On Tue, Jun 9, 2026 at 8:35 AM Pranjal Shrivastava <[email protected]> wrote: > > On Tue, Jun 09, 2026 at 03:12:11PM +0000, Pranjal Shrivastava wrote: > > On Mon, Jun 08, 2026 at 03:16:40PM -0300, Jason Gunthorpe wrote: > > > On Mon, Jun 08, 2026 at 10:49:29AM +0000, Pranjal Shrivastava wrote: > > > > > > > My point was that a FW exploit can meddle with the bitfields of the > > > > ACS_CTRL to spoof and mis-report the ACS flags. > > > > > > Devices can also ignore the ACS flags. I don't think this is an area > > > where we should be worrying about devices being actively hostile. > > > > I'm wondering what happens if we preserve IOMMU groups across a kexec, > > but a switch's ACS capability is dropped or the ACS_RR bit gets cleared? > > The incoming kernel assumes that it's the same ACS cap from the old one > > > > Now, the incoming kernel restores the groups assuming they're still > > isolated, but the hardware no longer enforces it, silently allowing DMAs > > & breaking isolation? > > Again, to clarify, I'm aware that we aren't preserving IOMMU groups, > the incoming kernel has to rebuild the groups. My concern is that if the > ACS_RR bit is cleared during the kexec window, the produced grouping would > be different than the old kernel. What happens if two devices on the > same bridge were assigned to 2 different VMs?
In this patch the kernel reads PCI_ACS_CTRL after kexec to determine the bridge's state and uses that information going forward. We don't assume that if ACS_RR was set on the previous kernel then it is still set now. So if ACS_RR were cleared during kexec somehow, the new kernel would see that and place those devices into the same group. Someitme after that (I'm a little fuzzy on the iommufd restore path during Live Update) the kernel would try and fail to restore the 2 devices into separate domains because they are in the same group and thus the 2 different VMs would fail to come up. Of course maybe ACS_RR can somehow get cleared after the kernel reads it, but at that point the issue has nothing to do with Live Update. So that's what would happen if ACS_RR ever got cleared during kexec and seems reasonable to me?
