iommu: leave IOMMU enabled by default during kexec crash transition

It's unsafe to disable IOMMU on a live system which is the case
if we're crashing since remapping hardware doesn't usually know what
to do with ongoing bus transactions and frequently raises NMI/MCE/SMI,
etc. (depends on the firmware configuration) to signal these abnormalities.
This, in turn, doesn't play well with kexec transition process as there is
no handling available at the moment for this kind of events resulting
in failures to enter the kernel.

Modern Linux kernels taught to copy all the necessary DMAR/IR tables
following kexec from the previous kernel (Xen in our case) - so it's
currently normal to keep IOMMU enabled. It might require minor changes to
kdump command line that enables IOMMU drivers (e.g. intel_iommu=on /
intremap=on) but recent kernels don't require any additional changes for
the transition to be transparent.

A fallback option is still left for compatibility with ancient crash
kernels which didn't like to have IOMMU active under their feet on boot.

Signed-off-by: Igor Druzhinin <igor.druzhinin@citrix.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
master commit: 12c36f577d454996c882ecdc5da8113ca2613646
master date: 2019-03-12 14:38:12 +0100

diff --git a/docs/misc/xen-command-line.pandoc b/docs/misc/xen-command-line.pandoc
index 2a3e812cebe31c621bdf3cc9b76675321f39c4f1..742555616d6805a11808929bf29d176469548ea8 100644 (file)
--- a/docs/misc/xen-command-line.pandoc
+++ b/docs/misc/xen-command-line.pandoc
@@ -1172,7 +1172,7 @@ detection of systems known to misbehave upon accesses to that port.
 
 ### iommu
     = List of [ <bool>, verbose, debug, force, required,
-                sharept, intremap, intpost,
+                sharept, intremap, intpost, crash-disable,
                 snoop, qinval, igfx, amd-iommu-perdev-intremap,
                 dom0-{passthrough,strict} ]
 
@@ -1234,6 +1234,12 @@ boolean (e.g. `iommu=no`) can override this and leave the IOMMUs disabled.
     This option depends on `intremap`, and is disabled by default due to some
     corner cases in the implementation which have yet to be resolved.
 
+*   The `crash-disable` boolean controls disabling IOMMU functionality (DMAR/IR/QI)
+    before switching to a crash kernel. This option is inactive by default and
+    is for compatibility with older kdump kernels only. Modern kernels copy
+    all the necessary tables from the previous one following kexec which makes
+    the transition transparent for them with IOMMU functions still on.
+
 The following options are specific to Intel VT-d hardware:
 
 *   The `snoop` boolean controls the Snoop Control sub-feature, and is active

diff --git a/xen/arch/x86/crash.c b/xen/arch/x86/crash.c
index 60c98b6175beecfd732cb8f3215baeac18cd670b..01e48a113302ad768944001da82f85d3bb4b80b1 100644 (file)
--- a/xen/arch/x86/crash.c
+++ b/xen/arch/x86/crash.c
@@ -162,8 +162,11 @@ static void nmi_shootdown_cpus(void)
         printk("Failed to shoot down CPUs {%*pbl}\n",
                nr_cpu_ids, cpumask_bits(&waiting_to_crash));
 
-    /* Crash shutdown any IOMMU functionality as the crashdump kernel is not
-     * happy when booting if interrupt/dma remapping is still enabled */
+    /*
+     * Try to crash shutdown IOMMU functionality as some old crashdump
+     * kernels are not happy when booting if interrupt/dma remapping
+     * is still enabled.
+     */
     iommu_crash_shutdown();
 
     __stop_this_cpu();

diff --git a/xen/drivers/passthrough/iommu.c b/xen/drivers/passthrough/iommu.c
index 117b869b0c4417f279ff0337751808d76617967f..a6697d58fbb6995aecfaa1e1b0b2b405849f5314 100644 (file)
--- a/xen/drivers/passthrough/iommu.c
+++ b/xen/drivers/passthrough/iommu.c
@@ -34,6 +34,7 @@ bool_t __read_mostly iommu_igfx = 1;
 bool_t __read_mostly iommu_snoop = 1;
 bool_t __read_mostly iommu_qinval = 1;
 bool_t __read_mostly iommu_intremap = 1;
+bool_t __read_mostly iommu_crash_disable;
 
 static bool __hwdom_initdata iommu_hwdom_none;
 bool __hwdom_initdata iommu_hwdom_strict;
@@ -85,6 +86,10 @@ static int __init parse_iommu_param(const char *s)
             iommu_intremap = val;
         else if ( (val = parse_boolean("intpost", s, ss)) >= 0 )
             iommu_intpost = val;
+#ifdef CONFIG_KEXEC
+        else if ( (val = parse_boolean("crash-disable", s, ss)) >= 0 )
+            iommu_crash_disable = val;
+#endif
         else if ( (val = parse_boolean("debug", s, ss)) >= 0 )
         {
             iommu_debug = val;
@@ -576,6 +581,9 @@ void iommu_share_p2m_table(struct domain* d)
 
 void iommu_crash_shutdown(void)
 {
+    if ( !iommu_crash_disable )
+        return;
+
     if ( iommu_enabled )
         iommu_get_ops()->crash_shutdown();
     iommu_enabled = iommu_intremap = iommu_intpost = 0;