[PATCH v4 03/10] iommu/arm-smmu-v3: Store IOTLB cache tags in struct arm_smmu_attach_state

Nicolin Chen
2026-03-19T19:52:52Z

So far, an IOTLB tag (ASID or VMID) has been stored in the arm_smmu_domain
structure. Its lifecycle is aligned with the smmu_domain.

However, an IOTLB tag (ASID or VMID) will not be used:
1) Before being installed to CD or STE during a device attachment
2) After being removed from CD or STE during a device detachment

Both (1) and (2) exactly align with the lifecycle of smmu_domain->invs.

The bigger problem is that storing the IOTLB tag in struct arm_smmu_domain
makes it difficult to share across SMMU instances, a common use case for a
nesting parent domain.

Introduce arm_smmu_find_iotlb_tag() helper to find an existing IOTLB cache
tag in the smmu_domain->invs array.

Introduce arm_smmu_alloc_iotlb_tag() helper provisionally copying an IOTLB
tag from the smmu_domain (cd->asid and s2_cfg), which will be updated later
to actually allocate a new IOTLB cache tag from the ASID or VMID bitmap.

(Note only the new_smmu_domain pathway is allowed to allocate a new tag.)

The returned tag will be stored in struct arm_smmu_attach_state, which will
be forwarded to arm_smmu_master_build_invs() and eventually set to a CD or
STE accordingly.

Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 11 +++
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 84 +++++++++++++++++++++
2 files changed, 95 insertions(+)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
index a31f9f7f39d3a..7f86be3144805 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
@@ -674,6 +674,11 @@ struct arm_smmu_inv {
int users; /* users=0 to mark as a trash to be purged */
};

+static inline void arm_smmu_inv_assert_iotlb_tag(struct arm_smmu_inv *inv)
+{
+ WARN_ON(inv->type != INV_TYPE_S1_ASID && inv->type != INV_TYPE_S2_VMID);
+}
+
static inline bool arm_smmu_inv_is_ats(const struct arm_smmu_inv *inv)
{
return inv->type == INV_TYPE_ATS || inv->type == INV_TYPE_ATS_FULL;
@@ -1117,11 +1122,13 @@ static inline bool arm_smmu_master_canwbs(struct arm_smmu_master *master)
* @new_invs: for new domain, this is the new invs array to update domain->invs;
* for old domain, this is the master->build_invs to pass in as the
* to_unref argument to an arm_smmu_invs_unref() call
+ * @tag: IOTLB cache tag (INV_TYPE_S1_ASID or INV_TYPE_S2_VMID)
*/
struct arm_smmu_inv_state {
struct arm_smmu_invs __rcu **invs_ptr;
struct arm_smmu_invs *old_invs;
struct arm_smmu_invs *new_invs;
+ struct arm_smmu_inv tag;
};

struct arm_smmu_attach_state {
@@ -1138,6 +1145,10 @@ struct arm_smmu_attach_state {
bool ats_enabled;
};

+int arm_smmu_find_iotlb_tag(struct iommu_domain *domain,
+ struct arm_smmu_device *smmu,
+ struct arm_smmu_inv *tag);
+
int arm_smmu_attach_prepare(struct arm_smmu_attach_state *state,
struct iommu_domain *new_domain);
void arm_smmu_attach_commit(struct arm_smmu_attach_state *state);
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index 78d45952db7da..29b1310786244 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -3205,6 +3205,77 @@ static void arm_smmu_disable_iopf(struct arm_smmu_master *master,
iopf_queue_remove_device(master->smmu->evtq.iopf, master->dev);
}

+static int __arm_smmu_domain_find_iotlb_tag(struct arm_smmu_domain *smmu_domain,
+ struct arm_smmu_inv *tag)
+{
+ struct arm_smmu_invs *invs = rcu_dereference_protected(
+ smmu_domain->invs, lockdep_is_held(&arm_smmu_asid_lock));
+ size_t i;
+
+ arm_smmu_inv_assert_iotlb_tag(tag);
+
+ for (i = 0; i != invs->num_invs; i++) {
+ if (invs->inv[i].type == tag->type &&
+ invs->inv[i].smmu == tag->smmu &&
+ READ_ONCE(invs->inv[i].users)) {
+ *tag = invs->inv[i];
+ return 0;
+ }
+ }
+
+ return -ENOENT;
+}
+
+/* Find an existing IOTLB cache tag in smmu_domain->invs (users counter != 0) */
+int arm_smmu_find_iotlb_tag(struct iommu_domain *domain,
+ struct arm_smmu_device *smmu,
+ struct arm_smmu_inv *tag)
+{
+ struct arm_smmu_domain *smmu_domain = to_smmu_domain_devices(domain);
+
+ if (WARN_ON(!smmu_domain))
+ return -EINVAL;
+
+ /* Decide the type of the iotlb cache tag */
+ switch (smmu_domain->stage) {
+ case ARM_SMMU_DOMAIN_SVA:
+ case ARM_SMMU_DOMAIN_S1:
+ tag->type = INV_TYPE_S1_ASID;
+ break;
+ case ARM_SMMU_DOMAIN_S2:
+ tag->type = INV_TYPE_S2_VMID;
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ tag->smmu = smmu;
+
+ return __arm_smmu_domain_find_iotlb_tag(smmu_domain, tag);
+}
+
+/* Allocate a new IOTLB cache tag (users counter == 0) */
+static int arm_smmu_alloc_iotlb_tag(struct iommu_domain *domain,
+ struct arm_smmu_device *smmu,
+ struct arm_smmu_inv *tag)
+{
+ struct arm_smmu_domain *smmu_domain = to_smmu_domain_devices(domain);
+ int ret;
+
+ /* Only allocate if there is no IOTLB cache tag to re-use */
+ ret = arm_smmu_find_iotlb_tag(domain, smmu, tag);
+ if (!ret || ret != -ENOENT)
+ return ret;
+
+ /* FIXME replace with an actual allocation from the bitmap */
+ if (tag->type == INV_TYPE_S1_ASID)
+ tag->id = smmu_domain->cd.asid;
+ else
+ tag->id = smmu_domain->s2_cfg.vmid;
+
+ return 0;
+}
+
static struct arm_smmu_inv *
arm_smmu_master_build_inv(struct arm_smmu_master *master,
enum arm_smmu_inv_type type, u32 id, ioasid_t ssid,
@@ -3370,7 +3441,9 @@ static int arm_smmu_attach_prepare_invs(struct arm_smmu_attach_state *state,
struct arm_smmu_domain *new_smmu_domain =
to_smmu_domain_devices(new_domain);
struct arm_smmu_master *master = state->master;
+ struct arm_smmu_device *smmu = master->smmu;
ioasid_t ssid = state->ssid;
+ int ret;

/*
* At this point a NULL domain indicates the domain doesn't use the
@@ -3384,6 +3457,11 @@ static int arm_smmu_attach_prepare_invs(struct arm_smmu_attach_state *state,
invst->old_invs = rcu_dereference_protected(
new_smmu_domain->invs,
lockdep_is_held(&arm_smmu_asid_lock));
+
+ ret = arm_smmu_alloc_iotlb_tag(new_domain, smmu, &invst->tag);
+ if (ret)
+ return ret;
+
build_invs = arm_smmu_master_build_invs(
master, state->ats_enabled, ssid, new_smmu_domain);
if (!build_invs)
@@ -3406,6 +3484,12 @@ static int arm_smmu_attach_prepare_invs(struct arm_smmu_attach_state *state,
invst->old_invs = rcu_dereference_protected(
old_smmu_domain->invs,
lockdep_is_held(&arm_smmu_asid_lock));
+
+ ret = arm_smmu_find_iotlb_tag(state->old_domain, smmu,
+ &invst->tag);
+ if (WARN_ON(ret))
+ return ret;
+
/* For old_smmu_domain, new_invs points to master->build_invs */
invst->new_invs = arm_smmu_master_build_invs(
master, master->ats_enabled, ssid, old_smmu_domain);
--
2.43.0