[QUESTION] Is the ARM SMMU v3 implementation designed to always ignore SSID when SSID_VALID == 0?

[QUESTION] Is the ARM SMMU v3 implementation designed to always ignore SSID when SSID_VALID == 0?

[Joonwon Kang]

Hi team,

According to the ARM SMMU v3 spec, I believe that SSID should always be
ignored when SSID_VALID == 0 and the current ARM SMMU v3 module
implementation in the kernel seems to comply with this without exception.
For example, when handling an event from SMMU, the implementation checks
SSID_VALID(SSV) first and ignores SSID accordingly. If there is any
exception to this rule, I believe it is a bug.

Is it true for all the current and future cases? In other words, is it
**mandatory** that the ARM SMMU v3 implementation ignores SSID when
SSID_VALID == 0? or there might be some cases where the implementation
needs to refer to SSID even when SSID_VALID == 0?

Asking this question since our HW may not be able to clear SSID when
SSID_VALID == 0 and so there might be some garbage value in SSID at some
point of time(the HW will have a correct SSID when SSID_VALID == 1,
though). If the ARM SMMU v3 implementation is to refer to that garbage
value for any reason, the result would be devastating.

Thanks,
Joonwon Kang

Re: [QUESTION] Is the ARM SMMU v3 implementation designed to always ignore SSID when SSID_VALID == 0?

[Jean-Philippe Brucker]

Hi,

On Tue, Apr 28, 2026 at 07:38:59AM +0000, Joonwon Kang wrote:
> Hi team,
> 
> According to the ARM SMMU v3 spec, I believe that SSID should always be
> ignored when SSID_VALID == 0 and the current ARM SMMU v3 module
> implementation in the kernel seems to comply with this without exception.
> For example, when handling an event from SMMU, the implementation checks
> SSID_VALID(SSV) first and ignores SSID accordingly. If there is any
> exception to this rule, I believe it is a bug.

Indeed

> Is it true for all the current and future cases? In other words, is it
> **mandatory** that the ARM SMMU v3 implementation ignores SSID when
> SSID_VALID == 0? or there might be some cases where the implementation
> needs to refer to SSID even when SSID_VALID == 0?
> 
> Asking this question since our HW may not be able to clear SSID when
> SSID_VALID == 0 and so there might be some garbage value in SSID at some
> point of time(the HW will have a correct SSID when SSID_VALID == 1,
> though). If the ARM SMMU v3 implementation is to refer to that garbage
> value for any reason, the result would be devastating.

At least according to the architecture, SubstreamID is ignored when SSV=0.
The SMMU is allowed to propagate the garbage:

  7.3 Event record

  * SSV: The SubstreamID validity flag
    - 0: No SubstreamID was provided with the transaction and the SubstreamID field is UNKNOWN.

But the driver will ignore it.

Same for PRI queue but in that case the page request wouldn't have a PASID
TLP prefix.

Thanks,
Jean

Re: [QUESTION] Is the ARM SMMU v3 implementation designed to always ignore SSID when SSID_VALID == 0?

[Joonwon Kang]

Thanks for your prompt and insightful answer!

> Hi,
> 
> On Tue, Apr 28, 2026 at 07:38:59AM +0000, Joonwon Kang wrote:
> > Hi team,
> > 
> > According to the ARM SMMU v3 spec, I believe that SSID should always be
> > ignored when SSID_VALID == 0 and the current ARM SMMU v3 module
> > implementation in the kernel seems to comply with this without exception.
> > For example, when handling an event from SMMU, the implementation checks
> > SSID_VALID(SSV) first and ignores SSID accordingly. If there is any
> > exception to this rule, I believe it is a bug.
> 
> Indeed

Acknowledged.

> 
> > Is it true for all the current and future cases? In other words, is it
> > **mandatory** that the ARM SMMU v3 implementation ignores SSID when
> > SSID_VALID == 0? or there might be some cases where the implementation
> > needs to refer to SSID even when SSID_VALID == 0?
> > 
> > Asking this question since our HW may not be able to clear SSID when
> > SSID_VALID == 0 and so there might be some garbage value in SSID at some
> > point of time(the HW will have a correct SSID when SSID_VALID == 1,
> > though). If the ARM SMMU v3 implementation is to refer to that garbage
> > value for any reason, the result would be devastating.
> 
> At least according to the architecture, SubstreamID is ignored when SSV=0.
> The SMMU is allowed to propagate the garbage:
> 
>   7.3 Event record
> 
>   * SSV: The SubstreamID validity flag
>     - 0: No SubstreamID was provided with the transaction and the SubstreamID field is UNKNOWN.
> 
> But the driver will ignore it.
> 
> Same for PRI queue but in that case the page request wouldn't have a PASID
> TLP prefix.

Although the PRI request without PASID may cause unpleasant ATC flush with
SSV clear in this case, it does not lead to the implementation referring
to the garbage SSID. Is this understanding correct? And while this case
seems to be handled solely by the ARM SMMU v3 implementation, do you see
if there is additional care required on our device driver for this?

Thanks,
Joonwon Kang

Re: [QUESTION] Is the ARM SMMU v3 implementation designed to always ignore SSID when SSID_VALID == 0?

[Robin Murphy]

On 28/04/2026 12:14 pm, Joonwon Kang wrote:
> Thanks for your prompt and insightful answer!
> 
>> Hi,
>>
>> On Tue, Apr 28, 2026 at 07:38:59AM +0000, Joonwon Kang wrote:
>>> Hi team,
>>>
>>> According to the ARM SMMU v3 spec, I believe that SSID should always be
>>> ignored when SSID_VALID == 0 and the current ARM SMMU v3 module
>>> implementation in the kernel seems to comply with this without exception.
>>> For example, when handling an event from SMMU, the implementation checks
>>> SSID_VALID(SSV) first and ignores SSID accordingly. If there is any
>>> exception to this rule, I believe it is a bug.
>>
>> Indeed
> 
> Acknowledged.
> 
>>
>>> Is it true for all the current and future cases? In other words, is it
>>> **mandatory** that the ARM SMMU v3 implementation ignores SSID when
>>> SSID_VALID == 0? or there might be some cases where the implementation
>>> needs to refer to SSID even when SSID_VALID == 0?
>>>
>>> Asking this question since our HW may not be able to clear SSID when
>>> SSID_VALID == 0 and so there might be some garbage value in SSID at some
>>> point of time(the HW will have a correct SSID when SSID_VALID == 1,
>>> though). If the ARM SMMU v3 implementation is to refer to that garbage
>>> value for any reason, the result would be devastating.
>>
>> At least according to the architecture, SubstreamID is ignored when SSV=0.
>> The SMMU is allowed to propagate the garbage:
>>
>>    7.3 Event record
>>
>>    * SSV: The SubstreamID validity flag
>>      - 0: No SubstreamID was provided with the transaction and the SubstreamID field is UNKNOWN.
>>
>> But the driver will ignore it.
>>
>> Same for PRI queue but in that case the page request wouldn't have a PASID
>> TLP prefix.
> 
> Although the PRI request without PASID may cause unpleasant ATC flush with
> SSV clear in this case, it does not lead to the implementation referring
> to the garbage SSID. Is this understanding correct? And while this case
> seems to be handled solely by the ARM SMMU v3 implementation, do you see
> if there is additional care required on our device driver for this?

A transaction with SSV==0 does not have a SubstreamID, therefore by 
definition there is nothing that an SMMU could validly attempt to do 
with a SubstreamID that does not exist. Sure, implementations can have 
bugs, but I'd expect any such bug in this regard should be sufficiently 
obvious that it most likely wouldn't get past architectural validation 
in the first place.

If you want to know the exact behaviour of Arm's implementations then 
you're best off asking Arm support, but since this piqued my curiosity 
too, I can save you the trouble - I checked with my contacts on the 
design team, and indeed our SMMUs should ignore the SSID value entirely 
when SSV==0 and just treat it as 0 (e.g. in event records).

Thanks,
Robin.

Re: [QUESTION] Is the ARM SMMU v3 implementation designed to always ignore SSID when SSID_VALID == 0?

[Joonwon Kang]

> On 28/04/2026 12:14 pm, Joonwon Kang wrote:
> > Thanks for your prompt and insightful answer!
> > 
> >> Hi,
> >>
> >> On Tue, Apr 28, 2026 at 07:38:59AM +0000, Joonwon Kang wrote:
> >>> Hi team,
> >>>
> >>> According to the ARM SMMU v3 spec, I believe that SSID should always be
> >>> ignored when SSID_VALID == 0 and the current ARM SMMU v3 module
> >>> implementation in the kernel seems to comply with this without exception.
> >>> For example, when handling an event from SMMU, the implementation checks
> >>> SSID_VALID(SSV) first and ignores SSID accordingly. If there is any
> >>> exception to this rule, I believe it is a bug.
> >>
> >> Indeed
> > 
> > Acknowledged.
> > 
> >>
> >>> Is it true for all the current and future cases? In other words, is it
> >>> **mandatory** that the ARM SMMU v3 implementation ignores SSID when
> >>> SSID_VALID == 0? or there might be some cases where the implementation
> >>> needs to refer to SSID even when SSID_VALID == 0?
> >>>
> >>> Asking this question since our HW may not be able to clear SSID when
> >>> SSID_VALID == 0 and so there might be some garbage value in SSID at some
> >>> point of time(the HW will have a correct SSID when SSID_VALID == 1,
> >>> though). If the ARM SMMU v3 implementation is to refer to that garbage
> >>> value for any reason, the result would be devastating.
> >>
> >> At least according to the architecture, SubstreamID is ignored when SSV=0.
> >> The SMMU is allowed to propagate the garbage:
> >>
> >>    7.3 Event record
> >>
> >>    * SSV: The SubstreamID validity flag
> >>      - 0: No SubstreamID was provided with the transaction and the SubstreamID field is UNKNOWN.
> >>
> >> But the driver will ignore it.
> >>
> >> Same for PRI queue but in that case the page request wouldn't have a PASID
> >> TLP prefix.
> > 
> > Although the PRI request without PASID may cause unpleasant ATC flush with
> > SSV clear in this case, it does not lead to the implementation referring
> > to the garbage SSID. Is this understanding correct? And while this case
> > seems to be handled solely by the ARM SMMU v3 implementation, do you see
> > if there is additional care required on our device driver for this?
> 
> A transaction with SSV==0 does not have a SubstreamID, therefore by 
> definition there is nothing that an SMMU could validly attempt to do 
> with a SubstreamID that does not exist. Sure, implementations can have 
> bugs, but I'd expect any such bug in this regard should be sufficiently 
> obvious that it most likely wouldn't get past architectural validation 
> in the first place.
> 

It makes a lot of sense.

> If you want to know the exact behaviour of Arm's implementations then 
> you're best off asking Arm support, but since this piqued my curiosity 
> too, I can save you the trouble - I checked with my contacts on the 
> design team, and indeed our SMMUs should ignore the SSID value entirely 
> when SSV==0 and just treat it as 0 (e.g. in event records).

Thank you very much for saving me the effort and confirming this. I also
acknowledge that it will be best to ask the Arm support with regards to
the exact behavior of Arm's implementation. 

Thanks,
Joonwon Kang