Subject: [PATCH v4 00/10] iommu/arm-smmu-v3: Share domain across SMMU/vSMMU instances

From: Nicolin Chen <[email-masked]>
Date: Thu, 19 Mar 2026 12:51:46 -0700

In a system with multiple physical SMMU instances, multiple devices can be
passed through to a VM. Currently, a VM would allocate one domain per SMMU
instance that might be shared across devices that sit behind the same SMMU
instance. However, the gPA->PA mappings (either an S1 unmanaged domain or
an S2 nesting parent domain) can be shared across all the devices that sit
behind different SMMU instances as well, provided that the shared I/O page
table is compatible with all the SMMU instances.

The major difficulty in sharing the domain has been invalidation, since a
change to the shared I/O page table results in an invalidation on all SMMU
instances. A traditional approach involves building a linked list of SMMUs
within the domain, which is very inefficient for the invalidation path as
the linked list has to be locked.

To address this, the SMMUv3 driver now uses an RCU-protected invalidation
array. Any new device (and its SMMU) is preloaded into the array during a
device attachment. This array maintains all necessary information, such as
ASID/VMID and which SMMU instance (CMDQ) to issue the command to.

The second issue concerns the lifecycle of the iotlb tag. Currently, ASID
or VMID is allocated per domain and kept in the domain structure (cd->asid
or s2_cfg->vmid). This does not work ideally when the domain (e.g. S2) is
shared, as the VMID will have to be global across all SMMU instances, even
if a VM is not using all of them. This results in wasted VMID resources in
the bitmaps of unused SMMU instances.

Instead, an iotlb tag should be allocated per SMMU instance. Consequently,
these tags must be allocated and maintained separately. Since ASID or VMID
is only used when a CD or STE is installed to the HW (which happens during
device attachment), and the invalidation array is built right before that,
it is ideal to allocate a new iotlb tag before arm_smmu_invs_merge():
 - when a device attaches, the driver first searches for an existing iotlb
   tag for the SMMU the device sits behind
 - If a match is found, the "users" counter is incremented
 - otherwise, a new tag is allocated.

A nested domain case is slightly unique as certain HW requires the VMID at
the vSMMU init stage v.s. a device attachment (to the nested domain). Thus
 - allocate/free a vmid in vsmmu_init/vsmmu_destroy and store in vSMMU
 - introduce an INV_TYPE_S2_VMID_VSMMU to separate it from a naked S2 case
 - retrieve the vmid from the vSMMU during attachment instead of allocation

With this, deprecate the cd->asid and s2_cfg->vmid from struct smmu_domain,
and replace them with the iotlb tag stored in the smmu_domain->invs array.

Finally, allow sharing a domain across the SMMU instances, so long as they
passes a compatibility test.

This is on Github:
https://github.com/nicolinc/iommufd/commits/smmuv3_share_domain-v4

An earlier effort to share S2 domain can be found:
https://lore.kernel.org/all/[email-masked]/

Changelog
v4
 * Rebase on arm/smmu/updates branch
 * Update commit messages
 * Drop unnecessary mutex around ida_alloc/free
 * Rename arm_smmu_make_cd_fn parameter to mak_cd_fn
 * Call ida_free() to the revert path in arm_vsmmu_init()
v3
 https://lore.kernel.org/all/[email-masked]/
 * Rebase on arm_smmu_invs-v12
 * Add Reviewed-by tags from Jason
 * Avoid Boolean function parameters
 * Set users counter in arm_smmu_ins_unref()
 * Add arm_smmu_inv_assert_iotlb_tag() helper
 * Fix the return values in arm_smmu_alloc_iotlb_tag()
 * Reorder the patches introducing INV_TYPE_S2_VMID_VSMMU
 * Add a note explaining the lifecycle of vSMMU-owned iotlb tag
 * Compare pgtbl with the new smmu in arm_smmu_domain_can_share()
 * Pass in a function pointer to arm_smmu_set_pasid() for CD making
 * Pass the raw domain pointer down to arm_smmu_domain_get_iotlb_tag()
v2
 https://lore.kernel.org/all/[email-masked]/
 * Add arm_smmu_domain_get_iotlb_tag()
 * Drop asid array and vmid from master structure, and get the iotlb
   tag in the smmu_domain->invs array
 * Introduce INV_TYPE_S2_VMID_VSMMU for vSMMU type, and separate the
   nested attach case from a naked S2 attach case
v1
 https://lore.kernel.org/all/[email-masked]/

Thanks
Nicolin

Nicolin Chen (10):
  iommu/arm-smmu-v3: Add a wrapper for arm_smmu_make_sva_cd()
  iommu/arm-smmu-v3: Pass in arm_smmu_make_cd_fn to arm_smmu_set_pasid()
  iommu/arm-smmu-v3: Store IOTLB cache tags in struct
    arm_smmu_attach_state
  iommu/arm-smmu-v3: Pass in IOTLB cache tag to
    arm_smmu_master_build_invs()
  iommu/arm-smmu-v3: Pass in IOTLB cache tag to CD and STE
  iommu/arm-smmu-v3: Introduce INV_TYPE_S2_VMID_VSMMU
  iommu/arm-smmu-v3: Allocate IOTLB cache tag if no id to reuse
  iommu/arm-smmu-v3: Allocate INV_TYPE_S2_VMID_VSMMU in arm_vsmmu_init
  iommu/arm-smmu-v3: Remove ASID/VMID from arm_smmu_domain
  iommu/arm-smmu-v3: Allow sharing domain across SMMUs

 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h   |  76 ++++-
 .../arm/arm-smmu-v3/arm-smmu-v3-iommufd.c     |  54 +++-
 .../iommu/arm/arm-smmu-v3/arm-smmu-v3-sva.c   |  57 ++--
 .../iommu/arm/arm-smmu-v3/arm-smmu-v3-test.c  |  19 +-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c   | 289 ++++++++++--------
 .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c    |   1 +
 6 files changed, 305 insertions(+), 191 deletions(-)

-- 
2.43.0