On 10/27/26 10:08, Li Wang wrote:

From: Mengmeng Zhao zhaomengmeng@kylinos.cn

This patch introduces a driver that allows moving data between a GPU dma-buf and a regular file on NVME without staging it through the page cache. Userspace registers the GPU dma-buf with the device, then issues read and write requests via the device's ioctls. Each transfer is direct I/O: an ITER_DMABUF_MAP iterator is passed to the file's read_iter or write_iter, and the filesystem's iomap path submits REQ_DMABUF bios that already carry the dma addresses.

Why in the world is that still useful with Pavel work on io_uring?

Signed-off-by: Mengmeng Zhao zhaomengmeng@kylinos.cn Signed-off-by: Li Wang liwang@kylinos.cn

---

.../userspace-api/ioctl/ioctl-number.rst | 2 + drivers/dma-buf/dma-buf-io.c | 3 + drivers/misc/Kconfig | 16 + drivers/misc/Makefile | 1 + drivers/misc/fgds.c | 506 ++++++++++++++++++ fs/iomap/buffered-io.c | 11 + fs/iomap/direct-io.c | 23 +- fs/xfs/xfs_file.c | 4 + include/linux/iov_iter.h | 4 + include/uapi/linux/fgds.h | 124 +++++ lib/iov_iter.c | 1 + mm/filemap.c | 22 +- 12 files changed, 713 insertions(+), 4 deletions(-) create mode 100644 drivers/misc/fgds.c create mode 100644 include/uapi/linux/fgds.h

diff --git a/Documentation/userspace-api/ioctl/ioctl-number.rst b/Documentation/userspace-api/ioctl/ioctl-number.rst index 2fc53093752d..5f93a252e773 100644 --- a/Documentation/userspace-api/ioctl/ioctl-number.rst +++ b/Documentation/userspace-api/ioctl/ioctl-number.rst @@ -306,6 +306,8 @@ Code Seq# Include File Comments 'v' 20-27 arch/powerpc/include/uapi/asm/vas-api.h VAS API 'v' C0-FF linux/meye.h conflict! 'w' all CERN SCI driver +'x' 00-0F linux/fgds.h Fast GPU Direct Storage

•                                                                   <mailto:liwang@kylinos.cn>
  

'y' 00-1F packet based user level communications mailto:zapman@interlan.net 'z' 00-3F CAN bus card conflict! diff --git a/drivers/dma-buf/dma-buf-io.c b/drivers/dma-buf/dma-buf-io.c index 8440151de860..2ee4fc683c74 100644 --- a/drivers/dma-buf/dma-buf-io.c +++ b/drivers/dma-buf/dma-buf-io.c @@ -135,6 +135,7 @@ struct dma_buf_io_map *dma_buf_io_create_map(struct dma_buf_io_ctx *ctx) dma_resv_unlock(ctx->dmabuf->resv); return map; } +EXPORT_SYMBOL_NS_GPL(dma_buf_io_create_map, "DMA_BUF");

Clear NAK to that. Those are FS layer helper functionalities for DMA-buf and not something drivers should ever need to mess with.

Regards, Christian.

static void dma_buf_io_ctx_shutdown(struct dma_buf_io_ctx *ctx) { @@ -190,6 +191,7 @@ int dma_buf_io_ctx_create(struct file *file, *out_ctx = ctx; return 0; } +EXPORT_SYMBOL_NS_GPL(dma_buf_io_ctx_create, "DMA_BUF"); /**

• dma_buf_io_ctx_release - Destroy the I/O context

@@ -211,6 +213,7 @@ void dma_buf_io_ctx_release(struct dma_buf_io_ctx *ctx) dma_buf_put(ctx->dmabuf); kfree(ctx); } +EXPORT_SYMBOL_NS_GPL(dma_buf_io_ctx_release, "DMA_BUF"); /**

• dma_buf_io_invalidate_mappings - Invalidate the current map

diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig index 7364931dad3a..b85fd64d27ad 100644 --- a/drivers/misc/Kconfig +++ b/drivers/misc/Kconfig @@ -568,6 +568,22 @@ config MCHP_LAN966X_PCI - lan966x-miim (MDIO_MSCC_MIIM) - lan966x-switch (LAN966X_SWITCH) +config FGDS

• tristate "Fast GPU Direct Storage support"
• depends on DMA_SHARED_BUFFER && BLOCK
• default n
• help

•  This driver exposes a misc device that moves data between a GPU
  

•  dma-buf and a regular file with synchronous read/write ioctls,
  

•  submitting the transfer as direct I/O (REQ_DMABUF bios) through
  

•  the file system's iomap DIO path without a page cache bounce
  

•  buffer.
  

•  To compile this driver as a module, choose M here: the module
  

•  will be called fgds.
  

•  If unsure, say N.
  

source "drivers/misc/c2port/Kconfig" source "drivers/misc/eeprom/Kconfig" source "drivers/misc/cb710/Kconfig" diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile index e8d8d5d88c0d..cd98ef3d008e 100644 --- a/drivers/misc/Makefile +++ b/drivers/misc/Makefile @@ -70,4 +70,5 @@ obj-$(CONFIG_MCHP_LAN966X_PCI) += lan966x-pci.o obj-y += keba/ obj-y += amd-sbi/ obj-$(CONFIG_MISC_RP1) += rp1/ +obj-$(CONFIG_FGDS) += fgds.o obj-$(CONFIG_INTEL_SSEI) += issei/ diff --git a/drivers/misc/fgds.c b/drivers/misc/fgds.c new file mode 100644 index 000000000000..3929a6514d23 --- /dev/null +++ b/drivers/misc/fgds.c @@ -0,0 +1,506 @@ +// SPDX-License-Identifier: GPL-2.0 +/*

• • Fast GPU Direct Storage via dma-buf.
• • Copyright (C) 2026 KylinSoft. Co., Ltd. All rights reserved.
• • Synchronous read/write ioctls that move data between a GPU dma-buf and
• • a regular file.
• */

+#include <linux/blkdev.h> +#include <linux/dma-buf.h> +#include <linux/dma-buf-io.h> +#include <linux/device.h> +#include <linux/fcntl.h> +#include <linux/fileattr.h> +#include <linux/fs.h> +#include <linux/fsnotify.h> +#include <linux/magic.h> +#include <linux/math.h> +#include <linux/miscdevice.h> +#include <linux/module.h> +#include <linux/overflow.h> +#include <linux/pagemap.h> +#include <linux/sched/xacct.h> +#include <linux/slab.h> +#include <linux/uaccess.h> +#include <linux/uio.h> +#include <linux/xarray.h>

+#include <linux/fgds.h>

+static struct miscdevice fgds_misc;

+/* One registered buffer: a dma-buf bound to a block device. */ +struct fgds_reg {

• struct kref kref;
• struct dma_buf_io_ctx *ctx;
• struct file *bdev_file;
• struct block_device *bdev;
• u64 size;

+};

+/* State of one /dev/fgds open file description; handles are private to it. */ +struct fgds_state {

• struct xarray regs;
• /* protects @regs and, with the reg kref, the lifetime of entries */
• struct mutex lock;

+};

+static void fgds_reg_release(struct kref *kref) +{

• struct fgds_reg *reg = container_of(kref, struct fgds_reg, kref);
• dma_buf_io_ctx_release(reg->ctx);
• fput(reg->bdev_file);
• kfree(reg);

+}

+static void fgds_reg_put(struct fgds_reg *reg) +{

• kref_put(&reg->kref, fgds_reg_release);

+}

+static struct fgds_state *fgds_state(struct file *file) +{

• return file->private_data;

+}

+/*

• • File and file-system level gate.
• */

+static int fgds_gate(struct file *ffile) +{

• struct inode *inode = file_inode(ffile);
• struct super_block *sb = inode->i_sb;
• struct file_kattr fa;
• if (!S_ISREG(inode->i_mode))

• return -EINVAL;
  

• if (sb->s_magic != XFS_SUPER_MAGIC)

• return -EOPNOTSUPP;
  

• if (IS_DAX(inode))

• return -EOPNOTSUPP;
  

• if (mapping_stable_writes(inode->i_mapping))

• return -EOPNOTSUPP;
  

• if (!sb->s_bdev)

• return -EOPNOTSUPP;
  

• if (bdev_is_zoned(sb->s_bdev))

• return -EOPNOTSUPP;
  

• if (!sb->s_bdev->bd_disk->fops->init_dma_buf_io_ctx)

• return -EOPNOTSUPP;
  

• /*

• * Realtime inodes live on a separate device whose DMA setup is not
  

• * covered here.
  

• */
  

• if (vfs_fileattr_get(ffile->f_path.dentry, &fa))

• return -EOPNOTSUPP;
  

• if (fa.fsx_xflags & FS_XFLAG_REALTIME)

• return -EOPNOTSUPP;
  

• return 0;

+}

+static unsigned int fgds_file_align(struct inode *inode, bool write) +{

• unsigned int lbs = bdev_logical_block_size(inode->i_sb->s_bdev);
• if (!write)

• return lbs;
  

• return max(1U << inode->i_blkbits, lbs);

+}

+static unsigned int fgds_dma_align(struct inode *inode) +{

• return bdev_dma_alignment(inode->i_sb->s_bdev) + 1;

+}

+static struct fgds_reg *fgds_reg_get(struct fgds_state *state, u32 handle) +{

• struct fgds_reg *reg;
• mutex_lock(&state->lock);
• reg = xa_load(&state->regs, handle);
• if (reg)

• kref_get(&reg->kref);
  

• mutex_unlock(&state->lock);
• return reg;

+}

+static int fgds_unregister_handle(struct fgds_state *state, u32 handle) +{

• struct fgds_reg *reg;
• mutex_lock(&state->lock);
• reg = xa_erase(&state->regs, handle);
• mutex_unlock(&state->lock);
• if (reg)

• fgds_reg_put(reg);
  

• return reg ? 0 : -EINVAL;

+}

+static int fgds_register(struct file *file, struct fgds_register_args __user *uarg) +{

• struct fgds_register_args args;
• struct fgds_state *state = fgds_state(file);
• struct dma_buf_io_ctx *ctx = NULL;
• struct block_device *bdev;
• struct file *bdev_file;
• struct dma_buf *dbuf;
• struct fd bfdf;
• struct fgds_reg *reg;
• u32 id;
• int ret;
• if (copy_from_user(&args, uarg, sizeof(args)))

• return -EFAULT;
  

• if (args.handle || args.pad || args.reserved)

• return -EINVAL;
  

• dbuf = dma_buf_get(args.dfd);
• if (IS_ERR(dbuf))

• return PTR_ERR(dbuf);
  

• bfdf = fdget(args.bdev_fd);
• if (fd_empty(bfdf)) {

• ret = -EBADF;
  

• goto out_dmabuf;
  

• }
• bdev_file = fd_file(bfdf);
• if (!S_ISBLK(file_inode(bdev_file)->i_mode)) {

• ret = -EINVAL;
  

• goto out_fdput;
  

• }
• /* blkdev_init_dma_buf_io_ctx() needs O_DIRECT. */
• if (!(bdev_file->f_flags & O_DIRECT)) {

• ret = -EINVAL;
  

• goto out_fdput;
  

• }
• bdev = file_bdev(bdev_file);
• if (!bdev->bd_disk->fops->init_dma_buf_io_ctx) {

• ret = -EOPNOTSUPP;
  

• goto out_fdput;
  

• }
• ret = -ENOMEM;
• reg = kzalloc_obj(*reg);
• if (!reg)

• goto out_fdput;
  

• get_file(bdev_file);
• ret = dma_buf_io_ctx_create(bdev_file, dbuf, DMA_BIDIRECTIONAL, &ctx);
• if (ret) {

• dev_err(fgds_misc.this_device,
  

• 	"dma-buf-io context on %pg failed: %pe\n",
  

• 	bdev, ERR_PTR(ret));
  

• goto out_file;
  

• }
• kref_init(&reg->kref);
• reg->ctx = ctx;
• reg->bdev_file = bdev_file;
• reg->bdev = bdev;
• reg->size = dbuf->size;
• mutex_lock(&state->lock);
• ret = xa_alloc(&state->regs, &id, reg, XA_LIMIT(1, UINT_MAX),

•        GFP_KERNEL);
  

• if (ret) {

• mutex_unlock(&state->lock);
  

• goto out_ctx;
  

• }
• args.handle = id;
• /* the window must stay inside the buffer and within 32 bits */
• args.max_doffset = min_t(u64, reg->size, UINT_MAX);
• if (copy_to_user(uarg, &args, sizeof(args))) {

• xa_erase(&state->regs, id);
  

• mutex_unlock(&state->lock);
  

• ret = -EFAULT;
  

• goto out_ctx;
  

• }
• mutex_unlock(&state->lock);
• fdput(bfdf);
• dma_buf_put(dbuf);
• return 0;

+out_ctx:

• dma_buf_io_ctx_release(ctx);

+out_file:

• fput(bdev_file);
• kfree(reg);

+out_fdput:

• fdput(bfdf);

+out_dmabuf:

• dma_buf_put(dbuf);
• return ret;

+}

+static int fgds_unregister(struct file *file, struct fgds_unregister_args __user *uarg) +{

• struct fgds_unregister_args args;
• if (copy_from_user(&args, uarg, sizeof(args)))

• return -EFAULT;
  

• if (args.reserved)

• return -EINVAL;
  

• return fgds_unregister_handle(fgds_state(file), args.handle);

+}

+/*

• • Launch one read_iter()/write_iter() call.
• • Returns the number of bytes the file system moved, or a negative
• • errno; a short read means the end of the file.
• */

+static ssize_t fgds_do_rw(struct fgds_state *state,

• 	  const struct fgds_rw_args *args, bool write)
  

+{

• struct fgds_reg *reg;
• struct dma_buf_io_map *map;
• struct file *ffile;
• struct inode *inode;
• struct iov_iter iter;
• struct kiocb kiocb;
• struct fd fdf;
• ssize_t (*iter_fn)(struct kiocb *kiocb, struct iov_iter *i);
• unsigned int file_align, dma_align;
• u64 length = args->length;
• u64 dbuf_end;
• loff_t offset, end;
• ssize_t ret;
• if (args->flags)

• return -EINVAL;
  

• if (length > MAX_RW_COUNT)

• return -EINVAL;
  

• offset = args->offset;
• if (offset < 0 || check_add_overflow(offset, (loff_t)length, &end))

• return -EINVAL;
  

• /*

• * The block layer's dma-buf iterator truncates the segment offset to
  

• * 32 bits, and the window must stay inside the registered buffer.
  

• */
  

• if (check_add_overflow(args->doffset, length, &dbuf_end))

• return -EINVAL;
  

• if (dbuf_end > UINT_MAX)

• return -EINVAL;
  

• fdf = fdget(args->ffd);
• if (fd_empty(fdf))

• return -EBADF;
  

• ffile = fd_file(fdf);
• inode = file_inode(ffile);
• ret = -EINVAL;
• if (!S_ISREG(inode->i_mode) || (ffile->f_flags & O_APPEND))

• goto out_fdput;
  

• if (write) {

• if (!(ffile->f_mode & FMODE_WRITE) ||
  

•     !(ffile->f_mode & FMODE_CAN_WRITE))
  

• 	goto out_fdput;
  

• iter_fn = ffile->f_op->write_iter;
  

• } else {

• if (!(ffile->f_mode & FMODE_READ) ||
  

•     !(ffile->f_mode & FMODE_CAN_READ))
  

• 	goto out_fdput;
  

• iter_fn = ffile->f_op->read_iter;
  

• }
• if (!iter_fn) {

• ret = -EOPNOTSUPP;
  

• goto out_fdput;
  

• }
• ret = fgds_gate(ffile);
• if (ret)

• goto out_fdput;
  

• reg = fgds_reg_get(state, args->handle);
• if (!reg) {

• ret = -EINVAL;
  

• goto out_fdput;
  

• }
• if (inode->i_sb->s_bdev != reg->bdev) {

• ret = -EXDEV;
  

• goto out_reg;
  

• }
• file_align = fgds_file_align(inode, write);
• dma_align = fgds_dma_align(inode);
• if ((offset | (loff_t)length) & (file_align - 1) ||

•    (args->doffset | (loff_t)length) & (dma_align - 1) ||
  

•    dbuf_end > reg->size ||
  

•    (!write && end > i_size_read(inode))) {
  

• ret = -EINVAL;
  

• goto out_reg;
  

• }
• ret = rw_verify_area(write ? WRITE : READ, ffile, &offset, length);
• if (ret)

• goto out_reg;
  

• if (write)

• inc_syscw(current);
  

• else

• inc_syscr(current);
  

• if (!length) {

• ret = 0;
  

• goto out_reg;
  

• }
• map = dma_buf_io_get_map(reg->ctx, false);
• if (IS_ERR(map)) {

• ret = PTR_ERR(map);
  

• if (ret != -EAGAIN)
  

• 	dev_err_ratelimited(fgds_misc.this_device,
  

• 			    "dma-buf mapping failed on %pg: %pe\n",
  

• 			    reg->bdev, ERR_PTR(ret));
  

• goto out_reg;
  

• }
• /*

• * A direct I/O read would leave any cached pages of the range
  

• * stale, so flush and drop them before submitting.
  

• */
  

• if (!write) {

• ret = filemap_write_and_wait_range(ffile->f_mapping,
  

• 				   offset, end - 1);
  

• if (ret)
  

• 	goto out_map;
  

• ret = invalidate_inode_pages2_range(ffile->f_mapping,
  

• 				    offset >> PAGE_SHIFT,
  

• 				    (end - 1) >> PAGE_SHIFT);
  

• if (ret) {
  

• 	/*
  

• 	 * Report a retryable error instead of letting
  

• 	 * -EBUSY escape.
  

• 	 */
  

• 	if (ret == -EBUSY)
  

• 		ret = -EAGAIN;
  

• 	goto out_map;
  

• }
  

• }
• if (write)

• file_start_write(ffile);
  

• iov_iter_dmabuf_map(&iter, write ? ITER_SOURCE : ITER_DEST,

• 	    map, args->doffset, length);
  

• init_sync_kiocb(&kiocb, ffile);
• kiocb.ki_flags |= IOCB_DIRECT;
• if (write)

• kiocb.ki_flags |= IOCB_WRITE;
  

• kiocb.ki_pos = offset;
• ret = iter_fn(&kiocb, &iter);
• if (WARN_ON_ONCE(ret == -EIOCBQUEUED))

• ret = -EIO;
  

• if (write)

• file_end_write(ffile);
  

• if (ret > 0) {

• if (write) {
  

• 	fsnotify_modify(ffile);
  

• 	add_wchar(current, ret);
  

• } else {
  

• 	fsnotify_access(ffile);
  

• 	add_rchar(current, ret);
  

• }
  

• }

+out_map:

• dma_buf_io_map_drop(map);

+out_reg:

• fgds_reg_put(reg);

+out_fdput:

• fdput(fdf);
• return ret;

+}

+static long fgds_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +{

• struct fgds_state *state = fgds_state(file);
• struct fgds_rw_args args;
• switch (cmd) {
• case FGDS_IOCTL_WRITE:
• case FGDS_IOCTL_READ:

• if (copy_from_user(&args, (void __user *)arg, sizeof(args)))
  

• 	return -EFAULT;
  

• return fgds_do_rw(state, &args, cmd == FGDS_IOCTL_WRITE);
  

• case FGDS_IOCTL_REGISTER_BUF:

• return fgds_register(file, (struct fgds_register_args __user *)arg);
  

• case FGDS_IOCTL_UNREGISTER_BUF:

• return fgds_unregister(file, (struct fgds_unregister_args __user *)arg);
  

• }
• return -ENOTTY;

+}

+static int fgds_open(struct inode *inode, struct file *file) +{

• struct fgds_state *state;
• state = kzalloc_obj(*state);
• if (!state)

• return -ENOMEM;
  

• xa_init_flags(&state->regs, XA_FLAGS_ALLOC);
• mutex_init(&state->lock);
• file->private_data = state;
• return 0;

+}

+static int fgds_release(struct inode *inode, struct file *file) +{

• struct fgds_state *state = fgds_state(file);
• struct fgds_reg *reg;
• unsigned long id;
• xa_for_each(&state->regs, id, reg) {

• xa_erase(&state->regs, id);
  

• fgds_reg_put(reg);
  

• }
• xa_destroy(&state->regs);
• mutex_destroy(&state->lock);
• kfree(state);
• return 0;

+}

+static const struct file_operations fgds_fops = {

• .owner = THIS_MODULE,
• .open = fgds_open,
• .release = fgds_release,
• .unlocked_ioctl = fgds_ioctl,
• .compat_ioctl = compat_ptr_ioctl,

+};

+static struct miscdevice fgds_misc = {

• .minor = MISC_DYNAMIC_MINOR,
• .name = "fgds",
• .fops = &fgds_fops,

+};

+static int __init fgds_init(void) +{

• return misc_register(&fgds_misc);

+}

+static void __exit fgds_exit(void) +{

• misc_deregister(&fgds_misc);

+}

+module_init(fgds_init); +module_exit(fgds_exit);

+MODULE_LICENSE("GPL"); +MODULE_IMPORT_NS("DMA_BUF"); +MODULE_AUTHOR("Mengmeng Zhao zhaomengmeng@kylinos.cn, Li Wang liwang@kylinos.cn"); +MODULE_DESCRIPTION("Fast GPU Direct Storage"); +MODULE_VERSION("1.0.0"); diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c index 0a5ebfda90f1..a7ab28edab98 100644 --- a/fs/iomap/buffered-io.c +++ b/fs/iomap/buffered-io.c @@ -1304,6 +1304,17 @@ iomap_file_buffered_write(struct kiocb *iocb, struct iov_iter *i, }; ssize_t ret;

• /*

• * The copy helpers have no source for a dma-buf iterator: the copy
  

• * would move zero bytes, ->write_end() would reject the untouched
  

• * folio, fault_in_iov_iter_readable() reports the iterator as
  

• * readable, and the loop below would never advance.  Refuse here
  

• * rather than at each caller's entry point, so no path can reach
  

• * the copy with such an iterator.
  

• */
  

• if (iov_iter_is_dmabuf_map(i))

• return -EOPNOTSUPP;
  

• if (iocb->ki_flags & IOCB_NOWAIT) iter.flags |= IOMAP_NOWAIT; if (iocb->ki_flags & IOCB_DONTCACHE)

diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c index 8b4039d16ce8..eccc07d53e9c 100644 --- a/fs/iomap/direct-io.c +++ b/fs/iomap/direct-io.c @@ -595,8 +595,16 @@ static int iomap_dio_bio_iter(struct iomap_iter *iter, struct iomap_dio *dio) static int iomap_dio_hole_iter(struct iomap_iter *iter, struct iomap_dio *dio) {

• loff_t length = iov_iter_zero(iomap_length(iter), dio->submit.iter);

• loff_t length;

• /*

• * dmabuf maps do not support zero-filling holes or
  

• * unwritten extents.
  

• */
  

• if (iov_iter_is_dmabuf_map(dio->submit.iter))

• return -EOPNOTSUPP;
  

• length = iov_iter_zero(iomap_length(iter), dio->submit.iter); dio->size += length; if (!length) return -EFAULT;

@@ -683,8 +691,8 @@ static int iomap_dio_iter(struct iomap_iter *iter, struct iomap_dio *dio)

• the correct total number of bytes transferred; this is essential for
• completing partial requests asynchronously.

• • Returns -ENOTBLK In case of a page invalidation invalidation failure for
• • writes. The callers needs to fall back to buffered I/O in this case.

• • Returns -ENOTBLK in case of a page cache invalidation failure for writes.
• • The caller needs to fall back to buffered I/O in this case.
  */

struct iomap_dio * __iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, @@ -794,6 +802,15 @@ __iomap_dio_rw(struct kiocb *iocb, struct iov_iter *iter, * the caller tries again. */ ret = -EAGAIN;

• 		} else if (iov_iter_is_dmabuf_map(iter)) {
  

• 			/*
  

• 			 * Avoid -ENOTBLK (buffered fallback)
  

• 			 * as dmabuf are not supported. Map
  

• 			 * -EBUSY to -EAGAIN for transient
  

• 			 * retires.
  

• 			 */
  

• 			if (ret == -EBUSY)
  

• 				ret = -EAGAIN;
  	} else {
  		/* fall back to buffered write */
  		ret = -ENOTBLK;
  

diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c index 426a67b813a7..f16e9cb63e9e 100644 --- a/fs/xfs/xfs_file.c +++ b/fs/xfs/xfs_file.c @@ -1211,6 +1211,10 @@ xfs_file_write_iter( return ret; }

• /* zoned and buffered I/O is not supported for dmabuf */
• if (iov_iter_is_dmabuf_map(from))

• return -EOPNOTSUPP;
  

• if (xfs_is_zoned_inode(ip)) return xfs_file_buffered_write_zoned(iocb, from); return xfs_file_buffered_write(iocb, from);

diff --git a/include/linux/iov_iter.h b/include/linux/iov_iter.h index 2f91884d733b..a3b99e6d8255 100644 --- a/include/linux/iov_iter.h +++ b/include/linux/iov_iter.h @@ -376,6 +376,10 @@ size_t iterate_and_advance_kernel(struct iov_iter *iter, size_t len, void *priv, return iterate_folioq(iter, len, priv, priv2, step); if (iov_iter_is_xarray(iter)) return iterate_xarray(iter, len, priv, priv2, step);

• if (iov_iter_is_dmabuf_map(iter)) {

• WARN_ON_ONCE(1);
  

• return 0;
  

• } return iterate_discard(iter, len, priv, priv2, step);

} diff --git a/include/uapi/linux/fgds.h b/include/uapi/linux/fgds.h new file mode 100644 index 000000000000..9a721c92cde2 --- /dev/null +++ b/include/uapi/linux/fgds.h @@ -0,0 +1,124 @@ +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ +/*

• • Fast GPU Direct Storage user-kernel ABI definitions.
• • Copyright (C) 2026 KylinSoft. Co., Ltd. All rights reserved.
• • Synchronous read/write ioctls that move data between a GPU dma-buf and
• • a regular file.
• */

+#ifndef _FGDS_H +#define _FGDS_H

+#include <linux/types.h> +#include <linux/ioctl.h>

+/**

• • struct fgds_register_args - arguments for %FGDS_IOCTL_REGISTER_BUF
• • @dfd: dma-buf file descriptor exported by the GPU runtime.
• • @bdev_fd: file descriptor of the underlying block device (the

• •           device the target files live on), opened with %O_DIRECT.
    

• •           The device is named separately from the file because:
    

• •           building the dma-buf I/O context needs a file for the
    

• •           device itself, and the device side requires %O_DIRECT
    

• •           on that file, which a regular file descriptor cannot
    

• •           provide.
    

• • @handle: Returned handle for use with the other ioctls. Handles

• •           are private to the /dev/fgds file descriptor they were
    

• •           created on and are released automatically when that
    

• •           descriptor is closed.  Output.
    

• • @pad: Must be 0.
• • @max_doffset: Largest accepted value of @doffset plus @length: the

• •           window must stay inside the registered dma-buf and
    

• •           within the 32-bit offset bound of the block-layer
    

• •           dma-buf iterator, so this reports the smaller of the
    

• •           dma-buf size and %UINT_MAX.  Output.
    

• • @reserved: Must be 0. Extension slot for further output fields.
• • A registered handle keeps the device attachment alive, and once a
• • transfer has mapped the buffer that mapping is held for the handle's
• • lifetime.
• • Returns 0, or a negative errno.
• */

+struct fgds_register_args {

• __s32 dfd;
• __s32 bdev_fd;
• __u32 handle;
• __u32 pad;
• __u64 max_doffset;
• __u64 reserved;

+};

+/**

• • struct fgds_unregister_args - arguments for %FGDS_IOCTL_UNREGISTER_BUF
• • @handle: Handle returned by %FGDS_IOCTL_REGISTER_BUF. Input.
• • @reserved: Must be 0.
• • Returns 0, or -EINVAL if @handle is not registered on this file
• • descriptor.
• */

+struct fgds_unregister_args {

• __u32 handle;
• __u32 reserved;

+};

+/**

• • struct fgds_rw_args - arguments for %FGDS_IOCTL_WRITE / %FGDS_IOCTL_READ
• • @handle: Handle from %FGDS_IOCTL_REGISTER_BUF naming both the

• •           dma-buf and the block device to transfer between.  Input.
    

• • @ffd: Regular file descriptor. %O_DIRECT is not required on

• •           it, fgds forces the direct I/O path itself.  Its file
    

• •           system's device must match the one registered with
    

• •           @handle or the transfer fails with %EXDEV.  Input.
    

• • @offset: Byte offset inside the file. Input.
• • @length: Transfer length in bytes. Unlike pread() and pwrite(),

• •           which silently truncate an oversized request, fgds rejects
    

• •           it with %EINVAL. Input.
    

• • @doffset: Byte offset inside the dma-buf, i.e. the start of the

• •           window the transfer reads from or writes to. Input.
    

• • @flags: Must be 0. Input.
• • Like pread() and pwrite(), the ioctl returns the number of bytes
• • transferred or a negative errno. A return value below @length means a
• • read stopped at the end of the file, or a write clamped by the calling
• • process' RLIMIT_FSIZE.
• • Contract and failure modes:
• • • Alignment is enforced on two independent axes, both answered by
• • statx() with %STATX_DIOALIGN. The file side applies to @offset and
• • @length: the device logical block size for a read, the max of that
• • and the file system block size for a write. The buffer side applies
• • to @doffset and @length: the device DMA alignment. A transfer must
• • satisfy both axes at once.
• • • Ranges backed by file holes or unwritten extents are not supported
• • for reads and fail with %EOPNOTSUPP: there is no page cache bounce
• • to serve zeros from, and GPU memory is generally not CPU accessible.
• • • Writes past the end of the file go through the file system's own
• • direct I/O extend path; no preallocation is performed by fgds. An
• • application that wants the space reserved must call fallocate()
• • itself first.
• • • Reads flush and drop any page cache of the transferred range before
• • submitting, so subsequent buffered reads observe the fresh data.
• */

+struct fgds_rw_args {

• __u32 handle;
• __s32 ffd;
• __u64 offset;
• __u64 length;
• __u64 doffset;
• __u64 flags;

+};

+#define FGDS_IOCTL_MAGIC 'x'

+#define FGDS_IOCTL_WRITE _IOW(FGDS_IOCTL_MAGIC, 1, struct fgds_rw_args) +#define FGDS_IOCTL_READ _IOW(FGDS_IOCTL_MAGIC, 2, struct fgds_rw_args) +#define FGDS_IOCTL_REGISTER_BUF _IOWR(FGDS_IOCTL_MAGIC, 3, struct fgds_register_args) +#define FGDS_IOCTL_UNREGISTER_BUF _IOW(FGDS_IOCTL_MAGIC, 4, struct fgds_unregister_args)

+#endif /* _FGDS_H */ diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 9b46f9ada8f9..b19bf7f5e4cf 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -790,6 +790,7 @@ void iov_iter_dmabuf_map(struct iov_iter *i, unsigned int direction, .iov_offset = off, }; } +EXPORT_SYMBOL_GPL(iov_iter_dmabuf_map); /**

• iov_iter_discard - Initialise an I/O iterator that discards data

diff --git a/mm/filemap.c b/mm/filemap.c index 6afec636881f..ab8a5391a699 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -3013,6 +3013,14 @@ generic_file_read_iter(struct kiocb *iocb, struct iov_iter *iter) return retval; }

• /*

• * Buffered I/O read is not supported for dmabuf; a short direct
  

• * read before this point stands on its own, as in
  

• * direct_write_fallback().
  

• */
  

• if (iov_iter_is_dmabuf_map(iter))

• return retval > 0 ? retval : -EOPNOTSUPP;
  

• return filemap_read(iocb, iter, retval);

} EXPORT_SYMBOL(generic_file_read_iter); @@ -4300,8 +4308,14 @@ generic_file_direct_write(struct kiocb *iocb, struct iov_iter *from) */ written = kiocb_invalidate_pages(iocb, write_len); if (written) {

• if (written == -EBUSY)
  

• if (written == -EBUSY) {
  

• 	/*
  

• 	 * Avoid fallback to buffered write for dmabuf.
  

• 	 */
  

• 	if (iov_iter_is_dmabuf_map(from))
  

• 		return -EAGAIN;
  return 0;
  

• }
  

  return written; }

@@ -4353,6 +4367,12 @@ ssize_t generic_perform_write(struct kiocb *iocb, struct iov_iter *i) long status = 0; ssize_t written = 0;

• /*

• * Buffered write is not supported for dmabuf.
  

• */
  

• if (iov_iter_is_dmabuf_map(i))

• return -EOPNOTSUPP;
  

• do { struct folio *folio; size_t offset; /* Offset into folio */