RE: [PATCH v5 1/2] x86/tboot: Add support for parsing DTPR table and disabling TPRs

From: Sun, Ning

Date: Mon Oct 05 2026 - 14:39:14 EST

Thanks for addressing the feedback from the previous iterations, the patch looks good to me.

Reviewed-by: Ning Sun <ning.sun@xxxxxxxxx>

> -----Original Message-----
> From: Michal Camacho Romero <michal.camacho.romero@xxxxxxxxxxxxxxx>
> Sent: Wednesday, September 30, 2026 5:31 AM
> To: Baolu Lu <baolu.lu@xxxxxxxxxxxxxxx>; Sun, Ning <ning.sun@xxxxxxxxx>; Thomas Gleixner <tglx@xxxxxxxxxx>
> Cc: Camacho Romero, Michal <michal.camacho.romero@xxxxxxxxx>; x86@xxxxxxxxxx; iommu@xxxxxxxxxxxxxxx; tboot-
> devel@xxxxxxxxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Mowka, Mateusz <mateusz.mowka@xxxxxxxxx>; Pawlicki, AdamX
> <adamx.pawlicki@xxxxxxxxx>; Randzio, Pawel <pawel.randzio@xxxxxxxxx>
> Subject: [PATCH v5 1/2] x86/tboot: Add support for parsing DTPR table and disabling TPRs
>
> From: Michal Camacho Romero <michal.camacho.romero@xxxxxxxxx>
>
> Add functions to locate and parse the DMA TXT Protection Ranges (DTPR) table from the TXT heap's SinitMleData extended data
> elements (requires SINIT MLE version >= 9).
>
> * tboot_check_txt_heap_section_bounds() - function checks if a given
> TXT heap section is within
> the bounds of the heap.
>
> * tboot_get_dtpr_table() - function walks through the
> TXT heap to find the DTPR
> extended data element (type
> HEAP_EXTDATA_TYPE_DTPR) and
> returns pointer to the DTPR
> table.
>
> * tboot_disable_tprs() - function iterates over TPR
> instances and disables each
> TPR region by setting bit 4
> in the TPRn_BASE register via
> MMIO.
>
> Using these functions will allow the kernel to deactivate SINIT ACM-established TPRs prior to the Linux OS launch.
>
> Link: https://uefi.org/sites/default/files/resources/633933_Intel_TXT_DMA_Protection_Ranges_rev_0p73.pdf
> Link: https://cdrdv2-public.intel.com/315168/315168_TXT_MLE_DG_rev_017_7.pdf
> Signed-off-by: Michal Camacho Romero <michal.camacho.romero@xxxxxxxxx>
> ---
>
> Thanks for the careful review. Summary of how each point is handled:
>
> 1. There is no need to validate TPR base addresses in the kernel as the SINIT
> ACM performs the whole DTPR table verification against the platform's
> hardware register map (each address == MCHBAR/IMH base + a known per-TPR
> offset, matching TPR/instance counts, full coverage) and aborts the secure
> launch on any mismatch. Each one sits at MCHBAR + a fixed offset, and that
> offset differs per CPU, so there's no single address range the kernel can
> check against.
>
> 2. According to the DTPR spec - Intel® Trusted Execution Technology
> (Intel® TXT) DMA Protection Ranges (633933 rev 0.73, Table 3-1/3-2), the
> serialization registers are not a separate object - SrlCnt and the SR address
> array are trailing fields of the same variable-length DTPR table, right after
> the instance array. So, there is no need to treat the serialization
> registers as a separate object.
>
> 4. Extended-element walk / forward progress: the size-driven traversal is
> required by the format - the SinitMleData extended-data area is a
> self-describing, variable-length element list with no stored count,
> terminated only by a TYPE_END element, so it must be walked via each
> element's size field.
>
> The rest of your suggestion have been applied in the current patch version
>
> Regards,
> Michal Camacho Romero
> arch/x86/kernel/tboot.c | 400 ++++++++++++++++++++++++++++++++++++++--
> include/linux/tboot.h | 22 +++
> 2 files changed, 407 insertions(+), 15 deletions(-)
>
> diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c index 46b8f1f16676..4455772d8cc3 100644
> --- a/arch/x86/kernel/tboot.c
> +++ b/arch/x86/kernel/tboot.c
> @@ -18,6 +18,7 @@
> #include <linux/mm.h>
> #include <linux/tboot.h>
> #include <linux/debugfs.h>
> +#include <acpi/actbl1.h>
>
> #include <asm/realmode.h>
> #include <asm/processor.h>
> @@ -223,6 +224,143 @@ static int tboot_setup_sleep(void)
>
> #endif
>
> +static bool tboot_check_txt_heap_section_bounds(const u64 heap_end,
> + void *heap_section,
> + u64* heap_section_size,
> + const char
> +*section_name) {
> + if (!heap_section) {
> + pr_err("%s section is NULL\n", section_name);
> + return false;
> + }
> +
> + if (!heap_section_size) {
> + pr_err("%s section size pointer is NULL\n", section_name);
> + return false;
> + }
> +
> + *heap_section_size = 0;
> +
> + if ((u64)heap_section > heap_end || heap_end - (u64)heap_section < 8) {
> + pr_err("%s size field exceeds heap boundary\n", section_name);
> + return false;
> + }
> +
> + /* Read the size of the current TXT Heap section */
> + *heap_section_size = *(u64 __force *)heap_section;
> +
> + if (*heap_section_size < 8) {
> + pr_err("%s size is too small\n", section_name);
> + return false;
> + }
> +
> + if (*heap_section_size > heap_end - (u64)heap_section) {
> + pr_err("%s exceeds heap boundary\n", section_name);
> + return false;
> + }
> +
> + return true;
> +}
> +
> +static bool tboot_check_dtpr_size(const struct heap_ext_data_elt *elt)
> +{
> + u64 dtpr_payload_size, dtpr_offset;
> + u32 i, ref_tpr_cnt;
> +
> + struct acpi_table_dtpr *dtpr = NULL;
> + struct acpi_tpr_instance *tpr_inst = NULL;
> + struct acpi_tpr_aux_sr *tpr_aux_srl = NULL;
> +
> + if (!elt) {
> + pr_err("DTPR element heap extension data is NULL\n");
> + return false;
> + }
> +
> + dtpr = (struct acpi_table_dtpr *)elt->data;
> + dtpr_payload_size = elt->size - sizeof(*elt);
> +
> + if (dtpr_payload_size < sizeof(struct acpi_table_dtpr)) {
> + pr_err("DTPR element payload too small for a DTPR header\n");
> + return false;
> + }
> +
> + if (dtpr->header.length != dtpr_payload_size) {
> + pr_err("Mismatch between DTPR table length and payload size\n");
> + return false;
> + }
> +
> + dtpr_offset = sizeof(struct acpi_table_dtpr);
> +
> + if (dtpr_offset > dtpr_payload_size) {
> + pr_err("TPR header exceeds table's declared size\n");
> + return false;
> + }
> +
> + if (dtpr->ins_cnt < 1) {
> + pr_err("DTPR table declares no TPR instances\n");
> + return false;
> + }
> +
> + for (i = 0; i < dtpr->ins_cnt; i++) {
> + /* prove this instance's header is in bounds before reading it */
> + if (dtpr_offset + sizeof(struct acpi_tpr_instance) > dtpr_payload_size) {
> + pr_err("TPR instance No.%u header exceeds DTPR table size\n", i);
> + return false;
> + }
> +
> + /* iterate to the current TPR instance */
> + tpr_inst = (struct acpi_tpr_instance *)((u8 *)dtpr + dtpr_offset);
> +
> + if (tpr_inst->tpr_cnt < 2) {
> + pr_err("TPR Instance %u has less than 2 TPRs, further DTPR "
> + "processing interrupted.\n", i);
> + return false;
> + }
> +
> + /* all instances must carry the same TPR count as the first */
> + if (i == 0)
> + ref_tpr_cnt = tpr_inst->tpr_cnt;
> + else if (tpr_inst->tpr_cnt != ref_tpr_cnt) {
> + pr_err("TPR Instance %u has inconsistent TPR count: expected %u,"
> + " found %u\n", i, ref_tpr_cnt, tpr_inst->tpr_cnt);
> + return false;
> + }
> +
> + /* iterate over each TPR instance */
> + dtpr_offset += sizeof(struct acpi_tpr_instance) +
> + tpr_inst->tpr_cnt * sizeof(struct acpi_tpr_array);
> +
> + /* verify TPR array size for this instance */
> + if (dtpr_offset > dtpr_payload_size) {
> + pr_err("TPR instance No.%d TPR entries exceed DTPR table size\n",
> + i);
> + return false;
> + }
> + }
> +
> + tpr_aux_srl = (struct acpi_tpr_aux_sr *)((u8 *)dtpr + dtpr_offset);
> + dtpr_offset += sizeof(u32);
> +
> + if (dtpr_offset > dtpr_payload_size) {
> + pr_err("TPR SRL count field exceeds DTPR table size\n");
> + return false;
> + }
> +
> + dtpr_offset += tpr_aux_srl->srl_cnt *
> + sizeof(struct acpi_tpr_serialize_request);
> + if (dtpr_offset > dtpr_payload_size) {
> + pr_err("TPR SRL entries exceed DTPR table size\n");
> + return false;
> + }
> +
> + if (dtpr_offset < dtpr_payload_size) {
> + pr_err("DTPR table is smaller than expected\n");
> + return false;
> + }
> +
> + return true;
> +}
> +
> void tboot_shutdown(u32 shutdown_type)
> {
> void (*shutdown)(void);
> @@ -454,21 +592,23 @@ struct sha1_hash { };
>
> struct sinit_mle_data {
> - u32 version; /* currently 6 */
> - struct sha1_hash bios_acm_id;
> - u32 edx_senter_flags;
> - u64 mseg_valid;
> - struct sha1_hash sinit_hash;
> - struct sha1_hash mle_hash;
> - struct sha1_hash stm_hash;
> - struct sha1_hash lcp_policy_hash;
> - u32 lcp_policy_control;
> - u32 rlp_wakeup_addr;
> - u32 reserved;
> - u32 num_mdrs;
> - u32 mdrs_off;
> - u32 num_vtd_dmars;
> - u32 vtd_dmars_off;
> + u32 version; /* currently 9 */
> + struct sha1_hash bios_acm_id;
> + u32 edx_senter_flags;
> + u64 mseg_valid;
> + struct sha1_hash sinit_hash;
> + struct sha1_hash mle_hash;
> + struct sha1_hash stm_hash;
> + struct sha1_hash lcp_policy_hash;
> + u32 lcp_policy_control;
> + u32 rlp_wakeup_addr;
> + u32 reserved;
> + u32 num_mdrs;
> + u32 mdrs_off;
> + u32 num_vtd_dmars;
> + u32 vtd_dmars_off;
> + u32 proc_scrtm_status; /* version 8 or later only*/
> + struct heap_ext_data_elt ext_data_elts[];
> } __packed;
>
> struct acpi_table_header *tboot_get_dmar_table(struct acpi_table_header *dmar_tbl) @@ -514,3 +654,233 @@ struct
> acpi_table_header *tboot_get_dmar_table(struct acpi_table_header *dmar_tb
>
> return dmar_tbl;
> }
> +
> +struct acpi_table_dtpr *tboot_get_dtpr_table(void __iomem **heap_base)
> +{
> + void *heap_ptr, *config, *sinit_mle_end;
> + struct sinit_mle_data *sinit_mle;
> + struct heap_ext_data_elt *elt;
> + u64 heap_end, heap_size, sinit_mle_size, heap_section_size;
> +
> + if (!heap_base) {
> + pr_warn("Heap base pointer is NULL.\n");
> + return NULL;
> + }
> +
> + if (!tboot_enabled())
> + return NULL;
> + /*
> + * ACPI tables may not be DMA protected by tboot, so use DMAR copy
> + * SINIT saved in SinitMleData in TXT heap (which is DMA protected)
> + */
> +
> + /* map config space in order to get heap addr */
> + config = ioremap(TXT_PUB_CONFIG_REGS_BASE, NR_TXT_CONFIG_PAGES *
> + PAGE_SIZE);
> + if (!config)
> + return NULL;
> +
> + /* now map TXT heap */
> + heap_size = *(u64 __force *)(config + TXTCR_HEAP_SIZE);
> + *heap_base = ioremap(*(u64 __force *)(config + TXTCR_HEAP_BASE), heap_size);
> + iounmap(config);
> +
> + if (!(*heap_base))
> + return NULL;
> +
> + if (heap_size == 0 || (u64)(*heap_base) + heap_size < (u64)(*heap_base)) {
> + pr_err("TXT heap size invalid or overflows\n");
> + goto err;
> + }
> +
> + heap_end = (u64)(*heap_base) + heap_size;
> +
> + /* walk heap to SinitMleData */
> + /* skip BiosData */
> + /* get BiosData section size */
> + if (!tboot_check_txt_heap_section_bounds(heap_end, *heap_base,
> + &heap_section_size, "BiosData")) {
> + goto err;
> + }
> +
> + /* skip OsMleData */
> + heap_ptr = *heap_base + heap_section_size;
> + /* get OsMleData section size */
> + if (!tboot_check_txt_heap_section_bounds(heap_end, heap_ptr,
> + &heap_section_size, "OsMleData")) {
> + goto err;
> + }
> +
> + /* skip OsSinitData */
> + heap_ptr += heap_section_size;
> + /* get OsSinitData section size */
> + if (!tboot_check_txt_heap_section_bounds(heap_end, heap_ptr,
> + &heap_section_size, "OsSinitData")) {
> + goto err;
> + }
> +
> + /* jump to the SinitMleData */
> + heap_ptr += heap_section_size;
> + sinit_mle_size = 0;
> + /* now points to SinitMleDataSize; set to SinitMleData */
> + if (!tboot_check_txt_heap_section_bounds(heap_end, heap_ptr,
> + &sinit_mle_size, "SinitMleData")) {
> + goto err;
> + }
> +
> + heap_ptr += sizeof(u64);
> + sinit_mle = (struct sinit_mle_data *)heap_ptr;
> + sinit_mle_end = (void *)sinit_mle + sinit_mle_size;
> + if (sizeof(struct sinit_mle_data) > sinit_mle_size) {
> + pr_err("SinitMleData size is smaller than expected.\n");
> + goto err;
> + }
> +
> + if (sinit_mle->version < 9) {
> + pr_err("Unsupported SinitMleData version: %u\n", sinit_mle->version);
> + goto err;
> + }
> +
> + heap_ptr += sizeof(struct sinit_mle_data);
> + if (heap_ptr > sinit_mle_end) {
> + pr_err("SinitMleData header out of bounds.\n");
> + goto err;
> + }
> +
> + /*
> + * The SinitMleData extended-data area is a self-describing list of
> + * variable-length elements with no stored element count; it is
> + * terminated only by a HEAP_EXTDATA_TYPE_END element. Traversal must
> + * therefore be driven by each element's own size field. Forward
> + * progress and termination are guaranteed on every iteration:
> + * - the 8-byte header is bounds-checked before type/size are read,
> + * - elt->size >= sizeof(*elt) enforces a strictly-positive advance,
> + * - the "elt <= sinit_mle_end" cap bounds the number of steps.
> + */
> + elt = sinit_mle->ext_data_elts;
> + do {
> + if ((u8 *)elt + sizeof(*elt) > (u8 *)sinit_mle_end) {
> + pr_err("SinitMleData element header out of bounds.\n");
> + goto err;
> + }
> +
> + if (elt->size < sizeof(*elt)) {
> + pr_err("Invalid SinitMleData element size: %u\n", elt->size);
> + goto err;
> + }
> +
> + if (elt->type == HEAP_EXTDATA_TYPE_END ||
> + elt->type == HEAP_EXTDATA_TYPE_DTPR) {
> + break;
> + }
> +
> + elt = (void *)elt + elt->size;
> + } while ((void *)elt <= sinit_mle_end);
> +
> + if ((void *)elt >= sinit_mle_end){
> + pr_err("Reached the end of SinitMleData without finding DTPR nor END"
> + " element.\n");
> + goto err;
> + }
> +
> + if (elt->type == HEAP_EXTDATA_TYPE_END) {
> + pr_err("DTPR element not found in SinitMleData\n");
> + goto err;
> + }
> +
> + if ((u8 *)elt + elt->size > (u8 *)sinit_mle_end) {
> + pr_err("DTPR Table exceeds SinitMleData bounds.\n");
> + goto err;
> + }
> +
> + if (!tboot_check_dtpr_size(elt)) {
> + pr_err("Invalid DTPR Table size.\n");
> + goto err;
> + }
> +
> + return (struct acpi_table_dtpr *)elt->data;
> +
> +err:
> + iounmap(*heap_base);
> + *heap_base = NULL;
> + return NULL;
> +}
> +
> +static bool tboot_tpr_enabled = false;
> +void tboot_disable_tprs(struct acpi_table_dtpr *dtpr, void __iomem
> +**heap_base) {
> + struct acpi_tpr_instance *tpr_inst;
> + struct acpi_tpr_array *tpr_arr;
> + u32 *instance_cnt;
> + void __iomem *base;
> + u32 i, j;
> +
> + if (!heap_base) {
> + pr_warn("Heap base pointer is NULL.\n");
> + return;
> + }
> +
> + if (!(*heap_base)) {
> + pr_warn("Heap base is NULL.\n");
> + return;
> + }
> +
> + if (dtpr == NULL) {
> + pr_warn("DTPR Table is NULL.\n");
> + goto teardown;
> + }
> +
> + if (!tboot_enabled()) {
> + pr_warn("TBOOT is not enabled. TPR weren't set by TBOOT and"
> + " SINIT ACM.\n");
> + goto teardown;
> + }
> +
> + instance_cnt = (u32 *)(&dtpr->ins_cnt);
> + tpr_inst = (struct acpi_tpr_instance *)(instance_cnt + 1);
> +
> + for (i = 0; i < *instance_cnt; ++i) {
> + for (j = 0; j < tpr_inst->tpr_cnt; ++j) {
> + tpr_arr = (struct acpi_tpr_array *)((u8 *) tpr_inst +
> + sizeof(struct acpi_tpr_instance) +
> + j * sizeof(struct acpi_tpr_array));
> +
> + /*
> + * Each TPR base address has already been verified by the SINIT ACM,
> + * so it can be treated as trustworthy and used safely for I/O
> + * mapping.
> + */
> + base = ioremap(tpr_arr->base, 16);
> + if (!base) {
> + pr_warn("TPR Instance %d, TPR No.%d disabling failure.\n",
> + i, j);
> + continue;
> + }
> +
> + pr_info("TPR instance %d, TPR %d:base %llx limit %llx\n", i, j,
> + readq(base), readq((u8 __iomem *)base + 8));
> + writeq(readq(base) | TPR_BASE_DISABLE_BIT, base);
> + if (!tboot_tpr_enabled)
> + tboot_tpr_enabled = true;
> + iounmap(base);
> + }
> +
> + tpr_inst = (struct acpi_tpr_instance *)((u8 *)tpr_inst +
> + sizeof(*tpr_inst) + j * sizeof(struct acpi_tpr_array));
> + }
> +
> + if (tboot_tpr_enabled)
> + pr_debug("TPR protection detected, PMR will be disabled\n");
> +
> + goto teardown;
> +
> +teardown:
> + iounmap(*heap_base);
> + *heap_base = NULL;
> + return;
> +}
> +
> +bool tboot_is_tpr_enabled(void)
> +{
> + return tboot_tpr_enabled;
> +}
> diff --git a/include/linux/tboot.h b/include/linux/tboot.h index d2279160ef39..f59c8026eabf 100644
> --- a/include/linux/tboot.h
> +++ b/include/linux/tboot.h
> @@ -24,10 +24,17 @@ enum {
> #include <linux/acpi.h>
> /* used to communicate between tboot and the launched kernel */
>
> +/*TXT Extended Data Element Types*/
> +#define HEAP_EXTDATA_TYPE_END 0
> +#define HEAP_EXTDATA_TYPE_DTPR 14
> +
> #define TB_KEY_SIZE 64 /* 512 bits */
>
> #define MAX_TB_MAC_REGIONS 32
>
> +/*TPR Base Disable BIT*/
> +#define TPR_BASE_DISABLE_BIT BIT(4)
> +
> struct tboot_mac_region {
> u64 start; /* must be 64 byte -aligned */
> u32 size; /* must be 64 byte -granular */
> @@ -58,6 +65,15 @@ struct tboot_acpi_sleep_info {
> u64 kernel_s3_resume_vector;
> } __packed;
>
> +/*
> + * structure for tboot extended data elements */ struct
> +heap_ext_data_elt {
> + u32 type;
> + u32 size;
> + u8 data[];
> +} __packed;
> +
> /*
> * shared memory page used for communication between tboot and kernel
> */
> @@ -122,10 +138,13 @@ struct tboot {
> 0xaa, 0x19, 0xea, 0x4d, 0x5, 0x7a, 0x8}
>
> bool tboot_enabled(void);
> +extern void tboot_disable_tprs(struct acpi_table_dtpr *, void __iomem
> +**);
> extern void tboot_probe(void);
> extern void tboot_shutdown(u32 shutdown_type); extern struct acpi_table_header *tboot_get_dmar_table(
> struct acpi_table_header *dmar_tbl);
> +extern struct acpi_table_dtpr *tboot_get_dtpr_table(void __iomem **);
> +extern bool tboot_is_tpr_enabled(void);
>
> #else
>
> @@ -135,6 +154,9 @@ extern struct acpi_table_header *tboot_get_dmar_table(
> #define tboot_sleep(sleep_state, pm1a_control, pm1b_control) \
> do { } while (0)
> #define tboot_get_dmar_table(dmar_tbl) (dmar_tbl)
> +#define tboot_get_dtpr_table(heap_base) NULL #define
> +tboot_disable_tprs(dtpr, heap_base) do { } while (0) #define
> +tboot_is_tpr_enabled() 0
>
> #endif /* !CONFIG_INTEL_TXT */
>
> --
> 2.55.0