Re: [PATCH v2 4/4] coco/tdx-host: Initialize trusted DMA on all capable IOMMUs

[Baolu Lu]

On 10/19/2026 3:03 PM, Chao Gao wrote:
> > +static int tdx_iommu_setup(struct dmar_drhd_unit *drhd)
> > +{
> > +	const struct tdx_sys_info *tdx_sysinfo = tdx_get_sysinfo();
> > +	unsigned int mt_page_count = tdx_sysinfo->tdx_connect.iommu_mt_page_count;
> > +	struct tdx_iommu_state *state;
> > +	u64 r, tdx_iommu_id;
> > +	int ret;
> > +
> > +	struct tdx_iommu_state *iommu_state __free(kfree) = kzalloc_obj(*iommu_state);
> > +	if (!iommu_state)
> > +		return -ENOMEM;
> > +
> > +	struct tdx_iommu_pages *iommu_mt __free(free_mt_pages) =
> > +			tdx_iommu_alloc_mt_pages(drhd, mt_page_count);
> > +	if (!iommu_mt)
> > +		return -ENOMEM;
> > +
> > +	r = tdh_iommu_setup(drhd->reg_base_addr, iommu_mt->root, &tdx_iommu_id);
>
> Dynamic PAMT was merged in 7.3. With it enabled, the PAMT for 4K pages

I guess you mean v7.4-rc1? v7.3 has already been finalized. Either way,
I will add dynamic PAMT support in the next version when I rebase.

> is no longer allocated up front, and the kernel must add PAMT backing
> before giving a page to the TDX module. So, the IQ buffers and the metadata
> pages need tdx_pamt_get() before TDH.IOMMU.SETUP and tdx_pamt_put() after
> TDH.IOMMU.CLEAR hands them back.

I will add something like the following:

- call tdx_pamt_get() on every 4K page of the IQ buffers and the
  metadata pages before TDH.IOMMU.SETUP, and tdx_pamt_put() on the
  SETUP failure pah;
- call tdx_pamt_put() after TDH.IOMMU.CLEAR succeeds. If CLEAR fails,
  the pages and their PAMT backing stay with the TDX module and are
  leaked;
- probably it is needed to export the PAMT helpers to tdx-host.

Thanks,
baolu