Re: [RFC PATCH 3/3] iommufd/tsm: Add tsm_bind/unbind iommufd ioctls

[Jason Gunthorpe <jgg@nvidia.com>]

On Tue, Jun 10, 2025 at 05:05:21PM +1000, Alexey Kardashevskiy wrote:
> 
> 
> On 4/6/25 22:36, Jason Gunthorpe wrote:
> > On Wed, Jun 04, 2025 at 01:58:55PM +0800, Xu Yilun wrote:
> > 
> > > But the p2p case may impact AMD, AMD have legacy IOMMUPT on its secure
> > > DMA path. And if you invalidate MMIO (in turn unmaps IOMMUPT) when
> > > bound, may trigger HW protection mechanism against DMA silent drop.
> > 
> > As I understand AMD it sort of has a single translation and relies on
> > its RMP for security.
> 
> Well, two levels with the first page table living in the guest
> memory + RMP for the second page table in the host memory.

Yes, 'level' is a bit unclear here.. Intel and ARM have four levels. 

 T=0 S2 lives in hypervisor memory
 T=1 S2 lives in TSM memory (S-EPT)
 T=0 S1 lives in guest shared memory
 T=1 S1 lives in guest private memory

So compared to AMD both the RMP equivalent and the secure S2 live in
TSM memory and provide protection..

I've forgotten exactly how AMD manages to secure the IOMMU S2 in
hypervisor memory, but it seemed unique to AMD.

> > > "If a bound TDI sends a request to the root complex, and the IOMMU detects a fault caused by host
> > > configuration, the root complex fences the ASID from all further I/O to or from that guest. A host
> > > fault is either a host page table fault or an RMP check violation. ASID fencing means that the
> > > IOMMU blocks all further I/O from the root complex to the guest that the TDI was bound, and the
> > > root complex blocks all MMIO accesses by the guest. When a guest writes to MMIO, the write is
> > > silently dropped. When a guest reads from MMIO, the guest reads 1s."
> > 
> > Sounds to me like the guest has to do things properly or the guest
> > gets itself killed. I wonder how feasible this really is..
> 
> What does look especially worrying? So far the process has been
> pretty straightforward. 

I think it makes debugging guest bugs hard if the guest explodes on an
errant DMA.

Jason