Re: [RFC 0/4] fs: support dma-buf backed direct I/O

[Pavel Begunkov <asml.silence@gmail.com>]

On 10/16/26 10:19, Anuj Gupta wrote:
> This series lets an application register a dma-buf against a file,
> so reads and writes go directly to the device as dma-buf backed
> bios with no per-command DMA mapping.

Great to see work done on the filesystem side!

For filesystems to be useful, we'll first need to make a registered
buffer work with all files of the fs and not only the one we used for
the registration. I think about something like below. I'll clean it up
and send out later.


commit 11e25bf0dbce227f87b81cb9436ad347de0deb06
Author: Pavel Begunkov <asml.silence@gmail.com>
Date:   Sun Oct 18 23:09:44 2026 +0100

     dma-buf-io: allow compatible file to reuse the context
     
     Currently, we limit the use of a dma-buf I/O context to the file it was
     created from. It might be fine for block device files but won't work
     well with file systems as we need to support multiple files. Let the
     importing subsystem to set an opaque handle to file and indirectly to
     the dma-buf I/O context, and use it to allow only compatible files.
     
     Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>

diff --git a/block/fops.c b/block/fops.c
index 3fcf33bba935..c62f9f6cc4e3 100644
--- a/block/fops.c
+++ b/block/fops.c
@@ -685,6 +685,7 @@ static int blkdev_open(struct inode *inode, struct file *filp)
  	ret = bdev_open(bdev, mode, filp->private_data, NULL, filp);
  	if (ret)
  		blkdev_put_no_open(bdev);
+	filp->f_dma_io_tag = (unsigned long)bdev;
  	return ret;
  }
  
diff --git a/drivers/dma-buf/dma-buf-io.c b/drivers/dma-buf/dma-buf-io.c
index f724936e223b..a99b93cd4be4 100644
--- a/drivers/dma-buf/dma-buf-io.c
+++ b/drivers/dma-buf/dma-buf-io.c
@@ -166,12 +166,15 @@ int dma_buf_io_ctx_create(struct file *file,
  
  	if (!file->f_op->init_dma_buf_io_ctx)
  		return -EOPNOTSUPP;
+	if (WARN_ON(!file->f_dma_io_tag))
+		return -EFAULT;
  
  	ctx = kzalloc_obj(*ctx);
  	if (!ctx)
  		return -ENOMEM;
  	ctx->dir = dir;
  	ctx->dmabuf = dmabuf;
+	ctx->importer_tag = file->f_dma_io_tag;
  	get_dma_buf(dmabuf);
  
  	ret = file->f_op->init_dma_buf_io_ctx(file, ctx);
diff --git a/include/linux/dma-buf-io.h b/include/linux/dma-buf-io.h
index d9f27650a851..c1d72024dd11 100644
--- a/include/linux/dma-buf-io.h
+++ b/include/linux/dma-buf-io.h
@@ -48,6 +48,15 @@ struct dma_buf_io_ctx {
  	enum dma_data_direction			dir;
  	bool					is_dead;
  
+	/*
+	 * A tag uniqiue to the importing subsystem, which used for filtering
+	 * out files incompatible with the dma-buf I/O context by matching it
+	 * against struct file::f_dma_io_tag. It encodes both the set of
+	 * devices it has been registered for and the subsystem specific
+	 * map / context structures representation.
+	 */
+	unsigned long				importer_tag;
+
  	void					*dev_priv;
  	const struct dma_buf_io_ops		*dev_ops;
  };
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 0d826777681d..8949ac27308c 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1292,6 +1292,12 @@ struct file {
  	};
  	file_ref_t			f_ref;
  	/* --- cacheline 3 boundary (192 bytes) --- */
+
+	/*
+	 * A tag representing the underlying subsystem for dma-buf I/O.
+	 * See struct dma_buf_io_ctx::importer_tag.
+	 */
+	unsigned long			f_dma_io_tag;
  } __randomize_layout
    __attribute__((aligned(4)));	/* lest something weird decides that 2 is OK */
  
diff --git a/io_uring/dma-buf.c b/io_uring/dma-buf.c
index 132e3d0d7023..d8771dced990 100644
--- a/io_uring/dma-buf.c
+++ b/io_uring/dma-buf.c
@@ -4,7 +4,6 @@ static inline void io_release_dmabuf(void *priv)
  {
  	struct io_buf_dma *bd = priv;
  
-	fput(bd->target_file);
  	dma_buf_io_ctx_release(bd->ctx);
  	kfree(bd);
  }
@@ -52,13 +51,13 @@ int __io_register_dmabuf(struct io_ring_ctx *ctx,
  	if (ret)
  		goto err;
  
-	bd->target_file = target_file;
  	imu->len = dmabuf->size;
  	imu->release = io_release_dmabuf;
  	imu->priv = bd;
  	imu->flags = IO_REGBUF_F_DMABUF;
  	imu->dir = IO_BUF_DEST | IO_BUF_SOURCE;
  	dma_buf_put(dmabuf);
+	fput(target_file);
  	return 0;
  err:
  	kfree(bd);
diff --git a/io_uring/dma-buf.h b/io_uring/dma-buf.h
index a876a9e5e272..3b812758fbf7 100644
--- a/io_uring/dma-buf.h
+++ b/io_uring/dma-buf.h
@@ -9,7 +9,6 @@
  
  struct io_buf_dma {
  	struct dma_buf_io_ctx		*ctx;
-	struct file			*target_file;
  };
  
  int __io_register_dmabuf(struct io_ring_ctx *ctx,
@@ -57,7 +56,7 @@ static inline int io_import_dmabuf_map(struct io_kiocb *req,
  
  	if (!IS_ENABLED(CONFIG_DMA_SHARED_BUFFER))
  		return -EOPNOTSUPP;
-	if (req->file != bd->target_file)
+	if (req->file->f_dma_io_tag != bd->ctx->importer_tag)
  		return -EBADF;
  	req->flags |= REQ_F_DMABUF;
  	iov_iter_dmabuf_map(iter, ddir, NULL, offset, len);

-- 
Pavel Begunkov