Re: [PATCH v2 6/8] dma-direct: make dma_direct_map_phys() honor DMA_ATTR_CC_SHARED

[Jason Gunthorpe <jgg@ziepe.ca>]

On Wed, Apr 22, 2026 at 11:20:28AM +0530, Aneesh Kumar K.V wrote:
> >> -			if (is_swiotlb_active(dev) &&
> >> -			    !(attrs & DMA_ATTR_REQUIRE_COHERENT))
> >> -				return swiotlb_map(dev, phys, size, dir, attrs);
> >> +		dma_addr = phys_to_dma_encrypted(dev, phys);
> >> +	}
> >>  
> >> -			goto err_overflow;
> >> -		}
> >> +	if (unlikely(!dma_capable(dev, dma_addr, size, true)) ||
> >> +	    dma_kmalloc_needs_bounce(dev, size, dir)) {
> >> +		if (is_swiotlb_active(dev) &&
> >> +		    !(attrs & DMA_ATTR_REQUIRE_COHERENT))
> >> +			return swiotlb_map(dev, phys, size, dir, attrs);
> >> +		goto err_overflow;
> >>  	}
> >
> > Then this movement shouldn't be needed?
> 
> I am still not clear about the use of DMA_ATTR_CC_SHARED here. If the
> resulting DMA address is not dma_capable, I was expecting that we should
> fall back to swiotlb_map().

"resulting" ? From what?

The user provides an address. If the provided address is marked
DMA_ATTR_CC_SHARED, then dma_capable should succeed on a CC
system. Otherwise if !DMA_ATTR_CC_SHARED dma_capable must require T=1,
or fail if T=0.

> That was the intention behind this change.
> However, the other email thread suggests that DMA_ATTR_CC_SHARED is
> always used with swiotlb_force_bounce(). I think we should address that.
> If we do, the goal here would be to check dma_capable for both shared
> and private addresses.

The flow I think should be

 if (force swiotlb)
    then do swiotlb

 if (!dma_capable())
    then do swiotlb

 if (kmalloc_needs_bounce())
    then do swiotlb

 otherwise use the provided phys_addr directly

ie stop using force swiotlb to handle T=0, instead have dma_capable
directly check T together with DMA_ATTR_CC_SHARED.

> For private/protected addresses, swiotlb_map() will currently fail with
> DMA_MAPPING_ERROR because the default io_tlb_mem (dev->dma_io_tlb_mem)
> is decrypted by default

This is a bug in swiotlb. swiotlb must *always* returns something that
is usable by the device, or it is broken. ie the pa it picks must pass
dma_capable:

It must return a buffer that falls within the dma mask

It must return an unprotected buffer if the device is T=0

It must return a protected buffer if the device is T=1 (ie it should
not choose an unprotected buffer just because DMA_ATTR_CC_SHARED, we
might be bouncing because the device dma mask can't reach the
unprotected adress space)

So, when the device is switched to T=1 something also has to go and
fix swiotlb so it is using T=1 memory too, and there should be
defensive WARN_ONs in the swiotlb path that the memory it picked is
suitable.

Jason