On Wed, Oct 09, 2024 at 09:38:08AM -0700, Nicolin Chen wrote: > +static struct iommufd_viommu * > +mock_viommu_alloc(struct iommu_device *iommu_dev, struct iommu_domain *domain, > + struct iommufd_ctx *ictx, unsigned int viommu_type) > +{ > + struct mock_iommu_device *mock_iommu = > + container_of(iommu_dev, struct mock_iommu_device, iommu_dev); > + struct mock_viommu *mock_viommu; > + > + if (viommu_type != IOMMU_VIOMMU_TYPE_SELFTEST) > + return ERR_PTR(-EOPNOTSUPP); What about the default viommu? What happens then? > + mock_viommu = iommufd_viommu_alloc(ictx, mock_viommu, core, > + &mock_viommu_ops); > + if (IS_ERR(mock_viommu)) > + return ERR_CAST(mock_viommu); > + > + if (!refcount_inc_not_zero(&mock_iommu->users)) { It would be a bug if the iommu_dev being passed in was somehow released while iommufd had hold of it through vfio. So just use refcount_inc() Jason