On Thu, Jan 08, 2026 at 01:11:14PM +0200, Edward Srouji wrote:
> void rdma_user_mmap_entry_remove(struct rdma_user_mmap_entry *entry)
> {
> + struct ib_uverbs_dmabuf_file *uverbs_dmabuf, *tmp;
> +
> if (!entry)
> return;
>
> + mutex_lock(&entry->dmabufs_lock);
> xa_lock(&entry->ucontext->mmap_xa);
> entry->driver_removed = true;
> xa_unlock(&entry->ucontext->mmap_xa);
> + list_for_each_entry_safe(uverbs_dmabuf, tmp, &entry->dmabufs,
> dmabufs_elm) {
> + dma_resv_lock(uverbs_dmabuf->dmabuf->resv, NULL);
> + list_del(&uverbs_dmabuf->dmabufs_elm);
> + uverbs_dmabuf->revoked = true;
> + dma_buf_move_notify(uverbs_dmabuf->dmabuf);
> + dma_resv_unlock(uverbs_dmabuf->dmabuf->resv);
This will need the same wait that Christian pointed out for VFIO..
> diff --git a/drivers/infiniband/core/rdma_core.c
> b/drivers/infiniband/core/rdma_core.c
> index 18918f463361..3e0a8b9cd288 100644
> --- a/drivers/infiniband/core/rdma_core.c
> +++ b/drivers/infiniband/core/rdma_core.c
> @@ -465,7 +465,7 @@ alloc_begin_fd_uobject(const struct uverbs_api_object
> *obj,
>
> fd_type =
> container_of(obj->type_attrs, struct uverbs_obj_fd_type, type);
> - if (WARN_ON(fd_type->fops->release != &uverbs_uobject_fd_release &&
> + if (WARN_ON(fd_type->fops && fd_type->fops->release !=
> &uverbs_uobject_fd_release &&
> fd_type->fops->release != &uverbs_async_event_release)) {
> ret = ERR_PTR(-EINVAL);
> goto err_fd;
> @@ -477,14 +477,16 @@ alloc_begin_fd_uobject(const struct uverbs_api_object
> *obj,
> goto err_fd;
> }
>
> - /* Note that uverbs_uobject_fd_release() is called during abort */
> - filp = anon_inode_getfile(fd_type->name, fd_type->fops, NULL,
> - fd_type->flags);
> - if (IS_ERR(filp)) {
> - ret = ERR_CAST(filp);
> - goto err_getfile;
> + if (fd_type->fops) {
> + /* Note that uverbs_uobject_fd_release() is called during abort
> */
> + filp = anon_inode_getfile(fd_type->name, fd_type->fops, NULL,
> + fd_type->flags);
> + if (IS_ERR(filp)) {
> + ret = ERR_CAST(filp);
> + goto err_getfile;
> + }
> + uobj->object = filp;
> }
> - uobj->object = filp;
>
> uobj->id = new_fd;
> return uobj;
> @@ -561,7 +563,9 @@ static void alloc_abort_fd_uobject(struct ib_uobject
> *uobj)
> {
> struct file *filp = uobj->object;
>
> - fput(filp);
> + if (filp)
> + fput(filp);
> +
> put_unused_fd(uobj->id);
This stuff changing hw the uobjects work should probably be in its own
patch with its own explanation about creating a uobject that wrappers
an externally allocated file descriptor vs this automatic internal
allocation.
> index 797e2fcc8072..66287e8e7ad7 100644
> --- a/drivers/infiniband/core/uverbs.h
> +++ b/drivers/infiniband/core/uverbs.h
> @@ -133,6 +133,16 @@ struct ib_uverbs_completion_event_file {
> struct ib_uverbs_event_queue ev_queue;
> };
>
> +struct ib_uverbs_dmabuf_file {
> + struct ib_uobject uobj;
> + struct dma_buf *dmabuf;
> + struct list_head dmabufs_elm;
> + struct rdma_user_mmap_entry *mmap_entry;
> + struct dma_buf_phys_vec phys_vec;
Oh, are we going to have weird merge conflicts with this Leon?
> +static int uverbs_dmabuf_attach(struct dma_buf *dmabuf,
> + struct dma_buf_attachment *attachment)
> +{
> + struct ib_uverbs_dmabuf_file *priv = dmabuf->priv;
> +
> + if (!attachment->peer2peer)
> + return -EOPNOTSUPP;
> +
> + if (priv->revoked)
> + return -ENODEV;
This should only be checked in map
This should also eventually call the new revoke testing function Leon
is adding
Jason
