From nobody Tue Feb 10 01:59:31 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D25ED19D8A8; Sat, 31 Jan 2026 05:34:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769837685; cv=none; b=VbFLufa8TMhL6XAfLD68gWBcWWIh/A4lAKCdHS03/ehLuKUfRu4j5GDLOg2RlSxsqrVCdh6IedeZ6EZ6CB/g1W5jligMtkIBFWkm0YqPkV7ubktnVg+YZL15XFibatFjaXKhzhGaDbFtq2XWprgzK6cRyKGbz6IxOMWNLIQyBlo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769837685; c=relaxed/simple; bh=PjtPaYCwW8GyC9UrsuJNBQBTLvXGRWhqJxW4W7K8RDk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=NzTSagFu02aSbn+fAcyyKq7lfcXjp4ax1ODmBNolsAK9AJngRQoSfFRTOMGrnhn/kDyU2Bc8s2DaCu7mQCJr4Gn0AhuX3afAEDVQTudY9v0UVZDy6KdIskN8mfo1+lw7K3+5lraqgJmvKMikMOc33iiAmzWDlDo0nDGmCRU82wg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=fAHoKYJS; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="fAHoKYJS" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DEB95C4CEF1; Sat, 31 Jan 2026 05:34:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1769837683; bh=PjtPaYCwW8GyC9UrsuJNBQBTLvXGRWhqJxW4W7K8RDk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fAHoKYJSQIA5FD5Z4jRtDfIY19kNDGT85pD1iLEg8Oy9RKKLvOKkqDJl6czg0goM2 7Kypx18/dEVqCGXsZvOcnsq1wiiilkdJBxb2zbB3cUxZJDlaMXTvIQoHrOYikE3l84 k0/Eay+eO2OkhTVIc/o/UGC+23sl99rLPLvAI/sjan5Zkpa+Tjbe4lJz+oy0ASme6x QM6n9G6UAEZugLn9nQLxCmHMyXZ0O+bSc6+Zj2Io+z+5NHREgUTHoduhxRyQuUpKTp P6EM3Rr+b7LVhd7jfpMYT+SRSi3ba2T+e5X9ym5YXIC5WIwFCdEPt3xprJYf9NEfGM LQdMwKUr87Opg== From: Leon Romanovsky To: Sumit Semwal , =?utf-8?q?Christian_K=C3=B6nig?= , Alex Deucher , David Airlie , Simona Vetter , Gerd Hoffmann , Dmitry Osipenko , Gurchetan Singh , Chia-I Wu , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Lucas De Marchi , =?utf-8?q?Thomas_Hellstr=C3=B6m?= , Rodrigo Vivi , Jason Gunthorpe , Leon Romanovsky , Kevin Tian , Joerg Roedel , Will Deacon , Robin Murphy , Felix Kuehling , Alex Williamson , Ankit Agrawal , Vivek Kasireddy Cc: linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, amd-gfx@lists.freedesktop.org, virtualization@lists.linux.dev, intel-xe@lists.freedesktop.org, linux-rdma@vger.kernel.org, iommu@lists.linux.dev, kvm@vger.kernel.org Subject: [PATCH v7 4/8] vfio: Wait for dma-buf invalidation to complete Date: Sat, 31 Jan 2026 07:34:14 +0200 Message-ID: <20260131-dmabuf-revoke-v7-4-463d956bd527@nvidia.com> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260131-dmabuf-revoke-v7-0-463d956bd527@nvidia.com> References: <20260131-dmabuf-revoke-v7-0-463d956bd527@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" X-Mailer: b4 0.15-dev-47773 Content-Transfer-Encoding: quoted-printable From: Leon Romanovsky dma-buf invalidation is handled asynchronously by the hardware, so VFIO must wait until all affected objects have been fully invalidated. In addition, the dma-buf exporter is expecting that all importers unmap any buffers they previously mapped. Fixes: 5d74781ebc86 ("vfio/pci: Add dma-buf export support for MMIO regions= ") Reviewed-by: Kevin Tian Signed-off-by: Leon Romanovsky Reviewed-by: Alex Williamson --- drivers/vfio/pci/vfio_pci_dmabuf.c | 61 ++++++++++++++++++++++++++++++++++= +--- 1 file changed, 57 insertions(+), 4 deletions(-) diff --git a/drivers/vfio/pci/vfio_pci_dmabuf.c b/drivers/vfio/pci/vfio_pci= _dmabuf.c index d8ceafabef48..78d47e260f34 100644 --- a/drivers/vfio/pci/vfio_pci_dmabuf.c +++ b/drivers/vfio/pci/vfio_pci_dmabuf.c @@ -17,6 +17,8 @@ struct vfio_pci_dma_buf { struct dma_buf_phys_vec *phys_vec; struct p2pdma_provider *provider; u32 nr_ranges; + struct kref kref; + struct completion comp; u8 revoked : 1; }; =20 @@ -44,27 +46,46 @@ static int vfio_pci_dma_buf_attach(struct dma_buf *dmab= uf, return 0; } =20 +static void vfio_pci_dma_buf_done(struct kref *kref) +{ + struct vfio_pci_dma_buf *priv =3D + container_of(kref, struct vfio_pci_dma_buf, kref); + + complete(&priv->comp); +} + static struct sg_table * vfio_pci_dma_buf_map(struct dma_buf_attachment *attachment, enum dma_data_direction dir) { struct vfio_pci_dma_buf *priv =3D attachment->dmabuf->priv; + struct sg_table *ret; =20 dma_resv_assert_held(priv->dmabuf->resv); =20 if (priv->revoked) return ERR_PTR(-ENODEV); =20 - return dma_buf_phys_vec_to_sgt(attachment, priv->provider, - priv->phys_vec, priv->nr_ranges, - priv->size, dir); + ret =3D dma_buf_phys_vec_to_sgt(attachment, priv->provider, + priv->phys_vec, priv->nr_ranges, + priv->size, dir); + if (IS_ERR(ret)) + return ret; + + kref_get(&priv->kref); + return ret; } =20 static void vfio_pci_dma_buf_unmap(struct dma_buf_attachment *attachment, struct sg_table *sgt, enum dma_data_direction dir) { + struct vfio_pci_dma_buf *priv =3D attachment->dmabuf->priv; + + dma_resv_assert_held(priv->dmabuf->resv); + dma_buf_free_sgt(attachment, sgt, dir); + kref_put(&priv->kref, vfio_pci_dma_buf_done); } =20 static void vfio_pci_dma_buf_release(struct dma_buf *dmabuf) @@ -287,6 +308,9 @@ int vfio_pci_core_feature_dma_buf(struct vfio_pci_core_= device *vdev, u32 flags, goto err_dev_put; } =20 + kref_init(&priv->kref); + init_completion(&priv->comp); + /* dma_buf_put() now frees priv */ INIT_LIST_HEAD(&priv->dmabufs_elm); down_write(&vdev->memory_lock); @@ -331,9 +355,33 @@ void vfio_pci_dma_buf_move(struct vfio_pci_core_device= *vdev, bool revoked) =20 if (priv->revoked !=3D revoked) { dma_resv_lock(priv->dmabuf->resv, NULL); - priv->revoked =3D revoked; + if (revoked) + priv->revoked =3D true; dma_buf_invalidate_mappings(priv->dmabuf); + dma_resv_wait_timeout(priv->dmabuf->resv, + DMA_RESV_USAGE_BOOKKEEP, false, + MAX_SCHEDULE_TIMEOUT); dma_resv_unlock(priv->dmabuf->resv); + if (revoked) { + kref_put(&priv->kref, vfio_pci_dma_buf_done); + wait_for_completion(&priv->comp); + } else { + /* + * Kref is initialize again, because when revoke + * was performed the reference counter was decreased + * to zero to trigger completion. + */ + kref_init(&priv->kref); + /* + * There is no need to wait as no mapping was + * performed when the previous status was + * priv->revoked =3D=3D true. + */ + reinit_completion(&priv->comp); + dma_resv_lock(priv->dmabuf->resv, NULL); + priv->revoked =3D false; + dma_resv_unlock(priv->dmabuf->resv); + } } fput(priv->dmabuf->file); } @@ -354,7 +402,12 @@ void vfio_pci_dma_buf_cleanup(struct vfio_pci_core_dev= ice *vdev) priv->vdev =3D NULL; priv->revoked =3D true; dma_buf_invalidate_mappings(priv->dmabuf); + dma_resv_wait_timeout(priv->dmabuf->resv, + DMA_RESV_USAGE_BOOKKEEP, false, + MAX_SCHEDULE_TIMEOUT); dma_resv_unlock(priv->dmabuf->resv); + kref_put(&priv->kref, vfio_pci_dma_buf_done); + wait_for_completion(&priv->comp); vfio_device_put_registration(&vdev->vdev); fput(priv->dmabuf->file); } --=20 2.52.0