Allow ATS to be always on for certain ATS-capable devices

Controlled by the IOMMU driver, ATS is usually enabled "on demand" when a device requests a translation service from its associated IOMMU HW running on the channel of a given PASID. This is working even when a device has no translation on its RID (i.e., the RID is IOMMU bypassed).

However, certain PCIe devices require non-PASID ATS on their RID even when the RID is IOMMU bypassed. Call this "always on".

For instance, the CXL spec notes in "3.2.5.13 Memory Type on CXL.cache":
"To source requests on CXL.cache, devices need to get the Host Physical Address (HPA) from the Host by means of an ATS request on CXL.io."

In other words, the CXL.cache capability requires ATS; otherwise, it can't access host physical memory.

Introduce a new pci_ats_always_on() helper for the IOMMU driver to scan a PCI device and shift ATS policies between "on demand" and "always on".

Add the support for CXL.cache devices first. Pre-CXL devices will be added in quirks.c file.

Note that pci_ats_always_on() validates against pci_ats_supported(), so we ensure that untrusted devices (e.g. external ports) will not be always on. This maintains the existing ATS security policy regarding potential side- channel attacks via ATS.

Suggested-by Vikram Sethi <[email protected]>

Suggested-by Jason Gunthorpe <[email protected]>

Signed-off-by Nicolin Chen <[email protected]>

---
 include/linux/pci-ats.h       |  3 +++
 include/uapi/linux/pci_regs.h |  1 +
 drivers/pci/ats.c             | 44 +++++++++++++++++++++++++++++++++++
 3 files changed, 48 insertions(+)

include/linux/pci-ats.h +3 -0

index 75c6c86cf09dc..d14ba727d38b3 100644
@@ -12,6 +12,7 @@ int pci_prepare_ats(struct pci_dev *dev, int ps);
 void pci_disable_ats(struct pci_dev *dev);
 int pci_ats_queue_depth(struct pci_dev *dev);
 int pci_ats_page_aligned(struct pci_dev *dev);
+bool pci_ats_always_on(struct pci_dev *dev);
 #else /* CONFIG_PCI_ATS */
 static inline bool pci_ats_supported(struct pci_dev *d)
 { return false; }

@@ -24,6 +25,8 @@ static inline int pci_ats_queue_depth(struct pci_dev *d)
 { return -ENODEV; }
 static inline int pci_ats_page_aligned(struct pci_dev *dev)
 { return 0; }
+static inline bool pci_ats_always_on(struct pci_dev *dev)
+{ return false; }
 #endif /* CONFIG_PCI_ATS */
 
 #ifdef CONFIG_PCI_PRI

include/uapi/linux/pci_regs.h +1 -0

index ec1c54b5a3101..ef061c0313ce6 100644
@@ -1349,6 +1349,7 @@
 /* CXL r4.0, 8.1.3: PCIe DVSEC for CXL Device */
 #define PCI_DVSEC_CXL_DEVICE				0
 #define  PCI_DVSEC_CXL_CAP				0xA
+#define   PCI_DVSEC_CXL_CACHE_CAPABLE			_BITUL(0)
 #define   PCI_DVSEC_CXL_MEM_CAPABLE			_BITUL(2)
 #define   PCI_DVSEC_CXL_HDM_COUNT			__GENMASK(5, 4)
 #define  PCI_DVSEC_CXL_CTRL				0xC

drivers/pci/ats.c +0 -0

index ec6c8dbdc5e9c..93060fdc0d3c0 100644

drivers/pci/ats.c +4 -0

+ */
+static bool pci_cxl_ats_always_on(struct pci_dev *pdev)
+{
+	int offset;

drivers/pci/ats.c +24 -0

+
+	return false;
+}
+
+/**
+ * pci_ats_always_on - Whether the PCI device requires ATS to be always enabled
+ * @pdev: the PCI device
+ *
+ * Returns true, if the PCI device requires non-PASID ATS function on an IOMMU
+ * bypassed configuration.
+ */
+bool pci_ats_always_on(struct pci_dev *pdev)
+{
+	if (pci_ats_disabled() || !pci_ats_supported(pdev))
+		return false;
+
+	/* A VF inherits its PF's requirement for ATS function */
+	if (pdev->is_virtfn)
+		pdev = pci_physfn(pdev);
+
+	return pci_cxl_ats_always_on(pdev);
+}
+EXPORT_SYMBOL_GPL(pci_ats_always_on);
+
 #ifdef CONFIG_PCI_PRI
 void pci_pri_init(struct pci_dev *pdev)
 {

Quoted 6 lines · On Mon, 23 Feb 2026 14:52:20 -0800 Nicolin Chen <[email protected]> wrote:

+/*
+ * CXL r4.0, sec 3.2.5.13 Memory Type on CXL.cache notes: to source requests on
+ * CXL.cache, devices need to get the Host Physical Address (HPA) from the Host
+ * by means of an ATS request on CXL.io.
+ *
+ * In other world, CXL.cache devices cannot access physical memory without ATS.

Maybe tweak that to "host physical memory"

There are too many physical memories in CXL land...

Quoted 4 lines

+ */

drivers/pci/ats.c +3 -0

+static bool pci_cxl_ats_always_on(struct pci_dev *pdev)
+{
+	int offset;

drivers/pci/ats.c int pci_ats_page_aligned(struct pci_dev *pdev) · line 227

Quoted 10 lines

drivers/pci/ats.c +10 -0

+	u16 cap;
+
+	offset = pci_find_dvsec_capability(pdev, PCI_VENDOR_ID_CXL,
+					   PCI_DVSEC_CXL_DEVICE);
+	if (!offset)
+		return false;
+
+	pci_read_config_word(pdev, offset + PCI_DVSEC_CXL_CAP, &cap);
+	if (cap & PCI_DVSEC_CXL_CACHE_CAPABLE)
+		return true;

Could just do

	return cap & PCI_DVSEC_CXL_CACHE_CAPABLE;

Unless the thinking is there may be other stuff that comes here.

+/**
+ * pci_ats_always_on - Whether the PCI device requires ATS to be always enabled
+ * @pdev: the PCI device
+ *
+ * Returns true, if the PCI device requires non-PASID ATS function on an IOMMU
+ * bypassed configuration.

Quoted 6 lines · Nicolin Chen

+/**
+ * pci_ats_always_on - Whether the PCI device requires ATS to be always enabled
+ * @pdev: the PCI device
+ *
+ * Returns true, if the PCI device requires non-PASID ATS function on an IOMMU
+ * bypassed configuration.

Including iommu-specific policies and configurations here might cause confusion. How about making it simply as: "Returns true if the PCI device requires ATS to be enabled for functional operation"?

When a device's default substream attaches to an identity domain, the SMMU driver currently sets the device's STE between two modes:

Mode 1: Cfg=Translate, S1DSS=Bypass, EATS=1
Mode 2: Cfg=bypass (EATS is ignored by HW)

When there is an active PASID (non-default substream), mode 1 is used. And when there is no PASID support or no active PASID, mode 2 is used.

The driver will also downgrade an STE from mode 1 to mode 2, when the last active substream becomes inactive.

However, there are PCIe devices that demand ATS to be always on. For these devices, their STEs have to use the mode 1 as HW ignores EATS with mode 2.

Change the driver accordingly:
- always use the mode 1
- never downgrade to mode 2
- allocate and retain a CD table (see note below)

Note that these devices might not support PASID, i.e. doing non-PASID ATS. In such a case, the ssid_bits is set to 0. However, s1cdmax must be set to a !0 value in order to keep the S1DSS field effective. Thus, when a master requires ats_always_on, set its s1cdmax to minimal 1, meaning the CD table will have a dummy entry (SSID=1) that will be never used.

Now, for these device, arm_smmu_cdtab_allocated() will always return true, v.s. false prior to this change. When its default substream is attached to an IDENTITY domain, its first CD is NULL in the table, which is a totally valid case. Thus, add "!master->ats_always_on" to the condition.

Signed-off-by Nicolin Chen <[email protected]>

In my head at least, it would be nice if a driver had to explicitly opt in to this behavior. The presence of CXL.cache support for instance doesn't actually mean the driver is going to enable it. However it is probably harmless so lets go with this as path of least resistance.

Quoted 4 lines · Jonathan Cameron

In my head at least, it would be nice if a driver had to explicitly opt in to this behavior. The presence of CXL.cache support for instance doesn't actually mean the driver is going to enable it. However it is probably harmless so lets go with this as path of least resistance.

That same remark applies to ATS in general, we have no idea if the device is going to use it when turned on or not..

Generally Linux has taken the approach of almost always enabling ATS if the device offers the PCIe capability.

The purpose of this series is to close of the few "almost" cases so it is always on.

Jason

Quoted 7 lines · On Tue, 24 Feb 2026 10:51:02 -0400 Jason Gunthorpe <[email protected]> wrote:

Quoted 4 lines · Jonathan Cameron

In my head at least, it would be nice if a driver had to explicitly opt in to this behavior. The presence of CXL.cache support for instance doesn't actually mean the driver is going to enable it. However it is probably harmless so lets go with this as path of least resistance.

Quoted 2 lines

That same remark applies to ATS in general, we have no idea if the device is going to use it when turned on or not..

Yup. Understood. That's the bit that smells bad to me.

Quoted 10 lines · Jonathan Cameron

Quoted 7 lines · On Tue, 24 Feb 2026 10:51:02 -0400 Jason Gunthorpe <[email protected]> wrote:

Quoted 4 lines · Jonathan Cameron

In my head at least, it would be nice if a driver had to explicitly opt in to this behavior. The presence of CXL.cache support for instance doesn't actually mean the driver is going to enable it. However it is probably harmless so lets go with this as path of least resistance.

Quoted 4 lines

Quoted 2 lines

That same remark applies to ATS in general, we have no idea if the device is going to use it when turned on or not..

Yup. Understood. That's the bit that smells bad to me.

Do you have thoughts on when this is a problem (aside from device pre-acceptance security already discussed)? So far I haven't heard complaining on this point..

Jason