[PATCH v1 6/8] iommu: Introduce TDISP T=0 state for confidential IOMMUs

[Jason Gunthorpe]

On Thu, Sep 17, 2026 at 04:18:16PM +0530, sonang patel wrote:
> On Wed, 9 Sep 2026 20:32:49 -0700, Nicolin Chen wrote:
> > + * @tdisp_t1: device uses its confidential IOMMU's T=1 stream. A zero value
> > + *            means T=0, where the T=1 stream remains blocked while the core
> > + *            owns required DMA operations such as ATS.
> 
> What happens when the TDI transitions to ERROR, and how does this bit
> signify it?
> A TDI can drop to ERROR asynchronously, and at that point the device is
> outside the trust boundary again.

The bit reflects how the kernel expects the device to do DMA. It does
not change when the TDISP state changes.

A device that falls to error can no longer do T=1 DMA, the device is
expected to halt that internally. It must not start doing T=0 DMA in
error either or it will corrupt random shared memory since T=0/T=1 are
different IOVA spaces on ARM and Intel.

To recover out of error the userpace would have to cycle it through
err/unlocked/locked/run and tell the kernel driver to start it up
again. During that time the device must not do any T=0 DMA because
nothing has been mapped to it in the T=0 regime.

>From the driver perspecitve the device simply stops doing DMA for a
while and when it comes back in RUN it is able to do DMA again. It is
sort of like existing RAS flows where a device crashes.

Jason