Re: [PATCH] iommu/amd: Add Secure ATS support

[Jason Gunthorpe <jgg@ziepe.ca>]

On Thu, Feb 27, 2025 at 09:34:01PM +0530, Vasant Hegde wrote:
> Kevin, Jason,
> 
> On 2/26/2025 12:40 PM, Tian, Kevin wrote:
> >> From: Vasant Hegde <vasant.hegde@amd.com>
> >> Sent: Wednesday, February 26, 2025 12:47 PM
> >>
> >>>
> >>>  3) TA is an IOVA and the IOMMU runs it through the full translation
> >>>     to validate it. ATS is just used to signal non-present
> >>
> >> Yes. AMD does this when Host page table is configured.
> > 
> > Here 'signal non-present' implies to support PRI.
> > 
> > But...
> > 
> >>
> >> We need to consider various scenarios. For AMD:
> >>   - Currently on baremetal, we cannot enable SVA and Secure ATS
> > 
> > ... here it says SVA/SATS are incompatible. Any more background?
> 
> Sorry. I should have explained it better.
> 
> To support SVA (PASID/PRI), we have to configure domain with AMD Guest (v2) Page
> table and host page table will not be set (DTE[Mode]=0).
> 
>   GVA -> GPA contains translation and GPA = SPA.
> 
> On ATS request it will send GPA back to device (which is actually a SPA). We can
> support secure ATS, but ATS response will contain the SPA.

I see, that makes sense. The TA is not tagged with a PASID on the wire
so no iommu can support the #2 form with PASID.

Jason