Hi Linus, Small set of iommufd updates this cycle, pretty much all bug fixes Thanks, Jason The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935: Linux 7.3-rc1 (2026-08-30 13:34:40 -0700) are available in the Git repository at: git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd.git tags/for-linus-iommufd for you to fetch changes up to 04bcf84613346b973a8cc0c59238b6b5bc902688: iommupt: Do not allow PTEs to be split when dirty logging (2026-10-15 13:56:22 -0300) ---------------------------------------------------------------- iommufd v7.4 merge window pull request Several bug fixes, probably found by AI based on the emails: - Several edge cases in the self test - Reject malformed invalidation commands in case the VMM let them through - Rework how the invalidation interface works to the drivers to be more robust and fix several Sashiko issues - Correct several error unwind paths - UAF during eventq file release - Reject more malformed usage of the dirty tracking by the VMM ---------------------------------------------------------------- Andrea Parri (3): iommufd: Keep dmabuf PFNs MMIO when filling another domain iommufd: Reject a zero-length dirty bitmap request iommufd/iova_bitmap: Ensure that iova_bitmap_set() handles the full IOVA Donggeun Yoo (1): iommufd: Keep reserved IOVA ranges when a replace within one IOAS fails Eva Kurchatova (1): iommufd/selftest: Skip when the mock device is not there Jason Gunthorpe (1): iommupt: Do not allow PTEs to be split when dirty logging Karl Mehltretter (1): iommufd: Fix iommufd_hw_capabilities reference in kernel-doc Nicolin Chen (5): iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands iommufd: Iterate the cache invalidation array in the core iommufd/selftest: Convert cache invalidation mocks to the core array loop iommu/arm-smmu-v3-iommufd: Convert cache invalidation to the core array loop iommu/vt-d: Convert nested cache invalidation to the core array loop Nirmoy Das (1): iommufd: Fix event queue release use-after-free Qinyun Tan (1): iommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET again Samarth Narang (1): iommufd/iova_bitmap: Fail GET_DIRTY_BITMAP when a bitmap page cannot be pinned .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 197 ++++++++++++++++----- drivers/iommu/generic_pt/iommu_pt.h | 30 +--- drivers/iommu/intel/nested.c | 54 +++--- drivers/iommu/iommufd/device.c | 8 +- drivers/iommu/iommufd/eventq.c | 4 +- drivers/iommu/iommufd/hw_pagetable.c | 25 +-- drivers/iommu/iommufd/io_pagetable.c | 5 +- drivers/iommu/iommufd/iova_bitmap.c | 26 ++- drivers/iommu/iommufd/pages.c | 13 +- drivers/iommu/iommufd/selftest.c | 153 ++++++++-------- include/linux/iommu.h | 6 +- include/linux/iommufd.h | 2 + include/uapi/linux/iommufd.h | 12 +- tools/testing/selftests/iommu/iommufd.c | 24 ++- tools/testing/selftests/iommu/iommufd_fail_nth.c | 14 +- 15 files changed, 375 insertions(+), 198 deletions(-)