Re: [PATCH v2 2/7] dma-mapping: Let a device declare that it reaches private memory

[Marek Szyprowski <m.szyprowski@samsung.com>]

On 03.11.2026 04:49, Nicolin Chen wrote:
> DMA devices in a confidential guest can access only shared memory, or both
> private and shared memory. Some method outside the DMA API will confirm the
> device is able to access private memory through DMA.
>
> Add DEV_FLAG_DMA_CC_PRIVATE and dma_set_cc_private(dev, bool).
>
> The flag must be stable while any DMA mapping exists.
>
> Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
> Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>

Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>


> ---
>  include/linux/device.h      |  4 ++++
>  include/linux/dma-mapping.h |  4 ++++
>  kernel/dma/mapping.c        | 21 +++++++++++++++++++++
>  3 files changed, 29 insertions(+)
>
> diff --git a/include/linux/device.h b/include/linux/device.h
> index 429e39f647cf9..01d7877d0b571 100644
> --- a/include/linux/device.h
> +++ b/include/linux/device.h
> @@ -604,6 +604,8 @@ struct device_physical_location {
>   *		ancestor device.
>   * @DEV_FLAG_OFFLINE_DISABLED: If set, the device is permanently online.
>   * @DEV_FLAG_OFFLINE: Set after successful invocation of bus type's .offline().
> + * @DEV_FLAG_DMA_CC_PRIVATE: The device is able to access private (encrypted)
> + *		memory, no shared memory bouncing is required from the DMA API.
>   * @DEV_FLAG_COUNT: Number of defined struct_device_flags.
>   */
>  enum struct_device_flags {
> @@ -617,6 +619,7 @@ enum struct_device_flags {
>  	DEV_FLAG_OF_NODE_REUSED = 7,
>  	DEV_FLAG_OFFLINE_DISABLED = 8,
>  	DEV_FLAG_OFFLINE = 9,
> +	DEV_FLAG_DMA_CC_PRIVATE = 10,
>  
>  	DEV_FLAG_COUNT
>  };
> @@ -834,6 +837,7 @@ __create_dev_flag_accessors(dma_coherent, DEV_FLAG_DMA_COHERENT);
>  __create_dev_flag_accessors(of_node_reused, DEV_FLAG_OF_NODE_REUSED);
>  __create_dev_flag_accessors(offline_disabled, DEV_FLAG_OFFLINE_DISABLED);
>  __create_dev_flag_accessors(offline, DEV_FLAG_OFFLINE);
> +__create_dev_flag_accessors(dma_cc_private, DEV_FLAG_DMA_CC_PRIVATE);
>  
>  #undef __create_dev_flag_accessors
>  
> diff --git a/include/linux/dma-mapping.h b/include/linux/dma-mapping.h
> index efde0e5a58dc2..3cc38db4a7490 100644
> --- a/include/linux/dma-mapping.h
> +++ b/include/linux/dma-mapping.h
> @@ -218,6 +218,7 @@ void *dma_vmap_noncontiguous(struct device *dev, size_t size,
>  void dma_vunmap_noncontiguous(struct device *dev, void *vaddr);
>  int dma_mmap_noncontiguous(struct device *dev, struct vm_area_struct *vma,
>  		size_t size, struct sg_table *sgt);
> +void dma_set_cc_private(struct device *dev, bool private);
>  #else /* CONFIG_HAS_DMA */
>  static inline dma_addr_t dma_map_page_attrs(struct device *dev,
>  		struct page *page, size_t offset, size_t size,
> @@ -357,6 +358,9 @@ static inline int dma_mmap_noncontiguous(struct device *dev,
>  {
>  	return -EINVAL;
>  }
> +static inline void dma_set_cc_private(struct device *dev, bool private)
> +{
> +}
>  #endif /* CONFIG_HAS_DMA */
>  
>  #ifdef CONFIG_IOMMU_DMA
> diff --git a/kernel/dma/mapping.c b/kernel/dma/mapping.c
> index 82e701648d604..ded585b39fb92 100644
> --- a/kernel/dma/mapping.c
> +++ b/kernel/dma/mapping.c
> @@ -501,6 +501,27 @@ static void dma_setup_need_sync(struct device *dev)
>  static inline void dma_setup_need_sync(struct device *dev) { }
>  #endif /* !CONFIG_DMA_NEED_SYNC */
>  
> +/**
> + * dma_set_cc_private - Set whether @dev can DMA to private memory
> + * @dev: device whose confidential-computing DMA access is being updated
> + * @private: whether the device can DMA to private memory
> + *
> + * Called when a device is known to be able to DMA to private memory.
> + * For architected CPU integrated devices their kernel drivers will
> + * self-accept using a driver specific validation. Other devices will
> + * have a userspace managed process.
> + *
> + * DMA mapping must not be active when this flag is changed. For CPU
> + * integrated devices the driver should self accept early during probe
> + * after validation. Other devices have this flag set automatically
> + * before probing.
> + */
> +void dma_set_cc_private(struct device *dev, bool private)
> +{
> +	dev_assign_dma_cc_private(dev, private);
> +}
> +EXPORT_SYMBOL_GPL(dma_set_cc_private);
> +
>  /*
>   * The whole dma_get_sgtable() idea is fundamentally unsafe - it seems
>   * that the intention is to allow exporting memory allocated via the

Best regards
-- 
Marek Szyprowski, PhD
Samsung R&D Institute Poland