From a9c7b86b03e4bb358b8b9614465ee15a45ddbccd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Fri, 22 May 2026 16:59:43 +0200 Subject: [PATCH 01/93] iommu/riscv: Drop superfluous zeros in pci_device_id array MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The .driver_data member of the struct pci_device_id array were initialized by a list expressions to zero without making use of that value. In this case it's better to not specify a value at all and let the compiler fill in the zeros. Same for the list terminator that can better be completely empty. Signed-off-by: Uwe Kleine-König (The Capable Hub) Reviewed-by: Robin Murphy Signed-off-by: Joerg Roedel --- drivers/iommu/riscv/iommu-pci.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/riscv/iommu-pci.c b/drivers/iommu/riscv/iommu-pci.c index d82d2b00904c..8abf52dfb4c9 100644 --- a/drivers/iommu/riscv/iommu-pci.c +++ b/drivers/iommu/riscv/iommu-pci.c @@ -109,9 +109,9 @@ static void riscv_iommu_pci_shutdown(struct pci_dev *pdev) } static const struct pci_device_id riscv_iommu_pci_tbl[] = { - {PCI_VDEVICE(REDHAT, PCI_DEVICE_ID_REDHAT_RISCV_IOMMU), 0}, - {PCI_VDEVICE(RIVOS, PCI_DEVICE_ID_RIVOS_RISCV_IOMMU_GA), 0}, - {0,} + { PCI_VDEVICE(REDHAT, PCI_DEVICE_ID_REDHAT_RISCV_IOMMU) }, + { PCI_VDEVICE(RIVOS, PCI_DEVICE_ID_RIVOS_RISCV_IOMMU_GA) }, + { } }; static struct pci_driver riscv_iommu_pci_driver = { From 4f2cd6091ac41566a7300f5a4590d20a99aaa8bc Mon Sep 17 00:00:00 2001 From: Pranjal Shrivastava Date: Mon, 15 Jun 2026 23:50:34 +0000 Subject: [PATCH 02/93] PCI/ATS: Ensure pci_ats_supported() is PF-aware for VFs Update pci_ats_supported() to additionally check the associated PF's status when called on a VF. This ensures that PF-level quirks and untrusted status are correctly propagated to VFs, providing a robust support check that aligns with the kernel's PF-centric ATS configuration model and is immune to the timing of VF-specific fixups. Reviewed-by: Jason Gunthorpe Reviewed-by: Samiullah Khawaja Reviewed-by: Nicolin Chen Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Acked-by: Bjorn Helgaas Signed-off-by: Pranjal Shrivastava Signed-off-by: Joerg Roedel --- drivers/pci/ats.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/pci/ats.c b/drivers/pci/ats.c index 96efa00d9743..679a3c3c1d54 100644 --- a/drivers/pci/ats.c +++ b/drivers/pci/ats.c @@ -40,10 +40,13 @@ void pci_ats_init(struct pci_dev *dev) */ bool pci_ats_supported(struct pci_dev *dev) { - if (!dev->ats_cap) + if (!dev->ats_cap || dev->untrusted) return false; - return (dev->untrusted == 0); + if (dev->is_virtfn) + return pci_ats_supported(pci_physfn(dev)); + + return true; } EXPORT_SYMBOL_GPL(pci_ats_supported); From 6fd7c5c81af233e1745d23c1f5d44a8a04c92209 Mon Sep 17 00:00:00 2001 From: Pranjal Shrivastava Date: Mon, 15 Jun 2026 23:50:35 +0000 Subject: [PATCH 03/93] PCI/ATS: Validate STU for VFs in pci_prepare_ats() While every PCI Function that implements ATS has an independent ATS Extended Capability structure with a Read/Write Smallest Translation Unit (STU) field, the kernel manages SR-IOV ATS by requiring the IOMMU driver to configure the STU on the Physical Function (PF) before any any Virtual Functions (VFs) are created. Currently, pci_prepare_ats() bails out early for VFs, assuming that the PF has already been correctly prepared. However, this creates a potential mismatch if a VF is subsequently prepared with a different page shift. Update pci_prepare_ats() to validate that the requested page shift (ps) matches the STU already configured in the associated PF. This ensures early detection of incompatible configurations and maintains the kernel's policy of consistent STU sizing across all functions associated with a given SMMU. Reviewed-by: Jason Gunthorpe Reviewed-by: Samiullah Khawaja Reviewed-by: Nicolin Chen Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Acked-by: Bjorn Helgaas Signed-off-by: Pranjal Shrivastava Signed-off-by: Joerg Roedel --- drivers/pci/ats.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/pci/ats.c b/drivers/pci/ats.c index 679a3c3c1d54..9cb23780093d 100644 --- a/drivers/pci/ats.c +++ b/drivers/pci/ats.c @@ -73,8 +73,12 @@ int pci_prepare_ats(struct pci_dev *dev, int ps) if (ps < PCI_ATS_MIN_STU) return -EINVAL; - if (dev->is_virtfn) + if (dev->is_virtfn) { + if (pci_physfn(dev)->ats_stu != ps) + return -EINVAL; + return 0; + } dev->ats_stu = ps; ctrl = PCI_ATS_CTRL_STU(dev->ats_stu - PCI_ATS_MIN_STU); From d23da7b8d63e77e5c09174dc8b859c653698b8ea Mon Sep 17 00:00:00 2001 From: Pranjal Shrivastava Date: Mon, 15 Jun 2026 23:50:36 +0000 Subject: [PATCH 04/93] iommu/arm-smmu-v3: Standardize ATS enablement failure reporting Update arm_smmu_enable_ats() to wrap the pci_enable_ats() call in a WARN(). Since probe-time checks now preclude configuration errors any failure during hardware enablement is considered a kernel bug. Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Reviewed-by: Samiullah Khawaja Reviewed-by: Jason Gunthorpe Signed-off-by: Pranjal Shrivastava Signed-off-by: Joerg Roedel --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index a10affb483a4..57b750ebcd3d 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2956,8 +2956,13 @@ static void arm_smmu_enable_ats(struct arm_smmu_master *master) * ATC invalidation of PASID 0 causes the entire ATC to be flushed. */ arm_smmu_atc_inv_master(master, IOMMU_NO_PASID); - if (pci_enable_ats(pdev, stu)) - dev_err(master->dev, "Failed to enable ATS (STU %zu)\n", stu); + + /* + * Since pci_prepare_ats() has already verified the HW capability + * and programmed the STE, pci_enable_ats() should not fail here. + */ + WARN(pci_enable_ats(pdev, stu), + "%s: Failed to enable ATS (STU %zu)\n", dev_name(master->dev), stu); } static int arm_smmu_enable_pasid(struct arm_smmu_master *master) From eab000d501af568fe98d760f16eadd43d219df50 Mon Sep 17 00:00:00 2001 From: Pranjal Shrivastava Date: Mon, 15 Jun 2026 23:50:37 +0000 Subject: [PATCH 05/93] iommu/vt-d: Fail probe on ATS configuration failure Update the Intel VT-d driver to handle ATS configuration and enablement more strictly. Specifically, update the device probe to fail if pci_prepare_ats() returns an error. This ensures that any ATS-capable master reaching the attach phase is guaranteed to have a valid config. Additionally, update iommu_enable_pci_ats() to WARN() if pci_enable_ats fails. Since earlier checks in the probe phase preclude config-related failures, any failure during hardware enablement is considered a kernel bug. Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Reviewed-by: Samiullah Khawaja Reviewed-by: Jason Gunthorpe Signed-off-by: Pranjal Shrivastava Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 849d06dfe1ae..f39451323553 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -876,8 +876,14 @@ static void iommu_enable_pci_ats(struct device_domain_info *info) if (!pci_ats_page_aligned(pdev)) return; - if (!pci_enable_ats(pdev, VTD_PAGE_SHIFT)) - info->ats_enabled = 1; + /* + * pci_enable_ats() should not fail here because earlier checks + * have already verified support and configuration. + */ + if (WARN_ON(pci_enable_ats(pdev, VTD_PAGE_SHIFT))) + return; + + info->ats_enabled = 1; } static void iommu_disable_pci_ats(struct device_domain_info *info) @@ -3292,7 +3298,10 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev) dev_iommu_priv_set(dev, info); if (pdev && pci_ats_supported(pdev)) { - pci_prepare_ats(pdev, VTD_PAGE_SHIFT); + ret = pci_prepare_ats(pdev, VTD_PAGE_SHIFT); + if (ret) + goto free; + ret = device_rbtree_insert(iommu, info); if (ret) goto free; From aebaa93f3da1572877579c2e15ebf27be2dcc7fb Mon Sep 17 00:00:00 2001 From: Akari Tsuyukusa Date: Mon, 29 Jun 2026 23:59:44 +0900 Subject: [PATCH 06/93] iommu/mediatek-v1: Fix off-by-one in MT2701_LARB_NR_MAX The mt2701_m4u_in_larb[] array contains 4 (for LARB0 to LARB3) elements, meaning mt2701_m4u_to_larb() can legitimately return 3. The current check `if (larbid >= MT2701_LARB_NR_MAX)` incorrectly rejects valid LARB3 with -EINVAL. Fix this off-by-one error by updating MT2701_LARB_NR_MAX to 4. Note that this does not cause immediate issues with the current mt2701.dtsi and mt7623n.dtsi because it only defines 3 LARBs: mediatek,larbs = <&larb0 &larb1 &larb2>; Thus, larbid never reaches 3 in the existing upstream device tree. Fixes: de78657e16f4 ("iommu/mediatek: Fix NULL pointer dereference when printing dev_name") Signed-off-by: Akari Tsuyukusa Signed-off-by: Joerg Roedel --- drivers/iommu/mtk_iommu_v1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/mtk_iommu_v1.c b/drivers/iommu/mtk_iommu_v1.c index ac97dd2868d4..e907c9953142 100644 --- a/drivers/iommu/mtk_iommu_v1.c +++ b/drivers/iommu/mtk_iommu_v1.c @@ -88,7 +88,7 @@ struct dma_iommu_mapping { /* MTK generation one iommu HW only support 4K size mapping */ #define MT2701_IOMMU_PAGE_SHIFT 12 #define MT2701_IOMMU_PAGE_SIZE (1UL << MT2701_IOMMU_PAGE_SHIFT) -#define MT2701_LARB_NR_MAX 3 +#define MT2701_LARB_NR_MAX 4 /* * MTK m4u support 4GB iova address space, and only support 4K page From e02e968159851cbb4deb2a0555ebaa3a6e7ced3b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicol=C3=A1s=20Antinori?= Date: Mon, 29 Jun 2026 17:10:41 -0300 Subject: [PATCH 07/93] rust: iommu: replace core::mem::zeroed with Zeroable::zeroed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All types in `bindings` implement `Zeroable` if they can. This enables using `Zeroable::zeroed` for `io_pgtable_cfg` initialization instead of relying on `..unsafe { core::mem::zeroed() }`. This change improves readability and removes an unnecessary unsafe block. Link: https://github.com/Rust-for-Linux/linux/issues/1189 Suggested-by: Benno Lossin Signed-off-by: Nicolás Antinori Acked-by: Gary Guo Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Signed-off-by: Joerg Roedel --- rust/kernel/iommu/pgtable.rs | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/rust/kernel/iommu/pgtable.rs b/rust/kernel/iommu/pgtable.rs index c88e38fd938a..eddda8d9d62a 100644 --- a/rust/kernel/iommu/pgtable.rs +++ b/rust/kernel/iommu/pgtable.rs @@ -102,8 +102,7 @@ pub unsafe fn new_raw(dev: &Device, config: Config) -> Result Date: Thu, 2 Jul 2026 01:24:11 +0300 Subject: [PATCH 08/93] iommu/msm: Return -ENOMEM on memory allocation failure in probe If dynamic memory allocation in driver's probe function execution fails, it should be reported to the driver's framework with -ENOMEM error code. Fixes: 109bd48ea2e1 ("iommu/msm: Add DT adaptation") Signed-off-by: Vladimir Zapolskiy Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Joerg Roedel --- drivers/iommu/msm_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c index 0ad5ff431d5b..708baeb29c03 100644 --- a/drivers/iommu/msm_iommu.c +++ b/drivers/iommu/msm_iommu.c @@ -720,7 +720,7 @@ static int msm_iommu_probe(struct platform_device *pdev) iommu = devm_kzalloc(&pdev->dev, sizeof(*iommu), GFP_KERNEL); if (!iommu) - return -ENODEV; + return -ENOMEM; iommu->dev = &pdev->dev; INIT_LIST_HEAD(&iommu->ctx_list); From 854056480f9217568e3ab5edd81a9347a173ea79 Mon Sep 17 00:00:00 2001 From: Wei Wang Date: Thu, 2 Jul 2026 22:40:18 +0800 Subject: [PATCH 09/93] iommu/amd: Prevent SB IOAPIC from overriding IVRS validation errors The check_ioapic_information() function validates IOAPICs against the IVRS table to safely disable Interrupt Remapping (IR) if the BIOS provides a broken topology. Currently, the validation loop contains a bug: If an unmapped secondary IOAPIC is encountered, 'ret' is set to false. But if the Southbridge (SB) IOAPIC is enumerated after it in the MADT, the loop overwrites 'ret' to true. This bypasses the validation failure and leaves IR enabled. When devices attached to the unmapped secondary IOAPIC fire interrupts, the IOMMU drops them due to the missing Requestor ID, leading to localized device hangs. Fix this by initializing 'ret' to true and only toggling it to false upon encountering a validation error, ensuring failures are never erased. Fixes: c2ff5cf5294b ("iommu/amd: Work around wrong IOAPIC device-id in IVRS table") Signed-off-by: Wei Wang Tested-by: Yongwei Xu Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel --- drivers/iommu/amd/init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index e93bcb5eef70..f983b1961847 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -3098,7 +3098,7 @@ static bool __init check_ioapic_information(void) int idx; has_sb_ioapic = false; - ret = false; + ret = true; /* * If we have map overrides on the kernel command line the @@ -3123,7 +3123,6 @@ static bool __init check_ioapic_information(void) boot_cpu_data.x86_model <= 0xf && devid == IOAPIC_SB_DEVID_FAM18H_M4H)) { has_sb_ioapic = true; - ret = true; } } @@ -3137,6 +3136,7 @@ static bool __init check_ioapic_information(void) * device id for the IOAPIC in the system. */ pr_err("%s: No southbridge IOAPIC found\n", fw_bug); + ret = false; } if (!ret) From 04fee302fac762a242ff1ad6810cff90c2a350ba Mon Sep 17 00:00:00 2001 From: Wei Wang Date: Thu, 2 Jul 2026 22:40:19 +0800 Subject: [PATCH 10/93] iommu/amd: Fix false positive in SB IOAPIC IVRS validation The check_ioapic_information() function is designed to prevent boot hangs by ensuring the Southbridge (SB) IOAPIC is properly mapped in the IVRS table before enabling Interrupt Remapping. Currently, this check passes if *any* enumerated IOAPIC matches the expected SB IOAPIC device ID. If a buggy BIOS incorrectly assigns the SB IOAPIC's device ID to a secondary IOAPIC in the IVRS, while scrambling the true SB IOAPIC's mapping, the check hits a false positive and succeeds. This erroneously enables Interrupt Remapping. Consequently, the IOMMU blocks unmapped interrupts from the actual SB IOAPIC, dropping the system timer and leading to a silent kernel boot hang. Tighten the validation to verify the device ID specifically against the SB IOAPIC by matching their APIC IDs first. This prevents the validation check from being bypassed via device ID aliasing. Fixes: c2ff5cf5294b ("iommu/amd: Work around wrong IOAPIC device-id in IVRS table") Signed-off-by: Wei Wang Tested-by: Yongwei Xu Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel --- drivers/iommu/amd/init.c | 32 ++++++++++++++++++++++++++++---- 1 file changed, 28 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index f983b1961847..9e07f7c4196f 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -3091,11 +3091,25 @@ static void __init free_iommu_resources(void) /* SB IOAPIC for Hygon family 18h model 4h is on the device 0xb */ #define IOAPIC_SB_DEVID_FAM18H_M4H ((0x00 << 8) | PCI_DEVFN(0xb, 0)) +/* + * The Southbridge IOAPIC is assigned a GSI Base of 0 (handling interrupts + * 0 through 23). + */ +static int __init get_sb_ioapic_id(void) +{ + int idx = mp_find_ioapic(0); + + if (idx < 0) + return -ENODEV; + + return mpc_ioapic_id(idx); +} + static bool __init check_ioapic_information(void) { const char *fw_bug = FW_BUG; bool ret, has_sb_ioapic; - int idx; + int idx, sb_apicid; has_sb_ioapic = false; ret = true; @@ -3108,6 +3122,16 @@ static bool __init check_ioapic_information(void) if (cmdline_maps) fw_bug = ""; + sb_apicid = get_sb_ioapic_id(); + if (sb_apicid < 0) { + /* + * Lack of SB IOAPIC registration is not a firmware bug, + * e.g. kernel booted with noapic or noacpi. + */ + fw_bug = ""; + goto out; + } + for (idx = 0; idx < nr_ioapics; idx++) { int devid, id = mpc_ioapic_id(idx); @@ -3116,16 +3140,16 @@ static bool __init check_ioapic_information(void) pr_err("%s: IOAPIC[%d] not in IVRS table\n", fw_bug, id); ret = false; - } else if (devid == IOAPIC_SB_DEVID || + } else if (id == sb_apicid && (devid == IOAPIC_SB_DEVID || (boot_cpu_data.x86_vendor == X86_VENDOR_HYGON && boot_cpu_data.x86 == 0x18 && boot_cpu_data.x86_model >= 0x4 && boot_cpu_data.x86_model <= 0xf && - devid == IOAPIC_SB_DEVID_FAM18H_M4H)) { + devid == IOAPIC_SB_DEVID_FAM18H_M4H))) { has_sb_ioapic = true; } } - +out: if (!has_sb_ioapic) { /* * We expect the SB IOAPIC to be listed in the IVRS From 16f52863b2ec04352e29c978022bc08a3635f0b2 Mon Sep 17 00:00:00 2001 From: Wei Wang Date: Thu, 2 Jul 2026 22:40:20 +0800 Subject: [PATCH 11/93] iommu/amd: Dynamically verify Southbridge IOAPIC via PCI config space check_ioapic_information() verifies whether the BIOS has provided a valid device ID for the Southbridge (SB) IOAPIC in the IVRS table. Currently, if the SB IOAPIC entry in the IVRS table does not match a historically hardcoded device ID (00:14.0), interrupt remapping is forcibly disabled. This hardcoded expectation does not scale to newer architectures. For example, recent Hygon Gen 4 servers use 00:0b.0 for the SB IOAPIC, which originally caused the validation to fail and interrupt remapping to be disabled until this device ID was added upstream. Instead of maintaining per-vendor/per-generation hardcoded device IDs, dynamically verify the SB IOAPIC by reading its PCI configuration space. Because the SB IOAPIC is embedded within the FCH (Fusion Controller Hub) and shares its device ID, we can inspect the PCI class code of the given device ID to confirm it is an actual FCH device (a SMBus controller or ISA Bridge). Signed-off-by: Wei Wang Tested-by: Yongwei Xu Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel --- drivers/iommu/amd/init.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index 9e07f7c4196f..c0748521dff8 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -3085,11 +3085,21 @@ static void __init free_iommu_resources(void) free_pci_segments(); } -/* SB IOAPIC is always on this device in AMD systems */ -#define IOAPIC_SB_DEVID ((0x00 << 8) | PCI_DEVFN(0x14, 0)) +static bool __init check_sb_ioapic(int devid) +{ + u8 bus = PCI_BUS_NUM(devid); + u8 devfn = devid & 0xff; + u16 val; -/* SB IOAPIC for Hygon family 18h model 4h is on the device 0xb */ -#define IOAPIC_SB_DEVID_FAM18H_M4H ((0x00 << 8) | PCI_DEVFN(0xb, 0)) + val = read_pci_config_16(bus, PCI_SLOT(devfn), PCI_FUNC(devfn), + PCI_CLASS_DEVICE); + + /* + * The SB IOAPIC is integrated into the FCH (Southbridge), which is + * exposed as an SMBus or ISA bridge in PCI config space. + */ + return val == PCI_CLASS_SERIAL_SMBUS || val == PCI_CLASS_BRIDGE_ISA; +} /* * The Southbridge IOAPIC is assigned a GSI Base of 0 (handling interrupts @@ -3140,12 +3150,7 @@ static bool __init check_ioapic_information(void) pr_err("%s: IOAPIC[%d] not in IVRS table\n", fw_bug, id); ret = false; - } else if (id == sb_apicid && (devid == IOAPIC_SB_DEVID || - (boot_cpu_data.x86_vendor == X86_VENDOR_HYGON && - boot_cpu_data.x86 == 0x18 && - boot_cpu_data.x86_model >= 0x4 && - boot_cpu_data.x86_model <= 0xf && - devid == IOAPIC_SB_DEVID_FAM18H_M4H))) { + } else if (id == sb_apicid && check_sb_ioapic(devid)) { has_sb_ioapic = true; } } From 20b4f0f120eaa9b865205cc2788fa9a27b38421e Mon Sep 17 00:00:00 2001 From: Bibek Kumar Patro Date: Fri, 10 Jul 2026 00:12:02 +0530 Subject: [PATCH 12/93] dt-bindings: arm-smmu: Document GPU SMMU for Shikra SoC Add specific compatible strings to document the GPU SMMU present in the Shikra SoC. Signed-off-by: Bibek Kumar Patro Reviewed-by: Krzysztof Kozlowski Signed-off-by: Akhil P Oommen Signed-off-by: Will Deacon --- Documentation/devicetree/bindings/iommu/arm,smmu.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Documentation/devicetree/bindings/iommu/arm,smmu.yaml b/Documentation/devicetree/bindings/iommu/arm,smmu.yaml index a701dec2fa0a..ad15fda5c25e 100644 --- a/Documentation/devicetree/bindings/iommu/arm,smmu.yaml +++ b/Documentation/devicetree/bindings/iommu/arm,smmu.yaml @@ -108,6 +108,7 @@ properties: - qcom,sc7280-smmu-500 - qcom,sc8180x-smmu-500 - qcom,sc8280xp-smmu-500 + - qcom,shikra-smmu-500 - qcom,sm6115-smmu-500 - qcom,sm6125-smmu-500 - qcom,sm8150-smmu-500 @@ -543,6 +544,7 @@ allOf: - enum: - qcom,milos-smmu-500 - qcom,sar2130p-smmu-500 + - qcom,shikra-smmu-500 - qcom,sm8550-smmu-500 - qcom,sm8650-smmu-500 - qcom,x1e80100-smmu-500 From 925f98235a729a87e632d6366fc749faac0463b4 Mon Sep 17 00:00:00 2001 From: Akhil P Oommen Date: Sat, 18 Jul 2026 02:11:29 +0530 Subject: [PATCH 13/93] dt-bindings: arm-smmu: Document GPU SMMU for Eliza SoC Add specific compatible strings to document the GPU SMMU present in the Eliza SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Akhil P Oommen Signed-off-by: Will Deacon --- Documentation/devicetree/bindings/iommu/arm,smmu.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Documentation/devicetree/bindings/iommu/arm,smmu.yaml b/Documentation/devicetree/bindings/iommu/arm,smmu.yaml index ad15fda5c25e..d87281026a71 100644 --- a/Documentation/devicetree/bindings/iommu/arm,smmu.yaml +++ b/Documentation/devicetree/bindings/iommu/arm,smmu.yaml @@ -95,6 +95,7 @@ properties: - description: Qcom Adreno GPUs implementing "qcom,smmu-500" and "arm,mmu-500" items: - enum: + - qcom,eliza-smmu-500 - qcom,glymur-smmu-500 - qcom,hawi-smmu-500 - qcom,kaanapali-smmu-500 @@ -572,6 +573,7 @@ allOf: compatible: items: - enum: + - qcom,eliza-smmu-500 - qcom,glymur-smmu-500 - qcom,hawi-smmu-500 - qcom,kaanapali-smmu-500 From d149c8b2c0146a01f1be326ddb1e182b55aee638 Mon Sep 17 00:00:00 2001 From: Esteban Urrutia Date: Sat, 11 Jul 2026 23:14:01 -0400 Subject: [PATCH 14/93] iommu/arm-smmu-qcom: Add SM8450 MDSS compatible Add the compatible for the MDSS client on the Snapdragon 8 Gen 1 so it can be properly configured by the IOMMU driver. Otherwise, there is an unhandled context fault, because the framebuffer is already configured in UEFI. Reviewed-by: Konrad Dybcio Signed-off-by: Esteban Urrutia Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c index e2c914fccd6f..795e8ec7e8fa 100644 --- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c @@ -425,6 +425,7 @@ static const struct of_device_id qcom_smmu_client_of_match[] __maybe_unused = { { .compatible = "qcom,sm6375-mdss" }, { .compatible = "qcom,sm8150-mdss" }, { .compatible = "qcom,sm8250-mdss" }, + { .compatible = "qcom,sm8450-mdss" }, { .compatible = "qcom,x1e80100-mdss" }, { } }; From 695a78825b4543363f73e9e5fe0f044dd31f07ec Mon Sep 17 00:00:00 2001 From: xiongweimin Date: Tue, 14 Jul 2026 10:40:41 +0800 Subject: [PATCH 15/93] iommu/vt-d: Fix spelling of "guarantees" in comment Correct "guarentees" to "guarantees" in the hotplug notes. Signed-off-by: xiongweimin Signed-off-by: Will Deacon --- drivers/iommu/intel/dmar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c index 767ec092accd..3ecbd54d0bc2 100644 --- a/drivers/iommu/intel/dmar.c +++ b/drivers/iommu/intel/dmar.c @@ -47,7 +47,7 @@ struct dmar_res_callback { /* * Assumptions: - * 1) The hotplug framework guarentees that DMAR unit will be hot-added + * 1) The hotplug framework guarantees that DMAR unit will be hot-added * before IO devices managed by that unit. * 2) The hotplug framework guarantees that DMAR unit will be hot-removed * after IO devices managed by that unit. From e3701ab2738079bebe3bab028ebd42030f9dbce7 Mon Sep 17 00:00:00 2001 From: xiongweimin Date: Tue, 14 Jul 2026 10:44:51 +0800 Subject: [PATCH 16/93] iommu: Fix possessive "its" in group remove kdoc Use "its" rather than "it's" when referring to the device's current group. Signed-off-by: xiongweimin Signed-off-by: Will Deacon --- drivers/iommu/iommu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c index e8f13dcebbde..a3dea7353500 100644 --- a/drivers/iommu/iommu.c +++ b/drivers/iommu/iommu.c @@ -1345,11 +1345,11 @@ int iommu_group_add_device(struct iommu_group *group, struct device *dev) EXPORT_SYMBOL_GPL(iommu_group_add_device); /** - * iommu_group_remove_device - remove a device from it's current group + * iommu_group_remove_device - remove a device from its current group * @dev: device to be removed * * This function is called by an iommu driver to remove the device from - * it's current group. This decrements the iommu group reference count. + * its current group. This decrements the iommu group reference count. */ void iommu_group_remove_device(struct device *dev) { From c579af7ec1662f20b3b1a2ec378c284463e55b43 Mon Sep 17 00:00:00 2001 From: xiongweimin Date: Tue, 14 Jul 2026 10:44:56 +0800 Subject: [PATCH 17/93] iova: Fix spelling of "reserved" in comment Correct "reserver" to "reserved". Signed-off-by: xiongweimin Signed-off-by: Will Deacon --- drivers/iommu/iova.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c index 021daf6528de..aa5a3f405b96 100644 --- a/drivers/iommu/iova.c +++ b/drivers/iommu/iova.c @@ -538,7 +538,7 @@ reserve_iova(struct iova_domain *iovad, break; } - /* We are here either because this is the first reserver node + /* We are here either because this is the first reserved node * or need to insert remaining non overlap addr range */ iova = __insert_new_range(iovad, pfn_lo, pfn_hi); From bfc147a8d3bc74aff9f39ef64cf75dccf4f7e067 Mon Sep 17 00:00:00 2001 From: xiongweimin Date: Tue, 14 Jul 2026 10:45:08 +0800 Subject: [PATCH 18/93] iommu/arm-smmu-v3: Fix grammar in comment Correct "possibly failure" to "possibly fail". Signed-off-by: xiongweimin Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index a10affb483a4..023cb138a23c 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -3252,7 +3252,7 @@ static void arm_smmu_remove_master_domain(struct arm_smmu_master *master, * 5. old domain updates its invs array, unreferencing master->build_invs * * For 1 and 5, prepare the two updated arrays in advance, handling any changes - * that can possibly failure. So the actual update of either 1 or 5 won't fail. + * that can possibly fail. So the actual update of either 1 or 5 won't fail. * arm_smmu_asid_lock ensures that the old invs in the domains are intact while * we are sequencing to update them. */ From fef725df406129f638f112dcd1de05d7abeafa66 Mon Sep 17 00:00:00 2001 From: xiongweimin Date: Tue, 14 Jul 2026 10:45:19 +0800 Subject: [PATCH 19/93] iommu/mtk: Fix spelling of correspondence in comment Correct "correspondance" to "correspondence". Signed-off-by: xiongweimin Signed-off-by: Will Deacon --- drivers/iommu/mtk_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c index 2be990c108de..b52e16b06760 100644 --- a/drivers/iommu/mtk_iommu.c +++ b/drivers/iommu/mtk_iommu.c @@ -220,7 +220,7 @@ struct mtk_iommu_plat_data { unsigned int iova_region_nr; const struct mtk_iommu_iova_region *iova_region; /* - * Indicate the correspondance between larbs, ports and regions. + * Indicate the correspondence between larbs, ports and regions. * * The index is the same as iova_region and larb port numbers are * described as bit positions. From 57bd32b2affb1b7a2ef9e7002e14a6090b990f94 Mon Sep 17 00:00:00 2001 From: xiongweimin Date: Tue, 14 Jul 2026 10:44:45 +0800 Subject: [PATCH 20/93] iommu/amd: Fix grammar and typos in comments Correct possessive "its", article before acpihid, and a couple of mangled sentences in IOMMU flush/irq comments. Signed-off-by: xiongweimin Reviewed-by: Ankit Soni Signed-off-by: Will Deacon --- drivers/iommu/amd/iommu.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 563f9c2672d5..824a585dfc03 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -456,7 +456,7 @@ static void clone_aliases(struct amd_iommu *iommu, struct device *dev) /* * The IVRS alias stored in the alias table may not be - * part of the PCI DMA aliases if it's bus differs + * part of the PCI DMA aliases if its bus differs * from the original device. */ clone_alias(pdev, iommu->pci_seg->alias_table[pci_dev_id(pdev)], pdev); @@ -505,7 +505,7 @@ static struct iommu_dev_data *find_dev_data(struct amd_iommu *iommu, u16 devid) } /* -* Find or create an IOMMU group for a acpihid device. +* Find or create an IOMMU group for an acpihid device. */ static struct iommu_group *acpihid_device_group(struct device *dev) { @@ -1268,7 +1268,7 @@ static void build_inv_dte(struct iommu_cmd *cmd, u16 devid) /* * Builds an invalidation address which is suitable for one page or multiple - * pages. Sets the size bit (S) as needed is more than one page is flushed. + * pages. Sets the size bit (S) as needed if more than one page is flushed. */ static inline u64 build_inv_address(u64 address, u64 last) { @@ -3687,7 +3687,7 @@ static void fill_msi_msg(struct msi_msg *msg, u32 index) /* * The struct msi_msg.dest_mode_logical is used to set the DM bit * in MSI Message Address Register. For device w/ 2K int-remap support, - * this is bit must be set to 1 regardless of the actual destination + * this bit must be set to 1 regardless of the actual destination * mode, which is signified by the IRTE[DM]. */ if (FEATURE_NUM_INT_REMAP_SUP_2K(amd_iommu_efr2)) From 843e149989665f8309ad2efe6048dc76591e1f94 Mon Sep 17 00:00:00 2001 From: Li RongQing Date: Mon, 1 Jun 2026 08:12:40 -0400 Subject: [PATCH 21/93] iommu/amd: Fix undefined behavior in devid_write debugfs function When for_each_pci_segment() loop completes without finding a matching segment, the pci_seg pointer is not NULL but points to an invalid memory location (the list head). Accessing pci_seg->id after the loop causes undefined behavior. Fix this by handling the successful case inside the loop and returning -EINVAL after the loop if no matching segment is found. Fixes: 2e98940f123d9 ("iommu/amd: Add support for device id user input") Signed-off-by: Li RongQing Reviewed-by: Ankit Soni Signed-off-by: Will Deacon --- drivers/iommu/amd/debugfs.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/drivers/iommu/amd/debugfs.c b/drivers/iommu/amd/debugfs.c index 4c53b6361314..5c573ec8e27a 100644 --- a/drivers/iommu/amd/debugfs.c +++ b/drivers/iommu/amd/debugfs.c @@ -176,19 +176,13 @@ static ssize_t devid_write(struct file *filp, const char __user *ubuf, kfree(srcid_ptr); return -ENODEV; } - break; - } - - if (pci_seg->id != seg) { + sbdf = PCI_SEG_DEVID_TO_SBDF(seg, devid); kfree(srcid_ptr); - return -EINVAL; + return cnt; } - sbdf = PCI_SEG_DEVID_TO_SBDF(seg, devid); - kfree(srcid_ptr); - - return cnt; + return -EINVAL; } static int devid_show(struct seq_file *m, void *unused) From c579f18e79599c16168925cb149e1db3f29eea5f Mon Sep 17 00:00:00 2001 From: Haoxiang Li Date: Tue, 23 Jun 2026 15:12:45 +0800 Subject: [PATCH 22/93] iommu/qcom: Remove sysfs device on probe failure path In qcom_iommu_device_probe(), if iommu_device_register() fails, the sysfs device created by iommu_device_sysfs_add() is not released. Add a goto label to do the cleanup. Fixes: 0ae349a0f33f ("iommu/qcom: Add qcom_iommu") Signed-off-by: Haoxiang Li Reviewed-by: Konrad Dybcio Reviewed-by: Mukesh Ojha Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c index a1e8cf29f594..32efef69e72d 100644 --- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c +++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c @@ -855,7 +855,7 @@ static int qcom_iommu_device_probe(struct platform_device *pdev) ret = iommu_device_register(&qcom_iommu->iommu, &qcom_iommu_ops, dev); if (ret) { dev_err(dev, "Failed to register iommu\n"); - goto err_pm_disable; + goto err_sysfs_remove; } if (qcom_iommu->local_base) { @@ -866,6 +866,8 @@ static int qcom_iommu_device_probe(struct platform_device *pdev) return 0; +err_sysfs_remove: + iommu_device_sysfs_remove(&qcom_iommu->iommu); err_pm_disable: pm_runtime_disable(dev); return ret; From 1f33b8208a1978b0c0d6ad60a47fe4bb7a235e58 Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Fri, 17 Jul 2026 20:16:03 +0530 Subject: [PATCH 23/93] iommu/qcom: Fix inverted fault report check in qcom_iommu_fault() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit report_iommu_fault() returns 0 when a fault handler successfully handles the fault, and -ENOSYS when no handler is installed. The condition '!report_iommu_fault()' evaluates to true (printing "Unhandled context fault") precisely when the fault *was* handled, and stays silent when no handler is present — the opposite of what is intended. Remove the '!' so the driver logs unhandled faults correctly. Fixes: 049541e178d5 ("iommu: qcom: wire up fault handler") Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c index 32efef69e72d..09f2ee6be988 100644 --- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c +++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c @@ -200,7 +200,7 @@ static irqreturn_t qcom_iommu_fault(int irq, void *dev) fsynr = iommu_readl(ctx, ARM_SMMU_CB_FSYNR0); iova = iommu_readq(ctx, ARM_SMMU_CB_FAR); - if (!report_iommu_fault(ctx->domain, ctx->dev, iova, 0)) { + if (report_iommu_fault(ctx->domain, ctx->dev, iova, 0)) { dev_err_ratelimited(ctx->dev, "Unhandled context fault: fsr=0x%x, " "iova=0x%016llx, fsynr=0x%x, cb=%d\n", From bf69e515b1802b67d91fa014c3ec1fbe217b345b Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Fri, 17 Jul 2026 20:16:04 +0530 Subject: [PATCH 24/93] iommu/qcom: Use devm_pm_runtime_enable() in qcom_iommu_device_probe() Switch from pm_runtime_enable() to devm_pm_runtime_enable() so that the matching pm_runtime_disable() is handled automatically via devres, both on probe failure and on device removal. This removes the err_pm_disable error label from the probe function and the explicit pm_runtime_disable() call from qcom_iommu_device_remove(). Signed-off-by: Mukesh Ojha Reviewed-by: Konrad Dybcio Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c index 09f2ee6be988..71251aecc292 100644 --- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c +++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c @@ -836,20 +836,22 @@ static int qcom_iommu_device_probe(struct platform_device *pdev) platform_set_drvdata(pdev, qcom_iommu); - pm_runtime_enable(dev); + ret = devm_pm_runtime_enable(dev); + if (ret) + return ret; /* register context bank devices, which are child nodes: */ ret = devm_of_platform_populate(dev); if (ret) { dev_err(dev, "Failed to populate iommu contexts\n"); - goto err_pm_disable; + return ret; } ret = iommu_device_sysfs_add(&qcom_iommu->iommu, dev, NULL, dev_name(dev)); if (ret) { dev_err(dev, "Failed to register iommu in sysfs\n"); - goto err_pm_disable; + return ret; } ret = iommu_device_register(&qcom_iommu->iommu, &qcom_iommu_ops, dev); @@ -868,8 +870,6 @@ static int qcom_iommu_device_probe(struct platform_device *pdev) err_sysfs_remove: iommu_device_sysfs_remove(&qcom_iommu->iommu); -err_pm_disable: - pm_runtime_disable(dev); return ret; } From e910315ae08a23bc953daed10b1c518abac1df49 Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Fri, 17 Jul 2026 20:16:05 +0530 Subject: [PATCH 25/93] iommu/qcom: Check pm_runtime_resume_and_get() return in probe The SMMU_INTR_SEL_NS register write in qcom_iommu_device_probe() uses pm_runtime_get_sync() without checking the return value. If runtime resume fails the subsequent writel_relaxed() would access hardware with clocks potentially disabled. Switch to pm_runtime_resume_and_get() which handles the usage-count cleanup on failure, check the return value, and unwind the already registered iommu device on error. Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c index 71251aecc292..1d04f0a19124 100644 --- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c +++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c @@ -861,13 +861,17 @@ static int qcom_iommu_device_probe(struct platform_device *pdev) } if (qcom_iommu->local_base) { - pm_runtime_get_sync(dev); + ret = pm_runtime_resume_and_get(dev); + if (ret) + goto err_iommu_unregister; writel_relaxed(0xffffffff, qcom_iommu->local_base + SMMU_INTR_SEL_NS); pm_runtime_put_sync(dev); } return 0; +err_iommu_unregister: + iommu_device_unregister(&qcom_iommu->iommu); err_sysfs_remove: iommu_device_sysfs_remove(&qcom_iommu->iommu); return ret; From 3c748a5554f961aac8e9ab1e28b7884b1c525012 Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Fri, 17 Jul 2026 20:16:06 +0530 Subject: [PATCH 26/93] iommu/qcom: Fix pgtbl_ops leak in qcom_iommu_init_domain() error path alloc_io_pgtable_ops() can succeed and then qcom_scm_restore_sec_cfg() can fail for one of the context banks. The goto out_clear_iommu path only cleared qcom_domain->iommu; the locally allocated pgtbl_ops was never freed, leaking it permanently since qcom_domain->pgtbl_ops is only assigned on the success path. free_io_pgtable_ops() safely handles a NULL argument (covers the case where alloc_io_pgtable_ops() itself failed), so add it unconditionally in the out_clear_iommu handler. Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c index 1d04f0a19124..222bb7febd03 100644 --- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c +++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c @@ -314,6 +314,7 @@ static int qcom_iommu_init_domain(struct iommu_domain *domain, return 0; out_clear_iommu: + free_io_pgtable_ops(pgtbl_ops); qcom_domain->iommu = NULL; out_unlock: mutex_unlock(&qcom_domain->init_mutex); From a05b67cd45ad09a19f41b2d37255da714512e0ca Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Fri, 17 Jul 2026 20:16:07 +0530 Subject: [PATCH 27/93] iommu/qcom: Publish pgtbl_ops before releasing init_mutex qcom_domain->pgtbl_ops was assigned after mutex_unlock(). Another thread calling qcom_iommu_init_domain() would see qcom_domain->iommu already set (domain fully initialized) and skip re-initialization under the mutex. If it then called qcom_iommu_map() before the first thread set pgtbl_ops, it would observe a NULL ops pointer and return -ENODEV for valid mappings. Move the assignment to before mutex_unlock() so that once the mutex is released the domain is fully visible to concurrent operations. Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c index 222bb7febd03..ecde5ca2d476 100644 --- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c +++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c @@ -306,13 +306,12 @@ static int qcom_iommu_init_domain(struct iommu_domain *domain, ctx->domain = domain; } - mutex_unlock(&qcom_domain->init_mutex); - /* Publish page table ops for map/unmap */ qcom_domain->pgtbl_ops = pgtbl_ops; - return 0; + mutex_unlock(&qcom_domain->init_mutex); + return 0; out_clear_iommu: free_io_pgtable_ops(pgtbl_ops); qcom_domain->iommu = NULL; From cb776a03a53429aa59e25a8cbc3d1a48bd11afdb Mon Sep 17 00:00:00 2001 From: Mukesh Ojha Date: Fri, 17 Jul 2026 20:16:08 +0530 Subject: [PATCH 28/93] iommu/qcom: Enable clocks before hardware access in qcom_iommu_ctx_probe() qcom_iommu_ctx_probe() reads and writes the CB_FSR register to clear any stale IRQ left by the bootloader. This happens during devm_of_platform_populate() which is called from the parent device's probe before any pm_runtime_get(). The parent's clocks (iface, bus, tbu) are therefore not guaranteed to be on, making the register access unreliable on rebind or after a suspend cycle. Use pm_runtime_resume_and_get() on the parent device to ensure clocks are enabled before the register access, and release the reference immediately after. Reviewed-by: Konrad Dybcio Signed-off-by: Mukesh Ojha Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c index ecde5ca2d476..5a9f8b39a99c 100644 --- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c +++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c @@ -704,8 +704,13 @@ static int qcom_iommu_ctx_probe(struct platform_device *pdev) /* clear IRQs before registering fault handler, just in case the * boot-loader left us a surprise: */ - if (!ctx->secured_ctx) + if (!ctx->secured_ctx) { + ret = pm_runtime_resume_and_get(dev->parent); + if (ret) + return ret; iommu_writel(ctx, ARM_SMMU_CB_FSR, iommu_readl(ctx, ARM_SMMU_CB_FSR)); + pm_runtime_put_sync(dev->parent); + } ret = devm_request_irq(dev, irq, qcom_iommu_fault, From 13a86292681dfdfe9835f440afc345778c9c1363 Mon Sep 17 00:00:00 2001 From: Pan Chuang Date: Tue, 14 Jul 2026 21:32:43 +0800 Subject: [PATCH 29/93] iommu: arm: Remove redundant dev_err()/dev_err_probe() Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() and devm_request_threaded_irq() automatically log detailed error messages on failure. Remove the now-redundant driver-specific dev_err() and dev_err_probe() calls. Signed-off-by: Pan Chuang Reviewed-by: Robin Murphy Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu/arm-smmu.c | 9 ++------- drivers/iommu/arm/arm-smmu/qcom_iommu.c | 4 +--- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu/arm-smmu.c b/drivers/iommu/arm/arm-smmu/arm-smmu.c index 0bd21d206eb3..889a0966d36c 100644 --- a/drivers/iommu/arm/arm-smmu/arm-smmu.c +++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c @@ -865,11 +865,8 @@ static int arm_smmu_init_domain_context(struct arm_smmu_domain *smmu_domain, ret = devm_request_irq(smmu->dev, irq, context_fault, IRQF_SHARED, "arm-smmu-context-fault", smmu_domain); - if (ret < 0) { - dev_err(smmu->dev, "failed to request context IRQ %d (%u)\n", - cfg->irptndx, irq); + if (ret < 0) cfg->irptndx = ARM_SMMU_INVALID_IRPTNDX; - } mutex_unlock(&smmu_domain->init_mutex); @@ -2219,9 +2216,7 @@ static int arm_smmu_device_probe(struct platform_device *pdev) err = devm_request_irq(dev, irq, global_fault, IRQF_SHARED, "arm-smmu global fault", smmu); if (err) - return dev_err_probe(dev, err, - "failed to request global IRQ %d (%u)\n", - i, irq); + return err; } platform_set_drvdata(pdev, smmu); diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c index 5a9f8b39a99c..21d18ce67b98 100644 --- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c +++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c @@ -717,10 +717,8 @@ static int qcom_iommu_ctx_probe(struct platform_device *pdev) IRQF_SHARED, "qcom-iommu-fault", ctx); - if (ret) { - dev_err(dev, "failed to request IRQ %u\n", irq); + if (ret) return ret; - } ret = get_asid(dev->of_node); if (ret < 0) { From 4455286274474e95f223c68c215d32c864404889 Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Mon, 15 Jun 2026 12:45:33 -0700 Subject: [PATCH 30/93] iommu/arm-smmu-v3: Declare eats_s1chk and eats_trans as host-endian u64 arm_smmu_get_ste_update_safe() declares the eats_s1chk and eats_trans locals as __le64, but initializes them from FIELD_PREP(), which returns a host-endian value, and passes them through cpu_to_le64() at the use sites. Sparse reports the following warnings: >> drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:1122:38: sparse: sparse: cast from restricted __le64 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c:1124:33: sparse: sparse: cast from restricted __le64 Declare both locals as u64 so the type matches FIELD_PREP() and the existing cpu_to_le64() at the use sites performs the host-to-little-endian conversion. No functional change. Fixes: 7cad80048595 ("iommu/arm-smmu-v3: Mark EATS_TRANS safe when computing the update sequence") Reported-by: kernel test robot Closes: https://lore.kernel.org/all/202606151017.QU0evpH9-lkp@intel.com/ Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index a10affb483a4..401aaf8a6e8e 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -1240,9 +1240,9 @@ VISIBLE_IF_KUNIT void arm_smmu_get_ste_update_safe(const __le64 *cur, const __le64 *target, __le64 *safe_bits) { - const __le64 eats_s1chk = + const u64 eats_s1chk = FIELD_PREP(STRTAB_STE_1_EATS, STRTAB_STE_1_EATS_S1CHK); - const __le64 eats_trans = + const u64 eats_trans = FIELD_PREP(STRTAB_STE_1_EATS, STRTAB_STE_1_EATS_TRANS); /* From 2bd22a0d40503a65d243b011de146603c8ce1cbc Mon Sep 17 00:00:00 2001 From: Shameer Kolothum Date: Mon, 29 Jun 2026 10:41:05 +0100 Subject: [PATCH 31/93] iommu/arm-smmu-v3: Manage teardown with devm arm_smmu_device_remove() manually frees the IOPF queue, destroys the vmid_map and disables the device, while the IRQs and queues are devm managed. devm unwinds only after remove() returns, so the cleanup runs in the wrong order. The IOPF queue is freed before the event-queue IRQ whose handler uses it. Manage all of it with devm so the unwind order is correct. Free the IOPF queue and vmid_map via devm actions, and disable the device from one registered after arm_smmu_device_reset(). This is also a prerequisite for fixing a Tegra241 CMDQV CMD_SYNC use-after-free in the subsequent patch. Cc: stable@vger.kernel.org Suggested-by: Jason Gunthorpe Reviewed-by: Nicolin Chen Signed-off-by: Shameer Kolothum Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 56 +++++++++++++++------ 1 file changed, 40 insertions(+), 16 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 401aaf8a6e8e..a0487bdfd6a8 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -4398,6 +4398,20 @@ int arm_smmu_cmdq_init(struct arm_smmu_device *smmu, return 0; } +static void arm_smmu_free_iopf_action(void *data) +{ + struct iopf_queue *queue = data; + + iopf_queue_free(queue); +} + +static void arm_smmu_destroy_vmid_map(void *data) +{ + struct ida *ida = data; + + ida_destroy(ida); +} + static int arm_smmu_init_queues(struct arm_smmu_device *smmu) { int ret; @@ -4425,6 +4439,11 @@ static int arm_smmu_init_queues(struct arm_smmu_device *smmu) smmu->evtq.iopf = iopf_queue_alloc(dev_name(smmu->dev)); if (!smmu->evtq.iopf) return -ENOMEM; + ret = devm_add_action_or_reset(smmu->dev, + arm_smmu_free_iopf_action, + smmu->evtq.iopf); + if (ret) + return ret; } /* priq */ @@ -4503,7 +4522,8 @@ static int arm_smmu_init_strtab(struct arm_smmu_device *smmu) ida_init(&smmu->vmid_map); - return 0; + return devm_add_action_or_reset(smmu->dev, arm_smmu_destroy_vmid_map, + &smmu->vmid_map); } static int arm_smmu_init_structures(struct arm_smmu_device *smmu) @@ -4716,6 +4736,13 @@ static int arm_smmu_device_disable(struct arm_smmu_device *smmu) return ret; } +static void arm_smmu_disable_action(void *data) +{ + struct arm_smmu_device *smmu = data; + + arm_smmu_device_disable(smmu); +} + static void arm_smmu_write_strtab(struct arm_smmu_device *smmu) { struct arm_smmu_strtab_cfg *cfg = &smmu->strtab_cfg; @@ -5472,7 +5499,7 @@ static int arm_smmu_device_probe(struct platform_device *pdev) /* Initialise in-memory data structures */ ret = arm_smmu_init_structures(smmu); if (ret) - goto err_free_iopf; + return ret; /* Record our private device structure */ platform_set_drvdata(pdev, smmu); @@ -5482,30 +5509,30 @@ static int arm_smmu_device_probe(struct platform_device *pdev) /* Reset the device */ ret = arm_smmu_device_reset(smmu); + if (ret) { + arm_smmu_device_disable(smmu); + return ret; + } + + /* Register last so it unwinds first, while the CMDQ is still up. */ + ret = devm_add_action_or_reset(smmu->dev, arm_smmu_disable_action, smmu); if (ret) - goto err_disable; + return ret; /* And we're up. Go go go! */ ret = iommu_device_sysfs_add(&smmu->iommu, dev, NULL, "smmu3.%pa", &ioaddr); if (ret) - goto err_disable; + return ret; ret = iommu_device_register(&smmu->iommu, &arm_smmu_ops, dev); if (ret) { dev_err(dev, "Failed to register iommu\n"); - goto err_free_sysfs; + iommu_device_sysfs_remove(&smmu->iommu); + return ret; } return 0; - -err_free_sysfs: - iommu_device_sysfs_remove(&smmu->iommu); -err_disable: - arm_smmu_device_disable(smmu); -err_free_iopf: - iopf_queue_free(smmu->evtq.iopf); - return ret; } static void arm_smmu_device_remove(struct platform_device *pdev) @@ -5514,9 +5541,6 @@ static void arm_smmu_device_remove(struct platform_device *pdev) iommu_device_unregister(&smmu->iommu); iommu_device_sysfs_remove(&smmu->iommu); - arm_smmu_device_disable(smmu); - iopf_queue_free(smmu->evtq.iopf); - ida_destroy(&smmu->vmid_map); } static void arm_smmu_device_shutdown(struct platform_device *pdev) From 9ff145a25c5c8a26b06ef7cf558fb536b18bba6d Mon Sep 17 00:00:00 2001 From: Shameer Kolothum Date: Mon, 29 Jun 2026 10:41:06 +0100 Subject: [PATCH 32/93] iommu/tegra241-cmdqv: Fix CMD_SYNC use-after-free on teardown arm_smmu_impl_remove() is registered as a devres action in arm_smmu_impl_probe(), before arm_smmu_init_queues() allocates smmu->cmdq.q.base. On a devres unwind, whether a failed probe or an unbind, the queue is freed first and arm_smmu_impl_remove() then runs tegra241_cmdqv_remove_vintf(), whose VINTF deinit issues a CMD_SYNC on the freed memory. Observed during testing with a QEMU hack that makes the VCMDQ fail to enable, so the impl reset fails and probe aborts into the devres unwind: platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: failed to enable, STATUS=0x00000000 platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: GERRORN=0x0, GERROR=0x4, CONS=0x0 platform NVDA200C:00: tegra241_cmdqv: VINTF0: VCMDQ0/LVCMDQ0: uncleared error detected, resetting arm-smmu-v3 arm-smmu-v3.0.auto: failed to reset impl arm-smmu-v3 arm-smmu-v3.0.auto: probe with driver arm-smmu-v3 failed with error -110 Unable to handle kernel paging request at virtual address ffff8000891e0098 ... Internal error: Oops: 0000000096000047 [#1] SMP ... Call trace: arm_smmu_cmdq_issue_cmdlist+0x320/0x6fc (P) tegra241_vcmdq_hw_deinit+0x98/0x168 tegra241_vintf_hw_deinit+0x5c/0x1b0 tegra241_cmdqv_remove_vintf+0x34/0xec tegra241_cmdqv_remove+0x40/0x9c arm_smmu_impl_remove+0x20/0x30 devm_action_release+0x14/0x20 devres_release_all+0xa8/0x110 device_unbind_cleanup+0x18/0x84 really_probe+0x1f0/0x29c Drop the VINTF deinit from tegra241_cmdqv_remove_vintf() so the unwind no longer touches the freed queue. Quiesce the VINTFs earlier instead. Add a device_disable() impl op and run it from arm_smmu_disable_action() while the CMDQ is still up. That handles a live unbind. A failed reset is already handled because tegra241_vintf_hw_init() deinits the VINTF on its own error path. tegra241_cmdqv_remove_vintf() is also used by the iommufd viommu destroy path, so quiesce there too. Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support") Cc: stable@vger.kernel.org Reviewed-by: Nicolin Chen Signed-off-by: Shameer Kolothum Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 ++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 15 +++++++++++++-- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index a0487bdfd6a8..251fe0fac80c 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -4740,6 +4740,8 @@ static void arm_smmu_disable_action(void *data) { struct arm_smmu_device *smmu = data; + if (smmu->impl_ops && smmu->impl_ops->device_disable) + smmu->impl_ops->device_disable(smmu); arm_smmu_device_disable(smmu); } diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h index c909c9a88538..1c4877ada1ee 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h @@ -871,6 +871,7 @@ struct arm_smmu_strtab_cfg { struct arm_smmu_impl_ops { int (*device_reset)(struct arm_smmu_device *smmu); + void (*device_disable)(struct arm_smmu_device *smmu); void (*device_remove)(struct arm_smmu_device *smmu); int (*init_structures)(struct arm_smmu_device *smmu); struct arm_smmu_cmdq *(*get_secondary_cmdq)( diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c index 67be62a6e764..aaf9ce38bd93 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -761,8 +761,6 @@ static void tegra241_cmdqv_remove_vintf(struct tegra241_cmdqv *cmdqv, u16 idx) struct tegra241_vintf *vintf = cmdqv->vintfs[idx]; u16 lidx; - tegra241_vintf_hw_deinit(vintf); - /* Remove LVCMDQ resources */ for (lidx = 0; lidx < vintf->cmdqv->num_lvcmdqs_per_vintf; lidx++) if (vintf->lvcmdqs[lidx]) @@ -779,6 +777,17 @@ static void tegra241_cmdqv_remove_vintf(struct tegra241_cmdqv *cmdqv, u16 idx) } } +static void tegra241_cmdqv_hw_disable(struct arm_smmu_device *smmu) +{ + struct tegra241_cmdqv *cmdqv = + container_of(smmu, struct tegra241_cmdqv, smmu); + u16 idx; + + for (idx = 0; idx < cmdqv->num_vintfs; idx++) + if (cmdqv->vintfs[idx]) + tegra241_vintf_hw_deinit(cmdqv->vintfs[idx]); +} + static void tegra241_cmdqv_remove(struct arm_smmu_device *smmu) { struct tegra241_cmdqv *cmdqv = @@ -844,6 +853,7 @@ static struct arm_smmu_impl_ops tegra241_cmdqv_impl_ops = { /* For in-kernel use */ .get_secondary_cmdq = tegra241_cmdqv_get_cmdq, .device_reset = tegra241_cmdqv_hw_reset, + .device_disable = tegra241_cmdqv_hw_disable, .device_remove = tegra241_cmdqv_remove, /* For user-space use */ .hw_info = tegra241_cmdqv_hw_info, @@ -1152,6 +1162,7 @@ static void tegra241_cmdqv_destroy_vintf_user(struct iommufd_viommu *viommu) if (vintf->mmap_offset) iommufd_viommu_destroy_mmap(&vintf->vsmmu.core, vintf->mmap_offset); + tegra241_vintf_hw_deinit(vintf); tegra241_cmdqv_remove_vintf(vintf->cmdqv, vintf->idx); } From 57f63e7082f66eccb2e6a3cf34f048c834a62e88 Mon Sep 17 00:00:00 2001 From: Bhargav Joshi Date: Wed, 8 Jul 2026 22:21:43 +0530 Subject: [PATCH 33/93] dt-bindings: iommu: ti,omap-iommu: Convert to DT schema Convert Texas Instruments OMAP2+ IOMMU from text to DT schema. Make the 'ti,hwmods' property optional and mark it deprecated as it is no longer used, it is kept to support legacy dtbs. Signed-off-by: Bhargav Joshi Reviewed-by: Rob Herring (Arm) Signed-off-by: Will Deacon --- .../bindings/iommu/ti,omap-iommu.txt | 59 --------- .../bindings/iommu/ti,omap-iommu.yaml | 114 ++++++++++++++++++ 2 files changed, 114 insertions(+), 59 deletions(-) delete mode 100644 Documentation/devicetree/bindings/iommu/ti,omap-iommu.txt create mode 100644 Documentation/devicetree/bindings/iommu/ti,omap-iommu.yaml diff --git a/Documentation/devicetree/bindings/iommu/ti,omap-iommu.txt b/Documentation/devicetree/bindings/iommu/ti,omap-iommu.txt deleted file mode 100644 index 4bd10dd881b8..000000000000 --- a/Documentation/devicetree/bindings/iommu/ti,omap-iommu.txt +++ /dev/null @@ -1,59 +0,0 @@ -OMAP2+ IOMMU - -Required properties: -- compatible : Should be one of, - "ti,omap2-iommu" for OMAP2/OMAP3 IOMMU instances - "ti,omap4-iommu" for OMAP4/OMAP5 IOMMU instances - "ti,dra7-dsp-iommu" for DRA7xx DSP IOMMU instances - "ti,dra7-iommu" for DRA7xx IOMMU instances -- ti,hwmods : Name of the hwmod associated with the IOMMU instance -- reg : Address space for the configuration registers -- interrupts : Interrupt specifier for the IOMMU instance -- #iommu-cells : Should be 0. OMAP IOMMUs are all "single-master" devices, - and needs no additional data in the pargs specifier. Please - also refer to the generic bindings document for more info - on this property, - Documentation/devicetree/bindings/iommu/iommu.txt - -Optional properties: -- ti,#tlb-entries : Number of entries in the translation look-aside buffer. - Should be either 8 or 32 (default: 32) -- ti,iommu-bus-err-back : Indicates the IOMMU instance supports throwing - back a bus error response on MMU faults. -- ti,syscon-mmuconfig : Should be a pair of the phandle to the DSP_SYSTEM - syscon node that contains the additional control - register for enabling the MMU, and the MMU instance - number (0-indexed) within the sub-system. This property - is required for DSP IOMMU instances on DRA7xx SoCs. The - instance number should be 0 for DSP MDMA MMUs and 1 for - DSP EDMA MMUs. - -Example: - /* OMAP3 ISP MMU */ - mmu_isp: mmu@480bd400 { - #iommu-cells = <0>; - compatible = "ti,omap2-iommu"; - reg = <0x480bd400 0x80>; - interrupts = <24>; - ti,hwmods = "mmu_isp"; - ti,#tlb-entries = <8>; - }; - - /* DRA74x DSP2 MMUs */ - mmu0_dsp2: mmu@41501000 { - compatible = "ti,dra7-dsp-iommu"; - reg = <0x41501000 0x100>; - interrupts = ; - ti,hwmods = "mmu0_dsp2"; - #iommu-cells = <0>; - ti,syscon-mmuconfig = <&dsp2_system 0x0>; - }; - - mmu1_dsp2: mmu@41502000 { - compatible = "ti,dra7-dsp-iommu"; - reg = <0x41502000 0x100>; - interrupts = ; - ti,hwmods = "mmu1_dsp2"; - #iommu-cells = <0>; - ti,syscon-mmuconfig = <&dsp2_system 0x1>; - }; diff --git a/Documentation/devicetree/bindings/iommu/ti,omap-iommu.yaml b/Documentation/devicetree/bindings/iommu/ti,omap-iommu.yaml new file mode 100644 index 000000000000..9588eb60376e --- /dev/null +++ b/Documentation/devicetree/bindings/iommu/ti,omap-iommu.yaml @@ -0,0 +1,114 @@ +# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/iommu/ti,omap-iommu.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: OMAP2+ IOMMU + +maintainers: + - Bhargav Joshi + +properties: + compatible: + enum: + - ti,omap2-iommu + - ti,omap4-iommu + - ti,dra7-dsp-iommu + - ti,dra7-iommu + + reg: + maxItems: 1 + + interrupts: + maxItems: 1 + + '#iommu-cells': + const: 0 + + ti,#tlb-entries: + description: Number of entries in the translation look-aside buffer. + $ref: /schemas/types.yaml#/definitions/uint32 + enum: [8, 32] + default: 32 + + ti,iommu-bus-err-back: + description: + Indicates the IOMMU instance supports throwing back a bus error response + on MMU faults. + type: boolean + + ti,syscon-mmuconfig: + description: + Pair of the phandle to the DSP_SYSTEM syscon node that + contains the additional control register for enabling the MMU, and the + MMU instance number (0-indexed) within the sub-system. The instance number + should be 0 for DSP MDMA MMUs and 1 for DSP EDMA MMUs. + $ref: /schemas/types.yaml#/definitions/phandle-array + maxItems: 1 + items: + items: + - description: phandle to the DSP_SYSTEM syscon node + - description: MMU instance number + enum: [0, 1] + + ti,hwmods: + description: Name of the hwmod associated with the IOMMU instance + $ref: /schemas/types.yaml#/definitions/string + deprecated: true + +required: + - compatible + - reg + - '#iommu-cells' + - interrupts + +allOf: + - if: + properties: + compatible: + contains: + const: ti,dra7-dsp-iommu + then: + required: + - ti,syscon-mmuconfig + else: + properties: + ti,syscon-mmuconfig: false + +additionalProperties: false + +examples: + - | + mmu@480bd400 { + #iommu-cells = <0>; + compatible = "ti,omap2-iommu"; + reg = <0x480bd400 0x80>; + interrupts = <24>; + ti,hwmods = "mmu_isp"; + ti,#tlb-entries = <8>; + }; + + - | + #include + + mmu@41501000 { + compatible = "ti,dra7-dsp-iommu"; + reg = <0x41501000 0x100>; + interrupts = ; + ti,hwmods = "mmu0_dsp2"; + #iommu-cells = <0>; + ti,syscon-mmuconfig = <&dsp2_system 0x0>; + }; + + - | + #include + + mmu@41502000 { + compatible = "ti,dra7-dsp-iommu"; + reg = <0x41502000 0x100>; + interrupts = ; + ti,hwmods = "mmu1_dsp2"; + #iommu-cells = <0>; + ti,syscon-mmuconfig = <&dsp2_system 0x1>; + }; From 7b97226bfb4ff96ecff7408160e8e50a5d70e48b Mon Sep 17 00:00:00 2001 From: Jingyi Wang Date: Fri, 3 Jul 2026 00:50:33 -0700 Subject: [PATCH 34/93] dt-bindings: arm-smmu: qcom: Add compatible for Maili SoC Qualcomm Maili SoC includes apps smmu that implements arm,mmu-500, which is used to translate device-visible virtual addresses to physical addresses. Add compatible for it. Signed-off-by: Jingyi Wang Reviewed-by: Krzysztof Kozlowski Signed-off-by: Will Deacon --- Documentation/devicetree/bindings/iommu/arm,smmu.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Documentation/devicetree/bindings/iommu/arm,smmu.yaml b/Documentation/devicetree/bindings/iommu/arm,smmu.yaml index d87281026a71..f2188942f877 100644 --- a/Documentation/devicetree/bindings/iommu/arm,smmu.yaml +++ b/Documentation/devicetree/bindings/iommu/arm,smmu.yaml @@ -39,6 +39,7 @@ properties: - qcom,glymur-smmu-500 - qcom,hawi-smmu-500 - qcom,kaanapali-smmu-500 + - qcom,maili-smmu-500 - qcom,milos-smmu-500 - qcom,nord-smmu-500 - qcom,qcm2290-smmu-500 @@ -625,6 +626,7 @@ allOf: - qcom,glymur-smmu-500 - qcom,hawi-smmu-500 - qcom,kaanapali-smmu-500 + - qcom,maili-smmu-500 - qcom,milos-smmu-500 - qcom,nord-smmu-500 - qcom,qcs615-smmu-500 From 649e5ef83671009bb89d683f54b16615adf94bf0 Mon Sep 17 00:00:00 2001 From: Pengpeng Hou Date: Wed, 22 Jul 2026 12:16:19 +0800 Subject: [PATCH 35/93] iommu/msm: Limit the per-master Machine ID list The OF translation path appends each unique stream ID from an IOMMU specifier to the fixed mids array in the per-master object. It currently has no capacity check before storing at mids[num_mids] and incrementing num_mids. Return -ENOSPC when the array is full rather than writing the next ID beyond it. Signed-off-by: Pengpeng Hou Reviewed-by: Dmitry Baryshkov Signed-off-by: Will Deacon --- drivers/iommu/msm_iommu.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c index 708baeb29c03..038f6ed797ea 100644 --- a/drivers/iommu/msm_iommu.c +++ b/drivers/iommu/msm_iommu.c @@ -622,6 +622,9 @@ static int insert_iommu_master(struct device *dev, return 0; } + if (master->num_mids >= MAX_NUM_MIDS) + return -ENOSPC; + master->mids[master->num_mids++] = spec->args[0]; return 0; } From 535a200220ca2c83bc8bf54bd2cbe045d6ee70c4 Mon Sep 17 00:00:00 2001 From: Weimin Xiong Date: Thu, 16 Jul 2026 09:32:29 +0800 Subject: [PATCH 36/93] iommu/msm: Unwind probe state on registration failure msm_iommu_probe() adds its devm-managed IOMMU object to qcom_iommu_devices before adding the IOMMU sysfs device and registering it with the IOMMU core. If iommu_device_sysfs_add() fails, probe returns with the object still on qcom_iommu_devices. The driver core then releases the devm allocation, leaving a dangling list entry that later list walks may dereference. If iommu_device_register() fails, the same dangling list entry remains and the sysfs device is left registered as well. Unwind the sysfs device and global list entry in reverse setup order on the corresponding failure paths. Fixes: 42df43b36163 ("iommu/msm: Make use of iommu_device_register interface") Cc: stable@vger.kernel.org Reviewed-by: Mukesh Ojha Signed-off-by: Weimin Xiong Signed-off-by: Will Deacon --- drivers/iommu/msm_iommu.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/msm_iommu.c b/drivers/iommu/msm_iommu.c index 038f6ed797ea..4ef1e8c8244b 100644 --- a/drivers/iommu/msm_iommu.c +++ b/drivers/iommu/msm_iommu.c @@ -787,19 +787,25 @@ static int msm_iommu_probe(struct platform_device *pdev) "msm-smmu.%pa", &ioaddr); if (ret) { pr_err("Could not add msm-smmu at %pa to sysfs\n", &ioaddr); - return ret; + goto err_remove_list; } ret = iommu_device_register(&iommu->iommu, &msm_iommu_ops, &pdev->dev); if (ret) { pr_err("Could not register msm-smmu at %pa\n", &ioaddr); - return ret; + goto err_remove_sysfs; } pr_info("device mapped at %p, irq %d with %d ctx banks\n", iommu->base, iommu->irq, iommu->ncb); return ret; + +err_remove_sysfs: + iommu_device_sysfs_remove(&iommu->iommu); +err_remove_list: + list_del(&iommu->dev_node); + return ret; } static const struct of_device_id msm_iommu_dt_match[] = { From 414cb6f3ac6217d67963d53866e0fc2288dd3556 Mon Sep 17 00:00:00 2001 From: Simon Xue Date: Wed, 22 Jul 2026 15:35:10 +0800 Subject: [PATCH 37/93] iommu/rockchip: Drop global rk_ops in favor of per-device ops The driver currently uses a global rk_ops pointer, forcing all IOMMU instances to share the same operations. This restricts the driver from supporting SoCs that might integrate different versions of IOMMU hardware. Since the IOMMU framework passes the master device information to iommu_paging_domain_alloc(), the global variable is no longer needed. Fix this by moving rk_ops into struct rk_iommu and struct rk_iommu_domain. Initialize it per-device during probe via of_device_get_match_data(), and replace all global references with the instance-specific pointers. Signed-off-by: Simon Xue Reviewed-by: Robin Murphy Signed-off-by: Will Deacon --- drivers/iommu/rockchip-iommu.c | 74 +++++++++++++++++----------------- 1 file changed, 36 insertions(+), 38 deletions(-) diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c index 87ae036d6414..d8cfce042dec 100644 --- a/drivers/iommu/rockchip-iommu.c +++ b/drivers/iommu/rockchip-iommu.c @@ -84,6 +84,14 @@ */ #define RK_IOMMU_PGSIZE_BITMAP 0x007ff000 +struct rk_iommu_ops { + phys_addr_t (*pt_address)(u32 dte); + u32 (*mk_dtentries)(dma_addr_t pt_dma); + u32 (*mk_ptentries)(phys_addr_t page, int prot); + u64 dma_bit_mask; + gfp_t gfp_flags; +}; + struct rk_iommu_domain { struct list_head iommus; u32 *dt; /* page directory table */ @@ -91,6 +99,7 @@ struct rk_iommu_domain { spinlock_t iommus_lock; /* lock for iommus list */ spinlock_t dt_lock; /* lock for modifying page directory table */ struct device *dma_dev; + const struct rk_iommu_ops *rk_ops; struct iommu_domain domain; }; @@ -100,14 +109,6 @@ static const char * const rk_iommu_clocks[] = { "aclk", "iface", }; -struct rk_iommu_ops { - phys_addr_t (*pt_address)(u32 dte); - u32 (*mk_dtentries)(dma_addr_t pt_dma); - u32 (*mk_ptentries)(phys_addr_t page, int prot); - u64 dma_bit_mask; - gfp_t gfp_flags; -}; - struct rk_iommu { struct device *dev; void __iomem **bases; @@ -119,6 +120,7 @@ struct rk_iommu { struct iommu_device iommu; struct list_head node; /* entry in rk_iommu_domain.iommus */ struct iommu_domain *domain; /* domain to which iommu is attached */ + const struct rk_iommu_ops *rk_ops; }; struct rk_iommudata { @@ -126,7 +128,6 @@ struct rk_iommudata { struct rk_iommu *iommu; }; -static const struct rk_iommu_ops *rk_ops; static struct iommu_domain rk_identity_domain; static inline void rk_table_flush(struct rk_iommu_domain *dom, dma_addr_t dma, @@ -512,7 +513,7 @@ static int rk_iommu_force_reset(struct rk_iommu *iommu) * and verifying that upper 5 (v1) or 7 (v2) nybbles are read back. */ for (i = 0; i < iommu->num_mmu; i++) { - dte_addr = rk_ops->pt_address(DTE_ADDR_DUMMY); + dte_addr = iommu->rk_ops->pt_address(DTE_ADDR_DUMMY); rk_iommu_write(iommu->bases[i], RK_MMU_DTE_ADDR, dte_addr); if (dte_addr != rk_iommu_read(iommu->bases[i], RK_MMU_DTE_ADDR)) { @@ -553,7 +554,7 @@ static void log_iova(struct rk_iommu *iommu, int index, dma_addr_t iova) page_offset = rk_iova_page_offset(iova); mmu_dte_addr = rk_iommu_read(base, RK_MMU_DTE_ADDR); - mmu_dte_addr_phys = rk_ops->pt_address(mmu_dte_addr); + mmu_dte_addr_phys = iommu->rk_ops->pt_address(mmu_dte_addr); dte_addr_phys = mmu_dte_addr_phys + (4 * dte_index); dte_addr = phys_to_virt(dte_addr_phys); @@ -562,14 +563,14 @@ static void log_iova(struct rk_iommu *iommu, int index, dma_addr_t iova) if (!rk_dte_is_pt_valid(dte)) goto print_it; - pte_addr_phys = rk_ops->pt_address(dte) + (pte_index * 4); + pte_addr_phys = iommu->rk_ops->pt_address(dte) + (pte_index * 4); pte_addr = phys_to_virt(pte_addr_phys); pte = *pte_addr; if (!rk_pte_is_page_valid(pte)) goto print_it; - page_addr_phys = rk_ops->pt_address(pte) + page_offset; + page_addr_phys = iommu->rk_ops->pt_address(pte) + page_offset; page_flags = pte & RK_PTE_PAGE_FLAGS_MASK; print_it: @@ -665,13 +666,13 @@ static phys_addr_t rk_iommu_iova_to_phys(struct iommu_domain *domain, if (!rk_dte_is_pt_valid(dte)) goto out; - pt_phys = rk_ops->pt_address(dte); + pt_phys = rk_domain->rk_ops->pt_address(dte); page_table = (u32 *)phys_to_virt(pt_phys); pte = page_table[rk_iova_pte_index(iova)]; if (!rk_pte_is_page_valid(pte)) goto out; - phys = rk_ops->pt_address(pte) + rk_iova_page_offset(iova); + phys = rk_domain->rk_ops->pt_address(pte) + rk_iova_page_offset(iova); out: spin_unlock_irqrestore(&rk_domain->dt_lock, flags); @@ -732,7 +733,7 @@ static u32 *rk_dte_get_page_table(struct rk_iommu_domain *rk_domain, if (rk_dte_is_pt_valid(dte)) goto done; - page_table = iommu_alloc_pages_sz(GFP_ATOMIC | rk_ops->gfp_flags, + page_table = iommu_alloc_pages_sz(GFP_ATOMIC | rk_domain->rk_ops->gfp_flags, SPAGE_SIZE); if (!page_table) return ERR_PTR(-ENOMEM); @@ -744,13 +745,13 @@ static u32 *rk_dte_get_page_table(struct rk_iommu_domain *rk_domain, return ERR_PTR(-ENOMEM); } - dte = rk_ops->mk_dtentries(pt_dma); + dte = rk_domain->rk_ops->mk_dtentries(pt_dma); *dte_addr = dte; rk_table_flush(rk_domain, rk_domain->dt_dma + dte_index * sizeof(u32), 1); done: - pt_phys = rk_ops->pt_address(dte); + pt_phys = rk_domain->rk_ops->pt_address(dte); return (u32 *)phys_to_virt(pt_phys); } @@ -792,7 +793,7 @@ static int rk_iommu_map_iova(struct rk_iommu_domain *rk_domain, u32 *pte_addr, if (rk_pte_is_page_valid(pte)) goto unwind; - pte_addr[pte_count] = rk_ops->mk_ptentries(paddr, prot); + pte_addr[pte_count] = rk_domain->rk_ops->mk_ptentries(paddr, prot); paddr += SPAGE_SIZE; } @@ -814,7 +815,7 @@ static int rk_iommu_map_iova(struct rk_iommu_domain *rk_domain, u32 *pte_addr, pte_count * SPAGE_SIZE); iova += pte_count * SPAGE_SIZE; - page_phys = rk_ops->pt_address(pte_addr[pte_count]); + page_phys = rk_domain->rk_ops->pt_address(pte_addr[pte_count]); pr_err("iova: %pad already mapped to %pa cannot remap to phys: %pa prot: %#x\n", &iova, &page_phys, &paddr, prot); @@ -851,7 +852,7 @@ static int rk_iommu_map(struct iommu_domain *domain, unsigned long _iova, pte_index = rk_iova_pte_index(iova); pte_addr = &page_table[pte_index]; - pte_dma = rk_ops->pt_address(dte_index) + pte_index * sizeof(u32); + pte_dma = rk_domain->rk_ops->pt_address(dte_index) + pte_index * sizeof(u32); ret = rk_iommu_map_iova(rk_domain, pte_addr, pte_dma, iova, paddr, size, prot); @@ -889,7 +890,7 @@ static size_t rk_iommu_unmap(struct iommu_domain *domain, unsigned long _iova, return 0; } - pt_phys = rk_ops->pt_address(dte); + pt_phys = rk_domain->rk_ops->pt_address(dte); pte_addr = (u32 *)phys_to_virt(pt_phys) + rk_iova_pte_index(iova); pte_dma = pt_phys + rk_iova_pte_index(iova) * sizeof(u32); unmap_size = rk_iommu_unmap_iova(rk_domain, pte_addr, pte_dma, size); @@ -948,7 +949,7 @@ static int rk_iommu_enable(struct rk_iommu *iommu) for (i = 0; i < iommu->num_mmu; i++) { rk_iommu_write(iommu->bases[i], RK_MMU_DTE_ADDR, - rk_ops->mk_dtentries(rk_domain->dt_dma)); + iommu->rk_ops->mk_dtentries(rk_domain->dt_dma)); rk_iommu_base_command(iommu->bases[i], RK_MMU_CMD_ZAP_CACHE); rk_iommu_write(iommu->bases[i], RK_MMU_INT_MASK, RK_MMU_IRQ_MASK); @@ -1035,6 +1036,9 @@ static int rk_iommu_attach_device(struct iommu_domain *domain, if (iommu->domain == domain) return 0; + if (rk_domain->rk_ops != iommu->rk_ops) + return -EINVAL; + ret = rk_iommu_identity_attach(&rk_identity_domain, dev, old); if (ret) return ret; @@ -1076,17 +1080,19 @@ static struct iommu_domain *rk_iommu_domain_alloc_paging(struct device *dev) if (!rk_domain) return NULL; + iommu = rk_iommu_from_dev(dev); + rk_domain->rk_ops = iommu->rk_ops; + /* * rk32xx iommus use a 2 level pagetable. * Each level1 (dt) and level2 (pt) table has 1024 4-byte entries. * Allocate one 4 KiB page for each table. */ - rk_domain->dt = iommu_alloc_pages_sz(GFP_KERNEL | rk_ops->gfp_flags, + rk_domain->dt = iommu_alloc_pages_sz(GFP_KERNEL | rk_domain->rk_ops->gfp_flags, SPAGE_SIZE); if (!rk_domain->dt) goto err_free_domain; - iommu = rk_iommu_from_dev(dev); rk_domain->dma_dev = iommu->dev; rk_domain->dt_dma = dma_map_single(rk_domain->dma_dev, rk_domain->dt, SPAGE_SIZE, DMA_TO_DEVICE); @@ -1125,7 +1131,7 @@ static void rk_iommu_domain_free(struct iommu_domain *domain) for (i = 0; i < NUM_DT_ENTRIES; i++) { u32 dte = rk_domain->dt[i]; if (rk_dte_is_pt_valid(dte)) { - phys_addr_t pt_phys = rk_ops->pt_address(dte); + phys_addr_t pt_phys = rk_domain->rk_ops->pt_address(dte); u32 *page_table = phys_to_virt(pt_phys); dma_unmap_single(rk_domain->dma_dev, pt_phys, SPAGE_SIZE, DMA_TO_DEVICE); @@ -1205,7 +1211,6 @@ static int rk_iommu_probe(struct platform_device *pdev) struct device *dev = &pdev->dev; struct rk_iommu *iommu; struct resource *res; - const struct rk_iommu_ops *ops; int num_res = pdev->num_resources; int err, i; @@ -1219,16 +1224,9 @@ static int rk_iommu_probe(struct platform_device *pdev) iommu->dev = dev; iommu->num_mmu = 0; - ops = of_device_get_match_data(dev); - if (!rk_ops) - rk_ops = ops; - - /* - * That should not happen unless different versions of the - * hardware block are embedded the same SoC - */ - if (WARN_ON(rk_ops != ops)) - return -EINVAL; + iommu->rk_ops = of_device_get_match_data(dev); + if (!iommu->rk_ops) + return -ENOENT; iommu->bases = devm_kcalloc(dev, num_res, sizeof(*iommu->bases), GFP_KERNEL); @@ -1294,7 +1292,7 @@ static int rk_iommu_probe(struct platform_device *pdev) goto err_pm_disable; } - dma_set_mask_and_coherent(dev, rk_ops->dma_bit_mask); + dma_set_mask_and_coherent(dev, iommu->rk_ops->dma_bit_mask); err = iommu_device_sysfs_add(&iommu->iommu, dev, NULL, dev_name(dev)); if (err) From ea0a9d453f60d5d065c377bbd20ab8a78b8620b7 Mon Sep 17 00:00:00 2001 From: ZhaoJinming Date: Thu, 23 Jul 2026 21:26:43 +0800 Subject: [PATCH 38/93] iommu/rockchip: Fix silent probe success when all MMU resources fail When all MMU register mappings fail in rk_iommu_probe(), the error path returns PTR_ERR(iommu->bases[0]). However, bases[0] can be NULL if the first platform_get_resource() also returned NULL, causing PTR_ERR(NULL) to evaluate to 0 and the probe to succeed silently. Return -ENODEV directly instead. Signed-off-by: ZhaoJinming Signed-off-by: Will Deacon --- drivers/iommu/rockchip-iommu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c index d8cfce042dec..05643dbde26d 100644 --- a/drivers/iommu/rockchip-iommu.c +++ b/drivers/iommu/rockchip-iommu.c @@ -1243,7 +1243,7 @@ static int rk_iommu_probe(struct platform_device *pdev) iommu->num_mmu++; } if (iommu->num_mmu == 0) - return PTR_ERR(iommu->bases[0]); + return -ENODEV; iommu->num_irq = platform_irq_count(pdev); if (iommu->num_irq < 0) From 841363ebb5082a06c69ac34719e26659fe63dbd6 Mon Sep 17 00:00:00 2001 From: Jiaxing Hu Date: Sat, 18 Jul 2026 15:11:42 +1200 Subject: [PATCH 39/93] iommu/rockchip: Take all DT clocks rk_iommu only enabled a fixed {aclk,iface} pair. On the RK3576 NPU the MMU sits behind the CBUF/DSU gates, so writes to DTE_ADDR are silently dropped until those clocks run too (reads work, writes need more clocks). Use devm_clk_bulk_get_all() to take every clock the devicetree provides instead of a fixed pair, so a platform can list the full set it needs. Clocks stay optional for the older clock-less devicetrees. Signed-off-by: Jiaxing Hu Signed-off-by: Will Deacon --- drivers/iommu/rockchip-iommu.c | 28 +++++++++------------------- 1 file changed, 9 insertions(+), 19 deletions(-) diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c index 05643dbde26d..d041160d18af 100644 --- a/drivers/iommu/rockchip-iommu.c +++ b/drivers/iommu/rockchip-iommu.c @@ -104,11 +104,6 @@ struct rk_iommu_domain { struct iommu_domain domain; }; -/* list of clocks required by IOMMU */ -static const char * const rk_iommu_clocks[] = { - "aclk", "iface", -}; - struct rk_iommu { struct device *dev; void __iomem **bases; @@ -1252,25 +1247,20 @@ static int rk_iommu_probe(struct platform_device *pdev) iommu->reset_disabled = device_property_read_bool(dev, "rockchip,disable-mmu-reset"); - iommu->num_clocks = ARRAY_SIZE(rk_iommu_clocks); - iommu->clocks = devm_kcalloc(iommu->dev, iommu->num_clocks, - sizeof(*iommu->clocks), GFP_KERNEL); - if (!iommu->clocks) - return -ENOMEM; - - for (i = 0; i < iommu->num_clocks; ++i) - iommu->clocks[i].id = rk_iommu_clocks[i]; - /* - * iommu clocks should be present for all new devices and devicetrees - * but there are older devicetrees without clocks out in the wild. - * So clocks as optional for the time being. + * Take every clock the devicetree provides. Most IOMMU instances + * need exactly "aclk" + "iface", but e.g. the RK3576 NPU IOMMUs sit + * behind additional gates (CBUF/DSU) whose clocks must be running + * for register writes to land. Clocks stay optional because there + * are older devicetrees without clocks out in the wild. */ - err = devm_clk_bulk_get(iommu->dev, iommu->num_clocks, iommu->clocks); + err = devm_clk_bulk_get_all(iommu->dev, &iommu->clocks); if (err == -ENOENT) iommu->num_clocks = 0; - else if (err) + else if (err < 0) return err; + else + iommu->num_clocks = err; err = clk_bulk_prepare(iommu->num_clocks, iommu->clocks); if (err) From b10d5920cafa292ee3cab9c20f813da4fe4f00b8 Mon Sep 17 00:00:00 2001 From: Jiaxing Hu Date: Sat, 18 Jul 2026 15:11:43 +1200 Subject: [PATCH 40/93] iommu/rockchip: Clear stale page faults before enabling stall Boot firmware can leave an IOMMU bank in PAGE_FAULT_ACTIVE before the driver has configured paging: PAGE_FAULT_ACTIVE=1 STALL_ACTIVE=0 IDLE=1 Such a bank ignores CMD_ENABLE_STALL and never reaches STALL_ACTIVE, so rk_iommu_enable_stall()'s readx_poll_timeout() spins until it times out (seen on the RK3576 NPU, whose MMUs share this poll across banks). Rather than special-casing these banks in the stall path, acknowledge the stale fault with CMD_PAGE_FAULT_DONE before enabling stall, so every bank starts from a clean state and the normal stall sequence applies to all of them. Banks without a pending fault are untouched. Signed-off-by: Jiaxing Hu Signed-off-by: Will Deacon --- drivers/iommu/rockchip-iommu.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c index d041160d18af..21af2f621c76 100644 --- a/drivers/iommu/rockchip-iommu.c +++ b/drivers/iommu/rockchip-iommu.c @@ -418,6 +418,19 @@ static int rk_iommu_enable_stall(struct rk_iommu *iommu) if (!rk_iommu_is_paging_enabled(iommu)) return 0; + /* + * Boot firmware can leave a bank in PAGE_FAULT_ACTIVE with no handler + * (PAGE_FAULT_ACTIVE & !STALL_ACTIVE & IDLE). Such a bank ignores + * CMD_ENABLE_STALL and never reaches STALL_ACTIVE, timing out the poll + * below. Acknowledge any stale fault first so every bank starts clean. + */ + for (i = 0; i < iommu->num_mmu; i++) { + if (rk_iommu_read(iommu->bases[i], RK_MMU_STATUS) & + RK_MMU_STATUS_PAGE_FAULT_ACTIVE) + writel(RK_MMU_CMD_PAGE_FAULT_DONE, + iommu->bases[i] + RK_MMU_COMMAND); + } + rk_iommu_command(iommu, RK_MMU_CMD_ENABLE_STALL); ret = readx_poll_timeout(rk_iommu_is_stall_active, iommu, val, From 20df8037968d3c088e507586bcac44b51aae3cbd Mon Sep 17 00:00:00 2001 From: Ashish Mhetre Date: Mon, 22 Jun 2026 06:54:09 +0000 Subject: [PATCH 41/93] dt-bindings: iommu: Fix interrupt type in example The CMDQV interrupt on Tegra264 is edge-triggered per the hardware interrupt documentation, but the binding example describes it as level-triggered. Correct the example to use IRQ_TYPE_EDGE_RISING so that it does not propagate the wrong trigger type. Fixes: 8a59954192eb ("dt-bindings: iommu: Add NVIDIA Tegra CMDQV support") Reported-by: Nicolin Chen Signed-off-by: Ashish Mhetre Acked-by: Jon Hunter Acked-by: Nicolin Chen Acked-by: Conor Dooley Signed-off-by: Will Deacon --- .../devicetree/bindings/iommu/nvidia,tegra264-cmdqv.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Documentation/devicetree/bindings/iommu/nvidia,tegra264-cmdqv.yaml b/Documentation/devicetree/bindings/iommu/nvidia,tegra264-cmdqv.yaml index 3f5006a59805..76ef34fe5c72 100644 --- a/Documentation/devicetree/bindings/iommu/nvidia,tegra264-cmdqv.yaml +++ b/Documentation/devicetree/bindings/iommu/nvidia,tegra264-cmdqv.yaml @@ -38,5 +38,5 @@ examples: cmdqv@5200000 { compatible = "nvidia,tegra264-cmdqv"; reg = <0x5200000 0x830000>; - interrupts = ; + interrupts = ; }; From 097bf4a02f2df3e4ea8729664df436d0fe914ea5 Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Sun, 26 Jul 2026 08:19:01 +0000 Subject: [PATCH 42/93] iommu/arm-smmu-v3: Factor out CMDQ batch force-sync conditions arm_smmu_cmdq_batch_add_cmd_p() carries two distinct reasons for flushing the current batch with a CMD_SYNC before appending the new command: - The batch's pre-assigned cmdq does not support the new command. - The Arm erratum 2812531 workaround (ARM_SMMU_OPT_CMDQ_FORCE_SYNC) forces a SYNC at one entry before the batch is full. Lift those checks into a new arm_smmu_cmdq_batch_force_sync() helper so that adding another force-sync condition becomes a one-line addition. No functional change. Signed-off-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Signed-off-by: Ashish Mhetre Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 23 +++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 251fe0fac80c..7c8cd8dbbd9b 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -847,16 +847,27 @@ static void arm_smmu_cmdq_batch_init_cmd(struct arm_smmu_device *smmu, cmds->cmdq = arm_smmu_get_cmdq(smmu, cmd); } +static bool arm_smmu_cmdq_batch_force_sync(struct arm_smmu_device *smmu, + struct arm_smmu_cmdq_batch *cmds, + struct arm_smmu_cmd *cmd) +{ + /* The batch's pre-assigned cmdq doesn't support the new command */ + if (!arm_smmu_cmdq_supports_cmd(cmds->cmdq, cmd)) + return true; + + /* Arm erratum 2812531 */ + if (cmds->num == CMDQ_BATCH_ENTRIES - 1 && + (smmu->options & ARM_SMMU_OPT_CMDQ_FORCE_SYNC)) + return true; + + return false; +} + static void arm_smmu_cmdq_batch_add_cmd_p(struct arm_smmu_device *smmu, struct arm_smmu_cmdq_batch *cmds, struct arm_smmu_cmd *cmd) { - bool force_sync = (cmds->num == CMDQ_BATCH_ENTRIES - 1) && - (smmu->options & ARM_SMMU_OPT_CMDQ_FORCE_SYNC); - bool unsupported_cmd; - - unsupported_cmd = !arm_smmu_cmdq_supports_cmd(cmds->cmdq, cmd); - if (force_sync || unsupported_cmd) { + if (arm_smmu_cmdq_batch_force_sync(smmu, cmds, cmd)) { arm_smmu_cmdq_issue_cmdlist(smmu, cmds->cmdq, cmds->cmds, cmds->num, true); arm_smmu_cmdq_batch_init_cmd(smmu, cmds, cmd); From 95ed2da20283844dfc0bb9d78c898b8529284af6 Mon Sep 17 00:00:00 2001 From: Ashish Mhetre Date: Sun, 26 Jul 2026 08:19:02 +0000 Subject: [PATCH 43/93] iommu/arm-smmu-v3: Add CFGI/TLBI-repeat workaround Tegra264 SMMU instances need every CFGI/TLBI command sequence issued twice, with the second issue executing only after the first issue's CMD_SYNC has completed: TLBI/CFGI ... CMD_SYNC TLBI/CFGI ... CMD_SYNC ATC_INV is not affected and must never be doubled. Add arm_smmu_erratum_repeat_tlbi_cfgi_key and a file-local arm_smmu_erratum_cmd_needs_repeating() helper that gates on the static key first and then range-checks the opcode (CFGI_STE .. ATC_INV). Rename the existing arm_smmu_cmdq_issue_cmdlist() to __arm_smmu_cmdq_issue_cmdlist() and add a thin wrapper of the original name that re-issues the same cmdlist a second time when the predicate fires. Register the new condition with arm_smmu_cmdq_batch_force_sync() too. No callers enable the static key yet, so there is no functional change. A subsequent change will enable the key on affected instances. Suggested-by: Nicolin Chen Reviewed-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Signed-off-by: Ashish Mhetre Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 57 +++++++++++++++++++-- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 4 ++ 2 files changed, 57 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 7c8cd8dbbd9b..8dc0586f015e 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include #include @@ -42,6 +43,14 @@ MODULE_PARM_DESC(disable_msipolling, static const struct iommu_ops arm_smmu_ops; static struct iommu_dirty_ops arm_smmu_dirty_ops; +/* + * Repeat every {CFGI,TLBI};CMD_SYNC command sequence so that the second + * issue executes only after the first issue's CMD_SYNC has completed. + * Does not apply to ATC_INV. The key is global and is enabled from DT + * probe on affected hardware (currently Tegra264 only). + */ +static DEFINE_STATIC_KEY_FALSE(arm_smmu_erratum_repeat_tlbi_cfgi_key); + enum arm_smmu_msi_index { EVTQ_MSI_INDEX, GERROR_MSI_INDEX, @@ -698,10 +707,10 @@ static void arm_smmu_cmdq_write_entries(struct arm_smmu_cmdq *cmdq, * insert their own list of commands then all of the commands from one * CPU will appear before any of the commands from the other CPU. */ -int arm_smmu_cmdq_issue_cmdlist(struct arm_smmu_device *smmu, - struct arm_smmu_cmdq *cmdq, - struct arm_smmu_cmd *cmds, int n, - bool sync) +int __arm_smmu_cmdq_issue_cmdlist(struct arm_smmu_device *smmu, + struct arm_smmu_cmdq *cmdq, + struct arm_smmu_cmd *cmds, int n, + bool sync) { struct arm_smmu_cmd cmd_sync; u32 prod; @@ -820,6 +829,38 @@ int arm_smmu_cmdq_issue_cmdlist(struct arm_smmu_device *smmu, return ret; } +static bool arm_smmu_erratum_cmd_needs_repeating(struct arm_smmu_cmd *cmd) +{ + u8 opcode; + + if (!static_branch_unlikely(&arm_smmu_erratum_repeat_tlbi_cfgi_key)) + return false; + + opcode = FIELD_GET(CMDQ_0_OP, cmd->data[0]); + return opcode >= CMDQ_OP_CFGI_STE && opcode < CMDQ_OP_ATC_INV; +} + +int arm_smmu_cmdq_issue_cmdlist(struct arm_smmu_device *smmu, + struct arm_smmu_cmdq *cmdq, + struct arm_smmu_cmd *cmds, int n, + bool sync) +{ + int ret = __arm_smmu_cmdq_issue_cmdlist(smmu, cmdq, cmds, n, sync); + + /* + * A bare CMD_SYNC can be issued with n == 0 (e.g. an empty + * batch_submit()), in which case there is no cmds[0] to inspect + * and nothing to repeat. + */ + if (!n || ret || !sync) + return ret; + + if (arm_smmu_erratum_cmd_needs_repeating(&cmds[0])) + ret = __arm_smmu_cmdq_issue_cmdlist(smmu, cmdq, cmds, n, sync); + + return ret; +} + static int arm_smmu_cmdq_issue_cmd_p(struct arm_smmu_device *smmu, struct arm_smmu_cmd *cmd, bool sync) { @@ -860,6 +901,14 @@ static bool arm_smmu_cmdq_batch_force_sync(struct arm_smmu_device *smmu, (smmu->options & ARM_SMMU_OPT_CMDQ_FORCE_SYNC)) return true; + /* + * See the description at arm_smmu_erratum_repeat_tlbi_cfgi_key. Batches + * never mix CFGI/TLBI with others, so checking cmds[0] alone is enough. + */ + if (cmds->num == CMDQ_BATCH_ENTRIES && + arm_smmu_erratum_cmd_needs_repeating(&cmds->cmds[0])) + return true; + return false; } diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h index 1c4877ada1ee..3030f07a7c85 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h @@ -1208,6 +1208,10 @@ void arm_smmu_attach_commit(struct arm_smmu_attach_state *state); void arm_smmu_install_ste_for_dev(struct arm_smmu_master *master, const struct arm_smmu_ste *target); +int __arm_smmu_cmdq_issue_cmdlist(struct arm_smmu_device *smmu, + struct arm_smmu_cmdq *cmdq, + struct arm_smmu_cmd *cmds, int n, + bool sync); int arm_smmu_cmdq_issue_cmdlist(struct arm_smmu_device *smmu, struct arm_smmu_cmdq *cmdq, struct arm_smmu_cmd *cmds, int n, From d501d66815eeb0e6641ce61e7eeb2beea19eadf5 Mon Sep 17 00:00:00 2001 From: Ashish Mhetre Date: Sun, 26 Jul 2026 08:19:03 +0000 Subject: [PATCH 44/93] iommu/arm-smmu-v3-iommufd: Report CFGI/TLBI-repeat erratum A guest with access to VCMDQ generates its own invalidation commands and must apply any invalidation errata before submitting them. If the host also repeats those commands, each affected invalidation is issued four times instead of twice. Add IOMMU_HW_INFO_ARM_SMMUV3_ERRATA_REPEAT_TLBI_CFGI to report the CFGI/TLBI-repeat erratum to user space. This allows the VMM to expose the erratum to the guest or apply the workaround itself. Use the raw __arm_smmu_cmdq_issue_cmdlist() helper for user-provided invalidations so the host does not apply the workaround a second time. Add arm_smmu_erratum_repeat_tlbi_cfgi() to query the static key when populating the SMMUv3 hardware information. Signed-off-by: Ashish Mhetre Reviewed-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 7 +++++-- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 7 ++++++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 + include/uapi/linux/iommufd.h | 13 ++++++++++++- 4 files changed, 24 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c index 1e9f7d2de344..76333091ec15 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c @@ -33,6 +33,9 @@ void *arm_smmu_hw_info(struct device *dev, u32 *length, info->iidr = readl_relaxed(master->smmu->base + ARM_SMMU_IIDR); info->aidr = readl_relaxed(master->smmu->base + ARM_SMMU_AIDR); + if (arm_smmu_erratum_repeat_tlbi_cfgi()) + info->flags |= IOMMU_HW_INFO_ARM_SMMUV3_ERRATA_REPEAT_TLBI_CFGI; + *length = sizeof(*info); *type = IOMMU_HW_INFO_TYPE_ARM_SMMUV3; @@ -386,8 +389,8 @@ int arm_vsmmu_cache_invalidate(struct iommufd_viommu *viommu, continue; /* FIXME always uses the main cmdq rather than trying to group by type */ - ret = arm_smmu_cmdq_issue_cmdlist(smmu, &smmu->cmdq, &last->cmd, - cur - last, true); + ret = __arm_smmu_cmdq_issue_cmdlist(smmu, &smmu->cmdq, &last->cmd, + cur - last, true); if (ret) { cur--; goto out; diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 8dc0586f015e..a78e85f4b457 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -829,11 +829,16 @@ int __arm_smmu_cmdq_issue_cmdlist(struct arm_smmu_device *smmu, return ret; } +bool arm_smmu_erratum_repeat_tlbi_cfgi(void) +{ + return static_branch_unlikely(&arm_smmu_erratum_repeat_tlbi_cfgi_key); +} + static bool arm_smmu_erratum_cmd_needs_repeating(struct arm_smmu_cmd *cmd) { u8 opcode; - if (!static_branch_unlikely(&arm_smmu_erratum_repeat_tlbi_cfgi_key)) + if (!arm_smmu_erratum_repeat_tlbi_cfgi()) return false; opcode = FIELD_GET(CMDQ_0_OP, cmd->data[0]); diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h index 3030f07a7c85..43f4d24e7847 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h @@ -1216,6 +1216,7 @@ int arm_smmu_cmdq_issue_cmdlist(struct arm_smmu_device *smmu, struct arm_smmu_cmdq *cmdq, struct arm_smmu_cmd *cmds, int n, bool sync); +bool arm_smmu_erratum_repeat_tlbi_cfgi(void); #ifdef CONFIG_ARM_SMMU_V3_SVA bool arm_smmu_sva_supported(struct arm_smmu_device *smmu); diff --git a/include/uapi/linux/iommufd.h b/include/uapi/linux/iommufd.h index 0425d452d41e..f73a392b3d3f 100644 --- a/include/uapi/linux/iommufd.h +++ b/include/uapi/linux/iommufd.h @@ -574,11 +574,22 @@ struct iommu_hw_info_vtd { __aligned_u64 ecap_reg; }; +/** + * enum iommu_hw_info_arm_smmuv3_flags - Flags for ARM SMMUv3 hw_info + * @IOMMU_HW_INFO_ARM_SMMUV3_ERRATA_REPEAT_TLBI_CFGI: + * If set, user space must issue TLBI/CFGI+SYNC commands twice due to + * hardware erratum T264-SMMU-3. See the description at + * arm_smmu_erratum_repeat_tlbi_cfgi_key. + */ +enum iommu_hw_info_arm_smmuv3_flags { + IOMMU_HW_INFO_ARM_SMMUV3_ERRATA_REPEAT_TLBI_CFGI = 1 << 0, +}; + /** * struct iommu_hw_info_arm_smmuv3 - ARM SMMUv3 hardware information * (IOMMU_HW_INFO_TYPE_ARM_SMMUV3) * - * @flags: Must be set to 0 + * @flags: Combination of enum iommu_hw_info_arm_smmuv3_flags * @__reserved: Must be 0 * @idr: Implemented features for ARM SMMU Non-secure programming interface * @iidr: Information about the implementation and implementer of ARM SMMU, From 06b15ddcfbc04ddd1cf6b339cf80779a68cf9efe Mon Sep 17 00:00:00 2001 From: Ashish Mhetre Date: Sun, 26 Jul 2026 08:19:04 +0000 Subject: [PATCH 45/93] iommu/arm-smmu-v3: Enable CFGI/TLBI-repeat workaround on Tegra264 Nvidia Tegra264 SMMU is affected by an erratum where a TLB entry can survive an invalidation that races with concurrent traffic targeting the same entry. The hardware-recommended software workaround is to issue every CFGI/TLBI command (each followed by CMD_SYNC) twice, and that infrastructure is already in place behind arm_smmu_erratum_repeat_tlbi_cfgi_key. Neither IDR nor IIDR flags this Tegra264-specific bug, so hardware detection is not possible. Tegra264 is device-tree-only (no ACPI/IORT support) and already has a dedicated "nvidia,tegra264-smmu" compatible, so DT-probe is the only viable detection path. Enable the workaround on instances matching the existing "nvidia,tegra264-smmu" compatible by calling static_branch_enable() on arm_smmu_erratum_repeat_tlbi_cfgi_key. Document the erratum in Documentation/arch/arm64/silicon-errata.rst. Signed-off-by: Ashish Mhetre Reviewed-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon --- Documentation/arch/arm64/silicon-errata.rst | 2 ++ drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/Documentation/arch/arm64/silicon-errata.rst b/Documentation/arch/arm64/silicon-errata.rst index 014aa1c215a1..076b3947d259 100644 --- a/Documentation/arch/arm64/silicon-errata.rst +++ b/Documentation/arch/arm64/silicon-errata.rst @@ -312,6 +312,8 @@ stable kernels. | | | T241-MPAM-4, | | | | | T241-MPAM-6 | | +----------------+-----------------+-----------------+-----------------------------+ +| NVIDIA | T264 SMMU | T264-SMMU-3 | N/A | ++----------------+-----------------+-----------------+-----------------------------+ +----------------+-----------------+-----------------+-----------------------------+ | Freescale/NXP | LS2080A/LS1043A | A-008585 | FSL_ERRATUM_A008585 | +----------------+-----------------+-----------------+-----------------------------+ diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index a78e85f4b457..3a9cbd7d8a00 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -5386,8 +5386,10 @@ static int arm_smmu_device_dt_probe(struct platform_device *pdev, if (of_dma_is_coherent(dev->of_node)) smmu->features |= ARM_SMMU_FEAT_COHERENCY; - if (of_device_is_compatible(dev->of_node, "nvidia,tegra264-smmu")) + if (of_device_is_compatible(dev->of_node, "nvidia,tegra264-smmu")) { tegra_cmdqv_dt_probe(dev->of_node, smmu); + static_branch_enable(&arm_smmu_erratum_repeat_tlbi_cfgi_key); + } return ret; } From cbc41aacd49e695338940196e7084770365e1b68 Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Tue, 14 Jul 2026 13:54:58 -0700 Subject: [PATCH 46/93] iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized tegra241_vintf_init_lvcmdq() stores the freshly allocated vcmdq pointer to the vintf->lvcmdqs[] array, before tegra241_vcmdq_alloc_smmu_cmdq() builds the vcmdq->cmdq. The error ISR dereferences that cmdq, so a latched LVCMDQ error (e.g. one inherited across a kexec) firing in this window would make tegra241_vintf0_handle_error() pass the still-zeroed arm_smmu_cmdq down to __arm_smmu_cmdq_skip_err(), dereferencing NULL queue register pointers. Drop the store from tegra241_vintf_init_lvcmdq() and publish the vcmdq at the end of the allocation instead, with an smp_store_release() that pairs with an smp_load_acquire() in the ISR, which can see a fully built LVCMDQ or NULL. The user-owned LVCMDQ allocation moves accordingly, publishing the vcmdq once tegra241_vcmdq_hw_init_user() succeeds, using a plain store since a user VINTF's lvcmdqs[] has no lockless reader -- the error ISR only walks the VINTF0 array. Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV") Assisted-by: Claude:claude-fable-5 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon --- .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c index aaf9ce38bd93..71c7ef52dad6 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -318,12 +318,19 @@ static void tegra241_vintf0_handle_error(struct tegra241_vintf *vintf) while (map) { unsigned long lidx = __ffs64(map); - struct tegra241_vcmdq *vcmdq = vintf->lvcmdqs[lidx]; - u32 gerror = readl_relaxed(REG_VCMDQ_PAGE0(vcmdq, GERROR)); + struct tegra241_vcmdq *vcmdq; + u32 gerror; + map &= ~BIT_ULL(lidx); + + /* Pairs with smp_store_release() publishing it */ + vcmdq = smp_load_acquire(&vintf->lvcmdqs[lidx]); + if (!vcmdq) + continue; + + gerror = readl_relaxed(REG_VCMDQ_PAGE0(vcmdq, GERROR)); __arm_smmu_cmdq_skip_err(&vintf->cmdqv->smmu, &vcmdq->cmdq); writel(gerror, REG_VCMDQ_PAGE0(vcmdq, GERRORN)); - map &= ~BIT_ULL(lidx); } } } @@ -666,7 +673,6 @@ static int tegra241_vintf_init_lvcmdq(struct tegra241_vintf *vintf, u16 lidx, vcmdq->page0 = cmdqv->base + TEGRA241_VINTFi_LVCMDQ_PAGE0(idx, lidx); vcmdq->page1 = cmdqv->base + TEGRA241_VINTFi_LVCMDQ_PAGE1(idx, lidx); - vintf->lvcmdqs[lidx] = vcmdq; return 0; } @@ -705,14 +711,15 @@ tegra241_vintf_alloc_lvcmdq(struct tegra241_vintf *vintf, u16 lidx) /* Build an arm_smmu_cmdq for each LVCMDQ */ ret = tegra241_vcmdq_alloc_smmu_cmdq(vcmdq); if (ret) - goto deinit_lvcmdq; + goto free_vcmdq; + + /* Pairs with the smp_load_acquire() in the error ISR */ + smp_store_release(&vintf->lvcmdqs[lidx], vcmdq); dev_dbg(cmdqv->dev, "%sallocated\n", lvcmdq_error_header(vcmdq, header, 64)); return vcmdq; -deinit_lvcmdq: - tegra241_vintf_deinit_lvcmdq(vintf, lidx); free_vcmdq: kfree(vcmdq); return ERR_PTR(ret); @@ -1140,13 +1147,15 @@ static int tegra241_vintf_alloc_lvcmdq_user(struct iommufd_hw_queue *hw_queue, if (ret) goto unmap_lvcmdq; + /* No lockless reader of a user VINTF's lvcmdqs[]; mutex-serialized */ + vintf->lvcmdqs[lidx] = vcmdq; + hw_queue->destroy = &tegra241_vintf_destroy_lvcmdq_user; mutex_unlock(&vintf->lvcmdq_mutex); return 0; unmap_lvcmdq: tegra241_vcmdq_unmap_lvcmdq(vcmdq); - tegra241_vintf_deinit_lvcmdq(vintf, lidx); undepend_vcmdq: if (vcmdq->prev) iommufd_hw_queue_undepend(vcmdq, vcmdq->prev, core); From a491be376abd1c80a314cdd658632c85cd660b73 Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Tue, 14 Jul 2026 13:54:59 -0700 Subject: [PATCH 47/93] iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init A user VINTF is torn down by tegra241_cmdqv_deinit_vintf(), which runs from the destroy callback and from the init-failure unwind in the alloc handler. It clears the cmdqv->vintfs[] slot and lets the iommufd core free it, but nothing serializes that against the error interrupt: tegra241_cmdqv_isr() reads cmdqv->vintfs[idx] and dereferences the vintf. A concurrent error can make the ISR read a slot mid-clear (a NULL deref) or use a vintf which is about to be freed (a use-after-free). deinit_vintf() also returns idx to the IDA before clearing the slot, so a concurrent create that reuses idx can publish its new vintf into the slot, only for this teardown to erase it again with the stale NULL store. On the other end, tegra241_cmdqv_init_vintf() publishes a new vintf with a plain store to the cmdqv->vintfs[] slot, and the ISR dereferences fields of a published vintf such as vintf->base. A plain store gives no ordering on a weakly-ordered CPU, and a stale VINTF_ERR_MAP bit on a reused idx can make the ISR pick a vintf the moment it is published, before its fields are set or tegra241_vintf_hw_init() runs. The cmdqv->vintfs[0] slot stays NULL until tegra241_cmdqv_init_structures() first creates VINTF0, so the slot 0 read needs the same NULL check. Publish every slot with an smp_store_release(), and read each slot in the ISR with an smp_load_acquire() under a NULL check, so the ISR always sees a fully built vintf or NULL. Also make deinit_vintf() clear the slot, and synchronize_irq() prior to returning idx to the IDA, so no vintf is freed under a running handler and no reused idx is clobbered. Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon --- .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 37 +++++++++++++++++-- 1 file changed, 33 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c index 71c7ef52dad6..49f085c11edb 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -335,6 +335,13 @@ static void tegra241_vintf0_handle_error(struct tegra241_vintf *vintf) } } +/* + * The CMDQV error interrupt is edge-triggered, so a pending VINTF error fires + * this ISR once and does not re-assert. An unacked guest therefore cannot + * storm the host. The HW latches and forwards each new error event on its + * own, so an already-set ERR_MAP bit does not suppress the interrupt for a + * new error. + */ static irqreturn_t tegra241_cmdqv_isr(int irq, void *devid) { struct tegra241_cmdqv *cmdqv = (struct tegra241_cmdqv *)devid; @@ -357,16 +364,27 @@ static irqreturn_t tegra241_cmdqv_isr(int irq, void *devid) /* Handle VINTF0 and its LVCMDQs */ if (vintf_map & BIT_ULL(0)) { - tegra241_vintf0_handle_error(cmdqv->vintfs[0]); + struct tegra241_vintf *vintf0; + vintf_map &= ~BIT_ULL(0); + + /* NULL until tegra241_cmdqv_init_structures() publishes it */ + vintf0 = smp_load_acquire(&cmdqv->vintfs[0]); + if (vintf0) + tegra241_vintf0_handle_error(vintf0); } /* Handle other user VINTFs and their LVCMDQs */ while (vintf_map) { unsigned long idx = __ffs64(vintf_map); + struct tegra241_vintf *vintf; - tegra241_vintf_user_handle_error(cmdqv->vintfs[idx]); vintf_map &= ~BIT_ULL(idx); + + /* The slot may be published or torn down (NULL'd) concurrently */ + vintf = smp_load_acquire(&cmdqv->vintfs[idx]); + if (vintf) + tegra241_vintf_user_handle_error(vintf); } return IRQ_HANDLED; @@ -730,8 +748,18 @@ tegra241_vintf_alloc_lvcmdq(struct tegra241_vintf *vintf, u16 lidx) static void tegra241_cmdqv_deinit_vintf(struct tegra241_cmdqv *cmdqv, u16 idx) { kfree(cmdqv->vintfs[idx]->lvcmdqs); + /* + * Clear the slot and drain any in-flight ISR before returning idx to + * the IDA, so a concurrent create that reuses idx cannot have its + * freshly published VINTF erased here. A plain WRITE_ONCE() suffices + * since clearing the slot publishes no data. This also covers the + * init-failure unwind, which reaches deinit_vintf() without the + * destroy callback. + */ + WRITE_ONCE(cmdqv->vintfs[idx], NULL); + if (cmdqv->irq > 0) + synchronize_irq(cmdqv->irq); ida_free(&cmdqv->vintf_ids, idx); - cmdqv->vintfs[idx] = NULL; } static int tegra241_cmdqv_init_vintf(struct tegra241_cmdqv *cmdqv, u16 max_idx, @@ -757,7 +785,8 @@ static int tegra241_cmdqv_init_vintf(struct tegra241_cmdqv *cmdqv, u16 max_idx, return -ENOMEM; } - cmdqv->vintfs[idx] = vintf; + /* Pairs with the smp_load_acquire() in tegra241_cmdqv_isr() */ + smp_store_release(&cmdqv->vintfs[idx], vintf); return ret; } From a2ee315db42610c8bb0fa8f37b4cc8082b7c8f42 Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Tue, 14 Jul 2026 13:55:00 -0700 Subject: [PATCH 48/93] iommu/tegra241-cmdqv: Harden error-map index handling in the error ISR tegra241_vintf0_handle_error() reads both 64-bit LVCMDQ error-map registers but used the register-local __ffs64() bit directly as the vintf->lvcmdqs[] index. For the second register that selects the wrong queue instead of 64 * i + bit, clearing the wrong queue's error status. The index is unbounded too: a bit at or beyond num_lvcmdqs_per_vintf would walk the read off vintf->lvcmdqs[]. tegra241_cmdqv_isr() has the same flaw one level up: a VINTF_ERR_MAP bit at or beyond num_vintfs would walk the read off cmdqv->vintfs[]. Use 64 * i + bit for the index and clear the snapshot with the local bit. In both handlers, WARN_ON_ONCE() and skip an out-of-bounds index. Only a malfunctioning device sets such a bit, so the _ONCE form keeps a wedged map from flooding the log. Note that 64 * i + bit is not reachable with the current configuration as a VINTF is pre-assigned with 2 lvcmdqs, this is not treated as bug fix but an defensive hardening. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c index 49f085c11edb..cc80426558d5 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -311,25 +311,30 @@ static void tegra241_vintf_user_handle_error(struct tegra241_vintf *vintf) static void tegra241_vintf0_handle_error(struct tegra241_vintf *vintf) { + struct tegra241_cmdqv *cmdqv = vintf->cmdqv; int i; for (i = 0; i < LVCMDQ_ERR_MAP_NUM_64; i++) { u64 map = readq_relaxed(REG_VINTF(vintf, LVCMDQ_ERR_MAP_64(i))); while (map) { - unsigned long lidx = __ffs64(map); + unsigned long map_bit = __ffs64(map); + unsigned long lidx = 64 * i + map_bit; struct tegra241_vcmdq *vcmdq; u32 gerror; - map &= ~BIT_ULL(lidx); + map &= ~BIT_ULL(map_bit); + /* A bit beyond the count means a HW error; skip it */ + if (WARN_ON_ONCE(lidx >= cmdqv->num_lvcmdqs_per_vintf)) + continue; /* Pairs with smp_store_release() publishing it */ vcmdq = smp_load_acquire(&vintf->lvcmdqs[lidx]); if (!vcmdq) continue; gerror = readl_relaxed(REG_VCMDQ_PAGE0(vcmdq, GERROR)); - __arm_smmu_cmdq_skip_err(&vintf->cmdqv->smmu, &vcmdq->cmdq); + __arm_smmu_cmdq_skip_err(&cmdqv->smmu, &vcmdq->cmdq); writel(gerror, REG_VCMDQ_PAGE0(vcmdq, GERRORN)); } } @@ -381,6 +386,9 @@ static irqreturn_t tegra241_cmdqv_isr(int irq, void *devid) vintf_map &= ~BIT_ULL(idx); + /* A bit beyond the count means a HW error; skip it */ + if (WARN_ON_ONCE(idx >= cmdqv->num_vintfs)) + continue; /* The slot may be published or torn down (NULL'd) concurrently */ vintf = smp_load_acquire(&cmdqv->vintfs[idx]); if (vintf) From 5acd67ceb38debe2fbf70ea35e2dec9f7ab01bbd Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Tue, 14 Jul 2026 13:55:01 -0700 Subject: [PATCH 49/93] iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs __tegra241_cmdqv_probe() requests the error IRQ before it has allocated the cmdqv->vintfs array and set cmdqv->num_vintfs. A CMDQV left enabled with a latched error across a kexec fires the IRQ as soon as it is requested, and tegra241_cmdqv_isr() then walks the uninitialized cmdqv->vintfs array. Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so that a latched interrupt firing early runs the ISR against a valid array of NULL slots that it safely skips. Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon --- .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 34 +++++++++++-------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c index cc80426558d5..8d6da7b0f6ba 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -983,17 +983,6 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res, cmdqv->dev = smmu->impl_dev; cmdqv->base_phys = res->start; - if (cmdqv->irq > 0) { - ret = request_threaded_irq(irq, NULL, tegra241_cmdqv_isr, - IRQF_ONESHOT, "tegra241-cmdqv", - cmdqv); - if (ret) { - dev_err(cmdqv->dev, "failed to request irq (%d): %d\n", - cmdqv->irq, ret); - goto iounmap; - } - } - regval = readl_relaxed(REG_CMDQV(cmdqv, PARAM)); cmdqv->num_vintfs = 1 << FIELD_GET(CMDQV_NUM_VINTF_LOG2, regval); cmdqv->num_vcmdqs = 1 << FIELD_GET(CMDQV_NUM_VCMDQ_LOG2, regval); @@ -1004,10 +993,25 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res, cmdqv->vintfs = kzalloc_objs(*cmdqv->vintfs, cmdqv->num_vintfs); if (!cmdqv->vintfs) - goto free_irq; + goto iounmap; ida_init(&cmdqv->vintf_ids); + /* + * Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so + * the ISR would not walk an uninitialized array. + */ + if (cmdqv->irq > 0) { + ret = request_threaded_irq(irq, NULL, tegra241_cmdqv_isr, + IRQF_ONESHOT, "tegra241-cmdqv", + cmdqv); + if (ret) { + dev_err(cmdqv->dev, "failed to request irq (%d): %d\n", + cmdqv->irq, ret); + goto free_vintfs; + } + } + #ifdef CONFIG_IOMMU_DEBUGFS if (!cmdqv_debugfs_dir) { cmdqv_debugfs_dir = @@ -1022,9 +1026,9 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res, return new_smmu; -free_irq: - if (cmdqv->irq > 0) - free_irq(cmdqv->irq, cmdqv); +free_vintfs: + ida_destroy(&cmdqv->vintf_ids); + kfree(cmdqv->vintfs); iounmap: iounmap(base); return NULL; From d4d05f55e9da646ec03adfa77260eb46f4163749 Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Tue, 14 Jul 2026 13:55:02 -0700 Subject: [PATCH 50/93] iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc() __tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path. Return an int and take @smmu by reference instead, then update *smmu to the reallocated pointer after devm_krealloc() succeeds, so the caller and its fallback path both use the live @smmu rather than the freed original. Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon --- .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 54 +++++++++++-------- 1 file changed, 32 insertions(+), 22 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c index 8d6da7b0f6ba..7233aa6c2d6e 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -944,16 +944,22 @@ static int tegra241_cmdqv_init_structures(struct arm_smmu_device *smmu) static struct dentry *cmdqv_debugfs_dir; #endif -static struct arm_smmu_device * -__tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res, - int irq) +/* + * Probe the CMDQV and reallocate @smmu into the larger cmdqv->smmu. + * + * devm_krealloc() may relocate and free the original @smmu, so update *smmu to + * the new pointer once it succeeds. The error paths after it do the same, so a + * caller falling back keeps a live @smmu instead of the freed original. + */ +static int __tegra241_cmdqv_probe(struct arm_smmu_device **smmu, + struct resource *res, int irq) { static const struct arm_smmu_impl_ops init_ops = { .init_structures = tegra241_cmdqv_init_structures, .device_remove = tegra241_cmdqv_remove, }; - struct tegra241_cmdqv *cmdqv = NULL; - struct arm_smmu_device *new_smmu; + struct device *dev = (*smmu)->dev; + struct tegra241_cmdqv *cmdqv; void __iomem *base; u32 regval; int ret; @@ -962,25 +968,28 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res, base = ioremap(res->start, resource_size(res)); if (!base) { - dev_err(smmu->dev, "failed to ioremap\n"); - return NULL; + dev_err(dev, "failed to ioremap\n"); + return -ENOMEM; } regval = readl(base + TEGRA241_CMDQV_CONFIG); if (disable_cmdqv) { - dev_info(smmu->dev, "Detected disable_cmdqv=true\n"); + dev_info(dev, "Detected disable_cmdqv=true\n"); writel(regval & ~CMDQV_EN, base + TEGRA241_CMDQV_CONFIG); + ret = -ENODEV; goto iounmap; } - cmdqv = devm_krealloc(smmu->dev, smmu, sizeof(*cmdqv), GFP_KERNEL); - if (!cmdqv) + cmdqv = devm_krealloc(dev, *smmu, sizeof(*cmdqv), GFP_KERNEL); + if (!cmdqv) { + ret = -ENOMEM; goto iounmap; - new_smmu = &cmdqv->smmu; + } + *smmu = &cmdqv->smmu; cmdqv->irq = irq; cmdqv->base = base; - cmdqv->dev = smmu->impl_dev; + cmdqv->dev = (*smmu)->impl_dev; cmdqv->base_phys = res->start; regval = readl_relaxed(REG_CMDQV(cmdqv, PARAM)); @@ -992,8 +1001,10 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res, cmdqv->vintfs = kzalloc_objs(*cmdqv->vintfs, cmdqv->num_vintfs); - if (!cmdqv->vintfs) + if (!cmdqv->vintfs) { + ret = -ENOMEM; goto iounmap; + } ida_init(&cmdqv->vintf_ids); @@ -1022,24 +1033,23 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res, #endif /* Provide init-level ops only, until tegra241_cmdqv_init_structures */ - new_smmu->impl_ops = &init_ops; + cmdqv->smmu.impl_ops = &init_ops; - return new_smmu; + return 0; free_vintfs: ida_destroy(&cmdqv->vintf_ids); kfree(cmdqv->vintfs); iounmap: iounmap(base); - return NULL; + return ret; } struct arm_smmu_device *tegra241_cmdqv_probe(struct arm_smmu_device *smmu) { struct platform_device *pdev = to_platform_device(smmu->impl_dev); - struct arm_smmu_device *new_smmu; struct resource *res; - int irq; + int irq, ret; res = platform_get_resource(pdev, IORESOURCE_MEM, 0); if (!res) { @@ -1052,15 +1062,15 @@ struct arm_smmu_device *tegra241_cmdqv_probe(struct arm_smmu_device *smmu) dev_warn(&pdev->dev, "no interrupt. errors will not be reported\n"); - new_smmu = __tegra241_cmdqv_probe(smmu, res, irq); - if (new_smmu) - return new_smmu; + ret = __tegra241_cmdqv_probe(&smmu, res, irq); + if (!ret) + return smmu; out_fallback: dev_info(smmu->impl_dev, "Falling back to standard SMMU CMDQ\n"); smmu->options &= ~ARM_SMMU_OPT_TEGRA241_CMDQV; put_device(smmu->impl_dev); - return ERR_PTR(-ENODEV); + return smmu; } /* User space VINTF and VCMDQ Functions */ From 61f0d437988e5730b04442f6a7d30a9907339f2a Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Tue, 14 Jul 2026 13:55:03 -0700 Subject: [PATCH 51/93] iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs tegra241_cmdqv_remove() tears each VINTF down first, then calls free_irq(). Tearing a VINTF down frees vintf0 and clears cmdqv->vintfs[0]. An error in that window makes tegra241_cmdqv_isr() read the stale slot and hand it to tegra241_vintf0_handle_error(), which dereferences a NULL or freed pointer. Free the IRQ before tearing the VINTFs down. free_irq() waits for in-flight handlers to finish and blocks new ones, so no ISR can observe a VINTF as it is torn down. Note: a user-owned VINTF (viommu) could outlive this teardown, which unmaps cmdqv->base and frees cmdqv->vintfs, so a later viommu close then touches freed memory. This is neither introduced nor fixed here: a physical IOMMU is not a pluggable device, so iommufd by design holds no reference on the one behind a viommu, and this teardown is not expected while that viommu is still alive. Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c index 7233aa6c2d6e..ae9ee4ab6644 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -838,6 +838,14 @@ static void tegra241_cmdqv_remove(struct arm_smmu_device *smmu) container_of(smmu, struct tegra241_cmdqv, smmu); u16 idx; + /* + * Free the IRQ before tearing down the VINTFs. free_irq() waits for any + * in-flight tegra241_cmdqv_isr() to finish and blocks new ones, so the + * ISR cannot dereference a VINTF that is freed by the loop below. + */ + if (cmdqv->irq > 0) + free_irq(cmdqv->irq, cmdqv); + /* Remove VINTF resources */ for (idx = 0; idx < cmdqv->num_vintfs; idx++) { if (cmdqv->vintfs[idx]) { @@ -850,8 +858,6 @@ static void tegra241_cmdqv_remove(struct arm_smmu_device *smmu) /* Remove cmdqv resources */ ida_destroy(&cmdqv->vintf_ids); - if (cmdqv->irq > 0) - free_irq(cmdqv->irq, cmdqv); iounmap(cmdqv->base); kfree(cmdqv->vintfs); put_device(cmdqv->dev); /* smmu->impl_dev */ From 4379610c79bd88ddbea10e7f6c21e16d4b338c6b Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Tue, 14 Jul 2026 13:55:04 -0700 Subject: [PATCH 52/93] iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH, whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag. The HW therefore matches only a 20-bit Stream ID. The bound check rejects only virt_sid > UINT_MAX, which admits a value far wider than the field. The write "virt_sid << 1 | 0x1" then drops every bit above 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match on vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id is guest-controlled, a VMM can trigger it. Validate virt_sid against the field width with FIELD_MAX(), and program the register with FIELD_PREP() so the value and the field stay consistent. Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c index ae9ee4ab6644..ad69641dce0f 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -56,6 +56,8 @@ #define VINTF_ENABLED BIT(0) #define TEGRA241_VINTF_SID_MATCH(s) (0x0040 + 0x4*(s)) +#define VINTF_SID_MATCH_VIRT_SID GENMASK(20, 1) +#define VINTF_SID_MATCH_ENABLE BIT(0) #define TEGRA241_VINTF_SID_REPLACE(s) (0x0080 + 0x4*(s)) #define TEGRA241_VINTF_LVCMDQ_ERR_MAP_64(m) \ @@ -1255,7 +1257,7 @@ static int tegra241_vintf_init_vsid(struct iommufd_vdevice *vdev) u64 virt_sid = vdev->virt_id; int sidx; - if (virt_sid > UINT_MAX) + if (virt_sid > FIELD_MAX(VINTF_SID_MATCH_VIRT_SID)) return -EINVAL; WARN_ON_ONCE(master->num_streams != 1); @@ -1267,7 +1269,9 @@ static int tegra241_vintf_init_vsid(struct iommufd_vdevice *vdev) return sidx; writel(stream->id, REG_VINTF(vintf, SID_REPLACE(sidx))); - writel(virt_sid << 1 | 0x1, REG_VINTF(vintf, SID_MATCH(sidx))); + writel(FIELD_PREP(VINTF_SID_MATCH_VIRT_SID, virt_sid) | + VINTF_SID_MATCH_ENABLE, + REG_VINTF(vintf, SID_MATCH(sidx))); dev_dbg(vintf->cmdqv->dev, "VINTF%u: allocated SID_REPLACE%d for pSID=%x, vSID=%x\n", vintf->idx, sidx, stream->id, (u32)virt_sid); From fb292bfc9be936dade7eef7ec5762de1201983d8 Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Tue, 14 Jul 2026 13:55:05 -0700 Subject: [PATCH 53/93] iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID taken from master->streams[0], and only warns when the device does not have exactly one stream. A device with several streams gets only its first one mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out of bounds. Reject the mapping with -EOPNOTSUPP if master->num_streams is not one. Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c index ad69641dce0f..269a06fcca27 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -1260,7 +1260,8 @@ static int tegra241_vintf_init_vsid(struct iommufd_vdevice *vdev) if (virt_sid > FIELD_MAX(VINTF_SID_MATCH_VIRT_SID)) return -EINVAL; - WARN_ON_ONCE(master->num_streams != 1); + if (master->num_streams != 1) + return -EOPNOTSUPP; /* Find an empty pair of SID_REPLACE and SID_MATCH */ sidx = ida_alloc_max(&vintf->sids, vintf->cmdqv->num_sids_per_vintf - 1, From f40f3144477314b489e4bc209c06cb51679fe82b Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Tue, 14 Jul 2026 13:55:06 -0700 Subject: [PATCH 54/93] iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path tegra241_cmdqv_init_structures() allocates VINTF0 with kzalloc_obj(), inits it, and preallocates its logical VCMDQs. Two of its error paths leak. When tegra241_cmdqv_init_vintf() fails it returns before VINTF0 reaches the cmdqv->vintfs[] array, so the devres unwind on probe failure cannot reach it; free it directly there. A later VCMDQ preallocation failure instead leaves VINTF0 published, and so this time the unwind does reach tegra241_cmdqv_remove_vintf(), which then frees it from vintf->hyp_own. But tegra241_vintf_hw_init() sets that flag only afterward, from a HW read-back, so the still-uninited VINTF0 reads as guest-owned and leaks, with mutex_destroy() and ida_destroy() run on fields it never set up. Decide ownership from vintf->idx instead, the index assigned when its id is allocated: idx 0 is the kernel-owned VINTF0, while idx >= 1 marks a guest VINTF. So the in-kernel free decision in tegra241_cmdqv_remove_vintf() and tegra241_vintf_free_lvcmdq() now keys on idx too, and hyp_own stays a pure HW-readback state. Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV") Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c index 269a06fcca27..8b97db10ecde 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -716,7 +716,7 @@ static void tegra241_vintf_free_lvcmdq(struct tegra241_vintf *vintf, u16 lidx) dev_dbg(vintf->cmdqv->dev, "%sdeallocated\n", lvcmdq_error_header(vcmdq, header, 64)); /* Guest-owned VCMDQ is free-ed with hw_queue by iommufd core */ - if (vcmdq->vintf->hyp_own) + if (!vcmdq->vintf->idx) kfree(vcmdq); } @@ -814,7 +814,7 @@ static void tegra241_cmdqv_remove_vintf(struct tegra241_cmdqv *cmdqv, u16 idx) dev_dbg(cmdqv->dev, "VINTF%u: deallocated\n", vintf->idx); tegra241_cmdqv_deinit_vintf(cmdqv, idx); - if (!vintf->hyp_own) { + if (vintf->idx) { mutex_destroy(&vintf->lvcmdq_mutex); ida_destroy(&vintf->sids); /* Guest-owned VINTF is free-ed with viommu by iommufd core */ @@ -931,6 +931,12 @@ static int tegra241_cmdqv_init_structures(struct arm_smmu_device *smmu) ret = tegra241_cmdqv_init_vintf(cmdqv, 0, vintf); if (ret) { dev_err(cmdqv->dev, "failed to init vintf0: %d\n", ret); + /* + * tegra241_cmdqv_init_vintf() failed to publish the vintf0 to + * cmdqv->vintfs[], so the probe unwind path that goes through + * cmdqv->vintfs[] would miss it. Free it here. + */ + kfree(vintf); return ret; } From a86c36163c9722545d27e92bdad8418fdcaa8b1d Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Tue, 14 Jul 2026 13:55:08 -0700 Subject: [PATCH 55/93] iommu/tegra241-cmdqv: Rate-limit the error ISR's log message tegra241_cmdqv_isr() logs the error-map registers on every error interrupt. A malfunctioning device, or a guest deliberately faulting its own VCMDQs, can raise these interrupts rapidly, and the unconditional dev_warn() then floods the kernel log. Rate-limit the message with dev_warn_ratelimited(), and pass the error-map registers straight to it so their four MMIO reads run only when the limiter prints, instead of building the string on every interrupt. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c index 8b97db10ecde..6644075c1431 100644 --- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c +++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c @@ -353,21 +353,19 @@ static irqreturn_t tegra241_cmdqv_isr(int irq, void *devid) { struct tegra241_cmdqv *cmdqv = (struct tegra241_cmdqv *)devid; void __iomem *reg_vintf_map = REG_CMDQV(cmdqv, VINTF_ERR_MAP); - char err_str[256]; u64 vintf_map; /* Use readl_relaxed() as register addresses are not 64-bit aligned */ vintf_map = (u64)readl_relaxed(reg_vintf_map + 0x4) << 32 | (u64)readl_relaxed(reg_vintf_map); - snprintf(err_str, sizeof(err_str), - "vintf_map: %016llx, vcmdq_map %08x:%08x:%08x:%08x", vintf_map, - readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(3))), - readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(2))), - readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(1))), - readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(0)))); - - dev_warn(cmdqv->dev, "unexpected error reported. %s\n", err_str); + dev_warn_ratelimited( + cmdqv->dev, + "unexpected error reported. vintf_map: %016llx, vcmdq_map %08x:%08x:%08x:%08x\n", + vintf_map, readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(3))), + readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(2))), + readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(1))), + readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(0)))); /* Handle VINTF0 and its LVCMDQs */ if (vintf_map & BIT_ULL(0)) { From af3b69b16383fbc8fe5f61b5b0150d2e41ede71f Mon Sep 17 00:00:00 2001 From: Shuai Xue Date: Mon, 27 Jul 2026 11:02:12 +0800 Subject: [PATCH 56/93] iommu/amd: Put PCI device after handling PPR faults iommu_call_iopf_notifier() looks up the requester with pci_get_domain_bus_and_slot(), which returns a PCI device with its reference count incremented. Neither the successful iommu_report_device_fault() path nor the abort path drops that reference, so every handled PPR request leaks a PCI device reference. This is the same ownership rule that was fixed for the old iommu_v2 ppr_notifier() path by commit 6cf0981c2233 ("iommu/amd: Fix pci device refcount leak in ppr_notifier()"), but iommu_call_iopf_notifier() was added later as a separate PPR/IOPF notifier path. Drop the PCI device reference after handling the PPR entry. Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler") Cc: stable@vger.kernel.org Assisted-by: Qoder:Qwen-3.8-MAX-Preview Signed-off-by: Shuai Xue Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel --- drivers/iommu/amd/ppr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/amd/ppr.c b/drivers/iommu/amd/ppr.c index 1f8d2823bea4..80369ca1e316 100644 --- a/drivers/iommu/amd/ppr.c +++ b/drivers/iommu/amd/ppr.c @@ -151,7 +151,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw) /* Submit event */ iommu_report_device_fault(&pdev->dev, &event); - + pci_dev_put(pdev); return; out: @@ -159,6 +159,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw) amd_iommu_complete_ppr(&pdev->dev, PPR_PASID(raw[0]), IOMMU_PAGE_RESP_FAILURE, PPR_TAG(raw[0]) & 0x1FF); + pci_dev_put(pdev); } void amd_iommu_poll_ppr_log(struct amd_iommu *iommu) From f5cd9718bd0be08a4ac3b5773740e7d3e0d3929a Mon Sep 17 00:00:00 2001 From: Logan Odell Date: Mon, 27 Jul 2026 08:57:20 -0700 Subject: [PATCH 57/93] iommu/iova: Move CPU magazine init to first insert A large amount of memory may be allocated for these magazines on machines with a lot of IOMMU groups and CPU cores. Not all may be used as some devices may be unused or be bound to drivers that do not use the DMA-API. Furthermore, some drivers may not use all levels or CPUs. Move the initialization of the loaded and prev magazines for each CPU on the first attempt to try to insert a freed IOVA to them. Signed-off-by: Logan Odell Signed-off-by: Michal Clapinski Reviewed-by: Robin Murphy Signed-off-by: Joerg Roedel --- drivers/iommu/iova.c | 29 +++++++++++++++-------------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c index 021daf6528de..82d52eb12e4c 100644 --- a/drivers/iommu/iova.c +++ b/drivers/iommu/iova.c @@ -621,6 +621,9 @@ iova_magazine_free_pfns(struct iova_magazine *mag, struct iova_domain *iovad) unsigned long flags; int i; + if (!mag) + return; + spin_lock_irqsave(&iovad->iova_rbtree_lock, flags); for (i = 0 ; i < mag->size; ++i) { @@ -739,12 +742,6 @@ int iova_domain_init_rcaches(struct iova_domain *iovad) cpu_rcache = per_cpu_ptr(rcache->cpu_rcaches, cpu); spin_lock_init(&cpu_rcache->lock); - cpu_rcache->loaded = iova_magazine_alloc(GFP_KERNEL); - cpu_rcache->prev = iova_magazine_alloc(GFP_KERNEL); - if (!cpu_rcache->loaded || !cpu_rcache->prev) { - ret = -ENOMEM; - goto out_err; - } } } @@ -777,19 +774,23 @@ static bool __iova_rcache_insert(struct iova_domain *iovad, cpu_rcache = raw_cpu_ptr(rcache->cpu_rcaches); spin_lock_irqsave(&cpu_rcache->lock, flags); - if (!iova_magazine_full(cpu_rcache->loaded)) { + if (cpu_rcache->loaded && !iova_magazine_full(cpu_rcache->loaded)) { can_insert = true; - } else if (!iova_magazine_full(cpu_rcache->prev)) { + } else if (cpu_rcache->prev && !iova_magazine_full(cpu_rcache->prev)) { swap(cpu_rcache->prev, cpu_rcache->loaded); can_insert = true; } else { struct iova_magazine *new_mag = iova_magazine_alloc(GFP_ATOMIC); if (new_mag) { - spin_lock(&rcache->lock); - iova_depot_push(rcache, cpu_rcache->loaded); - spin_unlock(&rcache->lock); - schedule_delayed_work(&rcache->work, IOVA_DEPOT_DELAY); + if (cpu_rcache->loaded && !cpu_rcache->prev) { + cpu_rcache->prev = cpu_rcache->loaded; + } else if (cpu_rcache->loaded) { + spin_lock(&rcache->lock); + iova_depot_push(rcache, cpu_rcache->loaded); + spin_unlock(&rcache->lock); + schedule_delayed_work(&rcache->work, IOVA_DEPOT_DELAY); + } cpu_rcache->loaded = new_mag; can_insert = true; @@ -831,9 +832,9 @@ static unsigned long __iova_rcache_get(struct iova_rcache *rcache, cpu_rcache = raw_cpu_ptr(rcache->cpu_rcaches); spin_lock_irqsave(&cpu_rcache->lock, flags); - if (!iova_magazine_empty(cpu_rcache->loaded)) { + if (cpu_rcache->loaded && !iova_magazine_empty(cpu_rcache->loaded)) { has_pfn = true; - } else if (!iova_magazine_empty(cpu_rcache->prev)) { + } else if (cpu_rcache->prev && !iova_magazine_empty(cpu_rcache->prev)) { swap(cpu_rcache->prev, cpu_rcache->loaded); has_pfn = true; } else { From 91038c83a250f1a6d49c199db2aaafea882af6c7 Mon Sep 17 00:00:00 2001 From: Robin Murphy Date: Mon, 27 Jul 2026 13:03:28 +0100 Subject: [PATCH 58/93] arm64: Add override for MMFR1.HAFDBS In general it might be nice to have the ability to disable hardware access/dirty bit management for debugging or performance comparison purposes without having to rebuild the kernel. However once FEAT_HAFT comes into the picture we also start to have a real functional concern where the decision to use HAFT based on the boot CPUs can prevent SVA or late-onlining if SMMUs/CPUs are later found to lack HAFT support. To that end, add the appropriate MMFR1 override, with an easy "nohaft" alias for the significant case, partly since the feature/field naming isn't the most obvious, but also so it could potentially be redirected in future if someone wanted to attempt a higher-level means of turning off just HAFT usage independently from FEAT_HDBSS. Signed-off-by: Robin Murphy Signed-off-by: Will Deacon --- Documentation/admin-guide/kernel-parameters.txt | 3 +++ arch/arm64/kernel/pi/idreg-override.c | 2 ++ 2 files changed, 5 insertions(+) diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt index b5493a7f8f22..7f23e5b8dc44 100644 --- a/Documentation/admin-guide/kernel-parameters.txt +++ b/Documentation/admin-guide/kernel-parameters.txt @@ -565,6 +565,9 @@ Kernel parameters arm64.nogcs [ARM64] Unconditionally disable Guarded Control Stack support + arm64.nohaft [ARM64] Unconditionally disable Hardware managed Access + Flag for Table descriptors support + arm64.nomops [ARM64] Unconditionally disable Memory Copy and Memory Set instructions support diff --git a/arch/arm64/kernel/pi/idreg-override.c b/arch/arm64/kernel/pi/idreg-override.c index bc57b290e5e7..0e051fec5afe 100644 --- a/arch/arm64/kernel/pi/idreg-override.c +++ b/arch/arm64/kernel/pi/idreg-override.c @@ -64,6 +64,7 @@ static const struct ftr_set_desc mmfr1 __prel64_initconst = { .override = &id_aa64mmfr1_override, .fields = { FIELD("vh", ID_AA64MMFR1_EL1_VH_SHIFT, mmfr1_vh_filter), + FIELD("hafdbs", ID_AA64MMFR1_EL1_HAFDBS_SHIFT, NULL), {} }, }; @@ -246,6 +247,7 @@ static const struct { { "arm64.nomte", "id_aa64pfr1.mte=0" }, { "nokaslr", "arm64_sw.nokaslr=1" }, { "rodata=off", "arm64_sw.rodataoff=1" }, + { "arm64.nohaft", "id_aa64mmfr1.hafdbs=2" }, { "arm64.nolva", "id_aa64mmfr2.varange=0" }, { "arm64.no32bit_el0", "id_aa64pfr0.el0=1" }, { "arm64.nompam", "id_aa64pfr0.mpam=0 id_aa64pfr1.mpam_frac=0" }, From f99d3b4bb095c4966cf58154077e8bb69ee4827f Mon Sep 17 00:00:00 2001 From: Robin Murphy Date: Mon, 27 Jul 2026 13:03:29 +0100 Subject: [PATCH 59/93] iommu/arm-smmu-v3: Add HAFT support for SVA Since table access flags cannot be software-managed, if process pagetables are using HAFT then SVA must require the SMMU to support and enable it too, otherwise page aging is liable to get out of whack. For unbinding, we can't disable HAFT atomically with HA as might be desired, but luckily we can get away with just not disabling HA either. Cc: stable@vger.kernel.org Fixes: 62df5870ebf7 ("arm64: Enable ARCH_HAS_NONLEAF_PMD_YOUNG") Signed-off-by: Robin Murphy Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon --- .../iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c | 24 +++++++++++-------- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 9 ++++++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 3 +++ 3 files changed, 25 insertions(+), 11 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c index 1ed8a6f29dc4..4cd60d3c450a 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c @@ -92,16 +92,6 @@ void arm_smmu_make_sva_cd(struct arm_smmu_cd *target, target->data[1] = cpu_to_le64(virt_to_phys(mm->pgd) & CTXDESC_CD_1_TTB0_MASK); - - /* - * Enable Hardware Access and Dirty updates (DBM) if supported. - * This is safe to enable by default, as PTE_WRITE and PTE_DBM - * share the same bit. - */ - if (master->smmu->features & ARM_SMMU_FEAT_HA) - target->data[0] |= cpu_to_le64(CTXDESC_CD_0_TCR_HA); - if (master->smmu->features & ARM_SMMU_FEAT_HD) - target->data[0] |= cpu_to_le64(CTXDESC_CD_0_TCR_HD); } else { target->data[0] |= cpu_to_le64(CTXDESC_CD_0_TCR_EPD0); @@ -114,6 +104,17 @@ void arm_smmu_make_sva_cd(struct arm_smmu_cd *target, target->data[0] &= cpu_to_le64(~(CTXDESC_CD_0_S | CTXDESC_CD_0_R)); } + /* + * Enable Hardware Access and Dirty updates (DBM) if supported. This is + * safe to enable by default, as PTE_WRITE and PTE_DBM share the same bit, + * while the EPD0 config can't get as far as fetching any PTEs anyway. + */ + if (master->smmu->features & ARM_SMMU_FEAT_HA) + target->data[0] |= cpu_to_le64(CTXDESC_CD_0_TCR_HA); + if (master->smmu->features & ARM_SMMU_FEAT_HD) + target->data[0] |= cpu_to_le64(CTXDESC_CD_0_TCR_HD); + if (master->smmu->features & ARM_SMMU_FEAT_HAFT && system_supports_haft()) + target->data[1] |= cpu_to_le64(CTXDESC_CD_1_HAFT); /* * MAIR value is pretty much constant and global, so we can just get it @@ -211,6 +212,9 @@ bool arm_smmu_sva_supported(struct arm_smmu_device *smmu) if (system_supports_bbml2_noabort()) feat_mask |= ARM_SMMU_FEAT_BBML2; + if (system_supports_haft()) + feat_mask |= ARM_SMMU_FEAT_HAFT; + if ((smmu->features & feat_mask) != feat_mask) return false; diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 3a9cbd7d8a00..267dfc40919c 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -5015,10 +5015,14 @@ static void arm_smmu_device_iidr_probe(struct arm_smmu_device *smmu) static void arm_smmu_get_httu(struct arm_smmu_device *smmu, u32 reg) { - u32 fw_features = smmu->features & (ARM_SMMU_FEAT_HA | ARM_SMMU_FEAT_HD); + u32 fw_features = smmu->features & (ARM_SMMU_FEAT_HA | ARM_SMMU_FEAT_HD | + ARM_SMMU_FEAT_HAFT); u32 hw_features = 0; switch (FIELD_GET(IDR0_HTTU, reg)) { + case IDR0_HTTU_ACCESS_DIRTY_HAFT: + hw_features |= ARM_SMMU_FEAT_HAFT; + fallthrough; case IDR0_HTTU_ACCESS_DIRTY: hw_features |= ARM_SMMU_FEAT_HD; fallthrough; @@ -5350,6 +5354,9 @@ static int arm_smmu_device_acpi_probe(struct platform_device *pdev, smmu->features |= ARM_SMMU_FEAT_COHERENCY; switch (FIELD_GET(ACPI_IORT_SMMU_V3_HTTU_OVERRIDE, iort_smmu->flags)) { + case IDR0_HTTU_ACCESS_DIRTY_HAFT: + smmu->features |= ARM_SMMU_FEAT_HAFT; + fallthrough; case IDR0_HTTU_ACCESS_DIRTY: smmu->features |= ARM_SMMU_FEAT_HD; fallthrough; diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h index 43f4d24e7847..98191075242a 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h @@ -40,6 +40,7 @@ struct arm_vsmmu; #define IDR0_HTTU GENMASK(7, 6) #define IDR0_HTTU_ACCESS 1 #define IDR0_HTTU_ACCESS_DIRTY 2 +#define IDR0_HTTU_ACCESS_DIRTY_HAFT 3 #define IDR0_COHACC (1 << 4) #define IDR0_TTF GENMASK(3, 2) #define IDR0_TTF_AARCH64 2 @@ -369,6 +370,7 @@ static inline unsigned int arm_smmu_cdtab_l2_idx(unsigned int ssid) #define CTXDESC_CD_0_ASET (1UL << 47) #define CTXDESC_CD_0_ASID GENMASK_ULL(63, 48) +#define CTXDESC_CD_1_HAFT (1UL << 3) #define CTXDESC_CD_1_TTB0_MASK GENMASK_ULL(51, 4) /* @@ -922,6 +924,7 @@ struct arm_smmu_device { #define ARM_SMMU_FEAT_HD (1 << 22) #define ARM_SMMU_FEAT_S2FWB (1 << 23) #define ARM_SMMU_FEAT_BBML2 (1 << 24) +#define ARM_SMMU_FEAT_HAFT (1 << 25) u32 features; #define ARM_SMMU_OPT_SKIP_PREFETCH (1 << 0) From eced8058c82a3a81ae480a6546e2da32100dddfa Mon Sep 17 00:00:00 2001 From: Pranjal Shrivastava Date: Tue, 28 Jul 2026 21:11:23 +0000 Subject: [PATCH 60/93] iommu/arm-smmu-v3: Convert to use atomic poll timeout The arm_smmu_write_reg_sync() helper is currently implemented using readl_relaxed_poll_timeout() (that relies on usleep_range() internally) which becomes a critical issue when used in the gerror irq handler. If the SMMU hits a gerror and enters Service Failure Mode (GERROR_SFM_ERR), the gerror handler calls arm_smmu_device_disable() in hard-irq context. This becomes a problem as arm_smmu_device_disable() inevitably calls arm_smmu_write_reg_sync() which might attempt to sleep inside a hard-irq context. Fix this by converting the arm_smmu_write_reg_sync to use the readl_relaxed_poll_timeout_atomic() polling helper. (Discovered while running Sashiko locally on another patch series). Reported-by: Sashiko Fixes: 48ec83bcbcf5 ("iommu/arm-smmu: Add initial driver support for ARM SMMUv3 devices") Signed-off-by: Pranjal Shrivastava Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 267dfc40919c..de5fba0b6d09 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -4618,8 +4618,9 @@ static int arm_smmu_write_reg_sync(struct arm_smmu_device *smmu, u32 val, u32 reg; writel_relaxed(val, smmu->base + reg_off); - return readl_relaxed_poll_timeout(smmu->base + ack_off, reg, reg == val, - 1, ARM_SMMU_POLL_TIMEOUT_US); + return readl_relaxed_poll_timeout_atomic(smmu->base + ack_off, reg, + reg == val, 1, + ARM_SMMU_POLL_TIMEOUT_US); } /* GBPA is "special" */ From 773f2b9e367019c03ed18f2736c8f67307305088 Mon Sep 17 00:00:00 2001 From: Nicolin Chen Date: Tue, 28 Jul 2026 10:33:33 -0700 Subject: [PATCH 61/93] iommu/arm-smmu-v3: Support IDR5.DS and widen the TLBI SCALE field An SMMU implementing SMMU_IDR5.DS extends the range invalidation commands: the SCALE field grows a 6th bit, raising its maximum value from 31 to 39, and TTL == 0b01 becomes a valid level hint for a 16KB translation granule. Add a new ARM_SMMU_FEAT_DS feature detecting the DS bit, and widen the CMDQ_TLBI_0_SCALE field to its architectural 6 bits. Mask the scale value explicitly in arm_smmu_cmdq_batch_add_range(), so the range invalidation path emits the same commands as before, keeping the pre-existing 5-bit truncation of a scale above 31. Also list DS as a valid IDR5 field in the iommu_hw_info_arm_smmuv3 kdoc: iommufd has always reported the raw IDR5 register, so a VMM may conclude from that bit alone that it can expose DS to its guest. Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Assisted-by: Claude:claude-fable-5 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 6 +++++- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 4 +++- include/uapi/linux/iommufd.h | 4 ++-- 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index de5fba0b6d09..2587c33c778f 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -2511,9 +2511,10 @@ static void arm_smmu_cmdq_batch_add_range(struct arm_smmu_device *smmu, /* Determine how many chunks of 2^scale size we have */ num = (num_pages >> scale) & CMDQ_TLBI_RANGE_NUM_MAX; + /* Keep the pre-DS 5-bit truncation when scale > 31 */ cmd->data[0] = orig_data0 | FIELD_PREP(CMDQ_TLBI_0_NUM, num - 1) | - FIELD_PREP(CMDQ_TLBI_0_SCALE, scale); + FIELD_PREP(CMDQ_TLBI_0_SCALE, scale & 0x1f); /* range is num * 2^scale * pgsize */ inv_range = num << (scale + tg); @@ -5197,6 +5198,9 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu) /* Maximum number of outstanding stalls */ smmu->evtq.max_stalls = FIELD_GET(IDR5_STALL_MAX, reg); + if (reg & IDR5_DS) + smmu->features |= ARM_SMMU_FEAT_DS; + /* Page sizes */ if (reg & IDR5_GRAN64K) smmu->pgsize_bitmap |= SZ_64K | SZ_512M; diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h index 98191075242a..50f8321e979c 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h @@ -65,6 +65,7 @@ struct arm_vsmmu; #define ARM_SMMU_IDR5 0x14 #define IDR5_STALL_MAX GENMASK(31, 16) +#define IDR5_DS (1 << 7) #define IDR5_GRAN64K (1 << 6) #define IDR5_GRAN16K (1 << 5) #define IDR5_GRAN4K (1 << 4) @@ -417,7 +418,7 @@ struct arm_smmu_cmd { #define CMDQ_TLBI_0_NUM GENMASK_ULL(16, 12) #define CMDQ_TLBI_RANGE_NUM_MAX 31 -#define CMDQ_TLBI_0_SCALE GENMASK_ULL(24, 20) +#define CMDQ_TLBI_0_SCALE GENMASK_ULL(25, 20) #define CMDQ_TLBI_0_VMID GENMASK_ULL(47, 32) #define CMDQ_TLBI_0_ASID GENMASK_ULL(63, 48) #define CMDQ_TLBI_1_LEAF (1UL << 0) @@ -925,6 +926,7 @@ struct arm_smmu_device { #define ARM_SMMU_FEAT_S2FWB (1 << 23) #define ARM_SMMU_FEAT_BBML2 (1 << 24) #define ARM_SMMU_FEAT_HAFT (1 << 25) +#define ARM_SMMU_FEAT_DS (1 << 26) u32 features; #define ARM_SMMU_OPT_SKIP_PREFETCH (1 << 0) diff --git a/include/uapi/linux/iommufd.h b/include/uapi/linux/iommufd.h index f73a392b3d3f..c6851c7655c6 100644 --- a/include/uapi/linux/iommufd.h +++ b/include/uapi/linux/iommufd.h @@ -605,7 +605,7 @@ enum iommu_hw_info_arm_smmuv3_flags { * idr[0]: ST_LEVEL, TERM_MODEL, STALL_MODEL, TTENDIAN , CD2L, ASID16, TTF * idr[1]: SIDSIZE, SSIDSIZE * idr[3]: BBML, RIL - * idr[5]: VAX, GRAN64K, GRAN16K, GRAN4K + * idr[5]: VAX, GRAN64K, GRAN16K, GRAN4K, DS * * - S1P should be assumed to be true if a NESTED HWPT can be created * - VFIO/iommufd only support platforms with COHACC, it should be assumed to be @@ -613,7 +613,7 @@ enum iommu_hw_info_arm_smmuv3_flags { * - ATS is a per-device property. If the VMM describes any devices as ATS * capable in ACPI/DT it should set the corresponding idr. * - * This list may expand in future (eg E0PD, AIE, PBHA, D128, DS etc). It is + * This list may expand in future (eg E0PD, AIE, PBHA, D128 etc). It is * important that VMMs do not read bits outside the list to allow for * compatibility with future kernels. Several features in the SMMUv3 * architecture are not currently supported by the kernel for nesting: HTTU, From 340e3c5165d4dd673c0219756aaf54c5b749b581 Mon Sep 17 00:00:00 2001 From: Kuan-Wei Chiu Date: Thu, 30 Jul 2026 18:12:15 +0000 Subject: [PATCH 62/93] iommu/arm-smmu-v3: Replace sort_nonatomic() with sort() The number of master->num_streams per master device is typically very small in practice. Sorting this array takes a very small amount of time, so there is no practical risk of triggering a soft lockup that would necessitate calling cond_resched() during the sort. Replace sort_nonatomic() with the standard sort(). Since this is the only remaining in-tree caller of sort_nonatomic(), this change paves the way to eventually remove the unused sort_nonatomic() API from the core library. Signed-off-by: Kuan-Wei Chiu Signed-off-by: Will Deacon --- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c index 2587c33c778f..ef8866e124f3 100644 --- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c +++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c @@ -4113,9 +4113,9 @@ static int arm_smmu_insert_master(struct arm_smmu_device *smmu, } /* Put the ids into order for sorted to_merge/to_unref arrays */ - sort_nonatomic(master->streams, master->num_streams, - sizeof(master->streams[0]), arm_smmu_stream_id_cmp, - NULL); + sort(master->streams, master->num_streams, + sizeof(master->streams[0]), arm_smmu_stream_id_cmp, + NULL); mutex_lock(&smmu->streams_mutex); for (i = 0; i < fwspec->num_ids; i++) { From 02f1359b11434179a3cb943b62c2901eb958c4fa Mon Sep 17 00:00:00 2001 From: Kathiravan Thirumoorthy Date: Fri, 31 Jul 2026 11:01:26 +0530 Subject: [PATCH 63/93] dt-bindings: arm-smmu: qcom: add compatible for IPQ9650 SoC Add the compatible string for the APPS SMMU present on the Qualcomm IPQ9650 SoC. Signed-off-by: Kathiravan Thirumoorthy Acked-by: Krzysztof Kozlowski Signed-off-by: Will Deacon --- Documentation/devicetree/bindings/iommu/arm,smmu.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Documentation/devicetree/bindings/iommu/arm,smmu.yaml b/Documentation/devicetree/bindings/iommu/arm,smmu.yaml index f2188942f877..ffa33b7f4a96 100644 --- a/Documentation/devicetree/bindings/iommu/arm,smmu.yaml +++ b/Documentation/devicetree/bindings/iommu/arm,smmu.yaml @@ -38,6 +38,7 @@ properties: - qcom,eliza-smmu-500 - qcom,glymur-smmu-500 - qcom,hawi-smmu-500 + - qcom,ipq9650-smmu-500 - qcom,kaanapali-smmu-500 - qcom,maili-smmu-500 - qcom,milos-smmu-500 @@ -625,6 +626,7 @@ allOf: - qcom,eliza-smmu-500 - qcom,glymur-smmu-500 - qcom,hawi-smmu-500 + - qcom,ipq9650-smmu-500 - qcom,kaanapali-smmu-500 - qcom,maili-smmu-500 - qcom,milos-smmu-500 From 530f8f9c3546cb3ebee1b135375aaee08a073ebb Mon Sep 17 00:00:00 2001 From: Shuai Xue Date: Sun, 26 Jul 2026 15:43:29 +0800 Subject: [PATCH 64/93] iommu/sva: Set handle->dev before the SVA handle is visible iommu_attach_device_pasid() installs the new SVA attach handle in the group PASID lookup before iommu_sva_bind_device() returns. A concurrent bind can therefore find and reuse the same handle after iommu_sva_lock is dropped. handle->dev was initialized after dropping iommu_sva_lock. This leaves a window where a racing bind can return a handle whose dev pointer is still NULL. A subsequent iommu_sva_unbind_device() can then dereference it via handle->dev->iommu_group. Initialize handle->dev before releasing iommu_sva_lock so any visible SVA handle is fully initialized. Fixes: be51b1d6bbff ("iommu/sva: Refactoring iommu_sva_bind/unbind_device()") Cc: stable@vger.kernel.org Assisted-by: Qoder:Qwen-3.8-MAX-Preview Signed-off-by: Shuai Xue Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Joerg Roedel --- drivers/iommu/iommu-sva.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/iommu-sva.c b/drivers/iommu/iommu-sva.c index bc7c7232a43e..9742cb593577 100644 --- a/drivers/iommu/iommu-sva.c +++ b/drivers/iommu/iommu-sva.c @@ -145,8 +145,8 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm list_add(&domain->next, &iommu_mm->sva_domains); out: refcount_set(&handle->users, 1); - mutex_unlock(&iommu_sva_lock); handle->dev = dev; + mutex_unlock(&iommu_sva_lock); return handle; out_free_domain: From 0dbcdf4473a614adbd732d567c9b39ac0e040e0c Mon Sep 17 00:00:00 2001 From: Shuai Xue Date: Sun, 26 Jul 2026 15:43:30 +0800 Subject: [PATCH 65/93] iommufd: Avoid locking internal accesses during unmap iommufd_access_notify_unmap() skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufd_lock_obj() before checking whether the access is internal. If iommufd_lock_obj() succeeds, the loop then sees the internal access and continues, bypassing the matching iommufd_put_object() used by the normal unmap path. This leaks the object reference taken by iommufd_lock_obj(). Check for internal accesses first so skipped entries are never locked. Fixes: 27b77ea5feaa ("iommufd/access: Bypass access->ops->unmap for internal use") Cc: stable@vger.kernel.org Assisted-by: Qoder:Qwen-3.8-MAX-Preview Signed-off-by: Shuai Xue Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Joerg Roedel --- drivers/iommu/iommufd/device.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/iommu/iommufd/device.c b/drivers/iommu/iommufd/device.c index 170a7005f0bc..e4537db724d5 100644 --- a/drivers/iommu/iommufd/device.c +++ b/drivers/iommu/iommufd/device.c @@ -1307,8 +1307,8 @@ void iommufd_access_notify_unmap(struct io_pagetable *iopt, unsigned long iova, xa_lock(&ioas->iopt.access_list); xa_for_each(&ioas->iopt.access_list, index, access) { - if (!iommufd_lock_obj(&access->obj) || - iommufd_access_is_internal(access)) + if (iommufd_access_is_internal(access) || + !iommufd_lock_obj(&access->obj)) continue; xa_unlock(&ioas->iopt.access_list); From 4ac2ce123824d5f885c868fa1f9f4d463141a2ba Mon Sep 17 00:00:00 2001 From: Shuai Xue Date: Sun, 26 Jul 2026 15:43:31 +0800 Subject: [PATCH 66/93] iommufd: Release current IOAS on xa_store() failure iommufd_take_all_iova_rwsem() takes an object reference and the iova_rwsem write lock before storing the IOAS in the temporary ioas_list xarray. If xa_store() fails, the current IOAS has not been inserted into ioas_list yet. iommufd_release_all_iova_rwsem() only unwinds IOAS objects already present in that xarray, so it cannot release the current IOAS. Release the current IOAS rwsem and object reference before unwinding the previously stored entries. Fixes: 051ae5aa73d7 ("iommufd: Lock all IOAS objects") Cc: stable@vger.kernel.org Assisted-by: Qoder:Qwen-3.8-MAX-Preview Signed-off-by: Shuai Xue Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Joerg Roedel --- drivers/iommu/iommufd/ioas.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/iommu/iommufd/ioas.c b/drivers/iommu/iommufd/ioas.c index fed06c2b728e..28616465ea6a 100644 --- a/drivers/iommu/iommufd/ioas.c +++ b/drivers/iommu/iommufd/ioas.c @@ -427,6 +427,8 @@ static int iommufd_take_all_iova_rwsem(struct iommufd_ctx *ictx, rc = xa_err(xa_store(ioas_list, index, ioas, GFP_KERNEL)); if (rc) { + up_write(&ioas->iopt.iova_rwsem); + refcount_dec(&ioas->obj.users); iommufd_release_all_iova_rwsem(ictx, ioas_list); return rc; } From 41cdc2a3d41b505c1dff9e6c1ab4c76d4cc1f995 Mon Sep 17 00:00:00 2001 From: Shuai Xue Date: Sun, 26 Jul 2026 15:43:32 +0800 Subject: [PATCH 67/93] iommupt: Return zero for invalid iova_to_phys() ranges DOMAIN_NS(iova_to_phys) returns a phys_addr_t and follows the IOMMU iova_to_phys() convention of returning 0 when there is no valid translation. make_range() returns a negative errno if the input IOVA cannot be represented by this page table format. Returning that errno directly casts it to phys_addr_t. Callers treat zero as no translation and use non-zero values as physical addresses, so this can make them consume a bogus physical address instead of seeing a failed translation. Match the page-table walk failure path and return 0 for range validation failures too. Fixes: 9d4c274cd7d5 ("iommupt: Add iova_to_phys op") Cc: stable@vger.kernel.org Assisted-by: Qoder:Qwen-3.8-MAX-Preview Signed-off-by: Shuai Xue Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Joerg Roedel --- drivers/iommu/generic_pt/iommu_pt.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/generic_pt/iommu_pt.h b/drivers/iommu/generic_pt/iommu_pt.h index c2752151c80a..07ec2b3ab986 100644 --- a/drivers/iommu/generic_pt/iommu_pt.h +++ b/drivers/iommu/generic_pt/iommu_pt.h @@ -224,7 +224,7 @@ phys_addr_t DOMAIN_NS(iova_to_phys)(struct iommu_domain *domain, ret = make_range(common_from_iommu(iommu_table), &range, iova, 1); if (ret) - return ret; + return 0; ret = pt_walk_range(&range, __iova_to_phys, &res); /* PHYS_ADDR_MAX would be a better error code */ From 5a9e89ea34e0e34ac5d7e949042d665533549e40 Mon Sep 17 00:00:00 2001 From: Andrew Jones Date: Thu, 30 Jul 2026 15:23:23 +0200 Subject: [PATCH 68/93] iommu/dma: Restore locking around msi_page_list Unlike a group's default domain, which is always freshly allocated and privately owned (iommu_group_alloc_default_domain()), VFIO type1's legacy container merges any newly attached group into an existing domain whenever their iommu_ops and cache-coherency enforcement match. iommu_dma_get_msi_page() only asserts the caller's own group mutex is held (iommu_group_mutex_assert()). On an IOMMU that publishes IOMMU_RESV_SW_MSI, e.g. ARM SMMU, a VM with two such devices assigned through the legacy container can have their guest drivers probe and allocate MSIs in parallel; each host-side VFIO_DEVICE_SET_IRQS lands on a different device fd and group mutex, but both devices' domains are the same merged domain, so both can enter iommu_dma_get_msi_page() concurrently and corrupt msi_page_list. commit 288683c92b1a ("iommu: Make iommu_dma_prepare_msi() into a generic operation") dropped the prior msi_prepare_lock on the reasoning that "each iommu_domain is unique to a group," which holds for default domains but not this VFIO type1 case. Restore the static lock, since it's only guarding a corner case and will likely never be contended. iommufd avoids the equivalent problem by having its own callers (iommufd_sw_map_msi()) take a ctx-wide sw_msi_lock before ever reaching the shared list. VFIO type1 can't mirror that since it dispatches to iommu_dma_sw_msi() which is outside VFIO's jurisdiction. Fixes: 288683c92b1a ("iommu: Make iommu_dma_prepare_msi() into a generic operation") Signed-off-by: Andrew Jones Reviewed-by: Jason Gunthorpe Reviewed-by: Nutty Liu Reviewed-by: Robin Murphy Signed-off-by: Joerg Roedel --- drivers/iommu/dma-iommu.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c index 9abaec0703ef..9a07eb39336e 100644 --- a/drivers/iommu/dma-iommu.c +++ b/drivers/iommu/dma-iommu.c @@ -2204,6 +2204,19 @@ static struct iommu_dma_msi_page *iommu_dma_get_msi_page(struct device *dev, dma_addr_t iova; int prot = IOMMU_WRITE | IOMMU_NOEXEC | IOMMU_MMIO; size_t size = cookie_msi_granule(domain); + static DEFINE_MUTEX(msi_prepare_lock); + + /* + * Normally a device's default domain is only ever attached to that + * device's own group, and the group mutex held by + * iommu_group_mutex_assert()'s callers is enough on its own. A VFIO + * type1 container is the one case that breaks that assumption: it + * can merge devices from different groups onto one domain, so two + * devices' group mutexes don't serialize each other here. A static + * lock is sufficient due to the expectation that this is a corner + * case that will never be contended in practice. + */ + guard(mutex)(&msi_prepare_lock); msi_addr &= ~(phys_addr_t)(size - 1); list_for_each_entry(msi_page, msi_page_list, list) From c6e63fc8e8fcefa5c32145dc0a3c82975b0ce152 Mon Sep 17 00:00:00 2001 From: Desnes Nunes Date: Wed, 5 Aug 2026 07:42:55 +0800 Subject: [PATCH 69/93] iommu/vt-d: Fix UCTP context table slot when copying root entries When translation is already enabled at boot (e.g. kdump), the vt-d driver copies context tables from the previous kernel's root table. In scalable mode, buses that only populate the upper root half (UCTP, devfn >= 0x80) should be written to ctxt_tbls[tbl_idx + 1] through copy_context_table(). However, the current copy path always uses tbl[tbl_idx + 0] in this situa- tion. Since idx wraps to 0 at devfn 0x80 due to a zeroed LCTP, new_ce for LCTP will be NULL and keep pos equals to 0. Thus, UCTP entries will be co- pied into tbl[tbl_idx + 0] instead of tbl[tbl_idx + 1], and written after- wards to root_entry[bus].lo instead of .hi in copy_translation_tables(). In short, devices on bus 0x80 with devfn >= 0x80 fail DMA with fault 0x39, which will break drivers running in kernels with translation pre-enabled. This fixes NO_PASID DMAR faults for UCTP-only buses such as: DMAR: [DMA Read NO_PASID] Request device [80:14.0] fault addr 0xe81759000 [fault reason 0x39] SM: Present bit in Root Entry is clear For instance, this fault yielded to locking issues between systemd and xHCI, blocking a system's reboot after a vmcore was captured with kdump: systemd-udevd[246]: usb3: Worker [255] processing SEQNUM=2193 is taking a long time dracut-initqueue[277]: Timed out while waiting for udev queue to empty. systemd-udevd[246]: usb3: Worker [255] processing SEQNUM=2193 killed systemd-udevd[246]: usb3: Worker [255] terminated by signal 9 (KILL). ... kdump[569]: saving vmcore complete ... systemd-shutdown[1]: Rebooting. INFO: task kworker/0:1:11 blocked for more than 122 seconds. Not tainted 7.0.0-clean #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208160 flags:0x00080000 Workqueue: usb_hub_wq hub_event Call Trace: __schedule+0x299/0x5c0 schedule+0x27/0x80 schedule_timeout+0xbd/0x100 __wait_for_common+0x97/0x1b0 ? __pfx_schedule_timeout+0x10/0x10 xhci_alloc_dev+0x9e/0x2b0 usb_alloc_dev+0x7a/0x3b0 hub_port_connect+0x285/0x960 hub_port_connect_change+0x94/0x290 port_event+0x4bb/0x840 hub_event+0x141/0x460 process_one_work+0x196/0x390 worker_thread+0x1af/0x320 ? __pfx_worker_thread+0x10/0x10 kthread+0xe3/0x120 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x199/0x260 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 INFO: task systemd-shutdow:1 blocked for more than 122 seconds. Not tainted 7.0.0-clean #1 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:systemd-shutdow state:D stack:0 pid:1 tgid:1 ppid:0 task_flags:0x400100 flags:0x00080000 Call Trace: __schedule+0x299/0x5c0 schedule+0x27/0x80 schedule_preempt_disabled+0x15/0x30 __mutex_lock.constprop.0+0x547/0xac0 device_shutdown+0xac/0x1b0 kernel_restart+0x3a/0x70 __do_sys_reboot+0x147/0x240 do_syscall_64+0x11b/0x6a0 ? handle_mm_fault+0x110/0x350 ? do_user_addr_fault+0x206/0x680 ? irqentry_exit+0x7a/0x4d0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe2958da917 RSP: 002b:00007ffc5c458618 EFLAGS: 00000206 ORIG_RAX: 00000000000000a9 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe2958da917 RDX: 0000000001234567 RSI: 0000000028121969 RDI: 00000000fee1dead RBP: 00007ffc5c458790 R08: 0000000000000069 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ffc5c4588b8 R15: 0000000000000000 INFO: task systemd-shutdow:1 is blocked on a mutex likely owned by task kworker/0:1:11. Fixes: 091d42e43d21 ("iommu/vt-d: Copy translation tables from old kernel") Signed-off-by: Desnes Nunes Tested-by: Tao Liu Signed-off-by: Lu Baolu Reviewed-by: Samiullah Khawaja Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 849d06dfe1ae..cf5f92619943 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -1446,7 +1446,7 @@ static int copy_context_table(struct intel_iommu *iommu, struct context_entry **tbl, int bus, bool ext) { - int tbl_idx, pos = 0, idx, devfn, ret = 0, did; + int tbl_idx, tbl_slot = 0, idx, devfn, ret = 0, did; struct context_entry *new_ce = NULL, ce; struct context_entry *old_ce = NULL; struct root_entry re; @@ -1462,10 +1462,9 @@ static int copy_context_table(struct intel_iommu *iommu, if (idx == 0) { /* First save what we may have and clean up */ if (new_ce) { - tbl[tbl_idx] = new_ce; + tbl[tbl_idx + tbl_slot] = new_ce; __iommu_flush_cache(iommu, new_ce, VTD_PAGE_SIZE); - pos = 1; } if (old_ce) @@ -1487,6 +1486,9 @@ static int copy_context_table(struct intel_iommu *iommu, } } + /* Track if saving UCTP or LCTP entries in scalable mode */ + tbl_slot = ext && devfn >= 0x80 ? 1 : 0; + ret = -ENOMEM; old_ce = memremap(old_ce_phys, PAGE_SIZE, MEMREMAP_WB); @@ -1515,7 +1517,7 @@ static int copy_context_table(struct intel_iommu *iommu, new_ce[idx] = ce; } - tbl[tbl_idx + pos] = new_ce; + tbl[tbl_idx + tbl_slot] = new_ce; __iommu_flush_cache(iommu, new_ce, VTD_PAGE_SIZE); From 710fe30142d9494f7d23dd072c11af3d85ddf72c Mon Sep 17 00:00:00 2001 From: Li RongQing Date: Wed, 5 Aug 2026 07:42:56 +0800 Subject: [PATCH 70/93] iommu/vt-d: Use logical OR operator for privilege mode check Replace bitwise OR (|) with logical OR (||) in the privilege mode validation check. While both operators produce the same result for boolean values (0 or 1), using logical OR is semantically correct and makes the intent clearer. No functional change, but improves code readability. Signed-off-by: Li RongQing Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/prq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/intel/prq.c b/drivers/iommu/intel/prq.c index 586055e51bb2..dddd3b51b657 100644 --- a/drivers/iommu/intel/prq.c +++ b/drivers/iommu/intel/prq.c @@ -223,7 +223,7 @@ static irqreturn_t prq_event_thread(int irq, void *d) goto prq_advance; } - if (unlikely(req->pm_req && (req->rd_req | req->wr_req))) { + if (unlikely(req->pm_req && (req->rd_req || req->wr_req))) { pr_err("IOMMU: %s: Page request in Privilege Mode\n", iommu->name); goto bad_req; From 3846e469c1ba1407260066070bff5c88ee39a4c7 Mon Sep 17 00:00:00 2001 From: Guanghui Feng Date: Wed, 5 Aug 2026 07:42:57 +0800 Subject: [PATCH 71/93] iommu/vt-d: Fix CACHE_TAG_NESTING_DEVTLB polluting shared variables in flush loop In cache_tag_flush_range(), the CACHE_TAG_NESTING_DEVTLB case modifies the shared local variables 'addr' and 'mask' before falling through to CACHE_TAG_DEVTLB. This causes all subsequent CACHE_TAG_DEVTLB entries in the same loop iteration to incorrectly use the full-range flush parameters (addr=0, mask=MAX_AGAW_PFN_WIDTH) instead of the precisely calculated PSI range. This is not the intended behavior, as regular DEVTLB entries should always perform targeted range-based invalidation. Fix this by having CACHE_TAG_NESTING_DEVTLB directly call cache_tag_flush_devtlb_psi() with the full-range constants and break, instead of modifying shared variables and falling through. This ensures CACHE_TAG_DEVTLB always uses the original calculated addr and mask for precise range flush. This change slightly affects trace_cache_tag_flush_range() behavior. Previously, after addr/mask were overwritten, the tracepoint could record a full-range flush even when the caller requested a narrower range. The tracepoint should reflect caller intent. Although this helper may widen the actual hardware invalidation range for implementation reasons, that does not change what the caller requested, so logging the requested range is the correct behavior. If the actual invalidation range sent to hardware is needed, it is already visible via the qi_submit trace event, which records the invalidation descriptors emitted by the driver. Signed-off-by: Guanghui Feng Signed-off-by: Guixin Liu Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/cache.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/intel/cache.c b/drivers/iommu/intel/cache.c index fdc88817709f..26a758b0f501 100644 --- a/drivers/iommu/intel/cache.c +++ b/drivers/iommu/intel/cache.c @@ -454,9 +454,8 @@ void cache_tag_flush_range(struct dmar_domain *domain, unsigned long start, * affected by a change in S2. So just flush the entire * device cache. */ - addr = 0; - mask = MAX_AGAW_PFN_WIDTH; - fallthrough; + cache_tag_flush_devtlb_psi(domain, tag, 0, MAX_AGAW_PFN_WIDTH); + break; case CACHE_TAG_DEVTLB: cache_tag_flush_devtlb_psi(domain, tag, addr, mask); break; From 1251ade0e39f81433823b19f48408fb5ab91b899 Mon Sep 17 00:00:00 2001 From: Dmitry Antipov Date: Wed, 5 Aug 2026 07:42:58 +0800 Subject: [PATCH 72/93] iommu/vt-d: Use kstrtoint_from_user() in dmar_perf_latency_write() Simplify 'dmar_perf_latency_write()' by using the convenient 'kstrtoint_from_user()'. Signed-off-by: Dmitry Antipov Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/debugfs.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/drivers/iommu/intel/debugfs.c b/drivers/iommu/intel/debugfs.c index 21e4e465ca58..d87408ebb830 100644 --- a/drivers/iommu/intel/debugfs.c +++ b/drivers/iommu/intel/debugfs.c @@ -690,19 +690,11 @@ static ssize_t dmar_perf_latency_write(struct file *filp, { struct dmar_drhd_unit *drhd; struct intel_iommu *iommu; - int counting; - char buf[64]; + int ret, counting; - if (cnt > 63) - cnt = 63; - - if (copy_from_user(&buf, ubuf, cnt)) - return -EFAULT; - - buf[cnt] = 0; - - if (kstrtoint(buf, 0, &counting)) - return -EINVAL; + ret = kstrtoint_from_user(ubuf, cnt, 0, &counting); + if (ret) + return ret; switch (counting) { case 0: From 219cc978d69ce9b538d0d73936c569d4ca5b0a24 Mon Sep 17 00:00:00 2001 From: Kevin Tian Date: Wed, 5 Aug 2026 07:42:59 +0800 Subject: [PATCH 73/93] iommu/vt-d: Fix no_iommu to disable platform opt-in If user explicitly requests to disable iommu (via "iommu=off" or "intel_iommu=off"), there is no reason to force enabling it due to platform opt-in (for external-facing devices). User should be aware of any security implication of doing so. "intel_iommu=off" implements this policy by setting no_platform_optin to skip platform opt-in in platform_optin_force_iommu(). However, "iommu=off" (no_iommu=1) doesn't set no_platform_optin hence is broken in this aspect: - detect_intel_iommu() doesn't request ACS if no_iommu=1 - platform_optin_force_iommu() forces iommu on if external-facing devices exist and no_platform_optin is not set This leads to a bad configuration with ACS disabled while DMA remapping is enabled. Instead of setting no_platform_optin (will soon be removed) for no_iommu=1, directly check no_iommu in platform_optin_force_iommu(). Fixes: 89a6079df791 ("iommu/vt-d: Force IOMMU on for platform opt in hint") Cc: stable@vger.kernel.org Signed-off-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index cf5f92619943..1a1f27a51063 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -2484,10 +2484,11 @@ static bool has_external_pci(void) static int __init platform_optin_force_iommu(void) { - if (!dmar_platform_optin() || no_platform_optin || !has_external_pci()) + if (no_iommu || !dmar_platform_optin() || no_platform_optin || + !has_external_pci()) return 0; - if (no_iommu || dmar_disabled) + if (dmar_disabled) pr_info("Intel-IOMMU force enabled due to platform opt in\n"); /* @@ -2498,7 +2499,6 @@ static int __init platform_optin_force_iommu(void) iommu_set_default_passthrough(false); dmar_disabled = 0; - no_iommu = 0; return 1; } From 607432b2618b61df81134be0ef2562b8300c1216 Mon Sep 17 00:00:00 2001 From: Kevin Tian Date: Wed, 5 Aug 2026 07:43:00 +0800 Subject: [PATCH 74/93] iommu/vt-d: Force requesting ACS when tboot is enabled Currently the conditions of requesting ACS in detect_intel_iommu() don't include tboot, leading to a possible misconfiguration with ACS disabled (e.g. due to user opts) while iommu is later forced on by tboot_force_iommu(). Fix it by checking tboot in detect_intel_iommu(). Fixes: 5d990b627537 ("PCI: add pci_request_acs") Cc: stable@vger.kernel.org Signed-off-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/dmar.c | 15 +++++++++++++-- drivers/iommu/intel/iommu.c | 2 +- drivers/iommu/intel/iommu.h | 2 ++ 3 files changed, 16 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c index 767ec092accd..e32685402f74 100644 --- a/drivers/iommu/intel/dmar.c +++ b/drivers/iommu/intel/dmar.c @@ -915,6 +915,18 @@ dmar_validate_one_drhd(struct acpi_dmar_header *entry, void *arg) return 0; } +static bool dmar_required(void) +{ + /* tboot supersedes any user/platform opt */ + if (!intel_iommu_tboot_noforce && tboot_enabled()) + return true; + + if (!no_iommu && (!dmar_disabled || dmar_platform_optin())) + return true; + + return false; +} + void __init detect_intel_iommu(void) { int ret; @@ -928,8 +940,7 @@ void __init detect_intel_iommu(void) if (!ret) ret = dmar_walk_dmar_table((struct acpi_table_dmar *)dmar_tbl, &validate_drhd_cb); - if (!ret && !no_iommu && !iommu_detected && - (!dmar_disabled || dmar_platform_optin())) { + if (!ret && !iommu_detected && dmar_required()) { iommu_detected = 1; /* Make sure ACS will be enabled */ pci_request_acs(); diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 1a1f27a51063..4d03d9a517de 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -57,7 +57,7 @@ static int rwbf_quirk; * (used when kernel is launched w/ TXT) */ static int force_on = 0; -static int intel_iommu_tboot_noforce; +int intel_iommu_tboot_noforce; static int no_platform_optin; #define ROOT_ENTRY_NR (VTD_PAGE_SIZE/sizeof(struct root_entry)) diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h index 775f1c4ae346..2cee36138d6e 100644 --- a/drivers/iommu/intel/iommu.h +++ b/drivers/iommu/intel/iommu.h @@ -1354,6 +1354,7 @@ static inline bool ecmd_has_pmu_essential(struct intel_iommu *iommu) extern int dmar_disabled; extern int intel_iommu_enabled; +extern int intel_iommu_tboot_noforce; #else static inline int iommu_calculate_agaw(struct intel_iommu *iommu) { @@ -1366,6 +1367,7 @@ static inline int iommu_calculate_max_sagaw(struct intel_iommu *iommu) #define dmar_disabled (1) #define intel_iommu_enabled (0) #define intel_iommu_sm (0) +#define intel_iommu_tboot_noforce (0) #endif static inline const char *decode_prq_descriptor(char *str, size_t size, From a4bd40c7e2ac5c74f9d1086a8ed1c633edeb5f32 Mon Sep 17 00:00:00 2001 From: Kevin Tian Date: Wed, 5 Aug 2026 07:43:01 +0800 Subject: [PATCH 75/93] iommu/vt-d: Remove dead code when CONFIG_INTEL_IOMMU is not set Those are leftovers and unreachable now: the entire intel directory is built only when CONFIG_INTEL_IOMMU is set. Signed-off-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.h | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h index 2cee36138d6e..785aa3b62055 100644 --- a/drivers/iommu/intel/iommu.h +++ b/drivers/iommu/intel/iommu.h @@ -1340,7 +1340,6 @@ static inline bool intel_domain_is_ss_paging(struct dmar_domain *domain) return domain->domain.ops == &intel_ss_paging_domain_ops; } -#ifdef CONFIG_INTEL_IOMMU extern int intel_iommu_sm; int iommu_calculate_agaw(struct intel_iommu *iommu); int iommu_calculate_max_sagaw(struct intel_iommu *iommu); @@ -1355,20 +1354,6 @@ static inline bool ecmd_has_pmu_essential(struct intel_iommu *iommu) extern int dmar_disabled; extern int intel_iommu_enabled; extern int intel_iommu_tboot_noforce; -#else -static inline int iommu_calculate_agaw(struct intel_iommu *iommu) -{ - return 0; -} -static inline int iommu_calculate_max_sagaw(struct intel_iommu *iommu) -{ - return 0; -} -#define dmar_disabled (1) -#define intel_iommu_enabled (0) -#define intel_iommu_sm (0) -#define intel_iommu_tboot_noforce (0) -#endif static inline const char *decode_prq_descriptor(char *str, size_t size, u64 dw0, u64 dw1, u64 dw2, u64 dw3) From 7e6bd2211eba39ad5aa61256ae8522c118b1a6aa Mon Sep 17 00:00:00 2001 From: Kevin Tian Date: Wed, 5 Aug 2026 07:43:02 +0800 Subject: [PATCH 76/93] iommu/vt-d: Consolidate dmar policy management and force_on logic Currently the dmar on/off is carried by multiple variables (no_iommu, dmar_disabled, no_platform_optin, etc.) with error-prone force_on logic scattered in multiple places. Unify/centralize the policy/priority management for various force_on scenarios. No functional impact except one case - "intel_iommu=off" sets no_platform_optin which is checked in platform_optin_force_iommu() but not in detect_intel_iommu(), leading to ACS unnecessarily requested when iommu could not be forced on later. Now with the unified logic this becomes more consistent. Signed-off-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/dmar.c | 58 ++++++++++++++++++++++++++++++++++--- drivers/iommu/intel/iommu.c | 7 +++++ drivers/iommu/intel/iommu.h | 45 ++++++++++++++++++++++++++++ 3 files changed, 106 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c index e32685402f74..bc2f6597eb27 100644 --- a/drivers/iommu/intel/dmar.c +++ b/drivers/iommu/intel/dmar.c @@ -915,14 +915,61 @@ dmar_validate_one_drhd(struct acpi_dmar_header *entry, void *arg) return 0; } +/* + * Centralized helper for deciding the force_on policy + * + * dmar off policies (for DMA Remapping) are defined from stronger + * (more negative values) to weaker (less negative values). + * + * When a force_on type is passed in, it is associated to a reference + * level for comparison. force_on is permitted when dmar is in a + * off policy less negative than the reference level (if the policy is + * on then the check is always true). + * + * For supported force_on types: + * + * - DMAR_FORCEON_TBOOT: tboot strictly requires DMA remapping for secure + * boot hence supersedes any user opts ("iommu=off" or "intel_iommu=off") + * and weaker off policies. + * + * - DMAR_FORCEON_PLATFORM: external-facing devices requires DMA + * remapping to prevent malicious downstream external devices from + * composing DMA attacks. force_on is permitted only if dmar policy is + * off by build configurations (CONFIG_INTEL_IOMMU_DEFAULT_ON=off). + * + * In a nutshell, "trusted boot environment" is considered stronger than + * "user choices", which in turn is stronger than "platform opt-in hint". + */ +bool dmar_can_force_on(enum dmar_force_on force_on) +{ + int level; + + switch (force_on) { + case DMAR_FORCEON_TBOOT: + level = DMAR_USER_OFF; + break; + case DMAR_FORCEON_PLATFORM: + level = DMAR_DEFAULT_OFF; + break; + default: + level = INT_MAX; + pr_warn("Unsupported force_on type (%d)\n", force_on); + break; + } + + return dmar_policy >= level; +} + static bool dmar_required(void) { - /* tboot supersedes any user/platform opt */ - if (!intel_iommu_tboot_noforce && tboot_enabled()) + if (dmar_policy_on()) return true; - if (!no_iommu && (!dmar_disabled || dmar_platform_optin())) - return true; + if (!intel_iommu_tboot_noforce && tboot_enabled()) + return dmar_can_force_on(DMAR_FORCEON_TBOOT); + + if (dmar_platform_optin()) + return dmar_can_force_on(DMAR_FORCEON_PLATFORM); return false; } @@ -936,6 +983,9 @@ void __init detect_intel_iommu(void) }; down_write(&dmar_global_lock); + if (no_iommu) + dmar_policy = DMAR_USER_OFF; + ret = dmar_table_detect(); if (!ret) ret = dmar_walk_dmar_table((struct acpi_table_dmar *)dmar_tbl, diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 4d03d9a517de..2f0cd1714923 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -199,6 +199,11 @@ static LIST_HEAD(dmar_satc_units); static void intel_iommu_domain_free(struct iommu_domain *domain); +#ifdef CONFIG_INTEL_IOMMU_DEFAULT_ON +int dmar_policy = DMAR_ON; +#else +int dmar_policy = DMAR_DEFAULT_OFF; +#endif int dmar_disabled = !IS_ENABLED(CONFIG_INTEL_IOMMU_DEFAULT_ON); int intel_iommu_sm = IS_ENABLED(CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON); @@ -240,9 +245,11 @@ static int __init intel_iommu_setup(char *str) while (*str) { if (!strncmp(str, "on", 2)) { + dmar_policy = DMAR_ON; dmar_disabled = 0; pr_info("IOMMU enabled\n"); } else if (!strncmp(str, "off", 3)) { + dmar_policy = DMAR_USER_OFF; dmar_disabled = 1; no_platform_optin = 1; pr_info("IOMMU disabled\n"); diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h index 785aa3b62055..dd2376a079b9 100644 --- a/drivers/iommu/intel/iommu.h +++ b/drivers/iommu/intel/iommu.h @@ -1351,6 +1351,51 @@ static inline bool ecmd_has_pmu_essential(struct intel_iommu *iommu) DMA_ECMD_ECCAP3_ESSENTIAL; } +enum dmar_force_on { + DMAR_FORCEON_PLATFORM, + DMAR_FORCEON_TBOOT +}; + +/* + * On policies are positive, with more positive value being stronger. + * Off policies are negative, with more negative value being stronger. + * + * 'dmar' here refers to DMA remapping instead of the dmar/iommu unit. + * + * - DMAR_FORCE_ON: + * force to turn on (e.g. by tboot or platform opt-in). + * + * - DMAR_ON: + * turn on by build configuration (CONFIG_INTEL_IOMMU_DEFAULT_ON=on) + * or user opts ("intel_iommu=on"). + * + * - DMAR_DEFAULT_OFF + * turn off by build configuration (CONFIG_INTEL_IOMMU_DEFAULT_ON=off). + * + * - DMAR_USER_OFF + * turn off by user opts ("intel_iommu=off" or "iommu=off"). + * + * - '0' is invalid, compared to decide the on/off policy + * + */ +#define DMAR_FORCE_ON 2 +#define DMAR_ON 1 +#define DMAR_DEFAULT_OFF -1 +#define DMAR_USER_OFF -2 +extern int dmar_policy; + +static inline bool dmar_policy_on(void) +{ + return dmar_policy > 0; +} + +static inline bool dmar_policy_off(void) +{ + return dmar_policy < 0; +} + +bool dmar_can_force_on(enum dmar_force_on force_on); + extern int dmar_disabled; extern int intel_iommu_enabled; extern int intel_iommu_tboot_noforce; From 98c8a9809b1c978db0bae4d21b21fa795099ce26 Mon Sep 17 00:00:00 2001 From: Kevin Tian Date: Wed, 5 Aug 2026 07:43:03 +0800 Subject: [PATCH 77/93] iommu/vt-d: Use dmar_can_force_on() for platform opt-in So the policy of requesting ACS in detect_intel_iommu() is consistent with that in platform_optin_force_iommu(). While at it, remove no_platform_optin which is unnecessary now. Signed-off-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 2f0cd1714923..ce0794e82e55 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -58,7 +58,6 @@ static int rwbf_quirk; */ static int force_on = 0; int intel_iommu_tboot_noforce; -static int no_platform_optin; #define ROOT_ENTRY_NR (VTD_PAGE_SIZE/sizeof(struct root_entry)) @@ -251,7 +250,6 @@ static int __init intel_iommu_setup(char *str) } else if (!strncmp(str, "off", 3)) { dmar_policy = DMAR_USER_OFF; dmar_disabled = 1; - no_platform_optin = 1; pr_info("IOMMU disabled\n"); } else if (!strncmp(str, "igfx_off", 8)) { disable_igfx_iommu = 1; @@ -2491,20 +2489,23 @@ static bool has_external_pci(void) static int __init platform_optin_force_iommu(void) { - if (no_iommu || !dmar_platform_optin() || no_platform_optin || - !has_external_pci()) + if (!dmar_platform_optin() || !dmar_can_force_on(DMAR_FORCEON_PLATFORM)) return 0; - if (dmar_disabled) - pr_info("Intel-IOMMU force enabled due to platform opt in\n"); + if (!has_external_pci()) + return 0; /* * If Intel-IOMMU is disabled by default, we will apply identity * map for all devices except those marked as being untrusted. */ - if (dmar_disabled) + if (dmar_policy_off()) { + pr_info("Intel-IOMMU force enabled due to platform opt in\n"); iommu_set_default_passthrough(false); + } + /* No concurrent access to dmar_policy at this point. */ + dmar_policy = DMAR_FORCE_ON; dmar_disabled = 0; return 1; From 03ff2ad8306df200c15858be2d6d31c6b3f9ef4e Mon Sep 17 00:00:00 2001 From: Kevin Tian Date: Wed, 5 Aug 2026 07:43:04 +0800 Subject: [PATCH 78/93] iommu/vt-d: Call dmar_can_force_on() for tboot opt-in So the policy of requesting ACS in detect_intel_iommu() is consistent with that in tboot_force_iommu(). Though tboot is the strongest override so far, dmar_can_force_on() may return false due to future extensions. In this case panic the kernel, as is already done when failing to initialize DMA remapping for tboot. No functional impact at this point. Signed-off-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index ce0794e82e55..5eb80aeec274 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -2550,12 +2550,17 @@ static int __init probe_acpi_namespace_devices(void) static __init int tboot_force_iommu(void) { - if (!tboot_enabled()) + if (!tboot_enabled() || intel_iommu_tboot_noforce) return 0; - if (no_iommu || dmar_disabled) + if (!dmar_can_force_on(DMAR_FORCEON_TBOOT)) + panic("tboot: Failed to force IOMMU on\n"); + + if (dmar_policy_off()) pr_warn("Forcing Intel-IOMMU to enabled\n"); + /* No concurrent access to dmar_policy at this point. */ + dmar_policy = DMAR_FORCE_ON; dmar_disabled = 0; no_iommu = 0; @@ -2572,8 +2577,7 @@ int __init intel_iommu_init(void) * Intel IOMMU is required for a TXT/tboot launch or platform * opt in, so enforce that. */ - force_on = (!intel_iommu_tboot_noforce && tboot_force_iommu()) || - platform_optin_force_iommu(); + force_on = tboot_force_iommu() || platform_optin_force_iommu(); down_write(&dmar_global_lock); if (dmar_table_init()) { From 124d249e712cafea5e35515ca5ba28d383ae3355 Mon Sep 17 00:00:00 2001 From: Kevin Tian Date: Wed, 5 Aug 2026 07:43:05 +0800 Subject: [PATCH 79/93] iommu/vt-d: Remove the 'force_on' variable The force_on variable is now redundant - same information captured by "dmar_policy == DMAR_FORCE_ON". Replace all force_on checks with dmar_policy_force_on(). Signed-off-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 37 +++++++++++++++++-------------------- drivers/iommu/intel/iommu.h | 5 +++++ 2 files changed, 22 insertions(+), 20 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 5eb80aeec274..118c62e859fd 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -53,10 +53,9 @@ static int rwbf_quirk; #define rwbf_required(iommu) (rwbf_quirk || cap_rwbf((iommu)->cap)) /* - * set to 1 to panic kernel if can't successfully enable VT-d - * (used when kernel is launched w/ TXT) + * Skip forcing iommu on and avoid tboot-related kernel panics during + * initialization when set to 1 (via intel_iommu=tboot_noforce). */ -static int force_on = 0; int intel_iommu_tboot_noforce; #define ROOT_ENTRY_NR (VTD_PAGE_SIZE/sizeof(struct root_entry)) @@ -1713,7 +1712,7 @@ static int __init init_dmars(void) * we always have to disable PMRs or DMA may fail on * this device */ - if (force_on) + if (dmar_policy_force_on()) iommu_disable_protect_mem_regions(iommu); continue; } @@ -1805,7 +1804,7 @@ static int init_iommu_hw(void) * we always have to disable PMRs or DMA may fail on * this device */ - if (force_on) + if (dmar_policy_force_on()) iommu_disable_protect_mem_regions(iommu); continue; } @@ -1866,7 +1865,7 @@ static void iommu_resume(void *data) unsigned long flag; if (init_iommu_hw()) { - if (force_on) + if (dmar_policy_force_on()) panic("tboot: IOMMU setup failed, DMAR can not resume!\n"); else WARN(1, "IOMMU setup failed, DMAR can not resume!\n"); @@ -2134,7 +2133,7 @@ static int intel_iommu_add(struct dmar_drhd_unit *dmaru) /* * we always have to disable PMRs or DMA may fail on this device */ - if (force_on) + if (dmar_policy_force_on()) iommu_disable_protect_mem_regions(iommu); return 0; } @@ -2487,13 +2486,13 @@ static bool has_external_pci(void) return false; } -static int __init platform_optin_force_iommu(void) +static void __init platform_optin_force_iommu(void) { if (!dmar_platform_optin() || !dmar_can_force_on(DMAR_FORCEON_PLATFORM)) - return 0; + return; if (!has_external_pci()) - return 0; + return; /* * If Intel-IOMMU is disabled by default, we will apply identity @@ -2507,8 +2506,6 @@ static int __init platform_optin_force_iommu(void) /* No concurrent access to dmar_policy at this point. */ dmar_policy = DMAR_FORCE_ON; dmar_disabled = 0; - - return 1; } static int __init probe_acpi_namespace_devices(void) @@ -2548,10 +2545,10 @@ static int __init probe_acpi_namespace_devices(void) return 0; } -static __init int tboot_force_iommu(void) +static __init void tboot_force_iommu(void) { if (!tboot_enabled() || intel_iommu_tboot_noforce) - return 0; + return; if (!dmar_can_force_on(DMAR_FORCEON_TBOOT)) panic("tboot: Failed to force IOMMU on\n"); @@ -2563,8 +2560,6 @@ static __init int tboot_force_iommu(void) dmar_policy = DMAR_FORCE_ON; dmar_disabled = 0; no_iommu = 0; - - return 1; } int __init intel_iommu_init(void) @@ -2577,17 +2572,19 @@ int __init intel_iommu_init(void) * Intel IOMMU is required for a TXT/tboot launch or platform * opt in, so enforce that. */ - force_on = tboot_force_iommu() || platform_optin_force_iommu(); + tboot_force_iommu(); + if (!dmar_policy_force_on()) + platform_optin_force_iommu(); down_write(&dmar_global_lock); if (dmar_table_init()) { - if (force_on) + if (dmar_policy_force_on()) panic("tboot: Failed to initialize DMAR table\n"); goto out_free_dmar; } if (dmar_dev_scope_init() < 0) { - if (force_on) + if (dmar_policy_force_on()) panic("tboot: Failed to initialize DMAR device scope\n"); goto out_free_dmar; } @@ -2641,7 +2638,7 @@ int __init intel_iommu_init(void) ret = init_dmars(); if (ret) { - if (force_on) + if (dmar_policy_force_on()) panic("tboot: Failed to initialize DMARs\n"); pr_err("Initialization failed\n"); goto out_free_dmar; diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h index dd2376a079b9..40da2ed7e254 100644 --- a/drivers/iommu/intel/iommu.h +++ b/drivers/iommu/intel/iommu.h @@ -1394,6 +1394,11 @@ static inline bool dmar_policy_off(void) return dmar_policy < 0; } +static inline bool dmar_policy_force_on(void) +{ + return dmar_policy == DMAR_FORCE_ON; +} + bool dmar_can_force_on(enum dmar_force_on force_on); extern int dmar_disabled; From 3f29c94ecac0708d096f770cdedc5e075912b9e0 Mon Sep 17 00:00:00 2001 From: Kevin Tian Date: Wed, 5 Aug 2026 07:43:06 +0800 Subject: [PATCH 80/93] iommu/vt-d: Remove dmar_disabled It's replaced by dmar_policy_off() now, covering both "iommu=off" and "intel_iommu=off". Also remove unnecessary checks on no_iommu, leaving only one exception in intel_iommu_init() which skips debugfs init for "iommu=off" but not "intel_iommu=off". Keep it to avoid surprise for now. Signed-off-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 9 ++------- drivers/iommu/intel/iommu.h | 1 - drivers/iommu/intel/svm.c | 2 +- 3 files changed, 3 insertions(+), 9 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 118c62e859fd..a996b72aca57 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -202,7 +202,6 @@ int dmar_policy = DMAR_ON; #else int dmar_policy = DMAR_DEFAULT_OFF; #endif -int dmar_disabled = !IS_ENABLED(CONFIG_INTEL_IOMMU_DEFAULT_ON); int intel_iommu_sm = IS_ENABLED(CONFIG_INTEL_IOMMU_SCALABLE_MODE_DEFAULT_ON); int intel_iommu_enabled = 0; @@ -244,11 +243,9 @@ static int __init intel_iommu_setup(char *str) while (*str) { if (!strncmp(str, "on", 2)) { dmar_policy = DMAR_ON; - dmar_disabled = 0; pr_info("IOMMU enabled\n"); } else if (!strncmp(str, "off", 3)) { dmar_policy = DMAR_USER_OFF; - dmar_disabled = 1; pr_info("IOMMU disabled\n"); } else if (!strncmp(str, "igfx_off", 8)) { disable_igfx_iommu = 1; @@ -2371,7 +2368,7 @@ void intel_iommu_shutdown(void) struct dmar_drhd_unit *drhd; struct intel_iommu *iommu = NULL; - if (no_iommu || dmar_disabled) + if (dmar_policy_off()) return; /* @@ -2505,7 +2502,6 @@ static void __init platform_optin_force_iommu(void) /* No concurrent access to dmar_policy at this point. */ dmar_policy = DMAR_FORCE_ON; - dmar_disabled = 0; } static int __init probe_acpi_namespace_devices(void) @@ -2558,7 +2554,6 @@ static __init void tboot_force_iommu(void) /* No concurrent access to dmar_policy at this point. */ dmar_policy = DMAR_FORCE_ON; - dmar_disabled = 0; no_iommu = 0; } @@ -2602,7 +2597,7 @@ int __init intel_iommu_init(void) if (!no_iommu) intel_iommu_debugfs_init(); - if (no_iommu || dmar_disabled) { + if (dmar_policy_off()) { /* * We exit the function here to ensure IOMMU's remapping and * mempool aren't setup, which means that the IOMMU's PMRs diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h index 40da2ed7e254..9805edb8c7df 100644 --- a/drivers/iommu/intel/iommu.h +++ b/drivers/iommu/intel/iommu.h @@ -1401,7 +1401,6 @@ static inline bool dmar_policy_force_on(void) bool dmar_can_force_on(enum dmar_force_on force_on); -extern int dmar_disabled; extern int intel_iommu_enabled; extern int intel_iommu_tboot_noforce; diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c index fea10acd4f02..0636987f03c8 100644 --- a/drivers/iommu/intel/svm.c +++ b/drivers/iommu/intel/svm.c @@ -115,7 +115,7 @@ static int intel_iommu_sva_supported(struct device *dev) struct device_domain_info *info = dev_iommu_priv_get(dev); struct intel_iommu *iommu; - if (!info || dmar_disabled) + if (!info || dmar_policy_off()) return -EINVAL; iommu = info->iommu; From 1c677d8a2c3cbc22287ac34483e6b2b7b20ddf52 Mon Sep 17 00:00:00 2001 From: Kevin Tian Date: Wed, 5 Aug 2026 07:43:07 +0800 Subject: [PATCH 81/93] iommu/vt-d: Support the new DMA_REMAP_OPT_OUT flag bit Some BIOS already provides config options to expose/hide VT-d units as a whole to/from system software. A new demand is to allow exposing VT-d units but requesting system software to disable DMA remapping while sustaining interrupt remapping. This can be communicated now by setting the new DMA_REMAP_OPT_OUT flag bit in the DMAR table, as introduced in VT-d spec v5.2 (section 8.1, DMA Remapping Reporting Structure). Introduce a new off policy (DMAR_FW_OFF) for DMA_REMAP_OPT_OUT. As the strongest off policy, it cannot be overridden by user opts or any force_on types. If tboot is enabled in the meantime, kernel will panic. It is user responsibility to configure BIOS properly. One cleanup is left for future - the DMAR flag is parsed multiple times, in detect_intel_iommu(), dmar_platform_optin() (which can be called at run-time), etc. Caching it is a cleaner way. Signed-off-by: Kevin Tian Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/dmar.c | 34 ++++++++++++++++++++++++---------- drivers/iommu/intel/iommu.h | 4 ++++ include/linux/dmar.h | 1 + 3 files changed, 29 insertions(+), 10 deletions(-) diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c index bc2f6597eb27..33bfaeafa7c6 100644 --- a/drivers/iommu/intel/dmar.c +++ b/drivers/iommu/intel/dmar.c @@ -930,7 +930,9 @@ dmar_validate_one_drhd(struct acpi_dmar_header *entry, void *arg) * * - DMAR_FORCEON_TBOOT: tboot strictly requires DMA remapping for secure * boot hence supersedes any user opts ("iommu=off" or "intel_iommu=off") - * and weaker off policies. + * and weaker off policies. But if firmware forces DMA remapping off (by + * setting DMAR_REMAP_OPT_OUT in the DMAR table), no force_on is allowed. + * Firmware settings must be changed to unblock tboot. * * - DMAR_FORCEON_PLATFORM: external-facing devices requires DMA * remapping to prevent malicious downstream external devices from @@ -939,6 +941,7 @@ dmar_validate_one_drhd(struct acpi_dmar_header *entry, void *arg) * * In a nutshell, "trusted boot environment" is considered stronger than * "user choices", which in turn is stronger than "platform opt-in hint". + * But they are all meaningless when it's forced off by "firmware". */ bool dmar_can_force_on(enum dmar_force_on force_on) { @@ -976,31 +979,42 @@ static bool dmar_required(void) void __init detect_intel_iommu(void) { - int ret; struct dmar_res_callback validate_drhd_cb = { .cb[ACPI_DMAR_TYPE_HARDWARE_UNIT] = &dmar_validate_one_drhd, .ignore_unhandled = true, }; + struct acpi_table_dmar *dmar; + int ret; down_write(&dmar_global_lock); if (no_iommu) dmar_policy = DMAR_USER_OFF; ret = dmar_table_detect(); - if (!ret) - ret = dmar_walk_dmar_table((struct acpi_table_dmar *)dmar_tbl, - &validate_drhd_cb); - if (!ret && !iommu_detected && dmar_required()) { + if (!ret) { + dmar = (struct acpi_table_dmar *)dmar_tbl; + ret = dmar_walk_dmar_table(dmar, &validate_drhd_cb); + } + + if (ret) + goto out; + + if (dmar->flags & DMAR_REMAP_OPT_OUT) { + dmar_policy = DMAR_FW_OFF; + pr_info("Firmware forces DMA remapping off\n"); + pr_info("Any user opt or tboot/platform force_on will be ignored\n"); + } + + if (!iommu_detected && dmar_required()) { iommu_detected = 1; /* Make sure ACS will be enabled */ pci_request_acs(); } - if (!ret) { - x86_init.iommu.iommu_init = intel_iommu_init; - x86_platform.iommu_shutdown = intel_iommu_shutdown; - } + x86_init.iommu.iommu_init = intel_iommu_init; + x86_platform.iommu_shutdown = intel_iommu_shutdown; +out: if (dmar_tbl) { acpi_put_table(dmar_tbl); dmar_tbl = NULL; diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h index 9805edb8c7df..656cd311ed9a 100644 --- a/drivers/iommu/intel/iommu.h +++ b/drivers/iommu/intel/iommu.h @@ -1375,6 +1375,9 @@ enum dmar_force_on { * - DMAR_USER_OFF * turn off by user opts ("intel_iommu=off" or "iommu=off"). * + * - DMAR_FW_OFF + * turn off due to firmware opt-out (DMAR_REMAP_OPT_OUT) + * * - '0' is invalid, compared to decide the on/off policy * */ @@ -1382,6 +1385,7 @@ enum dmar_force_on { #define DMAR_ON 1 #define DMAR_DEFAULT_OFF -1 #define DMAR_USER_OFF -2 +#define DMAR_FW_OFF -3 extern int dmar_policy; static inline bool dmar_policy_on(void) diff --git a/include/linux/dmar.h b/include/linux/dmar.h index 692b2b445761..63e35df2cef4 100644 --- a/include/linux/dmar.h +++ b/include/linux/dmar.h @@ -24,6 +24,7 @@ struct acpi_dmar_header; #define DMAR_INTR_REMAP 0x1 #define DMAR_X2APIC_OPT_OUT 0x2 #define DMAR_PLATFORM_OPT_IN 0x4 +#define DMAR_REMAP_OPT_OUT 0x8 struct intel_iommu; From 5b3ba0a002672d189fd55eaafdd4f55e5c6c522b Mon Sep 17 00:00:00 2001 From: Lu Baolu Date: Wed, 5 Aug 2026 07:43:08 +0800 Subject: [PATCH 82/93] iommu/vt-d: Cache max domain ID to avoid redundant calculation The cap_ndoms() helper calculates the maximum available domain ID from the value of capability register, which can be inefficient if called repeatedly. Cache the maximum supported domain ID in max_domain_id field during initialization to avoid redundant calls to cap_ndoms() throughout the IOMMU driver. No functionality change. Signed-off-by: Lu Baolu Signed-off-by: Xu Yilun Reviewed-by: Kevin Tian Signed-off-by: Joerg Roedel --- drivers/iommu/intel/dmar.c | 1 + drivers/iommu/intel/iommu.c | 10 +++++----- drivers/iommu/intel/iommu.h | 1 + 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c index 33bfaeafa7c6..c854173f6be9 100644 --- a/drivers/iommu/intel/dmar.c +++ b/drivers/iommu/intel/dmar.c @@ -1174,6 +1174,7 @@ static int alloc_iommu(struct dmar_drhd_unit *drhd) spin_lock_init(&iommu->lock); ida_init(&iommu->domain_ida); mutex_init(&iommu->did_lock); + iommu->max_domain_id = cap_ndoms(iommu->cap); ver = readl(iommu->reg + DMAR_VER_REG); pr_info("%s: reg_base_addr %llx ver %d:%d cap %llx ecap %llx\n", diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index a996b72aca57..5ea584b76f77 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -1047,7 +1047,7 @@ int domain_attach_iommu(struct dmar_domain *domain, struct intel_iommu *iommu) } num = ida_alloc_range(&iommu->domain_ida, IDA_START_DID, - cap_ndoms(iommu->cap) - 1, GFP_KERNEL); + iommu->max_domain_id - 1, GFP_KERNEL); if (num < 0) { pr_err("%s: No free domain ids\n", iommu->name); goto err_unlock; @@ -1111,7 +1111,7 @@ static void copied_context_tear_down(struct intel_iommu *iommu, did_old = context_domain_id(context); context_clear_entry(context); - if (did_old < cap_ndoms(iommu->cap)) { + if (did_old < iommu->max_domain_id) { iommu->flush.flush_context(iommu, did_old, PCI_DEVID(bus, devfn), DMA_CCMD_MASK_NOBIT, @@ -1511,7 +1511,7 @@ static int copy_context_table(struct intel_iommu *iommu, continue; did = context_domain_id(&ce); - if (did >= 0 && did < cap_ndoms(iommu->cap)) + if (did >= 0 && did < iommu->max_domain_id) ida_alloc_range(&iommu->domain_ida, did, did, GFP_KERNEL); set_context_copied(iommu, bus, devfn); @@ -2431,7 +2431,7 @@ static ssize_t domains_supported_show(struct device *dev, struct device_attribute *attr, char *buf) { struct intel_iommu *iommu = dev_to_intel_iommu(dev); - return sysfs_emit(buf, "%ld\n", cap_ndoms(iommu->cap)); + return sysfs_emit(buf, "%ld\n", iommu->max_domain_id); } static DEVICE_ATTR_RO(domains_supported); @@ -2442,7 +2442,7 @@ static ssize_t domains_used_show(struct device *dev, unsigned int count = 0; int id; - for (id = 0; id < cap_ndoms(iommu->cap); id++) + for (id = 0; id < iommu->max_domain_id; id++) if (ida_exists(&iommu->domain_ida, id)) count++; diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h index 656cd311ed9a..c00f44db0020 100644 --- a/drivers/iommu/intel/iommu.h +++ b/drivers/iommu/intel/iommu.h @@ -700,6 +700,7 @@ struct intel_iommu { /* mutex to protect domain_ida */ struct mutex did_lock; struct ida domain_ida; /* domain id allocator */ + unsigned long max_domain_id; unsigned long *copied_tables; /* bitmap of copied tables */ spinlock_t lock; /* protect context, domain ids */ struct root_entry *root_entry; /* virtual address */ From d9ef887fb26c8a73c904b5aed93e82dca64fe109 Mon Sep 17 00:00:00 2001 From: ZhaoJinming Date: Wed, 5 Aug 2026 07:43:09 +0800 Subject: [PATCH 83/93] iommu/vt-d: Fix copied_tables bitmap leak on error in copy_translation_tables The iommu->copied_tables bitmap was introduced by the IOMMU live update series to track which context entries have been copied from the previous kernel. The allocation via bitmap_zalloc() was added inside copy_translation_tables(), but the error paths were not updated to free it: 1. When old_rt_phys is 0 (invalid root table address) 2. When memremap(old_rt_phys) fails 3. When kcalloc for ctxt_tbls fails (goto out_unmap, which only unmaps old_rt without releasing the bitmap) The bitmap is only cleaned up by free_dmar_iommu(), which is called from the free_iommu error label in init_dmars(). However, when copy_translation_tables() fails, init_dmars() does not jump to free_iommu -- it logs the error, falls through, and continues with the next IOMMU. As a result, copied_tables is leaked. Fix this by converting the two early returns to goto a new err_free_bitmap label, and by making out_unmap fall through to it so that the bitmap is always freed on any error path. The success path performs memunmap(old_rt) inline and returns 0 directly, since copied_tables must remain allocated for subsequent use. Signed-off-by: ZhaoJinming Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 5ea584b76f77..7098a6bf6a40 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -1557,12 +1557,16 @@ static int copy_translation_tables(struct intel_iommu *iommu) return -ENOMEM; old_rt_phys = rtaddr_reg & VTD_PAGE_MASK; - if (!old_rt_phys) - return -EINVAL; + if (!old_rt_phys) { + ret = -EINVAL; + goto err_free_bitmap; + } old_rt = memremap(old_rt_phys, PAGE_SIZE, MEMREMAP_WB); - if (!old_rt) - return -ENOMEM; + if (!old_rt) { + ret = -ENOMEM; + goto err_free_bitmap; + } /* This is too big for the stack - allocate it from slab */ ctxt_table_entries = ext ? 512 : 256; @@ -1606,11 +1610,14 @@ static int copy_translation_tables(struct intel_iommu *iommu) __iommu_flush_cache(iommu, iommu->root_entry, PAGE_SIZE); - ret = 0; + memunmap(old_rt); + return 0; out_unmap: memunmap(old_rt); - +err_free_bitmap: + bitmap_free(iommu->copied_tables); + iommu->copied_tables = NULL; return ret; } From f532c57985b1a7d6b7e37e05506b46d413e5cca4 Mon Sep 17 00:00:00 2001 From: Lu Baolu Date: Wed, 5 Aug 2026 07:43:10 +0800 Subject: [PATCH 84/93] iommu/vt-d: Clear Present bit before tearing down copied context entry copied_context_tear_down() zeroes the 128-bit context entry with context_clear_entry() while the Present bit is still set, and only then issues the context-cache and IOTLB invalidations. This leaves a window in which hardware can fetch a torn entry, with some fields already zeroed while Present is still set, leading to unpredictable behaviour or spurious faults. While x86 provides strong write ordering, the compiler may reorder the writes to the two 64-bit halves of the entry, and the hardware fetch is not guaranteed to be atomic with respect to multiple CPU writes. There is no cacheline flush before the invalidation either, so on an IOMMU without coherent access to the context table the zeroed entry may not be visible to hardware at the point the invalidation is submitted. Apply the same ownership handshake described in the VT-d spec, Section 6.5.3.3 ("Guidance to Software for Invalidations"): clear only the Present bit, flush it out to the IOMMU, perform the invalidations, and only then zero the remainder of the entry. Fixes: c7191984e5aad ("iommu/vt-d: Factor out helpers from domain_context_mapping_one()") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260602233426.357499-1-baolu.lu%40linux.intel.com Assisted-by: Claude:claude-opus-5 Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 7098a6bf6a40..000b81cf4a7a 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -1109,7 +1109,8 @@ static void copied_context_tear_down(struct intel_iommu *iommu, assert_spin_locked(&iommu->lock); did_old = context_domain_id(context); - context_clear_entry(context); + context_clear_present(context); + __iommu_flush_cache(iommu, context, sizeof(*context)); if (did_old < iommu->max_domain_id) { iommu->flush.flush_context(iommu, did_old, @@ -1120,6 +1121,9 @@ static void copied_context_tear_down(struct intel_iommu *iommu, DMA_TLB_DSI_FLUSH); } + context_clear_entry(context); + __iommu_flush_cache(iommu, context, sizeof(*context)); + clear_context_copied(iommu, bus, devfn); } From 236dd58fabd2e951b940a6ad88b81147899ed311 Mon Sep 17 00:00:00 2001 From: Lu Baolu Date: Wed, 5 Aug 2026 07:43:11 +0800 Subject: [PATCH 85/93] iommu/vt-d: Fix iopf_refcount leak on RID domain replacement intel_iommu_attach_device() enables IOPF for the new domain but never disables it for the old one. device_block_translation(), called at the start of the function, tears down translation but does not touch any IOPF state; blocking_domain_attach_dev() has to call iopf_for_domain_remove() explicitly before invoking it for exactly this reason. identity_domain_attach_dev() has the same problem. Its comment claims that no PRI handling is needed because the device has been put in the blocking state, but the blocking state and the IOPF reference count are independent of each other. As a result, replacing a domain that has an iopf_handler with another domain at RID level leaks a reference in info->iopf_refcount. The count never drops back to zero, so iopf_queue_remove_device() is never called and iommu_disable_pci_pri() triggers its WARN_ON(info->iopf_refcount) when the device is released. The PASID paths already handle this correctly by way of iopf_for_domain_replace(); convert the two RID paths to do the same. Using the replace helper rather than a bare remove keeps the enable before the disable, so the reference count does not transiently reach zero and evict the device from the IOPF queue. Fixes: 17fce9d2336d ("iommu/vt-d: Put iopf enablement in domain attach path") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260602233426.357499-1-baolu.lu%40linux.intel.com Assisted-by: Claude:claude-opus-5 Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 000b81cf4a7a..9003783d02bc 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -3152,13 +3152,13 @@ static int intel_iommu_attach_device(struct iommu_domain *domain, if (ret) return ret; - ret = iopf_for_domain_set(domain, dev); + ret = iopf_for_domain_replace(domain, old, dev); if (ret) return ret; ret = dmar_domain_attach_device(to_dmar_domain(domain), dev); if (ret) - iopf_for_domain_remove(domain, dev); + iopf_for_domain_replace(old, domain, dev); return ret; } @@ -3861,10 +3861,13 @@ static int identity_domain_attach_dev(struct iommu_domain *domain, return 0; /* - * No PRI support with the global identity domain. No need to enable or - * disable PRI in this path as the iommu has been put in the blocking - * state. + * The identity domain has no iopf_handler, so no IOPF reference is + * taken for it. The reference held by the old domain must still be + * released here; putting the device in the blocking state above does + * not affect the IOPF reference count. */ + iopf_for_domain_remove(old, dev); + if (sm_supported(iommu)) ret = intel_pasid_setup_pass_through(iommu, dev, IOMMU_NO_PASID); else From c509fb73a1093a15accd7d43a61645d4b520f6ac Mon Sep 17 00:00:00 2001 From: Lu Baolu Date: Wed, 5 Aug 2026 07:43:12 +0800 Subject: [PATCH 86/93] iommu/vt-d: Tear down scalable-mode context on probe failure MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit intel_pasid_setup_sm_context() walks a PCI device’s DMA aliases via pci_for_each_dma_alias() and programs a scalable-mode context entry for each RID. For a device with a dma_alias_mask, the callback is invoked once for the device’s own RID and once for each alias bit, all with the same pci_dev, so device_pasid_table_setup() runs for multiple RIDs. pci_for_each_dma_alias() stops at the first callback error. Therefore, a failure partway through the walk can leave context entries for already processed RIDs present and still pointing to the device’s PASID table. On this error path, intel_iommu_probe_device() currently jumps directly to intel_pasid_free_table(), which frees the PASID table without first tearing down those context entries. The IOMMU may then walk a present context entry whose PASID table pointer references freed memory. intel_iommu_release_device() already performs teardown before freeing the table. Apply the same ordering on the probe failure path. device_pasid_table_teardown() safely handles RIDs that were never programmed: iommu_context_addr() returns NULL when no context table has been allocated, and clearing the Present bit of an already non-present entry is a no-op. So unwind is safe for both the alias that failed and any aliases not yet reached. Fixes: 301f1a80487fd ("iommu/vt-d: Setup scalable mode context entry in probe path") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260602233426.357499-1-baolu.lu%40linux.intel.com Assisted-by: Claude:claude-opus-5 Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 9003783d02bc..489bab4999fb 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -3333,6 +3333,7 @@ static struct iommu_device *intel_iommu_probe_device(struct device *dev) return &iommu->iommu; free_table: + intel_pasid_teardown_sm_context(dev); intel_pasid_free_table(dev); clear_rbtree: device_rbtree_remove(info); From c54e4ae971b98e8d650400137d332cee56c03f55 Mon Sep 17 00:00:00 2001 From: Lu Baolu Date: Wed, 5 Aug 2026 07:43:13 +0800 Subject: [PATCH 87/93] iommu/vt-d: Flush context cache with correct SID when tearing down aliases MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit domain_context_clear_one() and device_pasid_table_teardown() are both invoked once per DMA alias of a device. Each function locates the context entry using the bus/devfn pair provided by the pci_for_each_dma_alias() callback, then calls intel_context_flush_no_pasid(), which constructs a device-selective context-cache invalidation from info->bus and info->devfn (that is, always the requester ID of the device itself). As a result, for every alias other than the device’s own RID, the context entry that was just cleared in memory is never invalidated in the context cache. Hardware may continue using that stale cached entry. In the scalable-mode teardown path, intel_pasid_free_table() can then free the PASID directory still referenced by that stale entry, allowing the IOMMU to walk freed memory. Fix this by passing the source ID of the entry being torn down to intel_context_flush_no_pasid(), instead of deriving it from @info. Fixes: f90584f4beb84 ("iommu/vt-d: Add helper to flush caches for context change") Reported-by: Sashiko Closes: https://sashiko.dev/#/patchset/20260602233426.357499-1-baolu.lu%40linux.intel.com Assisted-by: Claude:claude-opus-5 Signed-off-by: Lu Baolu Reviewed-by: Samiullah Khawaja Signed-off-by: Joerg Roedel --- drivers/iommu/intel/iommu.c | 2 +- drivers/iommu/intel/iommu.h | 2 +- drivers/iommu/intel/pasid.c | 9 ++++++--- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 489bab4999fb..6d81644c66bc 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -1251,7 +1251,7 @@ static void domain_context_clear_one(struct device_domain_info *info, u8 bus, u8 context_clear_present(context); __iommu_flush_cache(iommu, context, sizeof(*context)); spin_unlock(&iommu->lock); - intel_context_flush_no_pasid(info, context, did); + intel_context_flush_no_pasid(info, context, did, PCI_DEVID(bus, devfn)); context_clear_entry(context); __iommu_flush_cache(iommu, context, sizeof(*context)); } diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h index c00f44db0020..23dbe6c24439 100644 --- a/drivers/iommu/intel/iommu.h +++ b/drivers/iommu/intel/iommu.h @@ -1241,7 +1241,7 @@ void cache_tag_flush_range_np(struct dmar_domain *domain, unsigned long start, unsigned long end); void intel_context_flush_no_pasid(struct device_domain_info *info, - struct context_entry *context, u16 did); + struct context_entry *context, u16 did, u16 sid); int intel_iommu_enable_prq(struct intel_iommu *iommu); int intel_iommu_finish_prq(struct intel_iommu *iommu); diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c index 81353fd46b37..e4f24d3f19a6 100644 --- a/drivers/iommu/intel/pasid.c +++ b/drivers/iommu/intel/pasid.c @@ -751,7 +751,7 @@ static void device_pasid_table_teardown(struct device *dev, u8 bus, u8 devfn) context_clear_present(context); __iommu_flush_cache(iommu, context, sizeof(*context)); spin_unlock(&iommu->lock); - intel_context_flush_no_pasid(info, context, did); + intel_context_flush_no_pasid(info, context, did, PCI_DEVID(bus, devfn)); context_clear_entry(context); __iommu_flush_cache(iommu, context, sizeof(*context)); } @@ -955,9 +955,12 @@ static void __context_flush_dev_iotlb(struct device_domain_info *info) * This helper can only be used when IOMMU is working in the legacy mode or * IOMMU is in scalable mode but all PASID table entries of the device are * non-present. + * + * @sid identifies the context entry that was modified, which may be a DMA + * alias of @info->dev rather than its own requester ID. */ void intel_context_flush_no_pasid(struct device_domain_info *info, - struct context_entry *context, u16 did) + struct context_entry *context, u16 did, u16 sid) { struct intel_iommu *iommu = info->iommu; @@ -967,7 +970,7 @@ void intel_context_flush_no_pasid(struct device_domain_info *info, * when operating in scalable mode. Therefore the @did value doesn't * matter in scalable mode. */ - iommu->flush.flush_context(iommu, did, PCI_DEVID(info->bus, info->devfn), + iommu->flush.flush_context(iommu, did, sid, DMA_CCMD_MASK_NOBIT, DMA_CCMD_DEVICE_INVL); /* From 5322e19fc5acf013784207bc38191cd418a8bb48 Mon Sep 17 00:00:00 2001 From: Vasant Hegde Date: Tue, 11 Aug 2026 04:08:56 +0000 Subject: [PATCH 88/93] iommu/amd: Fix incorrect device ID in invalid PASID error message The IO page fault notifier handler logs pdev->dev.id when reporting an invalid PASID, but pdev->dev.id is the kernel-internal device ID and not the IOMMU device ID (BDF). Use dev_data->devid instead, which reflects actual devid. Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler") Signed-off-by: Vasant Hegde Reviewed-by: Ankit Soni Signed-off-by: Joerg Roedel --- drivers/iommu/amd/ppr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iommu/amd/ppr.c b/drivers/iommu/amd/ppr.c index 80369ca1e316..1dde19a79e80 100644 --- a/drivers/iommu/amd/ppr.c +++ b/drivers/iommu/amd/ppr.c @@ -140,7 +140,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw) if (event.fault.prm.pasid == 0 || event.fault.prm.pasid >= dev_data->max_pasids) { pr_info_ratelimited("Invalid PASID : 0x%x, device : 0x%x\n", - event.fault.prm.pasid, pdev->dev.id); + event.fault.prm.pasid, dev_data->devid); goto out; } From 589f0cc1e099720aaffe4abf2d4d1a19c62a975a Mon Sep 17 00:00:00 2001 From: Vasant Hegde Date: Tue, 11 Aug 2026 04:08:57 +0000 Subject: [PATCH 89/93] iommu/amd: Introduce PPR_TAG_LAST_PAGE() macro The PPR tag field (PPRtag) encodes two distinct fields: the 9-bit tag value (bits 8-0) and the last-page indicator L bit (bit 9). Fix PPR_TAG() to mask only the 9-bit tag field and introduce PPR_TAG_LAST_PAGE to explicitly extract the L bit. This way it becomes easy to read. Cc: Wei Huang Signed-off-by: Vasant Hegde Reviewed-by: Ankit Soni Signed-off-by: Joerg Roedel --- drivers/iommu/amd/amd_iommu_types.h | 3 ++- drivers/iommu/amd/ppr.c | 7 +++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h index 3c292fdfa95a..a7aa9411b2e9 100644 --- a/drivers/iommu/amd/amd_iommu_types.h +++ b/drivers/iommu/amd/amd_iommu_types.h @@ -280,7 +280,8 @@ #define PPR_REQ_TYPE(x) (((x) >> 60) & 0xfULL) #define PPR_FLAGS(x) (((x) >> 48) & 0xfffULL) #define PPR_DEVID(x) ((x) & 0xffffULL) -#define PPR_TAG(x) (((x) >> 32) & 0x3ffULL) +#define PPR_TAG(x) (((x) >> 32) & 0x1ffULL) +#define PPR_TAG_LAST_PAGE(x) (((x) >> 32) & 0x200ULL) #define PPR_PASID1(x) (((x) >> 16) & 0xffffULL) #define PPR_PASID2(x) (((x) >> 42) & 0xfULL) #define PPR_PASID(x) ((PPR_PASID2(x) << 16) | PPR_PASID1(x)) diff --git a/drivers/iommu/amd/ppr.c b/drivers/iommu/amd/ppr.c index 1dde19a79e80..76296079bb8b 100644 --- a/drivers/iommu/amd/ppr.c +++ b/drivers/iommu/amd/ppr.c @@ -130,7 +130,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw) event.fault.prm.perm = ppr_flag_to_fault_perm(PPR_FLAGS(raw[0])); event.fault.prm.addr = (u64)(raw[1] & PAGE_MASK); event.fault.prm.pasid = PPR_PASID(raw[0]); - event.fault.prm.grpid = PPR_TAG(raw[0]) & 0x1FF; + event.fault.prm.grpid = PPR_TAG(raw[0]); /* * PASID zero is used for requests from the I/O device without @@ -146,7 +146,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw) event.fault.prm.flags |= IOMMU_FAULT_PAGE_RESPONSE_NEEDS_PASID; event.fault.prm.flags |= IOMMU_FAULT_PAGE_REQUEST_PASID_VALID; - if (PPR_TAG(raw[0]) & 0x200) + if (PPR_TAG_LAST_PAGE(raw[0])) event.fault.prm.flags |= IOMMU_FAULT_PAGE_REQUEST_LAST_PAGE; /* Submit event */ @@ -157,8 +157,7 @@ static void iommu_call_iopf_notifier(struct amd_iommu *iommu, u64 *raw) out: /* Nobody cared, abort */ amd_iommu_complete_ppr(&pdev->dev, PPR_PASID(raw[0]), - IOMMU_PAGE_RESP_FAILURE, - PPR_TAG(raw[0]) & 0x1FF); + IOMMU_PAGE_RESP_FAILURE, PPR_TAG(raw[0])); pci_dev_put(pdev); } From bc1f5ec826bfa510e7138e2be5aad23907850874 Mon Sep 17 00:00:00 2001 From: Vasant Hegde Date: Tue, 11 Aug 2026 04:08:58 +0000 Subject: [PATCH 90/93] iommu/amd: Fix missing CMD_COMPLETE_PPR response for invalid PPR requests The AMD IOMMU spec, requires the host to respond with a CMD_COMPLETE_PPR command when an EVENT_TYPE_INV_PPR_REQ event is received with the RX bit cleared. This response was missing in the current implementation, leaving invalid PPR requests unacknowledged. Introduce amd_iommu_report_ppr_err() to handle EVENT_TYPE_INV_PPR_REQ events. The new function logs the invalid PPR request and when the RX bit is cleared, sends CMD_COMPLETE_PPR response. Reported-by: Gaultier Delbarre Co-developed-by: Wei Huang Signed-off-by: Wei Huang Signed-off-by: Vasant Hegde Reviewed-by: Ankit Soni Signed-off-by: Joerg Roedel --- drivers/iommu/amd/amd_iommu_types.h | 1 + drivers/iommu/amd/iommu.c | 38 ++++++++++++++++++++++++----- 2 files changed, 33 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h index a7aa9411b2e9..500952e752b4 100644 --- a/drivers/iommu/amd/amd_iommu_types.h +++ b/drivers/iommu/amd/amd_iommu_types.h @@ -159,6 +159,7 @@ #define EVENT_FLAGS_SHIFT 0x10 #define EVENT_FLAG_RW 0x020 #define EVENT_FLAG_I 0x008 +#define EVENT_FLAG_PPR_RX 0x001 /* feature control bits */ #define CONTROL_IOMMU_EN 0 diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 563f9c2672d5..4372d3908e67 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -905,10 +905,40 @@ static void amd_iommu_report_page_fault(struct amd_iommu *iommu, pci_dev_put(pdev); } +static void amd_iommu_report_ppr_err(struct amd_iommu *iommu, volatile u32 *event, + u16 devid, u64 address, int flags) +{ + struct pci_dev *pdev; + struct device *dev = iommu->iommu.dev; + u32 pasid = PPR_PASID(*((u64 *)event)); + int tag = event[1] & 0x03FF; + + dev_err(dev, "Event logged [INVALID_PPR_REQUEST device=%04x:%02x:%02x.%x pasid=0x%05x address=0x%llx flags=0x%04x tag=0x%03x]\n", + iommu->pci_seg->id, PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid), + pasid, address, flags, tag); + + /* Skip COMPLETE_PPR_REQUEST response if RX=1 */ + if (flags & EVENT_FLAG_PPR_RX) + return; + + pdev = pci_get_domain_bus_and_slot(iommu->pci_seg->id, PCI_BUS_NUM(devid), + devid & 0xff); + if (!pdev) + return; + + if (!dev_iommu_priv_get(&pdev->dev)) { + pci_dev_put(pdev); + return; + } + + amd_iommu_complete_ppr(&pdev->dev, pasid, IOMMU_PAGE_RESP_FAILURE, tag); + pci_dev_put(pdev); +} + static void iommu_print_event(struct amd_iommu *iommu, void *__evt) { struct device *dev = iommu->iommu.dev; - int type, devid, flags, tag; + int type, devid, flags; volatile u32 *event = __evt; int count = 0; u64 address, ctrl; @@ -982,11 +1012,7 @@ static void iommu_print_event(struct amd_iommu *iommu, void *__evt) amd_iommu_report_rmp_hw_error(iommu, event); break; case EVENT_TYPE_INV_PPR_REQ: - pasid = PPR_PASID(*((u64 *)__evt)); - tag = event[1] & 0x03FF; - dev_err(dev, "Event logged [INVALID_PPR_REQUEST device=%04x:%02x:%02x.%x pasid=0x%05x address=0x%llx flags=0x%04x tag=0x%03x]\n", - iommu->pci_seg->id, PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid), - pasid, address, flags, tag); + amd_iommu_report_ppr_err(iommu, event, devid, address, flags); break; default: dev_err(dev, "Event logged [UNKNOWN event[0]=0x%08x event[1]=0x%08x event[2]=0x%08x event[3]=0x%08x\n", From abdbd786c5c7f45afb4b65a3603af059104bf5b4 Mon Sep 17 00:00:00 2001 From: Vasant Hegde Date: Tue, 11 Aug 2026 04:08:59 +0000 Subject: [PATCH 91/93] iommu/amd: Rate limit INVALID_PPR_REQUEST error logging The amd_iommu_report_ppr_err() function logs an error message for every INVALID_PPR_REQUEST event. Under certain fault conditions, a misbehaving or malicious device can flood the IOMMU event log with PPR faults, causing the kernel log to be overwhelmed with repeated error messages. Switch from dev_err() to dev_err_ratelimited() to suppress duplicate messages when INVALID_PPR_REQUEST events occur at a high rate. Signed-off-by: Vasant Hegde Reviewed-by: Ankit Soni Signed-off-by: Joerg Roedel --- drivers/iommu/amd/iommu.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 4372d3908e67..17df9b28ebaf 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -913,9 +913,10 @@ static void amd_iommu_report_ppr_err(struct amd_iommu *iommu, volatile u32 *even u32 pasid = PPR_PASID(*((u64 *)event)); int tag = event[1] & 0x03FF; - dev_err(dev, "Event logged [INVALID_PPR_REQUEST device=%04x:%02x:%02x.%x pasid=0x%05x address=0x%llx flags=0x%04x tag=0x%03x]\n", - iommu->pci_seg->id, PCI_BUS_NUM(devid), PCI_SLOT(devid), PCI_FUNC(devid), - pasid, address, flags, tag); + dev_err_ratelimited(dev, "Event logged [INVALID_PPR_REQUEST device=%04x:%02x:%02x.%x " + "pasid=0x%05x address=0x%llx flags=0x%04x tag=0x%03x]\n", + iommu->pci_seg->id, PCI_BUS_NUM(devid), PCI_SLOT(devid), + PCI_FUNC(devid), pasid, address, flags, tag); /* Skip COMPLETE_PPR_REQUEST response if RX=1 */ if (flags & EVENT_FLAG_PPR_RX) From c94252cd5bbcdab3b1a9a25c638302678fa7721f Mon Sep 17 00:00:00 2001 From: Vasant Hegde Date: Tue, 11 Aug 2026 04:09:00 +0000 Subject: [PATCH 92/93] iommu/amd: Fix GN bit setting in COMPLETE_PPR_REQUEST command The GN bit in the COMPLETE_PPR_REQUEST command indicates whether the device is operating under a guest (v2) page table. Currently, dev_data->pri_tlp is incorrectly used to derive this bit. However, pri_tlp indicates whether the device uses PRI TLP which is unrelated to page table mode. Fix this by refactoring amd_iommu_complete_ppr() into a static internal helper __amd_iommu_complete_ppr() that accepts an explicit 'gn' argument. The amd_iommu_complete_ppr() wrapper then derives the GN bit correctly from the device's active protection domain via pdom_is_v2_pgtbl_mode(). In the INVALID_PPR_REQUEST error handling path, the device's protection domain may not be accessible, so derive the GN bit directly from the EVENT_FLAG_PPR_GN flag in the event log entry instead. While at it, change the 'gn' parameter type in build_complete_ppr() from u8 to bool to better reflect its semantics. Signed-off-by: Vasant Hegde Reviewed-by: Ankit Soni Signed-off-by: Joerg Roedel --- drivers/iommu/amd/amd_iommu_types.h | 1 + drivers/iommu/amd/iommu.c | 26 +++++++++++++++++++++----- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h index 500952e752b4..36c0df418ce5 100644 --- a/drivers/iommu/amd/amd_iommu_types.h +++ b/drivers/iommu/amd/amd_iommu_types.h @@ -160,6 +160,7 @@ #define EVENT_FLAG_RW 0x020 #define EVENT_FLAG_I 0x008 #define EVENT_FLAG_PPR_RX 0x001 +#define EVENT_FLAG_PPR_GN 0x200 /* feature control bits */ #define CONTROL_IOMMU_EN 0 diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 17df9b28ebaf..856948a5192c 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -92,6 +92,9 @@ static void clone_aliases(struct amd_iommu *iommu, struct device *dev); static int iommu_completion_wait(struct amd_iommu *iommu); +static int __amd_iommu_complete_ppr(struct device *dev, u32 pasid, + int status, int tag, bool gn); + /**************************************************************************** * * Helper functions @@ -912,6 +915,7 @@ static void amd_iommu_report_ppr_err(struct amd_iommu *iommu, volatile u32 *even struct device *dev = iommu->iommu.dev; u32 pasid = PPR_PASID(*((u64 *)event)); int tag = event[1] & 0x03FF; + bool gn; dev_err_ratelimited(dev, "Event logged [INVALID_PPR_REQUEST device=%04x:%02x:%02x.%x " "pasid=0x%05x address=0x%llx flags=0x%04x tag=0x%03x]\n", @@ -932,7 +936,9 @@ static void amd_iommu_report_ppr_err(struct amd_iommu *iommu, volatile u32 *even return; } - amd_iommu_complete_ppr(&pdev->dev, pasid, IOMMU_PAGE_RESP_FAILURE, tag); + gn = (flags & EVENT_FLAG_PPR_GN); + + __amd_iommu_complete_ppr(&pdev->dev, pasid, IOMMU_PAGE_RESP_FAILURE, tag, gn); pci_dev_put(pdev); } @@ -1372,7 +1378,7 @@ static void build_inv_iotlb_pages(struct iommu_cmd *cmd, u16 devid, int qdep, } static void build_complete_ppr(struct iommu_cmd *cmd, u16 devid, u32 pasid, - int status, int tag, u8 gn) + int status, int tag, bool gn) { memset(cmd, 0, sizeof(*cmd)); @@ -1867,7 +1873,8 @@ static void dev_flush_pasid_all(struct iommu_dev_data *dev_data, amd_iommu_dev_flush_pasid_pages(dev_data, pasid, 0, U64_MAX); } -int amd_iommu_complete_ppr(struct device *dev, u32 pasid, int status, int tag) +static int __amd_iommu_complete_ppr(struct device *dev, u32 pasid, + int status, int tag, bool gn) { struct iommu_dev_data *dev_data; struct amd_iommu *iommu; @@ -1876,12 +1883,21 @@ int amd_iommu_complete_ppr(struct device *dev, u32 pasid, int status, int tag) dev_data = dev_iommu_priv_get(dev); iommu = get_amd_iommu_from_dev(dev); - build_complete_ppr(&cmd, dev_data->devid, pasid, status, - tag, dev_data->pri_tlp); + build_complete_ppr(&cmd, dev_data->devid, pasid, status, tag, gn); return iommu_queue_command(iommu, &cmd); } +int amd_iommu_complete_ppr(struct device *dev, u32 pasid, int status, int tag) +{ + struct iommu_dev_data *dev_data = dev_iommu_priv_get(dev); + bool gn; + + gn = pdom_is_v2_pgtbl_mode(dev_data->domain); + + return __amd_iommu_complete_ppr(dev, pasid, status, tag, gn); +} + /**************************************************************************** * * The next functions belong to the domain allocation. A domain is From cb2860ad6c4ff7e15bb69c7e3a6842bbea743229 Mon Sep 17 00:00:00 2001 From: Vasant Hegde Date: Tue, 11 Aug 2026 05:22:57 +0000 Subject: [PATCH 93/93] iommu/amd: Add SNP page mode 0 support Newer AMD IOMMUs supports DTE[Mode]=0 for SNP-enabled system. This is detected using new feature bit (EFR2[SNP_Page_Mode_0_Sup]). If this feature is enabled, then IOMMU supports: - Passthrough mode (i.e. iommu=pt) - amd_iommu=pgtbl_v2: Forcing Linux DMA-API to use IOMMU v2 page table - Setting up device for SVA mode in the host. Signed-off-by: Vasant Hegde Reviewed-by: Suravee Suthikulpanit Tested-by: Amandeep Kaur Longia Signed-off-by: Joerg Roedel --- drivers/iommu/amd/amd_iommu_types.h | 4 +++ drivers/iommu/amd/init.c | 42 ++++++++++++++++++++--------- drivers/iommu/amd/iommu.c | 4 +-- 3 files changed, 35 insertions(+), 15 deletions(-) diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h index 36c0df418ce5..3dbe20023456 100644 --- a/drivers/iommu/amd/amd_iommu_types.h +++ b/drivers/iommu/amd/amd_iommu_types.h @@ -113,6 +113,7 @@ #define FEATURE_SNPAVICSUP_GAM(x) \ (FIELD_GET(FEATURE_SNPAVICSUP, x) == 0x1) #define FEATURE_HT_RANGE_IGNORE BIT_ULL(11) +#define FEATURE_SNP_PAGE_MODE0_SUP BIT_ULL(13) #define FEATURE_NUM_INT_REMAP_SUP GENMASK_ULL(9, 8) #define FEATURE_NUM_INT_REMAP_SUP_2K(x) \ @@ -419,6 +420,9 @@ extern bool amd_iommu_dump; pr_info(format, ## arg); \ } while(0); +/* SNP page mode 0 support */ +extern bool amd_iommu_snp_mode0_sup; + /* global flag if IOMMUs cache non-present entries */ extern bool amd_iommu_np_cache; /* Only true if all IOMMUs support device IOTLBs */ diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c index c0748521dff8..a1f85d44f2a4 100644 --- a/drivers/iommu/amd/init.c +++ b/drivers/iommu/amd/init.c @@ -180,6 +180,9 @@ bool amd_iommu_hatdis; bool amd_iommu_snp_en; EXPORT_SYMBOL(amd_iommu_snp_en); +/* SNP page mode 0 support */ +bool amd_iommu_snp_mode0_sup; + LIST_HEAD(amd_iommu_pci_seg_list); /* list of all PCI segments */ LIST_HEAD(amd_iommu_list); /* list of all AMD IOMMUs in the system */ LIST_HEAD(amd_ivhd_dev_flags_list); /* list of all IVHD device entry settings */ @@ -3394,18 +3397,28 @@ static __init void iommu_snp_enable(void) #ifdef CONFIG_KVM_AMD_SEV if (!cc_platform_has(CC_ATTR_HOST_SEV_SNP)) return; - /* - * The SNP support requires that IOMMU must be enabled, and is - * configured with V1 page table (DTE[Mode] = 0 is not supported). - */ - if (no_iommu || iommu_default_passthrough()) { - pr_warn("SNP: IOMMU disabled or configured in passthrough mode, SNP cannot be supported.\n"); + + /* SNP support required IOMMU to be ON */ + if (no_iommu) { + pr_warn("SNP: IOMMU disabled, SNP cannot be supported.\n"); goto disable_snp; } - if (amd_iommu_pgtable != PD_MODE_V1) { - pr_warn("SNP: IOMMU is configured with V2 page table mode, SNP cannot be supported.\n"); - goto disable_snp; + amd_iommu_snp_mode0_sup = check_feature2(FEATURE_SNP_PAGE_MODE0_SUP); + /* + * If SNP page mode 0 is not enabled, then SNP support requires that IOMMU + * must be configured with V1 page table (DTE[Mode] != 0). + */ + if (!amd_iommu_snp_mode0_sup) { + if (iommu_default_passthrough()) { + pr_warn("SNP: IOMMU configured in passthrough mode, SNP cannot be supported.\n"); + goto disable_snp; + } + + if (amd_iommu_pgtable != PD_MODE_V1) { + pr_warn("SNP: IOMMU is configured with V2 page table mode, SNP cannot be supported.\n"); + goto disable_snp; + } } amd_iommu_snp_en = check_feature(FEATURE_SNP); @@ -3940,12 +3953,15 @@ bool amd_iommu_pasid_supported(void) amd_iommu_gpt_level != PAGE_MODE_5_LEVEL) return false; + if (!amd_iommu_gt_ppr_supported()) + return false; + /* - * Since DTE[Mode]=0 is prohibited on SNP-enabled system - * (i.e. EFR[SNPSup]=1), IOMMUv2 page table cannot be used without - * setting up IOMMUv1 page table. + * If SNP page mode 0 is not supported, then DTE[Mode]=0 is prohibited + * on SNP-enabled system (i.e. EFR[SNPSup]=1). IOMMUv2 page table + * cannot be used without setting up IOMMUv1 page table. */ - return amd_iommu_gt_ppr_supported() && !amd_iommu_snp_en; + return (!amd_iommu_snp_en) || (amd_iommu_snp_en && amd_iommu_snp_mode0_sup); } struct amd_iommu *get_amd_iommu(unsigned int idx) diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 856948a5192c..4c31294fabc5 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -2953,9 +2953,9 @@ static int amd_iommu_identity_attach(struct iommu_domain *dom, struct device *de { /* * Don't allow attaching a device to the identity domain if SNP is - * enabled. + * enabled and SNP Mode0 support is not present. */ - if (amd_iommu_snp_en) + if (amd_iommu_snp_en && !amd_iommu_snp_mode0_sup) return -EINVAL; return amd_iommu_attach_device(dom, dev, old);