Re: [RFC PATCH v6 08/11] iommufd: Add vIOMMU provider support

[Jason Gunthorpe <jgg@nvidia.com>]

On Tue, Sep 29, 2026 at 11:44:28AM +0530, Aneesh Kumar K.V wrote:

> tsm_viommu_get_ops() runs with pci_tsm_rwsem held for read and takes a
> temporary reference on the backend module (the CCA module). This keeps
> the selected ops callable until vIOMMU initialization completes. iommufd
> then drops the reference. This does not pin a particular TSM
> registration or prevent tsm_unregister().

That seems over complicated. Maybe we can't get to the sane locking I
suggested earlier where TSM module is stable while a driver is bound,
but we absolutely must have sane locking where we can "pin" the tsm
for a pdev and it cannot be unregistered for long periods of time,
such as while a viommu/vdev exists.

That period should start right before getting the ops and continue to
until the viommu is destroyed.

No hot unplug of tsm modules while things are active.

> CCA vIOMMU initialization takes a tsm_dev reference, keeping the TSM
> object and its PCI/TSM resources alive until the vIOMMU is
> destroyed.

iommufd should do this, so long as the viommu object exists the tsm
for it exists. It should not be inside tsm drivers.

> The initialization callback also takes a reference on the CCA module so
> that the vIOMMU callbacks remain available after iommufd drops the
> temporary discovery reference described above.

The initial pin should do this since it is the only way to prevent
unregistration.

> For a link TSM-connected device, a vdevice holds a pci_tsm_context
> reference. The context holds device references and increments PF0's
> context_users under the PF0 mutex. PCI/TSM disconnect checks that count
> under the same mutex and returns -EBUSY while contexts remain. The
> context is released during vdevice teardown. This prevents link
> disconnect while a vdevice is active without blocking tsm_unregister().

This one seems reasonable, but not sure a mutex is needed on top of a
a simple refcount scheme.

> A new unregistering state is added to tsm_dev. tsm_unregister() sets it,
> unregisters the class device, and drops the registration reference. New
> vIOMMU allocations, vdevice contexts, and PCI TSM connect/lock
> operations reject the TSM once this state is set. Existing users retain
> their references and can be torn down normally, so tsm_unregister() does
> not need to wait for them. PCI/TSM teardown occurs when the last active
> tsm_dev reference is dropped.

This seems over complicated, tsm unregistration should be made
impossible while it is not able to complete. We shouldn't need the
complexity of states here when we don't need to support tsm
hot-unplug.

ideally the module refcount handles this and the only way to trigger a
tsm remove is through module unload, with no sysfs path?

Jason