[PATCH 0/2] iommu/amd: Fix default domain selection for PASID-capable devices

[PATCH 0/2] iommu/amd: Fix default domain selection for PASID-capable devices

[Vasant Hegde]

This series addresses a long-standing issue in the default domain
selection path of the AMD IOMMU driver.

Currently, the driver unconditionally forces an identity domain on all
devices that support PASID (Process Address Space ID).

This series introduces a more targeted approach: instead of applying identity
domain assignment globally to all PASID-capable devices, quirks are added only
for specific GPUs. All remaining PASID-capable devices are now allowed to boot
with a paging domain, enabling proper use of page tables (v2 page table).

In addition, this series adds an ATS (Address Translation Service) quirk
for the "Radeon GPU WX 4100" to ensure correct operation when booted
with a paging domain.

Vasant Hegde (2):
  PCI: Mark Radeon Pro WX 4100 ATS as broken
  iommu/amd: Force identity mode for selected GPUs only

 drivers/iommu/amd/iommu.c | 56 +++++++++++++++++++++++++++++++--------
 drivers/pci/quirks.c      |  2 ++
 2 files changed, 47 insertions(+), 11 deletions(-)

-- 
2.31.1

[PATCH 1/2] PCI: Mark Radeon Pro WX 4100 ATS as broken

[Vasant Hegde]

If ATS is enabled then IOMMU logs below error and GPU fails to
initialize.

[  103.687137] iommu ivhd0: AMD-Vi: Event logged [IOTLB_INV_TIMEOUT device=0000:c4:00.0 address=0x1080006060]

Suggested-by: Alex Deucher <alexander.deucher@amd.com>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: linux-pci@vger.kernel.org
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
---
 drivers/pci/quirks.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index b09f27f7846f..d55657347d88 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -5686,6 +5686,8 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7340, quirk_amd_harvest_no_ats);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7341, quirk_amd_harvest_no_ats);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7347, quirk_amd_harvest_no_ats);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x734f, quirk_amd_harvest_no_ats);
+/* Radeon Pro WX 4100 */
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x67e3, quirk_amd_harvest_no_ats);
 /* AMD Raven platform iGPU */
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x15d8, quirk_amd_harvest_no_ats);
 
-- 
2.31.1

Re: [PATCH 1/2] PCI: Mark Radeon Pro WX 4100 ATS as broken

[sashiko-bot]

> If ATS is enabled then IOMMU logs below error and GPU fails to
> initialize.
> 
> [  103.687137] iommu ivhd0: AMD-Vi: Event logged [IOTLB_INV_TIMEOUT device=0000:c4:00.0 address=0x1080006060]
> 
> Suggested-by: Alex Deucher <alexander.deucher@amd.com>
> Cc: Bjorn Helgaas <bhelgaas@google.com>
> Cc: linux-pci@vger.kernel.org
> Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723061548.10187-1-vasant.hegde@amd.com?part=1

[PATCH 2/2] iommu/amd: Force identity mode for selected GPUs only

[Vasant Hegde]

Certain AMD GPU's must always be in identity mode. Currently its enforced
using PASID check. It worked fine as most GPU's has PASID feature. But
this means, identity mode enforcement is done for all PASID capable devices.

Previously it made sense as domain allocation API
(iommu_ops->domain_alloc()) was just passing domain type. So it couldn't
check device capability and decide best suited page table type (v1 or
v2). With recent enhancement to driver code, it uses
domain_alloc_paging_flags() ops for all paging mode domain allocation.
This can check device/flags and allocate best suited page table (v1 or v2).
Hence fix amd_iommu_def_domain_type() to force identity mapping for selected
GPUs only.

With this change system booted with DMA translation mode will select:
 * Guest (v2) page table for PASID capable device
 * Host (v1) page table for non-PASID capable device

Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
Tested-by: Amandeep Kaur Longia <AmandeepKaur.Longia@amd.com>
---
 drivers/iommu/amd/iommu.c | 56 +++++++++++++++++++++++++++++++--------
 1 file changed, 45 insertions(+), 11 deletions(-)

diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index 563f9c2672d5..fe642e33c87d 100644
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -3112,6 +3112,32 @@ static bool amd_iommu_is_attach_deferred(struct device *dev)
 	return dev_data->defer_attach;
 }
 
+static bool quirks_force_identity_mapping(struct pci_dev *pdev)
+{
+	struct pci_dev *root_port;
+	int class = pdev->class >> 8;
+
+	/* AMD GPU vendor ID */
+	if (pdev->vendor != PCI_VENDOR_ID_ATI)
+		return false;
+
+	/* GPU class */
+	if (class != PCI_CLASS_DISPLAY_VGA &&
+	    class != PCI_CLASS_DISPLAY_OTHER)
+		return false;
+
+	root_port = pcie_find_root_port(pdev);
+	if (!root_port)
+		return false;
+
+	/* If bridge vendor is not ATI then its APU and force IDENTITY mode */
+	if (root_port->vendor != PCI_VENDOR_ID_ATI)
+		return true;
+
+	/* Rest all are dGPUs and works fine with DMA mode */
+	return false;
+}
+
 static int amd_iommu_def_domain_type(struct device *dev)
 {
 	struct iommu_dev_data *dev_data;
@@ -3120,20 +3146,28 @@ static int amd_iommu_def_domain_type(struct device *dev)
 	if (!dev_data)
 		return 0;
 
+	if (!dev_is_pci(dev))
+		return 0;
+
 	/* Always use DMA domain for untrusted device */
-	if (dev_is_pci(dev) && to_pci_dev(dev)->untrusted)
+	if (to_pci_dev(dev)->untrusted)
 		return IOMMU_DOMAIN_DMA;
 
-	/*
-	 * Do not identity map IOMMUv2 capable devices when:
-	 *  - memory encryption is active, because some of those devices
-	 *    (AMD GPUs) don't have the encryption bit in their DMA-mask
-	 *    and require remapping.
-	 *  - SNP is enabled, because it prohibits DTE[Mode]=0.
-	 */
-	if (pdev_pasid_supported(dev_data) &&
-	    !cc_platform_has(CC_ATTR_MEM_ENCRYPT) &&
-	    !amd_iommu_snp_en) {
+	/* Apply device specific quirks */
+	if (quirks_force_identity_mapping(to_pci_dev(dev))) {
+
+		/*
+		 * When memory encryption is active, some of these devices
+		 * don't have the encryption bit in their DMA-mask and
+		 * require remapping.
+		 */
+		if (cc_platform_has(CC_ATTR_MEM_ENCRYPT))
+			return 0;
+
+		/* DTE[Mode]=0 is prohibited when SNP is enabled */
+		if (amd_iommu_snp_en)
+			return 0;
+
 		return IOMMU_DOMAIN_IDENTITY;
 	}
 
-- 
2.31.1

Re: [PATCH 2/2] iommu/amd: Force identity mode for selected GPUs only

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] quirks_force_identity_mapping() incorrectly identifies AMD discrete GPUs (dGPUs) as APUs, inadvertently forcing them into IOMMU IDENTITY mapping mode instead of the intended DMA mode.
--

--- Patch [2]: [PATCH 2/2] iommu/amd: Force identity mode for selected GPUs only ---
commit 43e3d4caff8faca1297d432e0146e34c6ec99227
Author: Vasant Hegde <vasant.hegde@amd.com>
Subject: iommu/amd: Force identity mode for selected GPUs only

This commit attempts to enforce identity mapping mode specifically for APUs 
while keeping discrete GPUs in DMA mode by checking the upstream bridge 
vendor ID.

> diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
> index 1e76386e5eb11..a9c7209f1b587 100644
> --- a/drivers/iommu/amd/iommu.c
> +++ b/drivers/iommu/amd/iommu.c
[ ... ]
> @@ -3122,6 +3122,32 @@ static bool amd_iommu_is_attach_deferred(struct device *dev)
>  	return dev_data->defer_attach;
>  }
>  
> +static bool quirks_force_identity_mapping(struct pci_dev *pdev)
> +{
> +	struct pci_dev *root_port;
> +	int class = pdev->class >> 8;
> +
> +	/* AMD GPU vendor ID */
> +	if (pdev->vendor != PCI_VENDOR_ID_ATI)
> +		return false;
> +
> +	/* GPU class */
> +	if (class != PCI_CLASS_DISPLAY_VGA &&
> +	    class != PCI_CLASS_DISPLAY_OTHER)
> +		return false;
> +
> +	root_port = pcie_find_root_port(pdev);
> +	if (!root_port)
> +		return false;

[Severity: High]
If an APU is implemented as a Root Complex Integrated Endpoint (RCiEP), 
pcie_find_root_port() will return NULL. Does this cause the function 
to return false early and leave the APU in DMA mode, which seems to be the 
opposite of the intended behavior?

> +
> +	/* If bridge vendor is not ATI then its APU and force IDENTITY mode */
> +	if (root_port->vendor != PCI_VENDOR_ID_ATI)
> +		return true;

[Severity: High]
Will this correctly distinguish between discrete GPUs and APUs?

Since pcie_find_root_port() traces up to the host's root port, the
vendor ID will typically match the system chipset (like AMD 0x1022 or
Intel 0x8086) rather than ATI 0x1002. Doesn't this mean the condition
root_port->vendor != PCI_VENDOR_ID_ATI evaluates to true for discrete
GPUs, forcing them into IDENTITY mode instead of the intended DMA mode?

> +
> +	/* Rest all are dGPUs and works fine with DMA mode */
> +	return false;
> +}
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723061548.10187-1-vasant.hegde@amd.com?part=2