[PATCH v3 0/7] hw/arm/smmuv3-accel: Resolve AUTO properties

[PATCH v3 0/7] hw/arm/smmuv3-accel: Resolve AUTO properties

[Nathan Chen]

Hi,

This is a follow-up to the series [0] that introduces support for
resolving 'auto' for arm-smmuv3 accelerated mode's ATS, RIL, SSIDSIZE,
and OAS feature properties based on host IOMMU capabilities. This is
dependent on the series [1] for changing these property types to accept
'auto' values.

Accelerated SMMUv3 Address Translation Services support is derived from
IDR0, Range Invalidation support is derived from IDR3, Substream ID
size is derived from IDR1, and output address space is derived from
IDR5.

The default values are set to 'auto' for all properties. If accel=off
and the values are set to 'auto' or are omitted and resolve to 'auto',
the default property values defined in smmuv3_init_id_regs() for OAS
and RIL will remain unchanged, while SSIDSIZE and ATS values will
remain initialized at 0.

A complete branch can be found here:
https://github.com/NathanChenNVIDIA/qemu/tree/smmuv3-accel-auto-resolve-v3

Please take a look and let me know your feedback.

Thanks,
Nathan

[0] https://lore.kernel.org/all/20260422204335.23116-1-nathanc@nvidia.com/
[1] https://lore.kernel.org/qemu-arm/20260323182454.1416110-1-nathanc@nvidia.com/

Changes from v2:
- Added R-by tags, thanks Eric, Shameer, Cédric for the feedback!
- Re-worded descriptions in qemu-options.hx and smmu_validate_property()
- Emphasize accel=off auto behavior in a comment for smmuv3_properties[]

Changes from v1:
- Update qemu-options.hx to explicitly mention auto is supported
- Update qemu-options.hx to mention auto as default
- Simplify comments in smmuv3_accel_auto_finalise()
- Update descriptions in smmuv3_class_init()
- Consolidate all default value change patches into one patch
- Implement and use smmuv3_pasid_supported() for setting PASID support
  flag
- Move smmuv3_machine_done() and qemu_add_machine_init_done_notifier()
  to smmuv3-accel.c
- Register machine done notifier only in case auto_mode is set

Nathan Chen (7):
  hw/arm/smmuv3-accel: Add helper for resolving auto parameters
  hw/arm/smmuv3-accel: Implement "auto" value for "ats"
  hw/arm/smmuv3-accel: Implement "auto" value for "ril"
  hw/arm/smmuv3-accel: Implement "auto" value for "ssidsize"
  hw/arm/smmuv3-accel: Implement "auto" value for "oas"
  hw/arm/smmuv3: Set default ats, ril, ssidsize, oas to auto
  qemu-options.hx: Support "auto" for accel SMMUv3 properties

 hw/arm/smmuv3-accel.c   | 81 ++++++++++++++++++++++++++++++++++++++++-
 hw/arm/smmuv3-accel.h   |  2 +
 hw/arm/smmuv3.c         | 71 +++++++++++++++++++-----------------
 hw/core/machine.c       |  5 +++
 include/hw/arm/smmuv3.h |  2 +
 qemu-options.hx         | 25 ++++++++++---
 6 files changed, 145 insertions(+), 41 deletions(-)

-- 
2.43.0

[PATCH v3 1/7] hw/arm/smmuv3-accel: Add helper for resolving auto parameters

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Introduce smmuv3_accel_auto_finalise() to resolve properties that are
set to 'auto' for accelerated SMMUv3. This helper function allows
properties such as ats, ril, ssidsize, and oas support to be resolved
from host IOMMU capabilities via IOMMU_GET_HW_INFO.

The later commits in this series set the auto_mode flag to true when
an accel SMMUv3 property value is explicitly set to 'auto', or if the
property value is not set and defaults to auto mode.

Setting these property values to 'auto' requires at least one
cold-plugged device to retrieve and finalise these properties. If the
auto_mode flag is true, register a machine_init_done notifier to
verify this requirement and fail boot if it is not met.

Hot-plugged devices into an accel SMMUv3-associated bus will re-use
the resolved host values from the initial cold-plug.

Subsequent patches will make use of this helper to resolve 'auto' to
what is reported by host IOMMU capabilities.

Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3-accel.c   | 44 +++++++++++++++++++++++++++++++++++++++++
 hw/arm/smmuv3-accel.h   |  2 ++
 include/hw/arm/smmuv3.h |  2 ++
 3 files changed, 48 insertions(+)

diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
index 862be814a0..82c0800f4d 100644
--- a/hw/arm/smmuv3-accel.c
+++ b/hw/arm/smmuv3-accel.c
@@ -18,6 +18,7 @@
 
 #include "smmuv3-internal.h"
 #include "smmuv3-accel.h"
+#include "system/system.h"
 
 /*
  * The root region aliases the global system memory, and shared_as_sysmem
@@ -35,11 +36,32 @@ static int smmuv3_oas_bits(uint32_t oas)
     return map[oas];
 }
 
+static void smmuv3_accel_auto_finalise(SMMUv3State *s,
+                                       struct iommu_hw_info_arm_smmuv3 *info) {
+    SMMUv3AccelState *accel = s->s_accel;
+
+    /*
+     * Return if 'auto' was not set for any accel SMMUv3 property, or
+     * if property values were already resolved from a previous call
+     * to this function (e.g. if this function was called again after
+     * VM boot during device hot plug). We do not accept new property
+     * values in this case where auto_finalised == true, and we re-use
+     * the values determined from the initial cold plug.
+     */
+    if (!accel->auto_mode || accel->auto_finalised) {
+        return;
+    }
+
+    accel->auto_finalised = true;
+}
+
 static bool
 smmuv3_accel_check_hw_compatible(SMMUv3State *s,
                                  struct iommu_hw_info_arm_smmuv3 *info,
                                  Error **errp)
 {
+    smmuv3_accel_auto_finalise(s, info);
+
     /* QEMU SMMUv3 supports both linear and 2-level stream tables */
     if (FIELD_EX32(info->idr[0], IDR0, STLEVEL) !=
                 FIELD_EX32(s->idr[0], IDR0, STLEVEL)) {
@@ -918,6 +940,22 @@ static void smmuv3_accel_as_init(SMMUv3State *s)
     address_space_init(shared_as_sysmem, &root, "smmuv3-accel-as-sysmem");
 }
 
+static void smmuv3_machine_done(Notifier *notifier, void *data)
+{
+    SMMUv3State *s = container_of(notifier, SMMUv3State, machine_done);
+    SMMUv3AccelState *accel = s->s_accel;
+
+    if (!s->accel) {
+        return;
+    }
+
+    if (accel->auto_mode && !accel->auto_finalised) {
+        error_report("arm-smmuv3 accel=on with 'auto' properties requires "
+                     "at least one cold-plugged VFIO device");
+        exit(1);
+    }
+}
+
 bool smmuv3_accel_init(SMMUv3State *s, Error **errp)
 {
     SMMUState *bs = ARM_SMMU(s);
@@ -925,5 +963,11 @@ bool smmuv3_accel_init(SMMUv3State *s, Error **errp)
     s->s_accel = g_new0(SMMUv3AccelState, 1);
     bs->iommu_ops = &smmuv3_accel_ops;
     smmuv3_accel_as_init(s);
+
+    if (s->s_accel->auto_mode) {
+        s->machine_done.notify = smmuv3_machine_done;
+        qemu_add_machine_init_done_notifier(&s->machine_done);
+    }
+
     return true;
 }
diff --git a/hw/arm/smmuv3-accel.h b/hw/arm/smmuv3-accel.h
index 407940616c..87fecb5c68 100644
--- a/hw/arm/smmuv3-accel.h
+++ b/hw/arm/smmuv3-accel.h
@@ -25,6 +25,8 @@ typedef struct SMMUv3AccelState {
     uint32_t bypass_hwpt_id;
     uint32_t abort_hwpt_id;
     QLIST_HEAD(, SMMUv3AccelDevice) device_list;
+    bool auto_mode;
+    bool auto_finalised;
 } SMMUv3AccelState;
 
 typedef struct SMMUS1Hwpt {
diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
index 82f18eb090..fe0493c1aa 100644
--- a/include/hw/arm/smmuv3.h
+++ b/include/hw/arm/smmuv3.h
@@ -74,6 +74,8 @@ struct SMMUv3State {
     OnOffAuto ats;
     OasMode oas;
     SsidSizeMode ssidsize;
+
+    Notifier machine_done;
 };
 
 typedef enum {
-- 
2.43.0

RE: [PATCH v3 1/7] hw/arm/smmuv3-accel: Add helper for resolving auto parameters

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 12 May 2026 20:35
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Eric Auger <eric.auger@redhat.com>; Peter Maydell
> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé <philmd@linaro.org>;
> Zhao Liu <zhao1.liu@intel.com>; Matt Ochs <mochs@nvidia.com>; Nicolin
> Chen <nicolinc@nvidia.com>; Shameer Kolothum Thodi
> <skolothumtho@nvidia.com>; Nathan Chen <nathanc@nvidia.com>
> Subject: [PATCH v3 1/7] hw/arm/smmuv3-accel: Add helper for resolving auto
> parameters
> 
> From: Nathan Chen <nathanc@nvidia.com>
> 
> Introduce smmuv3_accel_auto_finalise() to resolve properties that are
> set to 'auto' for accelerated SMMUv3. This helper function allows
> properties such as ats, ril, ssidsize, and oas support to be resolved
> from host IOMMU capabilities via IOMMU_GET_HW_INFO.
> 
> The later commits in this series set the auto_mode flag to true when
> an accel SMMUv3 property value is explicitly set to 'auto', or if the
> property value is not set and defaults to auto mode.
> 
> Setting these property values to 'auto' requires at least one
> cold-plugged device to retrieve and finalise these properties. If the
> auto_mode flag is true, register a machine_init_done notifier to
> verify this requirement and fail boot if it is not met.
> 
> Hot-plugged devices into an accel SMMUv3-associated bus will re-use
> the resolved host values from the initial cold-plug.
> 
> Subsequent patches will make use of this helper to resolve 'auto' to
> what is reported by host IOMMU capabilities.
> 
> Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
> Reviewed-by: Eric Auger <eric.auger@redhat.com>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3-accel.c   | 44
> +++++++++++++++++++++++++++++++++++++++++
>  hw/arm/smmuv3-accel.h   |  2 ++
>  include/hw/arm/smmuv3.h |  2 ++
>  3 files changed, 48 insertions(+)
> 
> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
> index 862be814a0..82c0800f4d 100644
> --- a/hw/arm/smmuv3-accel.c
> +++ b/hw/arm/smmuv3-accel.c
> @@ -18,6 +18,7 @@
> 
>  #include "smmuv3-internal.h"
>  #include "smmuv3-accel.h"
> +#include "system/system.h"
> 
>  /*
>   * The root region aliases the global system memory, and shared_as_sysmem
> @@ -35,11 +36,32 @@ static int smmuv3_oas_bits(uint32_t oas)
>      return map[oas];
>  }
> 
> +static void smmuv3_accel_auto_finalise(SMMUv3State *s,
> +                                       struct iommu_hw_info_arm_smmuv3 *info) {

Nit: Move the opening brace to its own line.

> +    SMMUv3AccelState *accel = s->s_accel;
> +
> +    /*
> +     * Return if 'auto' was not set for any accel SMMUv3 property, or
> +     * if property values were already resolved from a previous call
> +     * to this function (e.g. if this function was called again after
> +     * VM boot during device hot plug). We do not accept new property
> +     * values in this case where auto_finalised == true, and we re-use
> +     * the values determined from the initial cold plug.
> +     */
> +    if (!accel->auto_mode || accel->auto_finalised) {
> +        return;
> +    }
> +
> +    accel->auto_finalised = true;
> +}
> +
>  static bool
>  smmuv3_accel_check_hw_compatible(SMMUv3State *s,
>                                   struct iommu_hw_info_arm_smmuv3 *info,
>                                   Error **errp)
>  {
> +    smmuv3_accel_auto_finalise(s, info);
> +
>      /* QEMU SMMUv3 supports both linear and 2-level stream tables */
>      if (FIELD_EX32(info->idr[0], IDR0, STLEVEL) !=
>                  FIELD_EX32(s->idr[0], IDR0, STLEVEL)) {
> @@ -918,6 +940,22 @@ static void smmuv3_accel_as_init(SMMUv3State *s)
>      address_space_init(shared_as_sysmem, &root, "smmuv3-accel-as-
> sysmem");
>  }
> 
> +static void smmuv3_machine_done(Notifier *notifier, void *data)

smmuv3_accel_machine_done() better.

> +{
> +    SMMUv3State *s = container_of(notifier, SMMUv3State, machine_done);
> +    SMMUv3AccelState *accel = s->s_accel;
> +
> +    if (!s->accel) {
> +        return;
Not sure we need this as we only register this for accel cases.

> +    }
> +
> +    if (accel->auto_mode && !accel->auto_finalised) {
> +        error_report("arm-smmuv3 accel=on with 'auto' properties requires "
> +                     "at least one cold-plugged VFIO device");
> +        exit(1);
> +    }
> +}
> +
>  bool smmuv3_accel_init(SMMUv3State *s, Error **errp)
>  {
>      SMMUState *bs = ARM_SMMU(s);
> @@ -925,5 +963,11 @@ bool smmuv3_accel_init(SMMUv3State *s, Error
> **errp)
>      s->s_accel = g_new0(SMMUv3AccelState, 1);
>      bs->iommu_ops = &smmuv3_accel_ops;
>      smmuv3_accel_as_init(s);
> +
> +    if (s->s_accel->auto_mode) {
> +        s->machine_done.notify = smmuv3_machine_done;
> +        qemu_add_machine_init_done_notifier(&s->machine_done);
> +    }
> +
>      return true;
>  }
> diff --git a/hw/arm/smmuv3-accel.h b/hw/arm/smmuv3-accel.h
> index 407940616c..87fecb5c68 100644
> --- a/hw/arm/smmuv3-accel.h
> +++ b/hw/arm/smmuv3-accel.h
> @@ -25,6 +25,8 @@ typedef struct SMMUv3AccelState {
>      uint32_t bypass_hwpt_id;
>      uint32_t abort_hwpt_id;
>      QLIST_HEAD(, SMMUv3AccelDevice) device_list;
> +    bool auto_mode;
> +    bool auto_finalised;
>  } SMMUv3AccelState;
> 
>  typedef struct SMMUS1Hwpt {
> diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
> index 82f18eb090..fe0493c1aa 100644
> --- a/include/hw/arm/smmuv3.h
> +++ b/include/hw/arm/smmuv3.h
> @@ -74,6 +74,8 @@ struct SMMUv3State {
>      OnOffAuto ats;
>      OasMode oas;
>      SsidSizeMode ssidsize;
> +
> +    Notifier machine_done;

Better to #include "qemu/notify.h" in this header.
It may be compiling through some indirect #include now.

Besides:

Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>

Thanks,
Shameer

Re: [PATCH v3 1/7] hw/arm/smmuv3-accel: Add helper for resolving auto parameters

[Nathan Chen]

On 5/14/2026 6:41 AM, Shameer Kolothum Thodi wrote:
> 
>> -----Original Message-----
>> From: Nathan Chen<nathanc@nvidia.com>
>> Sent: 12 May 2026 20:35
>> To:qemu-arm@nongnu.org;qemu-devel@nongnu.org
>> Cc: Eric Auger<eric.auger@redhat.com>; Peter Maydell
>> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé<philmd@linaro.org>;
>> Zhao Liu<zhao1.liu@intel.com>; Matt Ochs<mochs@nvidia.com>; Nicolin
>> Chen<nicolinc@nvidia.com>; Shameer Kolothum Thodi
>> <skolothumtho@nvidia.com>; Nathan Chen<nathanc@nvidia.com>
>> Subject: [PATCH v3 1/7] hw/arm/smmuv3-accel: Add helper for resolving auto
>> parameters
>>
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Introduce smmuv3_accel_auto_finalise() to resolve properties that are
>> set to 'auto' for accelerated SMMUv3. This helper function allows
>> properties such as ats, ril, ssidsize, and oas support to be resolved
>> from host IOMMU capabilities via IOMMU_GET_HW_INFO.
>>
>> The later commits in this series set the auto_mode flag to true when
>> an accel SMMUv3 property value is explicitly set to 'auto', or if the
>> property value is not set and defaults to auto mode.
>>
>> Setting these property values to 'auto' requires at least one
>> cold-plugged device to retrieve and finalise these properties. If the
>> auto_mode flag is true, register a machine_init_done notifier to
>> verify this requirement and fail boot if it is not met.
>>
>> Hot-plugged devices into an accel SMMUv3-associated bus will re-use
>> the resolved host values from the initial cold-plug.
>>
>> Subsequent patches will make use of this helper to resolve 'auto' to
>> what is reported by host IOMMU capabilities.
>>
>> Suggested-by: Shameer Kolothum<skolothumtho@nvidia.com>
>> Reviewed-by: Eric Auger<eric.auger@redhat.com>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3-accel.c   | 44
>> +++++++++++++++++++++++++++++++++++++++++
>>   hw/arm/smmuv3-accel.h   |  2 ++
>>   include/hw/arm/smmuv3.h |  2 ++
>>   3 files changed, 48 insertions(+)
>>
>> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
>> index 862be814a0..82c0800f4d 100644
>> --- a/hw/arm/smmuv3-accel.c
>> +++ b/hw/arm/smmuv3-accel.c
>> @@ -18,6 +18,7 @@
>>
>>   #include "smmuv3-internal.h"
>>   #include "smmuv3-accel.h"
>> +#include "system/system.h"
>>
>>   /*
>>    * The root region aliases the global system memory, and shared_as_sysmem
>> @@ -35,11 +36,32 @@ static int smmuv3_oas_bits(uint32_t oas)
>>       return map[oas];
>>   }
>>
>> +static void smmuv3_accel_auto_finalise(SMMUv3State *s,
>> +                                       struct iommu_hw_info_arm_smmuv3 *info) {
> Nit: Move the opening brace to its own line.
> 
>> +    SMMUv3AccelState *accel = s->s_accel;
>> +
>> +    /*
>> +     * Return if 'auto' was not set for any accel SMMUv3 property, or
>> +     * if property values were already resolved from a previous call
>> +     * to this function (e.g. if this function was called again after
>> +     * VM boot during device hot plug). We do not accept new property
>> +     * values in this case where auto_finalised == true, and we re-use
>> +     * the values determined from the initial cold plug.
>> +     */
>> +    if (!accel->auto_mode || accel->auto_finalised) {
>> +        return;
>> +    }
>> +
>> +    accel->auto_finalised = true;
>> +}
>> +
>>   static bool
>>   smmuv3_accel_check_hw_compatible(SMMUv3State *s,
>>                                    struct iommu_hw_info_arm_smmuv3 *info,
>>                                    Error **errp)
>>   {
>> +    smmuv3_accel_auto_finalise(s, info);
>> +
>>       /* QEMU SMMUv3 supports both linear and 2-level stream tables */
>>       if (FIELD_EX32(info->idr[0], IDR0, STLEVEL) !=
>>                   FIELD_EX32(s->idr[0], IDR0, STLEVEL)) {
>> @@ -918,6 +940,22 @@ static void smmuv3_accel_as_init(SMMUv3State *s)
>>       address_space_init(shared_as_sysmem, &root, "smmuv3-accel-as-
>> sysmem");
>>   }
>>
>> +static void smmuv3_machine_done(Notifier *notifier, void *data)
> smmuv3_accel_machine_done() better.
> 
>> +{
>> +    SMMUv3State *s = container_of(notifier, SMMUv3State, machine_done);
>> +    SMMUv3AccelState *accel = s->s_accel;
>> +
>> +    if (!s->accel) {
>> +        return;
> Not sure we need this as we only register this for accel cases.
> 
>> +    }
>> +
>> +    if (accel->auto_mode && !accel->auto_finalised) {
>> +        error_report("arm-smmuv3 accel=on with 'auto' properties requires "
>> +                     "at least one cold-plugged VFIO device");
>> +        exit(1);
>> +    }
>> +}
>> +
>>   bool smmuv3_accel_init(SMMUv3State *s, Error **errp)
>>   {
>>       SMMUState *bs = ARM_SMMU(s);
>> @@ -925,5 +963,11 @@ bool smmuv3_accel_init(SMMUv3State *s, Error
>> **errp)
>>       s->s_accel = g_new0(SMMUv3AccelState, 1);
>>       bs->iommu_ops = &smmuv3_accel_ops;
>>       smmuv3_accel_as_init(s);
>> +
>> +    if (s->s_accel->auto_mode) {
>> +        s->machine_done.notify = smmuv3_machine_done;
>> +        qemu_add_machine_init_done_notifier(&s->machine_done);
>> +    }
>> +
>>       return true;
>>   }
>> diff --git a/hw/arm/smmuv3-accel.h b/hw/arm/smmuv3-accel.h
>> index 407940616c..87fecb5c68 100644
>> --- a/hw/arm/smmuv3-accel.h
>> +++ b/hw/arm/smmuv3-accel.h
>> @@ -25,6 +25,8 @@ typedef struct SMMUv3AccelState {
>>       uint32_t bypass_hwpt_id;
>>       uint32_t abort_hwpt_id;
>>       QLIST_HEAD(, SMMUv3AccelDevice) device_list;
>> +    bool auto_mode;
>> +    bool auto_finalised;
>>   } SMMUv3AccelState;
>>
>>   typedef struct SMMUS1Hwpt {
>> diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
>> index 82f18eb090..fe0493c1aa 100644
>> --- a/include/hw/arm/smmuv3.h
>> +++ b/include/hw/arm/smmuv3.h
>> @@ -74,6 +74,8 @@ struct SMMUv3State {
>>       OnOffAuto ats;
>>       OasMode oas;
>>       SsidSizeMode ssidsize;
>> +
>> +    Notifier machine_done;
> Better to #include "qemu/notify.h" in this header.
> It may be compiling through some indirect #include now.
Ok, thanks for the feedback - I will update these in the next refresh.

Thanks,
Nathan

[PATCH v3 2/7] hw/arm/smmuv3-accel: Implement "auto" value for "ats"

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Allow accelerated SMMUv3 Address Translation Services support property
to be derived from host IOMMU capabilities. Derive host values using
IOMMU_GET_HW_INFO, retrieving ATS capability from IDR0.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3-accel.c |  9 +++++++++
 hw/arm/smmuv3.c       | 11 ++++-------
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
index 82c0800f4d..9fbd13c438 100644
--- a/hw/arm/smmuv3-accel.c
+++ b/hw/arm/smmuv3-accel.c
@@ -52,6 +52,11 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
         return;
     }
 
+    if (s->ats == ON_OFF_AUTO_AUTO) {
+        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ATS,
+                               FIELD_EX32(info->idr[0], IDR0, ATS));
+    }
+
     accel->auto_finalised = true;
 }
 
@@ -964,6 +969,10 @@ bool smmuv3_accel_init(SMMUv3State *s, Error **errp)
     bs->iommu_ops = &smmuv3_accel_ops;
     smmuv3_accel_as_init(s);
 
+    if (s->ats == ON_OFF_AUTO_AUTO) {
+        s->s_accel->auto_mode = true;
+    }
+
     if (s->s_accel->auto_mode) {
         s->machine_done.notify = smmuv3_machine_done;
         qemu_add_machine_init_done_notifier(&s->machine_done);
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 5c2855c377..e558f09652 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -1965,10 +1965,6 @@ static void smmu_reset_exit(Object *obj, ResetType type)
 
 static bool smmu_validate_property(SMMUv3State *s, Error **errp)
 {
-    if (s->ats == ON_OFF_AUTO_AUTO) {
-        error_setg(errp, "ats auto mode is not supported");
-        return false;
-    }
     if (s->ril == ON_OFF_AUTO_AUTO) {
         error_setg(errp, "ril auto mode is not supported");
         return false;
@@ -2170,9 +2166,10 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
         "Disable range invalidation support (for accel=on). ril=auto "
         "is not supported.");
     object_class_property_set_description(klass, "ats",
-        "Enable/disable ATS support (for accel=on). Please ensure host "
-        "platform has ATS support before enabling this. ats=auto is not "
-        "supported.");
+        "Enable/disable ATS support (for accel=on). "
+        "Valid values are on, off, and auto. Defaults to off. "
+        "Please ensure host platform supports ATS before setting it "
+        "to on.");
     object_class_property_set_description(klass, "oas",
         "Specify Output Address Size (for accel=on). Supported values "
         "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "
-- 
2.43.0

RE: [PATCH v3 2/7] hw/arm/smmuv3-accel: Implement "auto" value for "ats"

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 12 May 2026 20:35
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Eric Auger <eric.auger@redhat.com>; Peter Maydell
> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé <philmd@linaro.org>;
> Zhao Liu <zhao1.liu@intel.com>; Matt Ochs <mochs@nvidia.com>; Nicolin
> Chen <nicolinc@nvidia.com>; Shameer Kolothum Thodi
> <skolothumtho@nvidia.com>; Nathan Chen <nathanc@nvidia.com>
> Subject: [PATCH v3 2/7] hw/arm/smmuv3-accel: Implement "auto" value for
> "ats"
> 
> From: Nathan Chen <nathanc@nvidia.com>
> 
> Allow accelerated SMMUv3 Address Translation Services support property
> to be derived from host IOMMU capabilities. Derive host values using
> IOMMU_GET_HW_INFO, retrieving ATS capability from IDR0.
> 
> Reviewed-by: Eric Auger <eric.auger@redhat.com>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3-accel.c |  9 +++++++++
>  hw/arm/smmuv3.c       | 11 ++++-------
>  2 files changed, 13 insertions(+), 7 deletions(-)
> 
> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
> index 82c0800f4d..9fbd13c438 100644
> --- a/hw/arm/smmuv3-accel.c
> +++ b/hw/arm/smmuv3-accel.c
> @@ -52,6 +52,11 @@ static void
> smmuv3_accel_auto_finalise(SMMUv3State *s,
>          return;
>      }
> 
> +    if (s->ats == ON_OFF_AUTO_AUTO) {
> +        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ATS,
> +                               FIELD_EX32(info->idr[0], IDR0, ATS));
> +    }
> +
>      accel->auto_finalised = true;
>  }
> 
> @@ -964,6 +969,10 @@ bool smmuv3_accel_init(SMMUv3State *s, Error
> **errp)
>      bs->iommu_ops = &smmuv3_accel_ops;
>      smmuv3_accel_as_init(s);
> 
> +    if (s->ats == ON_OFF_AUTO_AUTO) {
> +        s->s_accel->auto_mode = true;
> +    }
> +
>      if (s->s_accel->auto_mode) {
>          s->machine_done.notify = smmuv3_machine_done;
>          qemu_add_machine_init_done_notifier(&s->machine_done);
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index 5c2855c377..e558f09652 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -1965,10 +1965,6 @@ static void smmu_reset_exit(Object *obj,
> ResetType type)
> 
>  static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>  {
> -    if (s->ats == ON_OFF_AUTO_AUTO) {
> -        error_setg(errp, "ats auto mode is not supported");
> -        return false;
> -    }
>      if (s->ril == ON_OFF_AUTO_AUTO) {
>          error_setg(errp, "ril auto mode is not supported");
>          return false;
> @@ -2170,9 +2166,10 @@ static void smmuv3_class_init(ObjectClass *klass,
> const void *data)
>          "Disable range invalidation support (for accel=on). ril=auto "
>          "is not supported.");
>      object_class_property_set_description(klass, "ats",
> -        "Enable/disable ATS support (for accel=on). Please ensure host "
> -        "platform has ATS support before enabling this. ats=auto is not "
> -        "supported.");
> +        "Enable/disable ATS support (for accel=on). "
> +        "Valid values are on, off, and auto. Defaults to off. "
> +        "Please ensure host platform supports ATS before setting it "
> +        "to on.");
>      object_class_property_set_description(klass, "oas",
>          "Specify Output Address Size (for accel=on). Supported values "
>          "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "

In smmuv3.c we have;

case SMMU_CMD_ATC_INV:
        {
            SMMUDevice *sdev = smmu_find_sdev(bs, CMD_SID(&cmd));

            if (!sdev || !s->ats) {
                trace_smmuv3_unhandled_cmd(type);
                break;
            }

            if (!smmuv3_accel_issue_inv_cmd(s, &cmd, sdev, errp)) {
                cmd_error = SMMU_CERROR_ILL;
                break;
            }
            break;
        }

The above !s->ats will be true for AUTO case, right? I think
we should change the above check with smmuv3_ats_enabled().

Also, since we modified the ats to OnOffAuto in the previous
series, I am not sure the above should be a fix patch or not.

Thanks,
Shameer

Re: [PATCH v3 2/7] hw/arm/smmuv3-accel: Implement "auto" value for "ats"

[Nathan Chen]

On 5/14/2026 7:11 AM, Shameer Kolothum Thodi wrote:
> 
>> -----Original Message-----
>> From: Nathan Chen<nathanc@nvidia.com>
>> Sent: 12 May 2026 20:35
>> To:qemu-arm@nongnu.org;qemu-devel@nongnu.org
>> Cc: Eric Auger<eric.auger@redhat.com>; Peter Maydell
>> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé<philmd@linaro.org>;
>> Zhao Liu<zhao1.liu@intel.com>; Matt Ochs<mochs@nvidia.com>; Nicolin
>> Chen<nicolinc@nvidia.com>; Shameer Kolothum Thodi
>> <skolothumtho@nvidia.com>; Nathan Chen<nathanc@nvidia.com>
>> Subject: [PATCH v3 2/7] hw/arm/smmuv3-accel: Implement "auto" value for
>> "ats"
>>
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Allow accelerated SMMUv3 Address Translation Services support property
>> to be derived from host IOMMU capabilities. Derive host values using
>> IOMMU_GET_HW_INFO, retrieving ATS capability from IDR0.
>>
>> Reviewed-by: Eric Auger<eric.auger@redhat.com>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3-accel.c |  9 +++++++++
>>   hw/arm/smmuv3.c       | 11 ++++-------
>>   2 files changed, 13 insertions(+), 7 deletions(-)
>>
>> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
>> index 82c0800f4d..9fbd13c438 100644
>> --- a/hw/arm/smmuv3-accel.c
>> +++ b/hw/arm/smmuv3-accel.c
>> @@ -52,6 +52,11 @@ static void
>> smmuv3_accel_auto_finalise(SMMUv3State *s,
>>           return;
>>       }
>>
>> +    if (s->ats == ON_OFF_AUTO_AUTO) {
>> +        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ATS,
>> +                               FIELD_EX32(info->idr[0], IDR0, ATS));
>> +    }
>> +
>>       accel->auto_finalised = true;
>>   }
>>
>> @@ -964,6 +969,10 @@ bool smmuv3_accel_init(SMMUv3State *s, Error
>> **errp)
>>       bs->iommu_ops = &smmuv3_accel_ops;
>>       smmuv3_accel_as_init(s);
>>
>> +    if (s->ats == ON_OFF_AUTO_AUTO) {
>> +        s->s_accel->auto_mode = true;
>> +    }
>> +
>>       if (s->s_accel->auto_mode) {
>>           s->machine_done.notify = smmuv3_machine_done;
>>           qemu_add_machine_init_done_notifier(&s->machine_done);
>> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
>> index 5c2855c377..e558f09652 100644
>> --- a/hw/arm/smmuv3.c
>> +++ b/hw/arm/smmuv3.c
>> @@ -1965,10 +1965,6 @@ static void smmu_reset_exit(Object *obj,
>> ResetType type)
>>
>>   static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>>   {
>> -    if (s->ats == ON_OFF_AUTO_AUTO) {
>> -        error_setg(errp, "ats auto mode is not supported");
>> -        return false;
>> -    }
>>       if (s->ril == ON_OFF_AUTO_AUTO) {
>>           error_setg(errp, "ril auto mode is not supported");
>>           return false;
>> @@ -2170,9 +2166,10 @@ static void smmuv3_class_init(ObjectClass *klass,
>> const void *data)
>>           "Disable range invalidation support (for accel=on). ril=auto "
>>           "is not supported.");
>>       object_class_property_set_description(klass, "ats",
>> -        "Enable/disable ATS support (for accel=on). Please ensure host "
>> -        "platform has ATS support before enabling this. ats=auto is not "
>> -        "supported.");
>> +        "Enable/disable ATS support (for accel=on). "
>> +        "Valid values are on, off, and auto. Defaults to off. "
>> +        "Please ensure host platform supports ATS before setting it "
>> +        "to on.");
>>       object_class_property_set_description(klass, "oas",
>>           "Specify Output Address Size (for accel=on). Supported values "
>>           "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "
> In smmuv3.c we have;
> 
> case SMMU_CMD_ATC_INV:
>          {
>              SMMUDevice *sdev = smmu_find_sdev(bs, CMD_SID(&cmd));
> 
>              if (!sdev || !s->ats) {
>                  trace_smmuv3_unhandled_cmd(type);
>                  break;
>              }
> 
>              if (!smmuv3_accel_issue_inv_cmd(s, &cmd, sdev, errp)) {
>                  cmd_error = SMMU_CERROR_ILL;
>                  break;
>              }
>              break;
>          }
> 
> The above !s->ats will be true for AUTO case, right? I think
> we should change the above check with smmuv3_ats_enabled().
> 
> Also, since we modified the ats to OnOffAuto in the previous
> series, I am not sure the above should be a fix patch or not.
I see, I will use smmuv3_ats_enabled() here to account for the AUTO 
case. I am not sure if it should have the Fixes tag either but let's see 
if we can get any guidance on that point.

Thanks,
Nathan

RE: [PATCH v3 2/7] hw/arm/smmuv3-accel: Implement "auto" value for "ats"

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 14 May 2026 21:07
> To: Shameer Kolothum Thodi <skolothumtho@nvidia.com>; qemu-
> arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Eric Auger <eric.auger@redhat.com>; Peter Maydell
> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé <philmd@linaro.org>;
> Zhao Liu <zhao1.liu@intel.com>; Matt Ochs <mochs@nvidia.com>; Nicolin
> Chen <nicolinc@nvidia.com>
> Subject: Re: [PATCH v3 2/7] hw/arm/smmuv3-accel: Implement "auto" value
> for "ats"

[...]
 
> >>       object_class_property_set_description(klass, "oas",
> >>           "Specify Output Address Size (for accel=on). Supported values "
> >>           "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "
> > In smmuv3.c we have;
> >
> > case SMMU_CMD_ATC_INV:
> >          {
> >              SMMUDevice *sdev = smmu_find_sdev(bs, CMD_SID(&cmd));
> >
> >              if (!sdev || !s->ats) {
> >                  trace_smmuv3_unhandled_cmd(type);
> >                  break;
> >              }
> >
> >              if (!smmuv3_accel_issue_inv_cmd(s, &cmd, sdev, errp)) {
> >                  cmd_error = SMMU_CERROR_ILL;
> >                  break;
> >              }
> >              break;
> >          }
> >
> > The above !s->ats will be true for AUTO case, right? I think
> > we should change the above check with smmuv3_ats_enabled().
> >
> > Also, since we modified the ats to OnOffAuto in the previous
> > series, I am not sure the above should be a fix patch or not.
> I see, I will use smmuv3_ats_enabled() here to account for the AUTO
> case. I am not sure if it should have the Fixes tag either but let's see
> if we can get any guidance on that point.

The default ats with previous series is ON_OFF_AUTO_OFF(=2). So even
if ats is not visible to guest, a malicious guest issuing ats may end up
getting forwarded to host. So, I think we should fix it.

Thanks,
Shameer

[PATCH v3 3/7] hw/arm/smmuv3-accel: Implement "auto" value for "ril"

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Allow accelerated SMMUv3 Range Invalidation support property to be
derived from host IOMMU capabilities. Derive host values using
IOMMU_GET_HW_INFO, retrieving RIL capability from IDR3.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3-accel.c |  8 +++++++-
 hw/arm/smmuv3.c       | 10 ++++------
 2 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
index 9fbd13c438..a5973bd499 100644
--- a/hw/arm/smmuv3-accel.c
+++ b/hw/arm/smmuv3-accel.c
@@ -57,6 +57,11 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
                                FIELD_EX32(info->idr[0], IDR0, ATS));
     }
 
+    if (s->ril == ON_OFF_AUTO_AUTO) {
+        s->idr[3] = FIELD_DP32(s->idr[3], IDR3, RIL,
+                               FIELD_EX32(info->idr[3], IDR3, RIL));
+    }
+
     accel->auto_finalised = true;
 }
 
@@ -969,7 +974,8 @@ bool smmuv3_accel_init(SMMUv3State *s, Error **errp)
     bs->iommu_ops = &smmuv3_accel_ops;
     smmuv3_accel_as_init(s);
 
-    if (s->ats == ON_OFF_AUTO_AUTO) {
+    if (s->ats == ON_OFF_AUTO_AUTO ||
+        s->ril == ON_OFF_AUTO_AUTO) {
         s->s_accel->auto_mode = true;
     }
 
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index e558f09652..7ec4241ecf 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -1965,10 +1965,6 @@ static void smmu_reset_exit(Object *obj, ResetType type)
 
 static bool smmu_validate_property(SMMUv3State *s, Error **errp)
 {
-    if (s->ril == ON_OFF_AUTO_AUTO) {
-        error_setg(errp, "ril auto mode is not supported");
-        return false;
-    }
     if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
         error_setg(errp, "ssidsize auto mode is not supported");
         return false;
@@ -2163,8 +2159,10 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
         "Enable SMMUv3 accelerator support. Allows host SMMUv3 to be "
         "configured in nested mode for vfio-pci dev assignment");
     object_class_property_set_description(klass, "ril",
-        "Disable range invalidation support (for accel=on). ril=auto "
-        "is not supported.");
+        "Enable/disable range invalidation support (for accel=on). "
+        "Valid values are on, off, and auto. Defaults to on. "
+        "Any attempt to turn it 'on' while the host does not support "
+        "it would fail.");
     object_class_property_set_description(klass, "ats",
         "Enable/disable ATS support (for accel=on). "
         "Valid values are on, off, and auto. Defaults to off. "
-- 
2.43.0

RE: [PATCH v3 3/7] hw/arm/smmuv3-accel: Implement "auto" value for "ril"

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 12 May 2026 20:35
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Eric Auger <eric.auger@redhat.com>; Peter Maydell
> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé <philmd@linaro.org>;
> Zhao Liu <zhao1.liu@intel.com>; Matt Ochs <mochs@nvidia.com>; Nicolin
> Chen <nicolinc@nvidia.com>; Shameer Kolothum Thodi
> <skolothumtho@nvidia.com>; Nathan Chen <nathanc@nvidia.com>
> Subject: [PATCH v3 3/7] hw/arm/smmuv3-accel: Implement "auto" value for
> "ril"
> 
> From: Nathan Chen <nathanc@nvidia.com>
> 
> Allow accelerated SMMUv3 Range Invalidation support property to be
> derived from host IOMMU capabilities. Derive host values using
> IOMMU_GET_HW_INFO, retrieving RIL capability from IDR3.
> 
> Reviewed-by: Eric Auger <eric.auger@redhat.com>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>

Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>

Thanks,
Shameer

[PATCH v3 4/7] hw/arm/smmuv3-accel: Implement "auto" value for "ssidsize"

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Allow accelerated SMMUv3 SSID size property to be derived from host
IOMMU capabilities. Derive host values using IOMMU_GET_HW_INFO,
retrieving SSID size from IDR1. When the auto SSID size is resolved
to a non-zero value, PASID capability is advertised to the vIOMMU
and accelerated use cases such as Shared Virtual Addressing (SVA)
are supported.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3-accel.c | 18 ++++++++++++++++--
 hw/arm/smmuv3.c       | 20 ++++++++++----------
 2 files changed, 26 insertions(+), 12 deletions(-)

diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
index a5973bd499..5b1af062ee 100644
--- a/hw/arm/smmuv3-accel.c
+++ b/hw/arm/smmuv3-accel.c
@@ -62,6 +62,12 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
                                FIELD_EX32(info->idr[3], IDR3, RIL));
     }
 
+    if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
+        /* Store for get_viommu_flags() to determine PASID support */
+        s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SSIDSIZE,
+                               FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
+    }
+
     accel->auto_finalised = true;
 }
 
@@ -822,6 +828,13 @@ static AddressSpace *smmuv3_accel_find_add_as(PCIBus *bus, void *opaque,
     }
 }
 
+static inline bool smmuv3_pasid_supported(SMMUv3State *s)
+{
+    return s->ssidsize > SSID_SIZE_MODE_0 ||
+           (s->ssidsize == SSID_SIZE_MODE_AUTO &&
+            FIELD_EX32(s->idr[1], IDR1, SSIDSIZE));
+}
+
 static uint64_t smmuv3_accel_get_viommu_flags(void *opaque)
 {
     /*
@@ -834,7 +847,7 @@ static uint64_t smmuv3_accel_get_viommu_flags(void *opaque)
     SMMUState *bs = opaque;
     SMMUv3State *s = ARM_SMMUV3(bs);
 
-    if (s->ssidsize > SSID_SIZE_MODE_0) {
+    if (smmuv3_pasid_supported(s)) {
         flags |= VIOMMU_FLAG_PASID_SUPPORTED;
     }
     return flags;
@@ -975,7 +988,8 @@ bool smmuv3_accel_init(SMMUv3State *s, Error **errp)
     smmuv3_accel_as_init(s);
 
     if (s->ats == ON_OFF_AUTO_AUTO ||
-        s->ril == ON_OFF_AUTO_AUTO) {
+        s->ril == ON_OFF_AUTO_AUTO ||
+        s->ssidsize == SSID_SIZE_MODE_AUTO) {
         s->s_accel->auto_mode = true;
     }
 
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 7ec4241ecf..cd30275717 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -626,7 +626,10 @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
     }
 
     /* Multiple context descriptors require SubstreamID support */
-    if (s->ssidsize == SSID_SIZE_MODE_0 && STE_S1CDMAX(ste) != 0) {
+    if ((s->ssidsize == SSID_SIZE_MODE_0 ||
+         (s->ssidsize == SSID_SIZE_MODE_AUTO &&
+          !FIELD_EX32(s->idr[1], IDR1, SSIDSIZE))) &&
+        STE_S1CDMAX(ste) != 0) {
         qemu_log_mask(LOG_UNIMP,
                 "SMMUv3: multiple S1 context descriptors require SubstreamID support. "
                 "Configure ssidsize > 0 (requires accel=on)\n");
@@ -1965,10 +1968,6 @@ static void smmu_reset_exit(Object *obj, ResetType type)
 
 static bool smmu_validate_property(SMMUv3State *s, Error **errp)
 {
-    if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
-        error_setg(errp, "ssidsize auto mode is not supported");
-        return false;
-    }
     if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
         error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48 bit"
                    "OAS; other OasMode values are not supported");
@@ -1989,7 +1988,8 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
             return false;
         }
         if (s->ssidsize > SSID_SIZE_MODE_0) {
-            error_setg(errp, "ssidsize can only be set if accel=on");
+            error_setg(errp, "ssidsize can only be greater than 0 "
+                       "bits if accel=on");
             return false;
         }
         return true;
@@ -2173,11 +2173,11 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
         "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "
         "supported.");
     object_class_property_set_description(klass, "ssidsize",
-        "Number of bits used to represent SubstreamIDs (SSIDs). "
+        "Set number of bits used to represent SubstreamIDs (SSIDs). "
+        "Valid values are 0-20 and auto. Defaults to 0. "
         "A value of N allows SSIDs in the range [0 .. 2^N - 1]. "
-        "Valid range is 0-20, where 0 disables SubstreamID support. "
-        "Defaults to 0. A value greater than 0 is required to enable "
-        "PASID support. ssidsize=auto is not supported.");
+        "A value of 0 disables SubstreamID support. A value greater "
+        "than 0 is required to enable PASID support.");
 }
 
 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
-- 
2.43.0

RE: [PATCH v3 4/7] hw/arm/smmuv3-accel: Implement "auto" value for "ssidsize"

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 12 May 2026 20:35
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Eric Auger <eric.auger@redhat.com>; Peter Maydell
> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé <philmd@linaro.org>;
> Zhao Liu <zhao1.liu@intel.com>; Matt Ochs <mochs@nvidia.com>; Nicolin
> Chen <nicolinc@nvidia.com>; Shameer Kolothum Thodi
> <skolothumtho@nvidia.com>; Nathan Chen <nathanc@nvidia.com>
> Subject: [PATCH v3 4/7] hw/arm/smmuv3-accel: Implement "auto" value for
> "ssidsize"
> 
> From: Nathan Chen <nathanc@nvidia.com>
> 
> Allow accelerated SMMUv3 SSID size property to be derived from host
> IOMMU capabilities. Derive host values using IOMMU_GET_HW_INFO,
> retrieving SSID size from IDR1. When the auto SSID size is resolved
> to a non-zero value, PASID capability is advertised to the vIOMMU
> and accelerated use cases such as Shared Virtual Addressing (SVA)
> are supported.
> 
> Reviewed-by: Eric Auger <eric.auger@redhat.com>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  hw/arm/smmuv3-accel.c | 18 ++++++++++++++++--
>  hw/arm/smmuv3.c       | 20 ++++++++++----------
>  2 files changed, 26 insertions(+), 12 deletions(-)
> 
> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
> index a5973bd499..5b1af062ee 100644
> --- a/hw/arm/smmuv3-accel.c
> +++ b/hw/arm/smmuv3-accel.c
> @@ -62,6 +62,12 @@ static void
> smmuv3_accel_auto_finalise(SMMUv3State *s,
>                                 FIELD_EX32(info->idr[3], IDR3, RIL));
>      }
> 
> +    if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
> +        /* Store for get_viommu_flags() to determine PASID support */
> +        s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SSIDSIZE,
> +                               FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));

Nit: Not sure that comment makes sense. We need to update it
anyway, right?

> +    }
> +
>      accel->auto_finalised = true;
>  }
> 
> @@ -822,6 +828,13 @@ static AddressSpace
> *smmuv3_accel_find_add_as(PCIBus *bus, void *opaque,
>      }
>  }
> 
> +static inline bool smmuv3_pasid_supported(SMMUv3State *s)
> +{
> +    return s->ssidsize > SSID_SIZE_MODE_0 ||
> +           (s->ssidsize == SSID_SIZE_MODE_AUTO &&
> +            FIELD_EX32(s->idr[1], IDR1, SSIDSIZE));
> +}
> +
>  static uint64_t smmuv3_accel_get_viommu_flags(void *opaque)
>  {
>      /*
> @@ -834,7 +847,7 @@ static uint64_t
> smmuv3_accel_get_viommu_flags(void *opaque)
>      SMMUState *bs = opaque;
>      SMMUv3State *s = ARM_SMMUV3(bs);
> 
> -    if (s->ssidsize > SSID_SIZE_MODE_0) {
> +    if (smmuv3_pasid_supported(s)) {
>          flags |= VIOMMU_FLAG_PASID_SUPPORTED;
>      }
>      return flags;
> @@ -975,7 +988,8 @@ bool smmuv3_accel_init(SMMUv3State *s, Error
> **errp)
>      smmuv3_accel_as_init(s);
> 
>      if (s->ats == ON_OFF_AUTO_AUTO ||
> -        s->ril == ON_OFF_AUTO_AUTO) {
> +        s->ril == ON_OFF_AUTO_AUTO ||
> +        s->ssidsize == SSID_SIZE_MODE_AUTO) {
>          s->s_accel->auto_mode = true;
>      }
> 
> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
> index 7ec4241ecf..cd30275717 100644
> --- a/hw/arm/smmuv3.c
> +++ b/hw/arm/smmuv3.c
> @@ -626,7 +626,10 @@ static int decode_ste(SMMUv3State *s,
> SMMUTransCfg *cfg,
>      }
> 
>      /* Multiple context descriptors require SubstreamID support */
> -    if (s->ssidsize == SSID_SIZE_MODE_0 && STE_S1CDMAX(ste) != 0) {
> +    if ((s->ssidsize == SSID_SIZE_MODE_0 ||
> +         (s->ssidsize == SSID_SIZE_MODE_AUTO &&
> +          !FIELD_EX32(s->idr[1], IDR1, SSIDSIZE))) &&
> +        STE_S1CDMAX(ste) != 0) {
>          qemu_log_mask(LOG_UNIMP,
>                  "SMMUv3: multiple S1 context descriptors require SubstreamID
> support. "
>                  "Configure ssidsize > 0 (requires accel=on)\n");
> @@ -1965,10 +1968,6 @@ static void smmu_reset_exit(Object *obj,
> ResetType type)
> 
>  static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>  {
> -    if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
> -        error_setg(errp, "ssidsize auto mode is not supported");
> -        return false;
> -    }
>      if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
>          error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48 bit"
>                     "OAS; other OasMode values are not supported");
> @@ -1989,7 +1988,8 @@ static bool
> smmu_validate_property(SMMUv3State *s, Error **errp)
>              return false;
>          }
>          if (s->ssidsize > SSID_SIZE_MODE_0) {
> -            error_setg(errp, "ssidsize can only be set if accel=on");
> +            error_setg(errp, "ssidsize can only be greater than 0 "
> +                       "bits if accel=on");
>              return false;
>          }
>          return true;
> @@ -2173,11 +2173,11 @@ static void smmuv3_class_init(ObjectClass
> *klass, const void *data)
>          "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "
>          "supported.");
>      object_class_property_set_description(klass, "ssidsize",
> -        "Number of bits used to represent SubstreamIDs (SSIDs). "
> +        "Set number of bits used to represent SubstreamIDs (SSIDs). "
> +        "Valid values are 0-20 and auto. Defaults to 0. "
>          "A value of N allows SSIDs in the range [0 .. 2^N - 1]. "
> -        "Valid range is 0-20, where 0 disables SubstreamID support. "
> -        "Defaults to 0. A value greater than 0 is required to enable "
> -        "PASID support. ssidsize=auto is not supported.");
> +        "A value of 0 disables SubstreamID support. A value greater "
> +        "than 0 is required to enable PASID support.");
>  }
> 
>  static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,

Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>

Thanks,
Shameer

Re: [PATCH v3 4/7] hw/arm/smmuv3-accel: Implement "auto" value for "ssidsize"

[Nathan Chen]

On 5/14/2026 7:24 AM, Shameer Kolothum Thodi wrote:
> 
>> -----Original Message-----
>> From: Nathan Chen<nathanc@nvidia.com>
>> Sent: 12 May 2026 20:35
>> To:qemu-arm@nongnu.org;qemu-devel@nongnu.org
>> Cc: Eric Auger<eric.auger@redhat.com>; Peter Maydell
>> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé<philmd@linaro.org>;
>> Zhao Liu<zhao1.liu@intel.com>; Matt Ochs<mochs@nvidia.com>; Nicolin
>> Chen<nicolinc@nvidia.com>; Shameer Kolothum Thodi
>> <skolothumtho@nvidia.com>; Nathan Chen<nathanc@nvidia.com>
>> Subject: [PATCH v3 4/7] hw/arm/smmuv3-accel: Implement "auto" value for
>> "ssidsize"
>>
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Allow accelerated SMMUv3 SSID size property to be derived from host
>> IOMMU capabilities. Derive host values using IOMMU_GET_HW_INFO,
>> retrieving SSID size from IDR1. When the auto SSID size is resolved
>> to a non-zero value, PASID capability is advertised to the vIOMMU
>> and accelerated use cases such as Shared Virtual Addressing (SVA)
>> are supported.
>>
>> Reviewed-by: Eric Auger<eric.auger@redhat.com>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   hw/arm/smmuv3-accel.c | 18 ++++++++++++++++--
>>   hw/arm/smmuv3.c       | 20 ++++++++++----------
>>   2 files changed, 26 insertions(+), 12 deletions(-)
>>
>> diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
>> index a5973bd499..5b1af062ee 100644
>> --- a/hw/arm/smmuv3-accel.c
>> +++ b/hw/arm/smmuv3-accel.c
>> @@ -62,6 +62,12 @@ static void
>> smmuv3_accel_auto_finalise(SMMUv3State *s,
>>                                  FIELD_EX32(info->idr[3], IDR3, RIL));
>>       }
>>
>> +    if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
>> +        /* Store for get_viommu_flags() to determine PASID support */
>> +        s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SSIDSIZE,
>> +                               FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
> Nit: Not sure that comment makes sense. We need to update it
> anyway, right?
After ssidsize is stored in s->idr[1], smmuv3_accel_get_viommu_flags() 
will call smmuv3_pasid_supported() and enable the 
VIOMMU_FLAG_PASID_SUPPORTED flag if AUTO is specified for ssidsize and 
s->idr[1] is non-zero. Maybe we can remove the comment or come up with a 
better wording such as:

/* PASID support will be enabled if ssidsize is non-zero */

But this is already documented in qemu-options.hx. I think it would be 
cleaner to omit the comment here. What do you think?

Thanks,
Nathan

> 
>> +    }
>> +
>>       accel->auto_finalised = true;
>>   }
>>
>> @@ -822,6 +828,13 @@ static AddressSpace
>> *smmuv3_accel_find_add_as(PCIBus *bus, void *opaque,
>>       }
>>   }
>>
>> +static inline bool smmuv3_pasid_supported(SMMUv3State *s)
>> +{
>> +    return s->ssidsize > SSID_SIZE_MODE_0 ||
>> +           (s->ssidsize == SSID_SIZE_MODE_AUTO &&
>> +            FIELD_EX32(s->idr[1], IDR1, SSIDSIZE));
>> +}
>> +
>>   static uint64_t smmuv3_accel_get_viommu_flags(void *opaque)
>>   {
>>       /*
>> @@ -834,7 +847,7 @@ static uint64_t
>> smmuv3_accel_get_viommu_flags(void *opaque)
>>       SMMUState *bs = opaque;
>>       SMMUv3State *s = ARM_SMMUV3(bs);
>>
>> -    if (s->ssidsize > SSID_SIZE_MODE_0) {
>> +    if (smmuv3_pasid_supported(s)) {
>>           flags |= VIOMMU_FLAG_PASID_SUPPORTED;
>>       }
>>       return flags;
>> @@ -975,7 +988,8 @@ bool smmuv3_accel_init(SMMUv3State *s, Error
>> **errp)
>>       smmuv3_accel_as_init(s);
>>
>>       if (s->ats == ON_OFF_AUTO_AUTO ||
>> -        s->ril == ON_OFF_AUTO_AUTO) {
>> +        s->ril == ON_OFF_AUTO_AUTO ||
>> +        s->ssidsize == SSID_SIZE_MODE_AUTO) {
>>           s->s_accel->auto_mode = true;
>>       }
>>
>> diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
>> index 7ec4241ecf..cd30275717 100644
>> --- a/hw/arm/smmuv3.c
>> +++ b/hw/arm/smmuv3.c
>> @@ -626,7 +626,10 @@ static int decode_ste(SMMUv3State *s,
>> SMMUTransCfg *cfg,
>>       }
>>
>>       /* Multiple context descriptors require SubstreamID support */
>> -    if (s->ssidsize == SSID_SIZE_MODE_0 && STE_S1CDMAX(ste) != 0) {
>> +    if ((s->ssidsize == SSID_SIZE_MODE_0 ||
>> +         (s->ssidsize == SSID_SIZE_MODE_AUTO &&
>> +          !FIELD_EX32(s->idr[1], IDR1, SSIDSIZE))) &&
>> +        STE_S1CDMAX(ste) != 0) {
>>           qemu_log_mask(LOG_UNIMP,
>>                   "SMMUv3: multiple S1 context descriptors require SubstreamID
>> support. "
>>                   "Configure ssidsize > 0 (requires accel=on)\n");
>> @@ -1965,10 +1968,6 @@ static void smmu_reset_exit(Object *obj,
>> ResetType type)
>>
>>   static bool smmu_validate_property(SMMUv3State *s, Error **errp)
>>   {
>> -    if (s->ssidsize == SSID_SIZE_MODE_AUTO) {
>> -        error_setg(errp, "ssidsize auto mode is not supported");
>> -        return false;
>> -    }
>>       if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
>>           error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48 bit"
>>                      "OAS; other OasMode values are not supported");
>> @@ -1989,7 +1988,8 @@ static bool
>> smmu_validate_property(SMMUv3State *s, Error **errp)
>>               return false;
>>           }
>>           if (s->ssidsize > SSID_SIZE_MODE_0) {
>> -            error_setg(errp, "ssidsize can only be set if accel=on");
>> +            error_setg(errp, "ssidsize can only be greater than 0 "
>> +                       "bits if accel=on");
>>               return false;
>>           }
>>           return true;
>> @@ -2173,11 +2173,11 @@ static void smmuv3_class_init(ObjectClass
>> *klass, const void *data)
>>           "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "
>>           "supported.");
>>       object_class_property_set_description(klass, "ssidsize",
>> -        "Number of bits used to represent SubstreamIDs (SSIDs). "
>> +        "Set number of bits used to represent SubstreamIDs (SSIDs). "
>> +        "Valid values are 0-20 and auto. Defaults to 0. "
>>           "A value of N allows SSIDs in the range [0 .. 2^N - 1]. "
>> -        "Valid range is 0-20, where 0 disables SubstreamID support. "
>> -        "Defaults to 0. A value greater than 0 is required to enable "
>> -        "PASID support. ssidsize=auto is not supported.");
>> +        "A value of 0 disables SubstreamID support. A value greater "
>> +        "than 0 is required to enable PASID support.");
>>   }
>>
>>   static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,

[PATCH v3 5/7] hw/arm/smmuv3-accel: Implement "auto" value for "oas"

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Allow accelerated SMMUv3 OAS property to be derived from host IOMMU
capabilities. Derive host values using IOMMU_GET_HW_INFO, retrieving
OAS from IDR5.

This keeps the OAS value advertised by the virtual SMMU compatible with
the capabilities of the host SMMUv3, so that the intermediate physical
addresses (IPA) consumed by host SMMU for stage-2 translation do not
exceed the host's max supported IPA size.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3-accel.c |  8 +++++++-
 hw/arm/smmuv3.c       | 15 ++++++++-------
 2 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/hw/arm/smmuv3-accel.c b/hw/arm/smmuv3-accel.c
index 5b1af062ee..05257f74ed 100644
--- a/hw/arm/smmuv3-accel.c
+++ b/hw/arm/smmuv3-accel.c
@@ -68,6 +68,11 @@ static void smmuv3_accel_auto_finalise(SMMUv3State *s,
                                FIELD_EX32(info->idr[1], IDR1, SSIDSIZE));
     }
 
+    if (s->oas == OAS_MODE_AUTO) {
+        s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS,
+                               FIELD_EX32(info->idr[5], IDR5, OAS));
+    }
+
     accel->auto_finalised = true;
 }
 
@@ -989,7 +994,8 @@ bool smmuv3_accel_init(SMMUv3State *s, Error **errp)
 
     if (s->ats == ON_OFF_AUTO_AUTO ||
         s->ril == ON_OFF_AUTO_AUTO ||
-        s->ssidsize == SSID_SIZE_MODE_AUTO) {
+        s->ssidsize == SSID_SIZE_MODE_AUTO ||
+        s->oas == OAS_MODE_AUTO) {
         s->s_accel->auto_mode = true;
     }
 
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index cd30275717..31c2eec2f4 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -1968,9 +1968,11 @@ static void smmu_reset_exit(Object *obj, ResetType type)
 
 static bool smmu_validate_property(SMMUv3State *s, Error **errp)
 {
-    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48) {
-        error_setg(errp, "QEMU SMMUv3 model only implements 44 and 48 bit"
-                   "OAS; other OasMode values are not supported");
+    if (s->oas != OAS_MODE_44 && s->oas != OAS_MODE_48 &&
+        s->oas != OAS_MODE_AUTO) {
+        error_setg(errp, "QEMU SMMUv3 model only implements auto, "
+                   "44 bit, or 48 bit OAS. Other OasMode values are "
+                   "not supported.");
         return false;
     }
 
@@ -1984,7 +1986,7 @@ static bool smmu_validate_property(SMMUv3State *s, Error **errp)
             return false;
         }
         if (s->oas > OAS_MODE_44) {
-            error_setg(errp, "OAS must be 44 bits when accel=off");
+            error_setg(errp, "oas must be 44 bits when accel=off");
             return false;
         }
         if (s->ssidsize > SSID_SIZE_MODE_0) {
@@ -2169,9 +2171,8 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
         "Please ensure host platform supports ATS before setting it "
         "to on.");
     object_class_property_set_description(klass, "oas",
-        "Specify Output Address Size (for accel=on). Supported values "
-        "are 44 or 48 bits. Defaults to 44 bits. oas=auto is not "
-        "supported.");
+        "Set Output Address Size in bits (for accel=on). "
+        "Valid values are 44, 48, and auto. Defaults to 44 bits.");
     object_class_property_set_description(klass, "ssidsize",
         "Set number of bits used to represent SubstreamIDs (SSIDs). "
         "Valid values are 0-20 and auto. Defaults to 0. "
-- 
2.43.0

RE: [PATCH v3 5/7] hw/arm/smmuv3-accel: Implement "auto" value for "oas"

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 12 May 2026 20:35
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Eric Auger <eric.auger@redhat.com>; Peter Maydell
> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé <philmd@linaro.org>;
> Zhao Liu <zhao1.liu@intel.com>; Matt Ochs <mochs@nvidia.com>; Nicolin
> Chen <nicolinc@nvidia.com>; Shameer Kolothum Thodi
> <skolothumtho@nvidia.com>; Nathan Chen <nathanc@nvidia.com>
> Subject: [PATCH v3 5/7] hw/arm/smmuv3-accel: Implement "auto" value for
> "oas"
> 
> From: Nathan Chen <nathanc@nvidia.com>
> 
> Allow accelerated SMMUv3 OAS property to be derived from host IOMMU
> capabilities. Derive host values using IOMMU_GET_HW_INFO, retrieving
> OAS from IDR5.
> 
> This keeps the OAS value advertised by the virtual SMMU compatible with
> the capabilities of the host SMMUv3, so that the intermediate physical
> addresses (IPA) consumed by host SMMU for stage-2 translation do not
> exceed the host's max supported IPA size.
> 
> Reviewed-by: Eric Auger <eric.auger@redhat.com>
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>

Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>

Thanks,
Shameer

[PATCH v3 6/7] hw/arm/smmuv3: Set default ats, ril, ssidsize, oas to auto

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Set the default value of ATS, RIL, SSIDSIZE, and OAS to auto, in order
to match the host IOMMU properties when accel=on.

If accel=off and these property values are set to auto, the default
property values defined in smmuv3_init_id_regs() for OAS and RIL will
remain unchanged, while SSIDSIZE and ATS values will remain initialized
at 0.

Introduce a new compat for the changed defaults.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 hw/arm/smmuv3.c   | 23 +++++++++++++++--------
 hw/core/machine.c |  5 +++++
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index 31c2eec2f4..665e6a2538 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -2129,12 +2129,19 @@ static const Property smmuv3_properties[] = {
     DEFINE_PROP_BOOL("accel", SMMUv3State, accel, false),
     /* GPA of MSI doorbell, for SMMUv3 accel use. */
     DEFINE_PROP_UINT64("msi-gpa", SMMUv3State, msi_gpa, 0),
+    /*
+     * AUTO values for accel=off will resolve to:
+     * ril: on
+     * ats: off
+     * oas: 44
+     * ssidsize: 0
+     */
     /* RIL can be turned off for accel cases */
-    DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_ON),
-    DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_OFF),
-    DEFINE_PROP_OAS_MODE("oas", SMMUv3State, oas, OAS_MODE_44),
+    DEFINE_PROP_ON_OFF_AUTO("ril", SMMUv3State, ril, ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_ON_OFF_AUTO("ats", SMMUv3State, ats, ON_OFF_AUTO_AUTO),
+    DEFINE_PROP_OAS_MODE("oas", SMMUv3State, oas, OAS_MODE_AUTO),
     DEFINE_PROP_SSIDSIZE_MODE("ssidsize", SMMUv3State, ssidsize,
-                              SSID_SIZE_MODE_0),
+                              SSID_SIZE_MODE_AUTO),
 };
 
 static void smmuv3_instance_init(Object *obj)
@@ -2162,20 +2169,20 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
         "configured in nested mode for vfio-pci dev assignment");
     object_class_property_set_description(klass, "ril",
         "Enable/disable range invalidation support (for accel=on). "
-        "Valid values are on, off, and auto. Defaults to on. "
+        "Valid values are on, off, and auto. Defaults to auto. "
         "Any attempt to turn it 'on' while the host does not support "
         "it would fail.");
     object_class_property_set_description(klass, "ats",
         "Enable/disable ATS support (for accel=on). "
-        "Valid values are on, off, and auto. Defaults to off. "
+        "Valid values are on, off, and auto. Defaults to auto. "
         "Please ensure host platform supports ATS before setting it "
         "to on.");
     object_class_property_set_description(klass, "oas",
         "Set Output Address Size in bits (for accel=on). "
-        "Valid values are 44, 48, and auto. Defaults to 44 bits.");
+        "Valid values are 44, 48, and auto. Defaults to auto.");
     object_class_property_set_description(klass, "ssidsize",
         "Set number of bits used to represent SubstreamIDs (SSIDs). "
-        "Valid values are 0-20 and auto. Defaults to 0. "
+        "Valid values are 0-20 and auto. Defaults to auto. "
         "A value of N allows SSIDs in the range [0 .. 2^N - 1]. "
         "A value of 0 disables SubstreamID support. A value greater "
         "than 0 is required to enable PASID support.");
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 63baff859f..3339da99ee 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -38,9 +38,14 @@
 #include "hw/virtio/virtio-iommu.h"
 #include "hw/acpi/generic_event_device.h"
 #include "qemu/audio.h"
+#include "hw/arm/smmuv3.h"
 
 GlobalProperty hw_compat_11_0[] = {
     { "chardev-vc", "encoding", "cp437" },
+    { TYPE_ARM_SMMUV3, "ats", "off" },
+    { TYPE_ARM_SMMUV3, "ril", "on" },
+    { TYPE_ARM_SMMUV3, "ssidsize", "0" },
+    { TYPE_ARM_SMMUV3, "oas", "44" },
 };
 const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0);
 
-- 
2.43.0

RE: [PATCH v3 6/7] hw/arm/smmuv3: Set default ats, ril, ssidsize, oas to auto

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 12 May 2026 20:35
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Eric Auger <eric.auger@redhat.com>; Peter Maydell
> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé <philmd@linaro.org>;
> Zhao Liu <zhao1.liu@intel.com>; Matt Ochs <mochs@nvidia.com>; Nicolin
> Chen <nicolinc@nvidia.com>; Shameer Kolothum Thodi
> <skolothumtho@nvidia.com>; Nathan Chen <nathanc@nvidia.com>
> Subject: [PATCH v3 6/7] hw/arm/smmuv3: Set default ats, ril, ssidsize, oas to
> auto
> 
> From: Nathan Chen <nathanc@nvidia.com>
> 
> Set the default value of ATS, RIL, SSIDSIZE, and OAS to auto, in order
> to match the host IOMMU properties when accel=on.
> 
> If accel=off and these property values are set to auto, the default
> property values defined in smmuv3_init_id_regs() for OAS and RIL will
> remain unchanged, while SSIDSIZE and ATS values will remain initialized
> at 0.
> 
> Introduce a new compat for the changed defaults.
> 
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>

Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>

Thanks,
Shameer

[PATCH v3 7/7] qemu-options.hx: Support "auto" for accel SMMUv3 properties

[Nathan Chen]

From: Nathan Chen <nathanc@nvidia.com>

Update documentation now that "auto" is supported for accelerated SMMUv3
properties.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 qemu-options.hx | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/qemu-options.hx b/qemu-options.hx
index 96ae41f787..46b02a1bb3 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1291,30 +1291,43 @@ SRST
         Enabling accel configures the host SMMUv3 in nested mode to support
         vfio-pci passthrough.
 
-     The following options are available when accel=on.
-     Note: 'auto' mode is not currently supported.
+     The following options will be set to auto by default if not manually
+     set. When accel=on and these properties are set to auto, the value is
+     derived from the host SMMUv3 capabilities via IOMMU_GET_HW_INFO. With
+     accel=on, this requires at least one cold-plugged vfio-pci device; if
+     none is present at machine init, QEMU will abort.
 
-    ``ril=on|off`` (default: on)
+     If accel=off, auto values resolve to the non-accel defaults given below.
+
+    ``ril=on|off|auto`` (default: auto)
         Support for Range Invalidation, which allows the SMMUv3 driver to
         invalidate TLB entries for a range of IOVAs at once instead of issuing
         separate commands to invalidate each page. Must match with host SMMUv3
         Range Invalidation support.
+        - With accel=on, auto means the value is automatically derived from the host SMMU.
+        - With accel=off, auto is resolved to 'on'.
 
-    ``ats=on|off`` (default: off)
+    ``ats=on|off|auto`` (default: auto)
         Support for Address Translation Services, which enables PCIe devices to
         cache address translations in their local TLB and reduce latency. Host
         SMMUv3 must support ATS in order to enable this feature for the vIOMMU.
+        - With accel=on, auto means the value is automatically derived from the host SMMU.
+        - With accel=off, auto is resolved to 'off'.
 
-    ``oas=val`` (supported values are 44 and 48. default: 44)
+    ``oas=val|auto`` (supported values are 44 and 48. default: auto)
         Sets the Output Address Size in bits. The value set here must be less
         than or equal to the host SMMUv3's supported OAS, so that the
         intermediate physical addresses (IPA) consumed by host SMMU for stage-2
         translation do not exceed the host's max supported IPA size.
+        - With accel=on, auto means the value is automatically derived from the host SMMU.
+        - With accel=off, auto is resolved to 44.
 
-    ``ssidsize=val`` (val between 0 and 20. default: 0)
+    ``ssidsize=val|auto`` (val between 0 and 20. default: auto)
         Sets the Substream ID size in bits. When set to a non-zero value,
         PASID capability is advertised to the vIOMMU and accelerated use cases
         such as Shared Virtual Addressing (SVA) are supported.
+        - With accel=on, auto means the value is automatically derived from the host SMMU.
+        - With accel=off, auto is resolved to 0.
 
 ``-device amd-iommu[,option=...]``
     Enables emulation of an AMD-Vi I/O Memory Management Unit (IOMMU).
-- 
2.43.0

RE: [PATCH v3 7/7] qemu-options.hx: Support "auto" for accel SMMUv3 properties

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 12 May 2026 20:35
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Eric Auger <eric.auger@redhat.com>; Peter Maydell
> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé <philmd@linaro.org>;
> Zhao Liu <zhao1.liu@intel.com>; Matt Ochs <mochs@nvidia.com>; Nicolin
> Chen <nicolinc@nvidia.com>; Shameer Kolothum Thodi
> <skolothumtho@nvidia.com>; Nathan Chen <nathanc@nvidia.com>
> Subject: [PATCH v3 7/7] qemu-options.hx: Support "auto" for accel SMMUv3
> properties
> 
> From: Nathan Chen <nathanc@nvidia.com>
> 
> Update documentation now that "auto" is supported for accelerated
> SMMUv3 properties.
> 
> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  qemu-options.hx | 25 +++++++++++++++++++------
>  1 file changed, 19 insertions(+), 6 deletions(-)
> 
> diff --git a/qemu-options.hx b/qemu-options.hx index
> 96ae41f787..46b02a1bb3 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -1291,30 +1291,43 @@ SRST
>          Enabling accel configures the host SMMUv3 in nested mode to support
>          vfio-pci passthrough.
> 
> -     The following options are available when accel=on.
> -     Note: 'auto' mode is not currently supported.
> +     The following options will be set to auto by default if not manually
> +     set. When accel=on and these properties are set to auto, the value is
> +     derived from the host SMMUv3 capabilities via IOMMU_GET_HW_INFO.
> With
> +     accel=on, this requires at least one cold-plugged vfio-pci device; if
> +     none is present at machine init, QEMU will abort.
> 
> -    ``ril=on|off`` (default: on)
> +     If accel=off, auto values resolve to the non-accel defaults given below.
> +
> +    ``ril=on|off|auto`` (default: auto)
>          Support for Range Invalidation, which allows the SMMUv3 driver to
>          invalidate TLB entries for a range of IOVAs at once instead of issuing
>          separate commands to invalidate each page. Must match with host
> SMMUv3
>          Range Invalidation support.
> +        - With accel=on, auto means the value is automatically derived from the
> host SMMU.
> +        - With accel=off, auto is resolved to 'on'.

If the intention here is to have bullet points for above, you might need a blank
line before "-" . Please see how this gets rendered in html format and
adjust.

Same for others below.

Thanks,
Shameer 
> 
> -    ``ats=on|off`` (default: off)
> +    ``ats=on|off|auto`` (default: auto)
>          Support for Address Translation Services, which enables PCIe devices to
>          cache address translations in their local TLB and reduce latency. Host
>          SMMUv3 must support ATS in order to enable this feature for the
> vIOMMU.
> +        - With accel=on, auto means the value is automatically derived from the
> host SMMU.
> +        - With accel=off, auto is resolved to 'off'.
> 
> -    ``oas=val`` (supported values are 44 and 48. default: 44)
> +    ``oas=val|auto`` (supported values are 44 and 48. default: auto)
>          Sets the Output Address Size in bits. The value set here must be less
>          than or equal to the host SMMUv3's supported OAS, so that the
>          intermediate physical addresses (IPA) consumed by host SMMU for
> stage-2
>          translation do not exceed the host's max supported IPA size.
> +        - With accel=on, auto means the value is automatically derived from the
> host SMMU.
> +        - With accel=off, auto is resolved to 44.
> 
> -    ``ssidsize=val`` (val between 0 and 20. default: 0)
> +    ``ssidsize=val|auto`` (val between 0 and 20. default: auto)
>          Sets the Substream ID size in bits. When set to a non-zero value,
>          PASID capability is advertised to the vIOMMU and accelerated use cases
>          such as Shared Virtual Addressing (SVA) are supported.
> +        - With accel=on, auto means the value is automatically derived from the
> host SMMU.
> +        - With accel=off, auto is resolved to 0.
> 
>  ``-device amd-iommu[,option=...]``
>      Enables emulation of an AMD-Vi I/O Memory Management Unit (IOMMU).
> --
> 2.43.0

Re: [PATCH v3 7/7] qemu-options.hx: Support "auto" for accel SMMUv3 properties

[Nathan Chen]

On 5/14/2026 9:19 AM, Shameer Kolothum Thodi wrote:
> 
>> -----Original Message-----
>> From: Nathan Chen<nathanc@nvidia.com>
>> Sent: 12 May 2026 20:35
>> To:qemu-arm@nongnu.org;qemu-devel@nongnu.org
>> Cc: Eric Auger<eric.auger@redhat.com>; Peter Maydell
>> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé<philmd@linaro.org>;
>> Zhao Liu<zhao1.liu@intel.com>; Matt Ochs<mochs@nvidia.com>; Nicolin
>> Chen<nicolinc@nvidia.com>; Shameer Kolothum Thodi
>> <skolothumtho@nvidia.com>; Nathan Chen<nathanc@nvidia.com>
>> Subject: [PATCH v3 7/7] qemu-options.hx: Support "auto" for accel SMMUv3
>> properties
>>
>> From: Nathan Chen<nathanc@nvidia.com>
>>
>> Update documentation now that "auto" is supported for accelerated
>> SMMUv3 properties.
>>
>> Signed-off-by: Nathan Chen<nathanc@nvidia.com>
>> ---
>>   qemu-options.hx | 25 +++++++++++++++++++------
>>   1 file changed, 19 insertions(+), 6 deletions(-)
>>
>> diff --git a/qemu-options.hx b/qemu-options.hx index
>> 96ae41f787..46b02a1bb3 100644
>> --- a/qemu-options.hx
>> +++ b/qemu-options.hx
>> @@ -1291,30 +1291,43 @@ SRST
>>           Enabling accel configures the host SMMUv3 in nested mode to support
>>           vfio-pci passthrough.
>>
>> -     The following options are available when accel=on.
>> -     Note: 'auto' mode is not currently supported.
>> +     The following options will be set to auto by default if not manually
>> +     set. When accel=on and these properties are set to auto, the value is
>> +     derived from the host SMMUv3 capabilities via IOMMU_GET_HW_INFO.
>> With
>> +     accel=on, this requires at least one cold-plugged vfio-pci device; if
>> +     none is present at machine init, QEMU will abort.
>>
>> -    ``ril=on|off`` (default: on)
>> +     If accel=off, auto values resolve to the non-accel defaults given below.
>> +
>> +    ``ril=on|off|auto`` (default: auto)
>>           Support for Range Invalidation, which allows the SMMUv3 driver to
>>           invalidate TLB entries for a range of IOVAs at once instead of issuing
>>           separate commands to invalidate each page. Must match with host
>> SMMUv3
>>           Range Invalidation support.
>> +        - With accel=on, auto means the value is automatically derived from the
>> host SMMU.
>> +        - With accel=off, auto is resolved to 'on'.
> If the intention here is to have bullet points for above, you might need a blank
> line before "-" . Please see how this gets rendered in html format and
> adjust.
> 
> Same for others below.
Ok, I will confirm the render and update accordingly on the next revision.

Thanks,
Nathan

RE: [PATCH v3 0/7] hw/arm/smmuv3-accel: Resolve AUTO properties

[Shameer Kolothum Thodi]

Hi Nathan,

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 12 May 2026 20:35
> To: qemu-arm@nongnu.org; qemu-devel@nongnu.org
> Cc: Eric Auger <eric.auger@redhat.com>; Peter Maydell
> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé <philmd@linaro.org>;
> Zhao Liu <zhao1.liu@intel.com>; Matt Ochs <mochs@nvidia.com>; Nicolin
> Chen <nicolinc@nvidia.com>; Shameer Kolothum Thodi
> <skolothumtho@nvidia.com>; Nathan Chen <nathanc@nvidia.com>
> Subject: [PATCH v3 0/7] hw/arm/smmuv3-accel: Resolve AUTO properties
> 

[..]

> Changes from v2:
> - Added R-by tags, thanks Eric, Shameer, Cédric for the feedback!
> - Re-worded descriptions in qemu-options.hx and smmu_validate_property()
> - Emphasize accel=off auto behavior in a comment for smmuv3_properties[]

Just in case you missed it, there was a query regarding the corresponding VFIO
ATS support patch here:
https://lore.kernel.org/qemu-devel/ad0dac7a-cd60-4735-8ece-23fe526ca883@redhat.com/

Thanks,
Shameer

Re: [PATCH v3 0/7] hw/arm/smmuv3-accel: Resolve AUTO properties

[Nathan Chen]

Hi Shameer,

On 5/14/2026 9:37 AM, Shameer Kolothum Thodi wrote:
> Hi Nathan,
> 
>> -----Original Message-----
>> From: Nathan Chen<nathanc@nvidia.com>
>> Sent: 12 May 2026 20:35
>> To:qemu-arm@nongnu.org;qemu-devel@nongnu.org
>> Cc: Eric Auger<eric.auger@redhat.com>; Peter Maydell
>> <peter.maydell@linaro.org>; Philippe Mathieu-Daudé<philmd@linaro.org>;
>> Zhao Liu<zhao1.liu@intel.com>; Matt Ochs<mochs@nvidia.com>; Nicolin
>> Chen<nicolinc@nvidia.com>; Shameer Kolothum Thodi
>> <skolothumtho@nvidia.com>; Nathan Chen<nathanc@nvidia.com>
>> Subject: [PATCH v3 0/7] hw/arm/smmuv3-accel: Resolve AUTO properties
>>
> [..]
> 
>> Changes from v2:
>> - Added R-by tags, thanks Eric, Shameer, Cédric for the feedback!
>> - Re-worded descriptions in qemu-options.hx and smmu_validate_property()
>> - Emphasize accel=off auto behavior in a comment for smmuv3_properties[]
> Just in case you missed it, there was a query regarding the corresponding VFIO
> ATS support patch here:
> https://nam11.safelinks.protection.outlook.com/?
> url=https%3A%2F%2Flore.kernel.org%2Fqemu-devel%2Fad0dac7a- 
> cd60-4735-8ece-23fe526ca883%40redhat.com%2F&data=05%7C02%7Cnathanc%40nvidia.com%7C0a5c91b9729d461a53b208deb1d71a46%7C43083d157

Yes, thanks for jumping in on that thread while I was out. I am working 
on a separate series for the VFIO ATS support.

Thanks,
Nathan