From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=192.198.163.16 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793359329; b=OlIFKoOlsTGxSZ6szdhB1GPiQ88Veg/2RhIYlwsh9EiY0QACmPo5+dIAO/MiRzQb9rke 0DgaJvSk3MbNQyVdciNW1BCBc6oD2fOIK9QnJMX1LWvga6xRNsFZcn4TrZsrSzhcYrxOs dP3vpMYytYxMKzDFpxi2J6Gp+4eR6R6xgG+heTgGk/ns8ePEmnfQZuZGN+elWZlg9dfQd LRpHAtxBgSzc0xi9Gr6GiiIfkNpyfUkM/TiSE/CsXttG6A04I9SbhQHU6vQeSxeS7LsJD kuXq3nFjDwD4q3YFtTL9cWzkX3xbBGnv6E0eLWzoPhe0+GN+umaYqg8XXApWlfWxYTw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793359329; h=DMARC-Filter:DKIM-Signature:X-CSE-ConnectionGUID:X-CSE-MsgGUID: X-IronPort-AV:X-IronPort-AV:Received:X-CSE-ConnectionGUID: X-CSE-MsgGUID:X-ExtLoop1:X-IronPort-AV:Received:From:To:Cc:Subject: Date:Message-ID:X-Mailer:In-Reply-To:References:MIME-Version: Content-Transfer-Encoding; bh=PMxo0tKZ2uNq7UfgPU1pBYHsL5dtAg8inp26p5xVDiU=; b=ZCQmQ9TDLe2pXxkwDLfGGXvWDJCP2Qbme+MSGefAB9nT6MRRdy8NhjW930EGpciOKUus VrbidddxcjXt9D5B5zMXcWZb279y+cQhQWUaqMg7z86YHoU4MNvExPCIeRXC6i8++k57D eHvFFy7OjVZfbqmlOUFJsu+qdDi6Przaft70CdaHKdn/JlNdt3GfP5ICn7yHUSNx2+uM0 jd4dxKRgpzTrZcAz+BPzHFII6oODCDfyEoX7J1CyZOEXz4ooq8OcFJbfuRAyymUjZ4WPV eI0e0HOIXlSbrsDFi+Fh//WPjDwA4Ae5M50CV9kUEoBNVwuMSu5Cs9ikr5lY1fIBRUg== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=linux.intel.com; spf=pass smtp.mailfrom=linux.intel.com; dkim=pass header.d=intel.com header.i=@intel.com header.a=rsa-sha256 header.s=Intel header.b=R0daRYv2; arc=none smtp.remote-ip=192.198.163.16 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.16]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9FC18606A321 for ; Fri, 30 Oct 2026 11:22:08 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 9FC18606A321 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=intel.com header.i=@intel.com header.a=rsa-sha256 header.s=Intel header.b=R0daRYv2 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1793359328; x=1824895328; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=z3NhLfj1UqbvTSE1LMM7BgBTAVJZugHpz+h0zX3Mjy8=; b=R0daRYv2EtEYmU0NIL6dYvKBKLYHaguT4EucPrXLJasW0S7XvRDnDj4G ssI/g+DkFREPV9OC3kC0rAvFJ6GKFeu5poBEIucjGJW+JbLpJ1+Qa4h6u qkwx0g2KN6mZkVNOCrvQJsZCLDgRG/t62+TjRyOTYTEG4lFBkGA/KW+nS UnMQO0yMQpbTIjIcr+fMiG7VltNbJvYU+3kLznuX+pNqAvncwwQ2kspOb P1b7Rx517exbMxhtSJh0fIVsvUUwhBt3tcEtrR2N3NwlW0V/iywNaEPAT u/a6IXmSU5vAxiC9i4deHm8lbD6ioq9HZvQx7kzJKN8SW700WuH223khR g==; X-CSE-ConnectionGUID: 8Lfx9u4BR1afoR3HMhxLgw== X-CSE-MsgGUID: o6f7VfhlT3iNsP1l7qsghQ== X-IronPort-AV: E=McAfee;i="6800,10657,11950"; a="2135255" X-IronPort-AV: E=Sophos;i="6.27,186,1787036400"; d="scan'208";a="2135255" Received: from orviesa001.jf.intel.com ([10.64.159.141]) by fmvoesa110.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 30 Oct 2026 04:22:08 -0700 X-CSE-ConnectionGUID: h15cKfcnSFem9lFJqm1q/w== X-CSE-MsgGUID: 1+IA4HZFR4SYpFsHB4gPhg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.27,186,1787036400"; d="scan'208";a="5375432" Received: from gklab-096-123.igk.intel.com ([10.91.96.123]) by orviesa001.jf.intel.com with ESMTP; 30 Oct 2026 04:22:05 -0700 From: Michal Camacho Romero To: Lu Baolu Cc: Ning Sun , Thomas Gleixner , Borislav Petkov , Michal Camacho Romero , x86@kernel.org, iommu@lists.linux.dev, tboot-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, Mateusz Mowka , Adam Pawlicki , Pawel Randzio , Michal Camacho Romero Subject: [PATCH v8 2/2] iommu/vt-d: Disable TXT TPRs before enabling queued invalidation Date: Fri, 30 Oct 2026 12:20:09 +0100 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261029134149.3498677-1-michal.camacho.romero@intel.com> References: <20261029134149.3498677-1-michal.camacho.romero@intel.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit When the SINIT ACM establishes TXT Protection Regions (TPRs), they block all inbound DMA to their protected range, including the IOMMU's own queued invalidation (QI) ring. If the TPRs are still active when QI is first enabled, the first invalidation faults with an Invalidation Queue Error and the boot hangs. On systems with interrupt remapping enabled this happens very early, in intel_setup_irq_remapping() -> dmar_enable_qi(), well before init_dmars(). Link: https://uefi.org/sites/default/files/resources/633933_Intel_TXT_DMA_Protection_Ranges_rev_0p73.pdf Link: https://cdrdv2-public.intel.com/315168/315168_TXT_MLE_DG_rev_017_7.pdf Tested-by: Michal Camacho Romero Signed-off-by: Michal Camacho Romero --- Changes since v7: - Renamed tboot_free_txt_heap_mem() to tboot_unmap_txt_heap() to match the rename in patch 1. drivers/iommu/intel/dmar.c | 19 +++++++++++++++++++ drivers/iommu/intel/iommu.c | 18 ++++++++++++++++++ 2 files changed, 37 insertions(+) diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c index ba675b08cd208..5e59aa46721e6 100644 --- a/drivers/iommu/intel/dmar.c +++ b/drivers/iommu/intel/dmar.c @@ -675,6 +675,25 @@ parse_dmar_table(void) if (ret == 0 && drhd_count == 0) pr_warn(FW_BUG "No DRHD structure found in DMAR table\n"); + /* + * Only on a successful DMAR parse: if SINIT programmed TXT TPRs for DMA + * protection, disable them here, before any queued invalidation (QI) is + * enabled. TPRs block all inbound DMA to their protected range, including + * the IOMMU's own QI ring, so leaving them active makes the first queued + * invalidation fault (Invalidation Queue Error) and hangs the boot on any + * system with interrupt remapping enabled. + * + * If parsing failed, dmar_table_init() propagates the error and both the + * IOMMU and IRQ remmaping preparation will be aborted, before QI will + * be enabled, so the TPRs are left in place and SINIT's DMA protection + * will be retained. + */ + if (ret == 0 && tboot_enabled()) { + tboot_check_tprs(); + if (tboot_teardown_tprs() != 0) + pr_warn("tboot: Failed to disable TPRs. DMA is still blocked.\n"); + } + return ret; } diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c index 2e3b3ab216f8f..3ad6542f83e41 100644 --- a/drivers/iommu/intel/iommu.c +++ b/drivers/iommu/intel/iommu.c @@ -2648,6 +2648,15 @@ int __init intel_iommu_init(void) init_no_remapping_devices(); + /* + * SINIT TPRs (if any were active) should be already torn down during DMAR + * Table parsing process. If the teardown failed, DMA (including the IOMMU's + * own QI ring) is still blocked, so refuse to continue a forced launch + * rather than hang mid-init. + */ + if (tboot_is_tpr_protection_enabled() && !intel_iommu_tboot_noforce) + panic("tboot: Failed to disable TPRs. DMA is still blocked.\n"); + ret = init_dmars(); if (ret) { if (dmar_policy_force_on()) @@ -2698,6 +2707,14 @@ int __init intel_iommu_init(void) iommu_disable_protect_mem_regions(iommu); } + + /* + * Release the TXT heap mapping if it is still held. TPRs (and the + * heap) are normally torn down in parse_dmar_table(); this is a + * safety net for paths where no TPRs were active. + */ + tboot_unmap_txt_heap(); + up_read(&dmar_global_lock); pr_info("Intel(R) Virtualization Technology for Directed I/O\n"); @@ -2707,6 +2724,7 @@ int __init intel_iommu_init(void) return 0; out_free_dmar: + tboot_unmap_txt_heap(); intel_iommu_free_dmars(); up_write(&dmar_global_lock); return ret; -- 2.43.0