[PATCH 5/5] iommu/vt-d: Reserve MSB of domain ID space for TDX module

[Lu Baolu <baolu.lu@linux.intel.com>]

When an Intel IOMMU is enabled for TDX Connect, the VT-d DID namespace
must be split so the TDX module can use the MSB-tagged half for trusted
DMA translations, while the host/VMM uses the lower half.

After TDH.IOMMU.SETUP succeeds, restrict host domain ID allocation to the
lower half of the DID space by capping max_domain_id to ndoms / 2. Before
applying the cap, verify that no allocated domain IDs already exist in
the upper half; if they do, abort bring-up and roll back the per-IOMMU
TDX setup.

On teardown, restore max_domain_id to the full DID range.

This matches Intel TDX Connect architecture requirements for IOTLB/DID
isolation between TEE and non-TEE translations.

Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
---
 drivers/iommu/intel/tdxc.c | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/drivers/iommu/intel/tdxc.c b/drivers/iommu/intel/tdxc.c
index b5dfdeeb23db..1ca03257d456 100644
--- a/drivers/iommu/intel/tdxc.c
+++ b/drivers/iommu/intel/tdxc.c
@@ -129,6 +129,7 @@ static struct tdxc_pages *tdxc_alloc_mt_pages(struct intel_iommu *iommu,
 
 static int intel_iommu_bringup_tdxc(struct intel_iommu *iommu, unsigned int nr_pages)
 {
+	unsigned long ndoms = cap_ndoms(iommu->cap);
 	struct dmar_drhd_unit *drhd = iommu->drhd;
 	u64 r, tdx_iommu_id;
 
@@ -144,6 +145,10 @@ static int intel_iommu_bringup_tdxc(struct intel_iommu *iommu, unsigned int nr_p
 	if (!iommu_mt)
 		return -ENOMEM;
 
+	guard(mutex)(&iommu->did_lock);
+	if (ida_find_first_range(&iommu->domain_ida, ndoms >> 1, ndoms - 1) > 0)
+		return -EBUSY;
+
 	guard(mutex)(&iommu->tdx_lock);
 	r = tdh_iommu_setup(drhd->reg_base_addr, iommu_mt->root, &tdx_iommu_id);
 	/* TDX Extension is not supported on this iommu. Nothing to do. */
@@ -154,17 +159,27 @@ static int intel_iommu_bringup_tdxc(struct intel_iommu *iommu, unsigned int nr_p
 		return -EFAULT;
 	}
 
+	/*
+	 * Intel TDX Connect Architecture Specification, Section 2.2 Trusted DMA
+	 *
+	 * When IOMMU is enabled to support TDX Connect, the IOMMU restricts
+	 * the VMM’s DID setting, reserving the MSB bit for the TDX module. The
+	 * TDX module always sets this reserved bit on the trusted DMA table.
+	 */
+	iommu->max_domain_id = ndoms >> 1;
 	iommu->tdx_iommu_id = tdx_iommu_id;
 	iommu->mt_pages = no_free_ptr(iommu_mt);
 
-	/* Bring-up is not complete yet; report as unsupported for now. */
-	return -EOPNOTSUPP;
+	pr_info("%s: trusted DMA for TEE/IO initialized\n", iommu->name);
+
+	return 0;
 }
 
 static void intel_iommu_teardown_tdxc(struct intel_iommu *iommu)
 {
 	u64 r;
 
+	guard(mutex)(&iommu->did_lock);
 	guard(mutex)(&iommu->tdx_lock);
 
 	if (!iommu->mt_pages)
@@ -179,6 +194,7 @@ static void intel_iommu_teardown_tdxc(struct intel_iommu *iommu)
 	free_mt_pages(iommu->mt_pages);
 	iommu->mt_pages = NULL;
 	iommu->tdx_iommu_id = 0;
+	iommu->max_domain_id = cap_ndoms(iommu->cap);
 }
 
 void intel_tdxc_exit(void)
-- 
2.43.0