Re: [PATCH] iommu/amd: Add Secure ATS support

[Vasant Hegde <vasant.hegde@amd.com>]

Hi Yi,


On 2/25/2025 6:00 PM, Yi Liu wrote:
> On 2025/2/25 18:58, Vasant Hegde wrote:
>> AMD IOMMU supports processing ATS requests as Secure ATS requests when IOTLB
>> is supported and enabled (See section "2.11 Secure ATS Supports" in AMD IOMMU
>> spec [1] for more detail).
> 
> glad to see it. I'm also working on Secure ATS for VT-d. Intel Secure ATS
> has an extra table named HPT (Host Permission Table) chapter 4.2.4 in
> revision 5.0 spec. IOMMU uses this table to check the address in the
> translated transactions to ensure the device has access permission.
> 
> We plan to support the HPT on S2 when nested translation is configured. But
> we may let the userspace VMM to decide if it wants SATS on specific device.
> The reason is that some devices might be considered as trusted. e.g.
> integrated devices.

Yeah. That's another option (ATS for trusted SoC devices and secure ATS for
other devices).

> 
> My thought is to add a flag in iommufd_hw_capabilities to report the
> capability, and add a flag in iommufd_hwpt_alloc_flags to let iommu driver
> know if HPT is needed when allocating S2 domain. Userspace attaches the
> un-trusted devices to the domains with HPT. While trusted devices can be
> attached to 'normal' S2 domains.  Will to send it out soon.:)
> 
>> With Secure ATS, for ATS requests IOMMU return GPA to device instead of SPA.
> 
> I suppose AMD Secure ATS only works under nested translation configuration.
> is it? I guess admin may want some flexibility to opt-in it. :)

AMD Secure ATS works under 3 scenarios :
  - Baremetal case w/ AMD Host (V1) page table (this include VFIO passthrough)
  - HW Nested setup where both page table is configured
    In above two setup, its opt-in feature

  - SNP (Secure Nested Paging) is ON
    Secure ATS is mandatory.

-Vasant