From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f182.google.com (mail-qk1-f182.google.com [209.85.222.182]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6E9613A8744 for ; Sat, 9 May 2026 17:00:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.182 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778346055; cv=none; b=VVVgupJnPQlWj7Im2M+z5broj5WVvqq4rin+11EHZuRprzenNlvl4QjO1vADvbnZUiikXGUN2CEyZDbBBAjPFgBpoHv+f03nyLB3Fb18yxXw5DNIsWyMu8sdDJ3OV7S3uflRx0tdtYgxyDY5UUH5bRLFBeUP9hSfgfEnsr/ORCs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778346055; c=relaxed/simple; bh=WPZ0FMMKphUFt/o8yexGkUjGZtyGZuEFdu0coALbpL8=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=k/ur+YRZj0DwKGsdNDIJLcJGQUdK9eqIJkO3/NkFoc8cNOU+JImtjDL21l5oanBbzoBa2B5jPSt4zn+Esv8zJAgZwZ9qcY8pPUYtNH1JTrqcxdypebjKhgAmonxXtO5z0uSOa2EEntJQVfVvdm7atnABrxEohPc4XpaPo7lcOHk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca; spf=pass smtp.mailfrom=ziepe.ca; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b=nNpDm2lX; arc=none smtp.client-ip=209.85.222.182 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=ziepe.ca Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="nNpDm2lX" Received: by mail-qk1-f182.google.com with SMTP id af79cd13be357-8c70b5594f4so340657185a.1 for ; Sat, 09 May 2026 10:00:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; t=1778346053; x=1778950853; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=IRop8m7XaImUSxbpG/XbxbRCDh4G22WGRyOV4N0sJrU=; b=nNpDm2lXPIa8DFWDRjTTyRhyFbkzXsYSR4CYkJhQ3fMweFNWba9fJIa/D3HyVCcQhN 1QUGWcH+Yi5HoFnf/wMKssc0SEKpJa047FUXxPryQ8IRIxkvQ1EDC/JnuTKIV6r3ZkFi xuEnNpt0/vEfm7bxmksvLnCbcRyFWt0ozqHBwdBqEAFWtmfnT+8pgFBiPRUlsEa2OrNv IaoyHCn/ox+B6L/X8Aw0xtkaxmXo6Dtsr27WTx7AAvdx9bx+W898+yt+fxpta9FEstQK sYlHa73+E0j8MIkGByd5OA8/EUSRVdz1QeGEHetIGcaD9gAQU5cwDDbZ1IwQ4J7vB7zF Zh5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1778346053; x=1778950853; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=IRop8m7XaImUSxbpG/XbxbRCDh4G22WGRyOV4N0sJrU=; b=fxbYYV1d7e3cwWnhu6ttMXoG6uqmnvXsXqbmh/+2MxxDjQ97fiJHFye6PfzCAgKVnx Z+X7Xq60sGcenhkBoeJdclVvmZzdMYTJtQU/ImamYphR+FP9o1GgWsdJwkTDpdvRkOni X1ov6BTJF2/Cqq69dzN04cWrnt+7u0wy3O2DqDJVLsur3coA1WldaJlVA6xanBResik9 jPlAMTxH2FUWlCc5eru6nWES1L/AauZpyKkLOrYZy5LY9OOhfUGhEcbfEUN6Z5BC9ior gIlm3H11hQnTjxHDf3XiKJCj+E9x7CyoWxVP6L9+bEA3p+FvfAqCggj770GRygcuARzI LxUw== X-Forwarded-Encrypted: i=1; AFNElJ8m0XZVNJoALc07opCU4EXyT6Kjtt6aBQB+MpAtti9Lbvn5ieijX6dukbuu83V1ozsVFe4tcYQtXmWD+34=@vger.kernel.org X-Gm-Message-State: AOJu0Yw+J249cVWXznE1FQgaoqbviQ2UQVx+WbGrhyLhRn5XyUR7oZAb FztR9I0/QrFbA+9JujukkiQPsDNdyhcBvmBPJWHIDNauOzYYe8CUA3QQRqGnw7tsgabmC7jTx5T ijGrhAMs= X-Gm-Gg: Acq92OH6saTPLeSHgUfw6trYnHD6SuHK9Vci9vjquEI6qrq4eeg7wCnWlbBCVrDtPBN 45LW9iKLnwcWdmxn1Ufsx2LLHmzf/UiETRKVfif6EI9aSz1meVvWgjKCQqkItbpLLmz9QMsdylG Iw+/z5PJQXv52fXhscQmg6zDtLgm8JfOz9fqP8T8RIkY7eult3v++QB1X7nSDagK3wxTANnb4rN QKTQQNlWt6f0Gcmv6KcBTKvBWREtCBG0HuVfWANg/AVhzQq8Pv8z2B9uCNr8759wiWA/A5pMxnc IWivPkg3lzKBirMf1s/Y9j17pyhFSbG3jV420k6nMAeqiydY4Kvf5wG0zGNF1yQHuk3XUqhg5E5 Gv5mEqvIPM3LzqsVwyctk2P1Y7+/VZiECsoPaALiuOWVobyx/Z/j6FK9ze7jtdzYeaF2jNx+PT5 5AMTq55vv1RwLJCw4u6MHHSxXVQh0zxQxCUPfNRHwc2n+YxrGcf0Huo67gE5plzQb54rdjNN3k+ Tb4jw== X-Received: by 2002:a05:620a:45a6:b0:8d6:6db0:88de with SMTP id af79cd13be357-90653728e7emr1667325985a.44.1778346053103; Sat, 09 May 2026 10:00:53 -0700 (PDT) Received: from ziepe.ca (crbknf0213w-47-54-130-67.pppoe-dynamic.high-speed.nl.bellaliant.net. [47.54.130.67]) by smtp.gmail.com with ESMTPSA id af79cd13be357-8fc2c91c807sm2841885185a.32.2026.05.09.10.00.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 09 May 2026 10:00:52 -0700 (PDT) Received: from jgg by wakko with local (Exim 4.97) (envelope-from ) id 1wLl2p-00000001ptR-0bDu; Sat, 09 May 2026 14:00:51 -0300 Date: Sat, 9 May 2026 14:00:51 -0300 From: Jason Gunthorpe To: "Tian, Kevin" Cc: Teddy Astie , "iommu@lists.linux.dev" , "linux-kernel@vger.kernel.org" , Xen-devel Subject: Re: How to express "externally managed" IOMMU domains for VFIO/IOMMUFD ? Message-ID: <20260509170051.GD9285@ziepe.ca> References: <1776873531.8631fc262581453bbf619ec5b2062170.19db5ea67ab000f373@vates.tech> <20260426133027.GB3501894@ziepe.ca> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Thu, May 07, 2026 at 08:02:40AM +0000, Tian, Kevin wrote: > > From: Jason Gunthorpe > > Sent: Sunday, April 26, 2026 9:30 PM > > > > On Thu, Apr 23, 2026 at 08:01:50AM +0000, Tian, Kevin wrote: > > > > On Xen, we have a dedicated hypercalls for moving a device into another > > > > guest (so it no longer belongs in Dom0, at far as DMA is concerned). > > > > > > > > But it looks like there are no way to describe that idea of "attach that > > > > device to this VM" nor "the device is in a VM"; which makes that > > > > impracticable. > > > > > > > > There may be things that could be done with the vIOMMU objects, but > > > > there would be no "parent domain" in such case, as said earlier it > > > > doesn't exist in the IOMMU subsystem. > > > > > > > > What is expected to be done instead ? > > > > > > > > Teddy > > > > > > > > [1] https://www.youtube.com/watch?v=pLMGRgEJ-Eg > > > > > > > > > > It'd be much easier to collect comments if you can put plain words > > > to explain the problem rather than expecting other folks to watch > > > the video first... > > > > It sounds like CC and pkvm to me so I think it should re-use those > > mechanisms.. > > > > for CC and pkvm the guest memory is still allocated from host. >From an iommu perspective that doesn't entirely matter, what it sees is that the translation is controlled by some secure world and it only needs a way to associate the kvm handle for the secure world with any required call for configuring the viommu. It is not very different from KVM installing encrypted pages that have been completed unmapped from all page tables in the hypervisor into the VM's secure EPT through TDX calls and then iommufd creating a viommu that re-uses the secure EPT. The only thing dealing with the memory map is KVM. I'd expect Xen to work the same, however the invisible memory was affiliated with the VM through KVM the iommu side should pick up the KVM and then request a VIOMMU to be setup for the VFIO device on the target KVM and that should trigger the hypercalls to move the device into the selected guest. Jason