[PATCH v5 07/24] iommu/amd: Add support for AMD vIOMMU VF MMIO region

From: Suravee Suthikulpanit

Date: Mon Sep 14 2026 - 14:57:51 EST


The AMD vIOMMU virtualizes guest MMIO registers at the 3rd 4K region.
This is achieved using the iommufd_viommu_alloc_mmap().

Copy struct iommu_viommu_amd from and to userspace so the VF-MMIO
mmap offset is validated and returned on vIOMMU alloc.

Return -EINVAL if the VF-MMIO page_base is zero so mmap is not
registered at physical address 0.

Reviewed-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
Co-developed-by: Vasant Hegde <Vasant.Hegde@xxxxxxx>
Signed-off-by: Vasant Hegde <Vasant.Hegde@xxxxxxx>
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@xxxxxxx>
---
drivers/iommu/amd/amd_iommu_types.h | 3 +++
drivers/iommu/amd/amd_viommu.h | 7 +++++
drivers/iommu/amd/iommufd.c | 41 ++++++++++++++++++++++++++++-
drivers/iommu/amd/viommu.c | 12 +++++++++
4 files changed, 62 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h
index c2257d48e222..3aaaf69a1e7d 100644
--- a/drivers/iommu/amd/amd_iommu_types.h
+++ b/drivers/iommu/amd/amd_iommu_types.h
@@ -532,6 +532,9 @@ struct amd_iommu_viommu {
* Indexed by guest domain ID.
*/
struct xarray gdomid_array;
+
+ /* Offset for mmap() of guest VF MMIO; set after iommufd_viommu_alloc_mmap(). */
+ unsigned long vfmmio_mmap_offset;
};

/*
diff --git a/drivers/iommu/amd/amd_viommu.h b/drivers/iommu/amd/amd_viommu.h
index e5fbea666e01..276f2126290f 100644
--- a/drivers/iommu/amd/amd_viommu.h
+++ b/drivers/iommu/amd/amd_viommu.h
@@ -14,6 +14,8 @@ int amd_viommu_init(struct amd_iommu *iommu);

void __init amd_viommu_uninit(struct amd_iommu *iommu);

+u64 amd_viommu_get_vfmmio_addr(struct amd_iommu *iommu, u16 gid);
+
#else

/*
@@ -30,6 +32,11 @@ static inline void amd_viommu_uninit(struct amd_iommu *iommu)
{
}

+static inline u64 amd_viommu_get_vfmmio_addr(struct amd_iommu *iommu, u16 gid)
+{
+ return 0;
+}
+
#endif /* CONFIG_AMD_IOMMU_IOMMUFD */

#endif /* AMD_VIOMMU_H */
diff --git a/drivers/iommu/amd/iommufd.c b/drivers/iommu/amd/iommufd.c
index 69a0e61bf83d..7f358e57efde 100644
--- a/drivers/iommu/amd/iommufd.c
+++ b/drivers/iommu/amd/iommufd.c
@@ -7,6 +7,7 @@

#include "iommufd.h"
#include "amd_iommu.h"
+#include "amd_viommu.h"
#include "amd_iommu_types.h"

static const struct iommufd_viommu_ops amd_viommu_ops;
@@ -51,6 +52,8 @@ int amd_iommufd_viommu_init(struct iommufd_viommu *viommu, struct iommu_domain *
{
int ret;
unsigned long flags;
+ phys_addr_t page_base;
+ struct iommu_viommu_amd data = {};
struct protection_domain *pdom = to_pdomain(parent);
struct amd_iommu_viommu *aviommu = container_of(viommu, struct amd_iommu_viommu, core);
struct amd_iommu *iommu = container_of(viommu->iommu_dev, struct amd_iommu, iommu);
@@ -58,14 +61,43 @@ int amd_iommufd_viommu_init(struct iommufd_viommu *viommu, struct iommu_domain *
if (!amd_iommu_viommu_enabled(iommu))
return -EOPNOTSUPP;

+ if (!user_data)
+ return -EINVAL;
+
+ ret = iommu_copy_struct_from_user(&data, user_data,
+ IOMMU_VIOMMU_TYPE_AMD,
+ out_vfmmio_mmap_offset);
+ if (ret)
+ return ret;
+
xa_init_flags(&aviommu->gdomid_array, XA_FLAGS_ALLOC1);
aviommu->parent = pdom;

ret = amd_iommu_gid_alloc(iommu);
if (ret < 0)
- return ret;
+ goto err_gid;
aviommu->gid = ret;

+ page_base = amd_viommu_get_vfmmio_addr(iommu, aviommu->gid);
+ if (!page_base) {
+ ret = -EINVAL;
+ goto err_mmap;
+ }
+
+ ret = iommufd_viommu_alloc_mmap(&aviommu->core,
+ page_base, SZ_4K,
+ &aviommu->vfmmio_mmap_offset);
+ if (ret)
+ goto err_mmap;
+
+ data.out_vfmmio_mmap_offset = aviommu->vfmmio_mmap_offset;
+
+ ret = iommu_copy_struct_to_user(user_data, &data,
+ IOMMU_VIOMMU_TYPE_AMD,
+ out_vfmmio_mmap_offset);
+ if (ret)
+ goto err_init;
+
viommu->ops = &amd_viommu_ops;

spin_lock_irqsave(&pdom->lock, flags);
@@ -73,6 +105,12 @@ int amd_iommufd_viommu_init(struct iommufd_viommu *viommu, struct iommu_domain *
spin_unlock_irqrestore(&pdom->lock, flags);

return 0;
+err_init:
+ iommufd_viommu_destroy_mmap(&aviommu->core, aviommu->vfmmio_mmap_offset);
+err_mmap:
+ amd_iommu_gid_free(iommu, aviommu->gid);
+err_gid:
+ return ret;
}

static void amd_iommufd_viommu_destroy(struct iommufd_viommu *viommu)
@@ -88,6 +126,7 @@ static void amd_iommufd_viommu_destroy(struct iommufd_viommu *viommu)
list_del(&aviommu->pdom_list);
spin_unlock_irqrestore(&pdom->lock, flags);
xa_destroy(&aviommu->gdomid_array);
+ iommufd_viommu_destroy_mmap(&aviommu->core, aviommu->vfmmio_mmap_offset);
amd_iommu_gid_free(iommu, aviommu->gid);
}

diff --git a/drivers/iommu/amd/viommu.c b/drivers/iommu/amd/viommu.c
index 7e6c4412ff20..c9207ed47fb6 100644
--- a/drivers/iommu/amd/viommu.c
+++ b/drivers/iommu/amd/viommu.c
@@ -110,6 +110,18 @@ static int __init viommu_vf_vfcntl_init(struct amd_iommu *iommu)
return -ENOMEM;
}

+/*
+ * Returns VF MMIO BAR offset for the given guest ID which will be
+ * mapped to guest vIOMMU 3rd 4K MMIO address
+ */
+u64 amd_viommu_get_vfmmio_addr(struct amd_iommu *iommu, u16 gid)
+{
+ if (WARN_ON(!iommu->vf_base_phys || gid > VIOMMU_MAX_GID))
+ return 0;
+
+ return iommu->vf_base_phys + gid * VIOMMU_VF_MMIO_ENTRY_SIZE;
+}
+
int __init amd_viommu_init(struct amd_iommu *iommu)
{
int ret;
--
2.34.1