vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD
authorJason Gunthorpe <jgg@nvidia.com>
Mon, 14 Jul 2025 16:08:25 +0000 (13:08 -0300)
committerAlex Williamson <alex.williamson@redhat.com>
Tue, 5 Aug 2025 21:41:14 +0000 (15:41 -0600)
commit86624ba3b522b6512def25534341da93356c8da4
tree79092057ba1b34bc2ebd802a3d14b3280336138c
parentb3060198483bac43ec113c62ae3837076f61f5de
vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD

This was missed during the initial implementation. The VFIO PCI encodes
the vf_token inside the device name when opening the device from the group
FD, something like:

  "0000:04:10.0 vf_token=bd8d9d2b-5a5f-4f5a-a211-f591514ba1f3"

This is used to control access to a VF unless there is co-ordination with
the owner of the PF.

Since we no longer have a device name in the cdev path, pass the token
directly through VFIO_DEVICE_BIND_IOMMUFD using an optional field
indicated by VFIO_DEVICE_BIND_FLAG_TOKEN.

Fixes: 5fcc26969a16 ("vfio: Add VFIO_DEVICE_BIND_IOMMUFD")
Tested-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Reviewed-by: Yi Liu <yi.l.liu@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/0-v3-bdd8716e85fe+3978a-vfio_token_jgg@nvidia.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
12 files changed:
drivers/vfio/device_cdev.c
drivers/vfio/pci/hisilicon/hisi_acc_vfio_pci.c
drivers/vfio/pci/mlx5/main.c
drivers/vfio/pci/nvgrace-gpu/main.c
drivers/vfio/pci/pds/vfio_dev.c
drivers/vfio/pci/qat/main.c
drivers/vfio/pci/vfio_pci.c
drivers/vfio/pci/vfio_pci_core.c
drivers/vfio/pci/virtio/main.c
include/linux/vfio.h
include/linux/vfio_pci_core.h
include/uapi/linux/vfio.h