[v2] iommu/amd-vi: remove zeroing of MMIO region

[PATCH v2 0/2] iommu/amd-vi: remove zeroing of MMIO region

Posted by Roger Pau Monne 1 week ago

Hello,

Unconditionally zeroing the whole IOMMU MMIO region is dangerous, at
least on an upcoming platform this does put the IOMMU in a broken state
that's not recoverable by the init procedure in Xen.

Get rid of the zeroing, and instead attempt to disable the IOMMU ahead
of enabling it.

Thanks, Roger.

Roger Pau Monne (2):
  iommu/amd-vi: allow disable_iommu() against non-initialized IOMMUs
  iommu/amd-vi: do not zero IOMMU MMIO region

 xen/drivers/passthrough/amd/iommu_init.c | 41 +++++++++++++-----------
 1 file changed, 22 insertions(+), 19 deletions(-)

-- 
2.53.0

Re: [PATCH v2 0/2] iommu/amd-vi: remove zeroing of MMIO region

Posted by Marek Marczykowski-Górecki 1 week ago

On Wed, May 06, 2026 at 03:55:12PM +0200, Roger Pau Monne wrote:
> Hello,
> 
> Unconditionally zeroing the whole IOMMU MMIO region is dangerous, at
> least on an upcoming platform this does put the IOMMU in a broken state
> that's not recoverable by the init procedure in Xen.
> 
> Get rid of the zeroing, and instead attempt to disable the IOMMU ahead
> of enabling it.

Just to mention it here, while this looks like a step in the right
direction, even better would be to not disable IOMMU at boot, but
reconfigure it - to preserve uninterrupted protection when boot time DMA
protection is enabled in firmware. But that's definitely more work...

-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab

Re: [PATCH v2 0/2] iommu/amd-vi: remove zeroing of MMIO region

Posted by Roger Pau Monné 1 week ago

On Wed, May 06, 2026 at 06:49:47PM +0200, Marek Marczykowski-Górecki wrote:
> On Wed, May 06, 2026 at 03:55:12PM +0200, Roger Pau Monne wrote:
> > Hello,
> > 
> > Unconditionally zeroing the whole IOMMU MMIO region is dangerous, at
> > least on an upcoming platform this does put the IOMMU in a broken state
> > that's not recoverable by the init procedure in Xen.
> > 
> > Get rid of the zeroing, and instead attempt to disable the IOMMU ahead
> > of enabling it.
> 
> Just to mention it here, while this looks like a step in the right
> direction, even better would be to not disable IOMMU at boot, but
> reconfigure it - to preserve uninterrupted protection when boot time DMA
> protection is enabled in firmware. But that's definitely more work...

Yes, we are aware of this.  But IMO booting with the IOMMU enabled
will be a new feature, this is strictly a fix that we can "safely"
backport to stable branches to deal with broken hardware.

Thanks, Roger.