[PATCH v4 08/10] iommu/arm-smmu-v3: Allocate INV_TYPE_S2_VMID_VSMMU in arm_vsmmu_init

Nicolin Chen
2026-03-19T19:52:45Z

VMID owned by a vSMMU should be allocated in the viommu_init callback for
- a straightforward lifecycle for a VMID used by a vSMMU
- HW like tegra241-cmdqv needs to setup VINTF with the VMID

Allocate/free a VMID in arm_vsmmu_init/destroy(). This decouples the VMID
owned by vSMMU from the VMID living in the S2 parent domain (s2_cfg.vmid).

Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h | 1 +
.../arm/arm-smmu-v3/arm-smmu-v3-iommufd.c | 26 ++++++++++++++++---
.../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 1 +
3 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
index c722df9b21982..2e5520fdca3c5 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
@@ -1213,6 +1213,7 @@ size_t arm_smmu_get_viommu_size(struct device *dev,
int arm_vsmmu_init(struct iommufd_viommu *viommu,
struct iommu_domain *parent_domain,
const struct iommu_user_data *user_data);
+void arm_vsmmu_destroy(struct iommufd_viommu *viommu);
int arm_smmu_attach_prepare_vmaster(struct arm_smmu_attach_state *state,
struct arm_smmu_nested_domain *nested_domain);
void arm_smmu_attach_commit_vmaster(struct arm_smmu_attach_state *state);
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
index a77c60321203c..d17f8cb423b0c 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3-iommufd.c
@@ -406,7 +406,19 @@ int arm_vsmmu_cache_invalidate(struct iommufd_viommu *viommu,
return ret;
}

+void arm_vsmmu_destroy(struct iommufd_viommu *viommu)
+{
+ struct arm_vsmmu *vsmmu = container_of(viommu, struct arm_vsmmu, core);
+
+ /*
+ * arm_smmu_iotlb_tag_free() must have flushed the IOTLB with the VMID,
+ * but it did not free the VMID to align its lifecycle with the vSMMU.
+ */
+ ida_free(&vsmmu->smmu->vmid_map, vsmmu->vmid);
+}
+
static const struct iommufd_viommu_ops arm_vsmmu_ops = {
+ .destroy = arm_vsmmu_destroy,
.alloc_domain_nested = arm_vsmmu_alloc_domain_nested,
.cache_invalidate = arm_vsmmu_cache_invalidate,
};
@@ -456,21 +468,29 @@ int arm_vsmmu_init(struct iommufd_viommu *viommu,
struct arm_smmu_device *smmu =
container_of(viommu->iommu_dev, struct arm_smmu_device, iommu);
struct arm_smmu_domain *s2_parent = to_smmu_domain(parent_domain);
+ int id, ret;

if (s2_parent->smmu != smmu)
return -EINVAL;

+ id = ida_alloc_range(&smmu->vmid_map, 1, (1 << smmu->vmid_bits) - 1,
+ GFP_KERNEL);
+ if (id < 0)
+ return id;
+
+ vsmmu->vmid = id;
vsmmu->smmu = smmu;
vsmmu->s2_parent = s2_parent;
- /* FIXME Move VMID allocation from the S2 domain allocation to here */
- vsmmu->vmid = s2_parent->s2_cfg.vmid;

if (viommu->type == IOMMU_VIOMMU_TYPE_ARM_SMMUV3) {
viommu->ops = &arm_vsmmu_ops;
return 0;
}

- return smmu->impl_ops->vsmmu_init(vsmmu, user_data);
+ ret = smmu->impl_ops->vsmmu_init(vsmmu, user_data);
+ if (ret)
+ ida_free(&smmu->vmid_map, vsmmu->vmid);
+ return ret;
}

int arm_vmaster_report_event(struct arm_smmu_vmaster *vmaster, u64 *evt)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index 6fe5563eaf9eb..92845fabd0dec 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -1152,6 +1152,7 @@ static void tegra241_cmdqv_destroy_vintf_user(struct iommufd_viommu *viommu)
iommufd_viommu_destroy_mmap(&vintf->vsmmu.core,
vintf->mmap_offset);
tegra241_cmdqv_remove_vintf(vintf->cmdqv, vintf->idx);
+ arm_vsmmu_destroy(viommu);
}

static void tegra241_vintf_destroy_vsid(struct iommufd_vdevice *vdev)
--
2.43.0