[PATCH v7 08/16] iommufd/viommu: Keep a reference to the KVM file

[Tian, Kevin]

> From: Aneesh Kumar K.V <aneesh.kumar at kernel.org>
> Sent: Thursday, October 29, 2026 2:26 PM
> 
> Jacob Pan <jacob.pan at linux.microsoft.com> writes:
> 
> > Hi Aneesh,
> >
> > On Thu,  8 Oct 2026 11:29:47 +0530
> > "Aneesh Kumar K.V (Arm)" <aneesh.kumar at kernel.org> wrote:
> >
> >> @@ -82,6 +85,8 @@ int iommufd_viommu_alloc_ioctl(struct
> iommufd_ucmd
> >> *ucmd) }
> >>
> >>  	xa_init(&viommu->vdevs);
> >> +	if (idev->kvm_file)
> >> +		viommu->kvm_file = get_file(idev->kvm_file);
> > So kvm_file will persist inside viommu even when no more vdevice exists
> > under the viommu. In that case, don't we need to check idev->kvm_file
> > matches viommu->kvm_file during vdevice allocation?
> >
> > Otherwise, it appears possible to associate a device belonging to a
> > different KVM VM with the existing vIOMMU, no?
> >
> 
> Agreed. I will add the below.
> 
> modified    drivers/iommu/iommufd/viommu.c
> @@ -212,6 +212,11 @@ int iommufd_vdevice_alloc_ioctl(struct
> iommufd_ucmd *ucmd)
>  		goto out_put_viommu;
>  	}
> 
> +	if (idev->kvm_file != viommu->kvm_file) {
> +		rc = -EINVAL;
> +		goto out_put_idev;
> +	}
> +

IMHO this is required beyond the tsm usage.

Currently IOMMUFD doesn't prevent bound devices tied to different VMs, but
in concept a vIOMMU should not be shared by two VMs.

The uAPI header already says:

"
* Allocate a virtual IOMMU object, representing the underlying physical IOMMU's
 * virtualization support that is a security-isolated slice of the real IOMMU HW
 * that is unique to a specific VM.
"

But that uniqueness is not enforced so far, and your proposed change
can fix it.

Besides, it might be a good idea to return an error if idev->kvm_file is
NULL in iommufd_viommu_alloc_ioctl(). I don't think the viommu logic
is designed for native application...