x86, iommu/vt-d: Add an option to disable Intel IOMMU force on (bfd20f1c) · Commits · 戴 / test

Documentation/admin-guide/kernel-parameters.txt

+9 −0

Original line number	Original line	Diff line number	Diff line
	@@ -1578,6 +1578,15 @@
	extended tables themselves, and also PASID support. With		extended tables themselves, and also PASID support. With
	this option set, extended tables will not be used even		this option set, extended tables will not be used even
	on hardware which claims to support them.		on hardware which claims to support them.
			tboot_noforce [Default Off]
			Do not force the Intel IOMMU enabled under tboot.
			By default, tboot will force Intel IOMMU on, which
			could harm performance of some high-throughput
			devices like 40GBit network cards, even if identity
			mapping is enabled.
			Note that using this option lowers the security
			provided by tboot because it makes the system
			vulnerable to DMA attacks.

	intel_idle.max_cstate= [KNL,HW,ACPI,X86]		intel_idle.max_cstate= [KNL,HW,ACPI,X86]
	0 disables intel_idle and fall back on acpi_idle.		0 disables intel_idle and fall back on acpi_idle.

arch/x86/kernel/tboot.c

+3 −0

Original line number	Original line	Diff line number	Diff line
	@@ -510,6 +510,9 @@ int tboot_force_iommu(void)
	if (!tboot_enabled())		if (!tboot_enabled())
	return 0;		return 0;

			if (!intel_iommu_tboot_noforce)
			return 1;

	if (no_iommu \|\| swiotlb \|\| dmar_disabled)		if (no_iommu \|\| swiotlb \|\| dmar_disabled)
	pr_warning("Forcing Intel-IOMMU to enabled\n");		pr_warning("Forcing Intel-IOMMU to enabled\n");

drivers/iommu/intel-iommu.c

+18 −0

Original line number	Original line	Diff line number	Diff line
	@@ -183,6 +183,7 @@ static int rwbf_quirk;
	* (used when kernel is launched w/ TXT)		* (used when kernel is launched w/ TXT)
	*/		*/
	static int force_on = 0;		static int force_on = 0;
			int intel_iommu_tboot_noforce;

	/*		/*
	* 0: Present		* 0: Present
	@@ -607,6 +608,10 @@ static int __init intel_iommu_setup(char *str)
	"Intel-IOMMU: enable pre-production PASID support\n");		"Intel-IOMMU: enable pre-production PASID support\n");
	intel_iommu_pasid28 = 1;		intel_iommu_pasid28 = 1;
	iommu_identity_mapping \|= IDENTMAP_GFX;		iommu_identity_mapping \|= IDENTMAP_GFX;
			} else if (!strncmp(str, "tboot_noforce", 13)) {
			printk(KERN_INFO
			"Intel-IOMMU: not forcing on after tboot. This could expose security risk for tboot\n");
			intel_iommu_tboot_noforce = 1;
	}		}

	str += strcspn(str, ",");		str += strcspn(str, ",");
	@@ -4850,6 +4855,19 @@ int __init intel_iommu_init(void)
	}		}

	if (no_iommu \|\| dmar_disabled) {		if (no_iommu \|\| dmar_disabled) {
			/*
			* We exit the function here to ensure IOMMU's remapping and
			* mempool aren't setup, which means that the IOMMU's PMRs
			* won't be disabled via the call to init_dmars(). So disable
			* it explicitly here. The PMRs were setup by tboot prior to
			* calling SENTER, but the kernel is expected to reset/tear
			* down the PMRs.
			*/
			if (intel_iommu_tboot_noforce) {
			for_each_iommu(iommu, drhd)
			iommu_disable_protect_mem_regions(iommu);
			}

	/*		/*
	* Make sure the IOMMUs are switched off, even when we		* Make sure the IOMMUs are switched off, even when we
	* boot into a kexec kernel and the previous kernel left		* boot into a kexec kernel and the previous kernel left

include/linux/dma_remapping.h

+1 −0

Original line number	Original line	Diff line number	Diff line
	@@ -39,6 +39,7 @@ extern int iommu_calculate_agaw(struct intel_iommu *iommu);
	extern int iommu_calculate_max_sagaw(struct intel_iommu *iommu);		extern int iommu_calculate_max_sagaw(struct intel_iommu *iommu);
	extern int dmar_disabled;		extern int dmar_disabled;
	extern int intel_iommu_enabled;		extern int intel_iommu_enabled;
			extern int intel_iommu_tboot_noforce;
	#else		#else
	static inline int iommu_calculate_agaw(struct intel_iommu *iommu)		static inline int iommu_calculate_agaw(struct intel_iommu *iommu)
	{		{

Admin message