Re: [PATCH v1] iommu/amd: Set C-bit only for RAM-backed PTEs in IOMMU page tables

[Jason Gunthorpe <jgg@nvidia.com>]

On Thu, Oct 23, 2025 at 11:15:43PM +0800, Wei Wang wrote:
> When SME is enabled, iommu_v1_map_pages() currently sets the C-bit for
> all physical addresses. This is correct for RAM, since the C-bit is
> required by SME to indicate encrypted memory and ensure proper
> encryption/decryption.
> 
> However, applying the C-bit to MMIO addresses is incorrect. Devices and
> PCIe switches do not interpret the C-bit currently, and doing so can break
> PCIe peer-to-peer communication. To avoid this, only set the C-bit when
> the physical address is backed by RAM, and leave MMIO mappings unchanged.
> 
> Fixes: 2543a786aa25 ("iommu/amd: Allow the AMD IOMMU to work with memory encryption")
> Signed-off-by: Wei Wang <wei.w.wang@hotmail.com>
> ---
>  drivers/iommu/amd/io_pgtable.c | 7 +++++--
>  1 file changed, 5 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iommu/amd/io_pgtable.c b/drivers/iommu/amd/io_pgtable.c
> index 70c2f5b1631b..6f395940d0a4 100644
> --- a/drivers/iommu/amd/io_pgtable.c
> +++ b/drivers/iommu/amd/io_pgtable.c
> @@ -353,6 +353,9 @@ static int iommu_v1_map_pages(struct io_pgtable_ops *ops, unsigned long iova,
>  	if (!(prot & IOMMU_PROT_MASK))
>  		goto out;
>  
> +	if (sme_me_mask && page_is_ram(PHYS_PFN(paddr)))
> +		paddr = __sme_set(paddr);

It needs to use the IOMMU_MMIO flag not page_is_ram, which I think got
mangled by the time it reached here..

Though broadly this points to a larger problem, the iommu domain code
should not be trying to guess if a mapping is private or not, this
needs to be passed in from higher level code which knows what state
the PFN is..

Jason