Re: [PATCH 0/5] iommu/vt-d: Introduce trusted DMA initialization support
From: Baolu Lu
Date: Sat Sep 19 2026 - 00:05:23 EST
On 9/18/2026 10:30 AM, Tian, Kevin wrote:
From: Lu Baolu <baolu.lu@xxxxxxxxxxxxxxx>
Sent: Tuesday, September 15, 2026 3:42 PM
Hi,
This series adds Intel VT-d trusted extension support to the host Intel
IOMMU driver as groundwork for TEE I/O trusted DMA (e.g. TDX Connect).
The trusted extension introduces a parallel, extension-specific path for
trusted DMA assets used by confidential device assignment. Existing VT-d
functionality remains unchanged for regular host DMA paths.
From the TDX Connect architecture perspective, VT-d is enhanced with:
1) Trusted DMA translation root table
- A second root-table address register, restricted to SEAM SAI.
- Programmed by the TDX module with the root of TDX-managed DMA
translation tables for TD-assigned devices.
2) Trusted invalidation queue
- A second invalidation-queue address register plus dedicated
head/tail registers, also restricted to SEAM SAI.
3) IOTLB / DID isolation
- When TDX Connect is enabled, VT-d restricts VMM DID usage and
reserves the DID MSB namespace bit for TDX-module use.
This posting focuses on VT-d-side enablement only: it enables those
extension-defined resources and control points while preserving existing
host VT-d behavior for non-trusted flows. Higher-layer integration
(TDX guest/device flows) will be posted separately.
Jason had a comment on this from another thread [1]:
"
Okay, so I saw the driver posting for basic iommu support, can we try
to rework that to be split out like Aneesh is doing so everything
about TDX calls lives in tsm and intel iommu only provides a small API
surface to exchange whatever details are needed to bootstrap TDX
module?
"
[1] https://lore.kernel.org/all/20260916123954.GC3196566@xxxxxxxx/
Yes, I will head in this direction in the next version.
Thanks,
baolu