Re: [PATCH 2/2] iommu/amd: Force identity mode for selected GPUs only

[+cc Gerd, Alex]

On Thu, Jul 23, 2026 at 02:58:14PM -0500, Mario Limonciello wrote:
> On 7/23/26 14:53, Bjorn Helgaas wrote:
> > On Thu, Jul 23, 2026 at 11:32:49AM -0500, Mario Limonciello wrote:
> > > On 7/23/26 11:23, Vasant Hegde wrote:
> > > > On 7/23/2026 9:41 PM, Mario Limonciello wrote:
> > > > > On 7/23/26 10:59, Bjorn Helgaas wrote:
> > > > > > On Thu, Jul 23, 2026 at 06:15:48AM +0000, Vasant Hegde wrote:
> > > > > > > Certain AMD GPU's must always be in identity mode. Currently its enforced
> > > > > > > using PASID check. It worked fine as most GPU's has PASID feature. But
> > > > > > > this means, identity mode enforcement is done for all PASID capable devices.
> > > ...
> > 
> > > > +static bool quirks_force_identity_mapping(struct pci_dev *pdev)
> > > > +{
> > > > +       struct pci_dev *root_port;
> > > > +       int class = pdev->class >> 8;
> > > > +
> > > > +       /* AMD GPU vendor ID */
> > > > +       if (pdev->vendor != PCI_VENDOR_ID_ATI)
> > > > +               return false;
> > > > +
> > > > +       /* GPU class */
> > > > +       if (class != PCI_CLASS_DISPLAY_VGA &&
> > > > +           class != PCI_CLASS_DISPLAY_OTHER)
> > > > +               return false;
> > > > +
> > > > +       if (pci_upstream_bridge(pdev) &&
> > > 
> > > I don't think you need to check for pci_upstream_bridge() to be
> > > non-NULL.  You already checked that it's an endpoint by looking at
> > > the class.  So an endpoint will be connected to a bridge of some
> > > sort (either a switch internal to the dGPU or to a root port).
> > 
> > I think devices can be passed through to virtualized guests with
> > no upstream bridge visible to the guest, can't they?
> 
> None of the GPUs in APUs support SRIOV, so there isn't a VF to be
> passed in to a guest.  But I guess you could pass the whole endpoint
> in.
> 
> When passed into a guest doesn't it end up associated behind a root
> port in the guest though?

I don't think the Root Port is always passed into the guest.  From
1ae8c4ce1570 ("PCI: Enable AtomicOps only if Root Port supports
them"):

  On s390 and many virtualized guests, the Endpoint is visible but the
  Root Port is not.  In this case, pci_enable_atomic_ops_to_root()
  previously enabled AtomicOps in the Endpoint even though it can't
  tell whether the Root Port supports them as a completer.

Maybe Alex will chime in and tell us more about non-s390 guests.