On Thu, Jan 08, 2026 at 01:11:14PM +0200, Edward Srouji wrote:
> From: Yishai Hadas <[email protected]>
>
> Expose DMABUF functionality to userspace through the uverbs interface,
> enabling InfiniBand/RDMA devices to export PCI based memory regions
> (e.g. device memory) as DMABUF file descriptors. This allows
> zero-copy sharing of RDMA memory with other subsystems that support the
> dma-buf framework.
>
> A new UVERBS_OBJECT_DMABUF object type and allocation method were
> introduced.
>
> During allocation, uverbs invokes the driver to supply the
> rdma_user_mmap_entry associated with the given page offset (pgoff).
>
> Based on the returned rdma_user_mmap_entry, uverbs requests the driver
> to provide the corresponding physical-memory details as well as the
> driver’s PCI provider information.
>
> Using this information, dma_buf_export() is called; if it succeeds,
> uobj->object is set to the underlying file pointer returned by the
> dma-buf framework.
>
> The file descriptor number follows the standard uverbs allocation flow,
> but the file pointer comes from the dma-buf subsystem, including its own
> fops and private data.
>
> Because of this, alloc_begin_fd_uobject() must handle cases where
> fd_type->fops is NULL, and both alloc_commit_fd_uobject() and
> alloc_abort_fd_uobject() must account for whether filp->private_data
> exists, since it is only populated after a successful dma_buf_export().
>
> When an mmap entry is removed, uverbs iterates over its associated
> DMABUFs, marks them as revoked, and calls dma_buf_move_notify() so that
> their importers are notified.
>
> The same procedure applies during the disassociate flow; final cleanup
> occurs when the application closes the file.
>
> Signed-off-by: Yishai Hadas <[email protected]>
> Signed-off-by: Edward Srouji <[email protected]>
> ---
> drivers/infiniband/core/Makefile | 1 +
> drivers/infiniband/core/device.c | 2 +
> drivers/infiniband/core/ib_core_uverbs.c | 19 +++
> drivers/infiniband/core/rdma_core.c | 63 ++++----
> drivers/infiniband/core/rdma_core.h | 1 +
> drivers/infiniband/core/uverbs.h | 10 ++
> drivers/infiniband/core/uverbs_std_types_dmabuf.c | 172
> ++++++++++++++++++++++
> drivers/infiniband/core/uverbs_uapi.c | 1 +
> include/rdma/ib_verbs.h | 9 ++
> include/rdma/uverbs_types.h | 1 +
> include/uapi/rdma/ib_user_ioctl_cmds.h | 10 ++
> 11 files changed, 263 insertions(+), 26 deletions(-)
<...>
> +static struct sg_table *
> +uverbs_dmabuf_map(struct dma_buf_attachment *attachment,
> + enum dma_data_direction dir)
> +{
> + struct ib_uverbs_dmabuf_file *priv = attachment->dmabuf->priv;
> +
> + dma_resv_assert_held(priv->dmabuf->resv);
> +
> + if (priv->revoked)
> + return ERR_PTR(-ENODEV);
> +
> + return dma_buf_phys_vec_to_sgt(attachment, priv->provider,
> + &priv->phys_vec, 1, priv->phys_vec.len,
> + dir);
> +}
> +
> +static void uverbs_dmabuf_unmap(struct dma_buf_attachment *attachment,
> + struct sg_table *sgt,
> + enum dma_data_direction dir)
> +{
> + dma_buf_free_sgt(attachment, sgt, dir);
> +}
Unfortunately, it is not enough. Exporters should count their
map<->unmap calls and make sure that they are equal.
See this VFIO change
https://lore.kernel.org/kvm/[email protected]/
Thanks
