linux-toradex.git/drivers/iommu/iommufd, branch master

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

2026-04-17T04:21:55+00:00

Pull iommufd updates from Jason Gunthorpe:
 "Several fixes:

   - Add missing static const

   - Correct type 1 emulation for VFIO_CHECK_EXTENSION when no-iommu is
     turned on

   - Fix selftest memory leak and syzkaller splat

   - Fix missed -EFAULT in fault reporting write() fops

   - Fix a race where map/unmap with the internal IOVA allocator can
     unmap things it should not"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommufd: Fix a race with concurrent allocation and unmap
  iommufd/selftest: Remove MOCK_IOMMUPT_AMDV1 format
  iommufd: Fix return value of iommufd_fault_fops_write()
  iommufd: update outdated comment for renamed iommufd_hw_pagetable_alloc()
  iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}
  iommufd: vfio compatibility extension check for noiommu mode
  iommufd: Constify struct dma_buf_attach_ops

Merge tag 'iommu-updates-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux

2026-04-15T22:05:51+00:00

Pull iommu updates from Joerg Roedel:
 "Core:

   - Support for RISC-V IO-page-table format in generic iommupt code

  ARM-SMMU Updates:

   - Introduction of an "invalidation array" for SMMUv3, which enables
     future scalability work and optimisations for devices with a large
     number of SMMUv3 instances

   - Update the conditions under which the SMMUv3 driver works around
     hardware errata for invalidation on MMU-700 implementations

   - Fix broken command filtering for the host view of NVIDIA's "cmdqv"
     SMMUv3 extension

   - MMU-500 device-tree binding additions for Qualcomm Eliza & Hawi
     SoCs

  Intel VT-d:

   - Support for dirty tracking on domains attached to PASID

   - Removal of unnecessary read*()/write*() wrappers

   - Improvements to the invalidation paths

  AMD Vi:

   - Race-condition fixed in debugfs code

   - Make log buffer allocation NUMA aware

  RISC-V:

   - IO-TLB flushing improvements

   - Minor fixes"

* tag 'iommu-updates-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (48 commits)
  iommu/vt-d: Restore IOMMU_CAP_CACHE_COHERENCY
  dt-bindings: arm-smmu: qcom: Add compatible for Hawi SoC
  iommu/amd: Invalidate IRT cache for DMA aliases
  iommu/riscv: Remove overflows on the invalidation path
  iommu/amd: Fix clone_alias() to use the original device's devid
  iommu/vt-d: Remove the remaining pages along the invalidation path
  iommu/vt-d: Pass size_order to qi_desc_piotlb() not npages
  iommu/vt-d: Split piotlb invalidation into range and all
  iommu/vt-d: Remove dmar_writel() and dmar_writeq()
  iommu/vt-d: Remove dmar_readl() and dmar_readq()
  iommufd/selftest: Test dirty tracking on PASID
  iommu/vt-d: Support dirty tracking on PASID
  iommu/vt-d: Rename device_set_dirty_tracking() and pass dmar_domain pointer
  iommu/vt-d: Block PASID attachment to nested domain with dirty tracking
  iommu/dma: Always allow DMA-FQ when iommupt provides the iommu_domain
  iommu/riscv: Fix signedness bug
  iommu/amd: Fix illegal cap/mmio access in IOMMU debugfs
  iommu/amd: Fix illegal device-id access in IOMMU debugfs
  iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement
  iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init()
  ...

iommufd: Fix a race with concurrent allocation and unmap

2026-04-11T12:57:02+00:00

iopt_unmap_iova_range() releases the lock on iova_rwsem inside the loop
body when getting to the more expensive unmap operations. This is fine on
its own, except the loop condition is based on the first area that matches
the unmap address range. If a concurrent call to map picks an area that
was unmapped in previous iterations, the loop mistakenly tries to unmap
it.

This is reproducible by having one userspace thread map buffers and pass
them to another thread that unmaps them. The problem manifests as EBUSY
errors with single page mappings.

Fix this by advancing the start pointer after unmapping an area. This
ensures each iteration only examines the IOVA range that remains mapped,
which is guaranteed not to have overlaps.

Cc: stable@vger.kernel.org
Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping")
Link: https://patch.msgid.link/r/CAAJpGJSR4r_ds1JOjmkqHtsBPyxu8GntoeW08Sk5RNQPmgi+tg@mail.gmail.com
Signed-off-by: Sina Hassani 
Reviewed-by: Kevin Tian 
Signed-off-by: Jason Gunthorpe

iommufd/selftest: Remove MOCK_IOMMUPT_AMDV1 format

2026-03-31T16:13:08+00:00

syzbot found that allocating a mock domain with AMDV1 format could
cause a WARN_ON because the selftest enabled DYNAMIC_TOP without
providing the required driver_ops.

The AMDV1 format in the selftest was a placeholder and was not actually
used by any of the existing selftests. Instead of adding dummy
driver_ops to satisfy the requirements of a format we don't currently
test, remove the AMDV1 format option from the selftest.

The MOCK_IOMMUPT_DEFAULT and MOCK_IOMMUPT_HUGE formats are unaffected as
they use the amdv1_mock variant which does not enable DYNAMIC_TOP.

Fixes: dcd6a011a8d5 ("iommupt: Add map_pages op")
Link: https://patch.msgid.link/r/20260330092609.2659235-1-praan@google.com
Reported-by: syzbot+453eb7add07c3767adab@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69c1d50b.a70a0220.3cae05.0001.GAE@google.com/
Signed-off-by: Pranjal Shrivastava 
Signed-off-by: Jason Gunthorpe

iommufd: Fix return value of iommufd_fault_fops_write()

2026-03-31T16:12:18+00:00

copy_from_user() may return number of bytes failed to copy, we should
not pass over this number to user space to cheat that write() succeed.
Instead, -EFAULT should be returned.

Link: https://patch.msgid.link/r/20260330030755.12856-1-zhenzhong.duan@intel.com
Cc: stable@vger.kernel.org
Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object")
Signed-off-by: Zhenzhong Duan 
Reviewed-by: Lu Baolu 
Reviewed-by: Pranjal Shrivastava 
Reviewed-by: Shuai Xue 
Reviewed-by: Kevin Tian 
Signed-off-by: Jason Gunthorpe

iommufd: update outdated comment for renamed iommufd_hw_pagetable_alloc()

2026-03-25T12:35:14+00:00

The function iommufd_hw_pagetable_alloc() was renamed to
iommufd_hwpt_paging_alloc() by commit 89db31635c87
("iommufd: Derive iommufd_hwpt_paging from
iommufd_hw_pagetable").  Update the stale reference in
iommufd_device_auto_get_domain().

Link: https://patch.msgid.link/r/20260321105759.6832-1-kexinsun@smail.nju.edu.cn
Assisted-by: unnamed:deepseek-v3.2 coccinelle
Signed-off-by: Kexin Sun 
Signed-off-by: Jason Gunthorpe

iommufd: Report ATS not supported status via IOMMU_GET_HW_INFO

2026-03-17T13:05:05+00:00

If the IOMMU driver reports that ATS is not supported for a device, set
the IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED flag in the returned hardware
capabilities.

This uses a negative flag for UAPI compatibility. Existing userspace
assumes ATS is supported if no flag is present. This also ensures that
new userspace works correctly on both old and new kernels, where a
zero value implies ATS support.

When this flag is set, ATS cannot be used for the device. When it is
clear, ATS may be enabled when an appropriate HWPT is attached.

Reviewed-by: Samiullah Khawaja 
Reviewed-by: Jason Gunthorpe 
Signed-off-by: Shameer Kolothum 
Signed-off-by: Joerg Roedel

iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy}

2026-03-13T16:28:40+00:00

mock_viommu_init() allocates two pages using __get_free_pages(..., 1),
but its error path and mock_viommu_destroy() only release the first page
using free_page(), leaking the second page. Use free_pages() with the
matching order instead to avoid any page leaks.

Fixes: 80478a2b450e ("iommufd/selftest: Add coverage for the new mmap interface")
Link: https://patch.msgid.link/r/20260312164040.457293-3-thorsten.blum@linux.dev
Signed-off-by: Thorsten Blum 
Reviewed-by: Nicolin Chen 
Reviewed-by: Pranjal Shrivastava 
Signed-off-by: Jason Gunthorpe

iommufd: vfio compatibility extension check for noiommu mode

2026-03-03T00:29:01+00:00

VFIO_CHECK_EXTENSION should return false for TYPE1_IOMMU variants when
in NO-IOMMU mode and IOMMUFD compat container is set. This change makes
the behavior match VFIO_CONTAINER in noiommu mode. It also prevents
userspace from incorrectly attempting to use TYPE1 IOMMU operations
in a no-iommu context.

Fixes: d624d6652a65 ("iommufd: vfio container FD ioctl compatibility")
Link: https://patch.msgid.link/r/20260213183636.3340-1-jacob.pan@linux.microsoft.com
Signed-off-by: Jacob Pan 
Signed-off-by: Jason Gunthorpe

iommufd: Constify struct dma_buf_attach_ops

2026-03-03T00:24:52+00:00

'struct dma_buf_attach_ops' is not modified in this driver.

Constifying this structure moves some data to a read-only section, so
increases overall security, especially when the structure holds some
function pointers.

On a x86_64, with allmodconfig:
Before:
======
   text	   data	    bss	    dec	    hex	filename
  81096	  13899	    192	  95187	  173d3	drivers/iommu/iommufd/pages.o

After:
=====
   text	   data	    bss	    dec	    hex	filename
  81160	  13835	    192	  95187	  173d3	drivers/iommu/iommufd/pages.o

Link: https://patch.msgid.link/r/67e9126bbffa1d5c05124773a8dd4a3493be77ac.1772139886.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Christophe JAILLET 
Signed-off-by: Jason Gunthorpe