On Mon, 2014-05-12 at 19:04 +0200, Daniel Vetter wrote:
> On Mon, May 12, 2014 at 6:16 PM, Andy Lutomirski <luto@amacapital.net> wrote:
> > Just to check: are you talking about disabling the IOMMU if there's a
> > fault storm or disabling reporting of IOMMU faults?
> 
> Re-enabling of the IOMMU after it was completely shut off to isolate a
> fault storm from a rouge device. Since if I as a developer still have
> to reboot if I wreak havoc in my driver it's only marginally better
> than a box that went down in a iommu page fault storm. But if I can
> just reload the driver (with the bug fixed) and get back a working
> device because the IOMMU was re-enabling then that would help. Not
> sure yet how feasible this really is.

You probably don't want to completely isolate it in that case. If it's
doing some bad DMA *and* it's also doing some good DMA to display its
framebuffer, why stop the latter?

The Intel IOMMU at least can be configured to avoid reporting faults for
a given device (well, requester-id). So valid transactions still happen,
while invalid transactions are still blocked. But silently, without
bothering the host with the details and causing a fault-IRQ storm.

-- 
David Woodhouse                            Open Source Technology Centre
David.Woodhouse@intel.com                              Intel Corporation