[RFC PATCH 15/15] virt: tdx-guest: Accept default DMAR entry during PCI driver attach

[Zhenzhong Duan <zhenzhong.duan@intel.com>]

Before a TDI can perform DMA to guest private memory, its secure DMA
mapping must be accepted. This happens during driver load stage after
MMIO acceptance and TDI activation.

The enable_dma callback issues TDG.DMAR.ACCEPT to set secure PASID
table entry to present state and target non-partitioned TD.

The secure PASID table entry is cleared in unlock stage implicitly
so disable_dma is a no-op currently.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
---
 drivers/virt/coco/tdx-guest/connect.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/virt/coco/tdx-guest/connect.c b/drivers/virt/coco/tdx-guest/connect.c
index a9d41fd38b64..b328caac0a49 100644
--- a/drivers/virt/coco/tdx-guest/connect.c
+++ b/drivers/virt/coco/tdx-guest/connect.c
@@ -427,10 +427,26 @@ static int tdx_devsec_run(struct pci_dev *pdev)
 	return 0;
 }
 
+static int tdx_devsec_enable_dma(struct pci_dev *pdev)
+{
+	int ret = tdx_mcall_dmar_accept(pci_dev_id(pdev), 0);
+
+	if (ret)
+		pci_err(pdev, "Failed to accept DMAR, ret=%d\n", ret);
+
+	return ret;
+}
+
+static void tdx_devsec_disable_dma(struct pci_dev *pdev)
+{
+}
+
 static struct pci_tsm_ops tdx_devsec_ops = {
 	.lock = tdx_devsec_lock,
 	.unlock = tdx_devsec_unlock,
 	.run = tdx_devsec_run,
+	.enable_dma = tdx_devsec_enable_dma,
+	.disable_dma = tdx_devsec_disable_dma,
 };
 
 static void devsec_tsm_remove(void *tsm_dev)
-- 
2.52.0