[RFC] Partial iommu_unmap issue with contiguous PTE hint enabled

[Zhang Yuwei]

Hi Vijayanand,

I have a question regarding the contiguous hint patch set:
https://lore.kernel.org/linux-iommu/20260804-iommu_contig_hint-v4-1-d7a47ed5db98@oss.qualcomm.com/

We encountered an issue during partial unmapping when contiguous PTE
hints (CONT bit) are set. Here is the scenario we observed:

1. Setup / Mapping:
   - Under 4 KiB page granule, a 64 KiB memory region is mapped via
     dma_map_page() (or iommu_map()).
   - Because the 64 KiB range meets the contiguous hint requirement
     (16 x 4 KiB PTEs), all 16 PTEs are programmed with the CONT bit set.

2. Partial Unmapping Trigger:
   - Later, iommu_unmap() is invoked to unmap a 32 KiB partial range
     within this 64 KiB block.

3. Observed Behavior:
   - Calling iommu_unmap() triggers a kernel WARN.
   - Only 28 KiB is successfully unmapped before the operation halts.
   - The remaining memory in this region can no longer be unmapped,
     leading to leaked/stuck IOMMU page table entries.

4. Questions:
   - Is partial unmapping supported when contiguous PTE hints are
     enabled, or is caller-side alignment enforced?
   - Should io-pgtable (or the SMMU driver) handle clearing/splitting
     the CONT bit prior to partial unmap, or refuse the unmap gracefully?
   - What is the recommended fix or expected behavior for handling
     non-64 KiB aligned unmaps over CONT-hinted regions?

Any insights or guidance on how this should be handled would be greatly
appreciated. If needed, I can provide additional logs or help test
potential fixes.

Thanks,
Zhang Yuwei