On 1/24/26 20:14, Leon Romanovsky wrote:

From: Leon Romanovsky leonro@nvidia.com

Along with renaming the .move_notify() callback, rename the corresponding dma-buf core function. This makes the expected behavior clear to exporters calling this function.

Signed-off-by: Leon Romanovsky leonro@nvidia.com

Reviewed-by: Christian König christian.koenig@amd.com

---

drivers/dma-buf/dma-buf.c | 8 ++++---- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 +- drivers/gpu/drm/xe/xe_bo.c | 2 +- drivers/iommu/iommufd/selftest.c | 2 +- drivers/vfio/pci/vfio_pci_dmabuf.c | 4 ++-- include/linux/dma-buf.h | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 59cc647bf40e..e12db540c413 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -912,7 +912,7 @@ dma_buf_pin_on_map(struct dma_buf_attachment *attach)

• 3. Exporters must hold the dma-buf reservation lock when calling these
• functions:

• • - dma_buf_move_notify()
    

• • - dma_buf_invalidate_mappings()
    

  */

/** @@ -1247,14 +1247,14 @@ void dma_buf_unmap_attachment_unlocked(struct dma_buf_attachment *attach, EXPORT_SYMBOL_NS_GPL(dma_buf_unmap_attachment_unlocked, "DMA_BUF"); /**

• • dma_buf_move_notify - notify attachments that DMA-buf is moving

• • dma_buf_invalidate_mappings - notify attachments that DMA-buf is moving
  • @dmabuf: [in] buffer which is moving
  • Informs all attachments that they need to destroy and recreate all their
  • mappings.
  */

-void dma_buf_move_notify(struct dma_buf *dmabuf) +void dma_buf_invalidate_mappings(struct dma_buf *dmabuf) { struct dma_buf_attachment *attach; @@ -1264,7 +1264,7 @@ void dma_buf_move_notify(struct dma_buf *dmabuf) if (attach->importer_ops) attach->importer_ops->invalidate_mappings(attach); } -EXPORT_SYMBOL_NS_GPL(dma_buf_move_notify, "DMA_BUF"); +EXPORT_SYMBOL_NS_GPL(dma_buf_invalidate_mappings, "DMA_BUF"); /**

• DOC: cpu access

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c index e08f58de4b17..f73dc99d1887 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c @@ -1270,7 +1270,7 @@ void amdgpu_bo_move_notify(struct ttm_buffer_object *bo, if (abo->tbo.base.dma_buf && !drm_gem_is_imported(&abo->tbo.base) && old_mem && old_mem->mem_type != TTM_PL_SYSTEM)

• dma_buf_move_notify(abo->tbo.base.dma_buf);
  

• dma_buf_invalidate_mappings(abo->tbo.base.dma_buf);
  

/* move_notify is called before move happens */ trace_amdgpu_bo_move(abo, new_mem ? new_mem->mem_type : -1, diff --git a/drivers/gpu/drm/xe/xe_bo.c b/drivers/gpu/drm/xe/xe_bo.c index bf4ee976b680..7d02cd9a8501 100644 --- a/drivers/gpu/drm/xe/xe_bo.c +++ b/drivers/gpu/drm/xe/xe_bo.c @@ -819,7 +819,7 @@ static int xe_bo_move_notify(struct xe_bo *bo, /* Don't call move_notify() for imported dma-bufs. */ if (ttm_bo->base.dma_buf && !ttm_bo->base.import_attach)

• dma_buf_move_notify(ttm_bo->base.dma_buf);
  

• dma_buf_invalidate_mappings(ttm_bo->base.dma_buf);
  

/* * TTM has already nuked the mmap for us (see ttm_bo_unmap_virtual), diff --git a/drivers/iommu/iommufd/selftest.c b/drivers/iommu/iommufd/selftest.c index 550ff36dec3a..f60cbd5328cc 100644 --- a/drivers/iommu/iommufd/selftest.c +++ b/drivers/iommu/iommufd/selftest.c @@ -2081,7 +2081,7 @@ static int iommufd_test_dmabuf_revoke(struct iommufd_ucmd *ucmd, int fd, priv = dmabuf->priv; dma_resv_lock(dmabuf->resv, NULL); priv->revoked = revoked;

• dma_buf_move_notify(dmabuf);

• dma_buf_invalidate_mappings(dmabuf); dma_resv_unlock(dmabuf->resv);

err_put: diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c index 4be4a85005cb..d8ceafabef48 100644 --- a/drivers/vfio/pci/vfio_pci_dmabuf.c +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c @@ -332,7 +332,7 @@ void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked) if (priv->revoked != revoked) { dma_resv_lock(priv->dmabuf->resv, NULL); priv->revoked = revoked;

• 	dma_buf_move_notify(priv->dmabuf);
  

• 	dma_buf_invalidate_mappings(priv->dmabuf);
  dma_resv_unlock(priv->dmabuf->resv);
  

  } fput(priv->dmabuf->file);

@@ -353,7 +353,7 @@ void vfio_pci_dma_buf_cleanup(struct vfio_pci_core_device *vdev) list_del_init(&priv->dmabufs_elm); priv->vdev = NULL; priv->revoked = true;

• dma_buf_move_notify(priv->dmabuf);
  

• dma_buf_invalidate_mappings(priv->dmabuf);
  

  dma_resv_unlock(priv->dmabuf->resv); vfio_device_put_registration(&vdev->vdev); fput(priv->dmabuf->file);

diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index 1b397635c793..d5c3ce2b3aa4 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -600,7 +600,7 @@ struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *, enum dma_data_direction); void dma_buf_unmap_attachment(struct dma_buf_attachment *, struct sg_table *, enum dma_data_direction); -void dma_buf_move_notify(struct dma_buf *dma_buf); +void dma_buf_invalidate_mappings(struct dma_buf *dma_buf); int dma_buf_begin_cpu_access(struct dma_buf *dma_buf, enum dma_data_direction dir); int dma_buf_end_cpu_access(struct dma_buf *dma_buf,

On 1/24/26 20:14, Leon Romanovsky wrote:

From: Leon Romanovsky leonro@nvidia.com

DMABUF_MOVE_NOTIFY was introduced in 2018 and has been marked as experimental and disabled by default ever since. Six years later, all new importers implement this callback.

It is therefore reasonable to drop CONFIG_DMABUF_MOVE_NOTIFY and always build DMABUF with support for it enabled.

Suggested-by: Christian König christian.koenig@amd.com Signed-off-by: Leon Romanovsky leonro@nvidia.com

Reviewed-by: Christian König christian.koenig@amd.com

As long as nobody starts screaming in the last second or I encounter some other problem I'm going to push the first three patches to drm-misc-next now.

They are basically just cleanups we should have done a long time ago.

Regards, Christian.

---

drivers/dma-buf/Kconfig | 12 ------------ drivers/dma-buf/dma-buf.c | 3 +-- drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c | 10 +++------- drivers/gpu/drm/amd/amdkfd/Kconfig | 2 +- drivers/gpu/drm/xe/tests/xe_dma_buf.c | 3 +-- drivers/gpu/drm/xe/xe_dma_buf.c | 12 ++++-------- 6 files changed, 10 insertions(+), 32 deletions(-)

diff --git a/drivers/dma-buf/Kconfig b/drivers/dma-buf/Kconfig index b46eb8a552d7..84d5e9b24e20 100644 --- a/drivers/dma-buf/Kconfig +++ b/drivers/dma-buf/Kconfig @@ -40,18 +40,6 @@ config UDMABUF A driver to let userspace turn memfd regions into dma-bufs. Qemu can use this to create host dmabufs for guest framebuffers. -config DMABUF_MOVE_NOTIFY

• bool "Move notify between drivers (EXPERIMENTAL)"
• default n
• depends on DMA_SHARED_BUFFER
• help

•  Don't pin buffers if the dynamic DMA-buf interface is available on
  

•  both the exporter as well as the importer. This fixes a security
  

•  problem where userspace is able to pin unrestricted amounts of memory
  

•  through DMA-buf.
  

•  This is marked experimental because we don't yet have a consistent
  

•  execution context and memory management between drivers.
  

config DMABUF_DEBUG bool "DMA-BUF debug checks" depends on DMA_SHARED_BUFFER diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index e12db540c413..cd68c1c0bfd7 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -847,8 +847,7 @@ static bool dma_buf_pin_on_map(struct dma_buf_attachment *attach) { return attach->dmabuf->ops->pin &&

• (!dma_buf_attachment_is_dynamic(attach) ||
  

•  !IS_ENABLED(CONFIG_DMABUF_MOVE_NOTIFY));
  

•       !dma_buf_attachment_is_dynamic(attach);
  

} /** diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c index cd4944ceb047..b7f85b8653cf 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_dma_buf.c @@ -133,13 +133,9 @@ static int amdgpu_dma_buf_pin(struct dma_buf_attachment *attach) * notifiers are disabled, only allow pinning in VRAM when move * notiers are enabled. */

• if (!IS_ENABLED(CONFIG_DMABUF_MOVE_NOTIFY)) {

• domains &= ~AMDGPU_GEM_DOMAIN_VRAM;
  

• } else {

• list_for_each_entry(attach, &dmabuf->attachments, node)
  

• 	if (!attach->peer2peer)
  

• 		domains &= ~AMDGPU_GEM_DOMAIN_VRAM;
  

• }

• list_for_each_entry(attach, &dmabuf->attachments, node)

• if (!attach->peer2peer)
  

• 	domains &= ~AMDGPU_GEM_DOMAIN_VRAM;
  

if (domains & AMDGPU_GEM_DOMAIN_VRAM) bo->flags |= AMDGPU_GEM_CREATE_CPU_ACCESS_REQUIRED; diff --git a/drivers/gpu/drm/amd/amdkfd/Kconfig b/drivers/gpu/drm/amd/amdkfd/Kconfig index 16e12c9913f9..a5d7467c2f34 100644 --- a/drivers/gpu/drm/amd/amdkfd/Kconfig +++ b/drivers/gpu/drm/amd/amdkfd/Kconfig @@ -27,7 +27,7 @@ config HSA_AMD_SVM config HSA_AMD_P2P bool "HSA kernel driver support for peer-to-peer for AMD GPU devices"

• depends on HSA_AMD && PCI_P2PDMA && DMABUF_MOVE_NOTIFY

• depends on HSA_AMD && PCI_P2PDMA help Enable peer-to-peer (P2P) communication between AMD GPUs over the PCIe bus. This can improve performance of multi-GPU compute

diff --git a/drivers/gpu/drm/xe/tests/xe_dma_buf.c b/drivers/gpu/drm/xe/tests/xe_dma_buf.c index 1f2cca5c2f81..c107687ef3c0 100644 --- a/drivers/gpu/drm/xe/tests/xe_dma_buf.c +++ b/drivers/gpu/drm/xe/tests/xe_dma_buf.c @@ -22,8 +22,7 @@ static bool p2p_enabled(struct dma_buf_test_params *params) static bool is_dynamic(struct dma_buf_test_params *params) {

• return IS_ENABLED(CONFIG_DMABUF_MOVE_NOTIFY) && params->attach_ops &&

• params->attach_ops->invalidate_mappings;
  

• return params->attach_ops && params->attach_ops->invalidate_mappings;

} static void check_residency(struct kunit *test, struct xe_bo *exported, diff --git a/drivers/gpu/drm/xe/xe_dma_buf.c b/drivers/gpu/drm/xe/xe_dma_buf.c index 1b9cd043e517..ea370cd373e9 100644 --- a/drivers/gpu/drm/xe/xe_dma_buf.c +++ b/drivers/gpu/drm/xe/xe_dma_buf.c @@ -56,14 +56,10 @@ static int xe_dma_buf_pin(struct dma_buf_attachment *attach) bool allow_vram = true; int ret;

• if (!IS_ENABLED(CONFIG_DMABUF_MOVE_NOTIFY)) {

• allow_vram = false;
  

• } else {

• list_for_each_entry(attach, &dmabuf->attachments, node) {
  

• 	if (!attach->peer2peer) {
  

• 		allow_vram = false;
  

• 		break;
  

• 	}
  

• list_for_each_entry(attach, &dmabuf->attachments, node) {

• if (!attach->peer2peer) {
  

• 	allow_vram = false;
  

• 	break;
  

  } }

On Fri, Jan 30, 2026 at 09:30:59AM +0100, Christian König wrote:

On 1/24/26 20:14, Leon Romanovsky wrote:

...

From: Leon Romanovsky leonro@nvidia.com

dma-buf invalidation is handled asynchronously by the hardware, so VFIO must wait until all affected objects have been fully invalidated.

In addition, the dma-buf exporter is expecting that all importers unmap any buffers they previously mapped.

Fixes: 5d74781ebc86 ("vfio/pci: Add dma-buf export support for MMIO regions") Signed-off-by: Leon Romanovsky leonro@nvidia.com

---

drivers/vfio/pci/vfio_pci_dmabuf.c | 71 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 68 insertions(+), 3 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c index d8ceafabef48..485515629fe4 100644 --- a/drivers/vfio/pci/vfio_pci_dmabuf.c +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c @@ -17,6 +17,8 @@ struct vfio_pci_dma_buf { struct dma_buf_phys_vec *phys_vec; struct p2pdma_provider *provider; u32 nr_ranges;

• struct kref kref;
• struct completion comp; u8 revoked : 1;

}; @@ -44,27 +46,46 @@ static int vfio_pci_dma_buf_attach(struct dma_buf *dmabuf, return 0; } +static void vfio_pci_dma_buf_done(struct kref *kref) +{

• struct vfio_pci_dma_buf *priv =

• container_of(kref, struct vfio_pci_dma_buf, kref);
  

• complete(&priv->comp);

+}

static struct sg_table * vfio_pci_dma_buf_map(struct dma_buf_attachment *attachment, enum dma_data_direction dir) { struct vfio_pci_dma_buf *priv = attachment->dmabuf->priv;

• struct sg_table *ret;

dma_resv_assert_held(priv->dmabuf->resv); if (priv->revoked) return ERR_PTR(-ENODEV);

• return dma_buf_phys_vec_to_sgt(attachment, priv->provider,

• 		       priv->phys_vec, priv->nr_ranges,
  

• 		       priv->size, dir);
  

• ret = dma_buf_phys_vec_to_sgt(attachment, priv->provider,

• 		      priv->phys_vec, priv->nr_ranges,
  

• 		      priv->size, dir);
  

• if (IS_ERR(ret))

• return ret;
  

• kref_get(&priv->kref);
• return ret;

} static void vfio_pci_dma_buf_unmap(struct dma_buf_attachment *attachment, struct sg_table *sgt, enum dma_data_direction dir) {

• struct vfio_pci_dma_buf *priv = attachment->dmabuf->priv;
• dma_resv_assert_held(priv->dmabuf->resv);
• dma_buf_free_sgt(attachment, sgt, dir);
• kref_put(&priv->kref, vfio_pci_dma_buf_done);

} static void vfio_pci_dma_buf_release(struct dma_buf *dmabuf) @@ -287,6 +308,9 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags, goto err_dev_put; }

• kref_init(&priv->kref);
• init_completion(&priv->comp);
• /* dma_buf_put() now frees priv */ INIT_LIST_HEAD(&priv->dmabufs_elm); down_write(&vdev->memory_lock);

@@ -326,6 +350,8 @@ void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked) lockdep_assert_held_write(&vdev->memory_lock); list_for_each_entry_safe(priv, tmp, &vdev->dmabufs, dmabufs_elm) {

• unsigned long wait;
  

• if (!get_file_active(&priv->dmabuf->file)) continue;

@@ -333,7 +359,37 @@ void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked) dma_resv_lock(priv->dmabuf->resv, NULL); priv->revoked = revoked; dma_buf_invalidate_mappings(priv->dmabuf);

• 	dma_resv_wait_timeout(priv->dmabuf->resv,
  

• 			      DMA_RESV_USAGE_BOOKKEEP, false,
  

• 			      MAX_SCHEDULE_TIMEOUT);
  dma_resv_unlock(priv->dmabuf->resv);
  

• 	if (revoked) {
  

• 		kref_put(&priv->kref, vfio_pci_dma_buf_done);
  

• 		/* Let's wait till all DMA unmap are completed. */
  

• 		wait = wait_for_completion_timeout(
  

• 			&priv->comp, secs_to_jiffies(1));
  

• 		/*
  

• 		 * If you see this WARN_ON, it means that
  

• 		 * importer didn't call unmap in response to
  

• 		 * dma_buf_invalidate_mappings() which is not
  

• 		 * allowed.
  

• 		 */
  

• 		WARN(!wait,
  

• 		     "Timed out waiting for DMABUF unmap, importer has a broken invalidate_mapping()");
  

You can do the revoke to do your resource management, for example re-use the backing store for something else.

But it is mandatory that you keep the mapping around indefinitely until the importer closes it.

Before that you can't do things like runtime PM or remove or anything which would make the DMA addresses invalid.

As far as I can see vfio_pci_dma_buf_move() is used exactly for that use case so this here is an absolutely clear NAK from my side for this approach.

You can either split up the functionality of vfio_pci_dma_buf_move() into vfio_pci_dma_buf_invalidate_mappings() and vfio_pci_dma_buf_flush() and then call the later whenever necessary or you keep it in one function and block everybody until the importer has dropped all mappings.

No problem, I can change it to be:

diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c index d087d018d547..53772a84c93b 100644 --- a/drivers/vfio/pci/vfio_pci_dmabuf.c +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c @@ -357,23 +357,7 @@ void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked) dma_resv_unlock(priv->dmabuf->resv); if (revoked) { kref_put(&priv->kref, vfio_pci_dma_buf_done); - /* - * Let's wait for 1 second till all DMA unmap - * are completed. It is supposed to catch dma-buf - * importers which lied about their support - * of dmabuf revoke. See dma_buf_invalidate_mappings() - * for the expected behaviour. - */ - wait = wait_for_completion_timeout( - &priv->comp, secs_to_jiffies(1)); - /* - * If you see this WARN_ON, it means that - * importer didn't call unmap in response to - * dma_buf_invalidate_mappings() which is not - * allowed. - */ - WARN(!wait, - "Timed out waiting for DMABUF unmap, importer has a broken invalidate_mapping()"); + wait_for_completion(&priv->comp); } else { /* * Kref is initialize again, because when revoke

Do you want me to send v6?

Thanks

...

• 	} else {
  

• 		/*
  

• 		 * Kref is initialize again, because when revoke
  

• 		 * was performed the reference counter was decreased
  

• 		 * to zero to trigger completion.
  

• 		 */
  

• 		kref_init(&priv->kref);
  

• 		/*
  

• 		 * There is no need to wait as no mapping was
  

• 		 * performed when the previous status was
  

• 		 * priv->revoked == true.
  

• 		 */
  

• 		reinit_completion(&priv->comp);
  

• 	}
  

  } fput(priv->dmabuf->file);

This is also extremely questionable. Why doesn't the dmabuf have a reference while on the linked list?

Regards, Christian.

...

} @@ -346,6 +402,8 @@ void vfio_pci_dma_buf_cleanup(struct vfio_pci_core_device *vdev) down_write(&vdev->memory_lock); list_for_each_entry_safe(priv, tmp, &vdev->dmabufs, dmabufs_elm) {

• unsigned long wait;
  

• if (!get_file_active(&priv->dmabuf->file)) continue;

@@ -354,7 +412,14 @@ void vfio_pci_dma_buf_cleanup(struct vfio_pci_core_device *vdev) priv->vdev = NULL; priv->revoked = true; dma_buf_invalidate_mappings(priv->dmabuf);

• dma_resv_wait_timeout(priv->dmabuf->resv,
  

• 		      DMA_RESV_USAGE_BOOKKEEP, false,
  

• 		      MAX_SCHEDULE_TIMEOUT);
  

  dma_resv_unlock(priv->dmabuf->resv);

• kref_put(&priv->kref, vfio_pci_dma_buf_done);
  

• wait = wait_for_completion_timeout(&priv->comp,
  

• 				   secs_to_jiffies(1));
  

• WARN_ON(!wait);
  

  vfio_device_put_registration(&vdev->vdev); fput(priv->dmabuf->file); }

On Fri, Jan 30, 2026 at 02:21:08PM +0100, Christian König wrote:

On 1/30/26 14:01, Leon Romanovsky wrote:

...

On Fri, Jan 30, 2026 at 09:30:59AM +0100, Christian König wrote:

...

On 1/24/26 20:14, Leon Romanovsky wrote:

...

From: Leon Romanovsky leonro@nvidia.com

dma-buf invalidation is handled asynchronously by the hardware, so VFIO must wait until all affected objects have been fully invalidated.

In addition, the dma-buf exporter is expecting that all importers unmap any buffers they previously mapped.

Fixes: 5d74781ebc86 ("vfio/pci: Add dma-buf export support for MMIO regions") Signed-off-by: Leon Romanovsky leonro@nvidia.com

---

drivers/vfio/pci/vfio_pci_dmabuf.c | 71 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 68 insertions(+), 3 deletions(-)

diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c index d8ceafabef48..485515629fe4 100644 --- a/drivers/vfio/pci/vfio_pci_dmabuf.c +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c @@ -17,6 +17,8 @@ struct vfio_pci_dma_buf { struct dma_buf_phys_vec *phys_vec; struct p2pdma_provider *provider; u32 nr_ranges;

• struct kref kref;
• struct completion comp; u8 revoked : 1;

}; @@ -44,27 +46,46 @@ static int vfio_pci_dma_buf_attach(struct dma_buf *dmabuf, return 0; } +static void vfio_pci_dma_buf_done(struct kref *kref) +{

• struct vfio_pci_dma_buf *priv =

• container_of(kref, struct vfio_pci_dma_buf, kref);
  

• complete(&priv->comp);

+}

static struct sg_table * vfio_pci_dma_buf_map(struct dma_buf_attachment *attachment, enum dma_data_direction dir) { struct vfio_pci_dma_buf *priv = attachment->dmabuf->priv;

• struct sg_table *ret;

dma_resv_assert_held(priv->dmabuf->resv); if (priv->revoked) return ERR_PTR(-ENODEV);

• return dma_buf_phys_vec_to_sgt(attachment, priv->provider,

• 		       priv->phys_vec, priv->nr_ranges,
  

• 		       priv->size, dir);
  

• ret = dma_buf_phys_vec_to_sgt(attachment, priv->provider,

• 		      priv->phys_vec, priv->nr_ranges,
  

• 		      priv->size, dir);
  

• if (IS_ERR(ret))

• return ret;
  

• kref_get(&priv->kref);
• return ret;

} static void vfio_pci_dma_buf_unmap(struct dma_buf_attachment *attachment, struct sg_table *sgt, enum dma_data_direction dir) {

• struct vfio_pci_dma_buf *priv = attachment->dmabuf->priv;
• dma_resv_assert_held(priv->dmabuf->resv);
• dma_buf_free_sgt(attachment, sgt, dir);
• kref_put(&priv->kref, vfio_pci_dma_buf_done);

} static void vfio_pci_dma_buf_release(struct dma_buf *dmabuf) @@ -287,6 +308,9 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_device *vdev, u32 flags, goto err_dev_put; }

• kref_init(&priv->kref);
• init_completion(&priv->comp);
• /* dma_buf_put() now frees priv */ INIT_LIST_HEAD(&priv->dmabufs_elm); down_write(&vdev->memory_lock);

@@ -326,6 +350,8 @@ void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked) lockdep_assert_held_write(&vdev->memory_lock); list_for_each_entry_safe(priv, tmp, &vdev->dmabufs, dmabufs_elm) {

• unsigned long wait;
  

• if (!get_file_active(&priv->dmabuf->file)) continue;

@@ -333,7 +359,37 @@ void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked) dma_resv_lock(priv->dmabuf->resv, NULL); priv->revoked = revoked; dma_buf_invalidate_mappings(priv->dmabuf);

• 	dma_resv_wait_timeout(priv->dmabuf->resv,
  

• 			      DMA_RESV_USAGE_BOOKKEEP, false,
  

• 			      MAX_SCHEDULE_TIMEOUT);
  dma_resv_unlock(priv->dmabuf->resv);
  

• 	if (revoked) {
  

• 		kref_put(&priv->kref, vfio_pci_dma_buf_done);
  

• 		/* Let's wait till all DMA unmap are completed. */
  

• 		wait = wait_for_completion_timeout(
  

• 			&priv->comp, secs_to_jiffies(1));
  

• 		/*
  

• 		 * If you see this WARN_ON, it means that
  

• 		 * importer didn't call unmap in response to
  

• 		 * dma_buf_invalidate_mappings() which is not
  

• 		 * allowed.
  

• 		 */
  

• 		WARN(!wait,
  

• 		     "Timed out waiting for DMABUF unmap, importer has a broken invalidate_mapping()");
  

You can do the revoke to do your resource management, for example re-use the backing store for something else.

But it is mandatory that you keep the mapping around indefinitely until the importer closes it.

Before that you can't do things like runtime PM or remove or anything which would make the DMA addresses invalid.

As far as I can see vfio_pci_dma_buf_move() is used exactly for that use case so this here is an absolutely clear NAK from my side for this approach.

You can either split up the functionality of vfio_pci_dma_buf_move() into vfio_pci_dma_buf_invalidate_mappings() and vfio_pci_dma_buf_flush() and then call the later whenever necessary or you keep it in one function and block everybody until the importer has dropped all mappings.

No problem, I can change it to be:

diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci_dmabuf.c index d087d018d547..53772a84c93b 100644 --- a/drivers/vfio/pci/vfio_pci_dmabuf.c +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c @@ -357,23 +357,7 @@ void vfio_pci_dma_buf_move(struct vfio_pci_core_device *vdev, bool revoked) dma_resv_unlock(priv->dmabuf->resv); if (revoked) { kref_put(&priv->kref, vfio_pci_dma_buf_done);

•                           /*
  

•                            * Let's wait for 1 second till all DMA unmap
  

•                            * are completed. It is supposed to catch dma-buf
  

•                            * importers which lied about their support
  

•                            * of dmabuf revoke. See dma_buf_invalidate_mappings()
  

•                            * for the expected behaviour.
  

•                            */
  

•                           wait = wait_for_completion_timeout(
  

•                                   &priv->comp, secs_to_jiffies(1));
  

•                           /*
  

•                            * If you see this WARN_ON, it means that
  

•                            * importer didn't call unmap in response to
  

•                            * dma_buf_invalidate_mappings() which is not
  

•                            * allowed.
  

•                            */
  

•                           WARN(!wait,
  

•                                "Timed out waiting for DMABUF unmap, importer has a broken invalidate_mapping()");
  

•                           wait_for_completion(&priv->comp);
                    } else {
                            /*
                             * Kref is initialize again, because when revoke
  
  

Do you want me to send v6?

That would work for me.

Question is if you really want to do it this way? See usually exporters try to avoid blocking such functions.

What exporters usually do instead is to grab references, e.g. call pm_runtime_get_sync() when either a DMA-buf, a DMA-buf attachment or in your case here a mapping of this attachment is made.

I view this as an enhancement that can be addressed later down the road.

But all of this is just a suggestion, if you are fine with blocking then feel free to add my rb.

It is fine for initial version. We need to start somewhere.

Thanks

Regards, Christian.

...

Thanks

...

...

• 	} else {
  

• 		/*
  

• 		 * Kref is initialize again, because when revoke
  

• 		 * was performed the reference counter was decreased
  

• 		 * to zero to trigger completion.
  

• 		 */
  

• 		kref_init(&priv->kref);
  

• 		/*
  

• 		 * There is no need to wait as no mapping was
  

• 		 * performed when the previous status was
  

• 		 * priv->revoked == true.
  

• 		 */
  

• 		reinit_completion(&priv->comp);
  

• 	}
  

  } fput(priv->dmabuf->file);

This is also extremely questionable. Why doesn't the dmabuf have a reference while on the linked list?

Regards, Christian.

...

} @@ -346,6 +402,8 @@ void vfio_pci_dma_buf_cleanup(struct vfio_pci_core_device *vdev) down_write(&vdev->memory_lock); list_for_each_entry_safe(priv, tmp, &vdev->dmabufs, dmabufs_elm) {

• unsigned long wait;
  

• if (!get_file_active(&priv->dmabuf->file)) continue;

@@ -354,7 +412,14 @@ void vfio_pci_dma_buf_cleanup(struct vfio_pci_core_device *vdev) priv->vdev = NULL; priv->revoked = true; dma_buf_invalidate_mappings(priv->dmabuf);

• dma_resv_wait_timeout(priv->dmabuf->resv,
  

• 		      DMA_RESV_USAGE_BOOKKEEP, false,
  

• 		      MAX_SCHEDULE_TIMEOUT);
  

  dma_resv_unlock(priv->dmabuf->resv);

• kref_put(&priv->kref, vfio_pci_dma_buf_done);
  

• wait = wait_for_completion_timeout(&priv->comp,
  

• 				   secs_to_jiffies(1));
  

• WARN_ON(!wait);
  

  vfio_device_put_registration(&vdev->vdev); fput(priv->dmabuf->file); }

On Fri, Jan 30, 2026 at 09:30:05AM +0100, Christian König wrote:

On 1/24/26 20:14, Leon Romanovsky wrote:

...

From: Leon Romanovsky leonro@nvidia.com

The .invalidate_mapping() callback is documented as optional, yet it effectively became mandatory whenever importer_ops were provided. This led to cases where RDMA non-ODP code had to supply an empty stub.

Relax the checks in the dma-buf core so the callback can be omitted, allowing RDMA code to drop the unnecessary function.

Removing the stub allows the next patch to tell that RDMA does not support .invalidate_mapping() by checking for a NULL op.

Signed-off-by: Leon Romanovsky leonro@nvidia.com

drivers/dma-buf/dma-buf.c | 6 ++---- drivers/infiniband/core/umem_dmabuf.c | 13 ------------- 2 files changed, 2 insertions(+), 17 deletions(-)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index cd68c1c0bfd7..1629312d364a 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -947,9 +947,6 @@ dma_buf_dynamic_attach(struct dma_buf *dmabuf, struct device *dev, if (WARN_ON(!dmabuf || !dev)) return ERR_PTR(-EINVAL);

• if (WARN_ON(importer_ops && !importer_ops->invalidate_mappings))

• return ERR_PTR(-EINVAL);
  

• attach = kzalloc(sizeof(*attach), GFP_KERNEL); if (!attach) return ERR_PTR(-ENOMEM);

@@ -1260,7 +1257,8 @@ void dma_buf_invalidate_mappings(struct dma_buf *dmabuf) dma_resv_assert_held(dmabuf->resv); list_for_each_entry(attach, &dmabuf->attachments, node)

• if (attach->importer_ops)
  

• if (attach->importer_ops &&
  

•     attach->importer_ops->invalidate_mappings)
  attach->importer_ops->invalidate_mappings(attach);
  

} EXPORT_SYMBOL_NS_GPL(dma_buf_invalidate_mappings, "DMA_BUF"); diff --git a/drivers/infiniband/core/umem_dmabuf.c b/drivers/infiniband/core/umem_dmabuf.c index d77a739cfe7a..256e34c15e6b 100644 --- a/drivers/infiniband/core/umem_dmabuf.c +++ b/drivers/infiniband/core/umem_dmabuf.c @@ -129,9 +129,6 @@ ib_umem_dmabuf_get_with_dma_device(struct ib_device *device, if (check_add_overflow(offset, (unsigned long)size, &end)) return ret;

• if (unlikely(!ops || !ops->invalidate_mappings))

You should probably keep "if (unlikely(!ops)).." here.

The unlikely is useless in this path.

Apart from that the patch looks good to me.

Regards, Christian.

...

• return ret;
  

• dmabuf = dma_buf_get(fd); if (IS_ERR(dmabuf)) return ERR_CAST(dmabuf);

@@ -184,18 +181,8 @@ struct ib_umem_dmabuf *ib_umem_dmabuf_get(struct ib_device *device, } EXPORT_SYMBOL(ib_umem_dmabuf_get); -static void -ib_umem_dmabuf_unsupported_move_notify(struct dma_buf_attachment *attach) -{

• struct ib_umem_dmabuf *umem_dmabuf = attach->importer_priv;
• ibdev_warn_ratelimited(umem_dmabuf->umem.ibdev,

• 	       "Invalidate callback should not be called when memory is pinned\n");
  

-}

static struct dma_buf_attach_ops ib_umem_dmabuf_attach_pinned_ops = { .allow_peer2peer = true,

• .invalidate_mappings = ib_umem_dmabuf_unsupported_move_notify,

}; struct ib_umem_dmabuf *

On 1/24/26 20:14, Leon Romanovsky wrote:

From: Leon Romanovsky leonro@nvidia.com

Some exporters need a flow to synchronously revoke access to the DMA-buf by importers. Once revoke is completed the importer is not permitted to touch the memory otherwise they may get IOMMU faults, AERs, or worse.

That approach is seriously not going to fly.

You can use the invalidate_mappings approach to trigger the importer to give back the mapping, but when the mapping is really given back is still completely on the importer side.

In other words you can't do the shot down revoke semantics you are trying to establish here.

Regards, Christian.

DMA-buf today defines a revoke flow, for both pinned and dynamic importers, which is broadly:

dma_resv_lock(dmabuf->resv, NULL); // Prevent new mappings from being established priv->revoked = true;

// Tell all importers to eventually unmap dma_buf_invalidate_mappings(dmabuf);

// Wait for any inprogress fences on the old mapping dma_resv_wait_timeout(dmabuf->resv, DMA_RESV_USAGE_BOOKKEEP, false, MAX_SCHEDULE_TIMEOUT); dma_resv_unlock(dmabuf->resv, NULL);

// Wait for all importers to complete unmap wait_for_completion(&priv->unmapped_comp);

This works well, and an importer that continues to access the DMA-buf after unmapping it is very buggy.

However, the final wait for unmap is effectively unbounded. Several importers do not support invalidate_mappings() at all and won't unmap until userspace triggers it.

This unbounded wait is not suitable for exporters like VFIO and RDMA tha need to issue revoke as part of their normal operations.

Add dma_buf_attach_revocable() to allow exporters to determine the difference between importers that can complete the above in bounded time, and those that can't. It can be called inside the exporter's attach op to reject incompatible importers.

Document these details about how dma_buf_invalidate_mappings() works and what the required sequence is to achieve a full revocation.

Signed-off-by: Leon Romanovsky leonro@nvidia.com

drivers/dma-buf/dma-buf.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++- include/linux/dma-buf.h | 9 +++------ 2 files changed, 50 insertions(+), 7 deletions(-)

diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 1629312d364a..f0e05227bda8 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -1242,13 +1242,59 @@ void dma_buf_unmap_attachment_unlocked(struct dma_buf_attachment *attach, } EXPORT_SYMBOL_NS_GPL(dma_buf_unmap_attachment_unlocked, "DMA_BUF"); +/**

• • dma_buf_attach_revocable - check if a DMA-buf importer implements
• • revoke semantics.
• • @attach: the DMA-buf attachment to check
• • Returns true if the DMA-buf importer can support the revoke sequence
• • explained in dma_buf_invalidate_mappings() within bounded time. Meaning the
• • importer implements invalidate_mappings() and ensures that unmap is called as
• • a result.
• */

+bool dma_buf_attach_revocable(struct dma_buf_attachment *attach) +{

• return attach->importer_ops &&

•       attach->importer_ops->invalidate_mappings;
  

+} +EXPORT_SYMBOL_NS_GPL(dma_buf_attach_revocable, "DMA_BUF");

/**

• dma_buf_invalidate_mappings - notify attachments that DMA-buf is moving
• @dmabuf: [in] buffer which is moving
• Informs all attachments that they need to destroy and recreate all their

• • mappings.

• • mappings. If the attachment is dynamic then the dynamic importer is expected
• • to invalidate any caches it has of the mapping result and perform a new
• • mapping request before allowing HW to do any further DMA.
• • If the attachment is pinned then this informs the pinned importer that the
• • underlying mapping is no longer available. Pinned importers may take this is
• • as a permanent revocation and never establish new mappings so exporters
• • should not trigger it lightly.
• • Upon return importers may continue to access the DMA-buf memory. The caller
• • must do two additional waits to ensure that the memory is no longer being
• • accessed:
• • 1. Until dma_resv_wait_timeout() retires fences the importer is allowed to

• • fully access the memory.
    

• • 2. Until the importer calls unmap it is allowed to speculatively

• • read-and-discard the memory. It must not write to the memory.
    

• • A caller wishing to use dma_buf_invalidate_mappings() to fully stop access to
• • the DMA-buf must wait for both. Dynamic callers can often use just the first.
• • All importers providing a invalidate_mappings() op must ensure that unmap is
• • called within bounded time after the op.
• • Pinned importers that do not support a invalidate_mappings() op will
• • eventually perform unmap when they are done with the buffer, which may be an
• • ubounded time from calling this function. dma_buf_attach_revocable() can be
• • used to prevent such importers from attaching.
• • Importers are free to request a new mapping in parallel as this function
• • returns.
  */

void dma_buf_invalidate_mappings(struct dma_buf *dmabuf) { diff --git a/include/linux/dma-buf.h b/include/linux/dma-buf.h index d5c3ce2b3aa4..84a7ec8f5359 100644 --- a/include/linux/dma-buf.h +++ b/include/linux/dma-buf.h @@ -468,12 +468,8 @@ struct dma_buf_attach_ops { * called with this lock held as well. This makes sure that no mapping * is created concurrently with an ongoing move operation. *

• * Mappings stay valid and are not directly affected by this callback.
  

• * But the DMA-buf can now be in a different physical location, so all
  

• * mappings should be destroyed and re-created as soon as possible.
  

• *
  

• * New mappings can be created after this callback returns, and will
  

• * point to the new location of the DMA-buf.
  

• * See the kdoc for dma_buf_invalidate_mappings() for details on the
  

• * required behavior.
  

  */ void (*invalidate_mappings)(struct dma_buf_attachment *attach);

}; @@ -601,6 +597,7 @@ struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *, void dma_buf_unmap_attachment(struct dma_buf_attachment *, struct sg_table *, enum dma_data_direction); void dma_buf_invalidate_mappings(struct dma_buf *dma_buf); +bool dma_buf_attach_revocable(struct dma_buf_attachment *attach); int dma_buf_begin_cpu_access(struct dma_buf *dma_buf, enum dma_data_direction dir); int dma_buf_end_cpu_access(struct dma_buf *dma_buf,