Re: [RFC PATCH v6 04/11] iommufd/viommu: Keep a reference to the KVM file

[Aneesh Kumar K . V]

Vasant Hegde <vasant.hegde@xxxxxxx> writes:

> On 9/17/2026 7:31 PM, Aneesh Kumar K.V (Arm) wrote:
>> From: Nicolin Chen <nicolinc@xxxxxxxxxx>
>> 
>> The TSM vDevice operations need access to the KVM associated with the
>> device's vIOMMU. Save the device's KVM file in the iommufd_viommu when the
>> vIOMMU is allocated, and take a file reference so it remains valid for the
>> lifetime of the vIOMMU.
>> 
>> Release the reference when the vIOMMU is destroyed.
>> 
>> Based on an original patch by Shameer Kolothum <shameerali.kolothum.thodi@xxxxxxxxxx>
>> 
>> [nicolinc: hold kvm's users_count]
>> Signed-off-by: Nicolin Chen <nicolinc@xxxxxxxxxx>
>> [aneesh.kumar: Switch to use kvm_file]
>> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@xxxxxxxxxx>
>> ---
>>  drivers/iommu/iommufd/viommu.c | 5 +++++
>>  include/linux/iommufd.h        | 1 +
>>  2 files changed, 6 insertions(+)
>> 
>> diff --git a/drivers/iommu/iommufd/viommu.c b/drivers/iommu/iommufd/viommu.c
>> index 4081deda9b33..bf5d58d55939 100644
>> --- a/drivers/iommu/iommufd/viommu.c
>> +++ b/drivers/iommu/iommufd/viommu.c
>> @@ -1,6 +1,7 @@
>>  // SPDX-License-Identifier: GPL-2.0-only
>>  /* Copyright (c) 2024, NVIDIA CORPORATION & AFFILIATES
>>   */
>> +#include <linux/file.h>
>>  #include "iommufd_private.h"
>>  
>>  void iommufd_viommu_destroy(struct iommufd_object *obj)
>> @@ -11,6 +12,8 @@ void iommufd_viommu_destroy(struct iommufd_object *obj)
>>  	if (viommu->ops && viommu->ops->destroy)
>>  		viommu->ops->destroy(viommu);
>>  	refcount_dec(&viommu->hwpt->common.obj.users);
>> +	if (viommu->kvm_file)
>> +		fput(viommu->kvm_file);
>>  	xa_destroy(&viommu->vdevs);
>>  }
>>  
>> @@ -76,6 +79,8 @@ int iommufd_viommu_alloc_ioctl(struct iommufd_ucmd *ucmd)
>>  	}
>>  
>>  	xa_init(&viommu->vdevs);
>> +	if (idev->kvm_file)
>> +		viommu->kvm_file = get_file(idev->kvm_file);
>
> Nice! This is needed for AMD IOMMU as well!
>
> Minor nit. You have to add fput() in error path.

The error path is handled by iommufd_viommu_destroy().
iommufd_fops_ioctl() calls either destroy or finalize, as required.

-aneesh