Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

Pull iommufd updates from Jason Gunthorpe:
 "Several bug fixes, probably found by AI based on the emails:

   - Several edge cases in the self test

   - Reject malformed invalidation commands in case the VMM let them
     through

   - Rework how the invalidation interface works to the drivers to be
     more robust and fix several Sashiko issues

   - Correct several error unwind paths

   - UAF during eventq file release

   - Reject more malformed usage of the dirty tracking by the VMM"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommupt: Do not allow PTEs to be split when dirty logging
  iommufd/iova_bitmap: Ensure that iova_bitmap_set() handles the full IOVA
  iommufd: Reject a zero-length dirty bitmap request
  iommufd/iova_bitmap: Fail GET_DIRTY_BITMAP when a bitmap page cannot be pinned
  iommufd: Fix event queue release use-after-free
  iommufd: Keep dmabuf PFNs MMIO when filling another domain
  iommufd: Keep reserved IOVA ranges when a replace within one IOAS fails
  iommufd: Fix iommufd_hw_capabilities reference in kernel-doc
  iommu/vt-d: Convert nested cache invalidation to the core array loop
  iommu/arm-smmu-v3-iommufd: Convert cache invalidation to the core array loop
  iommufd/selftest: Convert cache invalidation mocks to the core array loop
  iommufd: Iterate the cache invalidation array in the core
  iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands
  iommufd/selftest: Skip when the mock device is not there
  iommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET again

2 files changed, 6 insertions, 2 deletions

diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index ac43b8b93f14..05f7cee1375e 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -773,8 +773,10 @@ struct iommu_ops {
  *                         passes in the cache invalidation requests, in form
  *                         of a driver data structure. The driver must update
  *                         array->entry_num to report the number of handled
- *                         invalidation requests. The driver data structure
- *                         must be defined in include/uapi/linux/iommufd.h
+ *                         invalidation requests. A driver may handle fewer than
+ *                         the requested, in which case the core re-invokes the
+ *                         op for the remainder. The driver data structure must
+ *                         be defined in include/uapi/linux/iommufd.h
  * @iova_to_phys: translate iova to physical address
  * @enforce_cache_coherency: Prevent any kind of DMA from bypassing IOMMU_CACHE,
  *                           including no-snoop TLPs on PCIe or other platform
diff --git a/include/linux/iommufd.h b/include/linux/iommufd.h
index 6e7efe83bc5d..3087f5b2def8 100644
--- a/include/linux/iommufd.h
+++ b/include/linux/iommufd.h
@@ -154,6 +154,8 @@ struct iommufd_hw_queue {
  *                    The @array passes in the cache invalidation requests, in
  *                    form of a driver data structure. A driver must update the
  *                    array->entry_num to report the number of handled requests.
+ *                    A driver may handle fewer than the requested entry_num, in
+ *                    which case the core re-invokes the op for the remainder.
  *                    The data structure of the array entry must be defined in
  *                    include/uapi/linux/iommufd.h
  * @vdevice_size: Size of the driver-defined vDEVICE structure per this vIOMMU