[PATCH 00/11] hw/arm/smmuv3-accel: Resolve AUTO properties

[PATCH 00/11] hw/arm/smmuv3-accel: Resolve AUTO properties

[Nathan Chen]

Hi,

This series introduces support for resolving 'auto' for arm-smmuv3
accelerated mode's ATS, RIL, SSIDSIZE, and OAS feature properties
based on host IOMMU capabilities. This is dependent on the series [1]
for changing these property types to accept 'auto' values.

Accelerated SMMUv3 Address Translation Services support is derived
from IDR0, Range Invalidation support is derived from IDR3, Substream
ID size is derived from IDR1, and output address space is derived from
IDR5.

Additionally, an OnOffAuto "ats" property is added for vfio-pci devices,
where setting 'auto' detects the per-device presence of
IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED from the kernel, and the ATS cap can
be advertised or hidden by setting 'on' or 'off'. This is dependent
on Shameer's recent kernel series for reporting effective ATS support
status [2].

The default values are set to 'auto' for all properties.

A complete branch can be found here:
https://github.com/NathanChenNVIDIA/qemu/tree/smmuv3-accel-auto-resolve

Please take a look and let me know your feedback.

Thanks,
Nathan

[0] https://lore.kernel.org/qemu-devel/20260309192119.870186-1-nathanc@nvidia.com/
[1] https://lore.kernel.org/qemu-arm/20260323182454.1416110-1-nathanc@nvidia.com/
[2] https://lore.kernel.org/all/20260317111603.101456-1-skolothumtho@nvidia.com/

Example usage:
qemu-system-aarch64 \
  -object iommufd,id=iommufd0 \
  -machine virt,accel=kvm,gic-version=3,ras=on,highmem-mmio-size=4T \
  -cpu host -smp cpus=4 -m size=16G -nographic \
  -object memory-backend-ram,size=16G,id=m0 \
  -numa node,memdev=m0,cpus=0-3,nodeid=0 \
  -numa node,nodeid=1 -numa node,nodeid=2 -numa node,nodeid=3 -numa node,nodeid=4 \
  -numa node,nodeid=5 -numa node,nodeid=6 -numa node,nodeid=7 -numa node,nodeid=8 \
  -device pxb-pcie,id=pcie.1,bus_nr=1,bus=pcie.0,numa_node=0 \
  -device arm-smmuv3,primary-bus=pcie.1,id=smmuv3.1,accel=on,ats=auto,ssidsize=auto,ril=auto,oas=auto \
  -device pcie-root-port,id=pcie.port1,bus=pcie.1,chassis=1,io-reserve=0 \
  -device vfio-pci-nohotplug,host=0009:06:00.0,bus=pcie.port1,rombar=0,id=dev0,iommufd=iommufd0,ats=auto \
  -object acpi-generic-initiator,id=gi0,pci-dev=dev0,node=1 \
  -object acpi-generic-initiator,id=gi1,pci-dev=dev0,node=2 \
  -object acpi-generic-initiator,id=gi2,pci-dev=dev0,node=3 \
  -object acpi-generic-initiator,id=gi3,pci-dev=dev0,node=4 \
  -object acpi-generic-initiator,id=gi4,pci-dev=dev0,node=5 \
  -object acpi-generic-initiator,id=gi5,pci-dev=dev0,node=6 \
  -object acpi-generic-initiator,id=gi6,pci-dev=dev0,node=7 \
  -object acpi-generic-initiator,id=gi7,pci-dev=dev0,node=8 \
  -bios /usr/share/AAVMF/AAVMF_CODE.fd \
  -device nvme,drive=nvme0,serial=deadbeaf1,bus=pcie.0 \
  -drive file=/var/lib/libvirt/images/guest.qcow2,index=0,media=disk,format=qcow2,if=none,id=nvme0 \
  -device e1000,romfile=/usr/local/share/qemu/efi-e1000.rom,netdev=net0,bus=pcie.0 \
  -netdev user,id=net0,hostfwd=tcp::5558-:22,hostfwd=tcp::5586-:5586

Testing:
Basic sanity testing was performed on an NVIDIA Grace platform with GPU
device assignment and running CUDA test apps on the guest. Observed the
feature properties being set based on host IOMMU capabilities and the
ATS capability for a vfio-pci device reported based on what was reported
from the host. Verified that the VM boot will fail without a cold-plugged
device, and that a hot-plugged device re-uses the resolved values from
the initial cold-plug. Additional testing and feedback are welcome.

Nathan Chen (11):
  hw/arm/smmuv3-accel: Add helper for resolving auto parameters
  hw/arm/smmuv3-accel: Implement "auto" value for "ats"
  hw/arm/smmuv3: Change the default ats support to match the host
  vfio/pci: Add ats property and mask ATS cap when not exposed
  hw/arm/smmuv3-accel: Implement "auto" value for "ril"
  hw/arm/smmuv3: Change the default ril support to match the host
  hw/arm/smmuv3-accel: Implement "auto" value for "ssidsize"
  hw/arm/smmuv3: Change the default ssidsize to match the host
  hw/arm/smmuv3-accel: Implement "auto" value for "oas"
  hw/arm/smmuv3: Change the default oas to match the host
  qemu-options.hx: Support "auto" for accel SMMUv3 properties

 backends/iommufd.c                 | 15 +++++++
 hw/arm/smmuv3-accel.c              | 50 +++++++++++++++++++++++-
 hw/arm/smmuv3-accel.h              |  2 +
 hw/arm/smmuv3.c                    | 61 +++++++++++++++++------------
 hw/core/machine.c                  |  8 ++++
 hw/vfio/pci.c                      | 63 ++++++++++++++++++++++++++++++
 hw/vfio/pci.h                      |  1 +
 include/hw/arm/smmuv3.h            |  2 +
 include/system/host_iommu_device.h | 10 +++++
 qemu-options.hx                    |  1 -
 10 files changed, 185 insertions(+), 28 deletions(-)

-- 
2.43.0

[PATCH 01/11] hw/arm/smmuv3-accel: Add helper for resolving auto parameters

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Introduce smmuv3_accel_auto_finalise() to resolve properties that are
set to 'auto' for accelerated SMMUv3. This helper function allows
properties such as ats, ril, ssidsize, and oas support to be resolved
from host IOMMU capabilities via IOMMU_GET_HW_INFO.

Auto mode requires at least one cold-plugged device to retrieve and
finalise these properties. Register a machine_init_done notifier to
verify this requirement and fail boot if it is not met.

Hot-plugged devices into an accel SMMUv3-associated bus will re-use
the resolved host values from the initial cold-plug.

Subsequent patches will make use of this helper to resolve 'auto' to
what is reported by host IOMMU capabilities.

Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3-accel.c   | 14 ++++++++++++++
 hw/arm/smmuv3-accel.h   |  2 ++
 hw/arm/smmuv3.c         | 20 ++++++++++++++++++++
 include/hw/arm/smmuv3.h |  2 ++
 4 files changed, 38 insertions(+)

diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
index 65c2f44880..a0146c8d31 100644
--- a/hw/arm/smmuv3-accel.c
+++ b/hw/arm/smmuv3-accel.c
@@ -35,11 +35,25 @@ static int smmuv3_oas_bits(uint32_t oas)
     return map[oas];
 }
 
+static void smmuv3_accel_auto_finalise(SMMUv3State *s,
+                                       struct iommu_hw_info_arm_smmuv3 *info) {
+    SMMUv3AccelState *accel = s->s_accel;
+
+    /* Return if no auto for any or finalised already */
+    if (!accel->auto_mode || accel->auto_finalised) {
+        return;
+    }
+
+    accel->auto_finalised = true;
+}
+
 static bool
 smmuv3_accel_check_hw_compatible(SMMUv3State *s,
                                  struct iommu_hw_info_arm_smmuv3 *info,
                                  Error **errp)
 {
+    smmuv3_accel_auto_finalise(s, info);
+
     /* QEMU SMMUv3 supports both linear and 2-level stream tables */
     if (FIELD_EX32(info->idr[0], IDR0, STLEVEL) !=
                 FIELD_EX32(s->idr[0], IDR0, STLEVEL)) {
diff --git a/hw/arm/smmuv3-accel.h b/hw/arm/smmuv3-accel.h
index dba6c71de5..3c1cd55714 100644
--- a/hw/arm/smmuv3-accel.h
+++ b/hw/arm/smmuv3-accel.h
@@ -26,6 +26,8 @@ typedef struct SMMUv3AccelState {
     uint32_t bypass_hwpt_id;
     uint32_t abort_hwpt_id;
     QLIST_HEAD(, SMMUv3AccelDevice) device_list;
+    bool auto_mode;
+    bool auto_finalised;
 } SMMUv3AccelState;
 
 typedef struct SMMUS1Hwpt {
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 7fead1c3cf..09ea08eb18 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -37,6 +37,7 @@
 #include "smmuv3-accel.h"
 #include "smmuv3-internal.h"
 #include "smmu-internal.h"
+#include "system/system.h"
 
 #define PTW_RECORD_FAULT(ptw_info, cfg) (((ptw_info).stage == SMMU_STAGE_1 && \
                                         (cfg)->record_faults) || \
@@ -2020,6 +2021,22 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
     return true;
 }
 
+static void smmuv3_machine_done(Notifier *notifier, void *data)
+{
+    SMMUv3State *s = container_of(notifier, SMMUv3State, machine_done);
+    SMMUv3AccelState *accel = s->s_accel;
+
+    if (!s->accel) {
+        return;
+    }
+
+    if (accel->auto_mode && !accel->auto_finalised) {
+        error_report("arm-smmuv3 accel=on with 'auto' properties requires "
+                     "at least one cold-plugged VFIO device");
+        exit(1);
+    }
+}
+
 static void smmu_realize(DeviceState *d, Error **errp)
 {
     SMMUState *sys = ARM_SMMU(d);
@@ -2058,6 +2075,9 @@ static void smmu_realize(DeviceState *d, Error **errp)
 
     smmu_init_irq(s, dev);
     smmuv3_init_id_regs(s);
+
+    s->machine_done.notify = smmuv3_machine_done;
+    qemu_add_machine_init_done_notifier(&s->machine_done);
 }
 
 static const VMStateDescription vmstate_smmuv3_queue = {
diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
index 82f18eb090..fe0493c1aa 100644
--- a/include/hw/arm/smmuv3.h
+++ b/include/hw/arm/smmuv3.h
@@ -74,6 +74,8 @@ struct SMMUv3State {
     OnOffAuto ats;
     OasMode oas;
     SsidSizeMode ssidsize;
+
+    Notifier machine_done;
 };
 
 typedef enum {
-- 
2.43.0

[PATCH 02/11] hw/arm/smmuv3-accel: Implement "auto" value for "ats"

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Allow accelerated SMMUv3 Address Translation Services support property
to be derived from host IOMMU capabilities. Derive host values using
IOMMU_GET_HW_INFO, retrieving ATS capability from IDR0.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3-accel.c | 10 ++++++++++
 hw/arm/smmuv3.c       |  7 +------
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
index a0146c8d31..a835c8f220 100644
--- a/hw/arm/smmuv3-accel.c
+++ b/hw/arm/smmuv3-accel.c
@@ -44,6 +44,12 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
         return;
     }
 
+    /* Update ATS if auto from info */
+    if (s->ats == ON_OFF_AUTO_AUTO) {
+        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ATS,
+                               FIELD_EX32(info->idr[0], IDR0, ATS));
+    }
+
     accel->auto_finalised = true;
 }
 
@@ -938,4 +944,8 @@ void smmuv3_accel_init(SMMUv3State *s)
     s->s_accel = g_new0(SMMUv3AccelState, 1);
     bs->iommu_ops = &smmuv3_accel_ops;
     smmuv3_accel_as_init(s);
+
+    if (s->ats == ON_OFF_AUTO_AUTO) {
+        s->s_accel->auto_mode = true;
+    }
 }
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 09ea08eb18..f3603554e3 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -1973,10 +1973,6 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
     }
 #endif
 
-    if (s->ats == ON_OFF_AUTO_AUTO) {
-        error_setg(errp, "ats auto mode is not supported");
-        return false;
-    }
     if (s->ril == ON_OFF_AUTO_AUTO) {
         error_setg(errp, "ril auto mode is not supported");
         return false;
@@ -2196,8 +2192,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
         "is not supported.");
     object_class_property_set_description(klass, "ats",
         "Enable/disable ATS support (for accel=on). Please ensure host "
-        "platform has ATS support before enabling this. ats=auto is not "
-        "supported.");
+        "platform has ATS support before enabling this.");
     object_class_property_set_description(klass, "oas",
         "Specify Output Address Size (for accel=on). Supported values "
         "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "
-- 
2.43.0

[PATCH 03/11] hw/arm/smmuv3: Change the default ats support to match the host

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Set the default value of ATS to auto. The default for ATS support used
to be set to off, but we change it to match what the host IOMMU
properties report. Introduce a new compat for the changed default.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3.c   | 2 +-
 hw/core/machine.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index f3603554e3..f353865187 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -2158,7 +2158,7 @@ static const Property smmuv3_properties[] = {
     DEFINE_PROP_UINT64("msi-gpa", SMMUv3State, msi_gpa, 0),
     /* RIL can be turned off for accel cases */
     DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_ON),
-    DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_OFF),
+    DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_AUTO),
     DEFINE_PROP_OAS_MODE("oas", SMMUv3State, oas, OAS_MODE_44),
     DEFINE_PROP_SSIDSIZE_MODE("ssidsize", SMMUv3State, ssidsize,
                               SSID_SIZE_MODE_0),
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 0aa77a57e9..6796ab63cc 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -37,6 +37,11 @@
 #include "hw/virtio/virtio-iommu.h"
 #include "hw/acpi/generic_event_device.h"
 #include "qemu/audio.h"
+#include "hw/arm/smmuv3.h"
+
+GlobalProperty hw_compat_11_0[] = {
+    { TYPE_ARM_SMMUV3, "ats", "off" },
+};
 
 GlobalProperty hw_compat_10_2[] = {
     { "scsi-block", "migrate-pr", "off" },
-- 
2.43.0

[PATCH 04/11] vfio/pci: Add ats property and mask ATS cap when not exposed

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Add an "ats" OnOffAuto property to vfio-pci. When the device has an ATS
extended capability in config space but we should not expose it (ats=off,
or ats=auto and kernel reports IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED), mask
the capability so the guest does not see it.

This aligns with the kernel's per-device effective ATS reporting and
allows omitting ATS capability when the vIOMMU has ats=off.

Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 backends/iommufd.c                 | 15 +++++++
 hw/vfio/pci.c                      | 63 ++++++++++++++++++++++++++++++
 hw/vfio/pci.h                      |  1 +
 include/system/host_iommu_device.h | 10 +++++
 4 files changed, 89 insertions(+)

diff --git a/backends/iommufd.c b/backends/iommufd.c
index e1fee16acf..52cb060454 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -22,6 +22,13 @@
 #include "hw/vfio/vfio-device.h"
 #include <sys/ioctl.h>
 #include <linux/iommufd.h>
+/*
+ * Until kernel UAPI is synced via scripts;
+ * matches include/uapi/linux/iommufd.h
+ */
+#ifndef IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
+#define IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED (1 << 3)
+#endif
 
 static const char *iommufd_fd_name(IOMMUFDBackend *be)
 {
@@ -573,6 +580,13 @@ static int hiod_iommufd_get_cap(HostIOMMUDevice *hiod, int cap, Error **errp)
     }
 }
 
+static bool hiod_iommufd_support_ats(HostIOMMUDevice *hiod)
+{
+    HostIOMMUDeviceCaps *caps = &hiod->caps;
+
+    return !(caps->hw_caps & IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED);
+}
+
 static bool hiod_iommufd_get_pasid_info(HostIOMMUDevice *hiod,
                                         PasidInfo *pasid_info)
 {
@@ -595,6 +609,7 @@ static void hiod_iommufd_class_init(ObjectClass *oc, const void *data)
 
     hioc->get_cap = hiod_iommufd_get_cap;
     hioc->get_pasid_info = hiod_iommufd_get_pasid_info;
+    hioc->support_ats = hiod_iommufd_support_ats;
 };
 
 static const TypeInfo types[] = {
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 1945751ffd..2d408e1d9a 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -49,6 +49,10 @@
 #include "system/iommufd.h"
 #include "vfio-migration-internal.h"
 #include "vfio-helpers.h"
+#ifdef CONFIG_IOMMUFD
+#include "system/host_iommu_device.h"
+#include "linux/iommufd.h"
+#endif
 
 /* Protected by BQL */
 static KVMRouteChange vfio_route_change;
@@ -2550,10 +2554,53 @@ static bool vfio_pci_synthesize_pasid_cap(VFIOPCIDevice *vdev, Error **errp)
     return true;
 }
 
+/*
+ * Determine whether ATS capability should be advertised for @vdev, based on
+ * whether it was enabled on the command line and whether it is supported
+ * according to the kernel's IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED bit.
+ *
+ * Store whether ATS capability should be advertised in @ats_need.
+ *
+ * Return false if kernel enables IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
+ * and ATS is effectively unsupported.
+ */
+static bool vfio_pci_ats_requested_and_supported(VFIOPCIDevice *vdev,
+                                                 bool *ats_need, Error **errp)
+{
+    HostIOMMUDevice *hiod = vdev->vbasedev.hiod;
+    HostIOMMUDeviceClass *hiodc;
+    bool ats_supported;
+
+    if (vdev->ats == ON_OFF_AUTO_OFF) {
+        *ats_need = false;
+        return true;
+    }
+
+    *ats_need = true;
+    if (!hiod) {
+        return true;
+    }
+    hiodc = HOST_IOMMU_DEVICE_GET_CLASS(hiod);
+    if (!hiodc || !hiodc->support_ats) {
+        return true;
+    }
+
+    ats_supported = hiodc->support_ats(hiod);
+    if (vdev->ats == ON_OFF_AUTO_ON && !ats_supported) {
+        error_setg(errp, "vfio: ATS requested but not supported by kernel");
+        *ats_need = false;
+        return false;
+    }
+
+    *ats_need = ats_supported;
+    return true;
+}
+
 static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
 {
     PCIDevice *pdev = PCI_DEVICE(vdev);
     bool pasid_cap_added = false;
+    bool ats_needed = false;
     Error *err = NULL;
     uint32_t header;
     uint16_t cap_id, next, size;
@@ -2603,6 +2650,11 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
     pci_set_long(pdev->wmask + PCI_CONFIG_SPACE_SIZE, 0);
     pci_set_long(vdev->emulated_config_bits + PCI_CONFIG_SPACE_SIZE, ~0);
 
+    if (!vfio_pci_ats_requested_and_supported(vdev, &ats_needed, &err)) {
+        error_report_err(err);
+       err = NULL;
+    }
+
     for (next = PCI_CONFIG_SPACE_SIZE; next;
          next = PCI_EXT_CAP_NEXT(pci_get_long(config + next))) {
         header = pci_get_long(config + next);
@@ -2640,6 +2692,16 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
         case PCI_EXT_CAP_ID_PASID:
             pasid_cap_added = true;
             /* fallthrough */
+        case PCI_EXT_CAP_ID_ATS:
+            /*
+             * If ATS is requested and supported according to the kernel, add
+             * the ATS capability. If not supported according to the kernel or
+             * disabled on the qemu command line, omit the ATS cap.
+             */
+            if (ats_needed) {
+                pcie_add_capability(pdev, cap_id, cap_ver, next, size);
+            }
+            break;
         default:
             pcie_add_capability(pdev, cap_id, cap_ver, next, size);
         }
@@ -3819,6 +3881,7 @@ static const Property vfio_pci_properties[] = {
 #ifdef CONFIG_IOMMUFD
     DEFINE_PROP_LINK("iommufd", VFIOPCIDevice, vbasedev.iommufd,
                      TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
+    DEFINE_PROP_ON_OFF_AUTO("ats", VFIOPCIDevice, ats, ON_OFF_AUTO_AUTO),
 #endif
     DEFINE_PROP_BOOL("skip-vsc-check", VFIOPCIDevice, skip_vsc_check, true),
     DEFINE_PROP_UINT16("x-vpasid-cap-offset", VFIOPCIDevice,
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index d6495d7f29..514a9197ce 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -191,6 +191,7 @@ struct VFIOPCIDevice {
     VFIODisplay *dpy;
     Notifier irqchip_change_notifier;
     VFIOPCICPR cpr;
+    OnOffAuto ats;
 };
 
 /* Use uin32_t for vendor & device so PCI_ANY_ID expands and cannot match hw */
diff --git a/include/system/host_iommu_device.h b/include/system/host_iommu_device.h
index f000301583..44c56e87bb 100644
--- a/include/system/host_iommu_device.h
+++ b/include/system/host_iommu_device.h
@@ -133,6 +133,16 @@ struct HostIOMMUDeviceClass {
      * Returns: true on success, false on failure.
      */
     bool (*get_pasid_info)(HostIOMMUDevice *hiod, PasidInfo *pasid_info);
+    /**
+     *  @support_ats: Return whether ATS is supported for the device
+     *  associated with @hiod host IOMMU device, checking if the
+     *  IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED capability bit is set.
+     *
+     *  @hiod: handle to the host IOMMU device
+     *
+     *  Returns: true on success, false on failure
+     */
+    bool (*support_ats)(HostIOMMUDevice *hiod);
 };
 
 /*
-- 
2.43.0

[PATCH 05/11] hw/arm/smmuv3-accel: Implement "auto" value for "ril"

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Allow accelerated SMMUv3 Range Invalidation support property to be
derived from host IOMMU capabilities. Derive host values using
IOMMU_GET_HW_INFO, retrieving RIL capability from IDR3.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3-accel.c | 9 ++++++++-
 hw/arm/smmuv3.c       | 7 +------
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
index a835c8f220..9e7ec6a930 100644
--- a/hw/arm/smmuv3-accel.c
+++ b/hw/arm/smmuv3-accel.c
@@ -50,6 +50,12 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
                                FIELD_EX32(info->idr[0], IDR0, ATS));
     }
 
+    /* Update RIL if auto from info */
+    if (s->ril == ON_OFF_AUTO_AUTO) {
+        s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL,
+                               FIELD_EX32(info->idr[3], IDR3, RIL));
+    }
+
     accel->auto_finalised = true;
 }
 
@@ -945,7 +951,8 @@ void smmuv3_accel_init(SMMUv3State *s)
     bs->iommu_ops = &smmuv3_accel_ops;
     smmuv3_accel_as_init(s);
 
-    if (s->ats == ON_OFF_AUTO_AUTO) {
+    if (s->ats == ON_OFF_AUTO_AUTO ||
+        s->ril == ON_OFF_AUTO_AUTO) {
         s->s_accel->auto_mode = true;
     }
 }
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index f353865187..a2d2f0e3bc 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -1973,10 +1973,6 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
     }
 #endif
 
-    if (s->ril == ON_OFF_AUTO_AUTO) {
-        error_setg(errp, "ril auto mode is not supported");
-        return false;
-    }
     if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
         error_setg(errp, "ssidsize auto mode is not supported");
         return false;
@@ -2188,8 +2184,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
         "Enable SMMUv3 accelerator support. Allows host SMMUv3 to be "
         "configured in nested mode for vfio-pci dev assignment");
     object_class_property_set_description(klass, "ril",
-        "Disable range invalidation support (for accel=on). ril=auto "
-        "is not supported.");
+        "Disable range invalidation support (for accel=on).");
     object_class_property_set_description(klass, "ats",
         "Enable/disable ATS support (for accel=on). Please ensure host "
         "platform has ATS support before enabling this.");
-- 
2.43.0

[PATCH 06/11] hw/arm/smmuv3: Change the default ril support to match the host

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Set the default value of RIL to auto. The default for RIL support used
to be set to on, but we change it to match what the host IOMMU
properties report so that users do not have to introspect host IDR3 for
Range Invalidation support. Include the previous default for ril in the
11.0 compat.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3.c   | 2 +-
 hw/core/machine.c | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index a2d2f0e3bc..74cc81ae32 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -2153,7 +2153,7 @@ static const Property smmuv3_properties[] = {
     /* GPA of MSI doorbell, for SMMUv3 accel use. */
     DEFINE_PROP_UINT64("msi-gpa", SMMUv3State, msi_gpa, 0),
     /* RIL can be turned off for accel cases */
-    DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_ON),
+    DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_AUTO),
     DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_AUTO),
     DEFINE_PROP_OAS_MODE("oas", SMMUv3State, oas, OAS_MODE_44),
     DEFINE_PROP_SSIDSIZE_MODE("ssidsize", SMMUv3State, ssidsize,
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 6796ab63cc..8f8c26bbe8 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -41,6 +41,7 @@
 
 GlobalProperty hw_compat_11_0[] = {
     { TYPE_ARM_SMMUV3, "ats", "off" },
+    { TYPE_ARM_SMMUV3, "ril", "on" },
 };
 
 GlobalProperty hw_compat_10_2[] = {
-- 
2.43.0

[PATCH 07/11] hw/arm/smmuv3-accel: Implement "auto" value for "ssidsize"

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Allow accelerated SMMUv3 SSID size property to be derived from host
IOMMU capabilities. Derive host values using IOMMU_GET_HW_INFO,
retrieving SSID size from IDR1. When the auto SSID size is resolved
to a non-zero value, PASID capability is advertised to the vIOMMU
and accelerated use cases such as Shared Virtual Addressing (SVA)
are supported.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3-accel.c | 14 ++++++++++++--
 hw/arm/smmuv3.c       | 11 +++++------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
index 9e7ec6a930..03393fd7ba 100644
--- a/hw/arm/smmuv3-accel.c
+++ b/hw/arm/smmuv3-accel.c
@@ -56,6 +56,13 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
                                FIELD_EX32(info->idr[3], IDR3, RIL));
     }
 
+    /* Update SSIDSIZE if auto from info */
+    if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
+        /* Store for get_viommu_flags() to determine PASID support */
+        s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SSIDSIZE,
+                               FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
+    }
+
     accel->auto_finalised = true;
 }
 
@@ -828,7 +835,9 @@ static uint64_t smmuv3_accel_get_viommu_flags(void *opaque)
     SMMUState *bs = opaque;
     SMMUv3State *s = ARM_SMMUV3(bs);
 
-    if (s->ssidsize > SSID_SIZE_MODE_0) {
+    if (s->ssidsize > SSID_SIZE_MODE_0 ||
+        (s->ssidsize == SSID_SIZE_MODE_AUTO &&
+         FIELD_EX32(s->idr[1], IDR1, SSIDSIZE))) {
         flags |= VIOMMU_FLAG_PASID_SUPPORTED;
     }
     return flags;
@@ -952,7 +961,8 @@ void smmuv3_accel_init(SMMUv3State *s)
     smmuv3_accel_as_init(s);
 
     if (s->ats == ON_OFF_AUTO_AUTO ||
-        s->ril == ON_OFF_AUTO_AUTO) {
+        s->ril == ON_OFF_AUTO_AUTO ||
+        s->ssidsize == SSID_SIZE_MODE_AUTO) {
         s->s_accel->auto_mode = true;
     }
 }
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 74cc81ae32..67c499d22b 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -627,7 +627,10 @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
     }
 
     /* Multiple context descriptors require SubstreamID support */
-    if (s->ssidsize == SSID_SIZE_MODE_0 && STE_S1CDMAX(ste) != 0) {
+    if ((s->ssidsize == SSID_SIZE_MODE_0 ||
+         (s->ssidsize == SSID_SIZE_MODE_AUTO &&
+          !FIELD_EX32(s->idr[1], IDR1, SSIDSIZE))) &&
+        STE_S1CDMAX(ste) != 0) {
         qemu_log_mask(LOG_UNIMP,
                 "SMMUv3: multiple S1 context descriptors require SubstreamID support. "
                 "Configure ssidsize > 0 (requires accel=on)\n");
@@ -1973,10 +1976,6 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
     }
 #endif
 
-    if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
-        error_setg(errp, "ssidsize auto mode is not supported");
-        return false;
-    }
     if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
         error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48 bit"
                    "OAS; other OasMode values are not supported");
@@ -2197,7 +2196,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
         "A value of N allows SSIDs in the range [0 .. 2^N - 1]. "
         "Valid range is 0-20, where 0 disables SubstreamID support. "
         "Defaults to 0. A value greater than 0 is required to enable "
-        "PASID support. ssidsize=auto is not supported.");
+        "PASID support.");
 }
 
 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
-- 
2.43.0

[PATCH 08/11] hw/arm/smmuv3: Change the default ssidsize to match the host

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Set the default ssidsize value to auto. The default SSID size used
to be 0, but we change it to match what the host IOMMU properties
report so that users do not have to introspect host IDR1 for the
Substream ID support.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3.c   | 4 ++--
 hw/core/machine.c | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 67c499d22b..cb14a08a66 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -2156,7 +2156,7 @@ static const Property smmuv3_properties[] = {
     DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_AUTO),
     DEFINE_PROP_OAS_MODE("oas", SMMUv3State, oas, OAS_MODE_44),
     DEFINE_PROP_SSIDSIZE_MODE("ssidsize", SMMUv3State, ssidsize,
-                              SSID_SIZE_MODE_0),
+                              SSID_SIZE_MODE_AUTO),
 };
 
 static void smmuv3_instance_init(Object *obj)
@@ -2195,7 +2195,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
         "Number of bits used to represent SubstreamIDs (SSIDs). "
         "A value of N allows SSIDs in the range [0 .. 2^N - 1]. "
         "Valid range is 0-20, where 0 disables SubstreamID support. "
-        "Defaults to 0. A value greater than 0 is required to enable "
+        "Defaults to auto. A value greater than 0 is required to enable "
         "PASID support.");
 }
 
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 8f8c26bbe8..aa208a2d9a 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -42,6 +42,7 @@
 GlobalProperty hw_compat_11_0[] = {
     { TYPE_ARM_SMMUV3, "ats", "off" },
     { TYPE_ARM_SMMUV3, "ril", "on" },
+    { TYPE_ARM_SMMUV3, "ssidsize", "0" },
 };
 
 GlobalProperty hw_compat_10_2[] = {
-- 
2.43.0

[PATCH 09/11] hw/arm/smmuv3-accel: Implement "auto" value for "oas"

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Allow accelerated SMMUv3 OAS property to be derived from host IOMMU
capabilities. Derive host values using IOMMU_GET_HW_INFO, retrieving
OAS from IDR5.

This keeps the OAS value advertised by the virtual SMMU compatible with
the capabilities of the host SMMUv3, so that the intermediate physical
addresses (IPA) consumed by host SMMU for stage-2 translation do not
exceed the host's max supported IPA size.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3-accel.c | 9 ++++++++-
 hw/arm/smmuv3.c       | 6 +++---
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
index 03393fd7ba..105f6d26bf 100644
--- a/hw/arm/smmuv3-accel.c
+++ b/hw/arm/smmuv3-accel.c
@@ -63,6 +63,12 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
                                FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
     }
 
+    /* Update OAS if auto from info */
+    if (s->oas == OAS_MODE_AUTO) {
+        s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS,
+                               FIELD_EX32(info->idr[5], IDR5, OAS));
+    }
+
     accel->auto_finalised = true;
 }
 
@@ -962,7 +968,8 @@ void smmuv3_accel_init(SMMUv3State *s)
 
     if (s->ats == ON_OFF_AUTO_AUTO ||
         s->ril == ON_OFF_AUTO_AUTO ||
-        s->ssidsize == SSID_SIZE_MODE_AUTO) {
+        s->ssidsize == SSID_SIZE_MODE_AUTO ||
+        s->oas == OAS_MODE_AUTO) {
         s->s_accel->auto_mode = true;
     }
 }
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index cb14a08a66..0ab6d1e762 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -1976,7 +1976,8 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
     }
 #endif
 
-    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
+    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48 &&
+        s->oas != OAS_MODE_AUTO) {
         error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48 bit"
                    "OAS; other OasMode values are not supported");
         return false;
@@ -2189,8 +2190,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
         "platform has ATS support before enabling this.");
     object_class_property_set_description(klass, "oas",
         "Specify Output Address Size (for accel=on). Supported values "
-        "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "
-        "supported.");
+        "are 44 or 48 bits. Defaults to 44 bits.");
     object_class_property_set_description(klass, "ssidsize",
         "Number of bits used to represent SubstreamIDs (SSIDs). "
         "A value of N allows SSIDs in the range [0 .. 2^N - 1]. "
-- 
2.43.0

[PATCH 10/11] hw/arm/smmuv3: Change the default oas to match the host

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Set the default oas value to auto. The default Output Address Size used
to be 44-bit, but we change it to match what the host IOMMU properties
report so that users do not have to introspect host IDR5 for the OAS.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3.c   | 4 ++--
 hw/core/machine.c | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 0ab6d1e762..7d537b7947 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -2155,7 +2155,7 @@ static const Property smmuv3_properties[] = {
     /* RIL can be turned off for accel cases */
     DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_AUTO),
     DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_AUTO),
-    DEFINE_PROP_OAS_MODE("oas", SMMUv3State, oas, OAS_MODE_44),
+    DEFINE_PROP_OAS_MODE("oas", SMMUv3State, oas, OAS_MODE_AUTO),
     DEFINE_PROP_SSIDSIZE_MODE("ssidsize", SMMUv3State, ssidsize,
                               SSID_SIZE_MODE_AUTO),
 };
@@ -2190,7 +2190,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
         "platform has ATS support before enabling this.");
     object_class_property_set_description(klass, "oas",
         "Specify Output Address Size (for accel=on). Supported values "
-        "are 44 or 48 bits. Defaults to 44 bits.");
+        "are 44 or 48 bits. Defaults to auto.");
     object_class_property_set_description(klass, "ssidsize",
         "Number of bits used to represent SubstreamIDs (SSIDs). "
         "A value of N allows SSIDs in the range [0 .. 2^N - 1]. "
diff --git a/hw/core/machine.c b/hw/core/machine.c
index aa208a2d9a..a668bb2ec3 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -43,6 +43,7 @@ GlobalProperty hw_compat_11_0[] = {
     { TYPE_ARM_SMMUV3, "ats", "off" },
     { TYPE_ARM_SMMUV3, "ril", "on" },
     { TYPE_ARM_SMMUV3, "ssidsize", "0" },
+    { TYPE_ARM_SMMUV3, "oas", "44" },
 };
 
 GlobalProperty hw_compat_10_2[] = {
-- 
2.43.0

[PATCH 11/11] qemu-options.hx: Support "auto" for accel SMMUv3 properties

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Update documentation now that "auto" is supported for accelerated SMMUv3
properties.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 qemu-options.hx | 1 -
 1 file changed, 1 deletion(-)

diff --git a/qemu-options.hx b/qemu-options.hx
index 21972f8326..bd43258445 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1292,7 +1292,6 @@ SRST
         vfio-pci passthrough.
 
      The following options are available when accel=on.
-     Note: 'auto' mode is not currently supported.
 
     ``ril=on|off`` (default: on)
         Support for Range Invalidation, which allows the SMMUv3 driver to
-- 
2.43.0

Re: [PATCH 01/11] hw/arm/smmuv3-accel: Add helper for resolving auto parameters

[Eric Auger]

Hi Nathan,

On 4/1/26 3:02 AM, Nathan Chen wrote:
> From: Nathan Chen <nathanc@nvidia.com>
>
> Introduce smmuv3_accel_auto_finalise() to resolve properties that are
> set to 'auto' for accelerated SMMUv3. This helper function allows
> properties such as ats, ril, ssidsize, and oas support to be resolved
> from host IOMMU capabilities via IOMMU_GET_HW_INFO.
>
> Auto mode requires at least one cold-plugged device to retrieve and
> finalise these properties. Register a machine_init_done notifier to
> verify this requirement and fail boot if it is not met.
>
> Hot-plugged devices into an accel SMMUv3-associated bus will re-use
> the resolved host values from the initial cold-plug.
>
> Subsequent patches will make use of this helper to resolve 'auto' to
> what is reported by host IOMMU capabilities.
>
> Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3-accel.c   | 14 ++++++++++++++
>  hw/arm/smmuv3-accel.h   |  2 ++
>  hw/arm/smmuv3.c         | 20 ++++++++++++++++++++
>  include/hw/arm/smmuv3.h |  2 ++
>  4 files changed, 38 insertions(+)
>
> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
> index 65c2f44880..a0146c8d31 100644
> --- a/hw/arm/smmuv3-accel.c
> +++ b/hw/arm/smmuv3-accel.c
> @@ -35,11 +35,25 @@ static int smmuv3_oas_bits(uint32_t oas)
>      return map[oas];
>  }
>  
> +static void smmuv3_accel_auto_finalise(SMMUv3State *s,
> +                                       struct iommu_hw_info_arm_smmuv3 *info) {
> +    SMMUv3AccelState *accel = s->s_accel;
> +
> +    /* Return if no auto for any or finalised already */
> +    if (!accel->auto_mode || accel->auto_finalised) {
I think you need to explain the commit message when auto_mode is going
to be set (I guess at least once an accel  prop is set to auto mode).

Also can you detail this case where smmuv3_accel_auto_finalise() would
be called several times. Here we return directly without looking again
at the prop values. Would it be meaningful to continue and check the
collected info matches the ones already collected? Can it happen?

An alternative would have been to fall back to default values in case no
cold plugged host dev could be found. Can you motivate that choice in
the commit msg?
> +        return;
> +    }
> +
> +    accel->auto_finalised = true;
> +}
> +
>  static bool
>  smmuv3_accel_check_hw_compatible(SMMUv3State *s,
>                                   struct iommu_hw_info_arm_smmuv3 *info,
>                                   Error **errp)
>  {
> +    smmuv3_accel_auto_finalise(s, info);
> +
>      /* QEMU SMMUv3 supports both linear and 2-level stream tables */
>      if (FIELD_EX32(info->idr[0], IDR0, STLEVEL) !=
>                  FIELD_EX32(s->idr[0], IDR0, STLEVEL)) {
> diff --git a/hw/arm/smmuv3-accel.h b/hw/arm/smmuv3-accel.h
> index dba6c71de5..3c1cd55714 100644
> --- a/hw/arm/smmuv3-accel.h
> +++ b/hw/arm/smmuv3-accel.h
> @@ -26,6 +26,8 @@ typedef struct SMMUv3AccelState {
>      uint32_t bypass_hwpt_id;
>      uint32_t abort_hwpt_id;
>      QLIST_HEAD(, SMMUv3AccelDevice) device_list;
> +    bool auto_mode;
> +    bool auto_finalised;
>  } SMMUv3AccelState;
>  
>  typedef struct SMMUS1Hwpt {
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index 7fead1c3cf..09ea08eb18 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -37,6 +37,7 @@
>  #include "smmuv3-accel.h"
>  #include "smmuv3-internal.h"
>  #include "smmu-internal.h"
> +#include "system/system.h"
>  
>  #define PTW_RECORD_FAULT(ptw_info, cfg) (((ptw_info).stage == SMMU_STAGE_1 && \
>                                          (cfg)->record_faults) || \
> @@ -2020,6 +2021,22 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>      return true;
>  }
>  
> +static void smmuv3_machine_done(Notifier *notifier, void *data)
> +{
> +    SMMUv3State *s = container_of(notifier, SMMUv3State, machine_done);
> +    SMMUv3AccelState *accel = s->s_accel;
> +
> +    if (!s->accel) {
> +        return;
> +    }
> +
> +    if (accel->auto_mode && !accel->auto_finalised) {
> +        error_report("arm-smmuv3 accel=on with 'auto' properties requires "
> +                     "at least one cold-plugged VFIO device");
> +        exit(1);
> +    }
> +}
> +
>  static void smmu_realize(DeviceState *d, Error **errp)
>  {
>      SMMUState *sys = ARM_SMMU(d);
> @@ -2058,6 +2075,9 @@ static void smmu_realize(DeviceState *d, Error **errp)
>  
>      smmu_init_irq(s, dev);
>      smmuv3_init_id_regs(s);
> +
> +    s->machine_done.notify = smmuv3_machine_done;
> +    qemu_add_machine_init_done_notifier(&s->machine_done);
can't you move smmuv3_machine_done in smmuv3-accel.c and also call 

qemu_add_machine_init_done_notifier from smmuv3_accel_init()?

Eric

>  }
>  
>  static const VMStateDescription vmstate_smmuv3_queue = {
> diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
> index 82f18eb090..fe0493c1aa 100644
> --- a/include/hw/arm/smmuv3.h
> +++ b/include/hw/arm/smmuv3.h
> @@ -74,6 +74,8 @@ struct SMMUv3State {
>      OnOffAuto ats;
>      OasMode oas;
>      SsidSizeMode ssidsize;
> +
> +    Notifier machine_done;
>  };
>  
>  typedef enum {

Re: [PATCH 02/11] hw/arm/smmuv3-accel: Implement "auto" value for "ats"

[Eric Auger]

On 4/1/26 3:02 AM, Nathan Chen wrote:
> From: Nathan Chen <nathanc@nvidia.com>
>
> Allow accelerated SMMUv3 Address Translation Services support property
> to be derived from host IOMMU capabilities. Derive host values using
> IOMMU_GET_HW_INFO, retrieving ATS capability from IDR0.
>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3-accel.c | 10 ++++++++++
>  hw/arm/smmuv3.c       |  7 +------
>  2 files changed, 11 insertions(+), 6 deletions(-)
>
> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
> index a0146c8d31..a835c8f220 100644
> --- a/hw/arm/smmuv3-accel.c
> +++ b/hw/arm/smmuv3-accel.c
> @@ -44,6 +44,12 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
>          return;
>      }
>  
> +    /* Update ATS if auto from info */
> +    if (s->ats == ON_OFF_AUTO_AUTO) {
> +        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ATS,
> +                               FIELD_EX32(info->idr[0], IDR0, ATS));
> +    }
> +
>      accel->auto_finalised = true;
>  }
>  
> @@ -938,4 +944,8 @@ void smmuv3_accel_init(SMMUv3State *s)
>      s->s_accel = g_new0(SMMUv3AccelState, 1);
>      bs->iommu_ops = &smmuv3_accel_ops;
>      smmuv3_accel_as_init(s);
> +
> +    if (s->ats == ON_OFF_AUTO_AUTO) {
> +        s->s_accel->auto_mode = true;
> +    }
>  }
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index 09ea08eb18..f3603554e3 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -1973,10 +1973,6 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>      }
>  #endif
>  
> -    if (s->ats == ON_OFF_AUTO_AUTO) {
> -        error_setg(errp, "ats auto mode is not supported");
> -        return false;
> -    }
>      if (s->ril == ON_OFF_AUTO_AUTO) {
>          error_setg(errp, "ril auto mode is not supported");
>          return false;
> @@ -2196,8 +2192,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
>          "is not supported.");
>      object_class_property_set_description(klass, "ats",
>          "Enable/disable ATS support (for accel=on). Please ensure host "
> -        "platform has ATS support before enabling this. ats=auto is not "
> -        "supported.");
I would explicitly mention that auto value is supported.
Maybe:
Set ATS support. Valid values are off/on/auto. If set to on, make sure
the host platform supports ATS.

You have examples in hw/arm/virt.c. For instance msi option.

Also note that the doc in qemu-options.hx must also be updated. 

Eric
> +        "platform has ATS support before enabling this.");
>      object_class_property_set_description(klass, "oas",
>          "Specify Output Address Size (for accel=on). Supported values "
>          "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "

Re: [PATCH 01/11] hw/arm/smmuv3-accel: Add helper for resolving auto parameters

[Eric Auger]

On 4/1/26 3:02 AM, Nathan Chen wrote:
> From: Nathan Chen <nathanc@nvidia.com>
>
> Introduce smmuv3_accel_auto_finalise() to resolve properties that are
> set to 'auto' for accelerated SMMUv3. This helper function allows
> properties such as ats, ril, ssidsize, and oas support to be resolved
> from host IOMMU capabilities via IOMMU_GET_HW_INFO.
>
> Auto mode requires at least one cold-plugged device to retrieve and
> finalise these properties. Register a machine_init_done notifier to
> verify this requirement and fail boot if it is not met.
>
> Hot-plugged devices into an accel SMMUv3-associated bus will re-use
> the resolved host values from the initial cold-plug.
>
> Subsequent patches will make use of this helper to resolve 'auto' to
> what is reported by host IOMMU capabilities.
>
> Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3-accel.c   | 14 ++++++++++++++
>  hw/arm/smmuv3-accel.h   |  2 ++
>  hw/arm/smmuv3.c         | 20 ++++++++++++++++++++
>  include/hw/arm/smmuv3.h |  2 ++
>  4 files changed, 38 insertions(+)
>
> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
> index 65c2f44880..a0146c8d31 100644
> --- a/hw/arm/smmuv3-accel.c
> +++ b/hw/arm/smmuv3-accel.c
> @@ -35,11 +35,25 @@ static int smmuv3_oas_bits(uint32_t oas)
>      return map[oas];
>  }
>  
> +static void smmuv3_accel_auto_finalise(SMMUv3State *s,
> +                                       struct iommu_hw_info_arm_smmuv3 *info) {
> +    SMMUv3AccelState *accel = s->s_accel;
> +
> +    /* Return if no auto for any or finalised already */
> +    if (!accel->auto_mode || accel->auto_finalised) {
> +        return;
> +    }
> +
> +    accel->auto_finalised = true;
> +}
> +
>  static bool
>  smmuv3_accel_check_hw_compatible(SMMUv3State *s,
>                                   struct iommu_hw_info_arm_smmuv3 *info,
>                                   Error **errp)
>  {
> +    smmuv3_accel_auto_finalise(s, info);
> +
>      /* QEMU SMMUv3 supports both linear and 2-level stream tables */
>      if (FIELD_EX32(info->idr[0], IDR0, STLEVEL) !=
>                  FIELD_EX32(s->idr[0], IDR0, STLEVEL)) {
> diff --git a/hw/arm/smmuv3-accel.h b/hw/arm/smmuv3-accel.h
> index dba6c71de5..3c1cd55714 100644
> --- a/hw/arm/smmuv3-accel.h
> +++ b/hw/arm/smmuv3-accel.h
> @@ -26,6 +26,8 @@ typedef struct SMMUv3AccelState {
>      uint32_t bypass_hwpt_id;
>      uint32_t abort_hwpt_id;
>      QLIST_HEAD(, SMMUv3AccelDevice) device_list;
> +    bool auto_mode;
> +    bool auto_finalised;
>  } SMMUv3AccelState;
>  
>  typedef struct SMMUS1Hwpt {
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index 7fead1c3cf..09ea08eb18 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -37,6 +37,7 @@
>  #include "smmuv3-accel.h"
>  #include "smmuv3-internal.h"
>  #include "smmu-internal.h"
> +#include "system/system.h"
>  
>  #define PTW_RECORD_FAULT(ptw_info, cfg) (((ptw_info).stage == SMMU_STAGE_1 && \
>                                          (cfg)->record_faults) || \
> @@ -2020,6 +2021,22 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>      return true;
>  }
>  
> +static void smmuv3_machine_done(Notifier *notifier, void *data)
> +{
> +    SMMUv3State *s = container_of(notifier, SMMUv3State, machine_done);
> +    SMMUv3AccelState *accel = s->s_accel;
> +
> +    if (!s->accel) {
> +        return;
> +    }
> +
> +    if (accel->auto_mode && !accel->auto_finalised) {
> +        error_report("arm-smmuv3 accel=on with 'auto' properties requires "
> +                     "at least one cold-plugged VFIO device");
> +        exit(1);
> +    }
> +}
> +
>  static void smmu_realize(DeviceState *d, Error **errp)
>  {
>      SMMUState *sys = ARM_SMMU(d);
> @@ -2058,6 +2075,9 @@ static void smmu_realize(DeviceState *d, Error **errp)
>  
>      smmu_init_irq(s, dev);
>      smmuv3_init_id_regs(s);
> +
> +    s->machine_done.notify = smmuv3_machine_done;
> +    qemu_add_machine_init_done_notifier(&s->machine_done);
you might also register the machine done notifier only in case auto_mode
is set

Eric
>  }
>  
>  static const VMStateDescription vmstate_smmuv3_queue = {
> diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
> index 82f18eb090..fe0493c1aa 100644
> --- a/include/hw/arm/smmuv3.h
> +++ b/include/hw/arm/smmuv3.h
> @@ -74,6 +74,8 @@ struct SMMUv3State {
>      OnOffAuto ats;
>      OasMode oas;
>      SsidSizeMode ssidsize;
> +
> +    Notifier machine_done;
>  };
>  
>  typedef enum {

Re: [PATCH 06/11] hw/arm/smmuv3: Change the default ril support to match the host

[Eric Auger]

Hi Nathan,

On 4/1/26 3:02 AM, Nathan Chen wrote:
> From: Nathan Chen <nathanc@nvidia.com>
>
> Set the default value of RIL to auto. The default for RIL support used
> to be set to on, but we change it to match what the host IOMMU
> properties report so that users do not have to introspect host IDR3 for
> Range Invalidation support. Include the previous default for ril in the
> 11.0 compat.
>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3.c   | 2 +-
>  hw/core/machine.c | 1 +
>  2 files changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index a2d2f0e3bc..74cc81ae32 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -2153,7 +2153,7 @@ static const Property smmuv3_properties[] = {
>      /* GPA of MSI doorbell, for SMMUv3 accel use. */
>      DEFINE_PROP_UINT64("msi-gpa", SMMUv3State, msi_gpa, 0),
>      /* RIL can be turned off for accel cases */
> -    DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_ON),
> +    DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_AUTO),
>      DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_AUTO),
>      DEFINE_PROP_OAS_MODE("oas", SMMUv3State, oas, OAS_MODE_44),
>      DEFINE_PROP_SSIDSIZE_MODE("ssidsize", SMMUv3State, ssidsize,
> diff --git a/hw/core/machine.c b/hw/core/machine.c
> index 6796ab63cc..8f8c26bbe8 100644
> --- a/hw/core/machine.c
> +++ b/hw/core/machine.c
> @@ -41,6 +41,7 @@
>  
>  GlobalProperty hw_compat_11_0[] = {
>      { TYPE_ARM_SMMUV3, "ats", "off" },
> +    { TYPE_ARM_SMMUV3, "ril", "on" },
I wonder if you shouldn't squash all the patches that change the default
values of accel props to auto mode into a single patch, at the end of
the series.

Eric
>  };
>  
>  GlobalProperty hw_compat_10_2[] = {

Re: [PATCH 03/11] hw/arm/smmuv3: Change the default ats support to match the host

[Eric Auger]

On 4/1/26 3:02 AM, Nathan Chen wrote:
> From: Nathan Chen <nathanc@nvidia.com>
>
> Set the default value of ATS to auto. The default for ATS support used
> to be set to off, but we change it to match what the host IOMMU
> properties report. Introduce a new compat for the changed default.
>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3.c   | 2 +-
>  hw/core/machine.c | 5 +++++
>  2 files changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index f3603554e3..f353865187 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -2158,7 +2158,7 @@ static const Property smmuv3_properties[] = {
>      DEFINE_PROP_UINT64("msi-gpa", SMMUv3State, msi_gpa, 0),
>      /* RIL can be turned off for accel cases */
>      DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_ON),
> -    DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_OFF),
> +    DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_AUTO),
see my previous comment about squashing all those patches. Besides you
need to update qemu-options.hx where the default value is documented as
non auto.

Eric
>      DEFINE_PROP_OAS_MODE("oas", SMMUv3State, oas, OAS_MODE_44),
>      DEFINE_PROP_SSIDSIZE_MODE("ssidsize", SMMUv3State, ssidsize,
>                                SSID_SIZE_MODE_0),
> diff --git a/hw/core/machine.c b/hw/core/machine.c
> index 0aa77a57e9..6796ab63cc 100644
> --- a/hw/core/machine.c
> +++ b/hw/core/machine.c
> @@ -37,6 +37,11 @@
>  #include "hw/virtio/virtio-iommu.h"
>  #include "hw/acpi/generic_event_device.h"
>  #include "qemu/audio.h"
> +#include "hw/arm/smmuv3.h"
> +
> +GlobalProperty hw_compat_11_0[] = {
> +    { TYPE_ARM_SMMUV3, "ats", "off" },
> +};
>  
>  GlobalProperty hw_compat_10_2[] = {
>      { "scsi-block", "migrate-pr", "off" },

Re: [PATCH 05/11] hw/arm/smmuv3-accel: Implement "auto" value for "ril"

[Eric Auger]

On 4/1/26 3:02 AM, Nathan Chen wrote:
> From: Nathan Chen <nathanc@nvidia.com>
>
> Allow accelerated SMMUv3 Range Invalidation support property to be
> derived from host IOMMU capabilities. Derive host values using
> IOMMU_GET_HW_INFO, retrieving RIL capability from IDR3.
>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3-accel.c | 9 ++++++++-
>  hw/arm/smmuv3.c       | 7 +------
>  2 files changed, 9 insertions(+), 7 deletions(-)
>
> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
> index a835c8f220..9e7ec6a930 100644
> --- a/hw/arm/smmuv3-accel.c
> +++ b/hw/arm/smmuv3-accel.c
> @@ -50,6 +50,12 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
>                                 FIELD_EX32(info->idr[0], IDR0, ATS));
>      }
>  
> +    /* Update RIL if auto from info */
not sure that kind of comment is really useful.
> +    if (s->ril == ON_OFF_AUTO_AUTO) {
> +        s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL,
> +                               FIELD_EX32(info->idr[3], IDR3, RIL));
> +    }
> +
>      accel->auto_finalised = true;
>  }
>  
> @@ -945,7 +951,8 @@ void smmuv3_accel_init(SMMUv3State *s)
>      bs->iommu_ops = &smmuv3_accel_ops;
>      smmuv3_accel_as_init(s);
>  
> -    if (s->ats == ON_OFF_AUTO_AUTO) {
> +    if (s->ats == ON_OFF_AUTO_AUTO ||
> +        s->ril == ON_OFF_AUTO_AUTO) {
>          s->s_accel->auto_mode = true;
>      }
>  }
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index f353865187..a2d2f0e3bc 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -1973,10 +1973,6 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>      }
>  #endif
>  
> -    if (s->ril == ON_OFF_AUTO_AUTO) {
> -        error_setg(errp, "ril auto mode is not supported");
> -        return false;
> -    }
>      if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
>          error_setg(errp, "ssidsize auto mode is not supported");
>          return false;
> @@ -2188,8 +2184,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
>          "Enable SMMUv3 accelerator support. Allows host SMMUv3 to be "
>          "configured in nested mode for vfio-pci dev assignment");
>      object_class_property_set_description(klass, "ril",
> -        "Disable range invalidation support (for accel=on). ril=auto "
> -        "is not supported.");
> +        "Disable range invalidation support (for accel=on).");
same comment as before. Suggesting "Set RIL value. Valid values ..."
+ qemu-options.hx updates.

Eric
>      object_class_property_set_description(klass, "ats",
>          "Enable/disable ATS support (for accel=on). Please ensure host "
>          "platform has ATS support before enabling this.");

Re: [PATCH 09/11] hw/arm/smmuv3-accel: Implement "auto" value for "oas"

[Eric Auger]

On 4/1/26 3:02 AM, Nathan Chen wrote:
> From: Nathan Chen <nathanc@nvidia.com>
>
> Allow accelerated SMMUv3 OAS property to be derived from host IOMMU
> capabilities. Derive host values using IOMMU_GET_HW_INFO, retrieving
> OAS from IDR5.
>
> This keeps the OAS value advertised by the virtual SMMU compatible with
> the capabilities of the host SMMUv3, so that the intermediate physical
> addresses (IPA) consumed by host SMMU for stage-2 translation do not
> exceed the host's max supported IPA size.
>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3-accel.c | 9 ++++++++-
>  hw/arm/smmuv3.c       | 6 +++---
>  2 files changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
> index 03393fd7ba..105f6d26bf 100644
> --- a/hw/arm/smmuv3-accel.c
> +++ b/hw/arm/smmuv3-accel.c
> @@ -63,6 +63,12 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
>                                 FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
>      }
>  
> +    /* Update OAS if auto from info */
> +    if (s->oas == OAS_MODE_AUTO) {
> +        s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS,
> +                               FIELD_EX32(info->idr[5], IDR5, OAS));
> +    }
> +
>      accel->auto_finalised = true;
>  }
>  
> @@ -962,7 +968,8 @@ void smmuv3_accel_init(SMMUv3State *s)
>  
>      if (s->ats == ON_OFF_AUTO_AUTO ||
>          s->ril == ON_OFF_AUTO_AUTO ||
> -        s->ssidsize == SSID_SIZE_MODE_AUTO) {
> +        s->ssidsize == SSID_SIZE_MODE_AUTO ||
> +        s->oas == OAS_MODE_AUTO) {
>          s->s_accel->auto_mode = true;
>      }
>  }
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index cb14a08a66..0ab6d1e762 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -1976,7 +1976,8 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>      }
>  #endif
>  
> -    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
> +    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48 &&
> +        s->oas != OAS_MODE_AUTO) {
>          error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48 bit"
>                     "OAS; other OasMode values are not supported");
and auto mode
>          return false;
> @@ -2189,8 +2190,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
>          "platform has ATS support before enabling this.");
>      object_class_property_set_description(klass, "oas",
>          "Specify Output Address Size (for accel=on). Supported values "
> -        "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "
> -        "supported.");
> +        "are 44 or 48 bits. Defaults to 44 bits.");
see previous comments

Eric
>      object_class_property_set_description(klass, "ssidsize",
>          "Number of bits used to represent SubstreamIDs (SSIDs). "
>          "A value of N allows SSIDs in the range [0 .. 2^N - 1]. "

Re: [PATCH 07/11] hw/arm/smmuv3-accel: Implement "auto" value for "ssidsize"

[Eric Auger]

On 4/1/26 3:02 AM, Nathan Chen wrote:
> From: Nathan Chen <nathanc@nvidia.com>
>
> Allow accelerated SMMUv3 SSID size property to be derived from host
> IOMMU capabilities. Derive host values using IOMMU_GET_HW_INFO,
> retrieving SSID size from IDR1. When the auto SSID size is resolved
> to a non-zero value, PASID capability is advertised to the vIOMMU
> and accelerated use cases such as Shared Virtual Addressing (SVA)
> are supported.
>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3-accel.c | 14 ++++++++++++--
>  hw/arm/smmuv3.c       | 11 +++++------
>  2 files changed, 17 insertions(+), 8 deletions(-)
>
> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
> index 9e7ec6a930..03393fd7ba 100644
> --- a/hw/arm/smmuv3-accel.c
> +++ b/hw/arm/smmuv3-accel.c
> @@ -56,6 +56,13 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
>                                 FIELD_EX32(info->idr[3], IDR3, RIL));
>      }
>  
> +    /* Update SSIDSIZE if auto from info */
> +    if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
> +        /* Store for get_viommu_flags() to determine PASID support */
> +        s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SSIDSIZE,
> +                               FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
> +    }
> +
>      accel->auto_finalised = true;
>  }
>  
> @@ -828,7 +835,9 @@ static uint64_t smmuv3_accel_get_viommu_flags(void *opaque)
>      SMMUState *bs = opaque;
>      SMMUv3State *s = ARM_SMMUV3(bs);
>  
> -    if (s->ssidsize > SSID_SIZE_MODE_0) {
> +    if (s->ssidsize > SSID_SIZE_MODE_0 ||
> +        (s->ssidsize == SSID_SIZE_MODE_AUTO &&
maybe worth adding a short static inline helper pasid_is_supported(s)?

Eric
> +         FIELD_EX32(s->idr[1], IDR1, SSIDSIZE))) {
>          flags |= VIOMMU_FLAG_PASID_SUPPORTED;
>      }
>      return flags;
> @@ -952,7 +961,8 @@ void smmuv3_accel_init(SMMUv3State *s)
>      smmuv3_accel_as_init(s);
>  
>      if (s->ats == ON_OFF_AUTO_AUTO ||
> -        s->ril == ON_OFF_AUTO_AUTO) {
> +        s->ril == ON_OFF_AUTO_AUTO ||
> +        s->ssidsize == SSID_SIZE_MODE_AUTO) {
>          s->s_accel->auto_mode = true;
>      }
>  }
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index 74cc81ae32..67c499d22b 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -627,7 +627,10 @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
>      }
>  
>      /* Multiple context descriptors require SubstreamID support */
> -    if (s->ssidsize == SSID_SIZE_MODE_0 && STE_S1CDMAX(ste) != 0) {
> +    if ((s->ssidsize == SSID_SIZE_MODE_0 ||
> +         (s->ssidsize == SSID_SIZE_MODE_AUTO &&
> +          !FIELD_EX32(s->idr[1], IDR1, SSIDSIZE))) &&
> +        STE_S1CDMAX(ste) != 0) {
>          qemu_log_mask(LOG_UNIMP,
>                  "SMMUv3: multiple S1 context descriptors require SubstreamID support. "
>                  "Configure ssidsize > 0 (requires accel=on)\n");
> @@ -1973,10 +1976,6 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>      }
>  #endif
>  
> -    if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
> -        error_setg(errp, "ssidsize auto mode is not supported");
> -        return false;
> -    }
>      if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
>          error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48 bit"
>                     "OAS; other OasMode values are not supported");
> @@ -2197,7 +2196,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
>          "A value of N allows SSIDs in the range [0 .. 2^N - 1]. "
>          "Valid range is 0-20, where 0 disables SubstreamID support. "
>          "Defaults to 0. A value greater than 0 is required to enable "
> -        "PASID support. ssidsize=auto is not supported.");
> +        "PASID support.");
>  }
>  
>  static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,

Re: [PATCH 01/11] hw/arm/smmuv3-accel: Add helper for resolving auto parameters

[Nathan Chen]

Hi Eric,

On 4/10/2026 12:26 AM, Eric Auger wrote:
> On 4/1/26 3:02 AM, Nathan Chen wrote:
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Introduce smmuv3_accel_auto_finalise() to resolve properties that are
>> set to 'auto' for accelerated SMMUv3. This helper function allows
>> properties such as ats, ril, ssidsize, and oas support to be resolved
>> from host IOMMU capabilities via IOMMU_GET_HW_INFO.
>>
>> Auto mode requires at least one cold-plugged device to retrieve and
>> finalise these properties. Register a machine_init_done notifier to
>> verify this requirement and fail boot if it is not met.
>>
>> Hot-plugged devices into an accel SMMUv3-associated bus will re-use
>> the resolved host values from the initial cold-plug.
>>
>> Subsequent patches will make use of this helper to resolve 'auto' to
>> what is reported by host IOMMU capabilities.
>>
>> Suggested-by: Shameer Kolothum<skolothumtho@nvidia.com>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3-accel.c   | 14 ++++++++++++++
>>   hw/arm/smmuv3-accel.h   |  2 ++
>>   hw/arm/smmuv3.c         | 20 ++++++++++++++++++++
>>   include/hw/arm/smmuv3.h |  2 ++
>>   4 files changed, 38 insertions(+)
>>
>> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
>> index 65c2f44880..a0146c8d31 100644
>> --- a/hw/arm/smmuv3-accel.c
>> +++ b/hw/arm/smmuv3-accel.c
>> @@ -35,11 +35,25 @@ static int smmuv3_oas_bits(uint32_t oas)
>>       return map[oas];
>>   }
>>   
>> +static void smmuv3_accel_auto_finalise(SMMUv3State *s,
>> +                                       struct iommu_hw_info_arm_smmuv3 *info) {
>> +    SMMUv3AccelState *accel = s->s_accel;
>> +
>> +    /* Return if no auto for any or finalised already */
>> +    if (!accel->auto_mode || accel->auto_finalised) {
> I think you need to explain the commit message when auto_mode is going
> to be set (I guess at least once an accel  prop is set to auto mode).
> 
> Also can you detail this case where smmuv3_accel_auto_finalise() would
> be called several times. Here we return directly without looking again
> at the prop values. Would it be meaningful to continue and check the
> collected info matches the ones already collected? Can it happen?
> 
> An alternative would have been to fall back to default values in case no
> cold plugged host dev could be found. Can you motivate that choice in
> the commit msg?
Ok, I will explain in the commit description auto_mode is set when an 
accel prop is explicitly set to auto mode, or if the accel prop is not 
set and defaults to auto mode per the later commits in this series.

smmuv3_accel_auto_finalise() would be called more than once in the hot 
plug case. We do not accept new property values in that case and re-use 
the values determined from initial cold plug.

arm-smmuv3 accel=on with 'auto' properties requires at least one 
cold-plugged VFIO device, otherwise initial VM boot will fail and it 
would not be possible to call smmuv3_accel_auto_finalise() more than 
once in that case.

>> +        return;
>> +    }
>> +
>> +    accel->auto_finalised = true;
>> +}
>> +
>>   static bool
>>   smmuv3_accel_check_hw_compatible(SMMUv3State *s,
>>                                    struct iommu_hw_info_arm_smmuv3 *info,
>>                                    Error **errp)
>>   {
>> +    smmuv3_accel_auto_finalise(s, info);
>> +
>>       /* QEMU SMMUv3 supports both linear and 2-level stream tables */
>>       if (FIELD_EX32(info->idr[0], IDR0, STLEVEL) !=
>>                   FIELD_EX32(s->idr[0], IDR0, STLEVEL)) {
>> diff --git a/hw/arm/smmuv3-accel.h b/hw/arm/smmuv3-accel.h
>> index dba6c71de5..3c1cd55714 100644
>> --- a/hw/arm/smmuv3-accel.h
>> +++ b/hw/arm/smmuv3-accel.h
>> @@ -26,6 +26,8 @@ typedef struct SMMUv3AccelState {
>>       uint32_t bypass_hwpt_id;
>>       uint32_t abort_hwpt_id;
>>       QLIST_HEAD(, SMMUv3AccelDevice) device_list;
>> +    bool auto_mode;
>> +    bool auto_finalised;
>>   } SMMUv3AccelState;
>>   
>>   typedef struct SMMUS1Hwpt {
>> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
>> index 7fead1c3cf..09ea08eb18 100644
>> --- a/hw/arm/smmuv3.c
>> +++ b/hw/arm/smmuv3.c
>> @@ -37,6 +37,7 @@
>>   #include "smmuv3-accel.h"
>>   #include "smmuv3-internal.h"
>>   #include "smmu-internal.h"
>> +#include "system/system.h"
>>   
>>   #define PTW_RECORD_FAULT(ptw_info, cfg) (((ptw_info).stage == SMMU_STAGE_1 && \
>>                                           (cfg)->record_faults) || \
>> @@ -2020,6 +2021,22 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>>       return true;
>>   }
>>   
>> +static void smmuv3_machine_done(Notifier *notifier, void *data)
>> +{
>> +    SMMUv3State *s = container_of(notifier, SMMUv3State, machine_done);
>> +    SMMUv3AccelState *accel = s->s_accel;
>> +
>> +    if (!s->accel) {
>> +        return;
>> +    }
>> +
>> +    if (accel->auto_mode && !accel->auto_finalised) {
>> +        error_report("arm-smmuv3 accel=on with 'auto' properties requires "
>> +                     "at least one cold-plugged VFIO device");
>> +        exit(1);
>> +    }
>> +}
>> +
>>   static void smmu_realize(DeviceState *d, Error **errp)
>>   {
>>       SMMUState *sys = ARM_SMMU(d);
>> @@ -2058,6 +2075,9 @@ static void smmu_realize(DeviceState *d, Error **errp)
>>   
>>       smmu_init_irq(s, dev);
>>       smmuv3_init_id_regs(s);
>> +
>> +    s->machine_done.notify = smmuv3_machine_done;
>> +    qemu_add_machine_init_done_notifier(&s->machine_done);
> can't you move smmuv3_machine_done in smmuv3-accel.c and also call
> 
> qemu_add_machine_init_done_notifier from smmuv3_accel_init()?
That makes sense, we can move the machine_done Notifier to 
SMMUv3AccelState since it's relevant to accel cases. I'll look into 
updating this.

Thanks,
Nathan

Re: [PATCH 01/11] hw/arm/smmuv3-accel: Add helper for resolving auto parameters

[Nathan Chen]

On 4/10/2026 12:37 AM, Eric Auger wrote:
> 
> On 4/1/26 3:02 AM, Nathan Chen wrote:
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Introduce smmuv3_accel_auto_finalise() to resolve properties that are
>> set to 'auto' for accelerated SMMUv3. This helper function allows
>> properties such as ats, ril, ssidsize, and oas support to be resolved
>> from host IOMMU capabilities via IOMMU_GET_HW_INFO.
>>
>> Auto mode requires at least one cold-plugged device to retrieve and
>> finalise these properties. Register a machine_init_done notifier to
>> verify this requirement and fail boot if it is not met.
>>
>> Hot-plugged devices into an accel SMMUv3-associated bus will re-use
>> the resolved host values from the initial cold-plug.
>>
>> Subsequent patches will make use of this helper to resolve 'auto' to
>> what is reported by host IOMMU capabilities.
>>
>> Suggested-by: Shameer Kolothum<skolothumtho@nvidia.com>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3-accel.c   | 14 ++++++++++++++
>>   hw/arm/smmuv3-accel.h   |  2 ++
>>   hw/arm/smmuv3.c         | 20 ++++++++++++++++++++
>>   include/hw/arm/smmuv3.h |  2 ++
>>   4 files changed, 38 insertions(+)
>>
>> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
>> index 65c2f44880..a0146c8d31 100644
>> --- a/hw/arm/smmuv3-accel.c
>> +++ b/hw/arm/smmuv3-accel.c
>> @@ -35,11 +35,25 @@ static int smmuv3_oas_bits(uint32_t oas)
>>       return map[oas];
>>   }
>>   
>> +static void smmuv3_accel_auto_finalise(SMMUv3State *s,
>> +                                       struct iommu_hw_info_arm_smmuv3 *info) {
>> +    SMMUv3AccelState *accel = s->s_accel;
>> +
>> +    /* Return if no auto for any or finalised already */
>> +    if (!accel->auto_mode || accel->auto_finalised) {
>> +        return;
>> +    }
>> +
>> +    accel->auto_finalised = true;
>> +}
>> +
>>   static bool
>>   smmuv3_accel_check_hw_compatible(SMMUv3State *s,
>>                                    struct iommu_hw_info_arm_smmuv3 *info,
>>                                    Error **errp)
>>   {
>> +    smmuv3_accel_auto_finalise(s, info);
>> +
>>       /* QEMU SMMUv3 supports both linear and 2-level stream tables */
>>       if (FIELD_EX32(info->idr[0], IDR0, STLEVEL) !=
>>                   FIELD_EX32(s->idr[0], IDR0, STLEVEL)) {
>> diff --git a/hw/arm/smmuv3-accel.h b/hw/arm/smmuv3-accel.h
>> index dba6c71de5..3c1cd55714 100644
>> --- a/hw/arm/smmuv3-accel.h
>> +++ b/hw/arm/smmuv3-accel.h
>> @@ -26,6 +26,8 @@ typedef struct SMMUv3AccelState {
>>       uint32_t bypass_hwpt_id;
>>       uint32_t abort_hwpt_id;
>>       QLIST_HEAD(, SMMUv3AccelDevice) device_list;
>> +    bool auto_mode;
>> +    bool auto_finalised;
>>   } SMMUv3AccelState;
>>   
>>   typedef struct SMMUS1Hwpt {
>> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
>> index 7fead1c3cf..09ea08eb18 100644
>> --- a/hw/arm/smmuv3.c
>> +++ b/hw/arm/smmuv3.c
>> @@ -37,6 +37,7 @@
>>   #include "smmuv3-accel.h"
>>   #include "smmuv3-internal.h"
>>   #include "smmu-internal.h"
>> +#include "system/system.h"
>>   
>>   #define PTW_RECORD_FAULT(ptw_info, cfg) (((ptw_info).stage == SMMU_STAGE_1 && \
>>                                           (cfg)->record_faults) || \
>> @@ -2020,6 +2021,22 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>>       return true;
>>   }
>>   
>> +static void smmuv3_machine_done(Notifier *notifier, void *data)
>> +{
>> +    SMMUv3State *s = container_of(notifier, SMMUv3State, machine_done);
>> +    SMMUv3AccelState *accel = s->s_accel;
>> +
>> +    if (!s->accel) {
>> +        return;
>> +    }
>> +
>> +    if (accel->auto_mode && !accel->auto_finalised) {
>> +        error_report("arm-smmuv3 accel=on with 'auto' properties requires "
>> +                     "at least one cold-plugged VFIO device");
>> +        exit(1);
>> +    }
>> +}
>> +
>>   static void smmu_realize(DeviceState *d, Error **errp)
>>   {
>>       SMMUState *sys = ARM_SMMU(d);
>> @@ -2058,6 +2075,9 @@ static void smmu_realize(DeviceState *d, Error **errp)
>>   
>>       smmu_init_irq(s, dev);
>>       smmuv3_init_id_regs(s);
>> +
>> +    s->machine_done.notify = smmuv3_machine_done;
>> +    qemu_add_machine_init_done_notifier(&s->machine_done);
> you might also register the machine done notifier only in case auto_mode
> is set
Yes, I'll incorporate this in the next revision.

Thanks,
Nathan

Re: [PATCH 02/11] hw/arm/smmuv3-accel: Implement "auto" value for "ats"

[Nathan Chen]

On 4/10/2026 12:36 AM, Eric Auger wrote:
> 
> On 4/1/26 3:02 AM, Nathan Chen wrote:
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Allow accelerated SMMUv3 Address Translation Services support property
>> to be derived from host IOMMU capabilities. Derive host values using
>> IOMMU_GET_HW_INFO, retrieving ATS capability from IDR0.
>>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3-accel.c | 10 ++++++++++
>>   hw/arm/smmuv3.c       |  7 +------
>>   2 files changed, 11 insertions(+), 6 deletions(-)
>>
>> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
>> index a0146c8d31..a835c8f220 100644
>> --- a/hw/arm/smmuv3-accel.c
>> +++ b/hw/arm/smmuv3-accel.c
>> @@ -44,6 +44,12 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
>>           return;
>>       }
>>   
>> +    /* Update ATS if auto from info */
>> +    if (s->ats == ON_OFF_AUTO_AUTO) {
>> +        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ATS,
>> +                               FIELD_EX32(info->idr[0], IDR0, ATS));
>> +    }
>> +
>>       accel->auto_finalised = true;
>>   }
>>   
>> @@ -938,4 +944,8 @@ void smmuv3_accel_init(SMMUv3State *s)
>>       s->s_accel = g_new0(SMMUv3AccelState, 1);
>>       bs->iommu_ops = &smmuv3_accel_ops;
>>       smmuv3_accel_as_init(s);
>> +
>> +    if (s->ats == ON_OFF_AUTO_AUTO) {
>> +        s->s_accel->auto_mode = true;
>> +    }
>>   }
>> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
>> index 09ea08eb18..f3603554e3 100644
>> --- a/hw/arm/smmuv3.c
>> +++ b/hw/arm/smmuv3.c
>> @@ -1973,10 +1973,6 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>>       }
>>   #endif
>>   
>> -    if (s->ats == ON_OFF_AUTO_AUTO) {
>> -        error_setg(errp, "ats auto mode is not supported");
>> -        return false;
>> -    }
>>       if (s->ril == ON_OFF_AUTO_AUTO) {
>>           error_setg(errp, "ril auto mode is not supported");
>>           return false;
>> @@ -2196,8 +2192,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
>>           "is not supported.");
>>       object_class_property_set_description(klass, "ats",
>>           "Enable/disable ATS support (for accel=on). Please ensure host "
>> -        "platform has ATS support before enabling this. ats=auto is not "
>> -        "supported.");
> I would explicitly mention that auto value is supported.
> Maybe:
> Set ATS support. Valid values are off/on/auto. If set to on, make sure
> the host platform supports ATS.
> 
> You have examples in hw/arm/virt.c. For instance msi option.
> 
> Also note that the doc in qemu-options.hx must also be updated.
Ok, I'll explicitly mention it's supported here and in qemu-options.hx.

Thanks,
Nathan

Re: [PATCH 03/11] hw/arm/smmuv3: Change the default ats support to match the host

[Nathan Chen]

On 4/10/2026 12:42 AM, Eric Auger wrote:
> 
> On 4/1/26 3:02 AM, Nathan Chen wrote:
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Set the default value of ATS to auto. The default for ATS support used
>> to be set to off, but we change it to match what the host IOMMU
>> properties report. Introduce a new compat for the changed default.
>>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3.c   | 2 +-
>>   hw/core/machine.c | 5 +++++
>>   2 files changed, 6 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
>> index f3603554e3..f353865187 100644
>> --- a/hw/arm/smmuv3.c
>> +++ b/hw/arm/smmuv3.c
>> @@ -2158,7 +2158,7 @@ static const Property smmuv3_properties[] = {
>>       DEFINE_PROP_UINT64("msi-gpa", SMMUv3State, msi_gpa, 0),
>>       /* RIL can be turned off for accel cases */
>>       DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_ON),
>> -    DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_OFF),
>> +    DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_AUTO),
> see my previous comment about squashing all those patches. Besides you
> need to update qemu-options.hx where the default value is documented as
> non auto.
Ok, will squash all those patches into a single one and fix qemu-options.hx.

Thanks,
Nathan

Re: [PATCH 05/11] hw/arm/smmuv3-accel: Implement "auto" value for "ril"

[Nathan Chen]

On 4/10/2026 12:47 AM, Eric Auger wrote:
> 
> On 4/1/26 3:02 AM, Nathan Chen wrote:
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Allow accelerated SMMUv3 Range Invalidation support property to be
>> derived from host IOMMU capabilities. Derive host values using
>> IOMMU_GET_HW_INFO, retrieving RIL capability from IDR3.
>>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3-accel.c | 9 ++++++++-
>>   hw/arm/smmuv3.c       | 7 +------
>>   2 files changed, 9 insertions(+), 7 deletions(-)
>>
>> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
>> index a835c8f220..9e7ec6a930 100644
>> --- a/hw/arm/smmuv3-accel.c
>> +++ b/hw/arm/smmuv3-accel.c
>> @@ -50,6 +50,12 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
>>                                  FIELD_EX32(info->idr[0], IDR0, ATS));
>>       }
>>   
>> +    /* Update RIL if auto from info */
> not sure that kind of comment is really useful.
I'll remove it for these properties and add some more details to the 
comment above about "Return if no auto for any or finalised already".

>> +    if (s->ril == ON_OFF_AUTO_AUTO) {
>> +        s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL,
>> +                               FIELD_EX32(info->idr[3], IDR3, RIL));
>> +    }
>> +
>>       accel->auto_finalised = true;
>>   }
>>   
>> @@ -945,7 +951,8 @@ void smmuv3_accel_init(SMMUv3State *s)
>>       bs->iommu_ops = &smmuv3_accel_ops;
>>       smmuv3_accel_as_init(s);
>>   
>> -    if (s->ats == ON_OFF_AUTO_AUTO) {
>> +    if (s->ats == ON_OFF_AUTO_AUTO ||
>> +        s->ril == ON_OFF_AUTO_AUTO) {
>>           s->s_accel->auto_mode = true;
>>       }
>>   }
>> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
>> index f353865187..a2d2f0e3bc 100644
>> --- a/hw/arm/smmuv3.c
>> +++ b/hw/arm/smmuv3.c
>> @@ -1973,10 +1973,6 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>>       }
>>   #endif
>>   
>> -    if (s->ril == ON_OFF_AUTO_AUTO) {
>> -        error_setg(errp, "ril auto mode is not supported");
>> -        return false;
>> -    }
>>       if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
>>           error_setg(errp, "ssidsize auto mode is not supported");
>>           return false;
>> @@ -2188,8 +2184,7 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
>>           "Enable SMMUv3 accelerator support. Allows host SMMUv3 to be "
>>           "configured in nested mode for vfio-pci dev assignment");
>>       object_class_property_set_description(klass, "ril",
>> -        "Disable range invalidation support (for accel=on). ril=auto "
>> -        "is not supported.");
>> +        "Disable range invalidation support (for accel=on).");
> same comment as before. Suggesting "Set RIL value. Valid values ..."
> + qemu-options.hx updates.
Yes, will update for RIL and the other values as well.

Thanks,
Nathan

Re: [PATCH 06/11] hw/arm/smmuv3: Change the default ril support to match the host

[Nathan Chen]

Hi Eric,

On 4/10/2026 12:41 AM, Eric Auger wrote:
> Hi Nathan,
> 
> On 4/1/26 3:02 AM, Nathan Chen wrote:
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Set the default value of RIL to auto. The default for RIL support used
>> to be set to on, but we change it to match what the host IOMMU
>> properties report so that users do not have to introspect host IDR3 for
>> Range Invalidation support. Include the previous default for ril in the
>> 11.0 compat.
>>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3.c   | 2 +-
>>   hw/core/machine.c | 1 +
>>   2 files changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
>> index a2d2f0e3bc..74cc81ae32 100644
>> --- a/hw/arm/smmuv3.c
>> +++ b/hw/arm/smmuv3.c
>> @@ -2153,7 +2153,7 @@ static const Property smmuv3_properties[] = {
>>       /* GPA of MSI doorbell, for SMMUv3 accel use. */
>>       DEFINE_PROP_UINT64("msi-gpa", SMMUv3State, msi_gpa, 0),
>>       /* RIL can be turned off for accel cases */
>> -    DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_ON),
>> +    DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_AUTO),
>>       DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_AUTO),
>>       DEFINE_PROP_OAS_MODE("oas", SMMUv3State, oas, OAS_MODE_44),
>>       DEFINE_PROP_SSIDSIZE_MODE("ssidsize", SMMUv3State, ssidsize,
>> diff --git a/hw/core/machine.c b/hw/core/machine.c
>> index 6796ab63cc..8f8c26bbe8 100644
>> --- a/hw/core/machine.c
>> +++ b/hw/core/machine.c
>> @@ -41,6 +41,7 @@
>>   
>>   GlobalProperty hw_compat_11_0[] = {
>>       { TYPE_ARM_SMMUV3, "ats", "off" },
>> +    { TYPE_ARM_SMMUV3, "ril", "on" },
> I wonder if you shouldn't squash all the patches that change the default
> values of accel props to auto mode into a single patch, at the end of
> the series.
Yes that sounds good to me. I will consolidate them in the next refresh.

Thanks,
Nathan

Re: [PATCH 07/11] hw/arm/smmuv3-accel: Implement "auto" value for "ssidsize"

[Nathan Chen]

On 4/10/2026 12:56 AM, Eric Auger wrote:
> 
> On 4/1/26 3:02 AM, Nathan Chen wrote:
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Allow accelerated SMMUv3 SSID size property to be derived from host
>> IOMMU capabilities. Derive host values using IOMMU_GET_HW_INFO,
>> retrieving SSID size from IDR1. When the auto SSID size is resolved
>> to a non-zero value, PASID capability is advertised to the vIOMMU
>> and accelerated use cases such as Shared Virtual Addressing (SVA)
>> are supported.
>>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3-accel.c | 14 ++++++++++++--
>>   hw/arm/smmuv3.c       | 11 +++++------
>>   2 files changed, 17 insertions(+), 8 deletions(-)
>>
>> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
>> index 9e7ec6a930..03393fd7ba 100644
>> --- a/hw/arm/smmuv3-accel.c
>> +++ b/hw/arm/smmuv3-accel.c
>> @@ -56,6 +56,13 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
>>                                  FIELD_EX32(info->idr[3], IDR3, RIL));
>>       }
>>   
>> +    /* Update SSIDSIZE if auto from info */
>> +    if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
>> +        /* Store for get_viommu_flags() to determine PASID support */
>> +        s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SSIDSIZE,
>> +                               FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
>> +    }
>> +
>>       accel->auto_finalised = true;
>>   }
>>   
>> @@ -828,7 +835,9 @@ static uint64_t smmuv3_accel_get_viommu_flags(void *opaque)
>>       SMMUState *bs = opaque;
>>       SMMUv3State *s = ARM_SMMUV3(bs);
>>   
>> -    if (s->ssidsize > SSID_SIZE_MODE_0) {
>> +    if (s->ssidsize > SSID_SIZE_MODE_0 ||
>> +        (s->ssidsize == SSID_SIZE_MODE_AUTO &&
> maybe worth adding a short static inline helper pasid_is_supported(s)?
Yes, I will include that in the next refresh. It should look cleaner in 
smmuv3_accel_get_viommu_flags() that way.

Thanks,
Nathan

Re: [PATCH 04/11] vfio/pci: Add ats property and mask ATS cap when not exposed

[Cédric Le Goater]

Hello Nathan,

On 4/1/26 03:02, Nathan Chen wrote:
> From: Nathan Chen <nathanc@nvidia.com>
> 
> Add an "ats" OnOffAuto property to vfio-pci. When the device has an ATS
> extended capability in config space but we should not expose it (ats=off,
> or ats=auto and kernel reports IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED), mask
> the capability so the guest does not see it.
> 
> This aligns with the kernel's per-device effective ATS reporting and
> allows omitting ATS capability when the vIOMMU has ats=off.
> 
> Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>

This looks like a standalone VFIO change that could be sent independently.
Could you please rebase on vfio-next [*] ? There are a few conflicting
changes in this branch.

[*] https://github.com/legoater/qemu/commits/vfio-next

You will need to add a compat machine property too. This is a guest-visible
ABI change. A separate patch would be preferred.

> ---
>   backends/iommufd.c                 | 15 +++++++
>   hw/vfio/pci.c                      | 63 ++++++++++++++++++++++++++++++
>   hw/vfio/pci.h                      |  1 +
>   include/system/host_iommu_device.h | 10 +++++
>   4 files changed, 89 insertions(+)
> 
> diff --git a/backends/iommufd.c b/backends/iommufd.c
> index e1fee16acf..52cb060454 100644
> --- a/backends/iommufd.c
> +++ b/backends/iommufd.c
> @@ -22,6 +22,13 @@
>   #include "hw/vfio/vfio-device.h"
>   #include <sys/ioctl.h>
>   #include <linux/iommufd.h>
> +/*
> + * Until kernel UAPI is synced via scripts;
> + * matches include/uapi/linux/iommufd.h
> + */
> +#ifndef IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
> +#define IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED (1 << 3)
> +#endif

This definition is introduced by :

   https://lore.kernel.org/all/20260303150348.233997-1-skolothumtho@nvidia.com/

It should reach Linux v7.1 since it is in linux-next. Anyhow, until then,
please isolate this change in a temporary patch updating linux-headers/

>   static const char *iommufd_fd_name(IOMMUFDBackend *be)
>   {
> @@ -573,6 +580,13 @@ static int hiod_iommufd_get_cap(HostIOMMUDevice *hiod, int cap, Error **errp)
>       }
>   }
>   
> +static bool hiod_iommufd_support_ats(HostIOMMUDevice *hiod)
> +{
> +    HostIOMMUDeviceCaps *caps = &hiod->caps;
> +
> +    return !(caps->hw_caps & IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED);
> +}
> +
>   static bool hiod_iommufd_get_pasid_info(HostIOMMUDevice *hiod,
>                                           PasidInfo *pasid_info)
>   {
> @@ -595,6 +609,7 @@ static void hiod_iommufd_class_init(ObjectClass *oc, const void *data)
>   
>       hioc->get_cap = hiod_iommufd_get_cap;
>       hioc->get_pasid_info = hiod_iommufd_get_pasid_info;
> +    hioc->support_ats = hiod_iommufd_support_ats;
>   };
>   
>   static const TypeInfo types[] = {
> diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
> index 1945751ffd..2d408e1d9a 100644
> --- a/hw/vfio/pci.c
> +++ b/hw/vfio/pci.c
> @@ -49,6 +49,10 @@
>   #include "system/iommufd.h"
>   #include "vfio-migration-internal.h"
>   #include "vfio-helpers.h"
> +#ifdef CONFIG_IOMMUFD
> +#include "system/host_iommu_device.h"
> +#include "linux/iommufd.h"
> +#endif
>   
These includes are not necessary.

>   /* Protected by BQL */
>   static KVMRouteChange vfio_route_change;
> @@ -2550,10 +2554,53 @@ static bool vfio_pci_synthesize_pasid_cap(VFIOPCIDevice *vdev, Error **errp)
>       return true;
>   }
>   
> +/*
> + * Determine whether ATS capability should be advertised for @vdev, based on
> + * whether it was enabled on the command line and whether it is supported
> + * according to the kernel's IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED bit.
> + *
> + * Store whether ATS capability should be advertised in @ats_need.
> + *
> + * Return false if kernel enables IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
> + * and ATS is effectively unsupported.
> + */
> +static bool vfio_pci_ats_requested_and_supported(VFIOPCIDevice *vdev,
> +                                                 bool *ats_need, Error **errp)

May be rename 'ats_need' to 'ats' or 'ats_needed'

> +{
> +    HostIOMMUDevice *hiod = vdev->vbasedev.hiod;
> +    HostIOMMUDeviceClass *hiodc;
> +    bool ats_supported;
> +
> +    if (vdev->ats == ON_OFF_AUTO_OFF) {
> +        *ats_need = false;
> +        return true;
> +    }
> +
> +    *ats_need = true;
> +    if (!hiod) {
> +        return true;
> +    }
> +    hiodc = HOST_IOMMU_DEVICE_GET_CLASS(hiod);
> +    if (!hiodc || !hiodc->support_ats) {
> +        return true;
> +    }
> +
> +    ats_supported = hiodc->support_ats(hiod);
> +    if (vdev->ats == ON_OFF_AUTO_ON && !ats_supported) {
> +        error_setg(errp, "vfio: ATS requested but not supported by kernel");

hmm, I wonder if we shouldn't fail to realize the device and stop the VM
in this case (ats requested + no support).

> +        *ats_need = false;
> +        return false;
> +    }
> +
> +    *ats_need = ats_supported;
> +    return true;
> +}
> +
>   static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
>   {
>       PCIDevice *pdev = PCI_DEVICE(vdev);
>       bool pasid_cap_added = false;
> +    bool ats_needed = false;
>       Error *err = NULL;
>       uint32_t header;
>       uint16_t cap_id, next, size;
> @@ -2603,6 +2650,11 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
>       pci_set_long(pdev->wmask + PCI_CONFIG_SPACE_SIZE, 0);
>       pci_set_long(vdev->emulated_config_bits + PCI_CONFIG_SPACE_SIZE, ~0);
>   
> +    if (!vfio_pci_ats_requested_and_supported(vdev, &ats_needed, &err)) {
> +        error_report_err(err);
> +       err = NULL;

indent error

> +    }
> +
>       for (next = PCI_CONFIG_SPACE_SIZE; next;
>            next = PCI_EXT_CAP_NEXT(pci_get_long(config + next))) {
>           header = pci_get_long(config + next);
> @@ -2640,6 +2692,16 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
>           case PCI_EXT_CAP_ID_PASID:
>               pasid_cap_added = true;
>               /* fallthrough */

This change is coupling the PASID and ATS capabilities. Is this intended ?


> +        case PCI_EXT_CAP_ID_ATS:
> +            /*
> +             * If ATS is requested and supported according to the kernel, add
> +             * the ATS capability. If not supported according to the kernel or
> +             * disabled on the qemu command line, omit the ATS cap.
> +             */
> +            if (ats_needed) {
> +                pcie_add_capability(pdev, cap_id, cap_ver, next, size);
> +            }
> +            break;
>           default:
>               pcie_add_capability(pdev, cap_id, cap_ver, next, size);
>           }
> @@ -3819,6 +3881,7 @@ static const Property vfio_pci_properties[] = {
>   #ifdef CONFIG_IOMMUFD
>       DEFINE_PROP_LINK("iommufd", VFIOPCIDevice, vbasedev.iommufd,
>                        TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
> +    DEFINE_PROP_ON_OFF_AUTO("ats", VFIOPCIDevice, ats, ON_OFF_AUTO_AUTO),

conflicts with vfio-next

>   #endif
>       DEFINE_PROP_BOOL("skip-vsc-check", VFIOPCIDevice, skip_vsc_check, true),
>       DEFINE_PROP_UINT16("x-vpasid-cap-offset", VFIOPCIDevice,
> diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
> index d6495d7f29..514a9197ce 100644
> --- a/hw/vfio/pci.h
> +++ b/hw/vfio/pci.h
> @@ -191,6 +191,7 @@ struct VFIOPCIDevice {
>       VFIODisplay *dpy;
>       Notifier irqchip_change_notifier;
>       VFIOPCICPR cpr;
> +    OnOffAuto ats;
>   };
>   
>   /* Use uin32_t for vendor & device so PCI_ANY_ID expands and cannot match hw */
> diff --git a/include/system/host_iommu_device.h b/include/system/host_iommu_device.h
> index f000301583..44c56e87bb 100644
> --- a/include/system/host_iommu_device.h
> +++ b/include/system/host_iommu_device.h

Please add to your .git/config :

[diff]
	orderFile = /path/to/qemu/scripts/git.orderfile


> @@ -133,6 +133,16 @@ struct HostIOMMUDeviceClass {
>        * Returns: true on success, false on failure.
>        */
>       bool (*get_pasid_info)(HostIOMMUDevice *hiod, PasidInfo *pasid_info);
> +    /**
> +     *  @support_ats: Return whether ATS is supported for the device
> +     *  associated with @hiod host IOMMU device, checking if the
> +     *  IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED capability bit is set.
> +     *
> +     *  @hiod: handle to the host IOMMU device
> +     *
> +     *  Returns: true on success, false on failure

  "Returns: true if ATS is supported, false otherwise"

> +     */
> +    bool (*support_ats)(HostIOMMUDevice *hiod);
>   };
>   
>   /*


I would split this patch in 4 parts :

- linux-headers/ v7.1 update
- support_ats() handler introduction and iommufd implementation
- "ats" property addition
- compat property fixup

Thanks,

C.

Re: [PATCH 04/11] vfio/pci: Add ats property and mask ATS cap when not exposed

[Nathan Chen]

Hi Cédric,
On 4/10/2026 2:09 PM, Cédric Le Goater wrote:
> Hello Nathan,
> 
> On 4/1/26 03:02, Nathan Chen wrote:
>> From: Nathan Chen <nathanc@nvidia.com>
>>
>> Add an "ats" OnOffAuto property to vfio-pci. When the device has an ATS
>> extended capability in config space but we should not expose it (ats=off,
>> or ats=auto and kernel reports IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED), mask
>> the capability so the guest does not see it.
>>
>> This aligns with the kernel's per-device effective ATS reporting and
>> allows omitting ATS capability when the vIOMMU has ats=off.
>>
>> Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
>> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> 
> This looks like a standalone VFIO change that could be sent independently.
> Could you please rebase on vfio-next [*] ? There are a few conflicting
> changes in this branch.
> 
> [*] https://github.com/legoater/qemu/commits/vfio-next
> 
> You will need to add a compat machine property too. This is a guest-visible
> ABI change. A separate patch would be preferred.
> 
Yes, I will separate this out and rebase on vfio-next, with the compat 
machine property added.

>> ---
>>   backends/iommufd.c                 | 15 +++++++
>>   hw/vfio/pci.c                      | 63 ++++++++++++++++++++++++++++++
>>   hw/vfio/pci.h                      |  1 +
>>   include/system/host_iommu_device.h | 10 +++++
>>   4 files changed, 89 insertions(+)
>>
>> diff --git a/backends/iommufd.c b/backends/iommufd.c
>> index e1fee16acf..52cb060454 100644
>> --- a/backends/iommufd.c
>> +++ b/backends/iommufd.c
>> @@ -22,6 +22,13 @@
>>   #include "hw/vfio/vfio-device.h"
>>   #include <sys/ioctl.h>
>>   #include <linux/iommufd.h>
>> +/*
>> + * Until kernel UAPI is synced via scripts;
>> + * matches include/uapi/linux/iommufd.h
>> + */
>> +#ifndef IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
>> +#define IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED (1 << 3)
>> +#endif
> 
> This definition is introduced by :
> 
> https://lore.kernel.org/all/20260303150348.233997-1- 
> skolothumtho@nvidia.com/
> 
> It should reach Linux v7.1 since it is in linux-next. Anyhow, until then,
> please isolate this change in a temporary patch updating linux-headers/
> 
Ok, I will separate it out.
>>   static const char *iommufd_fd_name(IOMMUFDBackend *be)
>>   {
>> @@ -573,6 +580,13 @@ static int hiod_iommufd_get_cap(HostIOMMUDevice 
>> *hiod, int cap, Error **errp)
>>       }
>>   }
>> +static bool hiod_iommufd_support_ats(HostIOMMUDevice *hiod)
>> +{
>> +    HostIOMMUDeviceCaps *caps = &hiod->caps;
>> +
>> +    return !(caps->hw_caps & IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED);
>> +}
>> +
>>   static bool hiod_iommufd_get_pasid_info(HostIOMMUDevice *hiod,
>>                                           PasidInfo *pasid_info)
>>   {
>> @@ -595,6 +609,7 @@ static void hiod_iommufd_class_init(ObjectClass 
>> *oc, const void *data)
>>       hioc->get_cap = hiod_iommufd_get_cap;
>>       hioc->get_pasid_info = hiod_iommufd_get_pasid_info;
>> +    hioc->support_ats = hiod_iommufd_support_ats;
>>   };
>>   static const TypeInfo types[] = {
>> diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
>> index 1945751ffd..2d408e1d9a 100644
>> --- a/hw/vfio/pci.c
>> +++ b/hw/vfio/pci.c
>> @@ -49,6 +49,10 @@
>>   #include "system/iommufd.h"
>>   #include "vfio-migration-internal.h"
>>   #include "vfio-helpers.h"
>> +#ifdef CONFIG_IOMMUFD
>> +#include "system/host_iommu_device.h"
>> +#include "linux/iommufd.h"
>> +#endif
> These includes are not necessary.
Got it, I will remove these. I see that system/host_iommu_device.h is 
included in system/iommufd.h already. And linux/iommufd.h was leftover 
from a previous revision.

> 
>>   /* Protected by BQL */
>>   static KVMRouteChange vfio_route_change;
>> @@ -2550,10 +2554,53 @@ static bool 
>> vfio_pci_synthesize_pasid_cap(VFIOPCIDevice *vdev, Error **errp)
>>       return true;
>>   }
>> +/*
>> + * Determine whether ATS capability should be advertised for @vdev, 
>> based on
>> + * whether it was enabled on the command line and whether it is 
>> supported
>> + * according to the kernel's IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED bit.
>> + *
>> + * Store whether ATS capability should be advertised in @ats_need.
>> + *
>> + * Return false if kernel enables IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
>> + * and ATS is effectively unsupported.
>> + */
>> +static bool vfio_pci_ats_requested_and_supported(VFIOPCIDevice *vdev,
>> +                                                 bool *ats_need, 
>> Error **errp)
> 
> May be rename 'ats_need' to 'ats' or 'ats_needed'
> 
Ok, I will rename this to ats_needed.
>> +{
>> +    HostIOMMUDevice *hiod = vdev->vbasedev.hiod;
>> +    HostIOMMUDeviceClass *hiodc;
>> +    bool ats_supported;
>> +
>> +    if (vdev->ats == ON_OFF_AUTO_OFF) {
>> +        *ats_need = false;
>> +        return true;
>> +    }
>> +
>> +    *ats_need = true;
>> +    if (!hiod) {
>> +        return true;
>> +    }
>> +    hiodc = HOST_IOMMU_DEVICE_GET_CLASS(hiod);
>> +    if (!hiodc || !hiodc->support_ats) {
>> +        return true;
>> +    }
>> +
>> +    ats_supported = hiodc->support_ats(hiod);
>> +    if (vdev->ats == ON_OFF_AUTO_ON && !ats_supported) {
>> +        error_setg(errp, "vfio: ATS requested but not supported by 
>> kernel");
> 
> hmm, I wonder if we shouldn't fail to realize the device and stop the VM
> in this case (ats requested + no support).
Agreed. I can move the vfio_pci_ats_requested_and_supported() call to 
vfio_pci_add_capabilities() so we can propagate the Error **, and then 
pass ats_needed as a new input arg to vfio_add_ext_cap. Would that be 
alright?
> 
>> +        *ats_need = false;
>> +        return false;
>> +    }
>> +
>> +    *ats_need = ats_supported;
>> +    return true;
>> +}
>> +
>>   static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
>>   {
>>       PCIDevice *pdev = PCI_DEVICE(vdev);
>>       bool pasid_cap_added = false;
>> +    bool ats_needed = false;
>>       Error *err = NULL;
>>       uint32_t header;
>>       uint16_t cap_id, next, size;
>> @@ -2603,6 +2650,11 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
>>       pci_set_long(pdev->wmask + PCI_CONFIG_SPACE_SIZE, 0);
>>       pci_set_long(vdev->emulated_config_bits + PCI_CONFIG_SPACE_SIZE, 
>> ~0);
>> +    if (!vfio_pci_ats_requested_and_supported(vdev, &ats_needed, 
>> &err)) {
>> +        error_report_err(err);
>> +       err = NULL;
> 
> indent error
> 
Thanks, will fix this.
>> +    }
>> +
>>       for (next = PCI_CONFIG_SPACE_SIZE; next;
>>            next = PCI_EXT_CAP_NEXT(pci_get_long(config + next))) {
>>           header = pci_get_long(config + next);
>> @@ -2640,6 +2692,16 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
>>           case PCI_EXT_CAP_ID_PASID:
>>               pasid_cap_added = true;
>>               /* fallthrough */
> 
> This change is coupling the PASID and ATS capabilities. Is this intended ?
> 
This was not intentional, I will add a pcie_add_capability() call and 
break for the PASID case.
> 
>> +        case PCI_EXT_CAP_ID_ATS:
>> +            /*
>> +             * If ATS is requested and supported according to the 
>> kernel, add
>> +             * the ATS capability. If not supported according to the 
>> kernel or
>> +             * disabled on the qemu command line, omit the ATS cap.
>> +             */
>> +            if (ats_needed) {
>> +                pcie_add_capability(pdev, cap_id, cap_ver, next, size);
>> +            }
>> +            break;
>>           default:
>>               pcie_add_capability(pdev, cap_id, cap_ver, next, size);
>>           }
>> @@ -3819,6 +3881,7 @@ static const Property vfio_pci_properties[] = {
>>   #ifdef CONFIG_IOMMUFD
>>       DEFINE_PROP_LINK("iommufd", VFIOPCIDevice, vbasedev.iommufd,
>>                        TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
>> +    DEFINE_PROP_ON_OFF_AUTO("ats", VFIOPCIDevice, ats, 
>> ON_OFF_AUTO_AUTO),
> 
> conflicts with vfio-next
> 
Ok, will take a look and rebase on vfio-next.
>>   #endif
>>       DEFINE_PROP_BOOL("skip-vsc-check", VFIOPCIDevice, 
>> skip_vsc_check, true),
>>       DEFINE_PROP_UINT16("x-vpasid-cap-offset", VFIOPCIDevice,
>> diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
>> index d6495d7f29..514a9197ce 100644
>> --- a/hw/vfio/pci.h
>> +++ b/hw/vfio/pci.h
>> @@ -191,6 +191,7 @@ struct VFIOPCIDevice {
>>       VFIODisplay *dpy;
>>       Notifier irqchip_change_notifier;
>>       VFIOPCICPR cpr;
>> +    OnOffAuto ats;
>>   };
>>   /* Use uin32_t for vendor & device so PCI_ANY_ID expands and cannot 
>> match hw */
>> diff --git a/include/system/host_iommu_device.h b/include/system/ 
>> host_iommu_device.h
>> index f000301583..44c56e87bb 100644
>> --- a/include/system/host_iommu_device.h
>> +++ b/include/system/host_iommu_device.h
> 
> Please add to your .git/config :
> 
> [diff]
>      orderFile = /path/to/qemu/scripts/git.orderfile
> 
> 
Ok, I will add this for the next refresh.
>> @@ -133,6 +133,16 @@ struct HostIOMMUDeviceClass {
>>        * Returns: true on success, false on failure.
>>        */
>>       bool (*get_pasid_info)(HostIOMMUDevice *hiod, PasidInfo 
>> *pasid_info);
>> +    /**
>> +     *  @support_ats: Return whether ATS is supported for the device
>> +     *  associated with @hiod host IOMMU device, checking if the
>> +     *  IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED capability bit is set.
>> +     *
>> +     *  @hiod: handle to the host IOMMU device
>> +     *
>> +     *  Returns: true on success, false on failure
> 
>   "Returns: true if ATS is supported, false otherwise"
> 
Ok, I will make this more clear.
>> +     */
>> +    bool (*support_ats)(HostIOMMUDevice *hiod);
>>   };
>>   /*
> 
> 
> I would split this patch in 4 parts :
> 
> - linux-headers/ v7.1 update
> - support_ats() handler introduction and iommufd implementation
> - "ats" property addition
> - compat property fixup
Got it, thanks for the guidance on organizing the split. I will send 
separately from this series.

Thanks,
Nathan

Re: [PATCH 04/11] vfio/pci: Add ats property and mask ATS cap when not exposed

[Cédric Le Goater]

On 4/11/26 03:52, Nathan Chen wrote:
> 
> Hi Cédric,
> On 4/10/2026 2:09 PM, Cédric Le Goater wrote:
>> Hello Nathan,
>>
>> On 4/1/26 03:02, Nathan Chen wrote:
>>> From: Nathan Chen <nathanc@nvidia.com>
>>>
>>> Add an "ats" OnOffAuto property to vfio-pci. When the device has an ATS
>>> extended capability in config space but we should not expose it (ats=off,
>>> or ats=auto and kernel reports IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED), mask
>>> the capability so the guest does not see it.
>>>
>>> This aligns with the kernel's per-device effective ATS reporting and
>>> allows omitting ATS capability when the vIOMMU has ats=off.
>>>
>>> Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
>>> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
>>
>> This looks like a standalone VFIO change that could be sent independently.
>> Could you please rebase on vfio-next [*] ? There are a few conflicting
>> changes in this branch.
>>
>> [*] https://github.com/legoater/qemu/commits/vfio-next
>>
>> You will need to add a compat machine property too. This is a guest-visible
>> ABI change. A separate patch would be preferred.
>>
> Yes, I will separate this out and rebase on vfio-next, with the compat machine property added.
> 
>>> ---
>>>   backends/iommufd.c                 | 15 +++++++
>>>   hw/vfio/pci.c                      | 63 ++++++++++++++++++++++++++++++
>>>   hw/vfio/pci.h                      |  1 +
>>>   include/system/host_iommu_device.h | 10 +++++
>>>   4 files changed, 89 insertions(+)
>>>
>>> diff --git a/backends/iommufd.c b/backends/iommufd.c
>>> index e1fee16acf..52cb060454 100644
>>> --- a/backends/iommufd.c
>>> +++ b/backends/iommufd.c
>>> @@ -22,6 +22,13 @@
>>>   #include "hw/vfio/vfio-device.h"
>>>   #include <sys/ioctl.h>
>>>   #include <linux/iommufd.h>
>>> +/*
>>> + * Until kernel UAPI is synced via scripts;
>>> + * matches include/uapi/linux/iommufd.h
>>> + */
>>> +#ifndef IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
>>> +#define IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED (1 << 3)
>>> +#endif
>>
>> This definition is introduced by :
>>
>> https://lore.kernel.org/all/20260303150348.233997-1- skolothumtho@nvidia.com/
>>
>> It should reach Linux v7.1 since it is in linux-next. Anyhow, until then,
>> please isolate this change in a temporary patch updating linux-headers/
>>
> Ok, I will separate it out.
>>>   static const char *iommufd_fd_name(IOMMUFDBackend *be)
>>>   {
>>> @@ -573,6 +580,13 @@ static int hiod_iommufd_get_cap(HostIOMMUDevice *hiod, int cap, Error **errp)
>>>       }
>>>   }
>>> +static bool hiod_iommufd_support_ats(HostIOMMUDevice *hiod)
>>> +{
>>> +    HostIOMMUDeviceCaps *caps = &hiod->caps;
>>> +
>>> +    return !(caps->hw_caps & IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED);
>>> +}
>>> +
>>>   static bool hiod_iommufd_get_pasid_info(HostIOMMUDevice *hiod,
>>>                                           PasidInfo *pasid_info)
>>>   {
>>> @@ -595,6 +609,7 @@ static void hiod_iommufd_class_init(ObjectClass *oc, const void *data)
>>>       hioc->get_cap = hiod_iommufd_get_cap;
>>>       hioc->get_pasid_info = hiod_iommufd_get_pasid_info;
>>> +    hioc->support_ats = hiod_iommufd_support_ats;
>>>   };
>>>   static const TypeInfo types[] = {
>>> diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
>>> index 1945751ffd..2d408e1d9a 100644
>>> --- a/hw/vfio/pci.c
>>> +++ b/hw/vfio/pci.c
>>> @@ -49,6 +49,10 @@
>>>   #include "system/iommufd.h"
>>>   #include "vfio-migration-internal.h"
>>>   #include "vfio-helpers.h"
>>> +#ifdef CONFIG_IOMMUFD
>>> +#include "system/host_iommu_device.h"
>>> +#include "linux/iommufd.h"
>>> +#endif
>> These includes are not necessary.
> Got it, I will remove these. I see that system/host_iommu_device.h is included in system/iommufd.h already. And linux/iommufd.h was leftover from a previous revision.
> 
>>
>>>   /* Protected by BQL */
>>>   static KVMRouteChange vfio_route_change;
>>> @@ -2550,10 +2554,53 @@ static bool vfio_pci_synthesize_pasid_cap(VFIOPCIDevice *vdev, Error **errp)
>>>       return true;
>>>   }
>>> +/*
>>> + * Determine whether ATS capability should be advertised for @vdev, based on
>>> + * whether it was enabled on the command line and whether it is supported
>>> + * according to the kernel's IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED bit.
>>> + *
>>> + * Store whether ATS capability should be advertised in @ats_need.
>>> + *
>>> + * Return false if kernel enables IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
>>> + * and ATS is effectively unsupported.
>>> + */
>>> +static bool vfio_pci_ats_requested_and_supported(VFIOPCIDevice *vdev,
>>> +                                                 bool *ats_need, Error **errp)
>>
>> May be rename 'ats_need' to 'ats' or 'ats_needed'
>>
> Ok, I will rename this to ats_needed.
>>> +{
>>> +    HostIOMMUDevice *hiod = vdev->vbasedev.hiod;
>>> +    HostIOMMUDeviceClass *hiodc;
>>> +    bool ats_supported;
>>> +
>>> +    if (vdev->ats == ON_OFF_AUTO_OFF) {
>>> +        *ats_need = false;
>>> +        return true;
>>> +    }
>>> +
>>> +    *ats_need = true;
>>> +    if (!hiod) {
>>> +        return true;
>>> +    }
>>> +    hiodc = HOST_IOMMU_DEVICE_GET_CLASS(hiod);
>>> +    if (!hiodc || !hiodc->support_ats) {
>>> +        return true;
>>> +    }
>>> +
>>> +    ats_supported = hiodc->support_ats(hiod);
>>> +    if (vdev->ats == ON_OFF_AUTO_ON && !ats_supported) {
>>> +        error_setg(errp, "vfio: ATS requested but not supported by kernel");
>>
>> hmm, I wonder if we shouldn't fail to realize the device and stop the VM
>> in this case (ats requested + no support).
> Agreed. I can move the vfio_pci_ats_requested_and_supported() call to vfio_pci_add_capabilities() so we can propagate the Error **, and then pass ats_needed as a new input arg to vfio_add_ext_cap. Would that be alright?
>>
>>> +        *ats_need = false;
>>> +        return false;
>>> +    }
>>> +
>>> +    *ats_need = ats_supported;
>>> +    return true;
>>> +}
>>> +
>>>   static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
>>>   {
>>>       PCIDevice *pdev = PCI_DEVICE(vdev);
>>>       bool pasid_cap_added = false;
>>> +    bool ats_needed = false;
>>>       Error *err = NULL;
>>>       uint32_t header;
>>>       uint16_t cap_id, next, size;
>>> @@ -2603,6 +2650,11 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
>>>       pci_set_long(pdev->wmask + PCI_CONFIG_SPACE_SIZE, 0);
>>>       pci_set_long(vdev->emulated_config_bits + PCI_CONFIG_SPACE_SIZE, ~0);
>>> +    if (!vfio_pci_ats_requested_and_supported(vdev, &ats_needed, &err)) {
>>> +        error_report_err(err);
>>> +       err = NULL;
>>
>> indent error
>>
> Thanks, will fix this.
>>> +    }
>>> +
>>>       for (next = PCI_CONFIG_SPACE_SIZE; next;
>>>            next = PCI_EXT_CAP_NEXT(pci_get_long(config + next))) {
>>>           header = pci_get_long(config + next);
>>> @@ -2640,6 +2692,16 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
>>>           case PCI_EXT_CAP_ID_PASID:
>>>               pasid_cap_added = true;
>>>               /* fallthrough */
>>
>> This change is coupling the PASID and ATS capabilities. Is this intended ?
>>
> This was not intentional, I will add a pcie_add_capability() call and break for the PASID case.
>>
>>> +        case PCI_EXT_CAP_ID_ATS:
>>> +            /*
>>> +             * If ATS is requested and supported according to the kernel, add
>>> +             * the ATS capability. If not supported according to the kernel or
>>> +             * disabled on the qemu command line, omit the ATS cap.
>>> +             */
>>> +            if (ats_needed) {
>>> +                pcie_add_capability(pdev, cap_id, cap_ver, next, size);
>>> +            }
>>> +            break;
>>>           default:
>>>               pcie_add_capability(pdev, cap_id, cap_ver, next, size);
>>>           }
>>> @@ -3819,6 +3881,7 @@ static const Property vfio_pci_properties[] = {
>>>   #ifdef CONFIG_IOMMUFD
>>>       DEFINE_PROP_LINK("iommufd", VFIOPCIDevice, vbasedev.iommufd,
>>>                        TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
>>> +    DEFINE_PROP_ON_OFF_AUTO("ats", VFIOPCIDevice, ats, ON_OFF_AUTO_AUTO),
>>
>> conflicts with vfio-next
>>
> Ok, will take a look and rebase on vfio-next.

when you rebase, please put the "ats" property at the end of the list
and update accordingly vfio_pci_class_init().

Thanks,

C.


>>>   #endif
>>>       DEFINE_PROP_BOOL("skip-vsc-check", VFIOPCIDevice, skip_vsc_check, true),
>>>       DEFINE_PROP_UINT16("x-vpasid-cap-offset", VFIOPCIDevice,
>>> diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
>>> index d6495d7f29..514a9197ce 100644
>>> --- a/hw/vfio/pci.h
>>> +++ b/hw/vfio/pci.h
>>> @@ -191,6 +191,7 @@ struct VFIOPCIDevice {
>>>       VFIODisplay *dpy;
>>>       Notifier irqchip_change_notifier;
>>>       VFIOPCICPR cpr;
>>> +    OnOffAuto ats;
>>>   };
>>>   /* Use uin32_t for vendor & device so PCI_ANY_ID expands and cannot match hw */
>>> diff --git a/include/system/host_iommu_device.h b/include/system/ host_iommu_device.h
>>> index f000301583..44c56e87bb 100644
>>> --- a/include/system/host_iommu_device.h
>>> +++ b/include/system/host_iommu_device.h
>>
>> Please add to your .git/config :
>>
>> [diff]
>>      orderFile = /path/to/qemu/scripts/git.orderfile
>>
>>
> Ok, I will add this for the next refresh.
>>> @@ -133,6 +133,16 @@ struct HostIOMMUDeviceClass {
>>>        * Returns: true on success, false on failure.
>>>        */
>>>       bool (*get_pasid_info)(HostIOMMUDevice *hiod, PasidInfo *pasid_info);
>>> +    /**
>>> +     *  @support_ats: Return whether ATS is supported for the device
>>> +     *  associated with @hiod host IOMMU device, checking if the
>>> +     *  IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED capability bit is set.
>>> +     *
>>> +     *  @hiod: handle to the host IOMMU device
>>> +     *
>>> +     *  Returns: true on success, false on failure
>>
>>   "Returns: true if ATS is supported, false otherwise"
>>
> Ok, I will make this more clear.
>>> +     */
>>> +    bool (*support_ats)(HostIOMMUDevice *hiod);
>>>   };
>>>   /*
>>
>>
>> I would split this patch in 4 parts :
>>
>> - linux-headers/ v7.1 update
>> - support_ats() handler introduction and iommufd implementation
>> - "ats" property addition
>> - compat property fixup
> Got it, thanks for the guidance on organizing the split. I will send separately from this series.
> 
> Thanks,
> Nathan
> 

Re: [PATCH 04/11] vfio/pci: Add ats property and mask ATS cap when not exposed

[Nathan Chen]

On 4/11/2026 5:45 AM, Cédric Le Goater wrote:
> On 4/11/26 03:52, Nathan Chen wrote:
>>
>> Hi Cédric,
>> On 4/10/2026 2:09 PM, Cédric Le Goater wrote:
>>> Hello Nathan,
>>>
>>> On 4/1/26 03:02, Nathan Chen wrote:
>>>> From: Nathan Chen <nathanc@nvidia.com>
>>>>
>>>> Add an "ats" OnOffAuto property to vfio-pci. When the device has an ATS
>>>> extended capability in config space but we should not expose it 
>>>> (ats=off,
>>>> or ats=auto and kernel reports IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED), 
>>>> mask
>>>> the capability so the guest does not see it.
>>>>
>>>> This aligns with the kernel's per-device effective ATS reporting and
>>>> allows omitting ATS capability when the vIOMMU has ats=off.
>>>>
>>>> Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
>>>> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
>>>
>>> This looks like a standalone VFIO change that could be sent 
>>> independently.
>>> Could you please rebase on vfio-next [*] ? There are a few conflicting
>>> changes in this branch.
>>>
>>> [*] https://github.com/legoater/qemu/commits/vfio-next
>>>
>>> You will need to add a compat machine property too. This is a guest- 
>>> visible
>>> ABI change. A separate patch would be preferred.
>>>
>> Yes, I will separate this out and rebase on vfio-next, with the compat 
>> machine property added.
>>
>>>> ---
>>>>   backends/iommufd.c                 | 15 +++++++
>>>>   hw/vfio/pci.c                      | 63 ++++++++++++++++++++++++++ 
>>>> ++++
>>>>   hw/vfio/pci.h                      |  1 +
>>>>   include/system/host_iommu_device.h | 10 +++++
>>>>   4 files changed, 89 insertions(+)
>>>>
>>>> diff --git a/backends/iommufd.c b/backends/iommufd.c
>>>> index e1fee16acf..52cb060454 100644
>>>> --- a/backends/iommufd.c
>>>> +++ b/backends/iommufd.c
>>>> @@ -22,6 +22,13 @@
>>>>   #include "hw/vfio/vfio-device.h"
>>>>   #include <sys/ioctl.h>
>>>>   #include <linux/iommufd.h>
>>>> +/*
>>>> + * Until kernel UAPI is synced via scripts;
>>>> + * matches include/uapi/linux/iommufd.h
>>>> + */
>>>> +#ifndef IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
>>>> +#define IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED (1 << 3)
>>>> +#endif
>>>
>>> This definition is introduced by :
>>>
>>> https://lore.kernel.org/all/20260303150348.233997-1- 
>>> skolothumtho@nvidia.com/
>>>
>>> It should reach Linux v7.1 since it is in linux-next. Anyhow, until 
>>> then,
>>> please isolate this change in a temporary patch updating linux-headers/
>>>
>> Ok, I will separate it out.
>>>>   static const char *iommufd_fd_name(IOMMUFDBackend *be)
>>>>   {
>>>> @@ -573,6 +580,13 @@ static int hiod_iommufd_get_cap(HostIOMMUDevice 
>>>> *hiod, int cap, Error **errp)
>>>>       }
>>>>   }
>>>> +static bool hiod_iommufd_support_ats(HostIOMMUDevice *hiod)
>>>> +{
>>>> +    HostIOMMUDeviceCaps *caps = &hiod->caps;
>>>> +
>>>> +    return !(caps->hw_caps & IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED);
>>>> +}
>>>> +
>>>>   static bool hiod_iommufd_get_pasid_info(HostIOMMUDevice *hiod,
>>>>                                           PasidInfo *pasid_info)
>>>>   {
>>>> @@ -595,6 +609,7 @@ static void hiod_iommufd_class_init(ObjectClass 
>>>> *oc, const void *data)
>>>>       hioc->get_cap = hiod_iommufd_get_cap;
>>>>       hioc->get_pasid_info = hiod_iommufd_get_pasid_info;
>>>> +    hioc->support_ats = hiod_iommufd_support_ats;
>>>>   };
>>>>   static const TypeInfo types[] = {
>>>> diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
>>>> index 1945751ffd..2d408e1d9a 100644
>>>> --- a/hw/vfio/pci.c
>>>> +++ b/hw/vfio/pci.c
>>>> @@ -49,6 +49,10 @@
>>>>   #include "system/iommufd.h"
>>>>   #include "vfio-migration-internal.h"
>>>>   #include "vfio-helpers.h"
>>>> +#ifdef CONFIG_IOMMUFD
>>>> +#include "system/host_iommu_device.h"
>>>> +#include "linux/iommufd.h"
>>>> +#endif
>>> These includes are not necessary.
>> Got it, I will remove these. I see that system/host_iommu_device.h is 
>> included in system/iommufd.h already. And linux/iommufd.h was leftover 
>> from a previous revision.
>>
>>>
>>>>   /* Protected by BQL */
>>>>   static KVMRouteChange vfio_route_change;
>>>> @@ -2550,10 +2554,53 @@ static bool 
>>>> vfio_pci_synthesize_pasid_cap(VFIOPCIDevice *vdev, Error **errp)
>>>>       return true;
>>>>   }
>>>> +/*
>>>> + * Determine whether ATS capability should be advertised for @vdev, 
>>>> based on
>>>> + * whether it was enabled on the command line and whether it is 
>>>> supported
>>>> + * according to the kernel's IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED bit.
>>>> + *
>>>> + * Store whether ATS capability should be advertised in @ats_need.
>>>> + *
>>>> + * Return false if kernel enables IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
>>>> + * and ATS is effectively unsupported.
>>>> + */
>>>> +static bool vfio_pci_ats_requested_and_supported(VFIOPCIDevice *vdev,
>>>> +                                                 bool *ats_need, 
>>>> Error **errp)
>>>
>>> May be rename 'ats_need' to 'ats' or 'ats_needed'
>>>
>> Ok, I will rename this to ats_needed.
>>>> +{
>>>> +    HostIOMMUDevice *hiod = vdev->vbasedev.hiod;
>>>> +    HostIOMMUDeviceClass *hiodc;
>>>> +    bool ats_supported;
>>>> +
>>>> +    if (vdev->ats == ON_OFF_AUTO_OFF) {
>>>> +        *ats_need = false;
>>>> +        return true;
>>>> +    }
>>>> +
>>>> +    *ats_need = true;
>>>> +    if (!hiod) {
>>>> +        return true;
>>>> +    }
>>>> +    hiodc = HOST_IOMMU_DEVICE_GET_CLASS(hiod);
>>>> +    if (!hiodc || !hiodc->support_ats) {
>>>> +        return true;
>>>> +    }
>>>> +
>>>> +    ats_supported = hiodc->support_ats(hiod);
>>>> +    if (vdev->ats == ON_OFF_AUTO_ON && !ats_supported) {
>>>> +        error_setg(errp, "vfio: ATS requested but not supported by 
>>>> kernel");
>>>
>>> hmm, I wonder if we shouldn't fail to realize the device and stop the VM
>>> in this case (ats requested + no support).
>> Agreed. I can move the vfio_pci_ats_requested_and_supported() call to 
>> vfio_pci_add_capabilities() so we can propagate the Error **, and then 
>> pass ats_needed as a new input arg to vfio_add_ext_cap. Would that be 
>> alright?
>>>
>>>> +        *ats_need = false;
>>>> +        return false;
>>>> +    }
>>>> +
>>>> +    *ats_need = ats_supported;
>>>> +    return true;
>>>> +}
>>>> +
>>>>   static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
>>>>   {
>>>>       PCIDevice *pdev = PCI_DEVICE(vdev);
>>>>       bool pasid_cap_added = false;
>>>> +    bool ats_needed = false;
>>>>       Error *err = NULL;
>>>>       uint32_t header;
>>>>       uint16_t cap_id, next, size;
>>>> @@ -2603,6 +2650,11 @@ static void vfio_add_ext_cap(VFIOPCIDevice 
>>>> *vdev)
>>>>       pci_set_long(pdev->wmask + PCI_CONFIG_SPACE_SIZE, 0);
>>>>       pci_set_long(vdev->emulated_config_bits + 
>>>> PCI_CONFIG_SPACE_SIZE, ~0);
>>>> +    if (!vfio_pci_ats_requested_and_supported(vdev, &ats_needed, 
>>>> &err)) {
>>>> +        error_report_err(err);
>>>> +       err = NULL;
>>>
>>> indent error
>>>
>> Thanks, will fix this.
>>>> +    }
>>>> +
>>>>       for (next = PCI_CONFIG_SPACE_SIZE; next;
>>>>            next = PCI_EXT_CAP_NEXT(pci_get_long(config + next))) {
>>>>           header = pci_get_long(config + next);
>>>> @@ -2640,6 +2692,16 @@ static void vfio_add_ext_cap(VFIOPCIDevice 
>>>> *vdev)
>>>>           case PCI_EXT_CAP_ID_PASID:
>>>>               pasid_cap_added = true;
>>>>               /* fallthrough */
>>>
>>> This change is coupling the PASID and ATS capabilities. Is this 
>>> intended ?
>>>
>> This was not intentional, I will add a pcie_add_capability() call and 
>> break for the PASID case.
>>>
>>>> +        case PCI_EXT_CAP_ID_ATS:
>>>> +            /*
>>>> +             * If ATS is requested and supported according to the 
>>>> kernel, add
>>>> +             * the ATS capability. If not supported according to 
>>>> the kernel or
>>>> +             * disabled on the qemu command line, omit the ATS cap.
>>>> +             */
>>>> +            if (ats_needed) {
>>>> +                pcie_add_capability(pdev, cap_id, cap_ver, next, 
>>>> size);
>>>> +            }
>>>> +            break;
>>>>           default:
>>>>               pcie_add_capability(pdev, cap_id, cap_ver, next, size);
>>>>           }
>>>> @@ -3819,6 +3881,7 @@ static const Property vfio_pci_properties[] = {
>>>>   #ifdef CONFIG_IOMMUFD
>>>>       DEFINE_PROP_LINK("iommufd", VFIOPCIDevice, vbasedev.iommufd,
>>>>                        TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
>>>> +    DEFINE_PROP_ON_OFF_AUTO("ats", VFIOPCIDevice, ats, 
>>>> ON_OFF_AUTO_AUTO),
>>>
>>> conflicts with vfio-next
>>>
>> Ok, will take a look and rebase on vfio-next.
> 
> when you rebase, please put the "ats" property at the end of the list
> and update accordingly vfio_pci_class_init().
Ok, I will keep this in mind, thanks!

Nathan

RE: [PATCH 04/11] vfio/pci: Add ats property and mask ATS cap when not exposed

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 01 April 2026 02:02
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Yi Liu <yi.l.liu@intel.com>; Eric Auger <eric.auger@redhat.com>;
> Zhenzhong Duan <zhenzhong.duan@intel.com>; Peter Maydell
> <peter.maydell@linaro.org>; Marcel Apfelbaum
> <marcel.apfelbaum@gmail.com>; Philippe Mathieu-Daudé
> <philmd@linaro.org>; Yanan Wang <wangyanan55@huawei.com>; Zhao Liu
> <zhao1.liu@intel.com>; Alex Williamson <alex@shazbot.org>; Cédric Le Goater
> <clg@redhat.com>; Shameer Kolothum Thodi <skolothumtho@nvidia.com>;
> Matt Ochs <mochs@nvidia.com>; Nicolin Chen <nicolinc@nvidia.com>;
> Nathan Chen <nathanc@nvidia.com>
> Subject: [PATCH 04/11] vfio/pci: Add ats property and mask ATS cap when
> not exposed
> 
[...]
 
> +/*
> + * Determine whether ATS capability should be advertised for @vdev, based
> on
> + * whether it was enabled on the command line and whether it is supported
> + * according to the kernel's IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
> bit.
> + *
> + * Store whether ATS capability should be advertised in @ats_need.
> + *
> + * Return false if kernel enables
> IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
> + * and ATS is effectively unsupported.
> + */

Returns false only when ats=on is explicitly requested but the kernel reports
IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED. Returns true in all other cases.

Isn't it?

Thanks,
Shameer

Re: [PATCH 04/11] vfio/pci: Add ats property and mask ATS cap when not exposed

[Cédric Le Goater]

On 4/10/26 23:09, Cédric Le Goater wrote:
> Hello Nathan,
> 
> On 4/1/26 03:02, Nathan Chen wrote:
>> From: Nathan Chen <nathanc@nvidia.com>
>>
>> Add an "ats" OnOffAuto property to vfio-pci. When the device has an ATS
>> extended capability in config space but we should not expose it (ats=off,
>> or ats=auto and kernel reports IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED), mask
>> the capability so the guest does not see it.
>>
>> This aligns with the kernel's per-device effective ATS reporting and
>> allows omitting ATS capability when the vIOMMU has ats=off.
>>
>> Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
>> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> 
> This looks like a standalone VFIO change that could be sent independently.
> Could you please rebase on vfio-next [*] ? There are a few conflicting
> changes in this branch.
> 
> [*] https://github.com/legoater/qemu/commits/vfio-next
> 
> You will need to add a compat machine property too. This is a guest-visible
> ABI change. A separate patch would be preferred.
> 
>> ---
>>   backends/iommufd.c                 | 15 +++++++
>>   hw/vfio/pci.c                      | 63 ++++++++++++++++++++++++++++++
>>   hw/vfio/pci.h                      |  1 +
>>   include/system/host_iommu_device.h | 10 +++++
>>   4 files changed, 89 insertions(+)
>>
>> diff --git a/backends/iommufd.c b/backends/iommufd.c
>> index e1fee16acf..52cb060454 100644
>> --- a/backends/iommufd.c
>> +++ b/backends/iommufd.c
>> @@ -22,6 +22,13 @@
>>   #include "hw/vfio/vfio-device.h"
>>   #include <sys/ioctl.h>
>>   #include <linux/iommufd.h>
>> +/*
>> + * Until kernel UAPI is synced via scripts;
>> + * matches include/uapi/linux/iommufd.h
>> + */
>> +#ifndef IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
>> +#define IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED (1 << 3)
>> +#endif
> 
> This definition is introduced by :
> 
>    https://lore.kernel.org/all/20260303150348.233997-1-skolothumtho@nvidia.com/

This is now upstream.

> It should reach Linux v7.1 since it is in linux-next. Anyhow, until then,
> please isolate this change in a temporary patch updating linux-headers/

Please use script ./scripts/update-linux-headers.sh. I would wait
for v7.1-rc1 to be tagged though.

Thanks,

C.

RE: [PATCH 09/11] hw/arm/smmuv3-accel: Implement "auto" value for "oas"

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 01 April 2026 02:02
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Yi Liu <yi.l.liu@intel.com>; Eric Auger <eric.auger@redhat.com>;
> Zhenzhong Duan <zhenzhong.duan@intel.com>; Peter Maydell
> <peter.maydell@linaro.org>; Marcel Apfelbaum
> <marcel.apfelbaum@gmail.com>; Philippe Mathieu-Daudé
> <philmd@linaro.org>; Yanan Wang <wangyanan55@huawei.com>; Zhao Liu
> <zhao1.liu@intel.com>; Alex Williamson <alex@shazbot.org>; Cédric Le Goater
> <clg@redhat.com>; Shameer Kolothum Thodi <skolothumtho@nvidia.com>;
> Matt Ochs <mochs@nvidia.com>; Nicolin Chen <nicolinc@nvidia.com>;
> Nathan Chen <nathanc@nvidia.com>
> Subject: [PATCH 09/11] hw/arm/smmuv3-accel: Implement "auto" value for
> "oas"
> 
> From: Nathan Chen <nathanc@nvidia.com>
> 
> Allow accelerated SMMUv3 OAS property to be derived from host IOMMU
> capabilities. Derive host values using IOMMU_GET_HW_INFO, retrieving
> OAS from IDR5.
> 
> This keeps the OAS value advertised by the virtual SMMU compatible with
> the capabilities of the host SMMUv3, so that the intermediate physical
> addresses (IPA) consumed by host SMMU for stage-2 translation do not
> exceed the host's max supported IPA size.
> 
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3-accel.c | 9 ++++++++-
>  hw/arm/smmuv3.c       | 6 +++---
>  2 files changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
> index 03393fd7ba..105f6d26bf 100644
> --- a/hw/arm/smmuv3-accel.c
> +++ b/hw/arm/smmuv3-accel.c
> @@ -63,6 +63,12 @@ static void
> smmuv3_accel_auto_finalise(SMMUv3State *s,
>                                 FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
>      }
> 
> +    /* Update OAS if auto from info */
> +    if (s->oas == OAS_MODE_AUTO) {
> +        s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS,
> +                               FIELD_EX32(info->idr[5], IDR5, OAS));
> +    }
> +
>      accel->auto_finalised = true;
>  }
> 
> @@ -962,7 +968,8 @@ void smmuv3_accel_init(SMMUv3State *s)
> 
>      if (s->ats == ON_OFF_AUTO_AUTO ||
>          s->ril == ON_OFF_AUTO_AUTO ||
> -        s->ssidsize == SSID_SIZE_MODE_AUTO) {
> +        s->ssidsize == SSID_SIZE_MODE_AUTO ||
> +        s->oas == OAS_MODE_AUTO) {
>          s->s_accel->auto_mode = true;
>      }
>  }
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index cb14a08a66..0ab6d1e762 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -1976,7 +1976,8 @@ static bool
> smmu_validate_property(SMMUv3State *s, Error **errp)
>      }
>  #endif
> 
> -    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
> +    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48 &&
> +        s->oas != OAS_MODE_AUTO) {
>          error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48 bit"
>                     "OAS; other OasMode values are not supported");
>          return false;

Do we end up now allowing OAS_MODE_AUTO for non-accel mode?

I think we may need to adjust as below:

    if (!s->accel) {
         if (s->ril == ON_OFF_AUTO_OFF) {
              error_setg();
              return false;
          }
          if (s->ats != ON_OFF_AUTO_OFF) {
              error_setg();
              return false;
          }
          if (s->oas != OAS_MODE_44) {
              error_setg();
              return false;
          }
          if (s->ssidsize != SSID_SIZE_MODE_0) {
              error_setg();
              return false;
          }
          return true;
      }

Please check.

Thanks,
Shameer

RE: [PATCH 11/11] qemu-options.hx: Support "auto" for accel SMMUv3 properties

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 01 April 2026 02:03
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Yi Liu <yi.l.liu@intel.com>; Eric Auger <eric.auger@redhat.com>;
> Zhenzhong Duan <zhenzhong.duan@intel.com>; Peter Maydell
> <peter.maydell@linaro.org>; Marcel Apfelbaum
> <marcel.apfelbaum@gmail.com>; Philippe Mathieu-Daudé
> <philmd@linaro.org>; Yanan Wang <wangyanan55@huawei.com>; Zhao Liu
> <zhao1.liu@intel.com>; Alex Williamson <alex@shazbot.org>; Cédric Le Goater
> <clg@redhat.com>; Shameer Kolothum Thodi <skolothumtho@nvidia.com>;
> Matt Ochs <mochs@nvidia.com>; Nicolin Chen <nicolinc@nvidia.com>;
> Nathan Chen <nathanc@nvidia.com>
> Subject: [PATCH 11/11] qemu-options.hx: Support "auto" for accel SMMUv3
> properties
> 
> From: Nathan Chen <nathanc@nvidia.com>
> 
> Update documentation now that "auto" is supported for accelerated
> SMMUv3 properties.
> 
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  qemu-options.hx | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/qemu-options.hx b/qemu-options.hx index
> 21972f8326..bd43258445 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -1292,7 +1292,6 @@ SRST
>          vfio-pci passthrough.
> 
>       The following options are available when accel=on.
> -     Note: 'auto' mode is not currently supported.
> 
>      ``ril=on|off`` (default: on)
>          Support for Range Invalidation, which allows the SMMUv3 driver to

default: auto ?

This applies to all other properties as well. 
 
Also, it may be useful to clarify the "auto" behaviour, something like:

When set to auto, the value is derived from the host SMMUv3
capabilities via IOMMU_GET_HW_INFO. This requires at least one
cold-plugged   vfio-pci device; if none is present at machine init,
QEMU will abort.

Thanks,
Shameer

Re: [PATCH 11/11] qemu-options.hx: Support "auto" for accel SMMUv3 properties

[Nathan Chen]

On 4/16/2026 7:19 AM, Shameer Kolothum Thodi wrote:
> 
>> -----Original Message-----
>> From: Nathan Chen<nathanc@nvidia.com>
>> Sent: 01 April 2026 02:03
>> To:qemu-arm@nongnu.org;qemu-devel@nongnu.org
>> Cc: Yi Liu<yi.l.liu@intel.com>; Eric Auger<eric.auger@redhat.com>;
>> Zhenzhong Duan<zhenzhong.duan@intel.com>; Peter Maydell
>> <peter.maydell@linaro.org>; Marcel Apfelbaum
>> <marcel.apfelbaum@gmail.com>; Philippe Mathieu-Daudé
>> <philmd@linaro.org>; Yanan Wang<wangyanan55@huawei.com>; Zhao Liu
>> <zhao1.liu@intel.com>; Alex Williamson<alex@shazbot.org>; Cédric Le Goater
>> <clg@redhat.com>; Shameer Kolothum Thodi<skolothumtho@nvidia.com>;
>> Matt Ochs<mochs@nvidia.com>; Nicolin Chen<nicolinc@nvidia.com>;
>> Nathan Chen<nathanc@nvidia.com>
>> Subject: [PATCH 11/11] qemu-options.hx: Support "auto" for accel SMMUv3
>> properties
>>
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Update documentation now that "auto" is supported for accelerated
>> SMMUv3 properties.
>>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   qemu-options.hx | 1 -
>>   1 file changed, 1 deletion(-)
>>
>> diff --git a/qemu-options.hx b/qemu-options.hx index
>> 21972f8326..bd43258445 100644
>> --- a/qemu-options.hx
>> +++ b/qemu-options.hx
>> @@ -1292,7 +1292,6 @@ SRST
>>           vfio-pci passthrough.
>>
>>        The following options are available when accel=on.
>> -     Note: 'auto' mode is not currently supported.
>>
>>       ``ril=on|off`` (default: on)
>>           Support for Range Invalidation, which allows the SMMUv3 driver to
> default: auto ?
> 
> This applies to all other properties as well.
>   
> Also, it may be useful to clarify the "auto" behaviour, something like:
> 
> When set to auto, the value is derived from the host SMMUv3
> capabilities via IOMMU_GET_HW_INFO. This requires at least one
> cold-plugged   vfio-pci device; if none is present at machine init,
> QEMU will abort.

I will update the default to auto and clarify the auto behavior, thanks 
for the suggestion.

Thanks,
Nathan

Re: [PATCH 09/11] hw/arm/smmuv3-accel: Implement "auto" value for "oas"

[Nathan Chen]

On 4/16/2026 7:08 AM, Shameer Kolothum Thodi wrote:
> 
>> -----Original Message-----
>> From: Nathan Chen<nathanc@nvidia.com>
>> Sent: 01 April 2026 02:02
>> To:qemu-arm@nongnu.org;qemu-devel@nongnu.org
>> Cc: Yi Liu<yi.l.liu@intel.com>; Eric Auger<eric.auger@redhat.com>;
>> Zhenzhong Duan<zhenzhong.duan@intel.com>; Peter Maydell
>> <peter.maydell@linaro.org>; Marcel Apfelbaum
>> <marcel.apfelbaum@gmail.com>; Philippe Mathieu-Daudé
>> <philmd@linaro.org>; Yanan Wang<wangyanan55@huawei.com>; Zhao Liu
>> <zhao1.liu@intel.com>; Alex Williamson<alex@shazbot.org>; Cédric Le Goater
>> <clg@redhat.com>; Shameer Kolothum Thodi<skolothumtho@nvidia.com>;
>> Matt Ochs<mochs@nvidia.com>; Nicolin Chen<nicolinc@nvidia.com>;
>> Nathan Chen<nathanc@nvidia.com>
>> Subject: [PATCH 09/11] hw/arm/smmuv3-accel: Implement "auto" value for
>> "oas"
>>
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Allow accelerated SMMUv3 OAS property to be derived from host IOMMU
>> capabilities. Derive host values using IOMMU_GET_HW_INFO, retrieving
>> OAS from IDR5.
>>
>> This keeps the OAS value advertised by the virtual SMMU compatible with
>> the capabilities of the host SMMUv3, so that the intermediate physical
>> addresses (IPA) consumed by host SMMU for stage-2 translation do not
>> exceed the host's max supported IPA size.
>>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3-accel.c | 9 ++++++++-
>>   hw/arm/smmuv3.c       | 6 +++---
>>   2 files changed, 11 insertions(+), 4 deletions(-)
>>
>> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
>> index 03393fd7ba..105f6d26bf 100644
>> --- a/hw/arm/smmuv3-accel.c
>> +++ b/hw/arm/smmuv3-accel.c
>> @@ -63,6 +63,12 @@ static void
>> smmuv3_accel_auto_finalise(SMMUv3State *s,
>>                                  FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
>>       }
>>
>> +    /* Update OAS if auto from info */
>> +    if (s->oas == OAS_MODE_AUTO) {
>> +        s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS,
>> +                               FIELD_EX32(info->idr[5], IDR5, OAS));
>> +    }
>> +
>>       accel->auto_finalised = true;
>>   }
>>
>> @@ -962,7 +968,8 @@ void smmuv3_accel_init(SMMUv3State *s)
>>
>>       if (s->ats == ON_OFF_AUTO_AUTO ||
>>           s->ril == ON_OFF_AUTO_AUTO ||
>> -        s->ssidsize == SSID_SIZE_MODE_AUTO) {
>> +        s->ssidsize == SSID_SIZE_MODE_AUTO ||
>> +        s->oas == OAS_MODE_AUTO) {
>>           s->s_accel->auto_mode = true;
>>       }
>>   }
>> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
>> index cb14a08a66..0ab6d1e762 100644
>> --- a/hw/arm/smmuv3.c
>> +++ b/hw/arm/smmuv3.c
>> @@ -1976,7 +1976,8 @@ static bool
>> smmu_validate_property(SMMUv3State *s, Error **errp)
>>       }
>>   #endif
>>
>> -    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
>> +    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48 &&
>> +        s->oas != OAS_MODE_AUTO) {
>>           error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48 bit"
>>                      "OAS; other OasMode values are not supported");
>>           return false;
> Do we end up now allowing OAS_MODE_AUTO for non-accel mode?
> 
> I think we may need to adjust as below:
> 
>      if (!s->accel) {
>           if (s->ril == ON_OFF_AUTO_OFF) {
>                error_setg();
>                return false;
>            }
>            if (s->ats != ON_OFF_AUTO_OFF) {
>                error_setg();
>                return false;
>            }
>            if (s->oas != OAS_MODE_44) {
>                error_setg();
>                return false;
>            }
>            if (s->ssidsize != SSID_SIZE_MODE_0) {
>                error_setg();
>                return false;
>            }
>            return true;
>        }
> 
> Please check.
Yes, we need to adjust the check in smmu_validate_property() accordingly 
otherwise we can pass 'auto' in the non-accel case. I will include it on 
the next refresh.

Thanks,
Nathan

Re: [PATCH 04/11] vfio/pci: Add ats property and mask ATS cap when not exposed

[Nathan Chen]

On 4/16/2026 6:58 AM, Cédric Le Goater wrote:
> On 4/10/26 23:09, Cédric Le Goater wrote:
>> Hello Nathan,
>>
>> On 4/1/26 03:02, Nathan Chen wrote:
>>> From: Nathan Chen <nathanc@nvidia.com>
>>>
>>> Add an "ats" OnOffAuto property to vfio-pci. When the device has an ATS
>>> extended capability in config space but we should not expose it 
>>> (ats=off,
>>> or ats=auto and kernel reports IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED), mask
>>> the capability so the guest does not see it.
>>>
>>> This aligns with the kernel's per-device effective ATS reporting and
>>> allows omitting ATS capability when the vIOMMU has ats=off.
>>>
>>> Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
>>> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
>>
>> This looks like a standalone VFIO change that could be sent 
>> independently.
>> Could you please rebase on vfio-next [*] ? There are a few conflicting
>> changes in this branch.
>>
>> [*] https://github.com/legoater/qemu/commits/vfio-next
>>
>> You will need to add a compat machine property too. This is a guest- 
>> visible
>> ABI change. A separate patch would be preferred.
>>
>>> ---
>>>   backends/iommufd.c                 | 15 +++++++
>>>   hw/vfio/pci.c                      | 63 ++++++++++++++++++++++++++++++
>>>   hw/vfio/pci.h                      |  1 +
>>>   include/system/host_iommu_device.h | 10 +++++
>>>   4 files changed, 89 insertions(+)
>>>
>>> diff --git a/backends/iommufd.c b/backends/iommufd.c
>>> index e1fee16acf..52cb060454 100644
>>> --- a/backends/iommufd.c
>>> +++ b/backends/iommufd.c
>>> @@ -22,6 +22,13 @@
>>>   #include "hw/vfio/vfio-device.h"
>>>   #include <sys/ioctl.h>
>>>   #include <linux/iommufd.h>
>>> +/*
>>> + * Until kernel UAPI is synced via scripts;
>>> + * matches include/uapi/linux/iommufd.h
>>> + */
>>> +#ifndef IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
>>> +#define IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED (1 << 3)
>>> +#endif
>>
>> This definition is introduced by :
>>
>> https://lore.kernel.org/all/20260303150348.233997-1- 
>> skolothumtho@nvidia.com/
> 
> This is now upstream.
> 
>> It should reach Linux v7.1 since it is in linux-next. Anyhow, until then,
>> please isolate this change in a temporary patch updating linux-headers/
> 
> Please use script ./scripts/update-linux-headers.sh. I would wait
> for v7.1-rc1 to be tagged though.
Ok, I will use this script after v7.1-rc1 is tagged.

Thanks,
Nathan

Re: [PATCH 04/11] vfio/pci: Add ats property and mask ATS cap when not exposed

[Nathan Chen]

On 4/16/2026 6:43 AM, Shameer Kolothum Thodi wrote:
> 
>> -----Original Message-----
>> From: Nathan Chen<nathanc@nvidia.com>
>> Sent: 01 April 2026 02:02
>> To:qemu-arm@nongnu.org;qemu-devel@nongnu.org
>> Cc: Yi Liu<yi.l.liu@intel.com>; Eric Auger<eric.auger@redhat.com>;
>> Zhenzhong Duan<zhenzhong.duan@intel.com>; Peter Maydell
>> <peter.maydell@linaro.org>; Marcel Apfelbaum
>> <marcel.apfelbaum@gmail.com>; Philippe Mathieu-Daudé
>> <philmd@linaro.org>; Yanan Wang<wangyanan55@huawei.com>; Zhao Liu
>> <zhao1.liu@intel.com>; Alex Williamson<alex@shazbot.org>; Cédric Le Goater
>> <clg@redhat.com>; Shameer Kolothum Thodi<skolothumtho@nvidia.com>;
>> Matt Ochs<mochs@nvidia.com>; Nicolin Chen<nicolinc@nvidia.com>;
>> Nathan Chen<nathanc@nvidia.com>
>> Subject: [PATCH 04/11] vfio/pci: Add ats property and mask ATS cap when
>> not exposed
>>
> [...]
>   
>> +/*
>> + * Determine whether ATS capability should be advertised for @vdev, based
>> on
>> + * whether it was enabled on the command line and whether it is supported
>> + * according to the kernel's IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
>> bit.
>> + *
>> + * Store whether ATS capability should be advertised in @ats_need.
>> + *
>> + * Return false if kernel enables
>> IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED
>> + * and ATS is effectively unsupported.
>> + */
> Returns false only when ats=on is explicitly requested but the kernel reports
> IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED. Returns true in all other cases.
> 
> Isn't it?
Yes, I will fix the comment to say it returns false only when ats=on is 
requested but kernel reports it's not supported. If kernel reports 
IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED but ats=off or ats=auto, then we 
still return true but set ats_need to false.

Thanks,
Nathan

Re: [PATCH 09/11] hw/arm/smmuv3-accel: Implement "auto" value for "oas"

[Nathan Chen]

Hi Shameer,

On 4/16/2026 7:08 AM, Shameer Kolothum Thodi wrote:
> 
>> -----Original Message-----
>> From: Nathan Chen<nathanc@nvidia.com>
>> Sent: 01 April 2026 02:02
>> To:qemu-arm@nongnu.org;qemu-devel@nongnu.org
>> Cc: Yi Liu<yi.l.liu@intel.com>; Eric Auger<eric.auger@redhat.com>;
>> Zhenzhong Duan<zhenzhong.duan@intel.com>; Peter Maydell
>> <peter.maydell@linaro.org>; Marcel Apfelbaum
>> <marcel.apfelbaum@gmail.com>; Philippe Mathieu-Daudé
>> <philmd@linaro.org>; Yanan Wang<wangyanan55@huawei.com>; Zhao Liu
>> <zhao1.liu@intel.com>; Alex Williamson<alex@shazbot.org>; Cédric Le Goater
>> <clg@redhat.com>; Shameer Kolothum Thodi<skolothumtho@nvidia.com>;
>> Matt Ochs<mochs@nvidia.com>; Nicolin Chen<nicolinc@nvidia.com>;
>> Nathan Chen<nathanc@nvidia.com>
>> Subject: [PATCH 09/11] hw/arm/smmuv3-accel: Implement "auto" value for
>> "oas"
>>
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Allow accelerated SMMUv3 OAS property to be derived from host IOMMU
>> capabilities. Derive host values using IOMMU_GET_HW_INFO, retrieving
>> OAS from IDR5.
>>
>> This keeps the OAS value advertised by the virtual SMMU compatible with
>> the capabilities of the host SMMUv3, so that the intermediate physical
>> addresses (IPA) consumed by host SMMU for stage-2 translation do not
>> exceed the host's max supported IPA size.
>>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3-accel.c | 9 ++++++++-
>>   hw/arm/smmuv3.c       | 6 +++---
>>   2 files changed, 11 insertions(+), 4 deletions(-)
>>
>> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
>> index 03393fd7ba..105f6d26bf 100644
>> --- a/hw/arm/smmuv3-accel.c
>> +++ b/hw/arm/smmuv3-accel.c
>> @@ -63,6 +63,12 @@ static void
>> smmuv3_accel_auto_finalise(SMMUv3State *s,
>>                                  FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
>>       }
>>
>> +    /* Update OAS if auto from info */
>> +    if (s->oas == OAS_MODE_AUTO) {
>> +        s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS,
>> +                               FIELD_EX32(info->idr[5], IDR5, OAS));
>> +    }
>> +
>>       accel->auto_finalised = true;
>>   }
>>
>> @@ -962,7 +968,8 @@ void smmuv3_accel_init(SMMUv3State *s)
>>
>>       if (s->ats == ON_OFF_AUTO_AUTO ||
>>           s->ril == ON_OFF_AUTO_AUTO ||
>> -        s->ssidsize == SSID_SIZE_MODE_AUTO) {
>> +        s->ssidsize == SSID_SIZE_MODE_AUTO ||
>> +        s->oas == OAS_MODE_AUTO) {
>>           s->s_accel->auto_mode = true;
>>       }
>>   }
>> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
>> index cb14a08a66..0ab6d1e762 100644
>> --- a/hw/arm/smmuv3.c
>> +++ b/hw/arm/smmuv3.c
>> @@ -1976,7 +1976,8 @@ static bool
>> smmu_validate_property(SMMUv3State *s, Error **errp)
>>       }
>>   #endif
>>
>> -    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
>> +    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48 &&
>> +        s->oas != OAS_MODE_AUTO) {
>>           error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48 bit"
>>                      "OAS; other OasMode values are not supported");
>>           return false;
> Do we end up now allowing OAS_MODE_AUTO for non-accel mode?
> 
> I think we may need to adjust as below:
> 
>      if (!s->accel) {
>           if (s->ril == ON_OFF_AUTO_OFF) {
>                error_setg();
>                return false;
>            }
>            if (s->ats != ON_OFF_AUTO_OFF) {
>                error_setg();
>                return false;
>            }
>            if (s->oas != OAS_MODE_44) {
>                error_setg();
>                return false;
>            }
>            if (s->ssidsize != SSID_SIZE_MODE_0) {
>                error_setg()
>                return false;
>            }
>            return true;
>        }
> 
> Please check.

We do allow passing 'auto' if accel=off, but in that case 
smmuv3_accel_init() will not get called, so auto_mode = false and 
smmuv3_accel_auto_finalise() will not change the OAS.

If we adjust the check like above, users will have to manually set 
ril=on, ats=off, oas=44, ssidsize=0 when accel=off because the default 
is auto.

Would you prefer we do one of the following?
1. Add the adjustment above. Users have to manually set ril=on, ats=off, 
oas=44, ssidsize=0 when accel=off. Prevents setting auto for these 
properties when accel=off.

2. Add the adjustment above, but if accel=off and auto is set, resolve 
auto to previous defaults before we reach smmu_validate_property(). No 
functional change from current implementation.

3. Keep current implementation.

4. Add the adjustment above. Do not change defaults to auto. Users have 
to manually set auto for accel=on.

Thanks,
Nathan

RE: [PATCH 09/11] hw/arm/smmuv3-accel: Implement "auto" value for "oas"

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 20 April 2026 23:32
> To: Shameer Kolothum Thodi <skolothumtho@nvidia.com>; qemu-
> arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Yi Liu <yi.l.liu@intel.com>; Eric Auger <eric.auger@redhat.com>;
> Zhenzhong Duan <zhenzhong.duan@intel.com>; Peter Maydell
> <peter.maydell@linaro.org>; Marcel Apfelbaum
> <marcel.apfelbaum@gmail.com>; Philippe Mathieu-Daudé
> <philmd@linaro.org>; Yanan Wang <wangyanan55@huawei.com>; Zhao Liu
> <zhao1.liu@intel.com>; Alex Williamson <alex@shazbot.org>; Cédric Le Goater
> <clg@redhat.com>; Matt Ochs <mochs@nvidia.com>; Nicolin Chen
> <nicolinc@nvidia.com>
> Subject: Re: [PATCH 09/11] hw/arm/smmuv3-accel: Implement "auto" value
> for "oas"
> 
> Hi Shameer,
> 
> On 4/16/2026 7:08 AM, Shameer Kolothum Thodi wrote:
> >
> >> -----Original Message-----
> >> From: Nathan Chen<nathanc@nvidia.com>
> >> Sent: 01 April 2026 02:02
> >> To:qemu-arm@nongnu.org;qemu-devel@nongnu.org
> >> Cc: Yi Liu<yi.l.liu@intel.com>; Eric Auger<eric.auger@redhat.com>;
> >> Zhenzhong Duan<zhenzhong.duan@intel.com>; Peter Maydell
> >> <peter.maydell@linaro.org>; Marcel Apfelbaum
> >> <marcel.apfelbaum@gmail.com>; Philippe Mathieu-Daudé
> >> <philmd@linaro.org>; Yanan Wang<wangyanan55@huawei.com>; Zhao Liu
> >> <zhao1.liu@intel.com>; Alex Williamson<alex@shazbot.org>; Cédric Le
> Goater
> >> <clg@redhat.com>; Shameer Kolothum
> Thodi<skolothumtho@nvidia.com>;
> >> Matt Ochs<mochs@nvidia.com>; Nicolin Chen<nicolinc@nvidia.com>;
> >> Nathan Chen<nathanc@nvidia.com>
> >> Subject: [PATCH 09/11] hw/arm/smmuv3-accel: Implement "auto" value
> for
> >> "oas"
> >>
> >> From: Nathan Chen<nathanc@nvidia.com>
> >>
> >> Allow accelerated SMMUv3 OAS property to be derived from host IOMMU
> >> capabilities. Derive host values using IOMMU_GET_HW_INFO, retrieving
> >> OAS from IDR5.
> >>
> >> This keeps the OAS value advertised by the virtual SMMU compatible with
> >> the capabilities of the host SMMUv3, so that the intermediate physical
> >> addresses (IPA) consumed by host SMMU for stage-2 translation do not
> >> exceed the host's max supported IPA size.
> >>
> >> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
> >> ---
> >>   hw/arm/smmuv3-accel.c | 9 ++++++++-
> >>   hw/arm/smmuv3.c       | 6 +++---
> >>   2 files changed, 11 insertions(+), 4 deletions(-)
> >>
> >> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
> >> index 03393fd7ba..105f6d26bf 100644
> >> --- a/hw/arm/smmuv3-accel.c
> >> +++ b/hw/arm/smmuv3-accel.c
> >> @@ -63,6 +63,12 @@ static void
> >> smmuv3_accel_auto_finalise(SMMUv3State *s,
> >>                                  FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
> >>       }
> >>
> >> +    /* Update OAS if auto from info */
> >> +    if (s->oas == OAS_MODE_AUTO) {
> >> +        s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS,
> >> +                               FIELD_EX32(info->idr[5], IDR5, OAS));
> >> +    }
> >> +
> >>       accel->auto_finalised = true;
> >>   }
> >>
> >> @@ -962,7 +968,8 @@ void smmuv3_accel_init(SMMUv3State *s)
> >>
> >>       if (s->ats == ON_OFF_AUTO_AUTO ||
> >>           s->ril == ON_OFF_AUTO_AUTO ||
> >> -        s->ssidsize == SSID_SIZE_MODE_AUTO) {
> >> +        s->ssidsize == SSID_SIZE_MODE_AUTO ||
> >> +        s->oas == OAS_MODE_AUTO) {
> >>           s->s_accel->auto_mode = true;
> >>       }
> >>   }
> >> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> >> index cb14a08a66..0ab6d1e762 100644
> >> --- a/hw/arm/smmuv3.c
> >> +++ b/hw/arm/smmuv3.c
> >> @@ -1976,7 +1976,8 @@ static bool
> >> smmu_validate_property(SMMUv3State *s, Error **errp)
> >>       }
> >>   #endif
> >>
> >> -    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
> >> +    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48 &&
> >> +        s->oas != OAS_MODE_AUTO) {
> >>           error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48
> bit"
> >>                      "OAS; other OasMode values are not supported");
> >>           return false;
> > Do we end up now allowing OAS_MODE_AUTO for non-accel mode?
> >
> > I think we may need to adjust as below:
> >
> >      if (!s->accel) {
> >           if (s->ril == ON_OFF_AUTO_OFF) {
> >                error_setg();
> >                return false;
> >            }
> >            if (s->ats != ON_OFF_AUTO_OFF) {
> >                error_setg();
> >                return false;
> >            }
> >            if (s->oas != OAS_MODE_44) {
> >                error_setg();
> >                return false;
> >            }
> >            if (s->ssidsize != SSID_SIZE_MODE_0) {
> >                error_setg()
> >                return false;
> >            }
> >            return true;
> >        }
> >
> > Please check.
> 
> We do allow passing 'auto' if accel=off, but in that case
> smmuv3_accel_init() will not get called, so auto_mode = false and
> smmuv3_accel_auto_finalise() will not change the OAS.

Ok.

> 
> If we adjust the check like above, users will have to manually set
> ril=on, ats=off, oas=44, ssidsize=0 when accel=off because the default
> is auto.
> 
> Would you prefer we do one of the following?
> 1. Add the adjustment above. Users have to manually set ril=on, ats=off,
> oas=44, ssidsize=0 when accel=off. Prevents setting auto for these
> properties when accel=off.
> 
> 2. Add the adjustment above, but if accel=off and auto is set, resolve
> auto to previous defaults before we reach smmu_validate_property(). No
> functional change from current implementation.
> 
> 3. Keep current implementation.

The problem I am seeing is we set the default for these properties as
_AUTO but for non-accel case the default is actually something else.

I am fine to keep it as it is, but we need to capture this in commit
log/comments and probably need mention in qemu-options.hx.

Thanks,
Shameer