Why can the destination address used by ATU DMA ep_dma be RC side's iova?

Hi all,
I have a question about tegra vnet atu_dma.
The question is:
Why can the destination address used by ATU DMA ep_dma be RC side’s iova?

The specific codes are as follows:
RC:
static void tvnet_host_alloc_empty_buffers(struct tvnet_priv *tvnet){
	iova = dma_map_single(d, skb->data, len, DMA_FROM_DEVICE);
	ep2h_empty_msg[idx].u.empty_buffer.pcie_address = iova;
}

NV:
static netdev_tx_t tvnet_ep_start_xmit(struct sk_buff *skb, struct net_device *ndev){
	dst_iova = ep2h_empty_msg[rd_idx].u.empty_buffer.pcie_address;
	dst_len = ep2h_empty_msg[rd_idx].u.empty_buffer.buffer_len;
	dst_masked = (dst_iova & ~(SZ_64K - 1));
	dst_off = (dst_iova & (SZ_64K - 1));
	ret = pci_epc_map_addr(epc, tvnet->tx_dst_pci_addr, dst_masked, dst_len);

	ep_dma_virt[desc_widx].size = len;
	ep_dma_virt[desc_widx].sar_low = lower_32_bits(src_iova);
	ep_dma_virt[desc_widx].sar_high = upper_32_bits(src_iova);
	ep_dma_virt[desc_widx].dar_low = lower_32_bits(dst_iova);
	ep_dma_virt[desc_widx].dar_high = upper_32_bits(dst_iova);
}

Why is sar_low/sar_high not filled with tvnet->tx_dst_pci_addr?
Thanks a lot。

Hi all,
Does this mean that in IATU DMA operations, at least one of the source/destination addresses must be an address on the PCIe bus, while the other can access the internal bus of the SoC through SMMU (System Memory Management Unit)?