Add a new test_dev domain op for drivers to run a compatibility test prior
to the actual attachment at the driver level. Any incompatible attachment
will be rejected early, allowing the iommu core to postpone any concurrent
attachment during a device reset state.

This is a preparatory series for new iommu_dev_reset APIs:
https://lore.kernel.org/all/cover.1756682135.git.nicolinc@nvidia.com/

The change is a must to keep attach uAPI behavior consistent.

This is on github:
https://github.com/nicolinc/iommufd/tree/iommu_test_dev-v1

Nicolin Chen (20):
  iommu: Lock group->mutex in iommu_deferred_attach()
  iommu: Introduce a test_dev domain op and an internal helper
  iommu/arm-smmu-v3: Implement arm_smmu_domain_test_dev
  iommu/intel: Implement test_dev callbacks to domain ops
  iommu/amd: Implement test_dev callbacks to domain ops
  iommu/arm-smmu: Implement arm_smmu_test_dev
  iommu/qcom_iommu: Implement test_dev callbacks to domain ops
  iommu/riscv: Implement riscv_iommu_test_paging_domain
  iommu/mkt_iommu: Implement mtk_iommu_test_device
  iommu/apple-dart: Implement test_dev callbacks to domain ops
  iommu/ipmmu-vmsa: Implement ipmmu_domain_test_device
  iommu/sun50i-iommu: Implement sun50i_iommu_domain_test_device
  iommu/rockchip-iommu: Implement rk_iommu_identity_test_dev
  iommu/msm_iommu: Implement msm_iommu_domain_test_dev
  iommu/fsl_pamu_domain: Implement fsl_pamu_domain_test_device
  iommu/omap-iommu: Implement omap_iommu_domain_test_dev
  iommu/s390-iommu: Implement s390_iommu_domain_test_device
  iommufd/selftest: Implement mock_domain_nop_test
  iommu/virtio-iommu: Implement viommu_domain_test_dev
  iommu/tegra-smmu: Implement tegra_smmu_domain_test_dev

 drivers/iommu/amd/amd_iommu.h                 |   3 -
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h   |   2 +
 include/linux/iommu.h                         |  17 ++-
 drivers/iommu/amd/iommu.c                     |  27 ++--
 drivers/iommu/amd/pasid.c                     |  29 ++--
 drivers/iommu/apple-dart.c                    |  50 +++++--
 .../arm/arm-smmu-v3/arm-smmu-v3-iommufd.c     |   6 +-
 .../iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c   |   4 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c   | 113 ++++++++++------
 drivers/iommu/arm/arm-smmu/arm-smmu.c         | 116 +++++++++-------
 drivers/iommu/arm/arm-smmu/qcom_iommu.c       |  46 +++++--
 drivers/iommu/fsl_pamu_domain.c               |  50 +++++--
 drivers/iommu/intel/iommu.c                   |  66 ++++++----
 drivers/iommu/intel/nested.c                  |  29 ++--
 drivers/iommu/intel/svm.c                     |  11 +-
 drivers/iommu/iommu.c                         | 124 +++++++++++++-----
 drivers/iommu/iommufd/selftest.c              |  45 +++++--
 drivers/iommu/ipmmu-vmsa.c                    |  38 ++++--
 drivers/iommu/msm_iommu.c                     |  31 ++++-
 drivers/iommu/mtk_iommu.c                     |  17 ++-
 drivers/iommu/omap-iommu.c                    |  41 +++---
 drivers/iommu/riscv/iommu.c                   |  16 ++-
 drivers/iommu/rockchip-iommu.c                |  18 ++-
 drivers/iommu/s390-iommu.c                    |  22 +++-
 drivers/iommu/sun50i-iommu.c                  |  16 ++-
 drivers/iommu/tegra-smmu.c                    |  23 ++--
 drivers/iommu/virtio-iommu.c                  |  16 ++-
 27 files changed, 671 insertions(+), 305 deletions(-)

-- 
2.43.0

On Sun, Oct 12, 2025 at 05:04:57PM -0700, Nicolin Chen wrote:
> Add a new test_dev domain op for drivers to run a compatibility test prior
> to the actual attachment at the driver level. Any incompatible attachment
> will be rejected early, allowing the iommu core to postpone any concurrent
> attachment during a device reset state.

I had to go back and find the original email from kevin to understand
this..

 
This is a preparatory series for new iommu_dev_reset APIs:
https://lore.kernel.org/all/cover.1756682135.git.nicolinc@nvidia.com/

That series parks the domain attachment at BLOCKED during a device
reset. To keep the uAPI this also required that any change in domain
during this reset sequence is just recorded and kept in the background
until the reset is finished.

This creates a weird hole where userspace could propose to attach to a
domain that is incompatible with the device during FLR, have that
attach queued and then ultimately have the domain attach fail when the
FLR concludes.

This can be mitigated by splitting out the compatability test from the
attach and having the core code check the compatability before
accepting a queued domain attach.

It was felt that the subtle uAPI change warrants this rework.

Jason