On 1/18/26 13:08, Leon Romanovsky wrote:

From: Leon Romanovsky leonro@nvidia.com

Rename the .move_notify() callback to .invalidate_mappings() to make its purpose explicit and highlight that it is responsible for invalidating existing mappings.

Suggested-by: Christian König christian.koenig@amd.com Signed-off-by: Leon Romanovsky leonro@nvidia.com

Reviewed-by: Christian König christian.koenig@amd.com

---

drivers/dma-buf/dma-buf.c | 6 +++--- drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 4 ++-- drivers/gpu/drm/virtio/virtgpu_prime.c | 2 +- drivers/gpu/drm/xe/tests/xe_dma_buf.c | 6 +++--- drivers/gpu/drm/xe/xe_dma_buf.c | 2 +- drivers/infiniband/core/umem_dmabuf.c | 4 ++-- drivers/infiniband/hw/mlx5/mr.c | 2 +- drivers/iommu/iommufd/pages.c | 2 +- include/linux/dma-buf.h | 6 +++--- 9 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index edaa9e4ee4ae..59cc647bf40e 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -948,7 +948,7 @@ dma_buf_dynamic_attach(struct dma_buf *dmabuf, struct device *dev, if (WARN_ON(!dmabuf || !dev)) return ERR_PTR(-EINVAL);

• if (WARN_ON(importer_ops && !importer_ops->move_notify))

• if (WARN_ON(importer_ops && !importer_ops->invalidate_mappings)) return ERR_PTR(-EINVAL);

attach = kzalloc(sizeof(*attach), GFP_KERNEL); @@ -1055,7 +1055,7 @@ EXPORT_SYMBOL_NS_GPL(dma_buf_pin, "DMA_BUF");

• This unpins a buffer pinned by dma_buf_pin() and allows the exporter to move
• any mapping of @attach again and inform the importer through

• • &dma_buf_attach_ops.move_notify.

• • &dma_buf_attach_ops.invalidate_mappings.
  */

void dma_buf_unpin(struct dma_buf_attachment *attach) { @@ -1262,7 +1262,7 @@ void dma_buf_move_notify(struct dma_buf *dmabuf) list_for_each_entry(attach, &dmabuf->attachments, node) if (attach->importer_ops)

• 	attach->importer_ops->move_notify(attach);
  

• 	attach->importer_ops->invalidate_mappings(attach);
  

} EXPORT_SYMBOL_NS_GPL(dma_buf_move_notify, "DMA_BUF"); diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c index e22cfa7c6d32..863454148b28 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c @@ -450,7 +450,7 @@ amdgpu_dma_buf_create_obj(struct drm_device *dev, struct dma_buf *dma_buf) } /**

• • amdgpu_dma_buf_move_notify - &attach.move_notify implementation

• • amdgpu_dma_buf_move_notify - &attach.invalidate_mappings implementation
  • @attach: the DMA-buf attachment

@@ -521,7 +521,7 @@ amdgpu_dma_buf_move_notify(struct dma_buf_attachment *attach) static const struct dma_buf_attach_ops amdgpu_dma_buf_attach_ops = { .allow_peer2peer = true,

• .move_notify = amdgpu_dma_buf_move_notify

• .invalidate_mappings = amdgpu_dma_buf_move_notify

}; /** diff --git a/drivers/gpu/drm/virtio/virtgpu_prime.c b/drivers/gpu/drm/virtio/virtgpu_prime.c index ce49282198cb..19c78dd2ca77 100644 --- a/drivers/gpu/drm/virtio/virtgpu_prime.c +++ b/drivers/gpu/drm/virtio/virtgpu_prime.c @@ -288,7 +288,7 @@ static void virtgpu_dma_buf_move_notify(struct dma_buf_attachment *attach) static const struct dma_buf_attach_ops virtgpu_dma_buf_attach_ops = { .allow_peer2peer = true,

• .move_notify = virtgpu_dma_buf_move_notify

• .invalidate_mappings = virtgpu_dma_buf_move_notify

}; struct drm_gem_object *virtgpu_gem_prime_import(struct drm_device *dev, diff --git a/drivers/gpu/drm/xe/tests/xe_dma_buf.c b/drivers/gpu/drm/xe/tests/xe_dma_buf.c index 5df98de5ba3c..1f2cca5c2f81 100644 --- a/drivers/gpu/drm/xe/tests/xe_dma_buf.c +++ b/drivers/gpu/drm/xe/tests/xe_dma_buf.c @@ -23,7 +23,7 @@ static bool p2p_enabled(struct dma_buf_test_params *params) static bool is_dynamic(struct dma_buf_test_params *params) { return IS_ENABLED(CONFIG_DMABUF_MOVE_NOTIFY) && params->attach_ops &&

• params->attach_ops->move_notify;
  

• params->attach_ops->invalidate_mappings;
  

} static void check_residency(struct kunit *test, struct xe_bo *exported, @@ -60,7 +60,7 @@ static void check_residency(struct kunit *test, struct xe_bo *exported, /* * Evict exporter. Evicting the exported bo will

• * evict also the imported bo through the move_notify() functionality if
  

• * evict also the imported bo through the invalidate_mappings() functionality if
  

  • importer is on a different device. If they're on the same device,
  • the exporter and the importer should be the same bo.
  */

@@ -198,7 +198,7 @@ static void xe_test_dmabuf_import_same_driver(struct xe_device *xe) static const struct dma_buf_attach_ops nop2p_attach_ops = { .allow_peer2peer = false,

• .move_notify = xe_dma_buf_move_notify

• .invalidate_mappings = xe_dma_buf_move_notify

}; /* diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c index 7c74a31d4486..1b9cd043e517 100644 --- a/drivers/gpu/drm/xe/xe_dma_buf.c +++ b/drivers/gpu/drm/xe/xe_dma_buf.c @@ -287,7 +287,7 @@ static void xe_dma_buf_move_notify(struct dma_buf_attachment *attach) static const struct dma_buf_attach_ops xe_dma_buf_attach_ops = { .allow_peer2peer = true,

• .move_notify = xe_dma_buf_move_notify

• .invalidate_mappings = xe_dma_buf_move_notify

}; #if IS_ENABLED(CONFIG_DRM_XE_KUNIT_TEST) diff --git a/drivers/infiniband/core/umem_dmabuf.c b/drivers/infiniband/core/umem_dmabuf.c index 0ec2e4120cc9..d77a739cfe7a 100644 --- a/drivers/infiniband/core/umem_dmabuf.c +++ b/drivers/infiniband/core/umem_dmabuf.c @@ -129,7 +129,7 @@ ib_umem_dmabuf_get_with_dma_device(struct ib_device *device, if (check_add_overflow(offset, (unsigned long)size, &end)) return ret;

• if (unlikely(!ops || !ops->move_notify))

• if (unlikely(!ops || !ops->invalidate_mappings)) return ret;

dmabuf = dma_buf_get(fd); @@ -195,7 +195,7 @@ ib_umem_dmabuf_unsupported_move_notify(struct dma_buf_attachment *attach) static struct dma_buf_attach_ops ib_umem_dmabuf_attach_pinned_ops = { .allow_peer2peer = true,

• .move_notify = ib_umem_dmabuf_unsupported_move_notify,

• .invalidate_mappings = ib_umem_dmabuf_unsupported_move_notify,

}; struct ib_umem_dmabuf * diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c index 325fa04cbe8a..97099d3b1688 100644 --- a/drivers/infiniband/hw/mlx5/mr.c +++ b/drivers/infiniband/hw/mlx5/mr.c @@ -1620,7 +1620,7 @@ static void mlx5_ib_dmabuf_invalidate_cb(struct dma_buf_attachment *attach) static struct dma_buf_attach_ops mlx5_ib_dmabuf_attach_ops = { .allow_peer2peer = 1,

• .move_notify = mlx5_ib_dmabuf_invalidate_cb,

• .invalidate_mappings = mlx5_ib_dmabuf_invalidate_cb,

}; static struct ib_mr * diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index dbe51ecb9a20..76f900fa1687 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1451,7 +1451,7 @@ static void iopt_revoke_notify(struct dma_buf_attachment *attach) static struct dma_buf_attach_ops iopt_dmabuf_attach_revoke_ops = { .allow_peer2peer = true,

• .move_notify = iopt_revoke_notify,

• .invalidate_mappings = iopt_revoke_notify,

}; /* diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index 0bc492090237..1b397635c793 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -407,7 +407,7 @@ struct dma_buf { * through the device. * * - Dynamic importers should set fences for any access that they can't

• *   disable immediately from their &dma_buf_attach_ops.move_notify
  

• *   disable immediately from their &dma_buf_attach_ops.invalidate_mappings
  

  • callback.
  • IMPORTANT:

@@ -458,7 +458,7 @@ struct dma_buf_attach_ops { bool allow_peer2peer; /**

• * @move_notify: [optional] notification that the DMA-buf is moving
  

• * @invalidate_mappings: [optional] notification that the DMA-buf is moving
  

  • If this callback is provided the framework can avoid pinning the
  • backing store while mappings exists.

@@ -475,7 +475,7 @@ struct dma_buf_attach_ops { * New mappings can be created after this callback returns, and will * point to the new location of the DMA-buf. */

• void (*move_notify)(struct dma_buf_attachment *attach);

• void (*invalidate_mappings)(struct dma_buf_attachment *attach);

}; /**

On 1/19/26 12:38, Leon Romanovsky wrote:

On Mon, Jan 19, 2026 at 11:22:27AM +0100, Christian König wrote:

...

On 1/18/26 13:08, Leon Romanovsky wrote:

...

From: Leon Romanovsky leonro@nvidia.com

Rename the .move_notify() callback to .invalidate_mappings() to make its purpose explicit and highlight that it is responsible for invalidating existing mappings.

Suggested-by: Christian König christian.koenig@amd.com Signed-off-by: Leon Romanovsky leonro@nvidia.com

Reviewed-by: Christian König christian.koenig@amd.com

Thanks,

BTW, I didn't update the various xxx_move_notify() functions to use xxx_invalidate_mappings() names. Should those be converted as well?

No, those importer specific functions can keep their name.

More important is the config option. Haven't thought about that one.

Probably best if we either rename or completely remove that one, it was to keep the MOVE_NOTIFY functionality separate for initial testing but we have clearly supassed this long time ago.

Regards, Christian.

...

...

---

drivers/dma-buf/dma-buf.c | 6 +++--- drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 4 ++-- drivers/gpu/drm/virtio/virtgpu_prime.c | 2 +- drivers/gpu/drm/xe/tests/xe_dma_buf.c | 6 +++--- drivers/gpu/drm/xe/xe_dma_buf.c | 2 +- drivers/infiniband/core/umem_dmabuf.c | 4 ++-- drivers/infiniband/hw/mlx5/mr.c | 2 +- drivers/iommu/iommufd/pages.c | 2 +- include/linux/dma-buf.h | 6 +++--- 9 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index edaa9e4ee4ae..59cc647bf40e 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -948,7 +948,7 @@ dma_buf_dynamic_attach(struct dma_buf *dmabuf, struct device *dev, if (WARN_ON(!dmabuf || !dev)) return ERR_PTR(-EINVAL);

• if (WARN_ON(importer_ops && !importer_ops->move_notify))

• if (WARN_ON(importer_ops && !importer_ops->invalidate_mappings)) return ERR_PTR(-EINVAL);

attach = kzalloc(sizeof(*attach), GFP_KERNEL); @@ -1055,7 +1055,7 @@ EXPORT_SYMBOL_NS_GPL(dma_buf_pin, "DMA_BUF");

• This unpins a buffer pinned by dma_buf_pin() and allows the exporter to move
• any mapping of @attach again and inform the importer through

• • &dma_buf_attach_ops.move_notify.

• • &dma_buf_attach_ops.invalidate_mappings.
  */

void dma_buf_unpin(struct dma_buf_attachment *attach) { @@ -1262,7 +1262,7 @@ void dma_buf_move_notify(struct dma_buf *dmabuf) list_for_each_entry(attach, &dmabuf->attachments, node) if (attach->importer_ops)

• 	attach->importer_ops->move_notify(attach);
  

• 	attach->importer_ops->invalidate_mappings(attach);
  

} EXPORT_SYMBOL_NS_GPL(dma_buf_move_notify, "DMA_BUF"); diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c index e22cfa7c6d32..863454148b28 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c @@ -450,7 +450,7 @@ amdgpu_dma_buf_create_obj(struct drm_device *dev, struct dma_buf *dma_buf) } /**

• • amdgpu_dma_buf_move_notify - &attach.move_notify implementation

• • amdgpu_dma_buf_move_notify - &attach.invalidate_mappings implementation
  • @attach: the DMA-buf attachment

@@ -521,7 +521,7 @@ amdgpu_dma_buf_move_notify(struct dma_buf_attachment *attach) static const struct dma_buf_attach_ops amdgpu_dma_buf_attach_ops = { .allow_peer2peer = true,

• .move_notify = amdgpu_dma_buf_move_notify

• .invalidate_mappings = amdgpu_dma_buf_move_notify

}; /** diff --git a/drivers/gpu/drm/virtio/virtgpu_prime.c b/drivers/gpu/drm/virtio/virtgpu_prime.c index ce49282198cb..19c78dd2ca77 100644 --- a/drivers/gpu/drm/virtio/virtgpu_prime.c +++ b/drivers/gpu/drm/virtio/virtgpu_prime.c @@ -288,7 +288,7 @@ static void virtgpu_dma_buf_move_notify(struct dma_buf_attachment *attach) static const struct dma_buf_attach_ops virtgpu_dma_buf_attach_ops = { .allow_peer2peer = true,

• .move_notify = virtgpu_dma_buf_move_notify

• .invalidate_mappings = virtgpu_dma_buf_move_notify

}; struct drm_gem_object *virtgpu_gem_prime_import(struct drm_device *dev, diff --git a/drivers/gpu/drm/xe/tests/xe_dma_buf.c b/drivers/gpu/drm/xe/tests/xe_dma_buf.c index 5df98de5ba3c..1f2cca5c2f81 100644 --- a/drivers/gpu/drm/xe/tests/xe_dma_buf.c +++ b/drivers/gpu/drm/xe/tests/xe_dma_buf.c @@ -23,7 +23,7 @@ static bool p2p_enabled(struct dma_buf_test_params *params) static bool is_dynamic(struct dma_buf_test_params *params) { return IS_ENABLED(CONFIG_DMABUF_MOVE_NOTIFY) && params->attach_ops &&

• params->attach_ops->move_notify;
  

• params->attach_ops->invalidate_mappings;
  

} static void check_residency(struct kunit *test, struct xe_bo *exported, @@ -60,7 +60,7 @@ static void check_residency(struct kunit *test, struct xe_bo *exported, /* * Evict exporter. Evicting the exported bo will

• * evict also the imported bo through the move_notify() functionality if
  

• * evict also the imported bo through the invalidate_mappings() functionality if
  

  • importer is on a different device. If they're on the same device,
  • the exporter and the importer should be the same bo.
  */

@@ -198,7 +198,7 @@ static void xe_test_dmabuf_import_same_driver(struct xe_device *xe) static const struct dma_buf_attach_ops nop2p_attach_ops = { .allow_peer2peer = false,

• .move_notify = xe_dma_buf_move_notify

• .invalidate_mappings = xe_dma_buf_move_notify

}; /* diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c index 7c74a31d4486..1b9cd043e517 100644 --- a/drivers/gpu/drm/xe/xe_dma_buf.c +++ b/drivers/gpu/drm/xe/xe_dma_buf.c @@ -287,7 +287,7 @@ static void xe_dma_buf_move_notify(struct dma_buf_attachment *attach) static const struct dma_buf_attach_ops xe_dma_buf_attach_ops = { .allow_peer2peer = true,

• .move_notify = xe_dma_buf_move_notify

• .invalidate_mappings = xe_dma_buf_move_notify

}; #if IS_ENABLED(CONFIG_DRM_XE_KUNIT_TEST) diff --git a/drivers/infiniband/core/umem_dmabuf.c b/drivers/infiniband/core/umem_dmabuf.c index 0ec2e4120cc9..d77a739cfe7a 100644 --- a/drivers/infiniband/core/umem_dmabuf.c +++ b/drivers/infiniband/core/umem_dmabuf.c @@ -129,7 +129,7 @@ ib_umem_dmabuf_get_with_dma_device(struct ib_device *device, if (check_add_overflow(offset, (unsigned long)size, &end)) return ret;

• if (unlikely(!ops || !ops->move_notify))

• if (unlikely(!ops || !ops->invalidate_mappings)) return ret;

dmabuf = dma_buf_get(fd); @@ -195,7 +195,7 @@ ib_umem_dmabuf_unsupported_move_notify(struct dma_buf_attachment *attach) static struct dma_buf_attach_ops ib_umem_dmabuf_attach_pinned_ops = { .allow_peer2peer = true,

• .move_notify = ib_umem_dmabuf_unsupported_move_notify,

• .invalidate_mappings = ib_umem_dmabuf_unsupported_move_notify,

}; struct ib_umem_dmabuf * diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c index 325fa04cbe8a..97099d3b1688 100644 --- a/drivers/infiniband/hw/mlx5/mr.c +++ b/drivers/infiniband/hw/mlx5/mr.c @@ -1620,7 +1620,7 @@ static void mlx5_ib_dmabuf_invalidate_cb(struct dma_buf_attachment *attach) static struct dma_buf_attach_ops mlx5_ib_dmabuf_attach_ops = { .allow_peer2peer = 1,

• .move_notify = mlx5_ib_dmabuf_invalidate_cb,

• .invalidate_mappings = mlx5_ib_dmabuf_invalidate_cb,

}; static struct ib_mr * diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index dbe51ecb9a20..76f900fa1687 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1451,7 +1451,7 @@ static void iopt_revoke_notify(struct dma_buf_attachment *attach) static struct dma_buf_attach_ops iopt_dmabuf_attach_revoke_ops = { .allow_peer2peer = true,

• .move_notify = iopt_revoke_notify,

• .invalidate_mappings = iopt_revoke_notify,

}; /* diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index 0bc492090237..1b397635c793 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -407,7 +407,7 @@ struct dma_buf { * through the device. * * - Dynamic importers should set fences for any access that they can't

• *   disable immediately from their &dma_buf_attach_ops.move_notify
  

• *   disable immediately from their &dma_buf_attach_ops.invalidate_mappings
  

  • callback.
  • IMPORTANT:

@@ -458,7 +458,7 @@ struct dma_buf_attach_ops { bool allow_peer2peer; /**

• * @move_notify: [optional] notification that the DMA-buf is moving
  

• * @invalidate_mappings: [optional] notification that the DMA-buf is moving
  

  • If this callback is provided the framework can avoid pinning the
  • backing store while mappings exists.

@@ -475,7 +475,7 @@ struct dma_buf_attach_ops { * New mappings can be created after this callback returns, and will * point to the new location of the DMA-buf. */

• void (*move_notify)(struct dma_buf_attachment *attach);

• void (*invalidate_mappings)(struct dma_buf_attachment *attach);

}; /**

On 1/18/26 13:08, Leon Romanovsky wrote:

From: Leon Romanovsky leonro@nvidia.com

Document a DMA-buf revoke mechanism that allows an exporter to explicitly invalidate ("kill") a shared buffer after it has been handed out to importers. Once revoked, all further CPU and device access is blocked, and importers consistently observe failure.

This requires both importers and exporters to honor the revoke contract.

For importers, this means implementing .invalidate_mappings() and calling dma_buf_pin() after the DMA‑buf is attached to verify the exporter’s support for revocation.

For exporters, this means implementing the .pin() callback, which checks the DMA‑buf attachment for a valid revoke implementation.

Signed-off-by: Leon Romanovsky leonro@nvidia.com

include/linux/dma-buf.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)

diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index 1b397635c793..e0bc0b7119f5 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -579,6 +579,25 @@ static inline bool dma_buf_is_dynamic(struct dma_buf *dmabuf) return !!dmabuf->ops->pin; } +/**

• • dma_buf_attachment_is_revoke - check if a DMA-buf importer implements
• • revoke semantics.
• • @attach: the DMA-buf attachment to check

• • Returns true if DMA-buf importer honors revoke semantics, which is
• • negotiated with the exporter, by making sure that importer implements
• • .invalidate_mappings() callback and calls to dma_buf_pin() after
• • DMA-buf attach.

That wording is to unclear. Something like:

Returns true if the DMA-buf importer can handle invalidating it's mappings at any time, even after pinning a buffer.

• */

+static inline bool +dma_buf_attachment_is_revoke(struct dma_buf_attachment *attach)

That's clearly not a good name. But that is already discussed in another thread.

+{

• return IS_ENABLED(CONFIG_DMABUF_MOVE_NOTIFY) &&

Oh, we should have renamed that as well. Or maybe it is time to completely remove that config option.

•       dma_buf_is_dynamic(attach->dmabuf) &&
  

This is checking exporter and not importer capabilities, please drop.

•       (attach->importer_ops &&
  

• attach->importer_ops->invalidate_mappings);
  

So when invalidate_mappings is implemented we need to be able to call it at any time. Yeah that sounds like a valid approach to me.

But we need to remove the RDNA callback with the warning then to properly signal that. And also please document that in the callback kerneldoc.

Regards, Christian.

+}

struct dma_buf_attachment *dma_buf_attach(struct dma_buf *dmabuf, struct device *dev); struct dma_buf_attachment *

On Sun, Jan 18, 2026 at 02:08:46PM +0200, Leon Romanovsky wrote:

From: Leon Romanovsky leonro@nvidia.com

Document a DMA-buf revoke mechanism that allows an exporter to explicitly invalidate ("kill") a shared buffer after it has been handed out to importers. Once revoked, all further CPU and device access is blocked, and importers consistently observe failure.

This requires both importers and exporters to honor the revoke contract.

For importers, this means implementing .invalidate_mappings() and calling dma_buf_pin() after the DMA‑buf is attached to verify the exporter’s support for revocation.

For exporters, this means implementing the .pin() callback, which checks the DMA‑buf attachment for a valid revoke implementation.

Signed-off-by: Leon Romanovsky leonro@nvidia.com

include/linux/dma-buf.h | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+)

diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index 1b397635c793..e0bc0b7119f5 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -579,6 +579,25 @@ static inline bool dma_buf_is_dynamic(struct dma_buf *dmabuf) return !!dmabuf->ops->pin; } +/**

• • dma_buf_attachment_is_revoke - check if a DMA-buf importer implements
• • revoke semantics.
• • @attach: the DMA-buf attachment to check
• • Returns true if DMA-buf importer honors revoke semantics, which is
• • negotiated with the exporter, by making sure that importer implements
• • .invalidate_mappings() callback and calls to dma_buf_pin() after
• • DMA-buf attach.
• */

I think this clarification should also have comment to dma_buf_move_notify(). Maybe like this:

@@ -1324,7 +1324,18 @@ EXPORT_SYMBOL_NS_GPL(dma_buf_sgt_unmap_attachment_unlocked, "DMA_BUF"); * @dmabuf: [in] buffer which is moving * * Informs all attachments that they need to destroy and recreate all their - * mappings. + * mappings. If the attachment is dynamic then the dynamic importer is expected + * to invalidate any caches it has of the mapping result and perform a new + * mapping request before allowing HW to do any further DMA. + * + * If the attachment is pinned then this informs the pinned importer that + * the underlying mapping is no longer available. Pinned importers may take + * this is as a permanent revocation so exporters should not trigger it + * lightly. + * + * For legacy pinned importers that cannot support invalidation this is a NOP. + * Drivers can call dma_buf_attachment_is_revoke() to determine if the + * importer supports this. */

Also it would be nice to document what Christian pointed out regarding fences after move_notify.

+static inline bool +dma_buf_attachment_is_revoke(struct dma_buf_attachment *attach) +{

• return IS_ENABLED(CONFIG_DMABUF_MOVE_NOTIFY) &&

•       dma_buf_is_dynamic(attach->dmabuf) &&
  

•       (attach->importer_ops &&
  

• attach->importer_ops->invalidate_mappings);
  

+}

And I don't think we should use a NULL invalidate_mappings function pointer to signal this.

It sounds like the direction is to require importers to support move_notify, so we should not make it easy to just drop a NULL in the ops struct to get out of the desired configuration.

I suggest defining a function "dma_buf_unsupported_invalidate_mappings" and use EXPORT_SYMBOL_FOR_MODULES so only RDMA can use it. Then check for that along with NULL importer_ops to cover the two cases where it is not allowed.

The only reason RDMA has to use dma_buf_dynamic_attach() is to set the allow_p2p=true ..

Jason

On Mon, Jan 19, 2026 at 12:59:51PM -0400, Jason Gunthorpe wrote:

On Sun, Jan 18, 2026 at 02:08:47PM +0200, Leon Romanovsky wrote:

...

From: Leon Romanovsky leonro@nvidia.com

IOMMUFD does not support page fault handling, and after a call to .invalidate_mappings() all mappings become invalid. Ensure that the IOMMUFD DMABUF importer is bound to a revoke‑aware DMABUF exporter (for example, VFIO).

Signed-off-by: Leon Romanovsky leonro@nvidia.com

drivers/iommu/iommufd/pages.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index 76f900fa1687..a5eb2bc4ef48 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1501,16 +1501,22 @@ static int iopt_map_dmabuf(struct iommufd_ctx *ictx, struct iopt_pages *pages, mutex_unlock(&pages->mutex); }

• rc = sym_vfio_pci_dma_buf_iommufd_map(attach, &pages->dmabuf.phys);

• rc = dma_buf_pin(attach); if (rc) goto err_detach;

• rc = sym_vfio_pci_dma_buf_iommufd_map(attach, &pages->dmabuf.phys);
• if (rc)

• goto err_unpin;
  

• dma_resv_unlock(dmabuf->resv);

/* On success iopt_release_pages() will detach and put the dmabuf. */ pages->dmabuf.attach = attach; return 0;

Don't we need an explicit unpin after unmapping?

Yes, but this patch is going to be dropped in v3 because of this suggestion. https://lore.kernel.org/all/a397ff1e-615f-4873-98a9-940f9c16f85c@amd.com

Thanks

Jason

On Mon, Jan 19, 2026 at 03:54:44PM -0400, Jason Gunthorpe wrote:

On Mon, Jan 19, 2026 at 08:23:00PM +0200, Leon Romanovsky wrote:

...

On Mon, Jan 19, 2026 at 12:59:51PM -0400, Jason Gunthorpe wrote:

...

On Sun, Jan 18, 2026 at 02:08:47PM +0200, Leon Romanovsky wrote:

...

From: Leon Romanovsky leonro@nvidia.com

IOMMUFD does not support page fault handling, and after a call to .invalidate_mappings() all mappings become invalid. Ensure that the IOMMUFD DMABUF importer is bound to a revoke‑aware DMABUF exporter (for example, VFIO).

Signed-off-by: Leon Romanovsky leonro@nvidia.com

drivers/iommu/iommufd/pages.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index 76f900fa1687..a5eb2bc4ef48 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1501,16 +1501,22 @@ static int iopt_map_dmabuf(struct iommufd_ctx *ictx, struct iopt_pages *pages, mutex_unlock(&pages->mutex); }

• rc = sym_vfio_pci_dma_buf_iommufd_map(attach, &pages->dmabuf.phys);

• rc = dma_buf_pin(attach); if (rc) goto err_detach;

• rc = sym_vfio_pci_dma_buf_iommufd_map(attach, &pages->dmabuf.phys);
• if (rc)

• goto err_unpin;
  

• dma_resv_unlock(dmabuf->resv);

/* On success iopt_release_pages() will detach and put the dmabuf. */ pages->dmabuf.attach = attach; return 0;

Don't we need an explicit unpin after unmapping?

Yes, but this patch is going to be dropped in v3 because of this suggestion. https://lore.kernel.org/all/a397ff1e-615f-4873-98a9-940f9c16f85c@amd.com

That's not right, that suggestion is about changing VFIO. iommufd must still act as a pinning importer!

There is no change in iommufd, as it invokes dma_buf_dynamic_attach() with a valid &iopt_dmabuf_attach_revoke_ops. The check determining whether iommufd can perform a revoke is handled there.

Thanks

Jason

On Tue, Jan 20, 2026 at 09:15:30AM -0400, Jason Gunthorpe wrote:

On Tue, Jan 20, 2026 at 03:10:46PM +0200, Leon Romanovsky wrote:

...

On Mon, Jan 19, 2026 at 03:54:44PM -0400, Jason Gunthorpe wrote:

...

On Mon, Jan 19, 2026 at 08:23:00PM +0200, Leon Romanovsky wrote:

...

On Mon, Jan 19, 2026 at 12:59:51PM -0400, Jason Gunthorpe wrote:

...

On Sun, Jan 18, 2026 at 02:08:47PM +0200, Leon Romanovsky wrote:

...

From: Leon Romanovsky leonro@nvidia.com

IOMMUFD does not support page fault handling, and after a call to .invalidate_mappings() all mappings become invalid. Ensure that the IOMMUFD DMABUF importer is bound to a revoke‑aware DMABUF exporter (for example, VFIO).

Signed-off-by: Leon Romanovsky leonro@nvidia.com

drivers/iommu/iommufd/pages.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/iommufd/pages.c b/drivers/iommu/iommufd/pages.c index 76f900fa1687..a5eb2bc4ef48 100644 --- a/drivers/iommu/iommufd/pages.c +++ b/drivers/iommu/iommufd/pages.c @@ -1501,16 +1501,22 @@ static int iopt_map_dmabuf(struct iommufd_ctx *ictx, struct iopt_pages *pages, mutex_unlock(&pages->mutex); }

• rc = sym_vfio_pci_dma_buf_iommufd_map(attach, &pages->dmabuf.phys);

• rc = dma_buf_pin(attach); if (rc) goto err_detach;

• rc = sym_vfio_pci_dma_buf_iommufd_map(attach, &pages->dmabuf.phys);
• if (rc)

• goto err_unpin;
  

• dma_resv_unlock(dmabuf->resv);

/* On success iopt_release_pages() will detach and put the dmabuf. */ pages->dmabuf.attach = attach; return 0;

Don't we need an explicit unpin after unmapping?

Yes, but this patch is going to be dropped in v3 because of this suggestion. https://lore.kernel.org/all/a397ff1e-615f-4873-98a9-940f9c16f85c@amd.com

That's not right, that suggestion is about changing VFIO. iommufd must still act as a pinning importer!

There is no change in iommufd, as it invokes dma_buf_dynamic_attach() with a valid &iopt_dmabuf_attach_revoke_ops. The check determining whether iommufd can perform a revoke is handled there.

iommufd is a pining importer. I did not add a call to pin because it only worked with VFIO that would not support it. Now that this series fixes it the pin must be added. Don't drop this patch.

No problem, let's keep it.

Thanks

On 1/18/26 13:08, Leon Romanovsky wrote:

From: Leon Romanovsky leonro@nvidia.com

DMABUF ->pin() interface is called when the DMABUF importer perform its DMA mapping, so let's use this opportunity to check if DMABUF exporter revoked its buffer or not.

Signed-off-by: Leon Romanovsky leonro@nvidia.com

drivers/vfio/pci/vfio_pci_dmabuf.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)

diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c index d4d0f7d08c53..af9c315ddf71 100644 --- a/drivers/vfio/pci/vfio_pci_dmabuf.c +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c @@ -20,6 +20,20 @@ struct vfio_pci_dma_buf { u8 revoked : 1; }; +static int vfio_pci_dma_buf_pin(struct dma_buf_attachment *attachment) +{

• struct vfio_pci_dma_buf *priv = attachment->dmabuf->priv;
• dma_resv_assert_held(priv->dmabuf->resv);
• return dma_buf_attachment_is_revoke(attachment) ? 0 : -EOPNOTSUPP;

It's probably better to do that check in vfio_pci_dma_buf_attach.

And BTW the function vfio_pci_dma_buf_move() seems to be broken:

void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked) { struct vfio_pci_dma_buf *priv; struct vfio_pci_dma_buf *tmp;

lockdep_assert_held_write(&vdev->memory_lock);

list_for_each_entry_safe(priv, tmp, &vdev->dmabufs, dmabufs_elm) { if (!get_file_active(&priv->dmabuf->file)) continue;

if (priv->revoked != revoked) { dma_resv_lock(priv->dmabuf->resv, NULL); priv->revoked = revoked; dma_buf_move_notify(priv->dmabuf);

A dma_buf_move_notify() just triggers asynchronous invalidation of the mapping!

You need to use dma_resv_wait() to wait for that to finish.

dma_resv_unlock(priv->dmabuf->resv); } fput(priv->dmabuf->file); } }

Regards, Christian.

+}

+static void vfio_pci_dma_buf_unpin(struct dma_buf_attachment *attachment) +{

• /* Do nothing */

+}

static int vfio_pci_dma_buf_attach(struct dma_buf *dmabuf, struct dma_buf_attachment *attachment) { @@ -76,6 +90,8 @@ static void vfio_pci_dma_buf_release(struct dma_buf *dmabuf) } static const struct dma_buf_ops vfio_pci_dmabuf_ops = {

• .pin = vfio_pci_dma_buf_pin,
• .unpin = vfio_pci_dma_buf_unpin, .attach = vfio_pci_dma_buf_attach, .map_dma_buf = vfio_pci_dma_buf_map, .unmap_dma_buf = vfio_pci_dma_buf_unmap,

On 1/19/26 14:02, Leon Romanovsky wrote:

On Mon, Jan 19, 2026 at 01:12:45PM +0100, Christian König wrote:

...

On 1/18/26 13:08, Leon Romanovsky wrote:

...

From: Leon Romanovsky leonro@nvidia.com

DMABUF ->pin() interface is called when the DMABUF importer perform its DMA mapping, so let's use this opportunity to check if DMABUF exporter revoked its buffer or not.

Signed-off-by: Leon Romanovsky leonro@nvidia.com

drivers/vfio/pci/vfio_pci_dmabuf.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)

diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c index d4d0f7d08c53..af9c315ddf71 100644 --- a/drivers/vfio/pci/vfio_pci_dmabuf.c +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c @@ -20,6 +20,20 @@ struct vfio_pci_dma_buf { u8 revoked : 1; }; +static int vfio_pci_dma_buf_pin(struct dma_buf_attachment *attachment) +{

• struct vfio_pci_dma_buf *priv = attachment->dmabuf->priv;
• dma_resv_assert_held(priv->dmabuf->resv);
• return dma_buf_attachment_is_revoke(attachment) ? 0 : -EOPNOTSUPP;

It's probably better to do that check in vfio_pci_dma_buf_attach.

I assume you are proposing to add this check in both vfio_pci_dma_buf_attach() and vfio_pci_dma_buf_pin(). Otherwise, importers that lack .invalidate_mapping() will invoke dma_buf_pin() and will not fail.

vfio_pci_dma_buf_attach() alone should be sufficient. It is always called, even for importers lacking invalidate_mapping().

Regards, Christian.

...

And BTW the function vfio_pci_dma_buf_move() seems to be broken:

void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked) { struct vfio_pci_dma_buf *priv; struct vfio_pci_dma_buf *tmp;

    lockdep_assert_held_write(&vdev->memory_lock);

    list_for_each_entry_safe(priv, tmp, &vdev->dmabufs, dmabufs_elm) {
            if (!get_file_active(&priv->dmabuf->file))
                    continue;

            if (priv->revoked != revoked) {
                    dma_resv_lock(priv->dmabuf->resv, NULL);
                    priv->revoked = revoked;
                    dma_buf_move_notify(priv->dmabuf);

A dma_buf_move_notify() just triggers asynchronous invalidation of the mapping!

You need to use dma_resv_wait() to wait for that to finish.

We (VFIO and IOMMUFD) followed the same pattern used in amdgpu_bo_move_notify(), which also does not wait.

I'll add wait here.

Thanks

...

                    dma_resv_unlock(priv->dmabuf->resv);
            }
            fput(priv->dmabuf->file);
    }

}

Regards, Christian.

...

+}

+static void vfio_pci_dma_buf_unpin(struct dma_buf_attachment *attachment) +{

• /* Do nothing */

+}

static int vfio_pci_dma_buf_attach(struct dma_buf *dmabuf, struct dma_buf_attachment *attachment) { @@ -76,6 +90,8 @@ static void vfio_pci_dma_buf_release(struct dma_buf *dmabuf) } static const struct dma_buf_ops vfio_pci_dmabuf_ops = {

• .pin = vfio_pci_dma_buf_pin,
• .unpin = vfio_pci_dma_buf_unpin, .attach = vfio_pci_dma_buf_attach, .map_dma_buf = vfio_pci_dma_buf_map, .unmap_dma_buf = vfio_pci_dma_buf_unmap,