Re: [PATCH v5 4/6] dma: swiotlb: Centralize memory-encryption pool sizing

[Robin Murphy <robin.murphy@arm.com>]

On 21/09/2026 7:36 am, Aneesh Kumar K.V (Arm) wrote:
> Memory-encrypted guests use shared or unencrypted memory for DMA and may
> route all DMA through SWIOTLB. The default pool can therefore be too
> small for I/O-intensive workloads.
> 
> Move the existing x86 guest-sizing policy into the SWIOTLB core. For
> SWIOTLB_POOL_CC_GUEST, size the pool to 6% of guest memory, clamped
> between the normal default and 1 GiB. Preserve an explicit swiotlb=
> size.
> 
> Provide swiotlb_adjusted_size() so early users, including the x86 crash
> kernel reservation, can account for the prospective guest pool size
> before SWIOTLB initialization. Use the same area-aware alignment for
> both the prospective and allocated sizes.
> 
> Host memory encryption still selects a normal-sized shared pool and
> does not use the guest-sizing policy.
> 
> A restricted DMA pool already provides shared bounce buffers for its
> devices. Record its presence during reserved-memory initialization and
> do not select the confidential-guest default-pool policy solely because
> guest memory encryption is active.
> 
> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
> ---
>   arch/x86/include/asm/crash_reserve.h |  6 ++--
>   arch/x86/mm/mem_encrypt.c            | 24 --------------
>   include/linux/swiotlb.h              |  6 ++++
>   kernel/dma/swiotlb.c                 | 47 +++++++++++++++++++++++++++-
>   4 files changed, 56 insertions(+), 27 deletions(-)
> 
> diff --git a/arch/x86/include/asm/crash_reserve.h b/arch/x86/include/asm/crash_reserve.h
> index 7835b2cdff04..c1f5bf5d4182 100644
> --- a/arch/x86/include/asm/crash_reserve.h
> +++ b/arch/x86/include/asm/crash_reserve.h
> @@ -18,7 +18,9 @@
>    * no good way to detect the paging mode of the target kernel which will be
>    * loaded for dumping.
>    */
> -extern unsigned long swiotlb_size_or_default(void);
> +#ifdef CONFIG_X86_64
> +unsigned long __init swiotlb_adjusted_size(void);
> +#endif
>   
>   #ifdef CONFIG_X86_32
>   # define CRASH_ADDR_LOW_MAX     SZ_512M
> @@ -33,7 +35,7 @@ extern unsigned long swiotlb_size_or_default(void);
>   static inline unsigned long crash_low_size_default(void)
>   {
>   #ifdef CONFIG_X86_64
> -	return max(swiotlb_size_or_default() + (8UL << 20), 256UL << 20);
> +	return max(swiotlb_adjusted_size() + (8UL << 20), 256UL << 20);
>   #else
>   	return 0;
>   #endif
> diff --git a/arch/x86/mm/mem_encrypt.c b/arch/x86/mm/mem_encrypt.c
> index 95bae74fdab2..912f22ca838f 100644
> --- a/arch/x86/mm/mem_encrypt.c
> +++ b/arch/x86/mm/mem_encrypt.c
> @@ -101,9 +101,6 @@ void __init mem_encrypt_init(void)
>   
>   void __init mem_encrypt_setup_arch(void)
>   {
> -	phys_addr_t total_mem = memblock_phys_mem_size();
> -	unsigned long size;
> -
>   	/*
>   	 * Do RMP table fixups after the e820 tables have been setup by
>   	 * e820__memory_setup().
> @@ -114,27 +111,6 @@ void __init mem_encrypt_setup_arch(void)
>   	if (!cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT))
>   		return;
>   
> -	/*
> -	 * For SEV and TDX, all DMA has to occur via shared/unencrypted pages.
> -	 * Kernel uses SWIOTLB to make this happen without changing device
> -	 * drivers. However, depending on the workload being run, the
> -	 * default 64MB of SWIOTLB may not be enough and SWIOTLB may
> -	 * run out of buffers for DMA, resulting in I/O errors and/or
> -	 * performance degradation especially with high I/O workloads.
> -	 *
> -	 * Adjust the default size of SWIOTLB using a percentage of guest
> -	 * memory for SWIOTLB buffers. Also, as the SWIOTLB bounce buffer
> -	 * memory is allocated from low memory, ensure that the adjusted size
> -	 * is within the limits of low available memory.
> -	 *
> -	 * The percentage of guest memory used here for SWIOTLB buffers
> -	 * is more of an approximation of the static adjustment which
> -	 * 64MB for <1G, and ~128M to 256M for 1G-to-4G, i.e., the 6%
> -	 */
> -	size = total_mem * 6 / 100;
> -	size = clamp_val(size, IO_TLB_DEFAULT_SIZE, SZ_1G);
> -	swiotlb_adjust_size(size);
> -
>   	/* Set restricted memory access for virtio. */
>   	virtio_set_mem_acc_cb(virtio_require_restricted_mem_acc);
>   }
> diff --git a/include/linux/swiotlb.h b/include/linux/swiotlb.h
> index d69370c08094..be3962a33fc6 100644
> --- a/include/linux/swiotlb.h
> +++ b/include/linux/swiotlb.h
> @@ -193,6 +193,7 @@ void swiotlb_dev_init(struct device *dev);
>   size_t swiotlb_max_mapping_size(struct device *dev);
>   bool is_swiotlb_allocated(void);
>   bool is_swiotlb_active(struct device *dev);
> +unsigned long __init swiotlb_adjusted_size(void);
>   void __init swiotlb_adjust_size(unsigned long size);
>   phys_addr_t default_swiotlb_base(void);
>   phys_addr_t default_swiotlb_limit(void);
> @@ -232,6 +233,11 @@ static inline bool is_swiotlb_active(struct device *dev)
>   	return false;
>   }
>   
> +static inline unsigned long __init swiotlb_adjusted_size(void)
> +{
> +	return 0;
> +}
> +
>   static inline void swiotlb_adjust_size(unsigned long size)
>   {
>   }
> diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c
> index f368a73f4ed0..c19675846fc1 100644
> --- a/kernel/dma/swiotlb.c
> +++ b/kernel/dma/swiotlb.c
> @@ -80,6 +80,7 @@ struct io_tlb_slot {
>   
>   static bool swiotlb_force_bounce;
>   static bool swiotlb_force_disable;
> +static bool restricted_dma_pool_present __initdata;
>   
>   enum swiotlb_pool_policy {
>   	SWIOTLB_POOL_NONE,
> @@ -480,6 +481,46 @@ static bool __init swiotlb_kmalloc_needs_bounce(void)
>   	       (dma_get_cache_alignment() > 1);
>   }
>   
> +/**
> + * swiotlb_adjusted_size() - get the prospective adjusted SWIOTLB size
> + *
> + * Return the size that confidential-computing guest sizing would select for
> + * the default pool, without changing the configured SWIOTLB size. An
> + * explicit swiotlb= size is always preserved. An explicit area count is
> + * included in the size calculation. Automatic area sizing is initialized
> + * later from the running kernel's possible CPU map and any resulting size
> + * adjustment is therefore not reflected in the returned size.
> + */
> +unsigned long __init swiotlb_adjusted_size(void)

This is yet another misleadingly ambiguous name.

> +{
> +	unsigned long nslabs, size = swiotlb_size_or_default();
> +
> +	if (swiotlb_default_size_changed() ||
> +	    !cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT))
> +		return size;

And this makes for another needlessly convoluted calling convention.

> +	/*
> +	 * For SEV and TDX and CCA, all DMA has to occur via
> +	 * shared/unencrypted pages. Kernel uses SWIOTLB to make this
> +	 * happen without changing device drivers. However, depending on
> +	 * the workload being run, the default 64MB of SWIOTLB may not be
> +	 * enough and SWIOTLB may run out of buffers for DMA, resulting in
> +	 * I/O errors and/or performance degradation especially with high
> +	 * I/O workloads.
> +	 *
> +	 * Adjust the default size of SWIOTLB using a percentage of guest
> +	 * memory for SWIOTLB buffers.
> +	 *
> +	 * The percentage of guest memory used here for SWIOTLB buffers is
> +	 * more of an approximation of the static adjustment which 64MB for
> +	 * <1G, and ~128M to 256M for 1G-to-4G, i.e., the 6%
> +	 */
> +	size = memblock_phys_mem_size() * 6 / 100;

But mostly I fail to see how this makes any sense for the x86 
crash_low_size_default() case anyway. This calculation is based on the 
*total* system memory, of which 6% is likely comparable to (or perhaps 
even more than) the *entire* amount of memory reserved for the crash 
kernel itself. What's more, if the low memory and size restrictions are 
lifted for regular CoCo SWIOTLB as people want, then it becomes even 
more utterly nonsensical to tie crashkernel_low to this.

Yes, this happens to be the behaviour that falls out of how two 
different parts of the existing code interact, but I highly doubt it was 
ever intentional, so I'm not convinced that complicating SWIOTLB 
interfaces to blindly preserve it is the right thing to do.

Thanks,
Robin.

> +	size = clamp_val(size, IO_TLB_DEFAULT_SIZE, SZ_1G);
> +	nslabs = swiotlb_aligned_nslabs(size);
> +
> +	return nslabs << IO_TLB_SHIFT;
> +}
> +
>   static void __init
>   swiotlb_adjust_pool_size(enum swiotlb_pool_policy policy)
>   {
> @@ -496,6 +537,7 @@ swiotlb_adjust_pool_size(enum swiotlb_pool_policy policy)
>   		break;
>   	}
>   	case SWIOTLB_POOL_CC_GUEST:
> +		swiotlb_adjust_size(swiotlb_adjusted_size());
>   		break;
>   	case SWIOTLB_POOL_NONE:
>   		WARN(true, "Cannot adjust SWIOTLB size without a pool\n");
> @@ -511,7 +553,8 @@ swiotlb_select_pool_policy(unsigned int flags)
>   	if (swiotlb_force_disable)
>   		return SWIOTLB_POOL_NONE;
>   
> -	if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT))
> +	if (cc_platform_has(CC_ATTR_GUEST_MEM_ENCRYPT) &&
> +	    !restricted_dma_pool_present)
>   		return SWIOTLB_POOL_CC_GUEST;
>   
>   	if (cc_platform_has(CC_ATTR_HOST_MEM_ENCRYPT))
> @@ -2157,6 +2200,8 @@ static int __init rmem_swiotlb_setup(unsigned long node,
>   	    of_get_flat_dt_prop(node, "no-map", NULL))
>   		return -EINVAL;
>   
> +	restricted_dma_pool_present = true;
> +
>   	pr_info("Reserved memory: created restricted DMA pool at %pa, size %ld MiB\n",
>   		&rmem->base, (unsigned long)rmem->size / SZ_1M);
>   	return 0;