linux.git/include/uapi/linux/iommufd.h, branch master

Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd

2026-08-19T19:42:58+00:00

Pull iommufd updates from Jason Gunthorpe: "One small feature this cycle, the noiommu mode is useful in single-purpose VMs running something like DPDK. It avoids the double translation overhead and it seems to be commonly used with some hacks. Summary: - Formal API for "no iommu" mode in VFIO. iommufd now works in this environment and provides page pinning and phyiscal address services to userspace. This avoids nasty fragile tricks with mprotect and pgmap - Fix sykzaller crash racing change_process with map_pages - Various skyzkaller/AI fixes for the selftests" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Fix UAF in selftest IOPF reporting iommu/iommufd: Fix NULL pointer deref in iommufd_ioas_change_process when racing with iopt_map_file_pages Documentation: Update VFIO NOIOMMU mode vfio: Enable cdev noiommu mode under iommufd iommufd: Add an ioctl to query PA from IOVA for noiommu mode iommufd: Allow binding to a noiommu device iommufd: Move igroup allocation to a function iommufd: Support a HWPT without an iommu driver for noiommu iommufd: Simplify iommufd_device_remove_vdev() iommufd: Fix grammar and spelling in comments iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add iommufd/selftest: Fix dmabuf leak in iommufd_test_dmabuf_get() iommufd/selftest: Avoid selftest dirty bitmap size wrap

iommu/arm-smmu-v3: Support IDR5.DS and widen the TLBI SCALE field

2026-08-02T10:18:15+00:00

An SMMU implementing SMMU_IDR5.DS extends the range invalidation commands: the SCALE field grows a 6th bit, raising its maximum value from 31 to 39, and TTL == 0b01 becomes a valid level hint for a 16KB translation granule. Add a new ARM_SMMU_FEAT_DS feature detecting the DS bit, and widen the CMDQ_TLBI_0_SCALE field to its architectural 6 bits. Mask the scale value explicitly in arm_smmu_cmdq_batch_add_range(), so the range invalidation path emits the same commands as before, keeping the pre-existing 5-bit truncation of a scale above 31. Also list DS as a valid IDR5 field in the iommu_hw_info_arm_smmuv3 kdoc: iommufd has always reported the raw IDR5 register, so a VMM may conclude from that bit alone that it can expose DS to its guest. Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Assisted-by: Claude:claude-fable-5 Signed-off-by: Nicolin Chen Signed-off-by: Will Deacon

iommu/arm-smmu-v3-iommufd: Report CFGI/TLBI-repeat erratum

2026-07-28T09:49:47+00:00

A guest with access to VCMDQ generates its own invalidation commands and must apply any invalidation errata before submitting them. If the host also repeats those commands, each affected invalidation is issued four times instead of twice. Add IOMMU_HW_INFO_ARM_SMMUV3_ERRATA_REPEAT_TLBI_CFGI to report the CFGI/TLBI-repeat erratum to user space. This allows the VMM to expose the erratum to the guest or apply the workaround itself. Use the raw __arm_smmu_cmdq_issue_cmdlist() helper for user-provided invalidations so the host does not apply the workaround a second time. Add arm_smmu_erratum_repeat_tlbi_cfgi() to query the static key when populating the SMMUv3 hardware information. Signed-off-by: Ashish Mhetre Reviewed-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon

iommufd: Add an ioctl to query PA from IOVA for noiommu mode

2026-07-14T15:05:01+00:00

To support no-IOMMU mode where userspace drivers perform unsafe DMA using physical addresses, introduce a new API to retrieve the physical address of a user-allocated DMA buffer that has been mapped to an IOVA via IOMMU_IOAS_MAP. The mapping is backed by SW-only I/O page tables maintained by the GENERIC_PT framework. Link: https://patch.msgid.link/r/a60a601509688e8552c75e668deb548c93974a3b.1783360051.git.jacob.pan@linux.microsoft.com Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Reviewed-by: Yi Liu Suggested-by: Jason Gunthorpe Co-developed-by: Jason Gunthorpe Signed-off-by: Jacob Pan Fixes: 2c6cf6ab1564 ("iommufd: Allow binding to a noiommu device") Signed-off-by: Jason Gunthorpe

iommufd: Clarify IOAS_MAP_FILE dma-buf support

2026-06-12T13:10:34+00:00

IOMMU_IOAS_MAP_FILE is documented as mapping a memfd, but the implementation first tries to resolve the fd as a dma-buf and has a special path for supported dma-buf exporters. In particular, VFIO PCI dma-bufs exported through VFIO_DEVICE_FEATURE_DMA_BUF can be mapped when they describe a single DMA range. Update the UAPI comment so userspace understands that certain kinds of dma-buf are supported in addition to memfd. Fixes: 44ebaa1744fd ("iommufd: Accept a DMABUF through IOMMU_IOAS_MAP_FILE") Link: https://patch.msgid.link/r/20260610-tmp-v1-1-b8ccbf557391@fb.com Signed-off-by: Alex Mastro Assisted-by: Codex:gpt-5.5-high Signed-off-by: Jason Gunthorpe

Merge branches 'fixes', 'arm/smmu/updates', 'arm/smmu/bindings', 'riscv', 'intel/vt-d', 'amd/amd-vi' and 'core' into next

2026-04-09T12:18:27+00:00

iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement

2026-03-24T14:04:35+00:00

>From hardware implementation perspective, a guest tegra241-cmdqv hardware is different than the host hardware: - Host HW is backed by a VINTF (HYP_OWN=1) - Guest HW is backed by a VINTF (HYP_OWN=0) The kernel driver has an implementation requirement of the HYP_OWN bit in the VM. So, VMM must follow that to allow the same copy of Linux to work. Add this requirement to the uAPI, which is currently missing. Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support") Signed-off-by: Nicolin Chen Reviewed-by: Eric Auger Reviewed-by: Jason Gunthorpe Signed-off-by: Will Deacon

iommufd: Report ATS not supported status via IOMMU_GET_HW_INFO

2026-03-17T13:05:05+00:00

If the IOMMU driver reports that ATS is not supported for a device, set the IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED flag in the returned hardware capabilities. This uses a negative flag for UAPI compatibility. Existing userspace assumes ATS is supported if no flag is present. This also ensures that new userspace works correctly on both old and new kernels, where a zero value implies ATS support. When this flag is set, ATS cannot be used for the device. When it is clear, ATS may be enabled when an appropriate HWPT is attached. Reviewed-by: Samiullah Khawaja Reviewed-by: Jason Gunthorpe Signed-off-by: Shameer Kolothum Signed-off-by: Joerg Roedel

iommufd: Introduce data struct for AMD nested domain allocation

2026-01-18T09:56:12+00:00

Introduce IOMMU_HWPT_DATA_AMD_GUEST data type for IOMMU guest page table, which is used for stage-1 in nested translation. The data structure contains information necessary for setting up the AMD HW-vIOMMU support. Reviewed-by: Jason Gunthorpe Reviewed-by: Nicolin Chen Reviewed-by: Vasant Hegde Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel

iommu/amd: Add support for hw_info for iommu capability query

2026-01-18T09:56:09+00:00

AMD IOMMU Extended Feature (EFR) and Extended Feature 2 (EFR2) registers specify features supported by each IOMMU hardware instance. The IOMMU driver checks each feature-specific bits before enabling each feature at run time. For IOMMUFD, the hypervisor passes the raw value of amd_iommu_efr and amd_iommu_efr2 to VMM via iommufd IOMMU_DEVICE_GET_HW_INFO ioctl. Reviewed-by: Nicolin Chen Reviewed-by: Vasant Hegde Reviewed-by: Jason Gunthorpe Signed-off-by: Suravee Suthikulpanit Signed-off-by: Joerg Roedel