[PATCH 9/9] vfio/pci: Add mmap() attributes to DMABUF feature

Matt Evans
2026-04-16T13:19:09Z

A new field is reserved in vfio_device_feature_dma_buf.flags to
request CPU-facing memory type attributes for mmap()s of the buffer.
Add a flag VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_WC, which results in WC
PTEs for the DMABUF's BAR region.

Signed-off-by: Matt Evans <mattev@meta.com>
---
drivers/vfio/pci/vfio_pci_dmabuf.c | 15 +++++++++++++--
drivers/vfio/pci/vfio_pci_priv.h | 1 +
include/uapi/linux/vfio.h | 12 +++++++++---
3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c
index 48ec4da2db8b..00cedfe3a57d 100644
--- a/drivers/vfio/pci/vfio_pci_dmabuf.c
+++ b/drivers/vfio/pci/vfio_pci_dmabuf.c
@@ -43,7 +43,10 @@ static int vfio_pci_dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *
if (req_start + req_len > priv->size)
return -EINVAL;

- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ if (priv->attrs == VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_WC)
+ vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+ else
+ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);

/* See comments in vfio_pci_core_mmap() re VM_ALLOW_ANY_UNCACHED. */
@@ -370,6 +373,12 @@ static int validate_dmabuf_input(struct vfio_device_feature_dma_buf *dma_buf,
size_t length = 0;
u32 i;

+ if ((dma_buf->flags != 0) &&
+ ((dma_buf->flags & ~VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_MASK) ||
+ ((dma_buf->flags & VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_MASK) !=
+ VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_WC)))
+ return -EINVAL;
+
for (i = 0; i < dma_buf->nr_ranges; i++) {
u64 offset = dma_ranges[i].offset;
u64 len = dma_ranges[i].length;
@@ -413,7 +422,7 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,
if (copy_from_user(&get_dma_buf, arg, sizeof(get_dma_buf)))
return -EFAULT;

- if (!get_dma_buf.nr_ranges || get_dma_buf.flags)
+ if (!get_dma_buf.nr_ranges)
return -EINVAL;

/*
@@ -457,6 +466,7 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,
priv->vdev = vdev;
priv->nr_ranges = get_dma_buf.nr_ranges;
priv->size = length;
+ priv->attrs = get_dma_buf.flags & VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_MASK;
ret = vdev->pci_ops->get_dmabuf_phys(vdev, &priv->provider,
get_dma_buf.region_index,
priv->phys_vec, dma_ranges,
@@ -542,6 +552,7 @@ int vfio_pci_core_mmap_prep_dmabuf(struct vfio_pci_core_device *vdev,
*/
priv->vdev = vdev;
priv->nr_ranges = nr_ranges;
+ priv->attrs = 0;
priv->size = (vma->vm_pgoff << PAGE_SHIFT) + req_len;
priv->provider = pcim_p2pdma_provider(vdev->pdev, res_index);
if (!priv->provider) {
diff --git a/drivers/vfio/pci/vfio_pci_priv.h b/drivers/vfio/pci/vfio_pci_priv.h
index eac5606ca161..aeffd9f7f3b5 100644
--- a/drivers/vfio/pci/vfio_pci_priv.h
+++ b/drivers/vfio/pci/vfio_pci_priv.h
@@ -40,6 +40,7 @@ struct vfio_pci_dma_buf {
u32 nr_ranges;
struct kref kref;
struct completion comp;
+ u32 attrs;
enum vfio_pci_dma_buf_status status;
};

diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
index 77225ed8115f..93eef95dc7f3 100644
--- a/include/uapi/linux/vfio.h
+++ b/include/uapi/linux/vfio.h
@@ -1535,7 +1535,9 @@ struct vfio_device_feature_bus_master {
* etc. offset/length specify a slice of the region to create the dmabuf from.
* nr_ranges is the total number of (P2P DMA) ranges that comprise the dmabuf.
*
- * flags should be 0.
+ * flags contains:
+ * - A field for userspace mapping attribute: by default, suitable for regular
+ * MMIO. Alternate attributes (such as WC) can be selected.
*
* Return: The fd number on success, -1 and errno is set on failure.
*/
@@ -1549,8 +1551,12 @@ struct vfio_region_dma_range {
struct vfio_device_feature_dma_buf {
__u32 region_index;
__u32 open_flags;
- __u32 flags;
- __u32 nr_ranges;
+ __u32 flags;
+ /* Flags sub-field reserved for attribute enum */
+#define VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_MASK (0xfU << 28)
+#define VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_UC (0 << 28)
+#define VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_WC (1 << 28)
+ __u32 nr_ranges;
struct vfio_region_dma_range dma_ranges[] __counted_by(nr_ranges);
};

--
2.47.3