kernel/linux.git/drivers/iommu, branch v7.2-rc1

Merge tag 'hyperv-next-signed-20260621' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

2026-06-22T15:06:13+00:00

Pull hyperv updates from Wei Liu: - Use wakeup mailbox to boot APs in Hyper-V VTL2 TDX guests (Yunhong Jiang, Ricardo Neri) - Move the Hyper-V IOMMU to its own subdirectory (Mukesh Rathor) - Cosmetic changes to mshv and balloon driver (Junrui Luo, Markus Elfring) * tag 'hyperv-next-signed-20260621' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: mshv: add bounds check on vp_index in mshv_intercept_isr() hv_balloon: Simplify data output in hv_balloon_debug_show() x86/hyperv: Cosmetic changes in irqdomain.c for readability iommu/hyperv: Create hyperv subdirectory under drivers/iommu x86/hyperv/vtl: Use the wakeup mailbox to boot secondary CPUs x86/hyperv/vtl: Mark the wakeup mailbox page as private x86/acpi: Add a helper to get the address of the wakeup mailbox x86/hyperv/vtl: Setup the 64-bit trampoline for TDX guests x86/realmode: Make the location of the trampoline configurable x86/hyperv/vtl: Set real_mode_header in hv_vtl_init_platform() x86/dt: Parse the Wakeup Mailbox for Intel processors dt-bindings: reserved-memory: Wakeup Mailbox for Intel processors x86/acpi: Add functions to setup and access the wakeup mailbox x86/topology: Add missing struct declaration and attribute dependency

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

2026-06-17T19:33:23+00:00

Pull iommufd updates from Jason Gunthorpe: "All various fixes: - Typo breaking the veventq uAPI for 32 bit userspace - Several Sashiko found errors in the veventq and fault fd paths - Fix incorrect use of dmabuf locks, and possible races with iommufd destroy and dmabuf revoke - Sashiko errors found in the uAPI validation for IOMMU_HWPT_INVALIDATE" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommu: Avoid copying the user array twice in the full-array copy helper iommufd/selftest: Add invalidation entry_num and entry_len boundary tests iommufd: Set upper bounds on cache invalidation entry_num and entry_len iommufd: Clarify IOAS_MAP_FILE dma-buf support iommufd: Destroy the pages content after detaching from dmabuf iommufd: Take dma_resv lock before dma_buf_unpin() in release path iommufd/selftest: Cover invalid read counts on vEVENTQ FD iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() iommufd: Break the loop on failure in iommufd_fault_fops_read() iommufd: Reject invalid read count in iommufd_fault_fops_read() iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() iommufd: Reject invalid read count in iommufd_veventq_fops_read() iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails iommufd/selftest: Add boundary tests for veventq_depth iommufd: Set veventq_depth upper bound iommufd: Move vevent memory allocation outside spinlock iommufd: Fix data_len byte-count vs element-count mismatch iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read

Merge tag 'iommu-updates-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux

2026-06-17T19:24:50+00:00

Pull iommu updates from Joerg Roedel: "Core Code: - Fix dma-iommu scatterlist length handling in the P2PDMA path - Extend the generic IOMMU page-table code with detailed gather support for more precise invalidations - Add pending-gather tracking to generic page-table invalidation handling - Add support for smaller virtual address sizes in the generic AMDv1 page-table format, including KUnit coverage - Fix page-size bitmap calculation for smaller VA configurations - Rework Arm io-pgtable allocation/freeing to consistently use the iommu-pages API and address-conversion helpers - Add PCI ATS infrastructure for devices that require ATS, including always-on ATS handling for pre-CXL devices AMD IOMMU: - Fix several IOTLB invalidation details, including PDE handling, flush-all behavior, and command address encoding - Honor IVINFO[VASIZE] when deriving address limits - Fix premature loop termination in init_iommu_one() - Add Hygon family 18h model 4h IOAPIC support - Clean up legacy-mode handling, stale comments, dead IVMD exclusion-range code, and unused address-size macros Arm SMMU / Arm SMMU v3: - SMMUv2: - Device-tree binding updates for Qualcomm Hawi, Nord and Shikra SoCs - Constrain the clocks which can be specified for recent Qualcomm SoCs - Fix broken compatible string for Qualcomm prefetcher configuration an add new entry for the Glymur MDSS - Ensure SMMU is powered-up when writing context bank for Adreno client - SMMUv3: - Fix off-by-one in queue allocation retry loop - Enable hardware update of access/dirty bits from the SMMU - Re-jig command construction to use separate inline helpers for each command type Intel VT-d: - Add the PCI segment number to DMA fault messages - Improve support for non-PRI mode SVA - Ensure atomicity during context entry teardown - Fix RB-tree corruption in the probe error path RISC-V IOMMU: - Add NAPOT range invalidation support - Use detailed gather information for invalidation decisions - Compute the best stride for single invalidations - Advertise Svpbmt support to the generic page-table code - Add capability definitions and clean up command macro encoding VeriSilicon IOMMU: - Add a new VeriSilicon IOMMU driver - Add devicetree binding documentation and MAINTAINERS coverage - Add the RK3588 VeriSilicon IOMMU node - Apply small cleanups and warning fixes in the new driver Rockchip IOMMU: - Disable the fetch DTE time limit Apple DART: - Correct a stale CONFIG_PCIE_APPLE macro name in a comment" * tag 'iommu-updates-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (66 commits) iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path iommu/amd: Control INVALIDATE_IOMMU_PAGES PDE from the gather iommu/amd: Make CMD_INV_IOMMU_ALL_PAGES_ADDRESS match the spec iommu/amd: Have amd_iommu_domain_flush_pages() use last iommu/amd: Pass last in through to build_inv_address() iommu/amd: Simplify build_inv_address() iommu/apple-dart: correct CONFIG_PCIE_APPLE macro name in comment iommu/vt-d: Fix RB-tree corruption in probe error path iommu/vt-d: Improve IOMMU fault information iommu/vt-d: Remove typo from pasid_pte_config_nested() iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry iommu/vt-d: Avoid WARNING in sva unbind path dt-bindings: arm-smmu: Correct and add constraints for Hawi, Shikra and Kaanapali dt-bindings: arm-smmu: Add compatible for Qualcomm Nord SoC iommu/amd: Don't split flush for amd_iommu_domain_flush_all() iommu/rockchip: disable fetch dte time limit iommu/arm-smmu-v3: Allow ATS to be always on PCI: Allow ATS to be always on for pre-CXL devices PCI: Add pci_ats_required() for CXL.cache capable devices iommu/vsi: Use list_for_each_entry() ...

Merge tag 'devicetree-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

2026-06-17T18:54:57+00:00

Pull devicetree updates from Rob Herring: "DT core: - Add support for handling multiple cells in "iommu-map" entries - Support only 1 entry in /reserved-memory "reg" entries. Support for more than 1 entry has been broken - Fix a UAF on alloc_reserved_mem_array() failure - Make "ibm,phandle" handling logic specific to PPC - Use memcpy() instead of strcpy() for known length strings - Ensure __of_find_n_match_cpu_property() handles malformed "reg" entries - Add various checks that expected strings are strings before accessing them - Drop redundant memset() when unflattening DT DT bindings: - Add a DTS style checker. Currently hooked up to dt_binding_check to check examples - Convert st,nomadik platform, ti,omap-dmm, and ti,irq-crossbar bindings to DT schema - Add Apple System Management Controller hwmon, Qualcomm Hamoa Embedded Controller, Qualcomm IPQ6018 PWM controller, fsl,mc1323, Samsung SOFEF01-M DDIC panel, Freescale i.MX53 Television Encoder, Samsung S2M series PMIC extcon, and MT6365 PMIC AuxADC schemas - Extend bindings for QCom Maili and Nord PDC, QCom Hali fastrpc, qcom,eliza-imem, qcom,oryon-1-5 CPU, and MT6365 Keys - Consolidate "sram" property definitions - Fix constraints on "nvmem" properties which only contain phandles and no arg cells - Another pass of fixing "phandle-array" constraints - Add Gira vendor prefix" * tag 'devicetree-for-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (50 commits) dt-bindings: interrupt-controller: qcom,pdc: Add Maili compatible string dt-bindings: interrupt-controller: ti,irq-crossbar: Convert to DT schema dt-bindings: vendor-prefixes: add Gira dt-bindings: embedded-controller: Add Qualcomm reference device EC description dt-bindings: pwm: add IPQ6018 binding dt-bindings: hwmon: Add Apple System Management Controller hwmon schema docs: dt: writing-schema: Clarify what is required in a schema of: Respect #{iommu,msi}-cells in maps of: Factor arguments passed to of_map_id() into a struct of: Add convenience wrappers for of_map_id() of: reserved_mem: zero total_reserved_mem_cnt if no valid /reserved-memory entry of: reserved_mem: handle NULL name in of_reserved_mem_lookup() dt-bindings: cache: l2c2x0: Add missing power-domains dt-bindings: interrupt-controller: renesas,r9a09g077-icu: Fix reg size in example dt-bindings: nvmem: consumer: Make 'nvmem' an array of one-item entries drivers/of/overlay: Use memcpy() to copy known length strings dt-bindings: add self-test fixtures for style checker dt-bindings: wire style checker into dt_binding_check scripts/jobserver-exec: propagate child exit status dt-bindings: add DTS style checker ...

Merge tag 'driver-core-7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/driver-core/driver-core

2026-06-15T07:11:17+00:00

Pull driver core updates from Danilo Krummrich: "Deferred probe: - Fix race where deferred probe timeout work could be permanently canceled by using mod_delayed_work() - Fix missing jiffies conversion in deferred_probe_extend_timeout() - Guard timeout extension with delayed_work_pending() to prevent premature firing - Use system_percpu_wq instead of the deprecated system_wq - Update deferred_probe_timeout documentation device: - Replace direct struct device bitfield access (can_match, dma_iommu, dma_skip_sync, dma_ops_bypass, state_synced, dma_coherent, of_node_reused, offline, offline_disabled) with flag-based accessors using bit operations - Reject devices with unregistered buses - Delete unused DEVICE_ATTR_PREALLOC() - Add low-level device attribute macros with const show/store callbacks, allowing device attributes to reside in read-only memory - Move core device attributes to read-only memory - Constify group array pointers in driver_add_groups() / driver_remove_groups(), struct bus_type, and struct device_driver device property: - Fix fwnode reference leak in fwnode_graph_get_endpoint_by_id() - Initialize all fields of fwnode_handle in fwnode_init() - Provide swnode_get()/swnode_put() wrappers around kobject_get/put() - Allow passing struct software_node_ref_args pointers directly to PROPERTY_ENTRY_REF() driver_override: - Migrate amba, cdx, vmbus, and rpmsg to the generic driver_override infrastructure, fixing a UAF from unsynchronized access to driver_override in bus match() callbacks - Remove the now-unused driver_set_override() firmware loader: - Fix recursive lock deadlock in device_cache_fw_images() when async work falls back to synchronous execution - Fix device reference leak in firmware_upload_register() platform: - Pass KBUILD_MODNAME through the platform driver registration macro to create module symlinks in sysfs for built-in drivers; move module_kset initialization to a pure_initcall and tegra cbb registration to core_initcall to ensure correct ordering - Pass THIS_MODULE implicitly through a coresight_init_driver() macro sysfs: - Upgrade OOB write detection in sysfs_kf_seq_show() from printk to WARN - Add return value clamping to sysfs_kf_read() Rust: - ACPI: Fix missing match data for PRP0001 by exporting acpi_of_match_device() - Auxiliary: Replace drvdata() with dedicated registration data on auxiliary_device. drvdata() exposed the driver's bus device private data beyond the driver's own scope, creating ordering constraints and forcing the data to outlive all registrations that access it. Registration data is instead scoped structurally to the Registration object, making lifecycle ordering enforced by construction rather than convention. - Rust-native device driver lifetimes (HRT): Allow Rust device drivers to carry a lifetime parameter on their bus device private data, tied to the device binding scope -- the interval during which a bus device is bound to a driver. Device resources like pci::Bar<'a> and IoMem<'a> can be stored directly in the driver's bus device private data with a lifetime bounded by the binding scope, so the compiler enforces at build time that they do not outlive the binding. This removes Devres indirection from every access site and eliminates try_access() failure paths in destructors. Bus driver traits use a Generic Associated Type (GAT) Data<'bound> to introduce the lifetime on the private data, rather than parameterizing the Driver trait itself. Auxiliary registration data, where the lifetime is not introduced by a trait callback but must be threaded through Registration, uses the ForLt trait (a type-level abstraction for types generic over a lifetime). Misc: - Fix DT overlayed devices not probing by reverting the broken treewide overlay fix and re-running fw_devlink consumer pickup when an overlay is applied to a bound device - Use root_device_register() for faux bus root device; add sanity check for failed bus init - Fix dev_has_sync_state() data race with READ_ONCE() and move it to base.h - Avoid spurious device_links warning when removing a device while its supplier is unbinding - Switch ISA bus to dynamic root device - Fix suspicious RCU usage in kernfs_put() - Remove devcoredump exit callback - Constify devfreq_event_class" * tag 'driver-core-7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/driver-core/driver-core: (81 commits) software node: allow passing reference args to PROPERTY_ENTRY_REF() driver core: platform: set mod_name in driver registration coresight: pass THIS_MODULE implicitly through a macro kernel: param: initialize module_kset in a pure_initcall soc/tegra: cbb: Move driver registration from pure_initcall to core_initcall firmware_loader: Fix recursive lock in device_cache_fw_images() driver core: Use system_percpu_wq instead of system_wq driver core: remove driver_set_override() rpmsg: use generic driver_override infrastructure Drivers: hv: vmbus: use generic driver_override infrastructure cdx: use generic driver_override infrastructure amba: use generic driver_override infrastructure rust: devres: add 'static bound to Devres samples: rust: rust_driver_auxiliary: showcase lifetime-bound registration data rust: auxiliary: generalize Registration over ForLt rust: types: add `ForLt` trait for higher-ranked lifetime support gpu: nova-core: separate driver type from driver data samples: rust: rust_driver_pci: use HRT lifetime for Bar rust: io: make IoMem and ExclusiveIoMem lifetime-parameterized rust: pci: make Bar lifetime-parameterized ...

of: Factor arguments passed to of_map_id() into a struct

2026-06-12T15:25:39+00:00

Change of_map_id() to take a pointer to struct of_phandle_args instead of passing target device node and translated IDs separately. Update all callers accordingly. Add an explicit filter_np parameter to of_map_id() and of_map_msi_id() to separate the filter input from the output. Previously, the target parameter served dual purpose: as an input filter (if non-NULL, only match entries targeting that node) and as an output (receiving the matched node with a reference held). Now filter_np is the explicit input filter and arg->np is the pure output. Previously, of_map_id() would call of_node_put() on the matched node when a filter was provided, making reference ownership inconsistent. Remove this internal of_node_put() call so that of_map_id() now always transfers ownership of the matched node reference to the caller via arg->np. Callers are now consistently responsible for releasing this reference with of_node_put(arg->np) when done. Acked-by: Frank Li Suggested-by: Rob Herring (Arm) Suggested-by: Dmitry Baryshkov Signed-off-by: Charan Teja Kalla Signed-off-by: Vijayanand Jitta Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-2-dc509dacb19a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm)

of: Add convenience wrappers for of_map_id()

2026-06-12T15:25:39+00:00

Since we now have quite a few users parsing "iommu-map" and "msi-map" properties, give them some wrappers to conveniently encapsulate the appropriate sets of property names. This will also make it easier to then change of_map_id() to correctly account for specifier cells. Reviewed-by: Rob Herring (Arm) Reviewed-by: Frank Li Acked-by: Marc Zyngier Acked-by: Bjorn Helgaas Signed-off-by: Robin Murphy Signed-off-by: Vijayanand Jitta Link: https://patch.msgid.link/20260603-parse_iommu_cells-v16-1-dc509dacb19a@oss.qualcomm.com Signed-off-by: Rob Herring (Arm)

iommufd: Set upper bounds on cache invalidation entry_num and entry_len

2026-06-12T13:44:43+00:00

iommufd_hwpt_invalidate() takes a user-controlled entry_num and entry_len, each bounded only by U32_MAX. An entry_len beyond the kernel's struct size makes the copy helper verify the extra bytes are zero, scanning that excess in one uninterruptible pass; a multi-gigabyte value over zeroed user memory trips the soft-lockup watchdog. A large entry_num is the other half, driving the backend invalidation loop with no reschedule. The VT-d nested handler, for one, copies each entry and flushes caches per iteration, pinning the CPU on a non-preemptible kernel. Cap both in the ioctl. entry_len is held under PAGE_SIZE, above any request struct, and entry_num under 1 << 19, the order of a hardware invalidation queue and well beyond any real batch, bounding the per-call loop length. Fixes: 8c6eabae3807 ("iommufd: Add IOMMU_HWPT_INVALIDATE") Link: https://patch.msgid.link/r/447fa93663f7526eb361719e83fa8b649464483d.1780521606.git.nicolinc@nvidia.com Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Nicolin Chen Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe

Merge branches 'apple/dart', 'arm/smmu/updates', 'arm/smmu/bindings', 'rockchip', 'verisilicon', 'riscv', 'intel/vt-d', 'amd/amd-vi' and 'core' into next

2026-06-12T12:57:23+00:00

iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path

2026-06-12T12:56:49+00:00

In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment `s` is incorrectly assigned from the head entry `sg->length` instead of the current entry `s->length`. This typo causes all P2PDMA segments in the scatterlist to inherit the length of the first segment, leading to corrupted DMA lengths for multi- segment scatterlists. Fix this by using `s->length` instead of `sg->length`. Fixes: a25e7962db ("PCI/P2PDMA: Refactor the p2pdma mapping helpers") Signed-off-by: Li RongQing Reviewed-by: Logan Gunthorpe Signed-off-by: Joerg Roedel