Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

Pull iommufd updates from Jason Gunthorpe:
 "Several bug fixes, probably found by AI based on the emails:

   - Several edge cases in the self test

   - Reject malformed invalidation commands in case the VMM let them
     through

   - Rework how the invalidation interface works to the drivers to be
     more robust and fix several Sashiko issues

   - Correct several error unwind paths

   - UAF during eventq file release

   - Reject more malformed usage of the dirty tracking by the VMM"

* tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd:
  iommupt: Do not allow PTEs to be split when dirty logging
  iommufd/iova_bitmap: Ensure that iova_bitmap_set() handles the full IOVA
  iommufd: Reject a zero-length dirty bitmap request
  iommufd/iova_bitmap: Fail GET_DIRTY_BITMAP when a bitmap page cannot be pinned
  iommufd: Fix event queue release use-after-free
  iommufd: Keep dmabuf PFNs MMIO when filling another domain
  iommufd: Keep reserved IOVA ranges when a replace within one IOAS fails
  iommufd: Fix iommufd_hw_capabilities reference in kernel-doc
  iommu/vt-d: Convert nested cache invalidation to the core array loop
  iommu/arm-smmu-v3-iommufd: Convert cache invalidation to the core array loop
  iommufd/selftest: Convert cache invalidation mocks to the core array loop
  iommufd: Iterate the cache invalidation array in the core
  iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands
  iommufd/selftest: Skip when the mock device is not there
  iommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET again

1 files changed, 10 insertions, 2 deletions

diff --git a/include/uapi/linux/iommufd.h b/include/uapi/linux/iommufd.h
index 206fa667c782..010f47f7d3d2 100644
--- a/include/uapi/linux/iommufd.h
+++ b/include/uapi/linux/iommufd.h
@@ -776,7 +776,7 @@ enum iommufd_hw_info_flags {
  * @out_data_type: Output the iommu hardware info type as defined in the enum
  *                 iommu_hw_info_type.
  * @out_capabilities: Output the generic iommu capability info type as defined
- *                    in the enum iommu_hw_capabilities.
+ *                    in the enum iommufd_hw_capabilities.
  * @out_max_pasid_log2: Output the width of PASIDs. 0 means no PASID support.
  *                      PCI devices turn to out_capabilities to check if the
  *                      specific capabilities is supported or not.
@@ -871,6 +871,12 @@ enum iommufd_hwpt_get_dirty_bitmap_flags {
  * Walk the IOMMU pagetables for a given IOVA range to return a bitmap
  * with the dirty IOVAs. In doing so it will also by default clear any
  * dirty bit metadata set in the IOPTE.
+ *
+ * The IOVA range given must fully enclose any IOPTE. If the range starts or
+ * ends inside a dirty IOPTE then the ioctl will fail. This avoids partially
+ * reporting a dirty range.
+ *
+ * On failure the dirty state becomes unknown and the userspace must restart.
  */
 struct iommu_hwpt_get_dirty_bitmap {
 	__u32 size;
@@ -948,7 +954,9 @@ struct iommu_hwpt_vtd_s1_invalidate {
  *     CMDQ_OP_CFGI_CD
  *     CMDQ_OP_CFGI_CD_ALL
  *
- * -EIO will be returned if the command is not supported.
+ * User space must forward only valid commands: the kernel rejects, with
+ * -EIO, any command carrying an unsupported opcode, an unsupported field,
+ * or a field value that the underlying SMMU hardware does not implement.
  */
 struct iommu_viommu_arm_smmuv3_invalidate {
 	__aligned_le64 cmd[2];