On Thu, Jan 08, 2026 at 01:11:14PM +0200, Edward Srouji wrote:

From: Yishai Hadas yishaih@nvidia.com

Expose DMABUF functionality to userspace through the uverbs interface, enabling InfiniBand/RDMA devices to export PCI based memory regions (e.g. device memory) as DMABUF file descriptors. This allows zero-copy sharing of RDMA memory with other subsystems that support the dma-buf framework.

A new UVERBS_OBJECT_DMABUF object type and allocation method were introduced.

During allocation, uverbs invokes the driver to supply the rdma_user_mmap_entry associated with the given page offset (pgoff).

Based on the returned rdma_user_mmap_entry, uverbs requests the driver to provide the corresponding physical-memory details as well as the driver’s PCI provider information.

Using this information, dma_buf_export() is called; if it succeeds, uobj->object is set to the underlying file pointer returned by the dma-buf framework.

The file descriptor number follows the standard uverbs allocation flow, but the file pointer comes from the dma-buf subsystem, including its own fops and private data.

Because of this, alloc_begin_fd_uobject() must handle cases where fd_type->fops is NULL, and both alloc_commit_fd_uobject() and alloc_abort_fd_uobject() must account for whether filp->private_data exists, since it is only populated after a successful dma_buf_export().

When an mmap entry is removed, uverbs iterates over its associated DMABUFs, marks them as revoked, and calls dma_buf_move_notify() so that their importers are notified.

The same procedure applies during the disassociate flow; final cleanup occurs when the application closes the file.

Signed-off-by: Yishai Hadas yishaih@nvidia.com Signed-off-by: Edward Srouji edwards@nvidia.com

---

drivers/infiniband/core/Makefile | 1 + drivers/infiniband/core/device.c | 2 + drivers/infiniband/core/ib_core_uverbs.c | 19 +++ drivers/infiniband/core/rdma_core.c | 63 ++++---- drivers/infiniband/core/rdma_core.h | 1 + drivers/infiniband/core/uverbs.h | 10 ++ drivers/infiniband/core/uverbs_std_types_dmabuf.c | 172 ++++++++++++++++++++++ drivers/infiniband/core/uverbs_uapi.c | 1 + include/rdma/ib_verbs.h | 9 ++ include/rdma/uverbs_types.h | 1 + include/uapi/rdma/ib_user_ioctl_cmds.h | 10 ++ 11 files changed, 263 insertions(+), 26 deletions(-)

<...>

+static struct sg_table * +uverbs_dmabuf_map(struct dma_buf_attachment *attachment,

•   enum dma_data_direction dir)
  

+{

• struct ib_uverbs_dmabuf_file *priv = attachment->dmabuf->priv;
• dma_resv_assert_held(priv->dmabuf->resv);
• if (priv->revoked)

• return ERR_PTR(-ENODEV);
  

• return dma_buf_phys_vec_to_sgt(attachment, priv->provider,

• 		       &priv->phys_vec, 1, priv->phys_vec.len,
  

• 		       dir);
  

+}

+static void uverbs_dmabuf_unmap(struct dma_buf_attachment *attachment,

• 		struct sg_table *sgt,
  

• 		enum dma_data_direction dir)
  

+{

• dma_buf_free_sgt(attachment, sgt, dir);

+}

Unfortunately, it is not enough. Exporters should count their map<->unmap calls and make sure that they are equal.

See this VFIO change https://lore.kernel.org/kvm/20260124-dmabuf-revoke-v5-4-f98fca917e96@nvidia....

Thanks