Re: [PATCH v6 14/18] iommufd: Implement ioctl to mark HWPT for preservation

[Baolu Lu <baolu.lu@linux.intel.com>]

On 10/25/2026 10:19 AM, Samiullah Khawaja wrote:
> From: YiFei Zhu <zhuyifei@google.com>
> 
> Userspace provides a token to mark the HWPT for preservation. Note that
> this token is not the LUO token that is used to preserve the iommufd.
> Once all the required HWPT are marked for preservation, the user can
> preserve the iommufd into LUO. The iommufd will preserve the HWPTs that
> are marked for preservation.
> 
> The marked HWPTs are tracked using a new XArray mark protected by a new
> liveupdate mutex. This mutex will also be used during iommufd
> preservation to protect against any race with the mark preserve ioctl.
> 
> The HWPT token will be used during restore to identify this HWPT. The
> restoration logic is not implemented and will be added later.
> 
> Reviewed-by: Pranjal Shrivastava <praan@google.com>
> Signed-off-by: YiFei Zhu <zhuyifei@google.com>
> Signed-off-by: Samiullah Khawaja <skhawaja@google.com>
> ---
>   MAINTAINERS                             |  1 +
>   drivers/iommu/iommufd/Makefile          |  1 +
>   drivers/iommu/iommufd/iommufd_private.h | 17 ++++++
>   drivers/iommu/iommufd/liveupdate.c      | 72 +++++++++++++++++++++++++
>   drivers/iommu/iommufd/main.c            |  9 ++++
>   include/uapi/linux/iommufd.h            | 27 ++++++++++
>   6 files changed, 127 insertions(+)
>   create mode 100644 drivers/iommu/iommufd/liveupdate.c
> 
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 15e1da41b0cc..78af4e3dc106 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -13738,6 +13738,7 @@ M:	Samiullah Khawaja <skhawaja@google.com>
>   R:	Pranjal Shrivastava <praan@google.com>
>   L:	iommu@lists.linux.dev
>   S:	Maintained
> +F:	drivers/iommu/iommufd/liveupdate.c
>   F:	drivers/iommu/liveupdate.c
>   F:	include/linux/iommu-liveupdate.h
>   F:	include/linux/kho/abi/iommu.h
> diff --git a/drivers/iommu/iommufd/Makefile b/drivers/iommu/iommufd/Makefile
> index 67207914bb6e..cfd5b4b14ccb 100644
> --- a/drivers/iommu/iommufd/Makefile
> +++ b/drivers/iommu/iommufd/Makefile
> @@ -12,6 +12,7 @@ iommufd-y := \
>   
>   iommufd-$(CONFIG_IOMMUFD_NOIOMMU) += hwpt_noiommu.o
>   iommufd-$(CONFIG_IOMMUFD_TEST) += selftest.o
> +iommufd-$(CONFIG_IOMMU_LIVEUPDATE) += liveupdate.o
>   
>   obj-$(CONFIG_IOMMUFD) += iommufd.o
>   obj-$(CONFIG_IOMMUFD_DRIVER) += iova_bitmap.o
> diff --git a/drivers/iommu/iommufd/iommufd_private.h b/drivers/iommu/iommufd/iommufd_private.h
> index eb2e85b27e42..a33b32708afa 100644
> --- a/drivers/iommu/iommufd/iommufd_private.h
> +++ b/drivers/iommu/iommufd/iommufd_private.h
> @@ -44,6 +44,11 @@ struct iommufd_ctx {
>   	struct file *file;
>   	struct xarray objects;
>   	struct xarray groups;
> +#ifdef CONFIG_IOMMU_LIVEUPDATE
> +#define IOMMUFD_OBJ_LIVEUPDATE_MARK XA_MARK_1
> +	/* @liveupdate_mutex: Protects the preservation of HWPTs. */
> +	struct mutex liveupdate_mutex;
> +#endif
>   	wait_queue_head_t destroy_wait;
>   	struct rw_semaphore ioas_creation_lock;
>   	struct maple_tree mt_mmap;
> @@ -392,6 +397,9 @@ struct iommufd_hwpt_paging {
>   	bool auto_domain : 1;
>   	bool enforce_cache_coherency : 1;
>   	bool nest_parent : 1;
> +#ifdef CONFIG_IOMMU_LIVEUPDATE
> +	u64 liveupdate_token;
> +#endif
>   	/* Head at iommufd_ioas::hwpt_list */
>   	struct list_head hwpt_item;
>   	struct iommufd_sw_msi_maps present_sw_msi;
> @@ -729,6 +737,15 @@ void iommufd_vdevice_abort(struct iommufd_object *obj);
>   int iommufd_hw_queue_alloc_ioctl(struct iommufd_ucmd *ucmd);
>   void iommufd_hw_queue_destroy(struct iommufd_object *obj);
>   
> +#ifdef CONFIG_IOMMU_LIVEUPDATE
> +int iommufd_hwpt_liveupdate_mark_preserve(struct iommufd_ucmd *ucmd);
> +#else
> +static inline int iommufd_hwpt_liveupdate_mark_preserve(struct iommufd_ucmd *ucmd)
> +{
> +	return -ENOTTY;
> +}
> +#endif
> +
>   #ifdef CONFIG_IOMMUFD_TEST
>   int iommufd_test(struct iommufd_ucmd *ucmd);
>   void iommufd_selftest_destroy(struct iommufd_object *obj);
> diff --git a/drivers/iommu/iommufd/liveupdate.c b/drivers/iommu/iommufd/liveupdate.c
> new file mode 100644
> index 000000000000..5fb491ff3a3d
> --- /dev/null
> +++ b/drivers/iommu/iommufd/liveupdate.c
> @@ -0,0 +1,72 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +
> +/*
> + * Copyright (C) 2026, Google LLC
> + * Author: Samiullah Khawaja <skhawaja@google.com>
> + */
> +
> +#define pr_fmt(fmt) "iommufd: " fmt
> +
> +#include <linux/file.h>
> +#include <linux/iommufd.h>
> +#include <linux/liveupdate.h>
> +
> +#include "iommufd_private.h"
> +
> +int iommufd_hwpt_liveupdate_mark_preserve(struct iommufd_ucmd *ucmd)
> +{
> +	struct iommu_hwpt_liveupdate_mark_preserve *cmd = ucmd->cmd;
> +	struct iommufd_ctx *ictx = ucmd->ictx;
> +	struct iommufd_hwpt_paging *hwpt;
> +	struct iommufd_object *obj;
> +	unsigned long index;
> +	bool marked = false;
> +	int rc = 0;
> +
> +	hwpt = iommufd_get_hwpt_paging(ucmd, cmd->hwpt_id);
> +	if (IS_ERR(hwpt))
> +		return PTR_ERR(hwpt);
> +
> +	mutex_lock(&ictx->liveupdate_mutex);
> +
> +	xa_lock(&ictx->objects);
> +
> +	/* PRI use cases are not supported. */
> +	if (hwpt->common.fault) {
> +		rc = -EOPNOTSUPP;
> +		goto out_unlock;
> +	}
> +
> +	xa_for_each_marked(&ictx->objects, index, obj, IOMMUFD_OBJ_LIVEUPDATE_MARK) {
> +		struct iommufd_hwpt_paging *hwpt_marked;
> +
> +		if (WARN_ON_ONCE(obj->type != IOMMUFD_OBJ_HWPT_PAGING))
> +			continue;
> +
> +		hwpt_marked = to_hwpt_paging(container_of(obj, struct iommufd_hw_pagetable, obj));
> +
> +		if (hwpt_marked == hwpt)
> +			marked = true;
> +
> +		if (hwpt_marked->liveupdate_token == cmd->hwpt_token) {
> +			if (hwpt_marked == hwpt)
> +				goto out_unlock;
> +
> +			rc = -EADDRINUSE;
> +			goto out_unlock;
> +		}
> +	}
> +
> +	__xa_set_mark(&ictx->objects, hwpt->common.obj.id, IOMMUFD_OBJ_LIVEUPDATE_MARK);
> +
> +	if (marked)
> +		pr_warn_ratelimited("Overwriting HWPT liveupdate token from: %llu to %llu\n",
> +				    hwpt->liveupdate_token, cmd->hwpt_token);
> +	hwpt->liveupdate_token = cmd->hwpt_token;
> +
> +out_unlock:
> +	xa_unlock(&ictx->objects);
> +	mutex_unlock(&ictx->liveupdate_mutex);
> +	iommufd_put_object(ictx, &hwpt->common.obj);
> +	return rc;
> +}
> diff --git a/drivers/iommu/iommufd/main.c b/drivers/iommu/iommufd/main.c
> index 9a921b153162..fe8610fd58e3 100644
> --- a/drivers/iommu/iommufd/main.c
> +++ b/drivers/iommu/iommufd/main.c
> @@ -333,6 +333,9 @@ static int iommufd_fops_open(struct inode *inode, struct file *filp)
>   	init_rwsem(&ictx->ioas_creation_lock);
>   	xa_init_flags(&ictx->objects, XA_FLAGS_ALLOC1 | XA_FLAGS_ACCOUNT);
>   	xa_init(&ictx->groups);
> +#ifdef CONFIG_IOMMU_LIVEUPDATE
> +	mutex_init(&ictx->liveupdate_mutex);
> +#endif
>   	ictx->file = filp;
>   	mt_init_flags(&ictx->mt_mmap, MT_FLAGS_ALLOC_RANGE);
>   	init_waitqueue_head(&ictx->destroy_wait);
> @@ -395,6 +398,9 @@ static int iommufd_fops_release(struct inode *inode, struct file *filp)
>   	 * iommufd_object_tombstone_user()
>   	 */
>   	xa_destroy(&ictx->objects);
> +#ifdef CONFIG_IOMMU_LIVEUPDATE
> +	mutex_destroy(&ictx->liveupdate_mutex);
> +#endif
>   
>   	WARN_ON(!xa_empty(&ictx->groups));
>   
> @@ -440,6 +446,7 @@ union ucmd_buffer {
>   	struct iommu_hwpt_alloc hwpt;
>   	struct iommu_hwpt_get_dirty_bitmap get_dirty_bitmap;
>   	struct iommu_hwpt_invalidate cache;
> +	struct iommu_hwpt_liveupdate_mark_preserve mark_preserve;
>   	struct iommu_hwpt_set_dirty_tracking set_dirty_tracking;
>   	struct iommu_ioas_alloc alloc;
>   	struct iommu_ioas_allow_iovas allow_iovas;
> @@ -516,6 +523,8 @@ static const struct iommufd_ioctl_op iommufd_ioctl_ops[] = {
>   		 __reserved),
>   	IOCTL_OP(IOMMU_VIOMMU_ALLOC, iommufd_viommu_alloc_ioctl,
>   		 struct iommu_viommu_alloc, out_viommu_id),
> +	IOCTL_OP(IOMMU_HWPT_LIVEUPDATE_MARK_PRESERVE, iommufd_hwpt_liveupdate_mark_preserve,
> +		 struct iommu_hwpt_liveupdate_mark_preserve, hwpt_token),
>   #ifdef CONFIG_IOMMUFD_TEST
>   	IOCTL_OP(IOMMU_TEST_CMD, iommufd_test, struct iommu_test_cmd, last),
>   #endif
> diff --git a/include/uapi/linux/iommufd.h b/include/uapi/linux/iommufd.h
> index 206fa667c782..93372689afec 100644
> --- a/include/uapi/linux/iommufd.h
> +++ b/include/uapi/linux/iommufd.h
> @@ -58,6 +58,7 @@ enum {
>   	IOMMUFD_CMD_VEVENTQ_ALLOC = 0x93,
>   	IOMMUFD_CMD_HW_QUEUE_ALLOC = 0x94,
>   	IOMMUFD_CMD_IOAS_NOIOMMU_GET_PA = 0x95,
> +	IOMMUFD_CMD_HWPT_LIVEUPDATE_MARK_PRESERVE = 0x96,
>   };
>   
>   /**
> @@ -1390,4 +1391,30 @@ struct iommu_hw_queue_alloc {
>   	__aligned_u64 length;
>   };
>   #define IOMMU_HW_QUEUE_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HW_QUEUE_ALLOC)
> +
> +/**
> + * struct iommu_hwpt_liveupdate_mark_preserve - ioctl(IOMMU_HWPT_LIVEUPDATE_MARK_PRESERVE)
> + * @size: sizeof(struct iommu_hwpt_liveupdate_mark_preserve)
> + * @hwpt_id: HW pagetable ID to preserve for liveupdate
> + * @hwpt_token: Token to identify this hwpt upon restore
> + *
> + * The target HWPT will be preserved during iommufd preservation.
> + * Only file-based memory mappings (e.g. memfd) are supported for HWPTs marked
> + * for preservation. Mapping anonymous memory into a preserved HWPT will result
> + * in a failure during the preservation phase.
> + *
> + * The hwpt_token is provided by userspace. If userspace enters a token
> + * already in use within this iommufd, -EADDRINUSE is returned from this ioctl.
> + *
> + * Note: There is no 'unmark' operation, so any HWPTs pooled in userspace that
> + * are marked for preservation must be destroyed after use.
> + */
> +struct iommu_hwpt_liveupdate_mark_preserve {
> +	__u32 size;

Most iommufd commands have a "flags" member here, so that the uAPI
struct can be extended later. Why is this one different?

> +	__u32 hwpt_id;
> +	__aligned_u64 hwpt_token;
> +};
> +#define IOMMU_HWPT_LIVEUPDATE_MARK_PRESERVE \
> +	_IO(IOMMUFD_TYPE, IOMMUFD_CMD_HWPT_LIVEUPDATE_MARK_PRESERVE)
> +
>   #endif

Otherwise, this patch looks good to me,

Reviewed-by: Lu Baolu <baolu.lu@linux.intel.com>