Re: [PATCH 2/2] iommu/amd: Force identity mode for selected GPUs only

Mario, Alex, Felix,


On 7/29/2026 1:27 AM, Mario Limonciello wrote:
> 
> 
> On 7/28/26 14:10, Kuehling, Felix wrote:
>> On 2026-07-28 01:31, Mario Limonciello wrote:
>>> +Felix
>>>
>>> On 7/27/26 23:52, Vasant Hegde wrote:
>>>> Mario,


.../...

> 
> Hmm, I just had a try with this on a few years old APU (PHX).  It's flicker
> central with this (7.2-rc5~ish tree):
> 
> diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
> index 29dc18d3d22e5..1e792cee7f4cd 100644
> --- a/drivers/iommu/amd/iommu.c
> +++ b/drivers/iommu/amd/iommu.c
> @@ -3134,19 +3134,6 @@ static int amd_iommu_def_domain_type(struct device *dev)
>         if (dev_is_pci(dev) && to_pci_dev(dev)->untrusted)
>                 return IOMMU_DOMAIN_DMA;
> 
> -       /*
> -        * Do not identity map IOMMUv2 capable devices when:
> -        *  - memory encryption is active, because some of those devices
> -        *    (AMD GPUs) don't have the encryption bit in their DMA-mask
> -        *    and require remapping.
> -        *  - SNP is enabled, because it prohibits DTE[Mode]=0.
> -        */
> -       if (pdev_pasid_supported(dev_data) &&
> -           !cc_platform_has(CC_ATTR_MEM_ENCRYPT) &&
> -           !amd_iommu_snp_en) {
> -               return IOMMU_DOMAIN_IDENTITY;
> -       }
> -
>         return 0;
>  }
> 
> The flicking is reminencent of issues moving BOs between VRAM and GTT from a few
> years ago.
> 
> So I don't think it can be dropped (just) yet.

Based on discussion so far in this thread and the link Mario shared earlier [1]:
  - We still need identity mapping for APUs. I will fine tune the patch based on
the discussion in this thread.
  - Its fine to drop SNP check
  - I am still not sure its safe to drop SME check (CC_ATTR_MEM_ENCRYPT)
    Because here were are putting all APUs in identity mode.
    Commit ea68573d408f explicitly error out for RAVEN and some of the older APU
platform didn't support SME. But not sure about newer ones.


So I am inclined to keep SME check for now. Once this patch stabilized we can
revisit the SME check?


[1] https://lore.kernel.org/all/[email protected]/

-Vasant