From 0d3120db2cbe0a8793650e19f0923968a406ca2e Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 14 Oct 2026 12:01:59 +0100 Subject: [PATCH 01/20] dma-buf: introduce initial file I/O infrastructure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The goal is to be able to natively use dma-buf in the read-write / IO path. This patch adds basic building blocks serving as a glue and API between drivers and upper layer subsystems providing the uAPI. Later patches implement it for NVMe raw block devices and expose it to the user space via io_uring. There are two main objects. struct dma_buf_io_ctx and struct dma_buf_io_map. The ctx is used during initial registration and serves as an interface between the upper layer user like io_uring and to the importer subsystem / driver. The map represents the actual dma map established for the target device[s] with dma_buf_map_attachment() and stored in a device specific format. The context is created via a new file operation ->init_dma_buf_io_ctx. The ctx-map separation exists to facilitate map invalidation (see dma_buf_io_invalidate_mappings()). A ctx can create multiple maps during its lifetime, but there can only be no more than one (active) map attached to it. Invalidation drops the active map if present, and any new I/O request will try to create a new one. The primary task of dma_buf_io_map is to count requests using it and wait for their completion when we want to destroy the DMA map. [un]mapping and any work with dma addresses is delegated to the importer driver via an ops table stored in the ctx, see struct dma_buf_io_ops. Only the target driver / subsystem knows about devices it wants to use the dma-buf with, especially in case of multi-device filesystems or stacking in the future. Acked-by: Matthew Brost Tested-by: Matthew Brost Acked-by: Christian König Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/49e24334953262e85d5616c9afde88c680e4f3a3.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- drivers/dma-buf/Makefile | 2 +- drivers/dma-buf/dma-buf-io.c | 229 +++++++++++++++++++++++++++++++++++ include/linux/dma-buf-io.h | 125 +++++++++++++++++++ include/linux/fs.h | 2 + 4 files changed, 357 insertions(+), 1 deletion(-) create mode 100644 drivers/dma-buf/dma-buf-io.c create mode 100644 include/linux/dma-buf-io.h diff --git a/drivers/dma-buf/Makefile b/drivers/dma-buf/Makefile index b25d7550bacf..523731b0f83e 100644 --- a/drivers/dma-buf/Makefile +++ b/drivers/dma-buf/Makefile @@ -1,6 +1,6 @@ # SPDX-License-Identifier: GPL-2.0-only obj-y := dma-buf.o dma-fence.o dma-fence-array.o dma-fence-chain.o \ - dma-fence-unwrap.o dma-resv.o dma-buf-mapping.o + dma-fence-unwrap.o dma-resv.o dma-buf-mapping.o dma-buf-io.o obj-$(CONFIG_DMABUF_HEAPS) += dma-heap.o obj-$(CONFIG_DMABUF_HEAPS) += heaps/ obj-$(CONFIG_SYNC_FILE) += sync_file.o diff --git a/drivers/dma-buf/dma-buf-io.c b/drivers/dma-buf/dma-buf-io.c new file mode 100644 index 000000000000..21296bd3dde1 --- /dev/null +++ b/drivers/dma-buf/dma-buf-io.c @@ -0,0 +1,229 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Common infrastructure for supporing dma-buf in the I/O path. + * + * Copyright (C) 2026 Pavel Begunkov + */ +#include +#include + +static void dma_buf_io_map_release(struct dma_buf_io_map *map) +{ + struct dma_buf_io_ctx *ctx = map->ctx; + + dma_resv_assert_held(ctx->dmabuf->resv); + + percpu_ref_exit(&map->refs); + ctx->dev_ops->unmap(ctx, map); +} + +static void dma_buf_io_map_refs_cb(struct percpu_ref *ref) +{ + struct dma_buf_io_map *map = container_of(ref, struct dma_buf_io_map, refs); + + complete(&map->drained); +} + +static void dma_buf_io_kill_map(struct dma_buf_io_ctx *ctx) +{ + struct dma_buf_io_map *map; + + dma_resv_assert_held(ctx->dmabuf->resv); + + map = rcu_dereference_protected(ctx->map, + dma_resv_held(ctx->dmabuf->resv)); + if (!map) + return; + + rcu_assign_pointer(ctx->map, NULL); + percpu_ref_kill(&map->refs); + /* make sure the map is not visible via ctx->map */ + synchronize_rcu_expedited(); + wait_for_completion(&map->drained); + dma_buf_io_map_release(map); +} + +int dma_buf_io_init_map(struct dma_buf_io_ctx *ctx, struct dma_buf_io_map *map, + struct sg_table *sgt) +{ + unsigned seg_shift = ~0U; + struct scatterlist *sg; + unsigned long tmp; + int ret; + + for_each_sgtable_dma_sg(sgt, sg, tmp) + seg_shift = min(seg_shift, __ffs(sg_dma_len(sg))); + + ret = percpu_ref_init(&map->refs, dma_buf_io_map_refs_cb, 0, GFP_KERNEL); + if (ret) + return ret; + init_completion(&map->drained); + map->min_seg_shift = seg_shift; + map->ctx = ctx; + return 0; +} +EXPORT_SYMBOL_NS_GPL(dma_buf_io_init_map, "DMA_BUF"); + +static struct dma_buf_io_map *__dma_buf_io_create_map(struct dma_buf_io_ctx *ctx) +{ + struct dma_buf *dmabuf = ctx->dmabuf; + struct dma_buf_io_map *map; + long ret; + + dma_resv_assert_held(dmabuf->resv); + + if (ctx->is_dead) + return ERR_PTR(-ENOENT); + + map = __dma_buf_io_get_map(ctx); + if (map) + return map; + + map = ctx->dev_ops->map(ctx); + if (IS_ERR(map)) + return map; + + if (WARN_ON_ONCE(!map->min_seg_shift)) + return ERR_PTR(-EFAULT); + + ret = dma_resv_wait_timeout(dmabuf->resv, DMA_RESV_USAGE_KERNEL, + true, MAX_SCHEDULE_TIMEOUT); + if (ret <= 0) { + if (!ret) + ret = -EAGAIN; + dma_buf_io_map_release(map); + return ERR_PTR(ret); + } + + /* get a reference for the caller */ + percpu_ref_get(&map->refs); + rcu_assign_pointer(ctx->map, map); + return map; +} + +/** + * dma_buf_io_create_map - Create a new or reference an existing map. + * @ctx: [in] dma-buf I/O context + * + * A slow path part of dma_buf_io_get_map() and shouldn't be used directly. + * Behaves in the same way but allowed to block. + * + * Returns a map on success, or ERR_PTR encoded errno otherwise. + */ +struct dma_buf_io_map *dma_buf_io_create_map(struct dma_buf_io_ctx *ctx) +{ + struct dma_buf_io_map *map; + int ret; + + ret = dma_resv_lock_interruptible(ctx->dmabuf->resv, NULL); + if (ret) + return ERR_PTR(ret); + + map = __dma_buf_io_create_map(ctx); + dma_resv_unlock(ctx->dmabuf->resv); + return map; +} + +static void dma_buf_io_ctx_shutdown(struct dma_buf_io_ctx *ctx) +{ + dma_resv_lock(ctx->dmabuf->resv, NULL); + ctx->is_dead = true; + dma_buf_io_kill_map(ctx); + dma_resv_unlock(ctx->dmabuf->resv); +} + +/* + * dma_buf_io_ctx_create - create a new dma-buf I/O context for the given file. + * @file: [in] file for which the context is created + * @dmabuf: [in] buffer to create a context from + * @dir: [in] direction of DMA transfers + * @out_ctx [out] resulting ctx + * + * Create a new I/O context from the given DMA buffer for the given file. + * It only works with files implementing ->init_dma_buf_io_ctx and fails + * with -EOPNOTSUPP otherwise. Once created, the user can create a map + * and use it to issue I/O like read / write requests to @file. + */ +int dma_buf_io_ctx_create(struct file *file, + struct dma_buf *dmabuf, + enum dma_data_direction dir, + struct dma_buf_io_ctx **out_ctx) +{ + struct dma_buf_io_ctx *ctx; + int ret; + + if (!file->f_op->init_dma_buf_io_ctx) + return -EOPNOTSUPP; + + ctx = kzalloc_obj(*ctx); + if (!ctx) + return -ENOMEM; + ctx->dir = dir; + ctx->dmabuf = dmabuf; + get_dma_buf(dmabuf); + + ret = file->f_op->init_dma_buf_io_ctx(file, ctx); + if (ret) { + kfree(ctx); + dma_buf_put(dmabuf); + return ret; + } + + if (WARN_ON_ONCE(!ctx->dev_ops || + !ctx->dev_ops->map || + !ctx->dev_ops->unmap || + !ctx->dev_ops->release)) + return -EINVAL; + + *out_ctx = ctx; + return 0; +} + +/** + * dma_buf_io_ctx_release - destroy the I/O context + * @ctx: [in] dma-buf I/O context + * + * Destroy the context. It makes sure all maps are waited on and destroyed, + * and can block for I/O to complete. It detaches from the importer and + * destroys all its resources via the ->release callback, and frees the + * context. + */ +void dma_buf_io_ctx_release(struct dma_buf_io_ctx *ctx) +{ + dma_buf_io_ctx_shutdown(ctx); + + if (WARN_ON_ONCE(rcu_dereference_protected(ctx->map, true))) + return; + + ctx->dev_ops->release(ctx); + dma_buf_put(ctx->dmabuf); + kfree(ctx); +} + +/** + * dma_buf_io_invalidate_mappings - invalidate the current map + * @ctx: [in] dma-buf I/O context + * + * Importer's helper for invalidating the current map. Waits for all I/O + * using the map to complete and destroyes the map. Called with the + * dma-buf reservation lock held. + */ +void dma_buf_io_invalidate_mappings(struct dma_buf_io_ctx *ctx) +{ + dma_buf_io_kill_map(ctx); +} +EXPORT_SYMBOL_NS_GPL(dma_buf_io_invalidate_mappings, "DMA_BUF"); + +/** + * dma_buf_io_detach - detach the @ctx from the importer. + * @ctx: [in] dma-buf I/O context + * + * Importer's helper for removing the I/O ctx. It kills all maps and + * prevents creation of new ones. Upon return it's safe for the importer + * to release all its resources such as dma-buf attachments. + */ +void dma_buf_io_detach(struct dma_buf_io_ctx *ctx) +{ + dma_buf_io_ctx_shutdown(ctx); +} +EXPORT_SYMBOL_NS_GPL(dma_buf_io_detach, "DMA_BUF"); diff --git a/include/linux/dma-buf-io.h b/include/linux/dma-buf-io.h new file mode 100644 index 000000000000..b9bbeca1744f --- /dev/null +++ b/include/linux/dma-buf-io.h @@ -0,0 +1,125 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __DMA_BUF_IO_H__ +#define __DMA_BUF_IO_H__ + +#include + +struct dma_buf_io_ctx; +struct dma_buf_io_map; + +struct dma_buf_io_ops { + /* + * Create a new map for the given ctx. Called with the reservation + * lock held. + */ + struct dma_buf_io_map *(*map)(struct dma_buf_io_ctx *ctx); + + /* + * Clean up device specific parts of the @map. Called with the + * reservation lock held. + */ + void (*unmap)(struct dma_buf_io_ctx *ctx, struct dma_buf_io_map *map); + + /* + * The user tries to destroy the ctx. Release all device specific + * parts of the token. + */ + void (*release)(struct dma_buf_io_ctx *); +}; + +struct dma_buf_io_map { + /* + * Counts attached requests and other users. Device specific unmapping + * is deferred until all refs are dropped. + */ + struct percpu_ref refs; + /* + * Shift for the minimum segment size of the mapping. + */ + unsigned min_seg_shift; + + struct dma_buf_io_ctx *ctx; + struct completion drained; +}; + +struct dma_buf_io_ctx { + struct dma_buf_io_map __rcu *map; + struct dma_buf *dmabuf; + enum dma_data_direction dir; + bool is_dead; + + void *dev_priv; + const struct dma_buf_io_ops *dev_ops; +}; + +int dma_buf_io_ctx_create(struct file *file, + struct dma_buf *dmabuf, + enum dma_data_direction dir, + struct dma_buf_io_ctx **ctx); +void dma_buf_io_ctx_release(struct dma_buf_io_ctx *ctx); + +struct dma_buf_io_map *dma_buf_io_create_map(struct dma_buf_io_ctx *ctx); + +static inline struct dma_buf_io_map * +__dma_buf_io_get_map(struct dma_buf_io_ctx *ctx) +{ + struct dma_buf_io_map *map; + + guard(rcu)(); + + map = rcu_dereference(ctx->map); + if (unlikely(!map || !percpu_ref_tryget_live_rcu(&map->refs))) + return NULL; + + return map; +} + +/** + * dma_buf_io_get_map - Create a new or reference an existing map. + * @ctx: [in] dma-buf I/O context + * @nowait: [in] specifies whether it's allowed to block + * + * Create a new or acquire an existing map. When succeeds, it returns + * a referenced map, which should eventually be put down with + * dma_buf_io_map_drop(). If @nowait is set and the function would block, + * it return -EAGAIN, and the caller is expected to retry from a context + * where blocking is allowed. + * + * Returns a map on success, or ERR_PTR encoded errno otherwise. + */ +static inline struct dma_buf_io_map * +dma_buf_io_get_map(struct dma_buf_io_ctx *ctx, bool nowait) +{ + struct dma_buf_io_map *map; + + map = __dma_buf_io_get_map(ctx); + if (likely(map)) + return map; + + if (nowait) + return ERR_PTR(-EAGAIN); + return dma_buf_io_create_map(ctx); +} + +/** + * dma_buf_io_map_drop - Drop the map. + * @map: [in] dma-buf I/O map + * + * Put down a reference for the @map acquired via dma_buf_io_get_map(). + * Should be called as soon as I/O is completed. + */ +static inline void dma_buf_io_map_drop(struct dma_buf_io_map *map) +{ + percpu_ref_put(&map->refs); +} + +/* + * Device API + */ + +void dma_buf_io_invalidate_mappings(struct dma_buf_io_ctx *ctx); +int dma_buf_io_init_map(struct dma_buf_io_ctx *ctx, struct dma_buf_io_map *map, + struct sg_table *sgt); +void dma_buf_io_detach(struct dma_buf_io_ctx *ctx); + +#endif diff --git a/include/linux/fs.h b/include/linux/fs.h index f9d1e05e8ae6..05c1ff495732 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -1914,6 +1914,7 @@ struct dir_context { #define COPY_FILE_SPLICE (1 << 0) struct io_uring_cmd; +struct dma_buf_io_ctx; struct offset_ctx; struct file_operations { @@ -1960,6 +1961,7 @@ struct file_operations { int (*uring_cmd_iopoll)(struct io_uring_cmd *, struct io_comp_batch *, unsigned int poll_flags); int (*mmap_prepare)(struct vm_area_desc *); + int (*init_dma_buf_io_ctx)(struct file *, struct dma_buf_io_ctx *); } __randomize_layout; /* Supports async buffered reads */ From aeb3bb52052b3548b3acf0cc5606dbb5babb228b Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 14 Oct 2026 12:02:00 +0100 Subject: [PATCH 02/20] iov_iter: add iterator type for dmabuf maps Introduce a new iterator type for dmabuf maps. The map in an opaque object with internals and format specific to the subsystem / driver, and only it can use that subsystem / driver for issuing IO. The task of the middle layers is to pass the map / iterator further down, maybe doing basic splitting and length checking. The iterator can only be used by operations of the file the associated map was created for. Suggested-by: Keith Busch Reviewed-by: Christoph Hellwig Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/6aedb1c606f20ae5bd7fa358829966384c6e738f.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- include/linux/iov_iter.h | 2 ++ include/linux/uio.h | 11 +++++++++++ lib/iov_iter.c | 29 +++++++++++++++++++++++------ 3 files changed, 36 insertions(+), 6 deletions(-) diff --git a/include/linux/iov_iter.h b/include/linux/iov_iter.h index f9a17fbbd398..2f91884d733b 100644 --- a/include/linux/iov_iter.h +++ b/include/linux/iov_iter.h @@ -310,6 +310,8 @@ size_t iterate_and_advance2(struct iov_iter *iter, size_t len, void *priv, return iterate_folioq(iter, len, priv, priv2, step); if (iov_iter_is_xarray(iter)) return iterate_xarray(iter, len, priv, priv2, step); + if (WARN_ON_ONCE(iov_iter_is_dmabuf_map(iter))) + return 0; return iterate_discard(iter, len, priv, priv2, step); } diff --git a/include/linux/uio.h b/include/linux/uio.h index fe2e985d74d2..638c1116e912 100644 --- a/include/linux/uio.h +++ b/include/linux/uio.h @@ -12,6 +12,7 @@ struct page; struct folio_queue; +struct dma_buf_io_map; typedef unsigned int __bitwise iov_iter_extraction_t; @@ -29,6 +30,7 @@ enum iter_type { ITER_FOLIOQ, ITER_XARRAY, ITER_DISCARD, + ITER_DMABUF_MAP, }; #define ITER_SOURCE 1 // == WRITE @@ -71,6 +73,7 @@ struct iov_iter { const struct folio_queue *folioq; struct xarray *xarray; void __user *ubuf; + struct dma_buf_io_map *dmabuf_map; }; size_t count; }; @@ -155,6 +158,11 @@ static inline bool iov_iter_is_xarray(const struct iov_iter *i) return iov_iter_type(i) == ITER_XARRAY; } +static inline bool iov_iter_is_dmabuf_map(const struct iov_iter *i) +{ + return iov_iter_type(i) == ITER_DMABUF_MAP; +} + static inline unsigned char iov_iter_rw(const struct iov_iter *i) { return i->data_source ? WRITE : READ; @@ -300,6 +308,9 @@ void iov_iter_folio_queue(struct iov_iter *i, unsigned int direction, unsigned int first_slot, unsigned int offset, size_t count); void iov_iter_xarray(struct iov_iter *i, unsigned int direction, struct xarray *xarray, loff_t start, size_t count); +void iov_iter_dmabuf_map(struct iov_iter *i, unsigned int direction, + struct dma_buf_io_map *map, + loff_t off, size_t count); ssize_t iov_iter_get_pages2(struct iov_iter *i, struct page **pages, size_t maxsize, unsigned maxpages, size_t *start); ssize_t iov_iter_get_pages_alloc2(struct iov_iter *i, struct page ***pages, diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 6665372ecf71..9b46f9ada8f9 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -575,7 +575,8 @@ void iov_iter_advance(struct iov_iter *i, size_t size) { if (unlikely(i->count < size)) size = i->count; - if (likely(iter_is_ubuf(i)) || unlikely(iov_iter_is_xarray(i))) { + if (likely(iter_is_ubuf(i)) || unlikely(iov_iter_is_xarray(i)) || + unlikely(iov_iter_is_dmabuf_map(i))) { i->iov_offset += size; i->count -= size; } else if (likely(iter_is_iovec(i) || iov_iter_is_kvec(i))) { @@ -631,7 +632,8 @@ void iov_iter_revert(struct iov_iter *i, size_t unroll) return; } unroll -= i->iov_offset; - if (iov_iter_is_xarray(i) || iter_is_ubuf(i)) { + if (iov_iter_is_xarray(i) || iter_is_ubuf(i) || + iov_iter_is_dmabuf_map(i)) { BUG(); /* We should never go beyond the start of the specified * range since we might then be straying into pages that * aren't pinned. @@ -775,6 +777,20 @@ void iov_iter_xarray(struct iov_iter *i, unsigned int direction, } EXPORT_SYMBOL(iov_iter_xarray); +void iov_iter_dmabuf_map(struct iov_iter *i, unsigned int direction, + struct dma_buf_io_map *map, + loff_t off, size_t count) +{ + WARN_ON(direction & ~(READ | WRITE)); + *i = (struct iov_iter){ + .iter_type = ITER_DMABUF_MAP, + .data_source = direction, + .dmabuf_map = map, + .count = count, + .iov_offset = off, + }; +} + /** * iov_iter_discard - Initialise an I/O iterator that discards data * @i: The iterator to initialise. @@ -856,7 +872,7 @@ unsigned long iov_iter_alignment(const struct iov_iter *i) return iov_iter_alignment_bvec(i); /* With both xarray and folioq types, we're dealing with whole folios. */ - if (iov_iter_is_folioq(i)) + if (iov_iter_is_folioq(i) || iov_iter_is_dmabuf_map(i)) return i->iov_offset | i->count; if (iov_iter_is_xarray(i)) return (i->xarray_start + i->iov_offset) | i->count; @@ -872,7 +888,7 @@ unsigned long iov_iter_gap_alignment(const struct iov_iter *i) size_t size = i->count; unsigned k; - if (iter_is_ubuf(i)) + if (iter_is_ubuf(i) || iov_iter_is_dmabuf_map(i)) return 0; if (WARN_ON(!iter_is_iovec(i))) @@ -1469,11 +1485,12 @@ EXPORT_SYMBOL_GPL(import_ubuf); void iov_iter_restore(struct iov_iter *i, struct iov_iter_state *state) { if (WARN_ON_ONCE(!iov_iter_is_bvec(i) && !iter_is_iovec(i) && - !iter_is_ubuf(i)) && !iov_iter_is_kvec(i)) + !iter_is_ubuf(i) && !iov_iter_is_kvec(i) && + !iov_iter_is_dmabuf_map(i))) return; i->iov_offset = state->iov_offset; i->count = state->count; - if (iter_is_ubuf(i)) + if (iter_is_ubuf(i) || iov_iter_is_dmabuf_map(i)) return; /* * For the *vec iters, nr_segs + iov is constant - if we increment From 801503b9a66f7c2423b5e495d8e77e0f4447e5d4 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 14 Oct 2026 12:02:01 +0100 Subject: [PATCH 03/20] block: always adjust bi_offset on bio_advance_iter Extend bio_no_advance_iter() iteration to also increment the offset. It's not currently needed because the currently listed request types don't have a buffer, but will be useful once we add bios backed by dma-buf, which don't have a bvec but work with a single range. Suggested-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/8e5a67c2f84b6df99ff57a7b3bf7b289999e0468.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- drivers/md/dm-io-rewind.c | 6 ++++-- include/linux/bio.h | 12 ++++++++---- 2 files changed, 12 insertions(+), 6 deletions(-) diff --git a/drivers/md/dm-io-rewind.c b/drivers/md/dm-io-rewind.c index 04f3fc8aeb6f..b22719c6411c 100644 --- a/drivers/md/dm-io-rewind.c +++ b/drivers/md/dm-io-rewind.c @@ -113,10 +113,12 @@ static inline void dm_bio_rewind_iter(const struct bio *bio, iter->bi_sector -= bytes >> 9; /* No advance means no rewind */ - if (bio_no_advance_iter(bio)) + if (bio_no_advance_iter(bio)) { iter->bi_size += bytes; - else + iter->bi_offset -= bytes; + } else { dm_bvec_iter_rewind(bio->bi_io_vec, iter, bytes); + } } /** diff --git a/include/linux/bio.h b/include/linux/bio.h index bb3235497e67..0d27e0c72905 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -113,11 +113,13 @@ static inline void bio_advance_iter(const struct bio *bio, { iter->bi_sector += bytes >> 9; - if (bio_no_advance_iter(bio)) + if (bio_no_advance_iter(bio)) { iter->bi_size -= bytes; - else + iter->bi_offset += bytes; + } else { bvec_iter_advance(bio->bi_io_vec, iter, bytes); /* TODO: It is reasonable to complete bio with error here. */ + } } /* @bytes should be less or equal to bvec[i->bi_idx].bv_len */ @@ -127,10 +129,12 @@ static inline void bio_advance_iter_single(const struct bio *bio, { iter->bi_sector += bytes >> 9; - if (bio_no_advance_iter(bio)) + if (bio_no_advance_iter(bio)) { iter->bi_size -= bytes; - else + iter->bi_offset += bytes; + } else { bvec_iter_advance_single(bio->bi_io_vec, iter, bytes); + } } void __bio_advance(struct bio *, unsigned bytes); From d88e44f43e939e6ac0ca8302c6f3c957b33aa5fe Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 14 Oct 2026 12:02:02 +0100 Subject: [PATCH 04/20] block: introduce dma map backed bio type Premapped buffers don't require a generic bio_vec since these have already been dma mapped. Repurpose the bi_io_vec space to store dmabuf maps as they are mutually exclusive. The bio splitting differs from the normal path because it's already pre-mapped and for the block layer it's just an offset into the dma-buf. The actual segmentation is only available to the importer driver and not the block layer, however, it doesn't contain alignment gaps and we don't have to check it. For the same reason we can't precisely split by the number of segments, but we use ->min_seg_shift stored in the map to calculate the minimum number of bytes a request consisting of lim->max_segments full segments can cover and split by that. It's stricter and can add extra splitting. E.g. for a {4K, 4G} segmentation, the min segment size is 4K, and we'll split it into bios of (4K * lim->max_segments) bytes each, but it should be good enough for now to cover the most popular use cases. Suggested-by: Keith Busch Signed-off-by: Pavel Begunkov Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/39b964cf7510f42755188563da63d3d5acaf2aa9.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- block/bio.c | 15 +++++++++-- block/blk-merge.c | 52 +++++++++++++++++++++++++++++++++++++++ block/blk-mq.c | 6 +++++ block/fops.c | 2 +- include/linux/bio.h | 9 ++++--- include/linux/blk-mq.h | 7 ++++++ include/linux/blk_types.h | 14 ++++++++++- include/linux/bvec.h | 3 ++- 8 files changed, 99 insertions(+), 9 deletions(-) diff --git a/block/bio.c b/block/bio.c index f95b63c0604a..795b88e4a994 100644 --- a/block/bio.c +++ b/block/bio.c @@ -861,7 +861,11 @@ static int __bio_clone(struct bio *bio, struct bio *bio_src, gfp_t gfp) bio->bi_write_stream = bio_src->bi_write_stream; bio->bi_bvec_gap_bit = bio_src->bi_bvec_gap_bit; bio->bi_iter = bio_src->bi_iter; - bio->bi_io_vec = bio_src->bi_io_vec; + + if (op_is_dmabuf(bio->bi_opf)) + bio->bi_dmabuf_map = bio_src->bi_dmabuf_map; + else + bio->bi_io_vec = bio_src->bi_io_vec; if (bio->bi_bdev) { if (bio->bi_bdev == bio_src->bi_bdev && @@ -1184,16 +1188,23 @@ EXPORT_SYMBOL_GPL(__bio_release_pages); bool bio_iov_iter_set(struct bio *bio, const struct iov_iter *iter) { - if (!iov_iter_is_bvec(iter)) + if (!iov_iter_is_bvec(iter) && !iov_iter_is_dmabuf_map(iter)) return false; WARN_ON_ONCE(bio->bi_max_vecs); + static_assert(offsetof(struct bio, bi_io_vec) == + offsetof(struct bio, bi_dmabuf_map)); + static_assert(offsetof(struct iov_iter, bvec) == + offsetof(struct iov_iter, dmabuf_map)); + bio->bi_io_vec = (struct bio_vec *)iter->bvec; bio->bi_iter.bi_idx = 0; bio->bi_iter.bi_offset = iter->iov_offset; bio->bi_iter.bi_size = iov_iter_count(iter); bio_set_flag(bio, BIO_CLONED); + if (iov_iter_is_dmabuf_map(iter)) + bio->bi_opf |= REQ_NOMERGE | REQ_DMABUF; return true; } diff --git a/block/blk-merge.c b/block/blk-merge.c index 258a726071d1..501ddc01c449 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -9,6 +9,7 @@ #include #include #include +#include #include @@ -319,6 +320,41 @@ static inline unsigned int bvec_seg_gap(struct bio_vec *bvprv, return bv->bv_offset | (bvprv->bv_offset + bvprv->bv_len); } +static inline int bio_split_io_at_dmabuf(struct bio *bio, + const struct queue_limits *lim, unsigned *segs, + unsigned max_bytes, unsigned len_align_mask, + unsigned start_align_mask) +{ + unsigned bytes = min(bio->bi_iter.bi_size, max_bytes); + unsigned seg_shift = bio->bi_dmabuf_map->min_seg_shift; + unsigned offset = bio->bi_iter.bi_offset & ((1U << seg_shift) - 1); + u64 max_segs_bytes; + + /* + * dma-buf maps don't expose the underlying segmentation, but they're + * guaranteed to not have alignment gaps, we only need to check the + * start and length alignment. + */ + if ((bio->bi_iter.bi_offset & start_align_mask) || + (bio->bi_iter.bi_size & len_align_mask)) + return -EINVAL; + + /* Presented as a single contiguous range into the dma-buf */ + *segs = 1; + + /* + * Limit by the number of segments by using the minimal segment size. + * Any I/O consisting of N full segments should be able to cover at + * least N multiplied by the segment size. It's stricter than walking + * the segments and might cause extra splitting. + */ + max_segs_bytes = (u64)lim->max_segments << seg_shift; + bytes = min_t(u64, bytes, max_segs_bytes - offset); + if (bytes != bio->bi_iter.bi_size) + return bytes; + return 0; +} + /** * bio_split_io_at - check if and where to split a bio * @bio: [in] bio to be split @@ -346,6 +382,19 @@ int bio_split_io_at(struct bio *bio, const struct queue_limits *lim, len_align_mask |= (bc->bc_key->crypto_cfg.data_unit_size - 1); } + if (op_is_dmabuf(bio->bi_opf)) { + int ret; + + ret = bio_split_io_at_dmabuf(bio, lim, &nsegs, max_bytes, + len_align_mask, start_align_mask); + if (ret < 0) + return ret; + if (!ret) + goto out; + bytes = ret; + goto split; + } + bio_for_each_bvec(bv, bio, iter) { if (bv.bv_offset & start_align_mask || bv.bv_len & len_align_mask) @@ -376,6 +425,7 @@ int bio_split_io_at(struct bio *bio, const struct queue_limits *lim, bvprvp = &bvprv; } +out: *segs = nsegs; bio->bi_bvec_gap_bit = ffs(gaps); return 0; @@ -493,6 +543,8 @@ unsigned int blk_recalc_rq_segments(struct request *rq) if (!rq->bio) return 0; + if (op_is_dmabuf(rq->bio->bi_opf)) + return 1; switch (bio_op(rq->bio)) { case REQ_OP_DISCARD: diff --git a/block/blk-mq.c b/block/blk-mq.c index a26a11c73ee3..be5671966787 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -3138,6 +3138,12 @@ void blk_mq_submit_bio(struct bio *bio) goto queue_exit; } + if (unlikely(op_is_dmabuf(bio->bi_opf) && + bdev_has_integrity_csum(bio->bi_bdev))) { + bio_endio_status(bio, BLK_STS_NOTSUPP); + goto queue_exit; + } + if ((bio->bi_opf & REQ_POLLED) && !blk_mq_can_poll(q)) { bio_endio_status(bio, BLK_STS_NOTSUPP); goto queue_exit; diff --git a/block/fops.c b/block/fops.c index 2ce7c6c4714e..eb4f588bb4f7 100644 --- a/block/fops.c +++ b/block/fops.c @@ -346,7 +346,7 @@ static ssize_t __blkdev_direct_IO_async(struct kiocb *iocb, * Users don't rely on the iterator being in any particular * state for async I/O returning -EIOCBQUEUED, hence we can * avoid expensive iov_iter_advance(). Bypass - * bio_iov_iter_get_pages() and set the bvec directly. + * bio_iov_iter_get_pages() and set the bvec/dmabuf directly. */ if (!bio_iov_iter_set(bio, iter)) { ret = blkdev_iov_iter_get_pages(bio, iter, bdev); diff --git a/include/linux/bio.h b/include/linux/bio.h index 0d27e0c72905..22ce9deb2feb 100644 --- a/include/linux/bio.h +++ b/include/linux/bio.h @@ -80,7 +80,8 @@ static inline bool bio_no_advance_iter(const struct bio *bio) { return bio_op(bio) == REQ_OP_DISCARD || bio_op(bio) == REQ_OP_SECURE_ERASE || - bio_op(bio) == REQ_OP_WRITE_ZEROES; + bio_op(bio) == REQ_OP_WRITE_ZEROES || + op_is_dmabuf(bio->bi_opf); } static inline void *bio_data(struct bio *bio) @@ -438,12 +439,12 @@ static inline void bio_wouldblock_error(struct bio *bio) /* * Calculate number of bvec segments that should be allocated to fit data - * pointed by @iter. If @iter is backed by bvec it's going to be reused - * instead of allocating a new one. + * pointed by @iter. If @iter is backed by a bvec or a dmabuf, the bvec array / + * the dma map are going to be reused, and so no extra allocation is required. */ static inline int bio_iov_vecs_to_alloc(struct iov_iter *iter, int max_segs) { - if (iov_iter_is_bvec(iter)) + if (iov_iter_is_bvec(iter) || iov_iter_is_dmabuf_map(iter)) return 0; return iov_iter_npages(iter, max_segs); } diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index af878597afb8..7c7504c84e09 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -1017,6 +1017,13 @@ static inline void *blk_mq_rq_to_pdu(struct request *rq) return rq + 1; } +static inline bool blk_mq_rq_is_dmabuf(struct request *rq) +{ + if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER)) + return false; + return rq->bio && op_is_dmabuf(rq->bio->bi_opf); +} + static inline struct blk_mq_hw_ctx *queue_hctx(struct request_queue *q, int id) { struct blk_mq_hw_ctx *hctx; diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index 98e21b4cbf32..0cc09b975d8f 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -233,7 +233,12 @@ struct bio { atomic_t __bi_remaining; /* The actual vec list, preserved by bio_reset() */ - struct bio_vec *bi_io_vec; + union { + struct bio_vec *bi_io_vec; + /* Driver specific dma map, valid IFF REQ_DMABUF is set */ + struct dma_buf_io_map *bi_dmabuf_map; + }; + struct bvec_iter bi_iter; union { @@ -402,6 +407,7 @@ enum req_flag_bits { __REQ_DRV, /* for driver use */ __REQ_FS_PRIVATE, /* for file system (submitter) use */ __REQ_ATOMIC, /* for atomic write operations */ + __REQ_DMABUF, /* Using premmaped dma buffers */ /* * Command specific flags, keep last: */ @@ -434,6 +440,7 @@ enum req_flag_bits { #define REQ_DRV (__force blk_opf_t)(1ULL << __REQ_DRV) #define REQ_FS_PRIVATE (__force blk_opf_t)(1ULL << __REQ_FS_PRIVATE) #define REQ_ATOMIC (__force blk_opf_t)(1ULL << __REQ_ATOMIC) +#define REQ_DMABUF (__force blk_opf_t)(1ULL << __REQ_DMABUF) #define REQ_NOUNMAP (__force blk_opf_t)(1ULL << __REQ_NOUNMAP) @@ -487,6 +494,11 @@ static inline bool op_is_discard(blk_opf_t op) return (op & REQ_OP_MASK) == REQ_OP_DISCARD; } +static inline bool op_is_dmabuf(blk_opf_t op) +{ + return op & REQ_DMABUF; +} + /* * Check if a bio or request operation is a zone management operation. */ diff --git a/include/linux/bvec.h b/include/linux/bvec.h index fc566ee1c1ff..b63914ff56e3 100644 --- a/include/linux/bvec.h +++ b/include/linux/bvec.h @@ -108,7 +108,8 @@ struct bvec_iter { unsigned int bi_idx; /* - * Current offset in the bvec entry pointed to by `bi_idx`. + * Current offset in the bvec entry pointed to by `bi_idx` or into + * a dma-buf map. */ unsigned int bi_offset; } __packed __aligned(4); From 839231d193932ca0d592c2859669066f7c43731c Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 14 Oct 2026 12:02:03 +0100 Subject: [PATCH 05/20] block: add dma-buf support for raw bdev Add a simple proxy implementation of init_dma_buf_io_ctx() forwarding the call to a new struct block_device_operations operation. Also reject dma-buf backed iterators for buffered IO. Reviewed-by: Christoph Hellwig [pavel: reject dma-buf without O_DIRECT] Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/c01c4709dc55a12fb0f2fe1ec847b5f1f0c92789.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- block/fops.c | 24 ++++++++++++++++++++++++ include/linux/blkdev.h | 2 ++ 2 files changed, 26 insertions(+) diff --git a/block/fops.c b/block/fops.c index eb4f588bb4f7..49ae0302f123 100644 --- a/block/fops.c +++ b/block/fops.c @@ -709,6 +709,9 @@ blkdev_direct_write(struct kiocb *iocb, struct iov_iter *from) static ssize_t blkdev_buffered_write(struct kiocb *iocb, struct iov_iter *from) { + if (unlikely(iov_iter_is_dmabuf_map(from))) + return -EOPNOTSUPP; + return iomap_file_buffered_write(iocb, from, &blkdev_iomap_ops, NULL, NULL); } @@ -823,6 +826,11 @@ static ssize_t blkdev_read_iter(struct kiocb *iocb, struct iov_iter *to) if (ret < 0 || !count) goto reexpand; } + if (unlikely(iov_iter_is_dmabuf_map(to))) { + if (!ret) + ret = -EOPNOTSUPP; + goto reexpand; + } /* * Take i_rwsem and invalidate_lock to avoid racing with set_blocksize @@ -926,6 +934,21 @@ static int blkdev_mmap_prepare(struct vm_area_desc *desc) return generic_file_mmap_prepare(desc); } +static int blkdev_init_dma_buf_io_ctx(struct file *file, + struct dma_buf_io_ctx *ctx) +{ + struct block_device *bdev = file_bdev(file); + struct gendisk *disk = bdev->bd_disk; + + if (!(file->f_flags & O_DIRECT)) + return -EINVAL; + if (!disk->fops->init_dma_buf_io_ctx) + return -EOPNOTSUPP; + if (bdev_has_integrity_csum(bdev)) + return -EOPNOTSUPP; + return disk->fops->init_dma_buf_io_ctx(bdev, ctx); +} + const struct file_operations def_blk_fops = { .open = blkdev_open, .release = blkdev_release, @@ -944,6 +967,7 @@ const struct file_operations def_blk_fops = { .fallocate = blkdev_fallocate, .uring_cmd = blkdev_uring_cmd, .fop_flags = FOP_BUFFER_RASYNC | FOP_DONTCACHE, + .init_dma_buf_io_ctx = blkdev_init_dma_buf_io_ctx, }; static __init int blkdev_init(void) diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 4f7905c3412b..2d555a992e75 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -1596,6 +1596,8 @@ struct block_device_operations { /* returns the length of the identifier or a negative errno: */ int (*get_unique_id)(struct gendisk *disk, u8 id[16], enum blk_unique_id id_type); + int (*init_dma_buf_io_ctx)(struct block_device *, + struct dma_buf_io_ctx *); struct module *owner; const struct pr_ops *pr_ops; From a03648e2efda070322cd4066abf4dff15be093c4 Mon Sep 17 00:00:00 2001 From: Anuj Gupta Date: Wed, 14 Oct 2026 12:02:04 +0100 Subject: [PATCH 06/20] nvme-pci: rename nvme_pci_sgl_set_data to nvme_pci_dma_iter_set_sgl Rename the blk_dma_iter based nvme_pci_sgl_set_data() to nvme_pci_dma_iter_set_sgl(). Suggested-by: Christoph Hellwig Reviewed-by: Christoph Hellwig Signed-off-by: Anuj Gupta Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/42788b01948b58b891476006cb7ee9f9f5e917db.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- drivers/nvme/host/pci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 5440cf18b55b..296124534866 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -1147,7 +1147,7 @@ static blk_status_t nvme_pci_setup_data_prp(struct request *req, return BLK_STS_IOERR; } -static void nvme_pci_sgl_set_data(struct nvme_sgl_desc *sge, +static void nvme_pci_dma_iter_set_sgl(struct nvme_sgl_desc *sge, struct blk_dma_iter *iter) { sge->addr = cpu_to_le64(iter->addr); @@ -1177,7 +1177,7 @@ static blk_status_t nvme_pci_setup_data_sgl(struct request *req, iod->cmd.common.flags = NVME_CMD_SGL_METABUF; if (entries == 1 || blk_rq_dma_map_coalesce(&iod->dma_state)) { - nvme_pci_sgl_set_data(&iod->cmd.common.dptr.sgl, iter); + nvme_pci_dma_iter_set_sgl(&iod->cmd.common.dptr.sgl, iter); iod->total_len += iter->len; return BLK_STS_OK; } @@ -1199,7 +1199,7 @@ static blk_status_t nvme_pci_setup_data_sgl(struct request *req, iter->status = BLK_STS_IOERR; break; } - nvme_pci_sgl_set_data(&sg_list[mapped++], iter); + nvme_pci_dma_iter_set_sgl(&sg_list[mapped++], iter); iod->total_len += iter->len; } while (blk_rq_dma_map_iter_next(req, nvmeq->dev->dev, iter)); @@ -1359,13 +1359,13 @@ static blk_status_t nvme_pci_setup_meta_iter(struct request *req) iod->cmd.common.metadata = cpu_to_le64(sgl_dma); if (entries == 1) { iod->meta_total_len = iter.len; - nvme_pci_sgl_set_data(sg_list, &iter); + nvme_pci_dma_iter_set_sgl(sg_list, &iter); return BLK_STS_OK; } sgl_dma += sizeof(*sg_list); do { - nvme_pci_sgl_set_data(&sg_list[++i], &iter); + nvme_pci_dma_iter_set_sgl(&sg_list[++i], &iter); iod->meta_total_len += iter.len; } while (blk_rq_integrity_dma_map_iter_next(req, dev->dev, &iter)); From ce5e386c110815e3a29e3ba27d97575c28589c39 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 14 Oct 2026 12:02:05 +0100 Subject: [PATCH 07/20] nvme-pci: implement dma-buf backed requests Enable BIO_DMABUF_MAP backed requests. On registration we map the dma-buf and store it as a prp list, which is then used to initialise requests. All attached contexts are stored in a new list dmabuf_ctxs, and additions/removals are synchronised with dmabuf_lock. Suggested-by: Keith Busch Signed-off-by: Pavel Begunkov Reviewed-by: Christoph Hellwig Link: https://patch.msgid.link/9540e74b5d2dd1a5dc0d436bc0c2a6f5e18fc389.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- drivers/nvme/host/Makefile | 1 + drivers/nvme/host/core.c | 12 +++ drivers/nvme/host/nvme.h | 2 + drivers/nvme/host/pci-dmabuf.c | 169 +++++++++++++++++++++++++++++++++ drivers/nvme/host/pci-dmabuf.h | 75 +++++++++++++++ drivers/nvme/host/pci.c | 93 ++++++++++++++++++ 6 files changed, 352 insertions(+) create mode 100644 drivers/nvme/host/pci-dmabuf.c create mode 100644 drivers/nvme/host/pci-dmabuf.h diff --git a/drivers/nvme/host/Makefile b/drivers/nvme/host/Makefile index 67563a69f7dc..8288b986d713 100644 --- a/drivers/nvme/host/Makefile +++ b/drivers/nvme/host/Makefile @@ -21,6 +21,7 @@ nvme-core-$(CONFIG_NVME_HWMON) += hwmon.o nvme-core-$(CONFIG_NVME_HOST_AUTH) += auth.o nvme-y += pci.o +nvme-$(CONFIG_DMA_SHARED_BUFFER) += pci-dmabuf.o nvme-fabrics-y += fabrics.o diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index beea23d04a70..d81462e864a4 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -2699,6 +2699,17 @@ static int nvme_report_zones(struct gendisk *disk, sector_t sector, #define nvme_report_zones NULL #endif /* CONFIG_BLK_DEV_ZONED */ +static int nvme_init_dma_buf_io_ctx(struct block_device *bdev, + struct dma_buf_io_ctx *ctx) +{ + struct nvme_ns *ns = bdev->bd_disk->private_data; + struct nvme_ctrl *ctrl = ns->ctrl; + + if (!ctrl->ops->init_dma_buf_io_ctx) + return -EINVAL; + return ctrl->ops->init_dma_buf_io_ctx(ctrl, ctx); +} + const struct block_device_operations nvme_bdev_ops = { .owner = THIS_MODULE, .ioctl = nvme_ioctl, @@ -2709,6 +2720,7 @@ const struct block_device_operations nvme_bdev_ops = { .get_unique_id = nvme_get_unique_id, .report_zones = nvme_report_zones, .pr_ops = &nvme_pr_ops, + .init_dma_buf_io_ctx = nvme_init_dma_buf_io_ctx, }; static int nvme_wait_ready(struct nvme_ctrl *ctrl, u32 mask, u32 val, diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h index 2cff9fcbf740..befb7faba9ca 100644 --- a/drivers/nvme/host/nvme.h +++ b/drivers/nvme/host/nvme.h @@ -667,6 +667,8 @@ struct nvme_ctrl_ops { int (*get_address)(struct nvme_ctrl *ctrl, char *buf, int size); void (*print_device_info)(struct nvme_ctrl *ctrl); bool (*supports_pci_p2pdma)(struct nvme_ctrl *ctrl); + int (*init_dma_buf_io_ctx)(struct nvme_ctrl *ctrl, + struct dma_buf_io_ctx *ctx); unsigned long (*get_virt_boundary)(struct nvme_ctrl *ctrl, bool is_admin); }; diff --git a/drivers/nvme/host/pci-dmabuf.c b/drivers/nvme/host/pci-dmabuf.c new file mode 100644 index 000000000000..161e4ffa6919 --- /dev/null +++ b/drivers/nvme/host/pci-dmabuf.c @@ -0,0 +1,169 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Code for supporting dma-buf I/O maps in the NVMe driver. + * Copyright (C) 2026 Pavel Begunkov + */ + +#include + +#include "pci-dmabuf.h" + +static void nvme_dmabuf_invalidate_mappings(struct dma_buf_attachment *attach) +{ + struct dma_buf_io_ctx *ctx = attach->importer_priv; + + dma_buf_io_invalidate_mappings(ctx); +} + +static const struct dma_buf_attach_ops nvme_dmabuf_importer_ops = { + .invalidate_mappings = nvme_dmabuf_invalidate_mappings, + .allow_peer2peer = true, +}; + +static struct dma_buf_io_map *nvme_dma_buf_io_map(struct dma_buf_io_ctx *ctx) +{ + unsigned nr_entries = ctx->dmabuf->size / NVME_CTRL_PAGE_SIZE; + struct nvme_dma_buf_io_ctx *nvme_ctx = ctx->dev_priv; + struct dma_buf_attachment *attach = nvme_ctx->attach; + unsigned long tmp, i = 0; + struct nvme_dmabuf_map *map; + struct scatterlist *sg; + struct sg_table *sgt; + int ret; + + dma_resv_assert_held(ctx->dmabuf->resv); + + if (ctx->dmabuf->size % NVME_CTRL_PAGE_SIZE) + return ERR_PTR(-EINVAL); + + map = kvmalloc_flex(*map, dma_list, nr_entries); + if (!map) + return ERR_PTR(-ENOMEM); + map->nr_entries = nr_entries; + + sgt = dma_buf_map_attachment(attach, ctx->dir); + if (IS_ERR(sgt)) { + ret = PTR_ERR(sgt); + sgt = NULL; + goto err; + } + + for_each_sgtable_dma_sg(sgt, sg, tmp) { + dma_addr_t dma_addr = sg_dma_address(sg); + unsigned long sg_len = sg_dma_len(sg); + + if ((sg_len % NVME_CTRL_PAGE_SIZE) || + (dma_addr % NVME_CTRL_PAGE_SIZE)) { + ret = -EINVAL; + goto err; + } + while (sg_len) { + map->dma_list[i++] = dma_addr; + dma_addr += NVME_CTRL_PAGE_SIZE; + sg_len -= NVME_CTRL_PAGE_SIZE; + } + } + + ret = dma_buf_io_init_map(ctx, &map->base, sgt); + if (ret) + goto err; + map->sgt = sgt; + return &map->base; +err: + if (sgt) + dma_buf_unmap_attachment(attach, sgt, ctx->dir); + kvfree(map); + return ERR_PTR(ret); +} + +static void nvme_dma_buf_io_unmap(struct dma_buf_io_ctx *ctx, + struct dma_buf_io_map *map_base) +{ + struct nvme_dma_buf_io_ctx *nvme_ctx = ctx->dev_priv; + struct nvme_dmabuf_map *map = to_nvme_dmabuf_map(map_base); + + dma_resv_assert_held(ctx->dmabuf->resv); + + dma_buf_unmap_attachment(nvme_ctx->attach, map->sgt, ctx->dir); + kvfree(map); +} + +static void nvme_dma_buf_io_release(struct dma_buf_io_ctx *base_ctx) +{ + struct nvme_dma_buf_io_ctx *ctx = base_ctx->dev_priv; + struct nvme_dma_buf_list *buf_list = ctx->buf_list; + + mutex_lock(&buf_list->lock); + if (!list_empty(&ctx->list)) { + dma_buf_detach(ctx->base->dmabuf, ctx->attach); + list_del_init(&ctx->list); + } + mutex_unlock(&buf_list->lock); + + nvme_put_ctrl(ctx->ctrl); + kfree(ctx); +} + +void __nvme_pci_remove_dmabuf(struct nvme_dma_buf_list *list) +{ + struct nvme_dma_buf_io_ctx *ctx, *tmp; + + mutex_lock(&list->lock); + list->dead = true; + list_for_each_entry_safe(ctx, tmp, &list->ctxs, list) { + dma_buf_io_detach(ctx->base); + dma_buf_detach(ctx->base->dmabuf, ctx->attach); + list_del_init(&ctx->list); + } + mutex_unlock(&list->lock); +} + +const struct dma_buf_io_ops nvme_dma_buf_io_ops = { + .map = nvme_dma_buf_io_map, + .unmap = nvme_dma_buf_io_unmap, + .release = nvme_dma_buf_io_release, +}; + +static int nvme_init_io_ctx_locked(struct nvme_ctrl *ctrl, + struct nvme_dma_buf_list *buf_list, + struct dma_buf_io_ctx *ctx) +{ + struct nvme_dma_buf_io_ctx *nvme_ctx; + struct dma_buf_attachment *attach; + + if (buf_list->dead) + return -ENODEV; + + nvme_ctx = kzalloc_obj(*nvme_ctx); + if (!nvme_ctx) + return -ENOMEM; + + attach = dma_buf_dynamic_attach(ctx->dmabuf, ctrl->dev, + &nvme_dmabuf_importer_ops, ctx); + if (IS_ERR(attach)) { + kfree(nvme_ctx); + return PTR_ERR(attach); + } + + nvme_get_ctrl(ctrl); + list_add(&nvme_ctx->list, &buf_list->ctxs); + nvme_ctx->attach = attach; + nvme_ctx->base = ctx; + nvme_ctx->ctrl = ctrl; + nvme_ctx->buf_list = buf_list; + ctx->dev_priv = nvme_ctx; + ctx->dev_ops = &nvme_dma_buf_io_ops; + return 0; +} + +int __nvme_init_dma_buf_io_ctx(struct nvme_ctrl *ctrl, + struct nvme_dma_buf_list *buf_list, + struct dma_buf_io_ctx *ctx) +{ + int ret; + + mutex_lock(&buf_list->lock); + ret = nvme_init_io_ctx_locked(ctrl, buf_list, ctx); + mutex_unlock(&buf_list->lock); + return ret; +} diff --git a/drivers/nvme/host/pci-dmabuf.h b/drivers/nvme/host/pci-dmabuf.h new file mode 100644 index 000000000000..b3c9fd485878 --- /dev/null +++ b/drivers/nvme/host/pci-dmabuf.h @@ -0,0 +1,75 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (C) 2026 Pavel Begunkov + */ + +#ifndef _NVME_PCI_DMABUF_H +#define _NVME_PCI_DMABUF_H + +#include + +#include "nvme.h" + +struct nvme_dma_buf_list { + struct list_head ctxs; + struct mutex lock; + bool dead; +}; + +struct nvme_dma_buf_io_ctx { + struct dma_buf_attachment *attach; + struct nvme_dma_buf_list *buf_list; + struct dma_buf_io_ctx *base; + struct nvme_ctrl *ctrl; + struct list_head list; +}; + +struct nvme_dmabuf_map { + struct dma_buf_io_map base; + struct sg_table *sgt; + unsigned nr_entries; + dma_addr_t dma_list[] __counted_by(nr_entries); +}; + +static inline struct nvme_dmabuf_map *to_nvme_dmabuf_map( + struct dma_buf_io_map *map) +{ + return container_of(map, struct nvme_dmabuf_map, base); +} + +static inline struct nvme_dmabuf_map *nvme_req_to_map(struct request *req) +{ + struct dma_buf_io_map *map = req->bio->bi_dmabuf_map; + + return to_nvme_dmabuf_map(map); +} + +void __nvme_pci_remove_dmabuf(struct nvme_dma_buf_list *list); +int __nvme_init_dma_buf_io_ctx(struct nvme_ctrl *ctrl, + struct nvme_dma_buf_list *buf_list, + struct dma_buf_io_ctx *ctx); + +static inline void nvme_pci_remove_dmabuf(struct nvme_dma_buf_list *list) +{ + if (IS_ENABLED(CONFIG_DMA_SHARED_BUFFER)) + __nvme_pci_remove_dmabuf(list); +} + +static inline int nvme_init_dma_buf_io_ctx(struct nvme_ctrl *ctrl, + struct nvme_dma_buf_list *buf_list, + struct dma_buf_io_ctx *ctx) +{ + if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER)) + return -EOPNOTSUPP; + return __nvme_init_dma_buf_io_ctx(ctrl, buf_list, ctx); +} + +static inline void nvme_init_buf_list(struct nvme_dma_buf_list *buf_list) +{ + INIT_LIST_HEAD(&buf_list->ctxs); + mutex_init(&buf_list->lock); + buf_list->dead = false; +} + + +#endif /* _NVME_PCI_DMABUF_H */ \ No newline at end of file diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 296124534866..fc9ba224e0cf 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -30,6 +30,7 @@ #include "trace.h" #include "nvme.h" +#include "pci-dmabuf.h" #define SQ_SIZE(q) ((q)->q_depth << (q)->sqes) #define CQ_SIZE(q) ((q)->q_depth * sizeof(struct nvme_completion)) @@ -318,6 +319,7 @@ struct nvme_dev { bool hmb; struct sg_table *hmb_sgt; mempool_t *dmavec_mempool; + struct nvme_dma_buf_list dmabufs; /* shadow doorbell buffer support: */ __le32 *dbbuf_dbs; @@ -865,6 +867,76 @@ static void nvme_free_descriptors(struct request *req) } } +static blk_status_t nvme_rq_setup_dmabuf_map(struct request *req, + struct nvme_queue *nvmeq) +{ + struct nvme_iod *iod = blk_mq_rq_to_pdu(req); + struct nvme_dmabuf_map *map = nvme_req_to_map(req); + unsigned bvec_done = req->bio->bi_iter.bi_offset; + unsigned map_idx = bvec_done / NVME_CTRL_PAGE_SIZE; + unsigned offset = bvec_done & (NVME_CTRL_PAGE_SIZE - 1); + int length = blk_rq_payload_bytes(req) - (NVME_CTRL_PAGE_SIZE - offset); + dma_addr_t *dma_list = map->dma_list; + u64 prp1_dma = dma_list[map_idx++] + offset; + u64 dma_addr, prp2_dma; + dma_addr_t prp_dma; + __le64 *prp_list; + unsigned i; + + if (length <= 0) { + prp2_dma = 0; + goto done; + } + + if (length <= NVME_CTRL_PAGE_SIZE) { + prp2_dma = dma_list[map_idx]; + goto done; + } + + if (DIV_ROUND_UP(length, NVME_CTRL_PAGE_SIZE) <= + NVME_SMALL_POOL_SIZE / sizeof(__le64)) + iod->flags |= IOD_SMALL_DESCRIPTOR; + + prp_list = dma_pool_alloc(nvme_dma_pool(nvmeq, iod), GFP_ATOMIC, + &prp_dma); + if (!prp_list) + return BLK_STS_RESOURCE; + + iod->descriptors[iod->nr_descriptors++] = prp_list; + prp2_dma = prp_dma; + i = 0; + for (;;) { + if (i == NVME_CTRL_PAGE_SIZE >> 3) { + __le64 *old_prp_list = prp_list; + + prp_list = dma_pool_alloc(nvmeq->descriptor_pools.large, + GFP_ATOMIC, &prp_dma); + if (!prp_list) + goto free_prps; + iod->descriptors[iod->nr_descriptors++] = prp_list; + prp_list[0] = old_prp_list[i - 1]; + old_prp_list[i - 1] = cpu_to_le64(prp_dma); + i = 1; + } + + dma_addr = dma_list[map_idx++]; + prp_list[i++] = cpu_to_le64(dma_addr); + + length -= NVME_CTRL_PAGE_SIZE; + if (length <= 0) + break; + } +done: + iod->cmd.common.dptr.prp1 = cpu_to_le64(prp1_dma); + iod->cmd.common.dptr.prp2 = cpu_to_le64(prp2_dma); + return BLK_STS_OK; +free_prps: + iod->cmd.common.dptr.prp1 = cpu_to_le64(prp1_dma); + iod->cmd.common.dptr.prp2 = cpu_to_le64(prp2_dma); + nvme_free_descriptors(req); + return BLK_STS_RESOURCE; +} + static void nvme_free_prps(struct request *req, unsigned int attrs) { struct nvme_iod *iod = blk_mq_rq_to_pdu(req); @@ -943,6 +1015,9 @@ static void nvme_unmap_data(struct request *req) struct device *dma_dev = nvmeq->dev->dev; unsigned int attrs = 0; + if (blk_mq_rq_is_dmabuf(req)) + goto out_free_desc; + if (iod->flags & IOD_SINGLE_SEGMENT) { static_assert(offsetof(union nvme_data_ptr, prp1) == offsetof(union nvme_data_ptr, sgl.addr)); @@ -967,6 +1042,7 @@ static void nvme_unmap_data(struct request *req) nvme_free_prps(req, attrs); } +out_free_desc: if (iod->nr_descriptors) nvme_free_descriptors(req); } @@ -1257,6 +1333,9 @@ static blk_status_t nvme_map_data(struct request *req) struct blk_dma_iter iter; blk_status_t ret; + if (blk_mq_rq_is_dmabuf(req)) + return nvme_rq_setup_dmabuf_map(req, nvmeq); + /* * Try to skip the DMA iterator for single segment requests, as that * significantly improves performances for small I/O sizes. @@ -3357,6 +3436,9 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown) nvme_unquiesce_admin_queue(&dev->ctrl); } mutex_unlock(&dev->shutdown_lock); + + if (shutdown) + nvme_pci_remove_dmabuf(&dev->dmabufs); } static int nvme_disable_prepare_reset(struct nvme_dev *dev, bool shutdown) @@ -3564,6 +3646,14 @@ static unsigned long nvme_pci_get_virt_boundary(struct nvme_ctrl *ctrl, return 0; } +static int nvme_pci_init_dma_buf_io_ctx(struct nvme_ctrl *ctrl, + struct dma_buf_io_ctx *ctx) +{ + struct nvme_dev *dev = to_nvme_dev(ctrl); + + return nvme_init_dma_buf_io_ctx(ctrl, &dev->dmabufs, ctx); +} + static const struct nvme_ctrl_ops nvme_pci_ctrl_ops = { .name = "pcie", .module = THIS_MODULE, @@ -3579,6 +3669,7 @@ static const struct nvme_ctrl_ops nvme_pci_ctrl_ops = { .print_device_info = nvme_pci_print_device_info, .supports_pci_p2pdma = nvme_pci_supports_pci_p2pdma, .get_virt_boundary = nvme_pci_get_virt_boundary, + .init_dma_buf_io_ctx = nvme_pci_init_dma_buf_io_ctx, }; static int nvme_dev_map(struct nvme_dev *dev) @@ -3701,6 +3792,7 @@ static struct nvme_dev *nvme_pci_alloc_dev(struct pci_dev *pdev, return ERR_PTR(-ENOMEM); INIT_WORK(&dev->ctrl.reset_work, nvme_reset_work); mutex_init(&dev->shutdown_lock); + nvme_init_buf_list(&dev->dmabufs); dev->nr_write_queues = write_queues; dev->nr_poll_queues = poll_queues; @@ -4344,5 +4436,6 @@ MODULE_AUTHOR("Matthew Wilcox "); MODULE_LICENSE("GPL"); MODULE_VERSION("1.0"); MODULE_DESCRIPTION("NVMe host PCIe transport driver"); +MODULE_IMPORT_NS("DMA_BUF"); module_init(nvme_init); module_exit(nvme_exit); From d5c8cfd41d2575c65c3f1d543017949e578a92d3 Mon Sep 17 00:00:00 2001 From: Anuj Gupta Date: Wed, 14 Oct 2026 12:02:06 +0100 Subject: [PATCH 08/20] nvme-pci: add SGL support for the dmabuf path Add SGL support in addition to PRP for dmabuf-backed requests, building the descriptor list from the mapping's sg_table. Reviewed-by: Christoph Hellwig Signed-off-by: Anuj Gupta Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/86fb4caeddaa58fafad106548f82950782ea04fd.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- drivers/nvme/host/pci.c | 150 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 146 insertions(+), 4 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index fc9ba224e0cf..5b66def7b9b6 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -1223,12 +1223,18 @@ static blk_status_t nvme_pci_setup_data_prp(struct request *req, return BLK_STS_IOERR; } +static void nvme_pci_sgl_set_data(struct nvme_sgl_desc *sge, + dma_addr_t addr, u32 len) +{ + sge->addr = cpu_to_le64(addr); + sge->length = cpu_to_le32(len); + sge->type = NVME_SGL_FMT_DATA_DESC << 4; +} + static void nvme_pci_dma_iter_set_sgl(struct nvme_sgl_desc *sge, struct blk_dma_iter *iter) { - sge->addr = cpu_to_le64(iter->addr); - sge->length = cpu_to_le32(iter->len); - sge->type = NVME_SGL_FMT_DATA_DESC << 4; + nvme_pci_sgl_set_data(sge, iter->addr, iter->len); } static void nvme_pci_sgl_set_seg(struct nvme_sgl_desc *sge, @@ -1239,6 +1245,142 @@ static void nvme_pci_sgl_set_seg(struct nvme_sgl_desc *sge, sge->type = NVME_SGL_FMT_LAST_SEG_DESC << 4; } +static unsigned int nvme_pci_dmabuf_sgl_nents(struct request *req) +{ + struct bio *bio = req->bio; + struct nvme_dmabuf_map *map = to_nvme_dmabuf_map(bio->bi_dmabuf_map); + struct scatterlist *sg; + unsigned long tmp; + size_t offset = bio->bi_iter.bi_offset; + size_t remaining = blk_rq_payload_bytes(req); + unsigned int nents = 0; + + for_each_sgtable_dma_sg(map->sgt, sg, tmp) { + size_t sg_len = sg_dma_len(sg); + + if (!remaining) + break; + if (offset >= sg_len) { + offset -= sg_len; + continue; + } + + sg_len -= offset; + offset = 0; + + do { + size_t chunk = min(remaining, sg_len); + + nents++; + sg_len -= chunk; + remaining -= chunk; + } while (sg_len && remaining); + } + + if (unlikely(remaining)) + return 0; + + return nents; +} + +static blk_status_t nvme_rq_setup_dmabuf_sgl(struct request *req, + struct nvme_queue *nvmeq, unsigned int entries) +{ + struct nvme_iod *iod = blk_mq_rq_to_pdu(req); + struct nvme_dmabuf_map *map = nvme_req_to_map(req); + size_t length = blk_rq_payload_bytes(req); + struct nvme_sgl_desc *sg_list = &iod->cmd.common.dptr.sgl; + size_t offset = req->bio->bi_iter.bi_offset; + bool pooled = entries > 1; + dma_addr_t sgl_dma = 0; + unsigned int mapped = 0; + unsigned long tmp; + struct scatterlist *sg; + size_t remaining = length; + + if (!entries) + return BLK_STS_IOERR; + + iod->cmd.common.flags = NVME_CMD_SGL_METABUF; + iod->total_len = length; + + /* entries == 1 fits in the inline descriptor; more needs a pool. */ + if (pooled) { + if (entries <= NVME_SMALL_POOL_SIZE / sizeof(*sg_list)) + iod->flags |= IOD_SMALL_DESCRIPTOR; + + sg_list = dma_pool_alloc(nvme_dma_pool(nvmeq, iod), GFP_ATOMIC, + &sgl_dma); + if (!sg_list) + return BLK_STS_RESOURCE; + iod->descriptors[iod->nr_descriptors++] = sg_list; + } + + for_each_sgtable_dma_sg(map->sgt, sg, tmp) { + size_t sg_len = sg_dma_len(sg); + dma_addr_t addr = sg_dma_address(sg); + + if (!remaining) + break; + if (offset >= sg_len) { + offset -= sg_len; + continue; + } + + addr += offset; + sg_len -= offset; + offset = 0; + + do { + u32 chunk = min_t(size_t, remaining, sg_len); + + if (WARN_ON_ONCE(mapped == entries)) + goto err_free; + nvme_pci_sgl_set_data(&sg_list[mapped++], addr, chunk); + + addr += chunk; + sg_len -= chunk; + remaining -= chunk; + } while (sg_len && remaining); + } + + if (unlikely(remaining)) + goto err_free; + + if (pooled) + nvme_pci_sgl_set_seg(&iod->cmd.common.dptr.sgl, sgl_dma, + mapped); + return BLK_STS_OK; +err_free: + if (pooled) { + iod->nr_descriptors--; + dma_pool_free(nvme_dma_pool(nvmeq, iod), sg_list, sgl_dma); + } + return BLK_STS_IOERR; +} + +static blk_status_t nvme_rq_setup_dmabuf(struct request *req, + struct nvme_queue *nvmeq, enum nvme_use_sgl use_sgl) +{ + unsigned int entries; + size_t avg_seg; + + if (use_sgl == SGL_UNSUPPORTED) + return nvme_rq_setup_dmabuf_map(req, nvmeq); + + entries = nvme_pci_dmabuf_sgl_nents(req); + + if (use_sgl == SGL_FORCED) + return nvme_rq_setup_dmabuf_sgl(req, nvmeq, entries); + + avg_seg = entries ? + DIV_ROUND_UP(blk_rq_payload_bytes(req), entries) : 0; + if (sgl_threshold && avg_seg >= sgl_threshold) + return nvme_rq_setup_dmabuf_sgl(req, nvmeq, entries); + + return nvme_rq_setup_dmabuf_map(req, nvmeq); +} + static blk_status_t nvme_pci_setup_data_sgl(struct request *req, struct blk_dma_iter *iter) { @@ -1334,7 +1476,7 @@ static blk_status_t nvme_map_data(struct request *req) blk_status_t ret; if (blk_mq_rq_is_dmabuf(req)) - return nvme_rq_setup_dmabuf_map(req, nvmeq); + return nvme_rq_setup_dmabuf(req, nvmeq, use_sgl); /* * Try to skip the DMA iterator for single segment requests, as that From 727a66ad21b013555eedfd84559cd4707717463c Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 14 Oct 2026 12:02:07 +0100 Subject: [PATCH 09/20] io_uring/rsrc: introduce buf registration structure In preparation to following changes, instead of passing an iovec for buffer registration introduce a new structure. It'll be moved to uapi later, but for now it's initialised early from a user provided iovec. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/178bbcbc7a0a9cf017284e8b15d5434fb546fcaf.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- io_uring/rsrc.c | 50 ++++++++++++++++++++++++++++++++++--------------- 1 file changed, 35 insertions(+), 15 deletions(-) diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 1efaf29514e8..7234dcdb8372 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -27,8 +27,13 @@ struct io_rsrc_update { u32 offset; }; +struct io_uring_regbuf_desc { + __u64 uaddr; + __u64 size; +}; + static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx, - struct iovec *iov); + struct io_uring_regbuf_desc *desc); static int hpage_acct_ref(struct io_ring_ctx *ctx, struct page *hpage, bool *acct_new) @@ -81,6 +86,15 @@ static bool hpage_acct_unref(struct io_ring_ctx *ctx, struct page *hpage) #define IO_CACHED_BVECS_SEGS 32 +static void io_iov_to_regbuf_desc(const struct iovec *iov, + struct io_uring_regbuf_desc *desc) +{ + *desc = (struct io_uring_regbuf_desc) { + .uaddr = (u64)(uintptr_t)iov->iov_base, + .size = iov->iov_len, + }; +} + int __io_account_mem(struct user_struct *user, unsigned long nr_pages) { unsigned long page_limit, cur_pages, new_pages; @@ -398,6 +412,7 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, return -EINVAL; for (done = 0; done < nr_args; done++) { + struct io_uring_regbuf_desc desc; struct io_rsrc_node *node; u64 tag = 0; @@ -411,7 +426,9 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, err = -EFAULT; break; } - node = io_sqe_buffer_register(ctx, iov); + + io_iov_to_regbuf_desc(iov, &desc); + node = io_sqe_buffer_register(ctx, &desc); if (IS_ERR(node)) { err = PTR_ERR(node); break; @@ -870,26 +887,29 @@ bool io_check_coalesce_buffer(struct page **page_array, int nr_pages, } static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx, - struct iovec *iov) + struct io_uring_regbuf_desc *desc) { + unsigned long uaddr = (unsigned long)desc->uaddr; + size_t size = desc->size; struct io_mapped_ubuf *imu = NULL; struct page **pages = NULL; struct io_rsrc_node *node; unsigned long off; - size_t size; int ret, nr_pages, i; struct io_imu_folio_data data; bool coalesced = false; - if (!iov->iov_base) { - if (iov->iov_len) + if (uaddr != desc->uaddr || size != desc->size) + return ERR_PTR(-EOVERFLOW); + + if (!uaddr) { + if (size) return ERR_PTR(-EFAULT); /* remove the buffer without installing a new one */ return NULL; } - ret = io_validate_user_buf_range((unsigned long)iov->iov_base, - iov->iov_len); + ret = io_validate_user_buf_range(uaddr, size); if (ret) return ERR_PTR(ret); @@ -898,8 +918,7 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx, return ERR_PTR(-ENOMEM); ret = -ENOMEM; - pages = io_pin_pages((unsigned long) iov->iov_base, iov->iov_len, - &nr_pages); + pages = io_pin_pages(uaddr, size, &nr_pages); if (IS_ERR(pages)) { ret = PTR_ERR(pages); pages = NULL; @@ -921,10 +940,9 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx, if (ret) goto done; - size = iov->iov_len; /* store original address for later verification */ - imu->ubuf = (unsigned long) iov->iov_base; - imu->len = iov->iov_len; + imu->ubuf = uaddr; + imu->len = size; imu->folio_shift = PAGE_SHIFT; imu->release = io_release_ubuf; imu->priv = imu; @@ -934,7 +952,7 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx, imu->folio_shift = data.folio_shift; refcount_set(&imu->refs, 1); - off = (unsigned long)iov->iov_base & ~PAGE_MASK; + off = uaddr & ~PAGE_MASK; if (coalesced) off += data.first_folio_page_idx << PAGE_SHIFT; @@ -986,6 +1004,7 @@ int io_sqe_buffers_register(struct io_ring_ctx *ctx, void __user *arg, memset(iov, 0, sizeof(*iov)); for (i = 0; i < nr_args; i++) { + struct io_uring_regbuf_desc desc; struct io_rsrc_node *node; u64 tag = 0; @@ -1009,7 +1028,8 @@ int io_sqe_buffers_register(struct io_ring_ctx *ctx, void __user *arg, } } - node = io_sqe_buffer_register(ctx, iov); + io_iov_to_regbuf_desc(iov, &desc); + node = io_sqe_buffer_register(ctx, &desc); if (IS_ERR(node)) { ret = PTR_ERR(node); break; From a5819c456b716fa8bcb7792b942ab02b15e07fc5 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 14 Oct 2026 12:02:08 +0100 Subject: [PATCH 10/20] io_uring/rsrc: extend buffer update We need to pass more information to buffer registration than we can fit into a single struct iovec. This patch allows users to optionally pass struct io_uring_regbuf_desc. Apart from having more space for future use cases, it also introduces registration types. Currently, the type can be either of IO_REGBUF_TYPE_UADDR, which mirrors the iovec path, or IO_REGBUF_TYPE_EMPTY for leaving a buffer table slot empty. The next patch introduces a dmabuf backed type, and can be useful for other extensions like splicing a list of user addresses (i.e. iovec[]), interoperability with zcrx, kernel allocated memory like was brough up by Cristoph. Note, the type only represents a registration option, which is distinct from how io_uring internally stores it. The flags field is not used yet but always useful to have, e.g. we can encode read-only / write-only restrictions using it. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/0d60f1ebab80ef594a78ea27c2edd5ad33faa640.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- include/uapi/linux/io_uring.h | 27 +++++++++++++- io_uring/rsrc.c | 68 +++++++++++++++++++++-------------- 2 files changed, 68 insertions(+), 27 deletions(-) diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h index b42b66b424a7..abb590833a0f 100644 --- a/include/uapi/linux/io_uring.h +++ b/include/uapi/linux/io_uring.h @@ -791,13 +791,38 @@ struct io_uring_rsrc_update { struct io_uring_rsrc_update2 { __u32 offset; - __u32 resv; + __u32 flags; __aligned_u64 data; __aligned_u64 tags; __u32 nr; __u32 resv2; }; +/* struct io_uring_rsrc_update2::flags */ +enum io_uring_rsrc_reg_flags { + /* + * Use the extended descriptor format for buffer updates, + * see struct io_uring_regbuf_desc + */ + IORING_RSRC_UPDATE_EXTENDED = 1U << 1, +}; + +/* Buffer registration type, passed in struct io_uring_regbuf_desc::type */ +enum io_uring_regbuf_type { + IO_REGBUF_TYPE_EMPTY, + IO_REGBUF_TYPE_UADDR, + + __IO_REGBUF_TYPE_MAX, +}; + +struct io_uring_regbuf_desc { + __u32 type; /* enum io_uring_regbuf_type */ + __u32 flags; + __u64 size; + __u64 uaddr; + __u64 __resv[7]; +}; + /* Skip updating fd indexes set to this value in the fd table */ #define IORING_REGISTER_FILES_SKIP (-2) diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 7234dcdb8372..54774729ee67 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -27,11 +27,6 @@ struct io_rsrc_update { u32 offset; }; -struct io_uring_regbuf_desc { - __u64 uaddr; - __u64 size; -}; - static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx, struct io_uring_regbuf_desc *desc); @@ -90,9 +85,12 @@ static void io_iov_to_regbuf_desc(const struct iovec *iov, struct io_uring_regbuf_desc *desc) { *desc = (struct io_uring_regbuf_desc) { + .type = IO_REGBUF_TYPE_UADDR, .uaddr = (u64)(uintptr_t)iov->iov_base, .size = iov->iov_len, }; + if (!desc->uaddr) + desc->type = IO_REGBUF_TYPE_EMPTY; } int __io_account_mem(struct user_struct *user, unsigned long nr_pages) @@ -340,6 +338,8 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx, return -ENXIO; if (up->offset + nr_args > ctx->file_table.data.nr) return -EINVAL; + if (up->flags) + return -EINVAL; for (done = 0; done < nr_args; done++) { u64 tag = 0; @@ -399,9 +399,8 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, struct io_uring_rsrc_update2 *up, unsigned int nr_args) { + bool extended = up->flags & IORING_RSRC_UPDATE_EXTENDED; u64 __user *tags = u64_to_user_ptr(up->tags); - struct iovec fast_iov, *iov; - struct iovec __user *uvec; u64 user_data = up->data; __u32 done; int i, err; @@ -410,29 +409,49 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, return -ENXIO; if (up->offset + nr_args > ctx->buf_table.nr) return -EINVAL; + if (up->flags & ~IORING_RSRC_UPDATE_EXTENDED) + return -EINVAL; for (done = 0; done < nr_args; done++) { struct io_uring_regbuf_desc desc; struct io_rsrc_node *node; u64 tag = 0; - uvec = u64_to_user_ptr(user_data); - iov = iovec_from_user(uvec, 1, 1, &fast_iov, io_is_compat(ctx)); - if (IS_ERR(iov)) { - err = PTR_ERR(iov); - break; - } if (tags && copy_from_user(&tag, &tags[done], sizeof(tag))) { err = -EFAULT; break; } - io_iov_to_regbuf_desc(iov, &desc); + if (extended) { + if (copy_from_user(&desc, u64_to_user_ptr(user_data), + sizeof(desc))) { + err = -EFAULT; + break; + } + user_data += sizeof(desc); + } else { + struct iovec __user *uvec = u64_to_user_ptr(user_data); + struct iovec fast_iov, *iov; + + if (io_is_compat(ctx)) + user_data += sizeof(struct compat_iovec); + else + user_data += sizeof(struct iovec); + + iov = iovec_from_user(uvec, 1, 1, &fast_iov, io_is_compat(ctx)); + if (IS_ERR(iov)) { + err = PTR_ERR(iov); + break; + } + io_iov_to_regbuf_desc(iov, &desc); + } + node = io_sqe_buffer_register(ctx, &desc); if (IS_ERR(node)) { err = PTR_ERR(node); break; } + if (tag) { if (!node) { err = -EINVAL; @@ -443,10 +462,6 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, i = array_index_nospec(up->offset + done, ctx->buf_table.nr); io_reset_rsrc_node(ctx, &ctx->buf_table, i); ctx->buf_table.nodes[i] = node; - if (io_is_compat(ctx)) - user_data += sizeof(struct compat_iovec); - else - user_data += sizeof(struct iovec); } return done ? done : err; } @@ -481,7 +496,7 @@ int io_register_files_update(struct io_ring_ctx *ctx, void __user *arg, memset(&up, 0, sizeof(up)); if (copy_from_user(&up, arg, sizeof(struct io_uring_rsrc_update))) return -EFAULT; - if (up.resv || up.resv2) + if (up.resv2) return -EINVAL; return __io_register_rsrc_update(ctx, IORING_RSRC_FILE, &up, nr_args); } @@ -495,7 +510,7 @@ int io_register_rsrc_update(struct io_ring_ctx *ctx, void __user *arg, return -EINVAL; if (copy_from_user(&up, arg, sizeof(up))) return -EFAULT; - if (!up.nr || up.resv || up.resv2) + if (!up.nr || up.resv2) return -EINVAL; return __io_register_rsrc_update(ctx, type, &up, up.nr); } @@ -595,12 +610,9 @@ int io_files_update(struct io_kiocb *req, unsigned int issue_flags) struct io_uring_rsrc_update2 up2; int ret; + memset(&up2, 0, sizeof(up2)); up2.offset = up->offset; up2.data = up->arg; - up2.nr = 0; - up2.tags = 0; - up2.resv = 0; - up2.resv2 = 0; if (up->offset == IORING_FILE_INDEX_ALLOC) { ret = io_files_update_with_index_alloc(req, issue_flags); @@ -901,9 +913,13 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx, if (uaddr != desc->uaddr || size != desc->size) return ERR_PTR(-EOVERFLOW); + if (desc->type >= __IO_REGBUF_TYPE_MAX) + return ERR_PTR(-EINVAL); + if (!mem_is_zero(&desc->__resv, sizeof(desc->__resv)) || desc->flags) + return ERR_PTR(-EINVAL); - if (!uaddr) { - if (size) + if (desc->type == IO_REGBUF_TYPE_EMPTY) { + if (uaddr || size) return ERR_PTR(-EFAULT); /* remove the buffer without installing a new one */ return NULL; From 13b1690bb4767d3f1c847baf71a704c5f2da99e2 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 14 Oct 2026 12:02:09 +0100 Subject: [PATCH 11/20] io_uring/rsrc: add uncloneable regbuf flag It's hard to implement cloning if the internal structure needs to be mutable and/or relies on other ring resources. In preparation to such buffer types, add a flag indicating that the buffer can't be cloned. It might be possible to add cloning in the future for them, but that would likely need reallocating the structure and reacquiring resources in case by case manner. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/c73c459578981e64a352e46c0db39ad46621c63a.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- io_uring/rsrc.c | 5 +++++ io_uring/rsrc.h | 3 ++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 54774729ee67..532866a1e9b9 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1458,6 +1458,11 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx if (!src_node) { dst_node = NULL; } else { + if (src_node->buf->flags & IO_REGBUF_F_UNCLONEABLE) { + io_rsrc_data_free(ctx, &data); + return -EOPNOTSUPP; + } + dst_node = io_rsrc_node_alloc(ctx, IORING_RSRC_BUFFER); if (!dst_node) { io_rsrc_data_free(ctx, &data); diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h index 9ef88383b363..73d7b1ebf0b6 100644 --- a/io_uring/rsrc.h +++ b/io_uring/rsrc.h @@ -26,7 +26,8 @@ struct io_rsrc_node { }; enum { - IO_REGBUF_F_KBUF = 1, + IO_REGBUF_F_KBUF = 1 << 0, + IO_REGBUF_F_UNCLONEABLE = 1 << 1, }; struct io_mapped_ubuf { From d218f3e381908da0e68429f3a4b764e666564c60 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 14 Oct 2026 12:02:10 +0100 Subject: [PATCH 12/20] io_uring/rsrc: add regbuf import flags We'll have special registered buffer types that can't be used with all opcodes and need special handling. Add separate flags to control registered buffer import, which will be used to specify what kind of buffers the caller can handle. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/eb798e045bc245ebb7b0b42ba09a34b92f8b216f.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- io_uring/rsrc.c | 8 ++++---- io_uring/rsrc.h | 24 ++++++++++++++++++++---- 2 files changed, 24 insertions(+), 8 deletions(-) diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 532866a1e9b9..f42d201738cd 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1317,9 +1317,9 @@ inline struct io_rsrc_node *io_find_buf_node(struct io_kiocb *req, return NULL; } -int io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter, +int __io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter, u64 buf_addr, size_t len, int ddir, - unsigned issue_flags) + unsigned issue_flags, unsigned import_flags) { struct io_rsrc_node *node; @@ -1733,9 +1733,9 @@ static int io_kern_bvec_size(struct iovec *iov, unsigned nr_iovs, return 0; } -int io_import_reg_vec(int ddir, struct iov_iter *iter, +int __io_import_reg_vec(int ddir, struct iov_iter *iter, struct io_kiocb *req, struct iou_vec *vec, - unsigned nr_iovs, unsigned issue_flags) + unsigned nr_iovs, unsigned issue_flags, unsigned import_flags) { struct io_rsrc_node *node; struct io_mapped_ubuf *imu; diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h index 73d7b1ebf0b6..351995b61e68 100644 --- a/io_uring/rsrc.h +++ b/io_uring/rsrc.h @@ -62,12 +62,28 @@ int io_rsrc_data_alloc(struct io_rsrc_data *data, unsigned nr); struct io_rsrc_node *io_find_buf_node(struct io_kiocb *req, unsigned issue_flags); -int io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter, +int __io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter, u64 buf_addr, size_t len, int ddir, - unsigned issue_flags); -int io_import_reg_vec(int ddir, struct iov_iter *iter, + unsigned issue_flags, unsigned import_flags); +int __io_import_reg_vec(int ddir, struct iov_iter *iter, struct io_kiocb *req, struct iou_vec *vec, - unsigned nr_iovs, unsigned issue_flags); + unsigned nr_iovs, unsigned issue_flags, + unsigned import_flags); + +static inline int io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter, + u64 buf_addr, size_t len, int ddir, + unsigned issue_flags) +{ + return __io_import_reg_buf(req, iter, buf_addr, len, ddir, issue_flags, 0); +} + +static inline int io_import_reg_vec(int ddir, struct iov_iter *iter, + struct io_kiocb *req, struct iou_vec *vec, + unsigned nr_iovs, unsigned issue_flags) +{ + return __io_import_reg_vec(ddir, iter, req, vec, nr_iovs, issue_flags, 0); +} + int io_prep_reg_iovec(struct io_kiocb *req, struct iou_vec *iv, const struct iovec __user *uvec, size_t uvec_segs); From 62e4bf5b25d4458cf8aa9dece9022359f39f2294 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Wed, 14 Oct 2026 12:02:11 +0100 Subject: [PATCH 13/20] io_uring/rsrc: add dmabuf backed registered buffers Implement dmabuf backed registered buffers. To register them, the user should specify IO_REGBUF_TYPE_DMABUF for the regitration and pass the desired dmabuf fd and a file for which it should be registered. >From there, it can be used with io_uring read/write requests IORING_OP_{READ,WRITE}_FIXED) as normal. The requests should be issued against the file specified during registration, and otherwise they'll be failed. The user should also be prepared to handle spurious -EAGAIN by reissuing the request. Internally, dmabuf registered buffers is an optin feature for io_uring request opcodes and they should pass a special flag on import to use it. Suggested-by: David Wei Suggested-by: Vishal Verma Suggested-by: Tushar Gohad Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/4aa230df871ee275536f367087b44ebfebb88cc1.1791975048.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- include/linux/io_uring_types.h | 5 +++ include/uapi/linux/io_uring.h | 6 ++- io_uring/Makefile | 1 + io_uring/dma-buf.c | 66 +++++++++++++++++++++++++++++ io_uring/dma-buf.h | 76 ++++++++++++++++++++++++++++++++++ io_uring/rsrc.c | 59 ++++++++++++++++++++++++-- io_uring/rsrc.h | 5 +++ io_uring/rw.c | 33 +++++++++++---- 8 files changed, 237 insertions(+), 14 deletions(-) create mode 100644 io_uring/dma-buf.c create mode 100644 io_uring/dma-buf.h diff --git a/include/linux/io_uring_types.h b/include/linux/io_uring_types.h index 90fea94ad202..73cd11d173df 100644 --- a/include/linux/io_uring_types.h +++ b/include/linux/io_uring_types.h @@ -11,6 +11,7 @@ struct iou_loop_params; struct io_uring_bpf_ops; +struct dma_buf_io_map; enum { /* @@ -610,6 +611,7 @@ enum { REQ_F_IMPORT_BUFFER_BIT, REQ_F_SQE_COPIED_BIT, REQ_F_IOPOLL_BIT, + REQ_F_DMABUF_BIT, /* not a real bit, just to check we're not overflowing the space */ __REQ_F_LAST_BIT, @@ -705,6 +707,8 @@ enum { REQ_F_SQE_COPIED = IO_REQ_FLAG(REQ_F_SQE_COPIED_BIT), /* request must be iopolled to completion (set in ->issue()) */ REQ_F_IOPOLL = IO_REQ_FLAG(REQ_F_IOPOLL_BIT), + /* there is a dma map attached to request that needs to be dropped */ + REQ_F_DMABUF = IO_REQ_FLAG(REQ_F_DMABUF_BIT), }; struct io_tw_req { @@ -827,6 +831,7 @@ struct io_kiocb { /* custom credentials, valid IFF REQ_F_CREDS is set */ const struct cred *creds; struct io_wq_work work; + struct dma_buf_io_map *dmabuf_map; struct io_big_cqe { u64 extra1; diff --git a/include/uapi/linux/io_uring.h b/include/uapi/linux/io_uring.h index abb590833a0f..b456f45fa8de 100644 --- a/include/uapi/linux/io_uring.h +++ b/include/uapi/linux/io_uring.h @@ -811,6 +811,7 @@ enum io_uring_rsrc_reg_flags { enum io_uring_regbuf_type { IO_REGBUF_TYPE_EMPTY, IO_REGBUF_TYPE_UADDR, + IO_REGBUF_TYPE_DMABUF, __IO_REGBUF_TYPE_MAX, }; @@ -820,7 +821,10 @@ struct io_uring_regbuf_desc { __u32 flags; __u64 size; __u64 uaddr; - __u64 __resv[7]; + + __s32 dmabuf_fd; + __s32 target_fd; + __u64 __resv[6]; }; /* Skip updating fd indexes set to this value in the fd table */ diff --git a/io_uring/Makefile b/io_uring/Makefile index c54e328d1410..965bb60e9f7b 100644 --- a/io_uring/Makefile +++ b/io_uring/Makefile @@ -26,3 +26,4 @@ obj-$(CONFIG_PROC_FS) += fdinfo.o obj-$(CONFIG_IO_URING_MOCK_FILE) += mock_file.o obj-$(CONFIG_IO_URING_BPF) += bpf_filter.o obj-$(CONFIG_IO_URING_BPF_OPS) += bpf-ops.o +obj-$(CONFIG_DMA_SHARED_BUFFER) += dma-buf.o diff --git a/io_uring/dma-buf.c b/io_uring/dma-buf.c new file mode 100644 index 000000000000..1a1a88640823 --- /dev/null +++ b/io_uring/dma-buf.c @@ -0,0 +1,66 @@ +#include "dma-buf.h" + +static inline void io_release_dmabuf(void *priv) +{ + struct io_buf_dma *bd = priv; + + fput(bd->target_file); + dma_buf_io_ctx_release(bd->ctx); + kfree(bd); +} + +int __io_register_dmabuf(struct io_ring_ctx *ctx, + struct io_uring_regbuf_desc *desc, + struct io_mapped_ubuf *imu) +{ + struct io_buf_dma *bd = NULL; + struct file *target_file = NULL; + struct dma_buf *dmabuf = NULL; + int ret; + + if (ctx->flags & IORING_SETUP_IOPOLL) + return -EOPNOTSUPP; + if (desc->uaddr || desc->size) + return -EINVAL; + + bd = kzalloc(sizeof(*bd), GFP_KERNEL); + if (!bd) + return -ENOMEM; + + target_file = fget(desc->target_fd); + if (!target_file) { + ret = -EBADF; + goto err; + } + dmabuf = dma_buf_get(desc->dmabuf_fd); + if (IS_ERR(dmabuf)) { + ret = PTR_ERR(dmabuf); + dmabuf = NULL; + goto err; + } + ret = io_validate_user_buf_range(0, dmabuf->size); + if (ret) + goto err; + + ret = dma_buf_io_ctx_create(target_file, dmabuf, DMA_BIDIRECTIONAL, + &bd->ctx); + if (ret) + goto err; + + bd->target_file = target_file; + imu->len = dmabuf->size; + imu->release = io_release_dmabuf; + imu->priv = bd; + imu->flags = IO_REGBUF_F_DMABUF | IO_REGBUF_F_UNCLONEABLE; + imu->dir = IO_BUF_DEST | IO_BUF_SOURCE; + dma_buf_put(dmabuf); + return 0; +err: + kfree(bd); + if (target_file) + fput(target_file); + if (dmabuf) + dma_buf_put(dmabuf); + return ret; +} + diff --git a/io_uring/dma-buf.h b/io_uring/dma-buf.h new file mode 100644 index 000000000000..a876a9e5e272 --- /dev/null +++ b/io_uring/dma-buf.h @@ -0,0 +1,76 @@ +// SPDX-License-Identifier: GPL-2.0 +#ifndef IOU_DMA_BUF_H +#define IOU_DMA_BUF_H + +#include +#include + +#include "rsrc.h" + +struct io_buf_dma { + struct dma_buf_io_ctx *ctx; + struct file *target_file; +}; + +int __io_register_dmabuf(struct io_ring_ctx *ctx, + struct io_uring_regbuf_desc *desc, + struct io_mapped_ubuf *imu); + +static inline void io_detach_dmabuf_map(struct io_kiocb *req) +{ + if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER)) + return; + if (!(req->flags & REQ_F_DMABUF) || !req->dmabuf_map) + return; + dma_buf_io_map_drop(req->dmabuf_map); + req->dmabuf_map = NULL; +} + +static inline int io_attach_dmabuf_map(struct io_kiocb *req, + struct iov_iter *iter, + unsigned issue_flags) +{ + bool nowait = issue_flags & IO_URING_F_NONBLOCK; + struct dma_buf_io_map *map; + struct io_buf_dma *bd; + + if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER)) + return -EOPNOTSUPP; + if (!(req->flags & REQ_F_DMABUF)) + return 0; + + bd = req->buf_node->buf->priv; + map = dma_buf_io_get_map(bd->ctx, nowait); + if (unlikely(IS_ERR(map))) + return PTR_ERR(map); + req->dmabuf_map = map; + iter->dmabuf_map = map; + return 0; +} + +static inline int io_import_dmabuf_map(struct io_kiocb *req, + int ddir, struct iov_iter *iter, + struct io_mapped_ubuf *imu, + size_t len, size_t offset) +{ + struct io_buf_dma *bd = imu->priv; + + if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER)) + return -EOPNOTSUPP; + if (req->file != bd->target_file) + return -EBADF; + req->flags |= REQ_F_DMABUF; + iov_iter_dmabuf_map(iter, ddir, NULL, offset, len); + return 0; +} + +static inline int io_register_dmabuf(struct io_ring_ctx *ctx, + struct io_uring_regbuf_desc *desc, + struct io_mapped_ubuf *imu) +{ + if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER)) + return -EOPNOTSUPP; + return __io_register_dmabuf(ctx, desc, imu); +} + +#endif /* IOU_DMA_BUF_H */ diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index f42d201738cd..2e89e091afbb 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -10,6 +10,7 @@ #include #include #include +#include #include @@ -19,6 +20,7 @@ #include "rsrc.h" #include "memmap.h" #include "register.h" +#include "dma-buf.h" struct io_rsrc_update { struct file *file; @@ -898,6 +900,38 @@ bool io_check_coalesce_buffer(struct page **page_array, int nr_pages, return true; } +static struct io_rsrc_node *io_register_dmabuf_desc(struct io_ring_ctx *ctx, + struct io_uring_regbuf_desc *desc) +{ + struct io_rsrc_node *node = NULL; + struct io_mapped_ubuf *imu = NULL; + int ret; + + node = io_rsrc_node_alloc(ctx, IORING_RSRC_BUFFER); + if (!node) + return ERR_PTR(-ENOMEM); + + imu = io_alloc_imu(ctx, 0); + if (!imu) { + ret = -ENOMEM; + goto err; + } + memset(imu, 0, sizeof(*imu)); + refcount_set(&imu->refs, 1); + + ret = io_register_dmabuf(ctx, desc, imu); + if (ret) + goto err; + node->buf = imu; + return node; +err: + if (imu) + io_free_imu(ctx, imu); + if (node) + io_cache_free(&ctx->node_cache, node); + return ERR_PTR(ret); +} + static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx, struct io_uring_regbuf_desc *desc) { @@ -918,6 +952,12 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx, if (!mem_is_zero(&desc->__resv, sizeof(desc->__resv)) || desc->flags) return ERR_PTR(-EINVAL); + if (desc->type == IO_REGBUF_TYPE_DMABUF) + return io_register_dmabuf_desc(ctx, desc); + + if (desc->dmabuf_fd || desc->target_fd) + return ERR_PTR(-EINVAL); + if (desc->type == IO_REGBUF_TYPE_EMPTY) { if (uaddr || size) return ERR_PTR(-EFAULT); @@ -1242,9 +1282,12 @@ static int io_import_kbuf(int ddir, struct iov_iter *iter, return 0; } -static int io_import_fixed(int ddir, struct iov_iter *iter, +static int io_import_fixed(struct io_kiocb *req, + int ddir, struct iov_iter *iter, struct io_mapped_ubuf *imu, - u64 buf_addr, size_t len) + u64 buf_addr, size_t len, + unsigned issue_flags, + unsigned import_flags) { const struct bio_vec *bvec; size_t folio_mask; @@ -1264,6 +1307,11 @@ static int io_import_fixed(int ddir, struct iov_iter *iter, offset = buf_addr - imu->ubuf; + if (imu->flags & IO_REGBUF_F_DMABUF) { + if (!(import_flags & IO_REGBUF_IMPORT_ALLOW_DMABUF)) + return -EFAULT; + return io_import_dmabuf_map(req, ddir, iter, imu, len, offset); + } if (imu->flags & IO_REGBUF_F_KBUF) return io_import_kbuf(ddir, iter, imu, len, offset); @@ -1326,7 +1374,8 @@ int __io_import_reg_buf(struct io_kiocb *req, struct iov_iter *iter, node = io_find_buf_node(req, issue_flags); if (!node) return -EFAULT; - return io_import_fixed(ddir, iter, node->buf, buf_addr, len); + return io_import_fixed(req, ddir, iter, node->buf, buf_addr, len, + issue_flags, import_flags); } static int io_buffer_acct_cloned_hpages(struct io_ring_ctx *ctx, @@ -1753,7 +1802,9 @@ int __io_import_reg_vec(int ddir, struct iov_iter *iter, iovec_off = vec->nr - nr_iovs; iov = vec->iovec + iovec_off; - if (imu->flags & IO_REGBUF_F_KBUF) { + if (imu->flags & IO_REGBUF_F_DMABUF) { + return -EOPNOTSUPP; + } else if (imu->flags & IO_REGBUF_F_KBUF) { int ret = io_kern_bvec_size(iov, nr_iovs, imu, &nr_segs); if (unlikely(ret)) diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h index 351995b61e68..d893cc5e580a 100644 --- a/io_uring/rsrc.h +++ b/io_uring/rsrc.h @@ -28,6 +28,11 @@ struct io_rsrc_node { enum { IO_REGBUF_F_KBUF = 1 << 0, IO_REGBUF_F_UNCLONEABLE = 1 << 1, + IO_REGBUF_F_DMABUF = 1 << 3, +}; + +enum { + IO_REGBUF_IMPORT_ALLOW_DMABUF = 1 << 1, }; struct io_mapped_ubuf { diff --git a/io_uring/rw.c b/io_uring/rw.c index 999d9a1cc5a5..d33b925a848e 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -23,6 +23,7 @@ #include "rsrc.h" #include "poll.h" #include "rw.h" +#include "dma-buf.h" static void io_complete_rw(struct kiocb *kiocb, long res); static void io_complete_rw_iopoll(struct kiocb *kiocb, long res); @@ -358,13 +359,18 @@ static int io_init_rw_fixed(struct io_kiocb *req, unsigned int issue_flags, struct io_async_rw *io = req->async_data; int ret; - if (io->bytes_done) - return 0; + if (!io->bytes_done) { + ret = __io_import_reg_buf(req, &io->iter, rw->addr, rw->len, ddir, + issue_flags, IO_REGBUF_IMPORT_ALLOW_DMABUF); + if (ret) + return ret; + iov_iter_save_state(&io->iter, &io->iter_state); + } - ret = io_import_reg_buf(req, &io->iter, rw->addr, rw->len, ddir, - issue_flags); - iov_iter_save_state(&io->iter, &io->iter_state); - return ret; + ret = io_attach_dmabuf_map(req, &io->iter, issue_flags); + if (ret) + return ret; + return 0; } int io_prep_read_fixed(struct io_kiocb *req, const struct io_uring_sqe *sqe) @@ -577,6 +583,8 @@ static void io_complete_rw(struct kiocb *kiocb, long res) struct io_rw *rw = container_of(kiocb, struct io_rw, kiocb); struct io_kiocb *req = cmd_to_io_kiocb(rw); + io_detach_dmabuf_map(req); + /* ring owner may block in freeze_super() before task_work runs */ if (kiocb->ki_flags & IOCB_WRITE) io_req_end_write(req); @@ -698,7 +706,7 @@ static ssize_t loop_rw_iter(int ddir, struct io_rw *rw, struct iov_iter *iter) !(kiocb->ki_filp->f_flags & O_NONBLOCK)) return -EAGAIN; if ((req->flags & REQ_F_BUF_NODE) && - (req->buf_node->buf->flags & IO_REGBUF_F_KBUF)) + (req->buf_node->buf->flags & (IO_REGBUF_F_KBUF|IO_REGBUF_F_DMABUF))) return -EFAULT; ppos = io_kiocb_ppos(kiocb); @@ -1226,7 +1234,10 @@ int io_read_fixed(struct io_kiocb *req, unsigned int issue_flags) if (unlikely(ret)) return ret; - return io_read(req, issue_flags); + ret = io_read(req, issue_flags); + if (ret != -EIOCBQUEUED) + io_detach_dmabuf_map(req); + return ret; } int io_write_fixed(struct io_kiocb *req, unsigned int issue_flags) @@ -1237,7 +1248,11 @@ int io_write_fixed(struct io_kiocb *req, unsigned int issue_flags) if (unlikely(ret)) return ret; - return io_write(req, issue_flags); + ret = io_write(req, issue_flags); + if (ret != -EIOCBQUEUED) + io_detach_dmabuf_map(req); + return ret; + } void io_rw_fail(struct io_kiocb *req) From 20d808694e40d81d3627f99b90b08e51087d0f35 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Fri, 16 Oct 2026 10:20:29 +0100 Subject: [PATCH 14/20] block: fix indention for dma-buf checks There is a weird indention I botched while rebasing, fix it. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/de91f480f8507d44ddf99c193ef63dec0f02c749.1792142187.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- block/blk-mq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index be5671966787..7fff1305b492 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -3139,7 +3139,7 @@ void blk_mq_submit_bio(struct bio *bio) } if (unlikely(op_is_dmabuf(bio->bi_opf) && - bdev_has_integrity_csum(bio->bi_bdev))) { + bdev_has_integrity_csum(bio->bi_bdev))) { bio_endio_status(bio, BLK_STS_NOTSUPP); goto queue_exit; } From 44e75dbecb19579db9a070ac8d5f7b400297c1ec Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Fri, 16 Oct 2026 10:58:30 +0100 Subject: [PATCH 15/20] dma-buf-io: fix typos in kernel docs Fix some typos and inconsistencies in dma-buf-io kernel docs. Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/f328e279c3995cd36458ba2684c91d1bf24f057d.1792144609.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- drivers/dma-buf/dma-buf-io.c | 20 ++++++++++---------- include/linux/dma-buf-io.h | 7 ++++--- 2 files changed, 14 insertions(+), 13 deletions(-) diff --git a/drivers/dma-buf/dma-buf-io.c b/drivers/dma-buf/dma-buf-io.c index 21296bd3dde1..e432194a5dfc 100644 --- a/drivers/dma-buf/dma-buf-io.c +++ b/drivers/dma-buf/dma-buf-io.c @@ -106,7 +106,7 @@ static struct dma_buf_io_map *__dma_buf_io_create_map(struct dma_buf_io_ctx *ctx * @ctx: [in] dma-buf I/O context * * A slow path part of dma_buf_io_get_map() and shouldn't be used directly. - * Behaves in the same way but allowed to block. + * Behaves in the same way but is allowed to block. * * Returns a map on success, or ERR_PTR encoded errno otherwise. */ @@ -133,16 +133,16 @@ static void dma_buf_io_ctx_shutdown(struct dma_buf_io_ctx *ctx) } /* - * dma_buf_io_ctx_create - create a new dma-buf I/O context for the given file. + * dma_buf_io_ctx_create - Create a new dma-buf I/O context for the given file. * @file: [in] file for which the context is created * @dmabuf: [in] buffer to create a context from * @dir: [in] direction of DMA transfers - * @out_ctx [out] resulting ctx + * @out_ctx: [out] resulting ctx * * Create a new I/O context from the given DMA buffer for the given file. * It only works with files implementing ->init_dma_buf_io_ctx and fails * with -EOPNOTSUPP otherwise. Once created, the user can create a map - * and use it to issue I/O like read / write requests to @file. + * and use it to issue I/O, such as read/write requests, to @file. */ int dma_buf_io_ctx_create(struct file *file, struct dma_buf *dmabuf, @@ -180,7 +180,7 @@ int dma_buf_io_ctx_create(struct file *file, } /** - * dma_buf_io_ctx_release - destroy the I/O context + * dma_buf_io_ctx_release - Destroy the I/O context * @ctx: [in] dma-buf I/O context * * Destroy the context. It makes sure all maps are waited on and destroyed, @@ -201,11 +201,11 @@ void dma_buf_io_ctx_release(struct dma_buf_io_ctx *ctx) } /** - * dma_buf_io_invalidate_mappings - invalidate the current map + * dma_buf_io_invalidate_mappings - Invalidate the current map * @ctx: [in] dma-buf I/O context * * Importer's helper for invalidating the current map. Waits for all I/O - * using the map to complete and destroyes the map. Called with the + * using the map to complete and destroys the map. Called with the * dma-buf reservation lock held. */ void dma_buf_io_invalidate_mappings(struct dma_buf_io_ctx *ctx) @@ -215,11 +215,11 @@ void dma_buf_io_invalidate_mappings(struct dma_buf_io_ctx *ctx) EXPORT_SYMBOL_NS_GPL(dma_buf_io_invalidate_mappings, "DMA_BUF"); /** - * dma_buf_io_detach - detach the @ctx from the importer. + * dma_buf_io_detach - Detach the @ctx from the importer. * @ctx: [in] dma-buf I/O context * - * Importer's helper for removing the I/O ctx. It kills all maps and - * prevents creation of new ones. Upon return it's safe for the importer + * Importer's helper for removing the I/O context. It kills all maps and + * prevents creation of new ones. Upon return, it's safe for the importer * to release all its resources such as dma-buf attachments. */ void dma_buf_io_detach(struct dma_buf_io_ctx *ctx) diff --git a/include/linux/dma-buf-io.h b/include/linux/dma-buf-io.h index b9bbeca1744f..d9f27650a851 100644 --- a/include/linux/dma-buf-io.h +++ b/include/linux/dma-buf-io.h @@ -60,6 +60,7 @@ void dma_buf_io_ctx_release(struct dma_buf_io_ctx *ctx); struct dma_buf_io_map *dma_buf_io_create_map(struct dma_buf_io_ctx *ctx); +/* Internal helper, see dma_buf_io_get_map() */ static inline struct dma_buf_io_map * __dma_buf_io_get_map(struct dma_buf_io_ctx *ctx) { @@ -79,10 +80,10 @@ __dma_buf_io_get_map(struct dma_buf_io_ctx *ctx) * @ctx: [in] dma-buf I/O context * @nowait: [in] specifies whether it's allowed to block * - * Create a new or acquire an existing map. When succeeds, it returns + * Create a new or acquire an existing map. On success, it returns * a referenced map, which should eventually be put down with * dma_buf_io_map_drop(). If @nowait is set and the function would block, - * it return -EAGAIN, and the caller is expected to retry from a context + * it returns -EAGAIN, and the caller is expected to retry from a context * where blocking is allowed. * * Returns a map on success, or ERR_PTR encoded errno otherwise. @@ -105,7 +106,7 @@ dma_buf_io_get_map(struct dma_buf_io_ctx *ctx, bool nowait) * dma_buf_io_map_drop - Drop the map. * @map: [in] dma-buf I/O map * - * Put down a reference for the @map acquired via dma_buf_io_get_map(). + * Put down a reference to the @map acquired via dma_buf_io_get_map(). * Should be called as soon as I/O is completed. */ static inline void dma_buf_io_map_drop(struct dma_buf_io_map *map) From aeef964d73dbfd7f477182bac934cdb4087d1724 Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Fri, 16 Oct 2026 10:58:31 +0100 Subject: [PATCH 16/20] dma-buf-io: document dma_buf_io_init_map Add a kerneldoc for dma_buf_io_init_map(). Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/a9fdfbe6e447ac583f4d3a3f981b203141a624c4.1792144609.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- drivers/dma-buf/dma-buf-io.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/dma-buf/dma-buf-io.c b/drivers/dma-buf/dma-buf-io.c index e432194a5dfc..8440151de860 100644 --- a/drivers/dma-buf/dma-buf-io.c +++ b/drivers/dma-buf/dma-buf-io.c @@ -43,6 +43,18 @@ static void dma_buf_io_kill_map(struct dma_buf_io_ctx *ctx) dma_buf_io_map_release(map); } +/** + * dma_buf_io_init_map - Initialise the map. + * @ctx: [in] dma-buf I/O context the map is created for + * @map: [in] dma-buf I/O map + * @sgt: [in] the backing scatter-gather table + * + * Importer's helper that initialises @map for the provided I/O context + * and scatter-gather table. The importer should call it once for each map + * on creation. + * + * Return: 0 on success, or a negative errno code otherwise. + */ int dma_buf_io_init_map(struct dma_buf_io_ctx *ctx, struct dma_buf_io_map *map, struct sg_table *sgt) { From f57b957778a33d98e15e394ab426e93c3ead659c Mon Sep 17 00:00:00 2001 From: Pavel Begunkov Date: Fri, 16 Oct 2026 10:26:55 +0100 Subject: [PATCH 17/20] io_uring/dma-buf: allow cloning registered dma-bufs One problem that was brought up is that the file table size is often a limiting factor when working with dma-bufs, which is quite an old problem. With a single io_uring people can work it around by closing the dma-buf fd after registration, but for more complex cases we need a way to dynamically register it into another ring. We also need to deduplicate internal registrations as each creates a new attachment and related structures, which could involve large allocations and iommu mappings. Solve it by enabling io_uring buffer cloning. I made dma-bufs registered for io_uring not cloneable between rings because the implementation could modify parts of struct io_buf_dma without any locking and sharing it would've created races. That was an optimisation that got dropped at some point for simplicity, so we can safely enable cloning back as long as IORING_SETUP_IOPOLL rejection is honoured. Kill the uncloneable flag as unused as well. Reported-by: William Power Reported-by: Tushar Gohad Signed-off-by: Pavel Begunkov Link: https://patch.msgid.link/b76cf21ee0e2362489c864e43781b20d95fd75f7.1792142588.git.asml.silence@gmail.com Signed-off-by: Jens Axboe --- io_uring/dma-buf.c | 7 ++++++- io_uring/rsrc.c | 4 +++- io_uring/rsrc.h | 3 +-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/io_uring/dma-buf.c b/io_uring/dma-buf.c index 1a1a88640823..132e3d0d7023 100644 --- a/io_uring/dma-buf.c +++ b/io_uring/dma-buf.c @@ -18,6 +18,11 @@ int __io_register_dmabuf(struct io_ring_ctx *ctx, struct dma_buf *dmabuf = NULL; int ret; + /* + * We have to drop the dma-buf map early when IO is finished. Disable + * IOPOLL for now as we can't wait potentially infintely for a task + * to do that. + */ if (ctx->flags & IORING_SETUP_IOPOLL) return -EOPNOTSUPP; if (desc->uaddr || desc->size) @@ -51,7 +56,7 @@ int __io_register_dmabuf(struct io_ring_ctx *ctx, imu->len = dmabuf->size; imu->release = io_release_dmabuf; imu->priv = bd; - imu->flags = IO_REGBUF_F_DMABUF | IO_REGBUF_F_UNCLONEABLE; + imu->flags = IO_REGBUF_F_DMABUF; imu->dir = IO_BUF_DEST | IO_BUF_SOURCE; dma_buf_put(dmabuf); return 0; diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 2e89e091afbb..d64228b0e19e 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1507,7 +1507,9 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx if (!src_node) { dst_node = NULL; } else { - if (src_node->buf->flags & IO_REGBUF_F_UNCLONEABLE) { + /* we don't allow IOPOLL rw with dma-buf for now */ + if ((src_node->buf->flags & IO_REGBUF_F_DMABUF) && + (ctx->flags & IORING_SETUP_IOPOLL)) { io_rsrc_data_free(ctx, &data); return -EOPNOTSUPP; } diff --git a/io_uring/rsrc.h b/io_uring/rsrc.h index d893cc5e580a..418d236152ff 100644 --- a/io_uring/rsrc.h +++ b/io_uring/rsrc.h @@ -27,8 +27,7 @@ struct io_rsrc_node { enum { IO_REGBUF_F_KBUF = 1 << 0, - IO_REGBUF_F_UNCLONEABLE = 1 << 1, - IO_REGBUF_F_DMABUF = 1 << 3, + IO_REGBUF_F_DMABUF = 1 << 1, }; enum { From bcbd808652e127a704c21fa44d908eb56cbcda03 Mon Sep 17 00:00:00 2001 From: Keith Busch Date: Wed, 21 Oct 2026 11:46:57 -0700 Subject: [PATCH 18/20] block: reject dma-bufs larger than 4GiB The dma-buf offset is set in the 32-bit bvec_iter bi_offset. Reject buffers that can carry an offset that would wrap. Fixes: 839231d19393 ("block: add dma-buf support for raw bdev") Signed-off-by: Keith Busch Link: https://patch.msgid.link/20261021184658.644645-2-kbusch@meta.com Signed-off-by: Jens Axboe --- block/fops.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/block/fops.c b/block/fops.c index 49ae0302f123..01bc8afe3b48 100644 --- a/block/fops.c +++ b/block/fops.c @@ -19,6 +19,7 @@ #include #include #include +#include #include "blk.h" static inline struct inode *bdev_file_inode(struct file *file) @@ -942,6 +943,8 @@ static int blkdev_init_dma_buf_io_ctx(struct file *file, if (!(file->f_flags & O_DIRECT)) return -EINVAL; + if (ctx->dmabuf->size > UINT_MAX) + return -EINVAL; if (!disk->fops->init_dma_buf_io_ctx) return -EOPNOTSUPP; if (bdev_has_integrity_csum(bdev)) From fd13f31ac62abac4df2166bb0a6fbff53b288e0c Mon Sep 17 00:00:00 2001 From: Keith Busch Date: Wed, 21 Oct 2026 11:46:58 -0700 Subject: [PATCH 19/20] nvme-pci: detach dma-bufs only on removal Detaching the dma-bufs on every shutdown permanently prevents dma-buf I/O after resuming from a suspend. The mappings remain valid across suspend, so detach these only when the device is being removed. Fixes: ce5e386c1108 ("nvme-pci: implement dma-buf backed requests") Signed-off-by: Keith Busch Link: https://patch.msgid.link/20261021184658.644645-3-kbusch@meta.com Signed-off-by: Jens Axboe --- drivers/nvme/host/pci.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index 5b66def7b9b6..2da694f76c90 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -3578,9 +3578,6 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown) nvme_unquiesce_admin_queue(&dev->ctrl); } mutex_unlock(&dev->shutdown_lock); - - if (shutdown) - nvme_pci_remove_dmabuf(&dev->dmabufs); } static int nvme_disable_prepare_reset(struct nvme_dev *dev, bool shutdown) @@ -4150,6 +4147,7 @@ static void nvme_remove(struct pci_dev *pdev) nvme_stop_ctrl(&dev->ctrl); nvme_remove_namespaces(&dev->ctrl); nvme_dev_disable(dev, true); + nvme_pci_remove_dmabuf(&dev->dmabufs); nvme_free_host_mem(dev); nvme_dev_remove_admin(dev); nvme_dbbuf_dma_free(dev); From 45b716456dd99488a0cef58482120dc0474aa696 Mon Sep 17 00:00:00 2001 From: Anuj Gupta Date: Thu, 22 Oct 2026 18:50:27 +0530 Subject: [PATCH 20/20] io_uring/dma-buf: don't fail fixed buffers without dma-buf support io_attach_dmabuf_map() is called for every fixed read/write, but returns -EOPNOTSUPP when CONFIG_DMA_SHARED_BUFFER is disabled before checking whether the request uses a dma-buf at all. So READ_FIXED and WRITE_FIXED fail for ordinary registered buffers. Check REQ_F_DMABUF first. Fixes: 62e4bf5b25d4 ("io_uring/rsrc: add dmabuf backed registered buffers") Signed-off-by: Anuj Gupta Link: https://patch.msgid.link/20261022132027.2293931-1-anuj1072538@gmail.com Signed-off-by: Jens Axboe --- io_uring/dma-buf.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/io_uring/dma-buf.h b/io_uring/dma-buf.h index a876a9e5e272..534c06b6879f 100644 --- a/io_uring/dma-buf.h +++ b/io_uring/dma-buf.h @@ -34,10 +34,10 @@ static inline int io_attach_dmabuf_map(struct io_kiocb *req, struct dma_buf_io_map *map; struct io_buf_dma *bd; - if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER)) - return -EOPNOTSUPP; if (!(req->flags & REQ_F_DMABUF)) return 0; + if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER)) + return -EOPNOTSUPP; bd = req->buf_node->buf->priv; map = dma_buf_io_get_map(bd->ctx, nowait);