kernel/linux.git/drivers/iommu/amd, branch v7.2-rc2

Merge branches 'apple/dart', 'arm/smmu/updates', 'arm/smmu/bindings', 'rockchip', 'verisilicon', 'riscv', 'intel/vt-d', 'amd/amd-vi' and 'core' into next

2026-06-12T12:57:23+00:00

iommu/amd: Control INVALIDATE_IOMMU_PAGES PDE from the gather

2026-06-12T07:47:47+00:00

Now that AMD uses iommupt, it is easy to make use of the PDE bit. If the gather has no free list then no page directory entries were changed. Pass GN/PDE through the invalidation call chain in a u32 flags field that is OR'd into data[2] and set it properly from the gather. Signed-off-by: Jason Gunthorpe Reviewed-by: Wei Wang Tested-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel

iommu/amd: Make CMD_INV_IOMMU_ALL_PAGES_ADDRESS match the spec

2026-06-12T07:47:46+00:00

The spec in Table 14 defines the "Entire Cache" case as having the low 12 bits as zero. Indeed the command format doesn't even have the low 12 bits. Since there is only one user now, fix the constant to have 0 in the low 12 bits instead of 1 and remove the masking. Signed-off-by: Jason Gunthorpe Reviewed-by: Wei Wang Tested-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel

iommu/amd: Have amd_iommu_domain_flush_pages() use last

2026-06-12T07:47:18+00:00

Finish clearing out the size/last/end switching by converting amd_iommu_domain_flush_pages() to use last-based logic. This algorithm is simpler than the previous. Ultimately all this wants to do is select powers of two that are aligned to address and not longer than the distance to last. The new version is fully safe for size = U64_MAX and last = U64_MAX. Finally, the gather can be passed through natively without risking an overflow in (gather->end - gather->start + 1). Signed-off-by: Jason Gunthorpe Reviewed-by: Wei Wang Tested-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel

iommu/amd: Pass last in through to build_inv_address()

2026-06-12T07:18:59+00:00

This is the trivial call chain below amd_iommu_domain_flush_pages(). Cases that are doing a full invalidate will pass a last of U64_MAX. This avoids converting between size and last, and type confusion with size_t, unsigned long and u64 all being used in different places along the driver's invalidation path. Consistently use u64 in the internals. Signed-off-by: Jason Gunthorpe Tested-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel

iommu/amd: Simplify build_inv_address()

2026-06-12T07:17:05+00:00

This function is doing more work than it needs to: - iommu_num_pages() is pointless, the fls() is going to compute the required page size already. - It is easier to understand as sz_lg2, which is 12 if size is 4K, than msb_diff which is 11 if size is 4K. - Simplify the control flow to early exit on the out of range cases. - Use the usual last instead of end to signify an inclusive last address. - Use GENMASK to compute the 1's mask. - Use GENMASK to compute the address mask for the command layout, not PAGE_MASK. - Directly reference the spec language that defines the 52 bit limit. No functional change intended. Signed-off-by: Jason Gunthorpe Reviewed-by: Wei Wang Tested-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel

iommu/amd: Don't split flush for amd_iommu_domain_flush_all()

2026-06-02T08:45:46+00:00

We have observed multiple full invalidations occurring during device detach when we are done using the vfio-device. blocked_domain_attach_device() -> detach_device() -> amd_iommu_domain_flush_all() -> amd_iommu_domain_flush_pages(..., CMD_INV_IOMMU_ALL_PAGES_ADDRESS) while (size != 0) { -> __domain_flush_pages( flush_size /* power of 2 flush_size */) -> domain_flush_pages_v1() -> build_inv_iommu_pages() -> build_inv_address() } build_inv_address() will trigger a full invalidation if the chunk size > (1 << 51). Consequently, the guest will issue multiple full invalidations for a single call to amd_iommu_domain_flush_all() Without this patch, we will see 10 time instead of 1 time full invalidations for every amd_iommu_domain_flush_all(). Cc: stable@vger.kernel.org Fixes: a270be1b3fdf ("iommu/amd: Use only natural aligned flushes in a VM") Suggested-by: Josef Bacik Suggested-by: Jason Gunthorpe Signed-off-by: Weinan Liu Reviewed-by: Wei Wang Reviewed-by: Jason Gunthorpe Reviewed-by: Samiullah Khawaja Reviewed-by: Suravee Suthikulpanit Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel

iommu/amd: Fix premature break in init_iommu_one()

2026-05-28T07:28:58+00:00

In init_iommu_one(), when processing IOMMU EFR attributes, the code checks whether GASUP is enabled. If GASUP is not enabled, the code falls back to legacy guest IR mode and then breaks out of the switch statement. This break incorrectly skips the subsequent initialization steps that follow the GASUP check. These initializations are independent of GASUP support and must always be performed. Fix this by replacing the early break with a conditional else block, ensuring that the XTSUP check is only skipped when GASUP is not available. Fixes: a44092e326d4 ("iommu/amd: Use IVHD EFR for early initialization of IOMMU features") Reported-by: Sudheer Dantuluri Tested-by: Dheeraj Kumar Srivastava Signed-off-by: Vasant Hegde Signed-off-by: Joerg Roedel

iommu/amd: Adhere to IVINFO[VASIZE] for address limits

2026-05-19T08:49:03+00:00

ACPI IVRS IVHD’s IVINFO field reports the maximum virtual address size (VASIZE) supported by the IOMMU. The AMD IOMMU driver currently caps this with pagetable level reported by EFR[HATS] when configuring paging domains (hw_max_vasz_lg2). On systems where firmware or VM advertises smaller or different limits, the driver may over-advertise capabilities and create domains outside the hardware’s actual bounds. Reviewed-by: Jason Gunthorpe Reviewed-by: Vasant Hegde Signed-off-by: Ankit Soni Signed-off-by: Joerg Roedel

iommu/amd: Bounds-check devid in __rlookup_amd_iommu()

2026-05-11T08:07:52+00:00

iommu_device_register() walks every device on the PCI bus via bus_for_each_dev() and calls amd_iommu_probe_device() for each. The inlined check_device() path computes the device's sbdf, calls rlookup_amd_iommu() to find the owning IOMMU, and only afterwards verifies devid <= pci_seg->last_bdf. __rlookup_amd_iommu() indexes rlookup_table[devid] with no bounds check of its own, so for a PCI device whose BDF is not described by the IVRS, the lookup reads past the end of the allocation before the caller's bounds check can run. This was harmless before commit e874c666b15b ("iommu/amd: Change rlookup, irq_lookup, and alias to use kvalloc()"): the table was a zeroed page-order allocation, so the over-read returned NULL and the caller's NULL check skipped the device. After that commit the table is a tight kvcalloc() and the over-read returns adjacent slab contents, which check_device() then dereferences as a struct amd_iommu *, causing a boot-time GPF. Seen on Google Compute Engine ct6e VMs, where the virtualized IVRS describes only the four TPU endpoints 00:04.0-07.0; the gVNIC at 00:08.0 (devid 0x40) indexes 56 bytes past the 456-byte allocation, into the adjacent kmalloc-512 slab object: pci 0000:00:04.0: Adding to iommu group 0 pci 0000:00:05.0: Adding to iommu group 1 pci 0000:00:06.0: Adding to iommu group 2 pci 0000:00:07.0: Adding to iommu group 3 Oops: general protection fault, probably for non-canonical address 0x3a64695f78746382: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.22 #1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/06/2025 RIP: 0010:amd_iommu_probe_device+0x54/0x3a0 Call Trace: __iommu_probe_device+0x107/0x520 probe_iommu_group+0x29/0x50 bus_for_each_dev+0x7e/0xe0 iommu_device_register+0xc9/0x240 iommu_go_to_state+0x9c0/0x1c60 amd_iommu_init+0x14/0x40 pci_iommu_init+0x16/0x60 do_one_initcall+0x47/0x2f0 Guard the array access in __rlookup_amd_iommu(). With the fix applied on 6.18.22, the gVNIC at 00:08.0 is skipped cleanly and the VM boots. Fixes: e874c666b15b ("iommu/amd: Change rlookup, irq_lookup, and alias to use kvalloc()") Cc: stable@vger.kernel.org Reported-by: Ziyuan Chen Tested-by: Ziyuan Chen Reviewed-by: Josef Bacik Assisted-by: Claude:unspecified Signed-off-by: Jose Fernandez (Anthropic) Signed-off-by: Joerg Roedel