[RFC v2 PATCH 09/10] vfio/pci: Add mmap() attributes to DMABUF feature

From: Matt Evans

Date: Thu Mar 12 2026 - 14:48:20 EST


A new field is reserved in vfio_device_feature_dma_buf.flags to
request CPU-facing memory type attributes for mmap()s of the buffer.
Add a flag VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_WC, which results in WC
PTEs for the DMABUF's BAR region.

Signed-off-by: Matt Evans <mattev@xxxxxxxx>
---
drivers/vfio/pci/vfio_pci_dmabuf.c | 15 +++++++++++++--
drivers/vfio/pci/vfio_pci_priv.h | 1 +
include/uapi/linux/vfio.h | 12 +++++++++---
3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c
index 362207cf7e71..ed5b80f6911e 100644
--- a/drivers/vfio/pci/vfio_pci_dmabuf.c
+++ b/drivers/vfio/pci/vfio_pci_dmabuf.c
@@ -42,7 +42,10 @@ static int vfio_pci_dma_buf_mmap(struct dma_buf *dmabuf, struct vm_area_struct *
if (req_start + req_len > priv->size)
return -EINVAL;

- vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+ if (priv->attrs == VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_WC)
+ vma->vm_page_prot = pgprot_writecombine(vma->vm_page_prot);
+ else
+ vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
vma->vm_page_prot = pgprot_decrypted(vma->vm_page_prot);

/* See comments in vfio_pci_core_mmap() re VM_ALLOW_ANY_UNCACHED. */
@@ -343,6 +346,12 @@ static int validate_dmabuf_input(struct vfio_device_feature_dma_buf *dma_buf,
size_t length = 0;
u32 i;

+ if ((dma_buf->flags != 0) &&
+ ((dma_buf->flags & ~VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_MASK) ||
+ ((dma_buf->flags & VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_MASK) !=
+ VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_WC)))
+ return -EINVAL;
+
for (i = 0; i < dma_buf->nr_ranges; i++) {
u64 offset = dma_ranges[i].offset;
u64 len = dma_ranges[i].length;
@@ -386,7 +395,7 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,
if (copy_from_user(&get_dma_buf, arg, sizeof(get_dma_buf)))
return -EFAULT;

- if (!get_dma_buf.nr_ranges || get_dma_buf.flags)
+ if (!get_dma_buf.nr_ranges)
return -EINVAL;

/*
@@ -429,6 +438,7 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags,
priv->vdev = vdev;
priv->nr_ranges = get_dma_buf.nr_ranges;
priv->size = length;
+ priv->attrs = get_dma_buf.flags & VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_MASK;
ret = vdev->pci_ops->get_dmabuf_phys(vdev, &priv->provider,
get_dma_buf.region_index,
priv->phys_vec, dma_ranges,
@@ -488,6 +498,7 @@ int vfio_pci_core_mmap_prep_dmabuf(struct vfio_pci_core_device *vdev,
priv->vdev = vdev;
priv->nr_ranges = nr_ranges;
priv->size = req_len;
+ priv->attrs = 0;
priv->phys_vec[0].paddr = phys_start + (pgoff << PAGE_SHIFT);
priv->phys_vec[0].len = req_len;

diff --git a/drivers/vfio/pci/vfio_pci_priv.h b/drivers/vfio/pci/vfio_pci_priv.h
index c5a9e06bf81a..562de3cc88f4 100644
--- a/drivers/vfio/pci/vfio_pci_priv.h
+++ b/drivers/vfio/pci/vfio_pci_priv.h
@@ -40,6 +40,7 @@ struct vfio_pci_dma_buf {
u32 nr_ranges;
struct kref kref;
struct completion comp;
+ u32 attrs;
enum vfio_pci_dma_buf_status status;
};

diff --git a/include/uapi/linux/vfio.h b/include/uapi/linux/vfio.h
index c1b3fa880aa1..fbbe1adea533 100644
--- a/include/uapi/linux/vfio.h
+++ b/include/uapi/linux/vfio.h
@@ -1521,7 +1521,9 @@ struct vfio_device_feature_bus_master {
* etc. offset/length specify a slice of the region to create the dmabuf from.
* nr_ranges is the total number of (P2P DMA) ranges that comprise the dmabuf.
*
- * flags should be 0.
+ * flags contains:
+ * - A field for userspace mapping attribute: by default, suitable for regular
+ * MMIO. Alternate attributes (such as WC) can be selected.
*
* Return: The fd number on success, -1 and errno is set on failure.
*/
@@ -1535,8 +1537,12 @@ struct vfio_region_dma_range {
struct vfio_device_feature_dma_buf {
__u32 region_index;
__u32 open_flags;
- __u32 flags;
- __u32 nr_ranges;
+ __u32 flags;
+ /* Flags sub-field reserved for attribute enum */
+#define VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_MASK (0xf << 28)
+#define VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_UC (0 << 28)
+#define VFIO_DEVICE_FEATURE_DMA_BUF_ATTR_WC (1 << 28)
+ __u32 nr_ranges;
struct vfio_region_dma_range dma_ranges[] __counted_by(nr_ranges);
};

--
2.47.3