[PATCH v7 0/2] x86/tboot: Add Intel TXT Protection Regions (TPR) support

[Michal Camacho Romero <michal.camacho.romero@linux.intel.com>]

This series adds support for parsing the Intel TXT DMA Protection Ranges
(DTPR) table and tearing down the SINIT ACM-established TXT Protection
Regions (TPRs) during early kernel boot.

Background
==========
When a measured launch is performed, the SINIT ACM programs TXT
Protection Regions (TPRs) that block all inbound DMA requests.
These ranges also cover the Intel IOMMU's own queued
invalidation (QI) ring. If the TPRs are still active when QI is first
enabled, the very first invalidation faults with an Invalidation Queue
Error (IQE) and the boot hangs. The kernel must earlier locate and disable
the TPRs, before any QI is enabled, after which the IOMMU is the sole runtime
DMA protection.

Patch 1 adds the tboot-internal DTPR parsing and TPR teardown helpers.
Patch 2 wires them into the Intel VT-d driver, disabling TPRs in
parse_dmar_table() (which runs before every dmar_enable_qi() call site)
once DMAR parsing has succeeded.

Changes since v6
================
- Patch 2 retitled "iommu/vt-d: Disable PMRs and skip force-IOMMU when
  TXT TPRs are active" -> "iommu/vt-d: Disable TXT TPRs before enabling
  queued invalidation", reflecting a substantially reworked approach:
  * TPRs are now torn down early in parse_dmar_table(), before any
    dmar_enable_qi() (the real fix for the IQE boot hang on IR/x2apic
    systems), instead of in intel_iommu_init() after translation is
    enabled.
  * The tboot_force_iommu() is no longer modified. The IOMMU is forced on
    exactly as before, so booting intel_iommu=off on a TPR-capable
    platform behaves as upstream.
  * All TPR/DTPR/txt_heap states are kept internal to tboot.c. The IOMMU
    driver now uses only parameterless helpers (tboot_check_tprs(),
    tboot_teardown_tprs(), tboot_is_tpr_protection_enabled(),
    tboot_free_txt_heap_mem()). All TBOOT state leaks into the driver have been
    eliminated.
  * TPRs teardown runs only on a successful DMAR Table parse.
  * Using intel_iommu=tboot_noforce now suppresses the TPR-related panic
- Patch 1 is functionally unchanged; it only picks up checkpatch --strict
  cleanups: statics are no longer explicitly initialised, the TPR count is
  now signed (s64), and tab indentation, pointer/cast style,
  NULL-comparison and brace style, and unsplit log strings were fixed.

Michal Camacho Romero (2):
  x86/tboot: Add support for parsing DTPR table and disabling TPRs
  iommu/vt-d: Disable TXT TPRs before enabling queued invalidation

 arch/x86/kernel/tboot.c     | 515 ++++++++++++++++++++++++++++++++++--
 drivers/iommu/intel/dmar.c  |  19 ++
 drivers/iommu/intel/iommu.c |  18 ++
 include/linux/tboot.h       |  28 +-
 4 files changed, 560 insertions(+), 20 deletions(-)

-- 
2.43.0