IOMMU live-update patches aim to keep VM DMA mappings across kexec

Samiullah Khawaja of Google has posted a fifth revision of patches that let the Linux IOMMU stack carry device translation state through a kexec-based live update, starting with Intel VT-d and domains managed by iommufd.

The work targets a narrow but high-stakes case: a device assigned to a virtual machine through VFIO, with its IOMMU hardware page tables (HWPTs) and DMA mappings kept intact while the host kernel is replaced. Without that, live update would force VMs to rebuild IOMMU context and risk interrupting guest DMA. The series is Phase 1 of a broader effort and sits on top of earlier VFIO character-device and PCI device preservation work, plus the kernel's Kexec Handover and Live Update Orchestrator machinery.

In outline, preserving a VFIO cdev and its bound iommufd file into a live-update session triggers serialization of eligible IOMMU domains. Page tables are handed over via generic page-table support, along with root and context state. Only HWPTs whose DMA mappings are all file-backed, and whose backing memfds were sealed against grow, shrink, and further sealing when the mapping was created, are accepted. On the next kernel boot the VT-d unit, domains, and devices are restored, domains are reattached early, and DMA ownership is reclaimed so non-VFIO drivers cannot bind to those devices.

Userspace marks which HWPTs to keep with a dedicated token before the iommufd itself is preserved. Marked address spaces become immutable for the rest of the session so map and unmap cannot race with handover. Scalable-mode PASID tables for preserved devices are included; devices with Address Translation Services enabled are refused for now, because carrying live ATS state would require deeper PCI-core and context-entry handling. Stale root and context entries for devices that were not preserved are scrubbed at shutdown so they do not leak into the next kernel.

The series is aimed at the IOMMU tree. YiFei Zhu contributed the iommufd marking and preserve path. Restoration of the userspace-visible HWPT identity is still incomplete and left for a later phase.