Re: [PATCH v6 07/18] iommu/vt-d: Clear unpreserved context entries during shutdown

[Samiullah Khawaja]

On Thu, Oct 29, 2026 at 11:18:02AM +0800, Baolu Lu wrote:
> On 10/25/2026 10:19 AM, Samiullah Khawaja wrote:
> > During normal shutdown the iommu translation is disabled. Since the root
> > table is preserved during live update, it needs to be cleaned up and the
> > context entries of the unpreserved devices and root entries for the
> > unpreserved context tables need to be cleared.
> >
> > This is required because during kexec reboot and shutdown the devices do
> > not go through the release flow, so there might be stale entries in the
> > root table and context tables. Also note that new unpreserved context
> > tables for unpreserved devices might have been added after preservation,
> > so the root table entries for unpreserved context tables also need to
> > removed.
> >
> > Signed-off-by: Samiullah Khawaja<skhawaja@xxxxxxxxxx>
> > ---
> >  drivers/iommu/intel/iommu.c      |  15 +++-
> >  drivers/iommu/intel/iommu.h      |   5 ++
> >  drivers/iommu/intel/liveupdate.c | 134 +++++++++++++++++++++++++++++++
> >  3 files changed, 152 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
> > index 14bd1ca4fbd5..23a1da351ddf 100644
> > --- a/drivers/iommu/intel/iommu.c
> > +++ b/drivers/iommu/intel/iommu.c
> > @@ -1967,6 +1967,14 @@ static int iommu_suspend(void *data)
> >  	iommu_flush_all();
> > +	/*
> > +	 * Note that IOMMU suspend doesn't affect live update. The state
> > +	 * preserved during live update is not released and remains valid during
> > +	 * suspend and reused during IOMMU resume.
> > +	 *
> > +	 * Also note deployment of suspend/resume and live updated use case
> > +	 * should be mostly mutually exclusive.
> > +	 */
> >  	for_each_active_iommu(iommu, drhd) {
> >  		iommu_disable_translation(iommu);
> > @@ -2512,8 +2520,11 @@ void intel_iommu_shutdown(void)
> >  		/* Disable PMRs explicitly here. */
> >  		iommu_disable_protect_mem_regions(iommu);
> > -		/* Make sure the IOMMUs are switched off */
> > -		iommu_disable_translation(iommu);
> > +		/* Make sure the IOMMUs are switched off if not preserved. */
> > +		if (iommu_preserved_state(&iommu->iommu))
> > +			clear_unpreserved_context_entries(iommu);
> > +		else
> > +			iommu_disable_translation(iommu);
> >  	}
> >  }
>
> When I revisit this, perhaps we have overlooked something.
>
> After intel_iommu_shutdown() in the previous kernel, the memory for the
> Invalidation Queue, the memory for the PRQ, and the interrupt vector for
> the DMAR fault are all freed. However, the hardware is still configured
> with those resources. This potentially results in use-after-free bugs.
> So my understanding is that while we can preserve the translation state
> in intel_iommu_shutdown(), QI, PRQ, and fault handling should be
> disabled and their resources should be released.

Agreed. I will disable QI and mask the fault and page request interrupts
for the preserved IOMMUs in the next revision.

For PRQ, there is no way to disable it at the IOMMU level while
translation is enabled. But PRE is already disabled for the devices on
the preserved IOMMU, so we should not get any page requests.

> In a normal kexec, DMA translation is disabled, thus all resources
> configured to the hardware are released. However, this is not the case
> for the live update scenario.
>
> Thanks,
> baolu

Thanks,
Sami