This series implements a dma-buf “revoke” mechanism: to allow a dma-buf
exporter to explicitly invalidate (“kill”) a shared buffer after it has
been distributed to importers, so that further CPU and device access is
prevented and importers reliably observe failure.
Today, dma-buf effectively provides “if you have the fd, you can keep using
the memory indefinitely.” That assumption breaks down when an exporter must
reclaim, reset, evict, or otherwise retire backing memory after it has been
shared. Concrete cases include GPU reset and recovery where old allocations
become unsafe to access, memory eviction/overcommit where backing storage
must be withdrawn, and security or isolation situations where continued access
must be prevented. While drivers can sometimes approximate this with
exporter-specific fencing and policy, there is no core dma-buf state transition
that communicates “this buffer is no longer valid; fail access” across all
access paths.
The change in this series is to introduce a core “revoked” state on the dma-buf
object and a corresponding exporter-triggered revoke operation. Once a dma-buf
is revoked, new access paths are blocked so that attempts to DMA-map, vmap, or
mmap the buffer fail in a consistent way.
In addition, the series aims to invalidate existing access as much as the kernel
allows: device mappings are torn down where possible so devices and IOMMUs cannot
continue DMA.
The semantics are intentionally simple: revoke is a one-way, permanent transition
for the lifetime of that dma-buf instance.
From a compatibility perspective, users that never invoke revoke are unaffected,
and exporters that adopt it gain a core-supported enforcement mechanism rather
than relying on ad hoc driver behavior. The intent is to keep the interface
minimal and avoid imposing policy; the series provides the mechanism to terminate
access, with policy remaining in the exporter and higher-level components.
BTW, see this megathread [1] for additional context.
Ironically, it was posted exactly one year ago.
[1] https://lore.kernel.org/all/20250107142719.179636-2-yilun.xu@linux.intel.co…
Thanks
Cc: linux-rdma(a)vger.kernel.org
Cc: linux-kernel(a)vger.kernel.org
Cc: linux-media(a)vger.kernel.org
Cc: dri-devel(a)lists.freedesktop.org
Cc: linaro-mm-sig(a)lists.linaro.org
Cc: kvm(a)vger.kernel.org
Cc: iommu(a)lists.linux.dev
To: Jason Gunthorpe <jgg(a)ziepe.ca>
To: Leon Romanovsky <leon(a)kernel.org>
To: Sumit Semwal <sumit.semwal(a)linaro.org>
To: Christian König <christian.koenig(a)amd.com>
To: Alex Williamson <alex(a)shazbot.org>
To: Kevin Tian <kevin.tian(a)intel.com>
To: Joerg Roedel <joro(a)8bytes.org>
To: Will Deacon <will(a)kernel.org>
To: Robin Murphy <robin.murphy(a)arm.com>
Signed-off-by: Leon Romanovsky <leonro(a)nvidia.com>
---
Leon Romanovsky (4):
dma-buf: Introduce revoke semantics
vfio: Use dma-buf revoke semantics
iommufd: Require DMABUF revoke semantics
iommufd/selftest: Reuse dma-buf revoke semantics
drivers/dma-buf/dma-buf.c | 36 ++++++++++++++++++++++++++++++++----
drivers/iommu/iommufd/pages.c | 2 +-
drivers/iommu/iommufd/selftest.c | 12 ++++--------
drivers/vfio/pci/vfio_pci_dmabuf.c | 27 ++++++---------------------
include/linux/dma-buf.h | 31 +++++++++++++++++++++++++++++++
5 files changed, 74 insertions(+), 34 deletions(-)
---
base-commit: 9ace4753a5202b02191d54e9fdf7f9e3d02b85eb
change-id: 20251221-dmabuf-revoke-b90ef16e4236
Best regards,
--
Leon Romanovsky <leonro(a)nvidia.com>
The system dma-buf heap lets userspace allocate buffers from the page
allocator. However, these allocations are not accounted for in memcg,
allowing processes to escape limits that may be configured.
Pass the __GFP_ACCOUNT for our allocations to account them into memcg.
Userspace components using the system heap can be constrained with, e.g:
systemd-run --user --scope -p MemoryMax=10M ...
Signed-off-by: Eric Chanudet <echanude(a)redhat.com>
---
drivers/dma-buf/heaps/system_heap.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/dma-buf/heaps/system_heap.c b/drivers/dma-buf/heaps/system_heap.c
index 4c782fe33fd4..c91fcdff4b77 100644
--- a/drivers/dma-buf/heaps/system_heap.c
+++ b/drivers/dma-buf/heaps/system_heap.c
@@ -38,10 +38,10 @@ struct dma_heap_attachment {
bool mapped;
};
-#define LOW_ORDER_GFP (GFP_HIGHUSER | __GFP_ZERO)
+#define LOW_ORDER_GFP (GFP_HIGHUSER | __GFP_ZERO | __GFP_ACCOUNT)
#define HIGH_ORDER_GFP (((GFP_HIGHUSER | __GFP_ZERO | __GFP_NOWARN \
| __GFP_NORETRY) & ~__GFP_RECLAIM) \
- | __GFP_COMP)
+ | __GFP_COMP | __GFP_ACCOUNT)
static gfp_t order_flags[] = {HIGH_ORDER_GFP, HIGH_ORDER_GFP, LOW_ORDER_GFP};
/*
* The selection of the orders used for allocation (1MB, 64K, 4K) is designed
--
2.52.0
When a driver's vmap callback returns an error (e.g. -ENOMEM), dma_buf_vmap()
triggers a WARN_ON_ONCE(). This is incorrect as vmap operations can legitimately
fail due to resource exhaustion or other transient conditions, as documented.
Fix this by removing the WARN_ON_ONCE(). The error code is already correctly
propagated to the caller.
Reported-by: syzbot+4317d7108e14e5d56308(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4317d7108e14e5d56308
Signed-off-by: Szymon Wilczek <swilczek.lx(a)gmail.com>
---
drivers/dma-buf/dma-buf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index edaa9e4ee4ae..14b55f67ee1c 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -1525,7 +1525,7 @@ int dma_buf_vmap(struct dma_buf *dmabuf, struct iosys_map *map)
BUG_ON(iosys_map_is_set(&dmabuf->vmap_ptr));
ret = dmabuf->ops->vmap(dmabuf, &ptr);
- if (WARN_ON_ONCE(ret))
+ if (ret)
return ret;
dmabuf->vmap_ptr = ptr;
--
2.52.0
When a driver's vmap callback returns an error (e.g. -ENOMEM), dma_buf_vmap()
triggers a WARN_ON_ONCE(). This is incorrect as vmap operations can legitimately
fail due to resource exhaustion or other transient conditions, as documented.
Fix this by removing the WARN_ON_ONCE(). The error code is already correctly
propagated to the caller.
Reported-by: syzbot+cd944c467e4d4bc24cf6(a)syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug\?extid\=4317d7108e14e5d56308
Signed-off-by: Szymon Wilczek <szymonwilczek(a)gmx.com>
---
drivers/dma-buf/dma-buf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c
index edaa9e4ee4ae..14b55f67ee1c 100644
--- a/drivers/dma-buf/dma-buf.c
+++ b/drivers/dma-buf/dma-buf.c
@@ -1525,7 +1525,7 @@ int dma_buf_vmap(struct dma_buf *dmabuf, struct iosys_map *map)
BUG_ON(iosys_map_is_set(&dmabuf->vmap_ptr));
ret = dmabuf->ops->vmap(dmabuf, &ptr);
- if (WARN_ON_ONCE(ret))
+ if (ret)
return ret;
dmabuf->vmap_ptr = ptr;
--
2.52.0
This makes a few changes to the way immediate mode works, and then it
implements a Rust immediate mode GPUVM abstraction on top of that.
Please see the following branch for example usage in Tyr:
https://gitlab.freedesktop.org/panfrost/linux/-/merge_requests/53
For context, please see this previous patch:
https://lore.kernel.org/rust-for-linux/20250621-gpuvm-v3-1-10203da06867@col…
and the commit message of the last patch.
Signed-off-by: Alice Ryhl <aliceryhl(a)google.com>
---
Alice Ryhl (4):
drm/gpuvm: take GEM lock inside drm_gpuvm_bo_obtain_prealloc()
drm/gpuvm: drm_gpuvm_bo_obtain() requires lock and staged mode
drm/gpuvm: use const for drm_gpuva_op_* ptrs
rust: drm: add GPUVM immediate mode abstraction
MAINTAINERS | 1 +
drivers/gpu/drm/drm_gpuvm.c | 80 ++++--
drivers/gpu/drm/imagination/pvr_vm.c | 2 +-
drivers/gpu/drm/msm/msm_gem.h | 2 +-
drivers/gpu/drm/msm/msm_gem_vma.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_uvmm.c | 2 +-
drivers/gpu/drm/panthor/panthor_mmu.c | 10 -
drivers/gpu/drm/xe/xe_vm.c | 4 +-
include/drm/drm_gpuvm.h | 12 +-
rust/bindings/bindings_helper.h | 2 +
rust/helpers/drm_gpuvm.c | 43 +++
rust/helpers/helpers.c | 1 +
rust/kernel/drm/gpuvm/mod.rs | 394 +++++++++++++++++++++++++++
rust/kernel/drm/gpuvm/sm_ops.rs | 469 +++++++++++++++++++++++++++++++++
rust/kernel/drm/gpuvm/va.rs | 148 +++++++++++
rust/kernel/drm/gpuvm/vm_bo.rs | 213 +++++++++++++++
rust/kernel/drm/mod.rs | 1 +
17 files changed, 1337 insertions(+), 49 deletions(-)
---
base-commit: 77b686f688126a5f758b51441a03186e9eb1b0f1
change-id: 20251128-gpuvm-rust-b719cac27ad6
Best regards,
--
Alice Ryhl <aliceryhl(a)google.com>
Hi,
Here are kernel-doc fixes for mm subsystem, based on mm-hotfixes-unstable
branch. This series is split from previous assorted kernel-doc fixes series
[1] with review trailers applied.
I'm also including textsearch fix since there's currently no maintainer
for include/linux/textsearch.h (get_maintainer.pl only shows LKML).
Enjoy!
[1]: https://lore.kernel.org/linux-fsdevel/20251215113903.46555-1-bagasdotme@gma…
Bagas Sanjaya (4):
mm: Describe @flags parameter in memalloc_flags_save()
textsearch: Describe @list member in ts_ops search
mm: vmalloc: Fix up vrealloc_node_align() kernel-doc macro name
mm, kfence: Describe @slab parameter in __kfence_obj_info()
include/linux/kfence.h | 1 +
include/linux/sched/mm.h | 1 +
include/linux/textsearch.h | 1 +
mm/vmalloc.c | 2 +-
4 files changed, 4 insertions(+), 1 deletion(-)
base-commit: 980dbceadd50af9437257d8095d4a3606818e8c4
--
An old man doll... just what I always wanted! - Clara
This series improve stability of the capture by fixing the
handling of the overrun which was leading to captured
frame corruption.
Locking within the driver is also simplified and the way
DMA is handled is reworked allowing to avoid having a
specific handling for the JPEG data.
Performances of capture can now be increased via the usage
of a DMA->MDMA chaining which allows for capture of higher
resolution / framerate.
Signed-off-by: Alain Volmat <alain.volmat(a)foss.st.com>
---
Alain Volmat (12):
media: stm32: dcmi: Switch from __maybe_unused to pm_sleep_ptr()
media: stm32: dcmi: perform dmaengine_slave_config at probe
media: stm32: dcmi: only create dma descriptor once at buf_prepare
media: stm32: dcmi: stop the dma transfer on overrun
media: stm32: dcmi: rework spin_lock calls
media: stm32: dcmi: perform all dma handling within irq_thread
media: stm32: dcmi: use dmaengine_terminate_async in irq context
media: stm32: dcmi: continuous mode capture in JPEG
dt-bindings: media: st: dcmi: add DMA-MDMA chaining properties
media: stm32: dcmi: addition of DMA-MDMA chaining support
ARM: dts: stm32: add sram node within stm32mp151.dtsi
ARM: dts: stm32: enable DCMI DMA-MDMA chaining on stm32mp157c-ev1.dts
.../devicetree/bindings/media/st,stm32-dcmi.yaml | 13 +-
arch/arm/boot/dts/st/stm32mp151.dtsi | 8 +
arch/arm/boot/dts/st/stm32mp157c-ev1.dts | 15 +
drivers/media/platform/st/stm32/stm32-dcmi.c | 470 ++++++++++++++-------
4 files changed, 341 insertions(+), 165 deletions(-)
---
base-commit: f7231cff1f3ff8259bef02dc4999bc132abf29cf
change-id: 20251213-stm32-dcmi-dma-chaining-9ea1da83007d
Best regards,
--
Alain Volmat <alain.volmat(a)foss.st.com>