv->sgt); > dev_err(&indio_dev->dev, "Unable to map attachment: %d\n", err); > diff --git a/drivers/infiniband/core/umem_dmabuf.c b/drivers/infiniband/core/umem_dmabuf.c > index 39b5564a4c35..dd584f8dcd1c 100644 > --- a/drivers/infiniband/core/umem_dmabuf.c > +++ b/drivers/infiniband/core/umem_dmabuf.c > @@ -29,8 +29,8 @@ int ib_umem_dmabuf_map_pages(struct ib_umem_dmabuf *umem_dmabuf) > if (umem_dmabuf->sgt) > goto wait_fence; > > - sgt = dma_buf_map_attachment(umem_dmabuf->attach, > - DMA_BIDIRECTIONAL); > + sgt = dma_buf_sgt_map_attachment(umem_dmabuf->attach, > + DMA_BIDIRECTIONAL); > if (IS_ERR(sgt)) > return PTR_ERR(sgt); > > diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c > index b0a6084f1757..5cd53e06da0b 100644 > --- a/drivers/media/common/videobuf2/videobuf2-core.c > +++ b/drivers/media/common/videobuf2/videobuf2-core.c > @@ -1464,7 +1464,7 @@ static int __prepare_dmabuf(struct vb2_buffer *vb) > vb->planes[plane].mem_priv = mem_priv; > > /* > - * This pins the buffer(s) with dma_buf_map_attachment()). It's done > + * This pins the buffer(s) with dma_buf_sgt_map_attachment()). It's done > * here instead just before the DMA, while queueing the buffer(s) so > * userspace knows sooner rather than later if the dma-buf map fails. > */ > diff --git a/drivers/media/common/videobuf2/videobuf2-dma-contig.c b/drivers/media/common/videobuf2/videobuf2-dma-contig.c > index 536f839258c6..0ce643940898 100644 > --- a/drivers/media/common/videobuf2/videobuf2-dma-contig.c > +++ b/drivers/media/common/videobuf2/videobuf2-dma-contig.c > @@ -706,7 +706,7 @@ static int vb2_dc_map_dmabuf(void *mem_priv) > } > > /* get the associated scatterlist for this buffer */ > - sgt = dma_buf_map_attachment_unlocked(buf->db_attach, buf->dma_dir); > + sgt = dma_buf_sgt_map_attachment_unlocked(buf->db_attach, buf->dma_dir); > if (IS_ERR(sgt)) { > pr_err("Error getting dmabuf scatterlist\n"); > return -EINVAL; > diff --git a/drivers/media/common/videobuf2/videobuf2-dma-sg.c b/drivers/media/common/videobuf2/videobuf2-dma-sg.c > index fba2027e6e8d..17191373c69c 100644 > --- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c > +++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c > @@ -569,7 +569,7 @@ static int vb2_dma_sg_map_dmabuf(void *mem_priv) > } > > /* get the associated scatterlist for this buffer */ > - sgt = dma_buf_map_attachment_unlocked(buf->db_attach, buf->dma_dir); > + sgt = dma_buf_sgt_map_attachment_unlocked(buf->db_attach, buf->dma_dir); > if (IS_ERR(sgt)) { > pr_err("Error getting dmabuf scatterlist\n"); > return -EINVAL; > diff --git a/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c b/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c > index 7752064be783..8f3443fa0eb5 100644 > --- a/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c > +++ b/drivers/media/platform/nvidia/tegra-vde/dmabuf-cache.c > @@ -102,7 +102,7 @@ int tegra_vde_dmabuf_cache_map(struct tegra_vde *vde, > goto err_unlock; > } > > - sgt = dma_buf_map_attachment_unlocked(attachment, dma_dir); > + sgt = dma_buf_sgt_map_attachment_unlocked(attachment, dma_dir); > if (IS_ERR(sgt)) { > dev_err(dev, "Failed to get dmabufs sg_table\n"); > err = PTR_ERR(sgt); > diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c > index 85fed3a12f9c..fce849417eb7 100644 > --- a/drivers/misc/fastrpc.c > +++ b/drivers/misc/fastrpc.c > @@ -911,7 +911,8 @@ static int fastrpc_map_attach(struct fastrpc_user *fl, int fd, > goto attach_err; > } > > - table = dma_buf_map_attachment_unlocked(map->attach, DMA_BIDIRECTIONAL); > + table = dma_buf_sgt_map_attachment_unlocked(map->attach, > + DMA_BIDIRECTIONAL); > if (IS_ERR(table)) { > err = PTR_ERR(table); > goto map_err; > diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c > index 09680534623e..fe3c43ba72c6 100644 > --- a/drivers/usb/gadget/function/f_fs.c > +++ b/drivers/usb/gadget/function/f_fs.c > @@ -1567,7 +1567,7 @@ static int ffs_dmabuf_attach(struct file *file, int fd) > if (err) > goto err_free_priv; > > - sg_table = dma_buf_map_attachment(attach, dir); > + sg_table = dma_buf_sgt_map_attachment(attach, dir); > dma_resv_unlock(dmabuf->resv); > > if (IS_ERR(sg_table)) { > diff --git a/drivers/xen/gntdev-dmabuf.c b/drivers/xen/gntdev-dmabuf.c > index 028cd7295fd7..3bb05596920e 100644 > --- a/drivers/xen/gntdev-dmabuf.c > +++ b/drivers/xen/gntdev-dmabuf.c > @@ -588,7 +588,7 @@ dmabuf_imp_to_refs(struct gntdev_dmabuf_priv *priv, struct device *dev, > > gntdev_dmabuf->u.imp.attach = attach; > > - sgt = dma_buf_map_attachment_unlocked(attach, DMA_BIDIRECTIONAL); > + sgt = dma_buf_sgt_map_attachment_unlocked(attach, DMA_BIDIRECTIONAL); > if (IS_ERR(sgt)) { > ret = ERR_CAST(sgt); > goto fail_detach; > diff --git a/include/linux/dma-buf-mapping.h b/include/linux/dma-buf-mapping.h > index 91a55cbe0bb4..02d79d5615b5 100644 > --- a/include/linux/dma-buf-mapping.h > +++ b/include/linux/dma-buf-mapping.h > @@ -171,7 +171,7 @@ void dma_buf_sgt_type_unmap(struct dma_buf_attachment *attach, > * > * When this type is matched the map/unmap functions are: > * > - * dma_buf_map_attachment() > + * dma_buf_sgt_map_attachment() > * dma_buf_unmap_attachment() > * > * The struct sg_table returned by those functions has only the DMA portions > @@ -206,7 +206,7 @@ struct dma_buf_mapping_sgt_exp_ops { > /** > * @map_dma_buf: > * > - * This is called by dma_buf_map_attachment() and is used to map a > + * This is called by dma_buf_sgt_map_attachment() and is used to map a > * shared &dma_buf into device address space, and it is mandatory. It > * can only be called if @attach has been called successfully. > * > diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h > index 77a18b9817ac..ee6c97a5cecd 100644 > --- a/include/linux/dma-buf.h > +++ b/include/linux/dma-buf.h > @@ -515,7 +515,7 @@ struct dma_buf_attach_ops { > * > * An attachment is created by calling dma_buf_attach(), and released again by > * calling dma_buf_detach(). The DMA mapping itself needed to initiate a > - * transfer is created by dma_buf_map_attachment() and freed again by calling > + * transfer is created by dma_buf_sgt_map_attachment() and freed again by calling > * dma_buf_unmap_attachment(). > */ > struct dma_buf_attachment { > @@ -614,8 +614,8 @@ void dma_buf_fd_install(struct dma_buf *dmabuf, int fd); > struct dma_buf *dma_buf_get(int fd); > void dma_buf_put(struct dma_buf *dmabuf); > > -struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *, > - enum dma_data_direction); > +struct sg_table *dma_buf_sgt_map_attachment(struct dma_buf_attachment *, > + enum dma_data_direction); > void dma_buf_unmap_attachment(struct dma_buf_attachment *, struct sg_table *, > enum dma_data_direction); > void dma_buf_invalidate_mappings(struct dma_buf *dma_buf); > @@ -625,8 +625,8 @@ int dma_buf_begin_cpu_access(struct dma_buf *dma_buf, > int dma_buf_end_cpu_access(struct dma_buf *dma_buf, > enum dma_data_direction dir); > struct sg_table * > -dma_buf_map_attachment_unlocked(struct dma_buf_attachment *attach, > - enum dma_data_direction direction); > +dma_buf_sgt_map_attachment_unlocked(struct dma_buf_attachment *attach, > + enum dma_data_direction direction); > void dma_buf_unmap_attachment_unlocked(struct dma_buf_attachment *attach, > struct sg_table *sg_table, > enum dma_data_direction direction); > diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c > index 86d580d4410d..3f8be77a50dc 100644 > --- a/io_uring/zcrx.c > +++ b/io_uring/zcrx.c > @@ -182,7 +182,8 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq, > goto err; > } > > - mem->sgt = dma_buf_map_attachment_unlocked(mem->attach, DMA_FROM_DEVICE); > + mem->sgt = dma_buf_sgt_map_attachment_unlocked(mem->attach, > + DMA_FROM_DEVICE); > if (IS_ERR(mem->sgt)) { > ret = PTR_ERR(mem->sgt); > mem->sgt = NULL; > diff --git a/net/core/devmem.c b/net/core/devmem.c > index f4d60654ce7f..86b3c54933bb 100644 > --- a/net/core/devmem.c > +++ b/net/core/devmem.c > @@ -241,8 +241,8 @@ net_devmem_bind_dmabuf(struct net_device *dev, void *vdev, > goto err_exit_ref; > } > > - binding->sgt = dma_buf_map_attachment_unlocked(binding->attachment, > - direction); > + binding->sgt = dma_buf_sgt_map_attachment_unlocked(binding->attachment, > + direction); > if (IS_ERR(binding->sgt)) { > err = PTR_ERR(binding->sgt); > NL_SET_ERR_MSG(extack, "Failed to map dmabuf attachment");

12 hours, 28 minutes

Re: [PATCH 23/26] treewide: Rename dma_buf_attach() to dma_buf_sgt_attach()

by Jason Gunthorpe

On Tue, Oct 27, 2026 at 12:42:32PM +0900, Mikko Perttunen wrote: > > This page-side use predates the series, so the fault is not itself a v2 > > regression. Is dma_buf_sgt_attach() valid for this call site, or does Tegra > > need a page/physical mapping type first? > > Sounds like a bug in TegraDRM; we should be using the DMA addr/length > for the explicit IOMMU mapping as the sgt attachment is for the dummy > DRM device explicitly intended to give us physical addresses. No, you cannot connect dmabuf to an iommu_domain. It is 100% always illegal. DMABUF does not support this. Do not pass sg_dma to iommu functions either. > I'm currently in the process of removing the whole explicit IOMMU path > so if this only occurs with CONFIG_DMABUF_DEBUG enabled, I don't think > there's a pressing need to fix this before then. Yes I think this is probably the only way to fix it :| You have to always use the DMA API Jason

12 hours, 30 minutes

Re: [PATCH 23/26] treewide: Rename dma_buf_attach() to dma_buf_sgt_attach()

by Jason Gunthorpe

On Tue, Oct 27, 2026 at 03:15:34AM +0100, Karl Mehltretter wrote: > On Mon, Oct 26, 2026 at 04:36:14PM +0100, Alistair Popple wrote: > > Testing the series on a Jetson Nano exposed this path. A 3 MiB system-heap > buffer was imported into Tegra DRM and scanned out over HDMI. With > CONFIG_DMABUF_DEBUG=y the PRIME import succeeded, but scanout immediately > produced display SMMU faults starting at 0x300000. Why is this being reported here? Shouldn't CONFIG_DMABUF_DEBUG=y have always caused tegra to fail? > > @@ -475,7 +475,7 @@ static struct tegra_bo *tegra_bo_import(struct drm_device *drm, > > * domain, map it first to the DRM device to get an sgt. > > */ > > if (tegra->domain) { > > - attach = dma_buf_attach(buf, drm->dev); > > + attach = dma_buf_sgt_attach(buf, drm->dev); > > tegra_bo_import() passes the attachment SGT to iommu_map_sgtable(), > which This is illegal use of dmabuf, this was discussed in some other driver recently. All DRM drivers trying to use custom iommu domains are busted this way. AFAIK there is no solution besides "don't do that". > This page-side use predates the series, so the fault is not itself a v2 > regression. Is dma_buf_sgt_attach() valid for this call site, or does Tegra > need a page/physical mapping type first? Tegra is broken. Jason

12 hours, 32 minutes

Re: [PATCH 23/26] treewide: Rename dma_buf_attach() to dma_buf_sgt_attach()

by Christian König

On 10/27/26 03:15, Karl Mehltretter wrote: > On Mon, Oct 26, 2026 at 04:36:14PM +0100, Alistair Popple wrote: > > Testing the series on a Jetson Nano exposed this path. A 3 MiB system-heap > buffer was imported into Tegra DRM and scanned out over HDMI. With > CONFIG_DMABUF_DEBUG=y the PRIME import succeeded, but scanout immediately > produced display SMMU faults starting at 0x300000. > > Tracing the fault led here: > >> @@ -475,7 +475,7 @@ static struct tegra_bo *tegra_bo_import(struct drm_device *drm, >> * domain, map it first to the DRM device to get an sgt. >> */ >> if (tegra->domain) { >> - attach = dma_buf_attach(buf, drm->dev); >> + attach = dma_buf_sgt_attach(buf, drm->dev); > > tegra_bo_import() passes the attachment SGT to iommu_map_sgtable(), which > uses sg_phys() and sg->length. The SGT mapping contract only guarantees the > DMA address and length fields. The debug wrapper clears the page-side fields, > so iommu_map_sgtable() maps zero bytes. > > Tegra only treats negative returns as errors and keeps the reserved > IOVA, which scanout then faults on. > > This page-side use predates the series, so the fault is not itself a v2 > regression. Is dma_buf_sgt_attach() valid for this call site, or does Tegra > need a page/physical mapping type first? Sharing page/physical to be used with the IOMMU functions through DMA-buf is an absolutely hard NAK from my side. We still need to figure out how to do this between KVM, IOMMUFD and virtio so that it is limited to only those three. Regards, Christian. > > Karl

12 hours, 52 minutes

Re: [PATCH v2 01/23] dt-bindings: display: msm: Add Qualcomm DCP

by Krzysztof Kozlowski

On Mon, Oct 26, 2026 at 11:51:11AM +0530, Jayant Shekhar wrote: > DCP platforms place the display pipeline under firmware control, so Linux What is a DCP platform? > cannot discover display resources through direct register access. The DRM > driver therefore needs device-tree descriptions of the Qualcomm transport > wrapper, display topology, IOMMU contexts, and panel connections. > > Add bindings for the Qualcomm DCP transport wrapper and VirtIO display > subsystem. Document the IPCC power-notify resources, transport and > framebuffer IOMMU contexts, firmware-visible IOVA range, INTF graph, and > DSI panel connections. The wrapper creates a standard VirtIO-MMIO child > after the IPCC power-notify sequence has completed. It's still DT for real hardware, so I wonder why no SoC specific compatibles were used. Best regards, Krzysztof

16 hours, 27 minutes

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig