RE: [PATCH 0/5] iommu/vt-d: Introduce trusted DMA initialization support

[Tian, Kevin]

> From: Lu Baolu <baolu.lu@xxxxxxxxxxxxxxx>
> Sent: Tuesday, September 15, 2026 3:42 PM
> 
> Hi,
> 
> This series adds Intel VT-d trusted extension support to the host Intel
> IOMMU driver as groundwork for TEE I/O trusted DMA (e.g. TDX Connect).
> 
> The trusted extension introduces a parallel, extension-specific path for
> trusted DMA assets used by confidential device assignment. Existing VT-d
> functionality remains unchanged for regular host DMA paths.
> 
> From the TDX Connect architecture perspective, VT-d is enhanced with:
> 
>   1) Trusted DMA translation root table
>      - A second root-table address register, restricted to SEAM SAI.
>      - Programmed by the TDX module with the root of TDX-managed DMA
>        translation tables for TD-assigned devices.
> 
>   2) Trusted invalidation queue
>      - A second invalidation-queue address register plus dedicated
>        head/tail registers, also restricted to SEAM SAI.
> 
>   3) IOTLB / DID isolation
>      - When TDX Connect is enabled, VT-d restricts VMM DID usage and
>        reserves the DID MSB namespace bit for TDX-module use.
> 
> This posting focuses on VT-d-side enablement only: it enables those
> extension-defined resources and control points while preserving existing
> host VT-d behavior for non-trusted flows. Higher-layer integration
> (TDX guest/device flows) will be posted separately.
> 

Jason had a comment on this from another thread [1]:

"
Okay, so I saw the driver posting for basic iommu support, can we try
to rework that to be split out like Aneesh is doing so everything
about TDX calls lives in tsm and intel iommu only provides a small API
surface to exchange whatever details are needed to bootstrap TDX
module?
"

[1] https://lore.kernel.org/all/20260916123954.GC3196566@xxxxxxxx/