From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.69 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793633838; b=nnR6X8QFbREtylBxGubq1WM/f9vrp9ELk62Zo1KPrVRu7x1yV5JM8BpBerRJYjgF8RYK ysqj9U0j2gthzY3hJ9inPoYp8thkSw8T/OTLW/BL6mBTp5b1mhQlsGlF62cyV7/pscPIG ItbH7mbpkHS/0/7f0SHCLfXgyl19D6TlA0mBHEW2p0sY6vAPvhnzwmjvP4qqZJqlPg5jo MOiddPiEJr7BemCBUO4KMMCTOp8A1IB93N6hezbCDj9Dd4sonUuGRQUOeWcOUu4hypC3E I4pVcV+1mxKnzrosdnVmaAjSfdWST/miPHdS4O+IgKD3TIiPBzN7OcBXSeTXLy88Q0Q== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793633838; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:In-Reply-To: Mime-Version:References:X-Mailer:Message-ID:Subject:From:To:Cc: Content-Type; bh=ym/wrmWFSlmP/Qd42BcsAsFY9ji592OmGMgA89zOpEo=; b=DUdy/KtFoCQcCtcAT+pmFUpkPQMw1mPnxXJ0rTOugclGpGiD69i/p1cXXmyVVzZjgK0T iEBKPPISvVXFdIRSe0WUlayby1iTNgBsL5blcL4mXi3T6CNL369RkdOd6u+SPogbkQh5T de10gk3erNpjMcTFNGkulzB39idd7QjxTrx9xGBGJtZ8dcE4qZ+LyRDZFJ5Wpyj/QvESH JrAFNTADRNwWgeA512egA98NUrxgWnntFsjf0+Bx2Ln1qCVVZPEgNrzXmVZ3Z2MeLzlgj SBlZohq7/XZ+mEdvyCbstUU2l9P9ldazLfPNojwiNL/4S7PSum+C6YjX66sN5eP47JQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--vipinsh.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=OOoLULKt; arc=none smtp.remote-ip=209.85.216.69 Received: from mail-pj1-f69.google.com (mail-pj1-f69.google.com [209.85.216.69]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 64F8E60E6E4A for ; Mon, 2 Nov 2026 15:37:13 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org 64F8E60E6E4A Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--vipinsh.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20260707 header.b=OOoLULKt Received: by mail-pj1-f69.google.com with SMTP id 98e67ed59e1d1-3aed1b64104so738987a91.0 for ; Mon, 02 Nov 2026 07:37:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20260707; t=1793633833; x=1794238633; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=ym/wrmWFSlmP/Qd42BcsAsFY9ji592OmGMgA89zOpEo=; b=OOoLULKtlquOo1hW/AmHaG5FsQeivEQrZb86orM8Uwr5rOr6omi+/3iadCq7mNqOO1 XljI7RfadAnR5LvZE8sdlhGrGm7ovH1YZchOD+n2oEdVDwI1s4iPidqSm7AnqLNneX1J +19jmKdtOW/0IT9T+eUJSqR4B1jrAI1gc0IPi7/hiW+AFxh7LkF8GjPdKXH6YhhCWNtV Z/lr5wNh2KLIgibplLjpCnHFotSkYKRjnxsu3uTadvcsHqt+h9j1nYYXy0V8Ayodtieh GBaa8eAzMECdepVHl0ZN+7QCof8/aDsVoHEN/NF7jgv/oIWJ/c4wL25TQC+PNWSJZLhV bCbg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793633833; x=1794238633; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ym/wrmWFSlmP/Qd42BcsAsFY9ji592OmGMgA89zOpEo=; b=M4pN8myxuW731PlCW++S5ioIOD5l75Q+qpYfJn2w0D+JNZM+iI5OV9yU26dGkXAM4u jdPuUx1MBcgFNnBq1XXVUuFVZ6GawCVX9xOzQVzyNJ4AsBEjECMxOgAqz3aNU1NhBxf5 /7OybcTyXxMXtkt2AzJii7zHNPTYtG2b8d279XHtoP7VrLPP+XbI1a98BYYjc4h2S8YP GTXun7p9CXjDroNMac3h89hFC4LaqflDggYpCBh5hdff4rvLUe3ck1B/9VKxjIIQeFAX /RSvfRKQZmaN6LkrC6pal6wC6ybmxCWDEDAnUB6W81ZY0Cp1XmaGIEIfUzhLqEqHdmHu hb7g== X-Forwarded-Encrypted: i=1; AKwUvBziTk2UNlcH0oo2Ms1dZgONwO71JKkmdWX/lHl3B8VyDiAQ5B/WRHr+2PMSGvbORUDk/DS7b/vOlJIrW1Y=@vger.kernel.org X-Gm-Message-State: APuU4Z/S+WNSbxj+ip26JDhw7rPKWRE+44S6OE9CV8wJBZ9dd7FQL7mi J55qFzamjrh1tDxc6DMhGlSS2CiBs9w2YrWghXrHbfO5mEPCOcx1PxHdd9aZQSv9GQ0/ZEGSGBl 84/Oi4a2m3g== X-Received: from plhb8.prod.google.com ([2002:a17:903:2288:b0:2e9:84f0:65ba]) (user=vipinsh job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:3b47:b0:3ac:9f00:3bc7 with SMTP id 98e67ed59e1d1-3ae8980dccamr9246672a91.33.1793633832641; Mon, 02 Nov 2026 07:37:12 -0800 (PST) Date: Mon, 2 Nov 2026 07:36:41 -0800 In-Reply-To: <20261102153656.1431701-1-vipinsh@google.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <20261102153656.1431701-1-vipinsh@google.com> X-Mailer: git-send-email 2.56.0.317.g454f8302e1-goog Message-ID: <20261102153656.1431701-13-vipinsh@google.com> Subject: [PATCH v6 12/27] vfio: Enforce preserved devices are retrieved via LIVEUPDATE_SESSION_RETRIEVE_FD From: Vipin Sharma To: kexec@lists.infradead.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, kvm@vger.kernel.org, linux-mm@kvack.org, linux-kselftest@vger.kernel.org, linux-pci@vger.kernel.org Cc: ajayachandra@nvidia.com, alex@shazbot.org, amastro@fb.com, ankita@nvidia.com, apopple@nvidia.com, bhelgaas@google.com, chrisl@kernel.org, christian.koenig@amd.com, corbet@lwn.net, dmatlack@google.com, graf@amazon.com, jacob.pan@linux.microsoft.com, jgg@nvidia.com, jgg@ziepe.ca, jrhilke@google.com, julianr@linux.ibm.com, kees@kernel.org, kevin.tian@intel.com, leon@kernel.org, leonro@nvidia.com, lukas@wunner.de, mattev@meta.com, michal.winiarski@intel.com, parav@nvidia.com, pasha.tatashin@soleen.com, praan@google.com, pratyush@kernel.org, rananta@google.com, rdunlap@infradead.org, rientjes@google.com, rodrigo.vivi@intel.com, rppt@kernel.org, saeedm@nvidia.com, schnelle@linux.ibm.com, skhan@linuxfoundation.org, skhawaja@google.com, vipinsh@google.com, vivek.kasireddy@intel.com, witu@nvidia.com, yanjun.zhu@linux.dev, yi.l.liu@intel.com Content-Type: text/plain; charset="UTF-8" From: David Matlack Enforce that files for incoming (preserved by previous kernel) VFIO devices are retrieved via LIVEUPDATE_SESSION_RETRIEVE_FD rather than by opening the corresponding VFIO character device or via VFIO_GROUP_GET_DEVICE_FD. Both of these methods would result in VFIO initializing the device without access to the preserved state of the device passed by the previous kernel. Reviewed-by: Pranjal Shrivastava Signed-off-by: David Matlack Co-developed-by: Vipin Sharma Signed-off-by: Vipin Sharma --- drivers/vfio/device_cdev.c | 8 ++++++++ drivers/vfio/group.c | 9 +++++++++ drivers/vfio/pci/vfio_pci_liveupdate.c | 6 ++++++ drivers/vfio/vfio.h | 18 ++++++++++++++++++ 4 files changed, 41 insertions(+) diff --git a/drivers/vfio/device_cdev.c b/drivers/vfio/device_cdev.c index 38e691eceab5..f0018eae3c4d 100644 --- a/drivers/vfio/device_cdev.c +++ b/drivers/vfio/device_cdev.c @@ -58,6 +58,14 @@ static int vfio_device_cdev_open(struct vfio_device *device, struct file **filep } *filep = file; + } else if (vfio_liveupdate_incoming_is_preserved(device)) { + /* + * Since it is live update preserved device, it must be + * retrieved via LIVEUPDATE_SESSION_RETRIEVE_FD instead of + * opening /dev/vfio/devices/vfioX. + */ + ret = -EBUSY; + goto err_free_device_file; } file->private_data = df; diff --git a/drivers/vfio/group.c b/drivers/vfio/group.c index b2299e5bc6df..62b4eaabc829 100644 --- a/drivers/vfio/group.c +++ b/drivers/vfio/group.c @@ -316,6 +316,15 @@ static int vfio_group_ioctl_get_device_fd(struct vfio_group *group, if (IS_ERR(device)) return PTR_ERR(device); + /* + * This device was preserved across a Live Update. Accessing it via + * VFIO_GROUP_GET_DEVICE_FD is not allowed. + */ + if (vfio_liveupdate_incoming_is_preserved(device)) { + vfio_device_put_registration(device); + return -EBUSY; + } + fd = FD_ADD(O_CLOEXEC, vfio_device_open_file(device)); if (fd < 0) vfio_device_put_registration(device); diff --git a/drivers/vfio/pci/vfio_pci_liveupdate.c b/drivers/vfio/pci/vfio_pci_liveupdate.c index f13c757b4567..64810010f983 100644 --- a/drivers/vfio/pci/vfio_pci_liveupdate.c +++ b/drivers/vfio/pci/vfio_pci_liveupdate.c @@ -43,6 +43,12 @@ * ... * ioctl(session_fd, LIVEUPDATE_SESSION_FINISH, ...); * + * .. note:: + * After kexec, if a device was preserved by the previous kernel, attempting + * to open a new file for the device via its character device + * (``/dev/vfio/devices/X``) or via ``VFIO_GROUP_GET_DEVICE_FD`` will fail + * with ``-EBUSY``. + * * Restrictions * ============ * diff --git a/drivers/vfio/vfio.h b/drivers/vfio/vfio.h index 12557d45dfee..e6ca4c3fda06 100644 --- a/drivers/vfio/vfio.h +++ b/drivers/vfio/vfio.h @@ -11,6 +11,7 @@ #include #include #include +#include struct iommufd_ctx; struct iommu_group; @@ -446,4 +447,21 @@ static inline void vfio_device_debugfs_init(struct vfio_device *vdev) { } static inline void vfio_device_debugfs_exit(struct vfio_device *vdev) { } #endif /* CONFIG_VFIO_DEBUGFS */ +#ifdef CONFIG_VFIO_PCI_LIVEUPDATE +static inline bool vfio_liveupdate_incoming_is_preserved(struct vfio_device *device) +{ + struct device *d = device->dev; + + if (dev_is_pci(d)) + return pci_liveupdate_is_incoming(to_pci_dev(d)); + + return false; +} +#else +static inline bool vfio_liveupdate_incoming_is_preserved(struct vfio_device *device) +{ + return false; +} +#endif /* CONFIG_VFIO_PCI_LIVEUPDATE */ + #endif -- 2.56.0.317.g454f8302e1-goog