wireguard-linux/drivers/iommu/amd, branch stable

Merge branches 'arm/smmu/updates', 'arm/smmu/bindings', 'mediatek', 'qualcomm/msm', 'rockchip', 'ti/omap', 'riscv', 'intel/vt-d', 'amd/amd-vi', 'core' and 'typos' into next

2026-08-11T07:12:19Z

iommu/amd: Add SNP page mode 0 support

2026-08-11T07:03:57Z

Newer AMD IOMMUs supports DTE[Mode]=0 for SNP-enabled system. This is detected using new feature bit (EFR2[SNP_Page_Mode_0_Sup]). If this feature is enabled, then IOMMU supports: - Passthrough mode (i.e. iommu=pt) - amd_iommu=pgtbl_v2: Forcing Linux DMA-API to use IOMMU v2 page table - Setting up device for SVA mode in the host. Signed-off-by: Vasant Hegde Reviewed-by: Suravee Suthikulpanit Tested-by: Amandeep Kaur Longia Signed-off-by: Joerg Roedel

iommu/amd: Fix GN bit setting in COMPLETE_PPR_REQUEST command

2026-08-11T07:02:56Z

The GN bit in the COMPLETE_PPR_REQUEST command indicates whether the device is operating under a guest (v2) page table. Currently, dev_data->pri_tlp is incorrectly used to derive this bit. However, pri_tlp indicates whether the device uses PRI TLP which is unrelated to page table mode. Fix this by refactoring amd_iommu_complete_ppr() into a static internal helper __amd_iommu_complete_ppr() that accepts an explicit 'gn' argument. The amd_iommu_complete_ppr() wrapper then derives the GN bit correctly from the device's active protection domain via pdom_is_v2_pgtbl_mode(). In the INVALID_PPR_REQUEST error handling path, the device's protection domain may not be accessible, so derive the GN bit directly from the EVENT_FLAG_PPR_GN flag in the event log entry instead. While at it, change the 'gn' parameter type in build_complete_ppr() from u8 to bool to better reflect its semantics. Signed-off-by: Vasant Hegde Reviewed-by: Ankit Soni Signed-off-by: Joerg Roedel

iommu/amd: Rate limit INVALID_PPR_REQUEST error logging

2026-08-11T07:02:56Z

The amd_iommu_report_ppr_err() function logs an error message for every INVALID_PPR_REQUEST event. Under certain fault conditions, a misbehaving or malicious device can flood the IOMMU event log with PPR faults, causing the kernel log to be overwhelmed with repeated error messages. Switch from dev_err() to dev_err_ratelimited() to suppress duplicate messages when INVALID_PPR_REQUEST events occur at a high rate. Signed-off-by: Vasant Hegde Reviewed-by: Ankit Soni Signed-off-by: Joerg Roedel

iommu/amd: Fix missing CMD_COMPLETE_PPR response for invalid PPR requests

2026-08-11T07:02:55Z

The AMD IOMMU spec, requires the host to respond with a CMD_COMPLETE_PPR command when an EVENT_TYPE_INV_PPR_REQ event is received with the RX bit cleared. This response was missing in the current implementation, leaving invalid PPR requests unacknowledged. Introduce amd_iommu_report_ppr_err() to handle EVENT_TYPE_INV_PPR_REQ events. The new function logs the invalid PPR request and when the RX bit is cleared, sends CMD_COMPLETE_PPR response. Reported-by: Gaultier Delbarre Co-developed-by: Wei Huang Signed-off-by: Wei Huang Signed-off-by: Vasant Hegde Reviewed-by: Ankit Soni Signed-off-by: Joerg Roedel

iommu/amd: Introduce PPR_TAG_LAST_PAGE() macro

2026-08-11T07:02:55Z

The PPR tag field (PPRtag) encodes two distinct fields: the 9-bit tag value (bits 8-0) and the last-page indicator L bit (bit 9). Fix PPR_TAG() to mask only the 9-bit tag field and introduce PPR_TAG_LAST_PAGE to explicitly extract the L bit. This way it becomes easy to read. Cc: Wei Huang Signed-off-by: Vasant Hegde Reviewed-by: Ankit Soni Signed-off-by: Joerg Roedel

iommu/amd: Fix incorrect device ID in invalid PASID error message

2026-08-11T07:02:55Z

The IO page fault notifier handler logs pdev->dev.id when reporting an invalid PASID, but pdev->dev.id is the kernel-internal device ID and not the IOMMU device ID (BDF). Use dev_data->devid instead, which reflects actual devid. Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler") Signed-off-by: Vasant Hegde Reviewed-by: Ankit Soni Signed-off-by: Joerg Roedel

iommu/amd: Put PCI device after handling PPR faults

2026-07-30T12:51:15Z

iommu_call_iopf_notifier() looks up the requester with pci_get_domain_bus_and_slot(), which returns a PCI device with its reference count incremented. Neither the successful iommu_report_device_fault() path nor the abort path drops that reference, so every handled PPR request leaks a PCI device reference. This is the same ownership rule that was fixed for the old iommu_v2 ppr_notifier() path by commit 6cf0981c2233 ("iommu/amd: Fix pci device refcount leak in ppr_notifier()"), but iommu_call_iopf_notifier() was added later as a separate PPR/IOPF notifier path. Drop the PCI device reference after handling the PPR entry. Fixes: 978d626b8f1a ("iommu/amd: Add IO page fault notifier handler") Cc: stable@vger.kernel.org Assisted-by: Qoder:Qwen-3.8-MAX-Preview Signed-off-by: Shuai Xue Reviewed-by: Vasant Hegde Signed-off-by: Joerg Roedel

iommu/amd: Fix undefined behavior in devid_write debugfs function

2026-07-22T12:32:50Z

When for_each_pci_segment() loop completes without finding a matching segment, the pci_seg pointer is not NULL but points to an invalid memory location (the list head). Accessing pci_seg->id after the loop causes undefined behavior. Fix this by handling the successful case inside the loop and returning -EINVAL after the loop if no matching segment is found. Fixes: 2e98940f123d9 ("iommu/amd: Add support for device id user input") Signed-off-by: Li RongQing Reviewed-by: Ankit Soni Signed-off-by: Will Deacon

iommu/amd: Fix grammar and typos in comments

2026-07-22T12:31:31Z

Correct possessive "its", article before acpihid, and a couple of mangled sentences in IOMMU flush/irq comments. Signed-off-by: xiongweimin Reviewed-by: Ankit Soni Signed-off-by: Will Deacon