[PATCH RFC 0/2] iommu/dma: Fix DMA_ATTR_MMIO swiotlb rejection

[PATCH RFC 0/2] iommu/dma: Fix DMA_ATTR_MMIO swiotlb rejection

[Peng Fan (OSS)]

Commit f9374de14c0e8 ("iommu/dma: implement DMA_ATTR_MMIO for
iommu_dma_(un)map_phys()") and commit c288d657dd515 ("iommu/dma: implement
DMA_ATTR_MMIO for dma_iova_link().") added DMA_ATTR_MMIO support to skip
swiotlb bouncing and cache flushing for MMIO resources. However, both
implementations placed the DMA_ATTR_MMIO check inside the swiotlb bounce block,
causing non-page-aligned MMIO mappings to be rejected outright instead of
skipping the bounce and proceeding to create the IOVA mapping.

This breaks dma_map_resource() for any non-page-aligned device register when
behind an IOMMU: DMA controllers that map peripheral FIFO addresses
(e.g. SPI controller TX/RX data registers) through an IOMMU for per-channel
isolation.

Both patches move the DMA_ATTR_MMIO check before the swiotlb block so MMIO,
resources skip the entire bounce path and fall through directly to the IOMMU
mapping function.

Tested on NXP i.MX95 with ARM SMMUv3 where the fsl-edma DMA controller maps
SPI peripheral FIFO registers (non-page-aligned) via dma_map_resource()
through per-channel IOMMU domains. Only the iommu_dma_map_phys() path was
exercised; the dma_iova_link() fix is by code inspection of the same pattern.

Signed-off-by: Peng Fan <peng.fan@nxp.com>
---
Peng Fan (2):
      iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys
      iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in dma_iova_link()

 drivers/iommu/dma-iommu.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
---
base-commit: e6e35979777d646fe3c7c94dca7dd32fb25d45f4
change-id: 20260916-iommu-dma-fix-9f55af1beb46

Best regards,
--  
Peng Fan <peng.fan@nxp.com>

[PATCH RFC 1/2] iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys

[Peng Fan (OSS)]

From: Peng Fan <peng.fan@nxp.com>

MMIO resources mapped via dma_map_resource() carry DMA_ATTR_MMIO. These
never need swiotlb bounce buffering, but the current code enters the
swiotlb path when the physical address is not page-aligned, then rejects
the mapping because MMIO cannot be bounced.

Move the DMA_ATTR_MMIO check before the swiotlb block so the entire bounce
path is skipped for MMIO, falling through directly to __iommu_dma_map()
which creates the IOVA mapping.

Fixes: f9374de14c0e8 ("iommu/dma: implement DMA_ATTR_MMIO for iommu_dma_(un)map_phys()")
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Peng Fan <peng.fan@nxp.com>
---
 drivers/iommu/dma-iommu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 65d692ec7fced..26b9c2d71cd30 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -1228,9 +1228,9 @@ dma_addr_t iommu_dma_map_phys(struct device *dev, phys_addr_t phys, size_t size,
 	 * If both the physical buffer start address and size are page aligned,
 	 * we don't need to use a bounce page.
 	 */
-	if (dev_use_swiotlb(dev, size, dir) &&
+	if (!(attrs & DMA_ATTR_MMIO) && dev_use_swiotlb(dev, size, dir) &&
 	    iova_unaligned(iovad, phys, size)) {
-		if (attrs & (DMA_ATTR_MMIO | DMA_ATTR_REQUIRE_COHERENT))
+		if (attrs & DMA_ATTR_REQUIRE_COHERENT)
 			return DMA_MAPPING_ERROR;
 
 		phys = iommu_dma_map_swiotlb(dev, phys, size, dir, attrs);

-- 
2.34.1

Re: [PATCH RFC 1/2] iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys

[Robin Murphy]

On 16/09/2026 4:23 pm, Peng Fan (OSS) wrote:
> From: Peng Fan <peng.fan@nxp.com>
> 
> MMIO resources mapped via dma_map_resource() carry DMA_ATTR_MMIO. These
> never need swiotlb bounce buffering, but the current code enters the
> swiotlb path when the physical address is not page-aligned, then rejects
> the mapping because MMIO cannot be bounced.
> 
> Move the DMA_ATTR_MMIO check before the swiotlb block so the entire bounce
> path is skipped for MMIO, falling through directly to __iommu_dma_map()
> which creates the IOVA mapping.

Acked-by: Robin Murphy <robin.murphy@arm.comn>

I'd agree that we shouldn't need patch #2 - I don't see any good reason 
to ever try to use dma_iova_link() instead of dma_map_resource() for 
mapping actual device data registers, and for the link API use-cases 
where the "MMIO" is peer device memory and IOMMU isolation is more 
relevant, it seems sensible to keep the alignment constraint unless and 
until there is a definite compelling need to do otherwise.

Thanks,
Robin.

> Fixes: f9374de14c0e8 ("iommu/dma: implement DMA_ATTR_MMIO for iommu_dma_(un)map_phys()")
> Assisted-by: Claude:claude-opus-4-6
> Signed-off-by: Peng Fan <peng.fan@nxp.com>
> ---
>   drivers/iommu/dma-iommu.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
> index 65d692ec7fced..26b9c2d71cd30 100644
> --- a/drivers/iommu/dma-iommu.c
> +++ b/drivers/iommu/dma-iommu.c
> @@ -1228,9 +1228,9 @@ dma_addr_t iommu_dma_map_phys(struct device *dev, phys_addr_t phys, size_t size,
>   	 * If both the physical buffer start address and size are page aligned,
>   	 * we don't need to use a bounce page.
>   	 */
> -	if (dev_use_swiotlb(dev, size, dir) &&
> +	if (!(attrs & DMA_ATTR_MMIO) && dev_use_swiotlb(dev, size, dir) &&
>   	    iova_unaligned(iovad, phys, size)) {
> -		if (attrs & (DMA_ATTR_MMIO | DMA_ATTR_REQUIRE_COHERENT))
> +		if (attrs & DMA_ATTR_REQUIRE_COHERENT)
>   			return DMA_MAPPING_ERROR;
>   
>   		phys = iommu_dma_map_swiotlb(dev, phys, size, dir, attrs);
> 

[PATCH RFC 2/2] iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in dma_iova_link()

[Peng Fan (OSS)]

From: Peng Fan <peng.fan@nxp.com>

Same issue as the iommu_dma_map_phys() fix: MMIO resources never need
swiotlb bounce buffering, but dma_iova_link() enters the swiotlb path
when the physical address is not page-aligned, then rejects the mapping
with -EPERM.

Move the DMA_ATTR_MMIO check before the swiotlb block so the entire bounce
path is skipped for MMIO, falling through directly to __dma_iova_link()
which creates the IOMMU mapping.

Fixes: c288d657dd515 ("iommu/dma: implement DMA_ATTR_MMIO for dma_iova_link().")
Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Peng Fan <peng.fan@nxp.com>
---
 drivers/iommu/dma-iommu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 26b9c2d71cd30..6807430ee3ab0 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -1998,9 +1998,9 @@ int dma_iova_link(struct device *dev, struct dma_iova_state *state,
 	if (!dev_is_dma_coherent(dev) && (attrs & DMA_ATTR_REQUIRE_COHERENT))
 		return -EOPNOTSUPP;
 
-	if (dev_use_swiotlb(dev, size, dir) &&
+	if (!(attrs & DMA_ATTR_MMIO) && dev_use_swiotlb(dev, size, dir) &&
 	    iova_unaligned(iovad, phys, size)) {
-		if (attrs & (DMA_ATTR_MMIO | DMA_ATTR_REQUIRE_COHERENT))
+		if (attrs & DMA_ATTR_REQUIRE_COHERENT)
 			return -EPERM;
 
 		return iommu_dma_iova_link_swiotlb(dev, state, phys, offset,

-- 
2.34.1

Re: [PATCH RFC 0/2] iommu/dma: Fix DMA_ATTR_MMIO swiotlb rejection

[Leon Romanovsky]

On Wed, Sep 16, 2026 at 11:23:32PM +0800, Peng Fan (OSS) wrote:
> Commit f9374de14c0e8 ("iommu/dma: implement DMA_ATTR_MMIO for
> iommu_dma_(un)map_phys()") and commit c288d657dd515 ("iommu/dma: implement
> DMA_ATTR_MMIO for dma_iova_link().") added DMA_ATTR_MMIO support to skip
> swiotlb bouncing and cache flushing for MMIO resources. However, both
> implementations placed the DMA_ATTR_MMIO check inside the swiotlb bounce block,
> causing non-page-aligned MMIO mappings to be rejected outright instead of
> skipping the bounce and proceeding to create the IOVA mapping.
> 
> This breaks dma_map_resource() for any non-page-aligned device register when
> behind an IOMMU: DMA controllers that map peripheral FIFO addresses
> (e.g. SPI controller TX/RX data registers) through an IOMMU for per-channel
> isolation.
> 
> Both patches move the DMA_ATTR_MMIO check before the swiotlb block so MMIO,
> resources skip the entire bounce path and fall through directly to the IOMMU
> mapping function.

While I understand the rationale behind the first patch, why do we need the
second one? Do we want to allow unaligned addresses for the _link_ as well?
Current users don't need it.

Thanks

> 
> Tested on NXP i.MX95 with ARM SMMUv3 where the fsl-edma DMA controller maps
> SPI peripheral FIFO registers (non-page-aligned) via dma_map_resource()
> through per-channel IOMMU domains. Only the iommu_dma_map_phys() path was
> exercised; the dma_iova_link() fix is by code inspection of the same pattern.
> 
> Signed-off-by: Peng Fan <peng.fan@nxp.com>
> ---
> Peng Fan (2):
>       iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys
>       iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in dma_iova_link()
> 
>  drivers/iommu/dma-iommu.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> ---
> base-commit: e6e35979777d646fe3c7c94dca7dd32fb25d45f4
> change-id: 20260916-iommu-dma-fix-9f55af1beb46
> 
> Best regards,
> --  
> Peng Fan <peng.fan@nxp.com>
> 
> 

Re: [PATCH RFC 0/2] iommu/dma: Fix DMA_ATTR_MMIO swiotlb rejection

[Peng Fan]

Hi Leon,

On Fri, Sep 18, 2026 at 03:37:36PM +0300, Leon Romanovsky wrote:
>On Wed, Sep 16, 2026 at 11:23:32PM +0800, Peng Fan (OSS) wrote:
>> Commit f9374de14c0e8 ("iommu/dma: implement DMA_ATTR_MMIO for
>> iommu_dma_(un)map_phys()") and commit c288d657dd515 ("iommu/dma: implement
>> DMA_ATTR_MMIO for dma_iova_link().") added DMA_ATTR_MMIO support to skip
>> swiotlb bouncing and cache flushing for MMIO resources. However, both
>> implementations placed the DMA_ATTR_MMIO check inside the swiotlb bounce block,
>> causing non-page-aligned MMIO mappings to be rejected outright instead of
>> skipping the bounce and proceeding to create the IOVA mapping.
>> 
>> This breaks dma_map_resource() for any non-page-aligned device register when
>> behind an IOMMU: DMA controllers that map peripheral FIFO addresses
>> (e.g. SPI controller TX/RX data registers) through an IOMMU for per-channel
>> isolation.
>> 
>> Both patches move the DMA_ATTR_MMIO check before the swiotlb block so MMIO,
>> resources skip the entire bounce path and fall through directly to the IOMMU
>> mapping function.
>
>While I understand the rationale behind the first patch, why do we need the
>second one? Do we want to allow unaligned addresses for the _link_ as well?
>Current users don't need it.

My intention with the second patch was to make the DMA_ATTR_MMIO handling
consistent with iommu_dma_map_phys(), since MMIO cannot be bounced by
SWIOTLB in either case.

However, I don't have a dma_iova_link() user that requires an
unaligned MMIO address, so no need to relax the existing restriction there.
 
I'll drop the second patch and keep this fix scoped to iommu_dma_map_phys()
in v2. Does that sounds good to you?

BTW, does patch 1 look good to you?

Thanks,
Peng

>
>Thanks
>
>> 
>> Tested on NXP i.MX95 with ARM SMMUv3 where the fsl-edma DMA controller maps
>> SPI peripheral FIFO registers (non-page-aligned) via dma_map_resource()
>> through per-channel IOMMU domains. Only the iommu_dma_map_phys() path was
>> exercised; the dma_iova_link() fix is by code inspection of the same pattern.
>> 
>> Signed-off-by: Peng Fan <peng.fan@nxp.com>
>> ---
>> Peng Fan (2):
>>       iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys
>>       iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in dma_iova_link()
>> 
>>  drivers/iommu/dma-iommu.c | 8 ++++----
>>  1 file changed, 4 insertions(+), 4 deletions(-)
>> ---
>> base-commit: e6e35979777d646fe3c7c94dca7dd32fb25d45f4
>> change-id: 20260916-iommu-dma-fix-9f55af1beb46
>> 
>> Best regards,
>> --  
>> Peng Fan <peng.fan@nxp.com>
>> 
>> 
>
>

Re: [PATCH RFC 0/2] iommu/dma: Fix DMA_ATTR_MMIO swiotlb rejection

[Marek Szyprowski]

On 18.09.2026 16:12, Peng Fan wrote:
> On Fri, Sep 18, 2026 at 03:37:36PM +0300, Leon Romanovsky wrote:
>> On Wed, Sep 16, 2026 at 11:23:32PM +0800, Peng Fan (OSS) wrote:
>>> Commit f9374de14c0e8 ("iommu/dma: implement DMA_ATTR_MMIO for
>>> iommu_dma_(un)map_phys()") and commit c288d657dd515 ("iommu/dma: implement
>>> DMA_ATTR_MMIO for dma_iova_link().") added DMA_ATTR_MMIO support to skip
>>> swiotlb bouncing and cache flushing for MMIO resources. However, both
>>> implementations placed the DMA_ATTR_MMIO check inside the swiotlb bounce block,
>>> causing non-page-aligned MMIO mappings to be rejected outright instead of
>>> skipping the bounce and proceeding to create the IOVA mapping.
>>>
>>> This breaks dma_map_resource() for any non-page-aligned device register when
>>> behind an IOMMU: DMA controllers that map peripheral FIFO addresses
>>> (e.g. SPI controller TX/RX data registers) through an IOMMU for per-channel
>>> isolation.
>>>
>>> Both patches move the DMA_ATTR_MMIO check before the swiotlb block so MMIO,
>>> resources skip the entire bounce path and fall through directly to the IOMMU
>>> mapping function.
>> While I understand the rationale behind the first patch, why do we need the
>> second one? Do we want to allow unaligned addresses for the _link_ as well?
>> Current users don't need it.
> My intention with the second patch was to make the DMA_ATTR_MMIO handling
> consistent with iommu_dma_map_phys(), since MMIO cannot be bounced by
> SWIOTLB in either case.
>
> However, I don't have a dma_iova_link() user that requires an
> unaligned MMIO address, so no need to relax the existing restriction there.
>  
> I'll drop the second patch and keep this fix scoped to iommu_dma_map_phys()
> in v2. Does that sounds good to you?
>
> BTW, does patch 1 look good to you?


The first patch looks good, I will apply it as is. For the link case I think that
it needs to be properly documented that non-aligned mapping is not supported.

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland

Re: [PATCH RFC 0/2] iommu/dma: Fix DMA_ATTR_MMIO swiotlb rejection

[Leon Romanovsky]

On Fri, Sep 18, 2026 at 10:12:24PM +0800, Peng Fan wrote:
> Hi Leon,
> 
> On Fri, Sep 18, 2026 at 03:37:36PM +0300, Leon Romanovsky wrote:
> >On Wed, Sep 16, 2026 at 11:23:32PM +0800, Peng Fan (OSS) wrote:
> >> Commit f9374de14c0e8 ("iommu/dma: implement DMA_ATTR_MMIO for
> >> iommu_dma_(un)map_phys()") and commit c288d657dd515 ("iommu/dma: implement
> >> DMA_ATTR_MMIO for dma_iova_link().") added DMA_ATTR_MMIO support to skip
> >> swiotlb bouncing and cache flushing for MMIO resources. However, both
> >> implementations placed the DMA_ATTR_MMIO check inside the swiotlb bounce block,
> >> causing non-page-aligned MMIO mappings to be rejected outright instead of
> >> skipping the bounce and proceeding to create the IOVA mapping.
> >> 
> >> This breaks dma_map_resource() for any non-page-aligned device register when
> >> behind an IOMMU: DMA controllers that map peripheral FIFO addresses
> >> (e.g. SPI controller TX/RX data registers) through an IOMMU for per-channel
> >> isolation.
> >> 
> >> Both patches move the DMA_ATTR_MMIO check before the swiotlb block so MMIO,
> >> resources skip the entire bounce path and fall through directly to the IOMMU
> >> mapping function.
> >
> >While I understand the rationale behind the first patch, why do we need the
> >second one? Do we want to allow unaligned addresses for the _link_ as well?
> >Current users don't need it.
> 
> My intention with the second patch was to make the DMA_ATTR_MMIO handling
> consistent with iommu_dma_map_phys(), since MMIO cannot be bounced by
> SWIOTLB in either case.
> 
> However, I don't have a dma_iova_link() user that requires an
> unaligned MMIO address, so no need to relax the existing restriction there.
>  
> I'll drop the second patch and keep this fix scoped to iommu_dma_map_phys()
> in v2. Does that sounds good to you?
> 
> BTW, does patch 1 look good to you?

Yes, for both questions.

Thanks

> 
> Thanks,
> Peng
> 
> >
> >Thanks
> >
> >> 
> >> Tested on NXP i.MX95 with ARM SMMUv3 where the fsl-edma DMA controller maps
> >> SPI peripheral FIFO registers (non-page-aligned) via dma_map_resource()
> >> through per-channel IOMMU domains. Only the iommu_dma_map_phys() path was
> >> exercised; the dma_iova_link() fix is by code inspection of the same pattern.
> >> 
> >> Signed-off-by: Peng Fan <peng.fan@nxp.com>
> >> ---
> >> Peng Fan (2):
> >>       iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in iommu_dma_map_phys
> >>       iommu/dma: skip swiotlb bounce for DMA_ATTR_MMIO in dma_iova_link()
> >> 
> >>  drivers/iommu/dma-iommu.c | 8 ++++----
> >>  1 file changed, 4 insertions(+), 4 deletions(-)
> >> ---
> >> base-commit: e6e35979777d646fe3c7c94dca7dd32fb25d45f4
> >> change-id: 20260916-iommu-dma-fix-9f55af1beb46
> >> 
> >> Best regards,
> >> --  
> >> Peng Fan <peng.fan@nxp.com>
> >> 
> >> 
> >
> >
>