RE: [PATCH v2 4/4] coco/tdx-host: Initialize trusted DMA on all capable IOMMUs

[Tian, Kevin]

> From: Baolu Lu <baolu.lu@xxxxxxxxxxxxxxx>
> Sent: Monday, October 19, 2026 4:12 PM
> 
> On 10/16/2026 3:17 PM, Tian, Kevin wrote:
> >>    - The TDX Connect architecture places requirements on the host
> >>      iommu driver while the secure IOMMU is being set up. For example,
> >>      the host iommu driver must block the enhanced command (ECMD)
> >>      interface while the TDH.IOMMU.SETUP SEAMCALL runs, and it must
> >>      reserve the upper half of the domain ID space. These steps have
> >>      to happen atomically under the iommu driver's own locks. As a
> >>      result, the Intel iommu driver needs to merge the two steps above
> >>      into one.
> > Didn't get this. Both ECMD and DID reservation are TDX specific things.
> > How are they related to the two steps in the ARM sides and why calls
> > for merging?
> >
> > and why are they must be done atomically? they are conditions to
> > execute TDH.IOMMU.SETUP, but it is perfectly fine to reserve DID
> > at an early point then block ECMD later...
> 
> You are right, "atomically" was too strong. Only the ECMD block has to
> bracket TDH.IOMMU.SETUP. So I plan to restructure it as follows:
> 
> - dmar_tdxcs_init_prepare(dev, &params): resolve the device's DRHD and
>    take a reference on its secure-mode state. For the first user,
>    validate the preconditions (TE/QI/SM enabled), reserve the upper half
>    of the DID space (failing with -EBUSY if any of it is in use), block
>    ECMD and return what tdx-host needs (register base, NUMA node, etc).
>    If the unit is already in Secure TDX mode, just report that so
>    tdx-host skips TDH.IOMMU.SETUP.
> 
> - dmar_tdxcs_init_done(dev, result): unblock ECMD, then either mark the
>    unit as being in Secure TDX mode or roll back (including the DID
>    reservation), based on the SEAMCALL result. It must be called
>    whenever init_prepare() returns success.

We should continue blocking ECMD after the IOMMU successfully
enters the TDX mode.

> 
> - dmar_tdxcs_release(dev): drop the reference; the last user releases
>    the DID reservation and clears the Secure TDX mode state after
>    tdx-host issues TDH.IOMMU.CLEAR.
> 
> These are called from tdx_tsm_link_connect()/disconnect(). Any failure,
> whether a precondition, DID reservation or the SEAMCALL itself, aborts
> connect with the corresponding error.
> 
> Thanks,
> baolu