Re: [PATCH v8 13/15] iommufd/viommu: Allow vIOMMUs without a parent HWPT

[Aneesh Kumar K . V]

Jason Gunthorpe <jgg@xxxxxxxx> writes:

> On Wed, Nov 04, 2026 at 11:03:41AM -0800, Nicolin Chen wrote:
>> On Wed, Nov 04, 2026 at 09:46:30PM +0530, Aneesh Kumar K.V (Arm) wrote:
>> > VIOMMU_ALLOC currently requires a nesting parent HWPT_PAGING even when
>> > the selected vIOMMU implementation has no use for one. This would force
>> > implementations such as the following Arm Realm vIOMMU to create an
>> > unused parent.
>> 
>> IIRC, MSI on ARM still goes through the NS pathway. So, it wouldn't
>> be "unused" if the device attaches to it (or its nested hwpts)?
>
> It is unused by the RMM VIOMMU. I think that is what is Aneesh is
> explaining.
>

We create an IOMMU_HWPT_ALLOC_NEST_PARENT HWPT outside the vIOMMU and
attach it before allocating the vIOMMU. This HWPT is used for untrusted
devices and MSI-X.

The sequence is:
	ret = __iommufd_configure_device(kvm, vdev);
	ret = iommufd_get_hwpt(vdev, hwpt_flags, &hwpt_id);
	ret = iommufd_attach_hwpt(vdev, hwpt_id);
	ret = iommufd_create_vdevice(kvm, vdev);
        	viommu = iommufd_alloc_viommu(kvm, vdev, vdev->link_tsm_name);
		if (ioctl(iommu_fd, IOMMU_VDEVICE_ALLOC, &alloc_vdev)) {


Alloc viommu does the below:
	viommu->_viommu.size = sizeof(struct iommu_viommu_alloc);
	viommu->_viommu.flags =  0;
	viommu->_viommu.type = kvm__arch_get_viommu_type(kvm);
	viommu->_viommu.dev_id = vdev->bound_devid;
	viommu->_viommu.hwpt_id = 0;

	if (ioctl(iommu_fd, IOMMU_VIOMMU_ALLOC, &viommu->_viommu)) {
		vfio_dev_err(vdev, "failed to allocate VIOMMU %d", -errno);
		free(viommu);
		return NULL;
	}

>
>> By dropping the nesting parent from VIOMMU, it just simplifies the
>> attachment to an S1 paging hwpt, right?
>
> Yes.
>
> The VMM must always maintain a S1 paging attachment that is the
> identity map of the VM on all devices, same action as when there is no
> viommu.
>

I am currently creating an S2 paging attachment. This results in a
configuration with S1 disabled and S2 enabled, which is used by all
untrusted devices.

-aneesh