[PATCH] iommu/intel: disable DMAR for Q35 integrated gfx

[PATCH] iommu/intel: disable DMAR for Q35 integrated gfx

[Kees Cook]

This blacklists the Q35 integrated graphics so IOMMU can be otherwise
enabled. Without this, a Q35 system can only enable IOMMU when booting
with "intel_iommu=on,igfx_off" but not "intel_iommu=on".

00:02.0 0300: 8086:29b2 (rev 02) (prog-if 00 [VGA controller])
        Subsystem: 8086:4f4a
        Flags: bus master, fast devsel, latency 0, IRQ 32
        Memory at e0380000 (32-bit, non-prefetchable) [size=512K]
        I/O ports at 2460 [size=8]
        Memory at d0000000 (32-bit, prefetchable) [size=256M]
        Memory at e0200000 (32-bit, non-prefetchable) [size=1M]
        Expansion ROM at <unassigned> [disabled]
        Capabilities: <access denied>
        Kernel driver in use: i915
        Kernel modules: i915

Signed-off-by: Kees Cook <keescook@chromium.org>
---
 drivers/iommu/intel-iommu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index d8376c2d18b3..24e5b06834ae 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -5327,6 +5327,7 @@ static void quirk_iommu_g4x_gfx(struct pci_dev *dev)
 	dmar_map_gfx = 0;
 }
 
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x29b2, quirk_iommu_g4x_gfx);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_g4x_gfx);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_g4x_gfx);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e10, quirk_iommu_g4x_gfx);
-- 
2.7.4


-- 
Kees Cook
Nexus Security

Re: [PATCH] iommu/intel: disable DMAR for Q35 integrated gfx

[David Woodhouse]

[-- Attachment #1: Type: text/plain, Size: 396 bytes --]

On Mon, 2016-12-05 at 13:58 -0800, Kees Cook wrote:
> This blacklists the Q35 integrated graphics so IOMMU can be otherwise
> enabled. Without this, a Q35 system can only enable IOMMU when booting
> with "intel_iommu=on,igfx_off" but not "intel_iommu=on".

Hm, is this definitely the same bug? Or is it something different, and
perhaps a BIOS issue? There are many of those...

-- 
dwmw2

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5760 bytes --]

Re: [PATCH] iommu/intel: disable DMAR for Q35 integrated gfx

[Kees Cook]

On Mon, Dec 5, 2016 at 2:07 PM, David Woodhouse <dwmw2@infradead.org> wrote:
> On Mon, 2016-12-05 at 13:58 -0800, Kees Cook wrote:
>> This blacklists the Q35 integrated graphics so IOMMU can be otherwise
>> enabled. Without this, a Q35 system can only enable IOMMU when booting
>> with "intel_iommu=on,igfx_off" but not "intel_iommu=on".
>
> Hm, is this definitely the same bug? Or is it something different, and
> perhaps a BIOS issue? There are many of those...

Hm, I have no idea. :) What would I look for in the BIOS?

I figured since g4 was busted, surely q35 was too, since it's even older...

-Kees

-- 
Kees Cook
Nexus Security

Re: [PATCH] iommu/intel: disable DMAR for Q35 integrated gfx

[David Woodhouse]

On Mon, 2016-12-05 at 14:18 -0800, Kees Cook wrote:
> Hm, I have no idea. :) What would I look for in the BIOS?

For a start, what is the actual failure mode?

> I figured since g4 was busted, surely q35 was too, since it's even
> older...

Oh no, they all have different failures. Intel never actually *tested*
their graphics hardware before shipping it, but IIRC it was only Q4x
where we concluded the hardware was just too broken to live.

Re: [PATCH] iommu/intel: disable DMAR for Q35 integrated gfx

[Kees Cook]

On Mon, Dec 5, 2016 at 2:47 PM, David Woodhouse <dwmw2@infradead.org> wrote:
> On Mon, 2016-12-05 at 14:18 -0800, Kees Cook wrote:
>> Hm, I have no idea. :) What would I look for in the BIOS?
>
> For a start, what is the actual failure mode?

Based on initial testing (not that I've spent tons of time with it,
since I need that machine running): at graphics init, entire system
hangs. :P

>> I figured since g4 was busted, surely q35 was too, since it's even
>> older...
>
> Oh no, they all have different failures. Intel never actually *tested*
> their graphics hardware before shipping it, but IIRC it was only Q4x
> where we concluded the hardware was just too broken to live.

Wheee!

-Kees

-- 
Kees Cook
Nexus Security