diff --git a/Documentation/driver-api/vfio.rst b/Documentation/driver-api/vfio.rst
index 2a21a42c9386..0ad858460e7b 100644
--- a/Documentation/driver-api/vfio.rst
+++ b/Documentation/driver-api/vfio.rst
@@ -670,6 +670,29 @@ This implementation has some specifics:
 
 -------------------------------------------------------------------------------
 
+pvIOMMU implementation note
+-------------------------------
+1) pKVM provides mutual distrust between host kernel and protected VMs(pVM)
+   One solution to provide DMA isolation in this model, is to move the IOMMU
+   control to the hypervisor and para-virtualize the IOMMU interface for
+   the host and guest kernels. (none of them have direct access to IOMMU
+   programming interface).
+
+2) In the case of device assignment, the host can't map memory for the
+   guest kernel in the IOMMU (as it is not trusted).
+
+3) To statify these requirements a new VFIO IOMMU container type is added
+   VFIO_PKVM_IOMMU which attaches the device to a blocking domain, and
+   denies any MAP_DMA/UNMAP_DMA IOCTLs.
+
+4) The guest IOMMU is configured by the host (virtual toplogy) but the mappings
+   are controlled by the guest, you can find more about this in:
+   - Documentation/virt/kvm/devices/vfio.rst
+   - Documentation/virt/kvm/arm/pviommu.rst
+
+So, a new container type is added: `VFIO_PKVM_IOMMU`
+-------------------------------------------------------------------------------
+
 .. [1] VFIO was originally an acronym for "Virtual Function I/O" in its
    initial implementation by Tom Lyon while as Cisco.  We've since
    outgrown the acronym, but it's catchy.
diff --git a/Documentation/virt/kvm/devices/vfio.rst b/Documentation/virt/kvm/devices/vfio.rst
index c549143bb891..287e54401927 100644
--- a/Documentation/virt/kvm/devices/vfio.rst
+++ b/Documentation/virt/kvm/devices/vfio.rst
@@ -18,6 +18,7 @@ KVM, a reference to the VFIO file is held by KVM.
 Groups:
   KVM_DEV_VFIO_FILE
 	alias: KVM_DEV_VFIO_GROUP
+  KVM_DEV_VFIO_PVIOMMU
 
 KVM_DEV_VFIO_FILE attributes:
   KVM_DEV_VFIO_FILE_ADD: Add a VFIO file (group/device) to VFIO-KVM device
@@ -59,3 +60,49 @@ callback.  It is the same for device file descriptor via character device
 open which gets device access via VFIO_DEVICE_BIND_IOMMUFD.  For such file
 descriptors, FILE_ADD should be invoked before VFIO_DEVICE_BIND_IOMMUFD
 to support the drivers mentioned in prior sentence as well.
+
+KVM_DEV_VFIO_PVIOMMU attributes:
+  KVM_DEV_VFIO_PVIOMMU_ATTACH: Create and attach a pvIOMMU instance to the
+    KVM VM associated with this device, returns a file descriptor "pviommufd"
+    for this IOMMU which supports some IOCTLs.
+
+  KVM_DEV_VFIO_PVIOMMU_GET_INFO: Retrieve information about IOMMUs for a VFIO
+    devicefd, using the following struct:
+
+		struct kvm_vfio_iommu_info {
+			__u32 size;
+			__s32 device_fd;
+			__u32 out_nr_sids;
+			__u32 __reserved;
+		};
+
+	  Where kvm_vfio_iommu_info.device_fd the input VFIO device ID, and
+	  kvm_vfio_iommu_info.out_nr_sids is the number stream IDs(endpoint) for
+	  this device, this similar to VFIO_DEVICE_GET_IRQ_INFO which returns the
+	  number of irqs for a VFIO device.
+	  size is added to allow the struct to be extended, while __reserved
+      must be zero.
+
+  The rest of the IOCTLs are used to configure the pvIOMMU are part of
+  the pviommufd returned from the attach operation:
+    KVM_PVIOMMU_SET_CONFIG: Configure pvIOMMU for an endpoint for a device,
+      where the input struct:
+
+		struct kvm_vfio_iommu_config {
+			__u32 size;
+			__s32 device_fd;
+			__u32 sid_idx;
+			__u32 vsid;
+			__u32 __reserved;
+		};
+
+      kvm_vfio_iommu_config.device_fd is the VFIO devicefd,
+      kvm_vfio_iommu_config.sid_idx is a valid index based on number of sids
+      from KVM_DEV_VFIO_PVIOMMU_GET_INFO.
+      And kvm_vfio_iommu_config.vsid is the virtual sid seen by the guest,
+      It is the VMM responsibility to describe this to the guest, the pvIOMMU
+      would translate an IOMMU request with this vsid to the physical SID of
+	  the device for the index specified.
+      This is similar to VFIO IOCTL VFIO_DEVICE_SET_IRQS but for the IOMMU.
+      size is added to allow the struct to be extended, while __reserved
+      must be zero.