validate IOMMU support

[Wim Vervoorn]

Hello,

I added IOMMU support to coreboot (DMAR tables with filled DHRD and RMRR structures) and want to make sure everything is configured correctly.

I did check this using the Ubuntu fwts and also checked using qubues-hcl-report. All of these seem fine and I don't notice any obvious issues issues in my Qubes 4.0 rc 3 installation.

There are no warnings regarding this in the dmesg and journalctl.

Can I assume everything has been implemented correctly in Qubes or should I perform additional testing to make sure this is really working?

Best regards,

Wim Vervoorn

[awokd]

Not sure how "obvious" you mean, but I think if you have tested PCI
passthrough to an HVM and it works, you should be good.

[Wim Vervoorn]

Hello,

Thanks. I tried this. Now I am running into problems with the PCI devices I am using. Qubes can't reset those. For some reason they are not exposing the FLR capability. I am trying to find out why because they should according to the datasheet.

Best regards,

[awokd]

On Fri, January 12, 2018 8:23 am, Wim Vervoorn wrote:
> Hello,
>
>

> Thanks. I tried this. Now I am running into problems with the PCI devices
> I am using. Qubes can't reset those. For some reason they are not
> exposing the FLR capability. I am trying to find out why because they
> should according to the datasheet.

I'm personally interested in this because I have the same issue with a
Corebooted laptop so please let me know if you figure it out, but there
are probably going to be more subject matter experts over on the Coreboot
mailing list!

For purposes of validating IOMMU support though, as long as you can get
one PCI device passed through I think that would be all that matters?

[Tai...@gmx.com]

If you can pass through a device, you have quality IOMMU groups and
IOMMU-IR is enabled in dmesg then you are good to go.

I too would like to know how to modify the PCI capabilities list.

[Wim Vervoorn]

Hello,

I can understand that but there is no general rule for that. In many cases this won't be possible at all. In some cases this can be achieved by changing some configurations in the chip but in many cases this will not be documented in public documents.

I do think some things in Qubes can be improved regarding this support.

What I noticed is that all PCI devices in the systems are listed and can be assigned to a VM BUT when I try to do this the VM will not start (without any message to the user). I think two things can be improved here.
1) Only list the devices that can actually be used ( so they should support FLR or PM reset or bus reset). Listing the others is confusing and will cause frustration by the users
2) Provide some user feedback anyhow when a VM fails to start. Now a user needs to consult the log to check what happens. This is not really convenient.


Best regards,

Wim Vervoorn

-----Original Message-----
From: Frans Hendriks
Sent: Monday, January 15, 2018 9:42 AM
To: Wim Vervoorn <wver...@eltan.com>

Subject: FW: [SPAM] Re: [qubes-users] validate IOMMU support

-----Original Message-----
From: Tai...@gmx.com [mailto:Tai...@gmx.com]
Sent: vrijdag 12 januari 2018 18:24
To: aw...@danwin1210.me; Wim Vervoorn <wver...@eltan.com>
Cc: qubes-users <qubes...@googlegroups.com>

[awokd]

On Mon, January 15, 2018 9:40 am, Wim Vervoorn wrote:
> Hello,
>
>

> I can understand that but there is no general rule for that. In many
> cases this won't be possible at all. In some cases this can be achieved
> by changing some configurations in the chip but in many cases this will
> not be documented in public documents.
>
> I do think some things in Qubes can be improved regarding this support.
>
>
> What I noticed is that all PCI devices in the systems are listed and can
> be assigned to a VM BUT when I try to do this the VM will not start
> (without any message to the user). I think two things can be improved
> here. 1) Only list the devices that can actually be used ( so they should
> support FLR or PM reset or bus reset). Listing the others is confusing
> and will cause frustration by the users 2) Provide some user feedback
> anyhow when a VM fails to start. Now a user needs to consult the log to
> check what happens. This is not really convenient.

There is a FAQ entry on it at least: https://www.qubes-os.org/faq/
Often you can still use them if you disable the strict reset requirement.

[Wim Vervoorn]

Hello,

Thanks, I overlooked the no-strict-reset option. I will give this a try and see how it works out.

Wim

-----Original Message-----
From: awokd [mailto:aw...@danwin1210.me]
Sent: Monday, January 15, 2018 12:26 PM
To: Wim Vervoorn <wver...@eltan.com>