RE: [PATCH v1 4/8] dma-mapping: Keep DMA memory private for capable devices

[Shameer Kolothum Thodi]

> -----Original Message-----
> From: Nicolin Chen <nicolinc@xxxxxxxxxx>
> Sent: 10 September 2026 04:33
> To: Jason Gunthorpe <jgg@xxxxxxxxxx>; Catalin Marinas
> <catalin.marinas@xxxxxxx>; Will Deacon <will@xxxxxxxxxx>;
> joro@xxxxxxxxxx; Robin Murphy <robin.murphy@xxxxxxx>;
> rafael@xxxxxxxxxx; Danilo Krummrich <dakr@xxxxxxxxxx>; Marek Szyprowski
> <m.szyprowski@xxxxxxxxxxx>; aneesh.kumar@xxxxxxxxxx
> Cc: Mark Rutland <mark.rutland@xxxxxxx>; Greg Kroah-Hartman
> <gregkh@xxxxxxxxxxxxxxxxxxx>; Suzuki K Poulose
> <suzuki.poulose@xxxxxxx>; Gavin Shan <gshan@xxxxxxxxxx>; Vikram Sethi
> <vsethi@xxxxxxxxxx>; Anshuman Khandual
> <anshuman.khandual@xxxxxxx>; Shanker Donthineni
> <sdonthineni@xxxxxxxxxx>; Mostafa Saleh <smostafa@xxxxxxxxxx>;
> rppt@xxxxxxxxxx; Thomas Huth <thuth@xxxxxxxxxx>; Marc Zyngier
> <maz@xxxxxxxxxx>; Ryan Roberts <ryan.roberts@xxxxxxx>; kas@xxxxxxxxxx;
> Kohei Enju <enju.kohei@xxxxxxxxxxx>; Shaopeng Tan
> <tan.shaopeng@xxxxxxxxxxxxxx>; Ard Biesheuvel <ardb@xxxxxxxxxx>; James
> Morse <james.morse@xxxxxxx>; Steven Price <steven.price@xxxxxxx>;
> Sang-Heon Jeon <ekffu200098@xxxxxxxxx>; Omar Sandoval
> <osandov@xxxxxx>; Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>; Jinjie
> Ruan <ruanjinjie@xxxxxxxxxx>; Sam Edwards <cfsworks@xxxxxxxxx>;
> Douglas Anderson <dianders@xxxxxxxxxxxx>; Florian Fainelli
> <florian.fainelli@xxxxxxxxxxxx>; Chen-Yu Tsai <wenst@xxxxxxxxxxxx>;
> Huacai Chen <chenhuacai@xxxxxxxxxx>; Thomas Zimmermann
> <tzimmermann@xxxxxxx>; Pranjal Shrivastava <praan@xxxxxxxxxx>; Ashish
> Mhetre <amhetre@xxxxxxxxxx>; Shameer Kolothum Thodi
> <skolothumtho@xxxxxxxxxx>; linux-arm-kernel@xxxxxxxxxxxxxxxxxxx; linux-
> kernel@xxxxxxxxxxxxxxx; iommu@xxxxxxxxxxxxxxx; driver-core@xxxxxxxxxxxxxxx;
> Sonang Patel <sonangp@xxxxxxxxxx>; Ankit Agrawal <ankita@xxxxxxxxxx>
> Subject: [PATCH v1 4/8] dma-mapping: Keep DMA memory private for
> capable devices
> 
> Architecture code can require devices to use unencrypted memory. This makes
> the DMA API use shared memory for coherent allocations and bounce
> streaming
> mappings through SWIOTLB.
> 
> A device marked with DEV_FLAG_DMA_CC_PRIVATE can reach private
> memory
> directly. Add dma_require_decrypted() to combine force_dma_unencrypted()
> with the new device flag, and use it throughout the generic DMA code.
> 
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Nicolin Chen <nicolinc@xxxxxxxxxx>
> ---
>  include/linux/dma-direct.h |  7 ++++++-
>  kernel/dma/direct.c        | 16 ++++++++--------
>  kernel/dma/mapping.c       |  2 +-
>  kernel/dma/swiotlb.c       |  2 +-
>  4 files changed, 16 insertions(+), 11 deletions(-)
> 
> diff --git a/include/linux/dma-direct.h b/include/linux/dma-direct.h
> index daa31a1adf7b0..fb35ca27941cc 100644
> --- a/include/linux/dma-direct.h
> +++ b/include/linux/dma-direct.h
> @@ -134,6 +134,11 @@ static inline bool force_dma_unencrypted(struct
> device *dev)
>  }
>  #endif /* CONFIG_ARCH_HAS_FORCE_DMA_UNENCRYPTED */
> 
> +static inline bool dma_require_decrypted(struct device *dev)
> +{
> +	return !dev_dma_cc_private(dev) && force_dma_unencrypted(dev);
> +}
> +
>  static inline bool dma_capable(struct device *dev, dma_addr_t addr, size_t
> size,
>  		bool is_ram, unsigned long attrs)
>  {
> @@ -146,7 +151,7 @@ static inline bool dma_capable(struct device *dev,
> dma_addr_t addr, size_t size,
>  	 * requires unencrypted DMA addresses. Treat it as not DMA-capable
>  	 * so the caller can fall back to a suitable SWIOTLB pool.
>  	 */
> -	if (!(attrs & DMA_ATTR_CC_SHARED) &&
> force_dma_unencrypted(dev))
> +	if (!(attrs & DMA_ATTR_CC_SHARED) &&
> dma_require_decrypted(dev))
>  		return false;
> 
>  	if (is_ram && !IS_ENABLED(CONFIG_ARCH_DMA_ADDR_T_64BIT) &&
> diff --git a/kernel/dma/direct.c b/kernel/dma/direct.c
> index da665ca22d5c0..fbddab9740162 100644
> --- a/kernel/dma/direct.c
> +++ b/kernel/dma/direct.c
> @@ -41,7 +41,7 @@ static inline struct page *dma_direct_to_page(struct
> device *dev,
> 
>  u64 dma_direct_get_required_mask(struct device *dev)
>  {
> -	bool require_decrypted = force_dma_unencrypted(dev);
> +	bool require_decrypted = dma_require_decrypted(dev);
>  	phys_addr_t phys = ((phys_addr_t)max_pfn << PAGE_SHIFT) - 1;
>  	u64 max_dma = phys_to_dma_direct(dev, phys, require_decrypted);
> 
> @@ -72,7 +72,7 @@ static gfp_t dma_direct_optimal_gfp_mask(struct device
> *dev, u64 *phys_limit)
> 
>  bool dma_coherent_ok(struct device *dev, phys_addr_t phys, size_t size)
>  {
> -	bool require_decrypted = force_dma_unencrypted(dev);
> +	bool require_decrypted = dma_require_decrypted(dev);
>  	dma_addr_t dma_addr = phys_to_dma_direct(dev, phys,
> require_decrypted);
> 
>  	if (dma_addr == DMA_MAPPING_ERROR)
> @@ -208,7 +208,7 @@ void *dma_direct_alloc(struct device *dev, size_t size,
>  	struct page *page;
>  	void *cpu_addr;
> 
> -	if (force_dma_unencrypted(dev))
> +	if (dma_require_decrypted(dev))
>  		attrs |= __DMA_ATTR_ALLOC_CC_SHARED;
> 
>  	if (attrs & __DMA_ATTR_ALLOC_CC_SHARED) {
> @@ -368,7 +368,7 @@ void dma_direct_free(struct device *dev, size_t size,
>  	 * If the allocation used decrypted/shared backing pages, restore
>  	 * the encryption state on free.
>  	 */
> -	if (force_dma_unencrypted(dev))
> +	if (dma_require_decrypted(dev))
>  		attrs |= __DMA_ATTR_ALLOC_CC_SHARED;
> 
>  	if (attrs & __DMA_ATTR_ALLOC_CC_SHARED)
> @@ -436,7 +436,7 @@ struct page *dma_direct_alloc_pages(struct device
> *dev, size_t size,
>  	struct page *page;
>  	void *cpu_addr;
> 
> -	if (force_dma_unencrypted(dev))
> +	if (dma_require_decrypted(dev))
>  		attrs |= __DMA_ATTR_ALLOC_CC_SHARED;
> 
>  	if ((attrs & __DMA_ATTR_ALLOC_CC_SHARED) &&
> dma_direct_use_pool(dev, gfp))
> @@ -480,7 +480,7 @@ void dma_direct_free_pages(struct device *dev,
> size_t size,
>  	 * if the device had requested for an unencrypted buffer,
>  	 * convert it to encrypted on free
>  	 */
> -	bool mark_mem_encrypted = force_dma_unencrypted(dev);
> +	bool mark_mem_encrypted = dma_require_decrypted(dev);
> 
>  	/* If page is not from an atomic pool, dma_free_from_pool_page()
> fails */
>  	if (IS_ENABLED(CONFIG_DMA_COHERENT_POOL) &&
> @@ -649,7 +649,7 @@ int dma_direct_mmap(struct device *dev, struct
> vm_area_struct *vma,
>  	const pgoff_t pgoff_end = vma_end_pgoff(vma);
>  	int ret = -ENXIO;
> 
> -	if (force_dma_unencrypted(dev))
> +	if (dma_require_decrypted(dev))
>  		attrs |= DMA_ATTR_CC_SHARED;
> 
>  	vma->vm_page_prot = dma_pgprot(dev, vma->vm_page_prot, attrs);
> @@ -798,7 +798,7 @@ size_t dma_direct_max_mapping_size(struct device
> *dev)
>  	/* If SWIOTLB is active, use its maximum mapping size */
>  	if (is_swiotlb_active(dev) &&
>  	    (dma_addressing_limited(dev) || is_swiotlb_force_bounce(dev) ||
> -	     force_dma_unencrypted(dev)))
> +	     dma_require_decrypted(dev)))
>  		return swiotlb_max_mapping_size(dev);
> 
>  	return SIZE_MAX;
> diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c
> index 11c127ad45370..e7c48a925b7ac 100644
> --- a/kernel/dma/mapping.c
> +++ b/kernel/dma/mapping.c
> @@ -673,7 +673,7 @@ void *dma_alloc_attrs(struct device *dev, size_t size,
> dma_addr_t *dma_handle,
>  		return NULL;
>  	}
> 
> -	if (force_dma_unencrypted(dev))
> +	if (dma_require_decrypted(dev))
>  		attrs |= __DMA_ATTR_ALLOC_CC_SHARED;
> 
>  	if (dma_alloc_from_dev_coherent(dev, size, dma_handle,
> &cpu_addr)) {
> diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
> index ded7016a46a71..d08a3643ded14 100644
> --- a/kernel/dma/swiotlb.c
> +++ b/kernel/dma/swiotlb.c
> @@ -1552,7 +1552,7 @@ phys_addr_t swiotlb_tbl_map_single(struct device
> *dev, phys_addr_t orig_addr,
>  	if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)) {
> 
>  		/* swiotlb pool is incorrect for this device */
> -		if (unlikely(mem->cc_shared !=
> force_dma_unencrypted(dev)))
> +		if (unlikely(mem->cc_shared != dma_require_decrypted(dev)))

Just wondering, what if a device with CC_PRIVATE set has addressing
limitations and needs a private bounce buffer?  Or is that not a use case
at all? 

Thanks,
Shameer