Please pull IOMMUFD subsystem changes

Hi Linus,

Small set of iommufd updates this cycle, pretty much all bug fixes

Thanks,
Jason

The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:

Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)

are available in the Git repository at:

git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd.git tags/for-linus-iommufd

for you to fetch changes up to 04bcf84613346b973a8cc0c59238b6b5bc902688:

iommupt: Do not allow PTEs to be split when dirty logging (2026-10-15 13:56:22 -0300)

----------------------------------------------------------------
iommufd v7.4 merge window pull request

Several bug fixes, probably found by AI based on the emails:

- Several edge cases in the self test

- Reject malformed invalidation commands in case the VMM let them through

- Rework how the invalidation interface works to the drivers to be more robust and fix several Sashiko issues

- Correct several error unwind paths

- UAF during eventq file release

- Reject more malformed usage of the dirty tracking by the VMM

----------------------------------------------------------------
Andrea Parri (3):
iommufd: Keep dmabuf PFNs MMIO when filling another domain
iommufd: Reject a zero-length dirty bitmap request iommufd/iova_bitmap: Ensure that iova_bitmap_set() handles the full IOVA

Donggeun Yoo (1):
iommufd: Keep reserved IOVA ranges when a replace within one IOAS fails

Eva Kurchatova (1):
iommufd/selftest: Skip when the mock device is not there

Jason Gunthorpe (1):
iommupt: Do not allow PTEs to be split when dirty logging

Karl Mehltretter (1):
iommufd: Fix iommufd_hw_capabilities reference in kernel-doc

Nicolin Chen (5):
iommu/arm-smmu-v3-iommufd: Reject unsupported bits in invalidation commands
iommufd: Iterate the cache invalidation array in the core iommufd/selftest: Convert cache invalidation mocks to the core array loop iommu/arm-smmu-v3-iommufd: Convert cache invalidation to the core array loop iommu/vt-d: Convert nested cache invalidation to the core array loop

Nirmoy Das (1):
iommufd: Fix event queue release use-after-free

Qinyun Tan (1):
iommufd/selftest: Return dmabuf fd from IOMMU_TEST_OP_DMABUF_GET again

Samarth Narang (1):
iommufd/iova_bitmap: Fail GET_DIRTY_BITMAP when a bitmap page cannot be pinned

 .../iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c    | 197 ++++++++++++++++-----
 drivers/iommu/generic_pt/iommu_pt.h                |  30 +---
 drivers/iommu/intel/nested.c                       |  54 +++---
 drivers/iommu/iommufd/device.c                     |   8 +-
 drivers/iommu/iommufd/eventq.c                     |   4 +-
 drivers/iommu/iommufd/hw_pagetable.c               |  25 +--
 drivers/iommu/iommufd/io_pagetable.c               |   5 +-
 drivers/iommu/iommufd/iova_bitmap.c                |  26 ++-
 drivers/iommu/iommufd/pages.c                      |  13 +-
 drivers/iommu/iommufd/selftest.c                   | 153 ++++++++--------
 include/linux/iommu.h                              |   6 +-
 include/linux/iommufd.h                            |   2 +
 include/uapi/linux/iommufd.h                       |  12 +-
 tools/testing/selftests/iommu/iommufd.c            |  24 ++-
 tools/testing/selftests/iommu/iommufd_fail_nth.c   |  14 +-
 15 files changed, 375 insertions(+), 198 deletions(-)