Re: [RFC PATCH v6 09/11] iommufd: Add the vdevice TSM request ioctl

[Alexey Kardashevskiy <aik@amd.com>]

On 18/9/26 00:01, Aneesh Kumar K.V (Arm) wrote:
> A VMM needs to forward guest-originated TSM commands to the TSM
> implementation managing an assigned device. The IOMMUFD vdevice
> identifies that device within its vIOMMU and provides the appropriate
> dispatch point.
> 
> Add IOMMU_VDEVICE_TSM_REQ to send an opaque request to a vdevice and
> optionally return a response. Define common operation and guest
> architecture identifiers for CCA, SEV and TDX requests.

iommufd_viommu_provider_ops already knows what architecture it is, why bother with these identifiers? Thanks,

> 
> The ioctl return value reports dispatch or data transfer errors, while
> tsm_code carries the TSM-specific result.
> 
> Use sockptr_t for the internal request and response buffers so TSM
> implementations are not tied to userspace pointers.
> 
> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
> ---
>   drivers/iommu/iommufd/Makefile          |  2 +
>   drivers/iommu/iommufd/iommufd_private.h |  8 ++
>   drivers/iommu/iommufd/main.c            |  3 +
>   drivers/iommu/iommufd/tsm.c             | 98 +++++++++++++++++++++++++
>   drivers/iommu/iommufd/viommu.c          |  2 +
>   include/linux/iommufd.h                 |  5 ++
>   include/linux/tsm.h                     | 25 +++++++
>   include/uapi/linux/iommufd.h            | 73 ++++++++++++++++++
>   8 files changed, 216 insertions(+)
>   create mode 100644 drivers/iommu/iommufd/tsm.c
> 
> diff --git a/drivers/iommu/iommufd/Makefile b/drivers/iommu/iommufd/Makefile
> index 7ed46c286c42..105a54ff89f5 100644
> --- a/drivers/iommu/iommufd/Makefile
> +++ b/drivers/iommu/iommufd/Makefile
> @@ -11,6 +11,8 @@ iommufd-y := \
>   	viommu.o \
>   	viommu_provider.o
>   
> +iommufd-$(CONFIG_TSM) += tsm.o
> +
>   iommufd-$(CONFIG_IOMMUFD_TEST) += selftest.o
>   
>   obj-$(CONFIG_IOMMUFD) += iommufd.o
> diff --git a/drivers/iommu/iommufd/iommufd_private.h b/drivers/iommu/iommufd/iommufd_private.h
> index eae607eb5d76..0c67f2e1f137 100644
> --- a/drivers/iommu/iommufd/iommufd_private.h
> +++ b/drivers/iommu/iommufd/iommufd_private.h
> @@ -721,6 +721,14 @@ void iommufd_vdevice_destroy(struct iommufd_object *obj);
>   void iommufd_vdevice_abort(struct iommufd_object *obj);
>   int iommufd_hw_queue_alloc_ioctl(struct iommufd_ucmd *ucmd);
>   void iommufd_hw_queue_destroy(struct iommufd_object *obj);
> +#ifdef CONFIG_TSM
> +int iommufd_vdevice_tsm_req_ioctl(struct iommufd_ucmd *ucmd);
> +#else
> +static inline int iommufd_vdevice_tsm_req_ioctl(struct iommufd_ucmd *ucmd)
> +{
> +	return -EOPNOTSUPP;
> +}
> +#endif
>   
>   static inline struct iommufd_vdevice *
>   iommufd_get_vdevice(struct iommufd_ctx *ictx, u32 id)
> diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c
> index 8c6d43601afb..4a42cda0e8f8 100644
> --- a/drivers/iommu/iommufd/main.c
> +++ b/drivers/iommu/iommufd/main.c
> @@ -432,6 +432,7 @@ union ucmd_buffer {
>   	struct iommu_veventq_alloc veventq;
>   	struct iommu_vfio_ioas vfio_ioas;
>   	struct iommu_viommu_alloc viommu;
> +	struct iommu_vdevice_tsm_req tsm_req;
>   #ifdef CONFIG_IOMMUFD_TEST
>   	struct iommu_test_cmd test;
>   #endif
> @@ -493,6 +494,8 @@ static const struct iommufd_ioctl_op iommufd_ioctl_ops[] = {
>   		 __reserved),
>   	IOCTL_OP(IOMMU_VIOMMU_ALLOC, iommufd_viommu_alloc_ioctl,
>   		 struct iommu_viommu_alloc, out_viommu_id),
> +	IOCTL_OP(IOMMU_VDEVICE_TSM_REQ, iommufd_vdevice_tsm_req_ioctl,
> +		 struct iommu_vdevice_tsm_req, tsm_code),
>   #ifdef CONFIG_IOMMUFD_TEST
>   	IOCTL_OP(IOMMU_TEST_CMD, iommufd_test, struct iommu_test_cmd, last),
>   #endif
> diff --git a/drivers/iommu/iommufd/tsm.c b/drivers/iommu/iommufd/tsm.c
> new file mode 100644
> index 000000000000..2fb51a86c5ec
> --- /dev/null
> +++ b/drivers/iommu/iommufd/tsm.c
> @@ -0,0 +1,98 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * Copyright (C) 2026 ARM Ltd.
> + */
> +
> +#include <linux/tsm.h>
> +#include "iommufd_private.h"
> +
> +static bool iommufd_vdevice_tsm_req_arch_valid(u32 tvm_arch)
> +{
> +	switch (tvm_arch) {
> +	case IOMMU_VDEVICE_TSM_TVM_ARCH_CCA:
> +	case IOMMU_VDEVICE_TSM_TVM_ARCH_SEV:
> +	case IOMMU_VDEVICE_TSM_TVM_ARCH_TDX:
> +		return true;
> +	default:
> +		return false;
> +	}
> +}
> +
> +static bool iommufd_vdevice_tsm_req_op_valid(u32 op, u32 tvm_arch)
> +{
> +	switch (op) {
> +	case TSM_REQ_VALIDATE_MMIO:
> +	case TSM_REQ_SET_TDI_STATE:
> +		return true;
> +	case TSM_REQ_SEV_ENABLE_DMA:
> +	case TSM_REQ_SEV_DISABLE_DMA:
> +		return tvm_arch == IOMMU_VDEVICE_TSM_TVM_ARCH_SEV;
> +	case TSM_REQ_READ_OBJECT:
> +	case TSM_REQ_REGEN_OBJECT:
> +	case TSM_REQ_OBJECT_INFO:
> +		return true;
> +	default:
> +		return false;
> +	}
> +}
> +
> +/**
> + * iommufd_vdevice_tsm_req_ioctl - Forward TSM requests
> + * @ucmd: user command data for IOMMU_VDEVICE_TSM_REQ
> + *
> + * Resolve @iommu_vdevice_tsm_req::vdevice_id to a vdevice and pass the
> + * request/response buffers to its vIOMMU provider.
> + *
> + * Return:
> + *  -errno on error.
> + *  positive residue if response/request bytes were left unconsumed.
> + *    if response buffer is provided, residue indicates the number of bytes
> + *    not used in response buffer
> + *    if there is no response buffer, residue indicates the number of bytes
> + *    not consumed in req buffer
> + *  0 otherwise.
> + */
> +int iommufd_vdevice_tsm_req_ioctl(struct iommufd_ucmd *ucmd)
> +{
> +	int ret;
> +	struct iommufd_vdevice *vdev;
> +	struct iommu_vdevice_tsm_req *cmd = ucmd->cmd;
> +	struct tsm_guest_req_info info = {
> +		.op = cmd->op,
> +		.tvm_arch = cmd->tvm_arch,
> +		.req   = {
> +			.user = u64_to_user_ptr(cmd->req_uptr),
> +			.is_kernel = false,
> +		},
> +		.req_len = cmd->req_len,
> +		.resp    =  {
> +			.user = u64_to_user_ptr(cmd->resp_uptr),
> +			.is_kernel = false,
> +		},
> +		.resp_len = cmd->resp_len,
> +	};
> +
> +	if (!iommufd_vdevice_tsm_req_arch_valid(cmd->tvm_arch))
> +		return -EINVAL;
> +
> +	if (!iommufd_vdevice_tsm_req_op_valid(cmd->op, cmd->tvm_arch))
> +		return -EINVAL;
> +
> +	vdev = iommufd_get_vdevice(ucmd->ictx, cmd->vdevice_id);
> +	if (IS_ERR(vdev))
> +		return PTR_ERR(vdev);
> +
> +	cmd->tsm_code = 0;
> +	if (!vdev->viommu->ops || !vdev->viommu->ops->vdevice_tsm_req)
> +		ret = -EOPNOTSUPP;
> +	else
> +		ret = vdev->viommu->ops->vdevice_tsm_req(vdev, &info,
> +							 &cmd->tsm_code);
> +
> +	/* Always copy the tsm_code as response */
> +	if (iommufd_ucmd_respond(ucmd, sizeof(*cmd)))
> +		ret = -EFAULT;
> +
> +	iommufd_put_object(ucmd->ictx, &vdev->obj);
> +	return ret;
> +}
> diff --git a/drivers/iommu/iommufd/viommu.c b/drivers/iommu/iommufd/viommu.c
> index 66bbd6e4571d..c462086ff5df 100644
> --- a/drivers/iommu/iommufd/viommu.c
> +++ b/drivers/iommu/iommufd/viommu.c
> @@ -3,6 +3,8 @@
>    */
>   #include <linux/file.h>
>   #include "iommufd_private.h"
> +#include <linux/cleanup.h>
> +#include <linux/tsm.h>
>   
>   void iommufd_viommu_destroy(struct iommufd_object *obj)
>   {
> diff --git a/include/linux/iommufd.h b/include/linux/iommufd.h
> index 7b906e0d6400..f16b82034be9 100644
> --- a/include/linux/iommufd.h
> +++ b/include/linux/iommufd.h
> @@ -27,6 +27,7 @@ struct iommufd_viommu_ops;
>   struct iommufd_viommu_provider;
>   struct module;
>   struct page;
> +struct tsm_guest_req_info;
>   
>   /**
>    * struct iommufd_viommu_provider_ops - External vIOMMU implementation
> @@ -199,6 +200,7 @@ struct iommufd_hw_queue {
>    *                include/uapi/linux/iommufd.h)
>    *                If driver has a deinit function to revert what vdevice_init op
>    *                does, it should set it to the @vdev->destroy function pointer
> + * @vdevice_tsm_req: Forward a guest TSM request to a driver-owned vDEVICE
>    * @get_hw_queue_size: Get the size of a driver-defined HW queue structure for a
>    *                     given @viommu corresponding to @queue_type. Driver should
>    *                     return 0 if HW queue aren't supported accordingly. It is
> @@ -225,6 +227,9 @@ struct iommufd_viommu_ops {
>   				struct iommu_user_data_array *array);
>   	const size_t vdevice_size;
>   	int (*vdevice_init)(struct iommufd_vdevice *vdev);
> +	ssize_t (*vdevice_tsm_req)(struct iommufd_vdevice *vdev,
> +				   struct tsm_guest_req_info *info,
> +				   u64 *tsm_code);
>   	size_t (*get_hw_queue_size)(struct iommufd_viommu *viommu,
>   				    enum iommu_hw_queue_type queue_type);
>   	/* AMD's HW will add hw_queue_init simply using @hw_queue->base_addr */
> diff --git a/include/linux/tsm.h b/include/linux/tsm.h
> index f38d6fcf9cc9..39bad60b4815 100644
> --- a/include/linux/tsm.h
> +++ b/include/linux/tsm.h
> @@ -7,6 +7,8 @@
>   #include <linux/types.h>
>   #include <linux/uuid.h>
>   #include <linux/device.h>
> +#include <linux/sockptr.h>
> +#include <uapi/linux/iommufd.h>
>   
>   #define TSM_REPORT_INBLOB_MAX 64
>   #define TSM_REPORT_OUTBLOB_MAX SZ_16M
> @@ -139,4 +141,27 @@ struct tsm_dev *find_tsm_dev(int id);
>   struct pci_ide;
>   int tsm_ide_stream_register(struct pci_ide *ide);
>   void tsm_ide_stream_unregister(struct pci_ide *ide);
> +
> +#ifdef CONFIG_TSM
> +/**
> + * struct tsm_guest_req_info - parameters for a guest-initiated TSM request
> + * @op: operation for the guest-initiated request
> + * @tvm_arch: guest TVM architecture
> + * @req: request data buffer filled by guest
> + * @req_len: the size of @req filled by guest
> + * @resp: response data buffer filled by host
> + * @resp_len: the size of @resp buffer filled by guest
> + */
> +struct tsm_guest_req_info {
> +	enum iommu_vdevice_tsm_guest_req_op op;
> +	enum iommu_vdevice_tsm_guest_tvm_arch tvm_arch;
> +	sockptr_t req;
> +	size_t req_len;
> +	sockptr_t resp;
> +	size_t resp_len;
> +};iommufd_viommu_provider_ops
> +#else
> +struct tsm_guest_req_info;
> +#endif
> +
>   #endif /* __TSM_H */
> diff --git a/include/uapi/linux/iommufd.h b/include/uapi/linux/iommufd.h
> index 0425d452d41e..43ed082a9421 100644
> --- a/include/uapi/linux/iommufd.h
> +++ b/include/uapi/linux/iommufd.h
> @@ -57,6 +57,7 @@ enum {
>   	IOMMUFD_CMD_IOAS_CHANGE_PROCESS = 0x92,
>   	IOMMUFD_CMD_VEVENTQ_ALLOC = 0x93,
>   	IOMMUFD_CMD_HW_QUEUE_ALLOC = 0x94,
> +	IOMMUFD_CMD_VDEVICE_TSM_REQ = 0x96,
>   };
>   
>   /**
> @@ -1351,4 +1352,76 @@ struct iommu_hw_queue_alloc {
>   	__aligned_u64 length;
>   };
>   #define IOMMU_HW_QUEUE_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HW_QUEUE_ALLOC)
> +
> +/**
> + * enum iommu_vdevice_tsm_guest_tvm_arch - guest TVM architecture
> + * @IOMMU_VDEVICE_TSM_TVM_ARCH_CCA: Arm CCA TVM
> + * @IOMMU_VDEVICE_TSM_TVM_ARCH_SEV: AMD SEV TVM
> + * @IOMMU_VDEVICE_TSM_TVM_ARCH_TDX: Intel TDX TVM
> + */
> +enum iommu_vdevice_tsm_guest_tvm_arch {
> +	IOMMU_VDEVICE_TSM_TVM_ARCH_CCA = 1,
> +	IOMMU_VDEVICE_TSM_TVM_ARCH_SEV,
> +	IOMMU_VDEVICE_TSM_TVM_ARCH_TDX,
> +};
> +
> +/**
> + * enum iommu_vdevice_tsm_guest_req_op - operation for guest TSM requests
> + * @TSM_REQ_VALIDATE_MMIO: Validate MMIO for the TDI
> + * @TSM_REQ_SET_TDI_STATE: Set TDI state
> + * @TSM_REQ_SEV_ENABLE_DMA: Enable SEV DMA
> + * @TSM_REQ_SEV_DISABLE_DMA: Disable SEV DMA
> + * @TSM_REQ_READ_OBJECT: Read a TSM object
> + * @TSM_REQ_REGEN_OBJECT: Regenerate a TSM object
> + * @TSM_REQ_OBJECT_INFO: Read TSM object information
> + */
> +enum iommu_vdevice_tsm_guest_req_op {
> +	TSM_REQ_VALIDATE_MMIO = 1,
> +	TSM_REQ_SET_TDI_STATE,
> +	TSM_REQ_SEV_ENABLE_DMA,
> +	TSM_REQ_SEV_DISABLE_DMA,
> +	TSM_REQ_READ_OBJECT,
> +	TSM_REQ_REGEN_OBJECT,
> +	TSM_REQ_OBJECT_INFO,
> +};
> +
> +/**
> + * struct iommu_vdevice_tsm_req - ioctl(IOMMU_VDEVICE_TSM_REQ)
> + * @size: sizeof(struct iommu_vdevice_tsm_req)
> + * @vdevice_id: vDevice ID the guest request is for
> + * @op: One of enum iommu_vdevice_tsm_guest_req_op
> + * @tvm_arch: One of enum iommu_vdevice_tsm_guest_tvm_arch
> + * @req_len: Size in bytes of the input payload at @req_uptr
> + * @resp_len: Size in bytes of the output buffer at @resp_uptr
> + * @req_uptr: Userspace pointer to the guest-provided request payload
> + * @resp_uptr: Userspace pointer to the guest response buffer
> + * @tsm_code: TSM-specific result code returned by the TSM implementation
> + *
> + * Forward a TSM request to the TSM bound vDevice. This is intended for
> + * guest TSM/TDISP message transport where the host kernel only marshals
> + * bytes between userspace and the TSM implementation.
> + *
> + * The request operation is guest initiated. The TSM backend validates
> + * @tvm_arch against its bound TVM architecture assumptions.
> + *
> + * The request payload is read from @req_uptr/@req_len. If a response is
> + * expected, userspace provides @resp_uptr/@resp_len as writable storage for
> + * response bytes returned by the TSM path.
> + *
> + * The ioctl is only suitable for commands and results that the host kernel
> + * has no use, the host is only facilitating guest to TSM communication.
> + */
> +struct iommu_vdevice_tsm_req {
> +	__u32 size;
> +	__u32 vdevice_id;
> +	__u32 op;
> +	__u32 tvm_arch;
> +	__u32 req_len;
> +	__u32 resp_len;
> +	__aligned_u64 req_uptr;
> +	__aligned_u64 resp_uptr;
> +	__aligned_u64 tsm_code;
> +};
> +
> +#define IOMMU_VDEVICE_TSM_REQ _IO(IOMMUFD_TYPE, IOMMUFD_CMD_VDEVICE_TSM_REQ)
>   #endif

-- 
Alexey