[PATCH v14 4/7] PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends

[PATCH v14 4/7] PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends

[Koichiro Den]

Prepare pci-ep-msi for non-MSI doorbell backends.

Factor MSI doorbell allocation into a helper and extend struct
pci_epf_doorbell_msg with:

  - irq_flags: required IRQ request flags (e.g. IRQF_SHARED for some
    backends)
  - type: doorbell backend type
  - bar/offset: pre-exposed doorbell target location, if any

Initialize these fields for the existing MSI-backed doorbell
implementation.

Also add PCI_EPF_DOORBELL_EMBEDDED type, which is to be implemented in a
follow-up patch.

No functional changes.

Reviewed-by: Frank Li <Frank.Li@nxp.com>
Tested-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Koichiro Den <den@valinux.co.jp>
---
 drivers/pci/endpoint/pci-ep-msi.c | 54 ++++++++++++++++++++++---------
 include/linux/pci-epf.h           | 23 +++++++++++--
 2 files changed, 60 insertions(+), 17 deletions(-)

diff --git a/drivers/pci/endpoint/pci-ep-msi.c b/drivers/pci/endpoint/pci-ep-msi.c
index 1395919571f8..85fe46103220 100644
--- a/drivers/pci/endpoint/pci-ep-msi.c
+++ b/drivers/pci/endpoint/pci-ep-msi.c
@@ -8,6 +8,7 @@
 
 #include <linux/device.h>
 #include <linux/export.h>
+#include <linux/interrupt.h>
 #include <linux/irqdomain.h>
 #include <linux/module.h>
 #include <linux/msi.h>
@@ -35,23 +36,13 @@ static void pci_epf_write_msi_msg(struct msi_desc *desc, struct msi_msg *msg)
 	pci_epc_put(epc);
 }
 
-int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
+static int pci_epf_alloc_doorbell_msi(struct pci_epf *epf, u16 num_db)
 {
-	struct pci_epc *epc = epf->epc;
+	struct pci_epf_doorbell_msg *msg;
 	struct device *dev = &epf->dev;
+	struct pci_epc *epc = epf->epc;
 	struct irq_domain *domain;
-	void *msg;
-	int ret;
-	int i;
-
-	/* TODO: Multi-EPF support */
-	if (list_first_entry_or_null(&epc->pci_epf, struct pci_epf, list) != epf) {
-		dev_err(dev, "MSI doorbell doesn't support multiple EPF\n");
-		return -EINVAL;
-	}
-
-	if (epf->db_msg)
-		return -EBUSY;
+	int ret, i;
 
 	domain = of_msi_map_get_device_domain(epc->dev.parent, 0,
 					      DOMAIN_BUS_PLATFORM_MSI);
@@ -74,6 +65,12 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
 	if (!msg)
 		return -ENOMEM;
 
+	for (i = 0; i < num_db; i++)
+		msg[i] = (struct pci_epf_doorbell_msg) {
+			.type = PCI_EPF_DOORBELL_MSI,
+			.bar = NO_BAR,
+		};
+
 	epf->num_db = num_db;
 	epf->db_msg = msg;
 
@@ -90,13 +87,40 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
 	for (i = 0; i < num_db; i++)
 		epf->db_msg[i].virq = msi_get_virq(epc->dev.parent, i);
 
+	return 0;
+}
+
+int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
+{
+	struct pci_epc *epc = epf->epc;
+	struct device *dev = &epf->dev;
+	int ret;
+
+	/* TODO: Multi-EPF support */
+	if (list_first_entry_or_null(&epc->pci_epf, struct pci_epf, list) != epf) {
+		dev_err(dev, "Doorbell doesn't support multiple EPF\n");
+		return -EINVAL;
+	}
+
+	if (epf->db_msg)
+		return -EBUSY;
+
+	ret = pci_epf_alloc_doorbell_msi(epf, num_db);
+	if (!ret)
+		return 0;
+
+	dev_err(dev, "Failed to allocate doorbell: %d\n", ret);
 	return ret;
 }
 EXPORT_SYMBOL_GPL(pci_epf_alloc_doorbell);
 
 void pci_epf_free_doorbell(struct pci_epf *epf)
 {
-	platform_device_msi_free_irqs_all(epf->epc->dev.parent);
+	if (!epf->db_msg)
+		return;
+
+	if (epf->db_msg[0].type == PCI_EPF_DOORBELL_MSI)
+		platform_device_msi_free_irqs_all(epf->epc->dev.parent);
 
 	kfree(epf->db_msg);
 	epf->db_msg = NULL;
diff --git a/include/linux/pci-epf.h b/include/linux/pci-epf.h
index 7737a7c03260..cd747447a1ea 100644
--- a/include/linux/pci-epf.h
+++ b/include/linux/pci-epf.h
@@ -152,14 +152,33 @@ struct pci_epf_bar {
 	struct pci_epf_bar_submap	*submap;
 };
 
+enum pci_epf_doorbell_type {
+	PCI_EPF_DOORBELL_MSI = 0,
+	PCI_EPF_DOORBELL_EMBEDDED,
+};
+
 /**
  * struct pci_epf_doorbell_msg - represents doorbell message
- * @msg: MSI message
- * @virq: IRQ number of this doorbell MSI message
+ * @msg: Doorbell address/data pair to be mapped into BAR space.
+ *       For MSI-backed doorbells this is the MSI message, while for
+ *       "embedded" doorbells this represents an MMIO write that asserts
+ *       an interrupt on the EP side.
+ * @virq: IRQ number of this doorbell message
+ * @irq_flags: Required flags for request_irq()/request_threaded_irq().
+ *             Callers may OR-in additional flags (e.g. IRQF_ONESHOT).
+ * @type: Doorbell type.
+ * @bar: BAR number where the doorbell target is already exposed to the RC
+ *       (NO_BAR if not)
+ * @offset: offset within @bar for the doorbell target (valid iff
+ *          @bar != NO_BAR)
  */
 struct pci_epf_doorbell_msg {
 	struct msi_msg msg;
 	int virq;
+	unsigned long irq_flags;
+	enum pci_epf_doorbell_type type;
+	enum pci_barno bar;
+	resource_size_t offset;
 };
 
 /**
-- 
2.51.0

Re: [PATCH v14 4/7] PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends

[Max Boone]

On Tue, 14 Apr 2026 23:15:11 +0900, Koichiro Den wrote:
> Prepare pci-ep-msi for non-MSI doorbell backends.
> 
> Factor MSI doorbell allocation into a helper and extend struct
> pci_epf_doorbell_msg with:
> 
> - irq_flags: required IRQ request flags (e.g. IRQF_SHARED for some
> backends)
> - type: doorbell backend type
> - bar/offset: pre-exposed doorbell target location, if any
> 
> Initialize these fields for the existing MSI-backed doorbell
> implementation.
> 
> Also add PCI_EPF_DOORBELL_EMBEDDED type, which is to be implemented in a
> follow-up patch.
> 
> No functional changes.

I’m not very fond of keeping this implementation in the pci-ep-msi file,
as the platform MSI and this implementation are both iiuc specific to
the designware ep driver. Even more so because the MSI implementation
is enabled by config rather than through device tree.

Wouldn’t we want end-users to specify what kind of doorbell they want,
as it seems to be that a more specific doorbell BAR layout can be 
programmed with eDMA, allowing native support for nvmet’s doorbell
BAR for example.

Originally in a patchset by Frank Li the API that was proposed was more
generic, and the pci-epc-msi implementation was chosen because there
was only one implementation:
- https://lore.kernel.org/imx/20231019150441.GA7254@thinkpad/
- https://lore.kernel.org/imx/20231019172347.GC7254@thinkpad/

I’d personally prefer to see an abstraction that is weaved into pci-epc-core
and pci-epf-core that can be implemented by drivers as they wish. While 
still keeping the enum for different types.

That also gives room to pull a poll-mode doorbell into the pci-epc-core,
which deduplicates that code from the nvmet and vntb epfs, and allows
other functions to use RC->EP doorbells without needing to bother with
writing the polling mechanism.

P.S. I’ve been working on a vfio-user based epc for development purposes
personally, and the last hurdle before I want to send it in for comments is 
support for doorbells, and came across this patchset checking if there’s
any other activity in the space. Having an implementation-agnostic
doorbell API in the EPF/EPC core would be very helpful to me.

> 
> Reviewed-by: Frank Li <Frank.Li@nxp.com>
> Tested-by: Niklas Cassel <cassel@kernel.org>
> Signed-off-by: Koichiro Den <den@valinux.co.jp>
> ---
> drivers/pci/endpoint/pci-ep-msi.c | 54 ++++++++++++++++++++++---------
> include/linux/pci-epf.h | 23 +++++++++++--
> 2 files changed, 60 insertions(+), 17 deletions(-)
> 
> diff --git a/drivers/pci/endpoint/pci-ep-msi.c b/drivers/pci/endpoint/pci-ep-msi.c
> index 1395919571f8..85fe46103220 100644
> --- a/drivers/pci/endpoint/pci-ep-msi.c
> +++ b/drivers/pci/endpoint/pci-ep-msi.c
> @@ -8,6 +8,7 @@
> 
> #include <linux/device.h>
> #include <linux/export.h>
> +#include <linux/interrupt.h>
> #include <linux/irqdomain.h>
> #include <linux/module.h>
> #include <linux/msi.h>
> @@ -35,23 +36,13 @@ static void pci_epf_write_msi_msg(struct msi_desc *desc, struct msi_msg *msg)
> pci_epc_put(epc);
> }
> 
> -int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
> +static int pci_epf_alloc_doorbell_msi(struct pci_epf *epf, u16 num_db)
> {
> - struct pci_epc *epc = epf->epc;
> + struct pci_epf_doorbell_msg *msg;
> struct device *dev = &epf->dev;
> + struct pci_epc *epc = epf->epc;
> struct irq_domain *domain;
> - void *msg;
> - int ret;
> - int i;
> -
> - /* TODO: Multi-EPF support */
> - if (list_first_entry_or_null(&epc->pci_epf, struct pci_epf, list) != epf) {
> - dev_err(dev, "MSI doorbell doesn't support multiple EPF\n");
> - return -EINVAL;
> - }
> -
> - if (epf->db_msg)
> - return -EBUSY;
> + int ret, i;
> 
> domain = of_msi_map_get_device_domain(epc->dev.parent, 0,
> DOMAIN_BUS_PLATFORM_MSI);
> @@ -74,6 +65,12 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
> if (!msg)
> return -ENOMEM;
> 
> + for (i = 0; i < num_db; i++)
> + msg[i] = (struct pci_epf_doorbell_msg) {
> + .type = PCI_EPF_DOORBELL_MSI,
> + .bar = NO_BAR,
> + };
> +
> epf->num_db = num_db;
> epf->db_msg = msg;
> 
> @@ -90,13 +87,40 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
> for (i = 0; i < num_db; i++)
> epf->db_msg[i].virq = msi_get_virq(epc->dev.parent, i);
> 
> + return 0;
> +}
> +
> +int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
> +{
> + struct pci_epc *epc = epf->epc;
> + struct device *dev = &epf->dev;
> + int ret;
> +
> + /* TODO: Multi-EPF support */
> + if (list_first_entry_or_null(&epc->pci_epf, struct pci_epf, list) != epf) {
> + dev_err(dev, "Doorbell doesn't support multiple EPF\n");
> + return -EINVAL;
> + }
> +
> + if (epf->db_msg)
> + return -EBUSY;
> +
> + ret = pci_epf_alloc_doorbell_msi(epf, num_db);
> + if (!ret)
> + return 0;
> +
> + dev_err(dev, "Failed to allocate doorbell: %d\n", ret);
> return ret;
> }
> EXPORT_SYMBOL_GPL(pci_epf_alloc_doorbell);
> 
> void pci_epf_free_doorbell(struct pci_epf *epf)
> {
> - platform_device_msi_free_irqs_all(epf->epc->dev.parent);
> + if (!epf->db_msg)
> + return;
> +
> + if (epf->db_msg[0].type == PCI_EPF_DOORBELL_MSI)
> + platform_device_msi_free_irqs_all(epf->epc->dev.parent);
> 
> kfree(epf->db_msg);
> epf->db_msg = NULL;
> diff --git a/include/linux/pci-epf.h b/include/linux/pci-epf.h
> index 7737a7c03260..cd747447a1ea 100644
> --- a/include/linux/pci-epf.h
> +++ b/include/linux/pci-epf.h
> @@ -152,14 +152,33 @@ struct pci_epf_bar {
> struct pci_epf_bar_submap *submap;
> };
> 
> +enum pci_epf_doorbell_type {
> + PCI_EPF_DOORBELL_MSI = 0,
> + PCI_EPF_DOORBELL_EMBEDDED,
> +};
> +
> /**
> * struct pci_epf_doorbell_msg - represents doorbell message
> - * @msg: MSI message
> - * @virq: IRQ number of this doorbell MSI message
> + * @msg: Doorbell address/data pair to be mapped into BAR space.
> + * For MSI-backed doorbells this is the MSI message, while for
> + * "embedded" doorbells this represents an MMIO write that asserts
> + * an interrupt on the EP side.
> + * @virq: IRQ number of this doorbell message
> + * @irq_flags: Required flags for request_irq()/request_threaded_irq().
> + * Callers may OR-in additional flags (e.g. IRQF_ONESHOT).
> + * @type: Doorbell type.
> + * @bar: BAR number where the doorbell target is already exposed to the RC
> + * (NO_BAR if not)
> + * @offset: offset within @bar for the doorbell target (valid iff
> + * @bar != NO_BAR)
> */
> struct pci_epf_doorbell_msg {
> struct msi_msg msg;
> int virq;
> + unsigned long irq_flags;
> + enum pci_epf_doorbell_type type;
> + enum pci_barno bar;
> + resource_size_t offset;
> };
> 
> /**
> -- 
> 2.51.0

Re: [PATCH v14 4/7] PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends

[Max Boone]

> On Apr 14, 2026, at 4:15 PM, Koichiro Den <den@valinux.co.jp> wrote:
> 
> Prepare pci-ep-msi for non-MSI doorbell backends.
> 
> Factor MSI doorbell allocation into a helper and extend struct
> pci_epf_doorbell_msg with:
> 
>  - irq_flags: required IRQ request flags (e.g. IRQF_SHARED for some
>    backends)
>  - type: doorbell backend type
>  - bar/offset: pre-exposed doorbell target location, if any
> 
> Initialize these fields for the existing MSI-backed doorbell
> implementation.
> 
> Also add PCI_EPF_DOORBELL_EMBEDDED type, which is to be implemented in a
> follow-up patch.

I’m not very fond of keeping this implementation in the pci-ep-msi file,
as the platform MSI and this implementation are both iiuc specific to
the designware ep driver. Even more so because the MSI implementation
is enabled by config rather than through device tree.

Wouldn’t we want end-users to specify what kind of doorbell they want,
as it seems to be that a more specific doorbell BAR layout can be 
programmed with eDMA, allowing native support for nvmet’s doorbell
BAR for example.

Originally in a patchset by Frank Li the API that was proposed was more
generic, and the pci-epc-msi implementation was chosen because there
was only one implementation:
- https://lore.kernel.org/imx/20231019150441.GA7254@thinkpad/
- https://lore.kernel.org/imx/20231019172347.GC7254@thinkpad/

I’d personally prefer to see an abstraction that is weaved into pci-epc-core
and pci-epf-core that can be implemented by drivers as they wish. While 
still keeping the enum for different types.

That also gives room to pull a poll-mode doorbell into the pci-epc-core,
which deduplicates that code from the nvmet and vntb epfs, and allows
other functions to use RC->EP doorbells without needing to bother with
writing the polling mechanism.

P.S. I’ve been working on a vfio-user based epc for development purposes
personally, and the last hurdle before I want to send it in for comments is 
support for doorbells, and came across this patchset checking if there’s
any other activity in the space. Having an implementation-agnostic
doorbell API in the EPF/EPC core would be very helpful to me.

> 
> No functional changes.
> 
> Reviewed-by: Frank Li <Frank.Li@nxp.com>
> Tested-by: Niklas Cassel <cassel@kernel.org>
> Signed-off-by: Koichiro Den <den@valinux.co.jp>
> ---
> drivers/pci/endpoint/pci-ep-msi.c | 54 ++++++++++++++++++++++---------
> include/linux/pci-epf.h           | 23 +++++++++++--
> 2 files changed, 60 insertions(+), 17 deletions(-)
> 
> diff --git a/drivers/pci/endpoint/pci-ep-msi.c b/drivers/pci/endpoint/pci-ep-msi.c
> index 1395919571f8..85fe46103220 100644
> --- a/drivers/pci/endpoint/pci-ep-msi.c
> +++ b/drivers/pci/endpoint/pci-ep-msi.c
> @@ -8,6 +8,7 @@
> 
> #include <linux/device.h>
> #include <linux/export.h>
> +#include <linux/interrupt.h>
> #include <linux/irqdomain.h>
> #include <linux/module.h>
> #include <linux/msi.h>
> @@ -35,23 +36,13 @@ static void pci_epf_write_msi_msg(struct msi_desc *desc, struct msi_msg *msg)
> pci_epc_put(epc);
> }
> 
> -int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
> +static int pci_epf_alloc_doorbell_msi(struct pci_epf *epf, u16 num_db)
> {
> - struct pci_epc *epc = epf->epc;
> + struct pci_epf_doorbell_msg *msg;
> struct device *dev = &epf->dev;
> + struct pci_epc *epc = epf->epc;
> struct irq_domain *domain;
> - void *msg;
> - int ret;
> - int i;
> -
> - /* TODO: Multi-EPF support */
> - if (list_first_entry_or_null(&epc->pci_epf, struct pci_epf, list) != epf) {
> - dev_err(dev, "MSI doorbell doesn't support multiple EPF\n");
> - return -EINVAL;
> - }
> -
> - if (epf->db_msg)
> - return -EBUSY;
> + int ret, i;
> 
> domain = of_msi_map_get_device_domain(epc->dev.parent, 0,
>      DOMAIN_BUS_PLATFORM_MSI);
> @@ -74,6 +65,12 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
> if (!msg)
> return -ENOMEM;
> 
> + for (i = 0; i < num_db; i++)
> + msg[i] = (struct pci_epf_doorbell_msg) {
> + .type = PCI_EPF_DOORBELL_MSI,
> + .bar = NO_BAR,
> + };
> +
> epf->num_db = num_db;
> epf->db_msg = msg;
> 
> @@ -90,13 +87,40 @@ int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
> for (i = 0; i < num_db; i++)
> epf->db_msg[i].virq = msi_get_virq(epc->dev.parent, i);
> 
> + return 0;
> +}
> +
> +int pci_epf_alloc_doorbell(struct pci_epf *epf, u16 num_db)
> +{
> + struct pci_epc *epc = epf->epc;
> + struct device *dev = &epf->dev;
> + int ret;
> +
> + /* TODO: Multi-EPF support */
> + if (list_first_entry_or_null(&epc->pci_epf, struct pci_epf, list) != epf) {
> + dev_err(dev, "Doorbell doesn't support multiple EPF\n");
> + return -EINVAL;
> + }
> +
> + if (epf->db_msg)
> + return -EBUSY;
> +
> + ret = pci_epf_alloc_doorbell_msi(epf, num_db);
> + if (!ret)
> + return 0;
> +
> + dev_err(dev, "Failed to allocate doorbell: %d\n", ret);
> return ret;
> }
> EXPORT_SYMBOL_GPL(pci_epf_alloc_doorbell);
> 
> void pci_epf_free_doorbell(struct pci_epf *epf)
> {
> - platform_device_msi_free_irqs_all(epf->epc->dev.parent);
> + if (!epf->db_msg)
> + return;
> +
> + if (epf->db_msg[0].type == PCI_EPF_DOORBELL_MSI)
> + platform_device_msi_free_irqs_all(epf->epc->dev.parent);
> 
> kfree(epf->db_msg);
> epf->db_msg = NULL;
> diff --git a/include/linux/pci-epf.h b/include/linux/pci-epf.h
> index 7737a7c03260..cd747447a1ea 100644
> --- a/include/linux/pci-epf.h
> +++ b/include/linux/pci-epf.h
> @@ -152,14 +152,33 @@ struct pci_epf_bar {
> struct pci_epf_bar_submap *submap;
> };
> 
> +enum pci_epf_doorbell_type {
> + PCI_EPF_DOORBELL_MSI = 0,
> + PCI_EPF_DOORBELL_EMBEDDED,
> +};
> +
> /**
>  * struct pci_epf_doorbell_msg - represents doorbell message
> - * @msg: MSI message
> - * @virq: IRQ number of this doorbell MSI message
> + * @msg: Doorbell address/data pair to be mapped into BAR space.
> + *       For MSI-backed doorbells this is the MSI message, while for
> + *       "embedded" doorbells this represents an MMIO write that asserts
> + *       an interrupt on the EP side.
> + * @virq: IRQ number of this doorbell message
> + * @irq_flags: Required flags for request_irq()/request_threaded_irq().
> + *             Callers may OR-in additional flags (e.g. IRQF_ONESHOT).
> + * @type: Doorbell type.
> + * @bar: BAR number where the doorbell target is already exposed to the RC
> + *       (NO_BAR if not)
> + * @offset: offset within @bar for the doorbell target (valid iff
> + *          @bar != NO_BAR)
>  */
> struct pci_epf_doorbell_msg {
> struct msi_msg msg;
> int virq;
> + unsigned long irq_flags;
> + enum pci_epf_doorbell_type type;
> + enum pci_barno bar;
> + resource_size_t offset;
> };
> 
> /**
> -- 
> 2.51.0
> 
> 
--
Max

P.P.S. Sorry for the duplicate mail, the mailto link from lore didn’t work properly, at least this should put it in-thread.

Re: [PATCH v14 4/7] PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends

[Niklas Cassel]

On Tue, Apr 28, 2026 at 10:36:15PM +0200, Max Boone wrote:
> 
> I’m not very fond of keeping this implementation in the pci-ep-msi file,
> as the platform MSI and this implementation are both iiuc specific to
> the designware ep driver. Even more so because the MSI implementation
> is enabled by config rather than through device tree.

Why do you think that the current code with DOMAIN_BUS_PLATFORM_MSI is
designware EPC specific?

I don't see anything that is designware EPC specific.

Sure, it relies on GIC ITS, but I don't see why non-designware EPCs can't
use GIC ITS.


> 
> Wouldn’t we want end-users to specify what kind of doorbell they want,
> as it seems to be that a more specific doorbell BAR layout can be 
> programmed with eDMA, allowing native support for nvmet’s doorbell
> BAR for example.

I also wanted to use my designware based EPC for doorbells in nvmet-pci-epf,
specifically the support that Koichiro added for inbound subrange mapping.

However, most designware EPC have a strict alignment requirement
(CX_ATU_MIN_REGION_SIZE), which is often 4k.

This alignment requirement is there both on the PCI address (address within
the BAR, and for the physical memory address (target address)).

I thought that we could use the inbound subrange mapping and put the doorbells
in a separate inbound iATU, so we could remove polling in the nvmet-pci-epf
driver, just like they have done in the vNTB driver. However, it works in vNTB
because they have a register telling exactly which BAR and offset in that BAR
where the doorbells are.
In the NVMe PCIe Transport specification, the offset for the start of the
doorbells is fixed, at offset 0x1000 (4k) and the only thing you can change is
the stride between the doorbells.

Currently, a doorbell is a single 32-bit data, sure we could call
pci_epf_alloc_doorbell() with ("number of I/O queues" + 1 (admin queue)) * 2
(submission queue and completion queue).

However, the address which we get from pci_epf_alloc_doorbell() might not be
4k aligned.

We have the function pci_epf_align_inbound_addr() which can split this
non-aligned address to a 4k aligned base + offset from that base.

However, that would also require the host side driver to write to this offset
from the start address. (See e.g. doorbell_offset in pci-epf-test.c).

So, basically, with the current limitation that the doorbells must start at
0x1000, together with the fact that the doorbells returned from
pci_epf_alloc_doorbell() might have an arbitrary alignment, I don't see how
we could add support for doorbells in nvmet-pci-epf.

If we could supply an alignment requirement to pci_epf_alloc_doorbell(),
e.g. 4k, and the API is guaranteed to return an address that satisfies this
alignment requirement, then we would be good.

However, right now, we don't have such an API. We simple get an address
somewhere within the GIC ITS MMIO region.


> 
> Originally in a patchset by Frank Li the API that was proposed was more
> generic, and the pci-epc-msi implementation was chosen because there
> was only one implementation:
> - https://lore.kernel.org/imx/20231019150441.GA7254@thinkpad/
> - https://lore.kernel.org/imx/20231019172347.GC7254@thinkpad/
> 
> I’d personally prefer to see an abstraction that is weaved into pci-epc-core
> and pci-epf-core that can be implemented by drivers as they wish. While 
> still keeping the enum for different types.
> 
> That also gives room to pull a poll-mode doorbell into the pci-epc-core,
> which deduplicates that code from the nvmet and vntb epfs, and allows
> other functions to use RC->EP doorbells without needing to bother with
> writing the polling mechanism.

Sounds like a good idea.


> 
> P.S. I’ve been working on a vfio-user based epc for development purposes
> personally, and the last hurdle before I want to send it in for comments is 
> support for doorbells, and came across this patchset checking if there’s
> any other activity in the space. Having an implementation-agnostic
> doorbell API in the EPF/EPC core would be very helpful to me.

I have looked at adding doorbell support to nvmet-pci-epf, but got stuck on
pci_epf_alloc_doorbell() returning an address that is not 4k aligned.

(Since the NVMe PCIe transport specification has the doorbells at a fixed
location, we can't change that.)

But if we could provide an "alignment" parameter to pci_epf_alloc_doorbell(),
then I think it is possible.

Sure, the GIC ITS MMIO area might be quite small, so it might not be able
satisfy such a request. E.g. on rk3588, the its1 MMIO region is 0x20000 (128k):
https://github.com/torvalds/linux/blob/v7.1-rc1/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi#L2414

However, I have not idea of how much of this region the GIC driver uses for
actual registers, and how much of that region it can actually dedicate to
doorbells.


Kind regards,
Niklas

Re: [PATCH v14 4/7] PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends

[Max Boone]

> On Apr 29, 2026, at 11:33 AM, Niklas Cassel <cassel@kernel.org> wrote:
> 
> On Tue, Apr 28, 2026 at 10:36:15PM +0200, Max Boone wrote:
>> 
>> I’m not very fond of keeping this implementation in the pci-ep-msi file,
>> as the platform MSI and this implementation are both iiuc specific to
>> the designware ep driver. Even more so because the MSI implementation
>> is enabled by config rather than through device tree.
> 
> Why do you think that the current code with DOMAIN_BUS_PLATFORM_MSI is
> designware EPC specific?
> 
> I don't see anything that is designware EPC specific.
> 
> Sure, it relies on GIC ITS, but I don't see why non-designware EPCs can't
> use GIC ITS.

Good point - looking through the device trees I only saw the msi-map / platform
msi set for the imx95 and assumed designware was the only EPC supporting
this (also because the code uses that of-node specifically), but I indeed don’t see 
a reason that other chips can’t use this.

I’m a bit confused on the configuration, fwiw it’s probably me being unfamiliar
with PCIe, but it doesn’t seem right to configure the MSI and eDMA DBs through
a kconfig option rather than inferring it from the device tree and/or having the EP
driver enable the capability and expose an operation to realize it.

On the other hand, that way, we would probably end up with identical DB
implementations in mutliple drivers.

>> Wouldn’t we want end-users to specify what kind of doorbell they want,
>> as it seems to be that a more specific doorbell BAR layout can be 
>> programmed with eDMA, allowing native support for nvmet’s doorbell
>> BAR for example.
> 
> I also wanted to use my designware based EPC for doorbells in nvmet-pci-epf,
> specifically the support that Koichiro added for inbound subrange mapping.
> 
> However, most designware EPC have a strict alignment requirement
> (CX_ATU_MIN_REGION_SIZE), which is often 4k.
> 
> This alignment requirement is there both on the PCI address (address within
> the BAR, and for the physical memory address (target address)).
> 
> I thought that we could use the inbound subrange mapping and put the doorbells
> in a separate inbound iATU, so we could remove polling in the nvmet-pci-epf
> driver, just like they have done in the vNTB driver. However, it works in vNTB
> because they have a register telling exactly which BAR and offset in that BAR
> where the doorbells are.
> In the NVMe PCIe Transport specification, the offset for the start of the
> doorbells is fixed, at offset 0x1000 (4k) and the only thing you can change is
> the stride between the doorbells.
> 
> Currently, a doorbell is a single 32-bit data, sure we could call
> pci_epf_alloc_doorbell() with ("number of I/O queues" + 1 (admin queue)) * 2
> (submission queue and completion queue).
> 
> However, the address which we get from pci_epf_alloc_doorbell() might not be
> 4k aligned.
> 
> We have the function pci_epf_align_inbound_addr() which can split this
> non-aligned address to a 4k aligned base + offset from that base.
> 
> However, that would also require the host side driver to write to this offset
> from the start address. (See e.g. doorbell_offset in pci-epf-test.c).
> 
> So, basically, with the current limitation that the doorbells must start at
> 0x1000, together with the fact that the doorbells returned from
> pci_epf_alloc_doorbell() might have an arbitrary alignment, I don't see how
> we could add support for doorbells in nvmet-pci-epf.
> 
> If we could supply an alignment requirement to pci_epf_alloc_doorbell(),
> e.g. 4k, and the API is guaranteed to return an address that satisfies this
> alignment requirement, then we would be good.
> 
> However, right now, we don't have such an API. We simple get an address
> somewhere within the GIC ITS MMIO region.

Check, thanks for the write-up, this is also what I’m looking to get working,
coindicentally on the RK3588. I had imagined that it would be possible to build
a sufficient API by passing in a base offset and stride for the doorbell allocation, 
but an alignment param sounds better. Can we program the resulting doorbells
at an arbitrary offset in a BAR, or would we waste the first allocated
doorbell that’s going to be located at 0x0000 - 0x1000?

In any case, I think it would be preferable for users of the alloc_doorbell function
to pass in what kind of doorbell they want instead of using a fallback mechanism.
It seems to me that the alignment and possibly a larger amount of doorbells are
possible with the eDMA doorbell mechanism. Or am I misunderstanding eDMA
here and is that bounded by mapping / size / alignment of the GIC ITS?

>> Originally in a patchset by Frank Li the API that was proposed was more
>> generic, and the pci-epc-msi implementation was chosen because there
>> was only one implementation:
>> - https://lore.kernel.org/imx/20231019150441.GA7254@thinkpad/
>> - https://lore.kernel.org/imx/20231019172347.GC7254@thinkpad/
>> 
>> I’d personally prefer to see an abstraction that is weaved into pci-epc-core
>> and pci-epf-core that can be implemented by drivers as they wish. While 
>> still keeping the enum for different types.
>> 
>> That also gives room to pull a poll-mode doorbell into the pci-epc-core,
>> which deduplicates that code from the nvmet and vntb epfs, and allows
>> other functions to use RC->EP doorbells without needing to bother with
>> writing the polling mechanism.
> 
> Sounds like a good idea.

I’ll refactor my local branch and include this patchset and send it in with RFC,
will probably not work on this for another couple days though.

>> P.S. I’ve been working on a vfio-user based epc for development purposes
>> personally, and the last hurdle before I want to send it in for comments is 
>> support for doorbells, and came across this patchset checking if there’s
>> any other activity in the space. Having an implementation-agnostic
>> doorbell API in the EPF/EPC core would be very helpful to me.
> 
> I have looked at adding doorbell support to nvmet-pci-epf, but got stuck on
> pci_epf_alloc_doorbell() returning an address that is not 4k aligned.
> 
> (Since the NVMe PCIe transport specification has the doorbells at a fixed
> location, we can't change that.)
> 
> But if we could provide an "alignment" parameter to pci_epf_alloc_doorbell(),
> then I think it is possible.
> 
> Sure, the GIC ITS MMIO area might be quite small, so it might not be able
> satisfy such a request. E.g. on rk3588, the its1 MMIO region is 0x20000 (128k):
> https://github.com/torvalds/linux/blob/v7.1-rc1/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi#L2414

Hrm, I think I’m misunderstanding the eDMA mechanism that is proposed in this
patch. Is the fixed eDMA register block (e.g. BAR4 for the RK3588) translated to
a space in the GIC ITS MMIO area - or is restriction specifically on adding alignment
to the platform MSI doorbell implementation?

> However, I have not idea of how much of this region the GIC driver uses for
> actual registers, and how much of that region it can actually dedicate to
> doorbells.
> 
> 
> Kind regards,
> Niklas

Re: [PATCH v14 4/7] PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends

[Niklas Cassel]

On Wed, Apr 29, 2026 at 01:11:12PM +0200, Max Boone wrote:
> Good point - looking through the device trees I only saw the msi-map / platform
> msi set for the imx95 and assumed designware was the only EPC supporting
> this (also because the code uses that of-node specifically), but I indeed don’t see 
> a reason that other chips can’t use this.
> 
> I’m a bit confused on the configuration, fwiw it’s probably me being unfamiliar
> with PCIe, but it doesn’t seem right to configure the MSI and eDMA DBs through
> a kconfig option rather than inferring it from the device tree and/or having the EP
> driver enable the capability and expose an operation to realize it.

I don't see anything that is configured using Kconfig options.

But in order to enable PCIe EP doorbell support in the vmlinux binary
you need to build with CONFIG_PCI_ENDPOINT_MSI_DOORBELL=y.



To make use of the GIC-ITS MSI support, you need to define msi-map defined in
device tree. I did send such a patch for rk3588:
https://lore.kernel.org/linux-rockchip/20250908162400.535441-2-cassel@kernel.org/

But, AFAICT, considering that the rk3588 does not have any way to map RID to
a predictable SID (which is possible on e.g. imx95), I don't think it is wise
to add msi-map to rk3588.

It is similar to the problem why we can't run with the IOMMU enabled when
running the PCIe controller in endpoint mode.

For more info see:
https://lore.kernel.org/all/20250207143900.2047949-2-cassel@kernel.org/

Basically, the problem is that the host assigns a BDF to each Root Complex
on the host side, and then assigns a BDF to each Endpoint it finds connected
to that Root Complex.

Thus the PCI Endpoint controller will have no idea which BDF the Root Complex
will have.

The Requester ID will be that matching the BDF of the Root Complex.

But the problem is that the Endpoint side cannot insert a mapping for this
Requester ID, because it does not know which Requester ID the RC will have.

I guess it could theoretically insert all possible Requester IDs in the IOMMU,
but that is not going to fly according to Robin (ARM SMMU maintainer):

"Yeah, that one pretty much settles it - we can certainly expect host
root ports with nonzero device numbers, so that's at least 13 bits of
the StreamID space to cover, which isn't going to fly."


Note that there are some PCI endpoint controllers that can run with the IOMMU
enabled, by using a look up table and sideband signals, see e.g. imx6:

commit ce4c4301728541db7e5f571a5688a3a236d9e488
Author: Frank Li <Frank.Li@nxp.com>
Date:   Tue Jan 14 15:37:09 2025 -0500

    PCI: imx6: Add IOMMU and ITS MSI support for i.MX95



I'm not sure if it is possible to configure a LUT on the RK3588 as well,
in order to keep the IOMMU enabled also in Endpoint mode. If it is, then
it wasn't clear from the RK3588 TRM.

(Having the IOMMU enabled when running in Root Complex mode is no problem,
as the Linux driver core automatically will add/insert a (single) Stream ID
matching the BDF it assigns to each Endpoint.)


> Check, thanks for the write-up, this is also what I’m looking to get working,
> coindicentally on the RK3588. I had imagined that it would be possible to build
> a sufficient API by passing in a base offset and stride for the doorbell allocation, 
> but an alignment param sounds better. Can we program the resulting doorbells
> at an arbitrary offset in a BAR, or would we waste the first allocated
> doorbell that’s going to be located at 0x0000 - 0x1000?

I'm not sure if I follow.

If you use subrange inbound mapping, you split the BAR (BAR0) into two.

The first range, 0x0-0xfff would use one inbound iATU and would have inbound
address translation that points to allocated memory by nvmet-pci-epf.
This is the regular nvme registers in range 0x0-0xfff.

The second range 0x1000-XXXX (depends on how many I/O queues the nvmet-pci-epf
allocates) would point to a physical address that is used for doorbells
(the address returned by pci_epf_alloc_doorbell()). This would use another
inbound iATU.

Since there are no NVMe registers after the doorbells, we don't need a third
inbound iATU.


I think we can use stride == 0.

Another possible way would be to use stride == CX_ATU_MIN_REGION_SIZE, and then
use one iATU per doorbell, but considering that most DWC EPCs have a very
limited amount of inbound iATUs (rk3588 has 16 inbound iATUs, but some SoCs have
much fewer), I'm not sure if this approach is the best idea. One iATU per I/O
submission queue, and one iATU per I/O completion queue, then one iATU for Admin
submission queue, and one iATU for admin completion queue... I'm not sure if
this is a good approach. Stride == 0 and one iATU seems better.

(I don't really see any advantage of using one iATU per doorbell. We will still
have the problem that each address returned by pci_epf_alloc_doorbell() needs to
be aligned to CX_ATU_MIN_REGION_SIZE anyway.)


> In any case, I think it would be preferable for users of the alloc_doorbell function
> to pass in what kind of doorbell they want instead of using a fallback mechanism.
> It seems to me that the alignment and possibly a larger amount of doorbells are
> possible with the eDMA doorbell mechanism. Or am I misunderstanding eDMA
> here and is that bounded by mapping / size / alignment of the GIC ITS?

The GIC-ITS MSI way will return a physical address by pci_epf_alloc_doorbell().
(This option does not really seem feasible on rk3588.)

The alternative is to use the DWC eDMA hardware itself to emulate doorbells.

For the DWC eDMA option, there are two ways:
a) The PCIe EPC controller was synthesized to expose the eDMA registers in a
   BAR at a fixed offset.
b) The PCIe EPC controller was not synthesized to expose the eDMA registers in
   a BAR at a fixed offset.

For case a), we will get a physical address that is within the DWC eDMA MMIO
space. Here we will need to call pci_epf_alloc_doorbell() can set up an iATU
for inbound translation to the DWC eDMA MMIO address.

For case b), at least when I was testing, setting up an inbound iATU that
translates a region in e.g. BAR0 to the DWC eDMA MMIO addresses did NOT work.
Feel free to try this yourself. I don't fully understand why this does not work.

My theory is that when the DWC EPC was configured with the eDMA registers
exposed in a fixed location, e.g. in BAR4 on rk3588, the hardware has some
internal fixed translation for BAR4 to the eDMA MMIO addresses, and because of
that, setting up an inbound iATU which also translates inbound PCI TLPs, from
another BAR, e.g. BAR0 to the same DWC eDMA MMIO addresses, does not work.
Again, please feel free to try yourself, perhaps I missed something.

Thus, for pci-epf-test, we simply fill in DB_BAR and DB_OFFSET with the
BAR + offset in that BAR where the eDMA regs are exposed, rather than using
an inbound iATU to translate the inbound PCI TLPs to the DWC eDMA MMIO
addresses.


Regardless, for the DWC eDMA case, I'm not sure if it is possible to support an
"align" parameter to pci_epf_alloc_doorbell(), because I think it will always
return a single address (a specific address inside the DWC eDMA that can be used
to emulate doorbells). For GIC-ITS, I think pci_epf_alloc_doorbell() might
return different addresses, for each time it is called.
Koichiro, please correct me if I am wrong.

So, my suggestion to add an "align" parameter to pci_epf_alloc_doorbell() will
probably only work for the GIC-ITS case, unfortunately.


> Hrm, I think I’m misunderstanding the eDMA mechanism that is proposed in this
> patch. Is the fixed eDMA register block (e.g. BAR4 for the RK3588) translated to
> a space in the GIC ITS MMIO area - or is restriction specifically on adding alignment
> to the platform MSI doorbell implementation?

The iATU alignment requirement, that the base and target address must be aligned
to CX_ATU_MIN_REGION_SIZE is always there when using an iATU.

So for "GIC-ITS + iATU" or "DWC eDMA + iATU".

The difference is with e.g. rk3588, pci-epf-test does not use an inbound iATU
mapping to read/access the DWC eDMA regs (using the DWC eDMA MMIO address).
We simply fill in the DB_BAR and DB_OFFSET to point the BAR which has the eDMA
registers exposed by default. So we read the eDMA regs from the "fixed resource
BAR" (BAR4), rather than setting up an iATU mapping in e.g. BAR0, which translates
to the eDMA MMIO address.

(And because NVMe has the doorbells in a fixed location, as long as we can't set
up an inbound iATU that points to the eDMA MMIO regs, I don't see how we will
get nvmet-pci-epf to work with doorbells on rk3588).


Kind regards,
Niklas

Re: [PATCH v14 4/7] PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends

[Koichiro Den]

On Wed, Apr 29, 2026 at 11:33:13AM +0200, Niklas Cassel wrote:
> On Tue, Apr 28, 2026 at 10:36:15PM +0200, Max Boone wrote:
> > 
> > I’m not very fond of keeping this implementation in the pci-ep-msi file,
> > as the platform MSI and this implementation are both iiuc specific to
> > the designware ep driver. Even more so because the MSI implementation
> > is enabled by config rather than through device tree.
> 
> Why do you think that the current code with DOMAIN_BUS_PLATFORM_MSI is
> designware EPC specific?
> 
> I don't see anything that is designware EPC specific.
> 
> Sure, it relies on GIC ITS, but I don't see why non-designware EPCs can't
> use GIC ITS.
> 
> 
> > 
> > Wouldn’t we want end-users to specify what kind of doorbell they want,
> > as it seems to be that a more specific doorbell BAR layout can be 
> > programmed with eDMA, allowing native support for nvmet’s doorbell
> > BAR for example.
> 
> I also wanted to use my designware based EPC for doorbells in nvmet-pci-epf,
> specifically the support that Koichiro added for inbound subrange mapping.
> 
> However, most designware EPC have a strict alignment requirement
> (CX_ATU_MIN_REGION_SIZE), which is often 4k.
> 
> This alignment requirement is there both on the PCI address (address within
> the BAR, and for the physical memory address (target address)).
> 
> I thought that we could use the inbound subrange mapping and put the doorbells
> in a separate inbound iATU, so we could remove polling in the nvmet-pci-epf
> driver, just like they have done in the vNTB driver. However, it works in vNTB
> because they have a register telling exactly which BAR and offset in that BAR
> where the doorbells are.
> In the NVMe PCIe Transport specification, the offset for the start of the
> doorbells is fixed, at offset 0x1000 (4k) and the only thing you can change is
> the stride between the doorbells.
> 
> Currently, a doorbell is a single 32-bit data, sure we could call
> pci_epf_alloc_doorbell() with ("number of I/O queues" + 1 (admin queue)) * 2
> (submission queue and completion queue).
> 
> However, the address which we get from pci_epf_alloc_doorbell() might not be
> 4k aligned.
> 
> We have the function pci_epf_align_inbound_addr() which can split this
> non-aligned address to a 4k aligned base + offset from that base.
> 
> However, that would also require the host side driver to write to this offset
> from the start address. (See e.g. doorbell_offset in pci-epf-test.c).
> 
> So, basically, with the current limitation that the doorbells must start at
> 0x1000, together with the fact that the doorbells returned from
> pci_epf_alloc_doorbell() might have an arbitrary alignment, I don't see how
> we could add support for doorbells in nvmet-pci-epf.
> 
> If we could supply an alignment requirement to pci_epf_alloc_doorbell(),
> e.g. 4k, and the API is guaranteed to return an address that satisfies this
> alignment requirement, then we would be good.
> 
> However, right now, we don't have such an API. We simple get an address
> somewhere within the GIC ITS MMIO region.
> 
> 
> > 
> > Originally in a patchset by Frank Li the API that was proposed was more
> > generic, and the pci-epc-msi implementation was chosen because there
> > was only one implementation:
> > - https://lore.kernel.org/imx/20231019150441.GA7254@thinkpad/
> > - https://lore.kernel.org/imx/20231019172347.GC7254@thinkpad/
> > 
> > I’d personally prefer to see an abstraction that is weaved into pci-epc-core
> > and pci-epf-core that can be implemented by drivers as they wish. While 
> > still keeping the enum for different types.
> > 
> > That also gives room to pull a poll-mode doorbell into the pci-epc-core,
> > which deduplicates that code from the nvmet and vntb epfs, and allows
> > other functions to use RC->EP doorbells without needing to bother with
> > writing the polling mechanism.
> 
> Sounds like a good idea.

Hi Max, Niklas,

First of all, sorry for the late reply. I was away from late April, then caught
pneumonia and was out sick for a while...

- Regarding the common poll-mode doorbell:

  I agree that it would be useful. I don't have a detailed implementation in
  mind yet, but I can imagine it as the last-resort backend for
  pci_epf_alloc_doorbell(), used when no interrupt-capable backend can be
  allocated.

  In that design, I don't think this necessarily depends on making the backend
  type selectable by the caller. If I misunderstood what Max meant by "That also
  gives room to pull...", please let me know.

- Regarding the enum and explicit backend type selection:

  Earlier revisions (~v4) were somewhat closer to that model, before v5 moved
  the fallback selection behind pci_epf_alloc_doorbell():

  https://lore.kernel.org/linux-pci/avey4i3lwcqt4wsy3y2wjlx7ixo7sqe64hngj2ne6vubl4mjzv@kaksbjkspifd/

  For the current vntb/test users, I tried to keep the backend selection
  transparent to the EPF. If the MSI-backed path is available and working,
  explicitly asking for the embedded /eDMA fallback does not seem very useful.
  That's why the path is tried only as a fallback.

  That said, I'm not opposed to extending the API. For future users, it might
  make sense to let callers express additional requirements or preferences.

  Since this series has already been applied, I think this can be handled as
  follow-up improvement work.

Thank you both for the detailed and constructive discussion.

Best regards,
Koichiro

> 
> 
> > 
> > P.S. I’ve been working on a vfio-user based epc for development purposes
> > personally, and the last hurdle before I want to send it in for comments is 
> > support for doorbells, and came across this patchset checking if there’s
> > any other activity in the space. Having an implementation-agnostic
> > doorbell API in the EPF/EPC core would be very helpful to me.
> 
> I have looked at adding doorbell support to nvmet-pci-epf, but got stuck on
> pci_epf_alloc_doorbell() returning an address that is not 4k aligned.
> 
> (Since the NVMe PCIe transport specification has the doorbells at a fixed
> location, we can't change that.)
> 
> But if we could provide an "alignment" parameter to pci_epf_alloc_doorbell(),
> then I think it is possible.
> 
> Sure, the GIC ITS MMIO area might be quite small, so it might not be able
> satisfy such a request. E.g. on rk3588, the its1 MMIO region is 0x20000 (128k):
> https://github.com/torvalds/linux/blob/v7.1-rc1/arch/arm64/boot/dts/rockchip/rk3588-base.dtsi#L2414
> 
> However, I have not idea of how much of this region the GIC driver uses for
> actual registers, and how much of that region it can actually dedicate to
> doorbells.
> 
> 
> Kind regards,
> Niklas

Re: [PATCH v14 4/7] PCI: endpoint: pci-ep-msi: Refactor doorbell allocation for new backends

[Koichiro Den]

On Wed, Apr 29, 2026 at 04:52:13PM +0200, Niklas Cassel wrote:
> On Wed, Apr 29, 2026 at 01:11:12PM +0200, Max Boone wrote:
> > Good point - looking through the device trees I only saw the msi-map / platform
> > msi set for the imx95 and assumed designware was the only EPC supporting
> > this (also because the code uses that of-node specifically), but I indeed don’t see 
> > a reason that other chips can’t use this.
> > 
> > I’m a bit confused on the configuration, fwiw it’s probably me being unfamiliar
> > with PCIe, but it doesn’t seem right to configure the MSI and eDMA DBs through
> > a kconfig option rather than inferring it from the device tree and/or having the EP
> > driver enable the capability and expose an operation to realize it.
> 
> I don't see anything that is configured using Kconfig options.
> 
> But in order to enable PCIe EP doorbell support in the vmlinux binary
> you need to build with CONFIG_PCI_ENDPOINT_MSI_DOORBELL=y.
> 
> 
> 
> To make use of the GIC-ITS MSI support, you need to define msi-map defined in
> device tree. I did send such a patch for rk3588:
> https://lore.kernel.org/linux-rockchip/20250908162400.535441-2-cassel@kernel.org/
> 
> But, AFAICT, considering that the rk3588 does not have any way to map RID to
> a predictable SID (which is possible on e.g. imx95), I don't think it is wise
> to add msi-map to rk3588.
> 
> It is similar to the problem why we can't run with the IOMMU enabled when
> running the PCIe controller in endpoint mode.
> 
> For more info see:
> https://lore.kernel.org/all/20250207143900.2047949-2-cassel@kernel.org/
> 
> Basically, the problem is that the host assigns a BDF to each Root Complex
> on the host side, and then assigns a BDF to each Endpoint it finds connected
> to that Root Complex.
> 
> Thus the PCI Endpoint controller will have no idea which BDF the Root Complex
> will have.
> 
> The Requester ID will be that matching the BDF of the Root Complex.
> 
> But the problem is that the Endpoint side cannot insert a mapping for this
> Requester ID, because it does not know which Requester ID the RC will have.
> 
> I guess it could theoretically insert all possible Requester IDs in the IOMMU,
> but that is not going to fly according to Robin (ARM SMMU maintainer):
> 
> "Yeah, that one pretty much settles it - we can certainly expect host
> root ports with nonzero device numbers, so that's at least 13 bits of
> the StreamID space to cover, which isn't going to fly."
> 
> 
> Note that there are some PCI endpoint controllers that can run with the IOMMU
> enabled, by using a look up table and sideband signals, see e.g. imx6:
> 
> commit ce4c4301728541db7e5f571a5688a3a236d9e488
> Author: Frank Li <Frank.Li@nxp.com>
> Date:   Tue Jan 14 15:37:09 2025 -0500
> 
>     PCI: imx6: Add IOMMU and ITS MSI support for i.MX95
> 
> 
> 
> I'm not sure if it is possible to configure a LUT on the RK3588 as well,
> in order to keep the IOMMU enabled also in Endpoint mode. If it is, then
> it wasn't clear from the RK3588 TRM.
> 
> (Having the IOMMU enabled when running in Root Complex mode is no problem,
> as the Linux driver core automatically will add/insert a (single) Stream ID
> matching the BDF it assigns to each Endpoint.)
> 
> 
> > Check, thanks for the write-up, this is also what I’m looking to get working,
> > coindicentally on the RK3588. I had imagined that it would be possible to build
> > a sufficient API by passing in a base offset and stride for the doorbell allocation, 
> > but an alignment param sounds better. Can we program the resulting doorbells
> > at an arbitrary offset in a BAR, or would we waste the first allocated
> > doorbell that’s going to be located at 0x0000 - 0x1000?
> 
> I'm not sure if I follow.
> 
> If you use subrange inbound mapping, you split the BAR (BAR0) into two.
> 
> The first range, 0x0-0xfff would use one inbound iATU and would have inbound
> address translation that points to allocated memory by nvmet-pci-epf.
> This is the regular nvme registers in range 0x0-0xfff.
> 
> The second range 0x1000-XXXX (depends on how many I/O queues the nvmet-pci-epf
> allocates) would point to a physical address that is used for doorbells
> (the address returned by pci_epf_alloc_doorbell()). This would use another
> inbound iATU.
> 
> Since there are no NVMe registers after the doorbells, we don't need a third
> inbound iATU.
> 
> 
> I think we can use stride == 0.
> 
> Another possible way would be to use stride == CX_ATU_MIN_REGION_SIZE, and then
> use one iATU per doorbell, but considering that most DWC EPCs have a very
> limited amount of inbound iATUs (rk3588 has 16 inbound iATUs, but some SoCs have
> much fewer), I'm not sure if this approach is the best idea. One iATU per I/O
> submission queue, and one iATU per I/O completion queue, then one iATU for Admin
> submission queue, and one iATU for admin completion queue... I'm not sure if
> this is a good approach. Stride == 0 and one iATU seems better.
> 
> (I don't really see any advantage of using one iATU per doorbell. We will still
> have the problem that each address returned by pci_epf_alloc_doorbell() needs to
> be aligned to CX_ATU_MIN_REGION_SIZE anyway.)
> 
> 
> > In any case, I think it would be preferable for users of the alloc_doorbell function
> > to pass in what kind of doorbell they want instead of using a fallback mechanism.
> > It seems to me that the alignment and possibly a larger amount of doorbells are
> > possible with the eDMA doorbell mechanism. Or am I misunderstanding eDMA
> > here and is that bounded by mapping / size / alignment of the GIC ITS?

Hi Niklas, Max,

If the normal GIC/ITS-based doorbell is usable, I do not see any advantage in
selecting the embedded/eDMA backend explicitly. That is why the embedded backend
is not exposed as a selectable backend and is tried only as a hidden fallback
since v5, after the v4 discussion:
https://lore.kernel.org/linux-pci/avey4i3lwcqt4wsy3y2wjlx7ixo7sqe64hngj2ne6vubl4mjzv@kaksbjkspifd/

The current DWC eDMA interrupt-emulation backend does not provide multiple
independent doorbells. The aux-resource currently exposes one MMIO doorbell
target, one write value and one Linux IRQ. If the caller requests multiple
doorbells, pci_epf_alloc_doorbell() just replicates the same address/data/IRQ,
and consumers have to treat them as shared "kick" doorbells.

Note that the per-channel status fields in DMA_{WRITE,READ}_INT_STATUS_OFF do
not provide a separate doorbell vector slot either. They are real DMA interrupt
status bits. The interrupt-emulation feature only relies on the fact that a
write to the INT_STATUS register address triggeres a local interrupt, while it
does not set the Done/Abort status bits for that emulated interrupt. Therefore,
the write data is not usable to distinguish doorbell vectors.

So, from the vector-granularity point of view, the embedded/eDMA fallback is not
better than the GIC ITS path at all. Actually, it is more limited: the GIC ITS
path distinguishes vectors by MSI data, while the current embedded/eDMA backend
does not expose per-vector distinguishable address/data pairs.

Also, address-wise, both the GIC ITS-backed backend and the eDMA interrupt
emulation backend are effectively single-target-address backends. Therefore I do
not think the eDMA fallback has a generic advantage for alignment requirements
either.

> 
> The GIC-ITS MSI way will return a physical address by pci_epf_alloc_doorbell().
> (This option does not really seem feasible on rk3588.)
> 
> The alternative is to use the DWC eDMA hardware itself to emulate doorbells.
> 
> For the DWC eDMA option, there are two ways:
> a) The PCIe EPC controller was synthesized to expose the eDMA registers in a
>    BAR at a fixed offset.
> b) The PCIe EPC controller was not synthesized to expose the eDMA registers in
>    a BAR at a fixed offset.
> 
> For case a), we will get a physical address that is within the DWC eDMA MMIO
> space. Here we will need to call pci_epf_alloc_doorbell() can set up an iATU
> for inbound translation to the DWC eDMA MMIO address.

Just a minor clarification: for case a), pci_epf_alloc_doorbell() still returns
the doorbell info, but the EPF does not need to program another IB iATU for the
doorbell. It can just reuse the pre-exposed BAR/offset.

> 
> For case b), at least when I was testing, setting up an inbound iATU that
> translates a region in e.g. BAR0 to the DWC eDMA MMIO addresses did NOT work.
> Feel free to try this yourself. I don't fully understand why this does not work.
> 
> My theory is that when the DWC EPC was configured with the eDMA registers
> exposed in a fixed location, e.g. in BAR4 on rk3588, the hardware has some
> internal fixed translation for BAR4 to the eDMA MMIO addresses, and because of
> that, setting up an inbound iATU which also translates inbound PCI TLPs, from
> another BAR, e.g. BAR0 to the same DWC eDMA MMIO addresses, does not work.
> Again, please feel free to try yourself, perhaps I missed something.

IIRC, on RK3588, adding an IB iATU region that maps the eDMA register block to
e.g. BAR0 seemed to break the original fixed BAR4 mapping too (i.e. the host
side no longer be able to use the register block properly even via BAR4). That
looked to me the most difficult issue, and I still have no clue why so.

On Renesas R-Car S4, where no fixed mapping seemed to be present [1], I confirmed
that we can expose the eDMA register block at a BAR/offset chosen by the EPF,
within the usual IB iATU granularity/region constraints, by manually programming
an IB iATU.

[1]: while RK3588 looks as if it has something like:
  ENABLE_MEM_MAP_UNROLL_DMA_REG = 1
  MEM_FUNC0_BAR4_TARGET_MAP = TRGT0
  UNROLL_BAR_NUM  = 4
  UNROLL_DMA_OFFSET_BAR = 0x0000
  UNROLL_ATU_OFFSET_BAR = 0x2000
R-Car S4 does not seem to have such an arrangement.

> 
> Thus, for pci-epf-test, we simply fill in DB_BAR and DB_OFFSET with the
> BAR + offset in that BAR where the eDMA regs are exposed, rather than using
> an inbound iATU to translate the inbound PCI TLPs to the DWC eDMA MMIO
> addresses.
> 
> 
> Regardless, for the DWC eDMA case, I'm not sure if it is possible to support an
> "align" parameter to pci_epf_alloc_doorbell(), because I think it will always
> return a single address (a specific address inside the DWC eDMA that can be used
> to emulate doorbells). For GIC-ITS, I think pci_epf_alloc_doorbell() might
> return different addresses, for each time it is called.
> Koichiro, please correct me if I am wrong.

AFAIK, GIC ITS does not allocate different target addresses for each vector.
The MSI target address is the GITS_TRANSLATER address, or an IOVA for it, and
different vectors are distinguished by the MSI data rather than by different
target addresses.

So address-wise, the current GIC ITS backend and the current embedded/eDMA
backend are not very different: neither backend allocates a fresh arbitrary
target address for each vector. The difference is that the GIC ITS backend has
per-vector MSI data, while the current embedded/eDMA backend exposes only one
address/data/IRQ tuple.

I also think the alignment requirement is somewhat orthogonal to whether the
backend address is single or fixed. I am not sure that adding only an "align"
parameter to pci_epf_alloc_doorbell() would be very useful. With the current
API, how the returned doorbell is exposed in a BAR, including any IB iATU
subrange mapping, is up to the caller, and the caller can already look at
pci_epc_features::align when setting up that mapping.

For future users with some fixed layout requirements, I agree it may be more
useful to let the caller express the required BAR offset/window or other layout
constraints, so that only the backend that satisfies the constraint is chosen
and allocated.

Best regards,
Koichiro

> 
> So, my suggestion to add an "align" parameter to pci_epf_alloc_doorbell() will
> probably only work for the GIC-ITS case, unfortunately.
> 
> 
> > Hrm, I think I’m misunderstanding the eDMA mechanism that is proposed in this
> > patch. Is the fixed eDMA register block (e.g. BAR4 for the RK3588) translated to
> > a space in the GIC ITS MMIO area - or is restriction specifically on adding alignment
> > to the platform MSI doorbell implementation?
> 
> The iATU alignment requirement, that the base and target address must be aligned
> to CX_ATU_MIN_REGION_SIZE is always there when using an iATU.
> 
> So for "GIC-ITS + iATU" or "DWC eDMA + iATU".
> 
> The difference is with e.g. rk3588, pci-epf-test does not use an inbound iATU
> mapping to read/access the DWC eDMA regs (using the DWC eDMA MMIO address).
> We simply fill in the DB_BAR and DB_OFFSET to point the BAR which has the eDMA
> registers exposed by default. So we read the eDMA regs from the "fixed resource
> BAR" (BAR4), rather than setting up an iATU mapping in e.g. BAR0, which translates
> to the eDMA MMIO address.
> 
> (And because NVMe has the doorbells in a fixed location, as long as we can't set
> up an inbound iATU that points to the eDMA MMIO regs, I don't see how we will
> get nvmet-pci-epf to work with doorbells on rk3588).
> 
> 
> Kind regards,
> Niklas