[Xen-devel] [PATCH] iommu: leave IOMMU enabled by default during kexec crash transition

[Igor Druzhinin <igor.druzhinin@xxxxxxxxxx>]

It's unsafe to disable IOMMU on a live system which is the case
if we're crashing since remapping hardware doesn't usually know what
to do with ongoing bus transactions and frequently raises NMI/MCE/SMI,
etc. (depends on the firmware configuration) to signal these abnormalities.
This, in turn, doesn't play well with kexec transition process as there is
no any handling available at the moment for this kind of events resulting
in failures to enter the kernel.

Modern Linux kernels taught to copy all the necessary DMAR/IR tables
following kexec from the previous kernel (Xen in our case) - so it's
currently normal to keep IOMMU enabled. It would only require to change
crash kernel command line by enabling IOMMU drivers from the existing users.

An option is left for compatibility with ancient crash kernels which
didn't like to have IOMMU active under their feet on boot.

Signed-off-by: Igor Druzhinin <igor.druzhinin@xxxxxxxxxx>
---

Jan, Andrew, should we have this option here and, if so, what is the default
value for it should be?

---
 docs/misc/xen-command-line.pandoc | 5 +++++
 xen/arch/x86/crash.c              | 5 +++--
 xen/drivers/passthrough/iommu.c   | 6 ++++++
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/docs/misc/xen-command-line.pandoc 
b/docs/misc/xen-command-line.pandoc
index c8d1ced..8fd4791 100644
--- a/docs/misc/xen-command-line.pandoc
+++ b/docs/misc/xen-command-line.pandoc
@@ -1235,6 +1235,11 @@ boolean (e.g. `iommu=no`) can override this and leave 
the IOMMUs disabled.
     This option depends on `intremap`, and is disabled by default due to some
     corner cases in the implementation which have yet to be resolved.
 
+*   The `crash-shutdown` boolean controls shutting down IOMMU before switching
+    to a crash kernel through kexec. This option is inactive by default and
+    is for compatibility with older kexec kernels only as modern kernels copy
+    all the necessary tables from the previous kernel following kexec 
transition.
+
 The following options are specific to Intel VT-d hardware:
 
 *   The `snoop` boolean controls the Snoop Control sub-feature, and is active
diff --git a/xen/arch/x86/crash.c b/xen/arch/x86/crash.c
index 60c98b6..fd67c10 100644
--- a/xen/arch/x86/crash.c
+++ b/xen/arch/x86/crash.c
@@ -162,8 +162,9 @@ static void nmi_shootdown_cpus(void)
         printk("Failed to shoot down CPUs {%*pbl}\n",
                nr_cpu_ids, cpumask_bits(&waiting_to_crash));
 
-    /* Crash shutdown any IOMMU functionality as the crashdump kernel is not
-     * happy when booting if interrupt/dma remapping is still enabled */
+    /* Try to crash shutdown IOMMU functionality as some old crashdump
+     * kernels are not happy when booting if interrupt/dma remapping
+     * is still enabled */
     iommu_crash_shutdown();
 
     __stop_this_cpu();
diff --git a/xen/drivers/passthrough/iommu.c b/xen/drivers/passthrough/iommu.c
index 5ecaa10..75f1211 100644
--- a/xen/drivers/passthrough/iommu.c
+++ b/xen/drivers/passthrough/iommu.c
@@ -35,6 +35,7 @@ bool_t __read_mostly iommu_igfx = 1;
 bool_t __read_mostly iommu_snoop = 1;
 bool_t __read_mostly iommu_qinval = 1;
 bool_t __read_mostly iommu_intremap = 1;
+bool_t __read_mostly iommu_crash_shutdown_enable;
 
 static bool __hwdom_initdata iommu_hwdom_none;
 bool __hwdom_initdata iommu_hwdom_strict;
@@ -88,6 +89,8 @@ static int __init parse_iommu_param(const char *s)
             iommu_intremap = val;
         else if ( (val = parse_boolean("intpost", s, ss)) >= 0 )
             iommu_intpost = val;
+        else if ( (val = parse_boolean("crash-shutdown", s, ss)) >= 0 )
+            iommu_crash_shutdown_enable = val;
         else if ( (val = parse_boolean("debug", s, ss)) >= 0 )
         {
             iommu_debug = val;
@@ -579,6 +582,9 @@ void iommu_share_p2m_table(struct domain* d)
 
 void iommu_crash_shutdown(void)
 {
+    if ( !iommu_crash_shutdown_enable )
+        return;
+
     if ( iommu_enabled )
         iommu_get_ops()->crash_shutdown();
     iommu_enabled = iommu_intremap = iommu_intpost = 0;
-- 
2.7.4


_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel