Re: [RFC PATCH v2 2/2] dma: swiotlb: Initialize and size shared default pools for memory encryption

[Catalin Marinas <catalin.marinas@arm.com>]

On Thu, Aug 13, 2026 at 03:55:21PM +0530, Aneesh Kumar K.V (Arm) wrote:
> diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
> index 9f5b366d2086..c3188ca878f3 100644
> --- a/arch/arm64/mm/init.c
> +++ b/arch/arm64/mm/init.c
> @@ -338,12 +338,8 @@ void __init arch_setup_zero_pages(void)
>  void __init arch_mm_preinit(void)
>  {
>  	unsigned int flags = SWIOTLB_VERBOSE;
> -	/* pKVM uses restricted-dma-pool */
> -	bool cc_guest = is_realm_world();
>  
> -	if (cc_guest)
> -		flags |= SWIOTLB_INIT_CC_SHARED;
> -	else if (max_pfn > PFN_DOWN(arm64_dma_phys_limit))
> +	if (max_pfn > PFN_DOWN(arm64_dma_phys_limit))
>  		flags |= SWIOTLB_INIT_ADDRESSING_LIMIT;
>  
>  	swiotlb_init(flags);

This looks fine. As I mentioned on patch 1, we might as well move this
hunk over there and avoid the flag definition.

> @@ -102,9 +101,6 @@ void __init mem_encrypt_init(void)
>  
>  void __init mem_encrypt_setup_arch(void)
>  {
> -	phys_addr_t total_mem = memblock_phys_mem_size();
> -	unsigned long size;
> -
>  	/*
>  	 * Do RMP table fixups after the e820 tables have been setup by
>  	 * e820__memory_setup().
> @@ -112,33 +108,9 @@ void __init mem_encrypt_setup_arch(void)
>  	if (cc_platform_has(CC_ATTR_HOST_SEV_SNP))
>  		snp_fixup_e820_tables();
>  
> -	if (cc_platform_has(CC_ATTR_MEM_ENCRYPT))
> -		x86_swiotlb_flags |= SWIOTLB_INIT_CC_SHARED;
> -
>  	if (!cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT))
>  		return;
>  
> -	/*
> -	 * For SEV and TDX, all DMA has to occur via shared/unencrypted pages.
> -	 * Kernel uses SWIOTLB to make this happen without changing device
> -	 * drivers. However, depending on the workload being run, the
> -	 * default 64MB of SWIOTLB may not be enough and SWIOTLB may
> -	 * run out of buffers for DMA, resulting in I/O errors and/or
> -	 * performance degradation especially with high I/O workloads.
> -	 *
> -	 * Adjust the default size of SWIOTLB using a percentage of guest
> -	 * memory for SWIOTLB buffers. Also, as the SWIOTLB bounce buffer
> -	 * memory is allocated from low memory, ensure that the adjusted size
> -	 * is within the limits of low available memory.
> -	 *
> -	 * The percentage of guest memory used here for SWIOTLB buffers
> -	 * is more of an approximation of the static adjustment which
> -	 * 64MB for <1G, and ~128M to 256M for 1G-to-4G, i.e., the 6%
> -	 */
> -	size = total_mem * 6 / 100;
> -	size = clamp_val(size, IO_TLB_DEFAULT_SIZE, SZ_1G);
> -	swiotlb_adjust_size(size);
> -
>  	/* Set restricted memory access for virtio. */
>  	virtio_set_mem_acc_cb(virtio_require_restricted_mem_acc);
>  }

Credit to claude, it noticed a slight change in behaviour for x86 w.r.t.
the crash kernel reservation. crash_low_size_default() reads the swiotlb
size but the resizing now happens after arch_reserve_crashkernel().
Maybe not an issue.

Alternatively, we could build the sizing logic into
swiotlb_size_or_default() but I haven't checked whether we have the
right information when this function is called.

> @@ -382,12 +374,54 @@ static void __init *swiotlb_memblock_alloc(unsigned long nslabs,
>  	return tlb;
>  }
>  
> +static void __init swiotlb_adjust_cc_attributes(void)
> +{
> +	unsigned long size;
> +	phys_addr_t total_mem = memblock_phys_mem_size();
> +
> +	/* Do not resize for host memory encryption. */
> +	if (!cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT))
> +		return;
> +
> +	/*
> +	 * For SEV and TDX and CCA, all DMA has to occur via
> +	 * shared/unencrypted pages. Kernel uses SWIOTLB to make this
> +	 * happen without changing device drivers. However, depending on
> +	 * the workload being run, the default 64MB of SWIOTLB may not be
> +	 * enough and SWIOTLB may run out of buffers for DMA, resulting in
> +	 * I/O errors and/or performance degradation especially with high
> +	 * I/O workloads.
> +	 *
> +	 * Adjust the default size of SWIOTLB using a percentage of guest
> +	 * memory for SWIOTLB buffers. Also, as the SWIOTLB bounce buffer
> +	 * memory is allocated from low memory, ensure that the adjusted
> +	 * size is within the limits of low available memory.
> +	 *
> +	 * The percentage of guest memory used here for SWIOTLB buffers is
> +	 * more of an approximation of the static adjustment which 64MB for
> +	 * <1G, and ~128M to 256M for 1G-to-4G, i.e., the 6%
> +	 */
> +	size = total_mem * 6 / 100;
> +	size = clamp_val(size, IO_TLB_DEFAULT_SIZE, SZ_1G);
> +	swiotlb_adjust_size(size);
> +
> +	if (!IS_ENABLED(CONFIG_SWIOTLB_DYNAMIC))
> +		pr_info("Consider enabling CONFIG_SWIOTLB_DYNAMIC for memory-encrypted systems\n");

I agree with Michael, let's drop this pr_info().

> +}
> +
>  static bool __init swiotlb_kmalloc_needs_bounce(void)
>  {
>  	return IS_ENABLED(CONFIG_DMA_BOUNCE_UNALIGNED_KMALLOC) &&
>  	       (dma_get_cache_alignment() > 1);
>  }
>  
> +static bool __init swiotlb_default_pool_needs_cc_shared(void)
> +{
> +	/* A restricted DMA pool provides the shared buffers instead. */
> +	return cc_platform_has(CC_ATTR_MEM_ENCRYPT) &&
> +	       !restricted_dma_pool_present;
> +}

I don't think restricted_dma_pool_present should change the cc_shared
attribute. The rmem pool is all about sizing the swiotlb, not disabling
sharing.

Thinking some more, if other archs don't like rmem pool influencing the
default swiotlb size, we could add a flag (SWIOTLB_SKIP_IF_RMEM_POOL or
some better name). But only if people dislike the heuristics.

> @@ -437,9 +469,11 @@ void __init swiotlb_init_remap(unsigned int flags,
>  		io_tlb_default_mem.phys_limit = ARCH_LOW_ADDRESS_LIMIT;
>  #endif
>  
> -	if (!(flags & (SWIOTLB_INIT_ADDRESSING_LIMIT |
> -		       SWIOTLB_INIT_CC_SHARED)) &&
> -	    swiotlb_kmalloc_needs_bounce()) {
> +	if (swiotlb_default_pool_needs_cc_shared()) {
> +		io_tlb_default_mem.cc_shared = true;
> +		swiotlb_adjust_cc_attributes();
> +	} else if (!(flags & SWIOTLB_INIT_ADDRESSING_LIMIT) &&
> +		   swiotlb_kmalloc_needs_bounce()) {

I think at a high level, we need (i.e. separate attributed from sizing):

	if (cc_platform_has(CC_ATTR_MEM_ENCRYPT))
		io_tlb_default_mem.cc_shared = true;

	if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT)) {
		if (!restricted_dma_pool_present)
			swiotlb_adjust_cc_size();	/* 6%, clamped */
	} else if (!(flags & SWIOTLB_INIT_ADDRESSING_LIMIT) &&
		   swiotlb_kmalloc_needs_bounce()) {
		swiotlb_shrink_for_kmalloc();		/* 1MB per 1GB */
	}

-- 
Catalin