From: Jason Gunthorpe <jgg@ziepe.ca>
To: "Tian, Kevin" <kevin.tian@intel.com>
Cc: "Liu, Yi L" <yi.l.liu@intel.com>,
Vasant Hegde <vasant.hegde@amd.com>,
Robin Murphy <robin.murphy@arm.com>,
"iommu@lists.linux.dev" <iommu@lists.linux.dev>,
"joro@8bytes.org" <joro@8bytes.org>,
"will@kernel.org" <will@kernel.org>,
"suravee.suthikulpanit@amd.com" <suravee.suthikulpanit@amd.com>
Subject: Re: [PATCH] iommu/amd: Add Secure ATS support
Date: Wed, 5 Mar 2025 13:22:19 -0400 [thread overview]
Message-ID: <20250305172219.GF5011@ziepe.ca> (raw)
In-Reply-To: <BN9PR11MB52769EFA077B3E552DA4235A8CCB2@BN9PR11MB5276.namprd11.prod.outlook.com>
On Wed, Mar 05, 2025 at 02:50:38AM +0000, Tian, Kevin wrote:
> Probably we may also need separate policy between unmanaged and
> dma types. In some scenarios the user may care more about potential
> ATS attacks from userspace drivers but not kernel drivers. In that case
> disabling secure ats for kernel drivers would avoid unnecessary cost
> of address audit.
That would be some specific iommufd/vfio policy IMHO
But really, if the device is being used by iommufd or not is well
known by the admin, they could set the general ATS to secure prior to
binding vfio and just be done with it. No need for more automation?
Jason
next prev parent reply other threads:[~2025-03-05 17:22 UTC|newest]
Thread overview: 68+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-25 10:58 [PATCH] iommu/amd: Add Secure ATS support Vasant Hegde
2025-02-25 12:30 ` Yi Liu
2025-02-25 13:18 ` Robin Murphy
2025-02-25 13:57 ` Yi Liu
2025-02-25 14:55 ` Jason Gunthorpe
2025-02-26 1:09 ` Yi Liu
2025-02-26 1:13 ` Jason Gunthorpe
2025-02-26 1:27 ` Yi Liu
2025-02-26 2:52 ` Tian, Kevin
2025-02-26 1:12 ` Tian, Kevin
2025-02-26 1:17 ` Jason Gunthorpe
2025-02-26 2:50 ` Tian, Kevin
2025-02-26 12:57 ` Jason Gunthorpe
2025-02-26 7:05 ` Tian, Kevin
2025-02-26 12:58 ` Jason Gunthorpe
2025-02-27 15:27 ` Vasant Hegde
2025-02-28 6:32 ` Tian, Kevin
2025-02-28 7:43 ` Yi Liu
2025-02-28 8:30 ` Vasant Hegde
2025-02-28 8:47 ` Yi Liu
2025-02-28 8:47 ` Vasant Hegde
2025-03-02 8:10 ` Yi Liu
2025-03-03 3:00 ` Tian, Kevin
2025-03-04 6:58 ` Yi Liu
2025-03-03 11:42 ` Vasant Hegde
2025-03-05 3:24 ` Tian, Kevin
2025-03-10 17:07 ` Vasant Hegde
2025-03-12 7:15 ` Tian, Kevin
2025-03-17 8:56 ` Vasant Hegde
2025-04-07 5:28 ` Tian, Kevin
2025-03-03 18:38 ` Jason Gunthorpe
2025-03-04 2:16 ` Baolu Lu
2025-03-04 14:18 ` Jason Gunthorpe
2025-03-05 2:45 ` Baolu Lu
2025-03-05 2:46 ` Tian, Kevin
2025-03-04 6:50 ` Yi Liu
2025-03-04 10:46 ` Vasant Hegde
2025-03-04 14:20 ` Jason Gunthorpe
2025-03-05 2:50 ` Tian, Kevin
2025-03-05 17:22 ` Jason Gunthorpe [this message]
2025-03-06 2:41 ` Tian, Kevin
2025-03-14 12:54 ` Yi Liu
2025-03-04 10:15 ` Vasant Hegde
2025-03-04 14:24 ` Jason Gunthorpe
2025-03-10 16:35 ` Vasant Hegde
2025-03-14 12:09 ` Yi Liu
2025-03-19 19:52 ` Jason Gunthorpe
2025-03-14 12:22 ` Yi Liu
2025-02-28 8:26 ` Vasant Hegde
2025-02-28 14:56 ` Jason Gunthorpe
2025-03-03 2:55 ` Tian, Kevin
2025-03-10 14:13 ` Vasant Hegde
2025-03-12 6:55 ` Tian, Kevin
2025-03-03 11:56 ` Vasant Hegde
2025-02-26 4:47 ` Vasant Hegde
2025-02-26 7:10 ` Tian, Kevin
2025-02-26 13:01 ` Jason Gunthorpe
2025-02-26 22:42 ` Jerry Snitselaar
2025-02-27 16:04 ` Vasant Hegde
2025-02-28 0:04 ` Jason Gunthorpe
2025-02-28 6:18 ` Tian, Kevin
2025-02-28 1:47 ` Baolu Lu
2025-02-28 6:15 ` Tian, Kevin
2025-02-28 8:53 ` Vasant Hegde
2025-02-28 14:53 ` Jason Gunthorpe
2025-03-03 2:43 ` Tian, Kevin
2025-02-28 8:38 ` Vasant Hegde
2025-02-26 4:33 ` Vasant Hegde
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250305172219.GF5011@ziepe.ca \
--to=jgg@ziepe.ca \
--cc=iommu@lists.linux.dev \
--cc=joro@8bytes.org \
--cc=kevin.tian@intel.com \
--cc=robin.murphy@arm.com \
--cc=suravee.suthikulpanit@amd.com \
--cc=vasant.hegde@amd.com \
--cc=will@kernel.org \
--cc=yi.l.liu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.