From: Samiullah Khawaja <skhawaja@google.com>
To: David Woodhouse <dwmw2@infradead.org>,
Lu Baolu <baolu.lu@linux.intel.com>,
Joerg Roedel <joro@8bytes.org>, Will Deacon <will@kernel.org>,
Jason Gunthorpe <jgg@ziepe.ca>
Cc: YiFei Zhu <zhuyifei@google.com>,
Pranjal Shrivastava <praan@google.com>,
Samiullah Khawaja <skhawaja@google.com>,
Robin Murphy <robin.murphy@arm.com>,
Kevin Tian <kevin.tian@intel.com>,
Alex Williamson <alex@shazbot.org>, Shuah Khan <shuah@kernel.org>,
iommu@lists.linux.dev, linux-kernel@vger.kernel.org,
kvm@vger.kernel.org, Pratyush Yadav <pratyush@kernel.org>,
Pasha Tatashin <pasha.tatashin@soleen.com>,
David Matlack <dmatlack@google.com>,
Andrew Morton <akpm@linux-foundation.org>,
Vipin Sharma <vipinsh@google.com>
Subject: [PATCH v5 14/18] iommufd: Implement ioctl to mark HWPT for preservation
Date: Mon, 21 Sep 2026 00:48:30 +0000 [thread overview]
Message-ID: <20260921004834.2601285-15-skhawaja@google.com> (raw)
In-Reply-To: <20260921004834.2601285-1-skhawaja@google.com>
From: YiFei Zhu <zhuyifei@google.com>
Userspace provides a token to mark the HWPT for preservation. Note that
this token is not the LUO token that is used to preserve the iommufd.
Once all the required HWPT are marked for preservation, the user can
preserve the iommufd into LUO. The iommufd will preserve the HWPTs that
are marked for preservation.
The marked HWPTs are tracked using a new XArray mark protected by a new
liveupdate mutex. This mutex will also be used during iommufd
preservation to protect against any race with the mark preserve ioctl.
The HWPT token will be used during restore to identify this HWPT. The
restoration logic is not implemented and will be added later.
Reviewed-by: Pranjal Shrivastava <praan@google.com>
Signed-off-by: YiFei Zhu <zhuyifei@google.com>
Signed-off-by: Samiullah Khawaja <skhawaja@google.com>
---
MAINTAINERS | 1 +
drivers/iommu/iommufd/Makefile | 1 +
drivers/iommu/iommufd/iommufd_private.h | 17 ++++++
drivers/iommu/iommufd/liveupdate.c | 71 +++++++++++++++++++++++++
drivers/iommu/iommufd/main.c | 9 ++++
include/uapi/linux/iommufd.h | 27 ++++++++++
6 files changed, 126 insertions(+)
create mode 100644 drivers/iommu/iommufd/liveupdate.c
diff --git a/MAINTAINERS b/MAINTAINERS
index ae6df95dc398..d4848ec3a9d6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -13728,6 +13728,7 @@ M: Samiullah Khawaja <skhawaja@google.com>
R: Pranjal Shrivastava <praan@google.com>
L: iommu@lists.linux.dev
S: Maintained
+F: drivers/iommu/iommufd/liveupdate.c
F: drivers/iommu/liveupdate.c
F: include/linux/iommu-liveupdate.h
F: include/linux/kho/abi/iommu.h
diff --git a/drivers/iommu/iommufd/Makefile b/drivers/iommu/iommufd/Makefile
index 67207914bb6e..cfd5b4b14ccb 100644
--- a/drivers/iommu/iommufd/Makefile
+++ b/drivers/iommu/iommufd/Makefile
@@ -12,6 +12,7 @@ iommufd-y := \
iommufd-$(CONFIG_IOMMUFD_NOIOMMU) += hwpt_noiommu.o
iommufd-$(CONFIG_IOMMUFD_TEST) += selftest.o
+iommufd-$(CONFIG_IOMMU_LIVEUPDATE) += liveupdate.o
obj-$(CONFIG_IOMMUFD) += iommufd.o
obj-$(CONFIG_IOMMUFD_DRIVER) += iova_bitmap.o
diff --git a/drivers/iommu/iommufd/iommufd_private.h b/drivers/iommu/iommufd/iommufd_private.h
index eb2e85b27e42..a33b32708afa 100644
--- a/drivers/iommu/iommufd/iommufd_private.h
+++ b/drivers/iommu/iommufd/iommufd_private.h
@@ -44,6 +44,11 @@ struct iommufd_ctx {
struct file *file;
struct xarray objects;
struct xarray groups;
+#ifdef CONFIG_IOMMU_LIVEUPDATE
+#define IOMMUFD_OBJ_LIVEUPDATE_MARK XA_MARK_1
+ /* @liveupdate_mutex: Protects the preservation of HWPTs. */
+ struct mutex liveupdate_mutex;
+#endif
wait_queue_head_t destroy_wait;
struct rw_semaphore ioas_creation_lock;
struct maple_tree mt_mmap;
@@ -392,6 +397,9 @@ struct iommufd_hwpt_paging {
bool auto_domain : 1;
bool enforce_cache_coherency : 1;
bool nest_parent : 1;
+#ifdef CONFIG_IOMMU_LIVEUPDATE
+ u64 liveupdate_token;
+#endif
/* Head at iommufd_ioas::hwpt_list */
struct list_head hwpt_item;
struct iommufd_sw_msi_maps present_sw_msi;
@@ -729,6 +737,15 @@ void iommufd_vdevice_abort(struct iommufd_object *obj);
int iommufd_hw_queue_alloc_ioctl(struct iommufd_ucmd *ucmd);
void iommufd_hw_queue_destroy(struct iommufd_object *obj);
+#ifdef CONFIG_IOMMU_LIVEUPDATE
+int iommufd_hwpt_liveupdate_mark_preserve(struct iommufd_ucmd *ucmd);
+#else
+static inline int iommufd_hwpt_liveupdate_mark_preserve(struct iommufd_ucmd *ucmd)
+{
+ return -ENOTTY;
+}
+#endif
+
#ifdef CONFIG_IOMMUFD_TEST
int iommufd_test(struct iommufd_ucmd *ucmd);
void iommufd_selftest_destroy(struct iommufd_object *obj);
diff --git a/drivers/iommu/iommufd/liveupdate.c b/drivers/iommu/iommufd/liveupdate.c
new file mode 100644
index 000000000000..96f01ee5a1e8
--- /dev/null
+++ b/drivers/iommu/iommufd/liveupdate.c
@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: GPL-2.0-only
+
+/*
+ * Copyright (C) 2026, Google LLC
+ * Author: Samiullah Khawaja <skhawaja@google.com>
+ */
+
+#define pr_fmt(fmt) "iommufd: " fmt
+
+#include <linux/file.h>
+#include <linux/iommufd.h>
+#include <linux/liveupdate.h>
+
+#include "iommufd_private.h"
+
+int iommufd_hwpt_liveupdate_mark_preserve(struct iommufd_ucmd *ucmd)
+{
+ struct iommu_hwpt_liveupdate_mark_preserve *cmd = ucmd->cmd;
+ struct iommufd_hwpt_paging *hwpt_target;
+ struct iommufd_hwpt_paging *hwpt_paging;
+ struct iommufd_ctx *ictx = ucmd->ictx;
+ struct iommufd_object *obj;
+ unsigned long index;
+ bool marked = false;
+ int rc = 0;
+
+ hwpt_target = iommufd_get_hwpt_paging(ucmd, cmd->hwpt_id);
+ if (IS_ERR(hwpt_target))
+ return PTR_ERR(hwpt_target);
+
+ mutex_lock(&ictx->liveupdate_mutex);
+
+ xa_lock(&ictx->objects);
+
+ /* PRI use cases are not supported. */
+ if (hwpt_target->common.fault) {
+ rc = -EOPNOTSUPP;
+ goto out_unlock;
+ }
+
+ xa_for_each_marked(&ictx->objects, index, obj, IOMMUFD_OBJ_LIVEUPDATE_MARK) {
+ if (WARN_ON_ONCE(obj->type != IOMMUFD_OBJ_HWPT_PAGING))
+ continue;
+
+ hwpt_paging = to_hwpt_paging(container_of(obj, struct iommufd_hw_pagetable, obj));
+
+ if (hwpt_paging == hwpt_target)
+ marked = true;
+
+ if (hwpt_paging->liveupdate_token == cmd->hwpt_token) {
+ if (hwpt_paging == hwpt_target)
+ goto out_unlock;
+
+ rc = -EADDRINUSE;
+ goto out_unlock;
+ }
+ }
+
+ __xa_set_mark(&ictx->objects, hwpt_target->common.obj.id, IOMMUFD_OBJ_LIVEUPDATE_MARK);
+
+ if (marked)
+ pr_warn_ratelimited("Overwriting HWPT liveupdate token from: %llu to %llu\n",
+ hwpt_target->liveupdate_token, cmd->hwpt_token);
+ hwpt_target->liveupdate_token = cmd->hwpt_token;
+
+out_unlock:
+ xa_unlock(&ictx->objects);
+ mutex_unlock(&ictx->liveupdate_mutex);
+ iommufd_put_object(ictx, &hwpt_target->common.obj);
+ return rc;
+}
diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c
index 9a921b153162..fe8610fd58e3 100644
--- a/drivers/iommu/iommufd/main.c
+++ b/drivers/iommu/iommufd/main.c
@@ -333,6 +333,9 @@ static int iommufd_fops_open(struct inode *inode, struct file *filp)
init_rwsem(&ictx->ioas_creation_lock);
xa_init_flags(&ictx->objects, XA_FLAGS_ALLOC1 | XA_FLAGS_ACCOUNT);
xa_init(&ictx->groups);
+#ifdef CONFIG_IOMMU_LIVEUPDATE
+ mutex_init(&ictx->liveupdate_mutex);
+#endif
ictx->file = filp;
mt_init_flags(&ictx->mt_mmap, MT_FLAGS_ALLOC_RANGE);
init_waitqueue_head(&ictx->destroy_wait);
@@ -395,6 +398,9 @@ static int iommufd_fops_release(struct inode *inode, struct file *filp)
* iommufd_object_tombstone_user()
*/
xa_destroy(&ictx->objects);
+#ifdef CONFIG_IOMMU_LIVEUPDATE
+ mutex_destroy(&ictx->liveupdate_mutex);
+#endif
WARN_ON(!xa_empty(&ictx->groups));
@@ -440,6 +446,7 @@ union ucmd_buffer {
struct iommu_hwpt_alloc hwpt;
struct iommu_hwpt_get_dirty_bitmap get_dirty_bitmap;
struct iommu_hwpt_invalidate cache;
+ struct iommu_hwpt_liveupdate_mark_preserve mark_preserve;
struct iommu_hwpt_set_dirty_tracking set_dirty_tracking;
struct iommu_ioas_alloc alloc;
struct iommu_ioas_allow_iovas allow_iovas;
@@ -516,6 +523,8 @@ static const struct iommufd_ioctl_op iommufd_ioctl_ops[] = {
__reserved),
IOCTL_OP(IOMMU_VIOMMU_ALLOC, iommufd_viommu_alloc_ioctl,
struct iommu_viommu_alloc, out_viommu_id),
+ IOCTL_OP(IOMMU_HWPT_LIVEUPDATE_MARK_PRESERVE, iommufd_hwpt_liveupdate_mark_preserve,
+ struct iommu_hwpt_liveupdate_mark_preserve, hwpt_token),
#ifdef CONFIG_IOMMUFD_TEST
IOCTL_OP(IOMMU_TEST_CMD, iommufd_test, struct iommu_test_cmd, last),
#endif
diff --git a/include/uapi/linux/iommufd.h b/include/uapi/linux/iommufd.h
index 206fa667c782..34637712c873 100644
--- a/include/uapi/linux/iommufd.h
+++ b/include/uapi/linux/iommufd.h
@@ -58,6 +58,7 @@ enum {
IOMMUFD_CMD_VEVENTQ_ALLOC = 0x93,
IOMMUFD_CMD_HW_QUEUE_ALLOC = 0x94,
IOMMUFD_CMD_IOAS_NOIOMMU_GET_PA = 0x95,
+ IOMMUFD_CMD_HWPT_LIVEUPDATE_MARK_PRESERVE = 0x96,
};
/**
@@ -1390,4 +1391,30 @@ struct iommu_hw_queue_alloc {
__aligned_u64 length;
};
#define IOMMU_HW_QUEUE_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HW_QUEUE_ALLOC)
+
+/**
+ * struct iommu_hwpt_liveupdate_mark_preserve - ioctl(IOMMU_HWPT_LIVEUPDATE_MARK_PRESERVE)
+ * @size: sizeof(struct iommu_hwpt_liveupdate_mark_preserve)
+ * @hwpt_id: Iommufd object ID of the target HWPT
+ * @hwpt_token: Token to identify this hwpt upon restore
+ *
+ * The target HWPT will be preserved during iommufd preservation.
+ * Only file-based memory mappings (e.g. memfd) are supported for HWPTs marked
+ * for preservation. Mapping anonymous memory into a preserved HWPT will result
+ * in a failure during the preservation phase.
+ *
+ * The hwpt_token is provided by userspace. If userspace enters a token
+ * already in use within this iommufd, -EADDRINUSE is returned from this ioctl.
+ *
+ * Note: There is no 'unmark' operation, so any HWPTs pooled in userspace that
+ * are marked for preservation must be destroyed after use.
+ */
+struct iommu_hwpt_liveupdate_mark_preserve {
+ __u32 size;
+ __u32 hwpt_id;
+ __aligned_u64 hwpt_token;
+};
+#define IOMMU_HWPT_LIVEUPDATE_MARK_PRESERVE \
+ _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_LIVEUPDATE_MARK_PRESERVE)
+
#endif
--
2.55.0.1082.g2b9226bbc0-goog
next prev parent reply other threads:[~2026-09-21 0:48 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-21 0:48 [PATCH v5 00/18] iommu: Add live update state preservation Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 01/18] memfd: export memfd_get_seals() Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 02/18] iommu: Implement IOMMU Live update FLB callbacks Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 03/18] iommu/pages: Add APIs to preserve/unpreserve/restore iommu pages Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 04/18] iommupt: Implement preserve/unpreserve/restore callbacks Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 05/18] iommu: Implement IOMMU domain preservation Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 06/18] iommu: Implement device and IOMMU HW preservation Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 07/18] iommu/vt-d: Implement device and iommu preserve/unpreserve ops Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 08/18] iommu/vt-d: Clear unpreserved context entries during shutdown Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 09/18] iommu: Add APIs to get iommu and device preserved state Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 10/18] iommu/vt-d: Restore IOMMU state and reclaimed domain ids Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 11/18] iommu: Restore and reattach preserved domains to devices Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 12/18] iommu/vt-d: Handle reattach of the restored domain Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 13/18] iommu/vt-d: Preserve PASID table of preserved device Samiullah Khawaja
2026-09-21 0:48 ` Samiullah Khawaja [this message]
2026-09-21 0:48 ` [PATCH v5 15/18] iommufd: Persist iommu hardware pagetables for live update Samiullah Khawaja
2026-09-23 23:59 ` John Starks
2026-09-24 17:49 ` Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 16/18] iommufd: Add APIs to preserve/unpreserve a vfio cdev Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 17/18] vfio/pci: Preserve the iommufd state of the " Samiullah Khawaja
2026-09-21 0:48 ` [PATCH v5 18/18] iommufd/selftest: Add test to verify iommufd preservation Samiullah Khawaja
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260921004834.2601285-15-skhawaja@google.com \
--to=skhawaja@google.com \
--cc=akpm@linux-foundation.org \
--cc=alex@shazbot.org \
--cc=baolu.lu@linux.intel.com \
--cc=dmatlack@google.com \
--cc=dwmw2@infradead.org \
--cc=iommu@lists.linux.dev \
--cc=jgg@ziepe.ca \
--cc=joro@8bytes.org \
--cc=kevin.tian@intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pasha.tatashin@soleen.com \
--cc=praan@google.com \
--cc=pratyush@kernel.org \
--cc=robin.murphy@arm.com \
--cc=shuah@kernel.org \
--cc=vipinsh@google.com \
--cc=will@kernel.org \
--cc=zhuyifei@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®