Re: [PATCH v3 3/4] dma: swiotlb: Centralize memory-encryption pool sizing

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Skipping SWIOTLB_POOL_CC_GUEST when a restricted DMA pool is present can result in SWIOTLB_POOL_NONE or SWIOTLB_POOL_MINIMAL being selected, breaking DMA for all other devices.
--

commit d8ab20a637a8736036e923dfa3f89a8da55215c3
Author: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>

dma: swiotlb: Centralize memory-encryption pool sizing

This patch centralizes SWIOTLB memory-encryption pool sizing for guests into
the SWIOTLB core. It sizes the confidential guest pool to 6% of guest memory
by default and records the presence of restricted DMA pools to avoid selecting
the confidential-guest policy solely based on guest memory encryption.

> diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
> index 90e0bfd0715cf..c4611b2c45403 100644
> --- a/kernel/dma/swiotlb.c
> +++ b/kernel/dma/swiotlb.c

[ ... ]

> @@ -509,7 +553,8 @@ swiotlb_select_pool_policy(unsigned int flags)
>  	if (swiotlb_force_disable)
>  		return SWIOTLB_POOL_NONE;
>  
> -	if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT))
> +	if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT) &&
> +	    !restricted_dma_pool_present)
>  		return SWIOTLB_POOL_CC_GUEST;

[Severity: High]
Does skipping SWIOTLB_POOL_CC_GUEST here leave the system without a proper
fallback for non-restricted devices?

Looking at swiotlb_select_pool_policy() in kernel/dma/swiotlb.c, if a
confidential guest boots with a restricted DMA pool present in the Device
Tree, and system RAM is small enough that SWIOTLB_INIT_ADDRESSING_LIMIT is
not set (e.g., <= 4GB), this check will skip SWIOTLB_POOL_CC_GUEST. 

The function then falls through all the way to SWIOTLB_POOL_MINIMAL (a tiny
1MB/GB pool) or SWIOTLB_POOL_NONE. If it returns SWIOTLB_POOL_NONE,
swiotlb_init_remap() will exit without allocating a default SWIOTLB pool.
As a result, unassigned devices that still rely on the default pool for
bounce buffers will fail to map DMA memory, potentially leading to I/O
errors or boot panics.

Should this path safely fall back to SWIOTLB_POOL_DEFAULT when a restricted
DMA pool is present, to ensure a standard default pool is still allocated?

>  
>  	if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT))
>  		return SWIOTLB_POOL_DEFAULT;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904101810.1193505-1-aneesh.kumar@kernel.org?part=3