Re: [PATCH] vfio: Use file-based reference counting for KVM

[Alex Williamson <alex@shazbot.org>]

On Wed, 12 Aug 2026 20:55:30 +0200
Steffen Eiden <seiden@linux.ibm.com> wrote:

> Replace manual module reference counting with file-based reference
> counting for KVM integration. Previously, VFIO used symbol_get() to
> obtain function pointers for kvm_get_kvm_safe() and kvm_put_kvm(),
> then manually tracked module references through these symbols. This
> approach required storing the put_kvm function pointer in each device
> and carefully managing symbol references. Remove the put_kvm field in
> struct vfio_device as is it no longer used.
> 
> Pass struct file pointers instead of struct kvm pointers throughout the
> VFIO-KVM interface. This leverages the kernel's existing file reference
> counting mechanism via get_file()/get_file_active() and fput(),
> eliminating the need for manual module reference tracking. The
> file->private_data field provides access to the underlying struct kvm
> when needed.
> 
> group->kvm and df->kvm hold a reference of their own, taken when the
> pointer is stored and dropped when it is overwritten or cleared. They
> have to: the kvm-vfio device fd holds a VM reference of its own, so the
> VM file can be closed and released while the kvm-vfio device is still
> alive and still pointing at it. filp_cachep is SLAB_TYPESAFE_BY_RCU, so
> a stale pointer left in those slots could be made to reference a
> recycled, unrelated file.
> 
> kvm->file itself carries no reference, so that it does not pin the VM.
> It is only ever read with get_file_active(), which is safe because
> kvm_vm_release() clears it, i.e. before the struct file is freed.
> 
> This simplifies the code and removes all remaining externally exported
> symbols for KVM, paving the path for a second concurrent KVM module.
> 
> Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
> Co-developed-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
> ---
> This is a spin-off for the arm-on-s390 series for fast-lane merging
> requested by sean[0]. It is based on patch 1 [1] of the v6 of the
> arm-on-s390 series but with some fixes for some issues pointed out by
> sashiko. The useless rcu protection of kvm->file is removed and
> the getting-the-file-handle process is streamlined.

We'll need a shared branch to merge this across two subsystems and the
vfio-ap driver.  Based on $Subject and LoC I can volunteer to provide
that once we're settled.  A couple minor issues below...

> diff --git a/drivers/vfio/pci/vfio_pci_zdev.c b/drivers/vfio/pci/vfio_pci_zdev.c
> index 0990fdb146b7..d3a110101353 100644
> --- a/drivers/vfio/pci/vfio_pci_zdev.c
> +++ b/drivers/vfio/pci/vfio_pci_zdev.c
> @@ -144,6 +144,7 @@ int vfio_pci_info_zdev_add_caps(struct vfio_pci_core_device *vdev,
>  int vfio_pci_zdev_open_device(struct vfio_pci_core_device *vdev)
>  {
>  	struct zpci_dev *zdev = to_zpci(vdev->pdev);
> +	struct kvm *kvm;
>  
>  	if (!zdev)
>  		return -ENODEV;
> @@ -151,8 +152,12 @@ int vfio_pci_zdev_open_device(struct vfio_pci_core_device *vdev)
>  	if (!vdev->vdev.kvm)
>  		return 0;
>  
> +	kvm = vdev->vdev.kvm->private_data;
> +	if (!kvm)
> +		return -ENOENT;
> +
>  	if (zpci_kvm_hook.kvm_register)
> -		return zpci_kvm_hook.kvm_register(zdev, vdev->vdev.kvm);
> +		return zpci_kvm_hook.kvm_register(zdev, kvm);

There are conflicts here with Farhan's 9f240376d034 ("s390/pci: Store
PCI error information for passthrough devices"), we need to maintain
the error exit funnel through stop mediation.
  
>  	return -ENOENT;
>  }
> diff --git a/drivers/vfio/vfio.h b/drivers/vfio/vfio.h
> index 7728bc99b63d..f76504d707e1 100644
> --- a/drivers/vfio/vfio.h
> +++ b/drivers/vfio/vfio.h
> @@ -23,7 +23,7 @@ struct vfio_device_file {
>  	u8 access_granted;
>  	u32 devid; /* only valid when iommufd is valid */
>  	spinlock_t kvm_ref_lock; /* protect kvm field */
> -	struct kvm *kvm;
> +	struct file *kvm;
>  	struct iommufd_ctx *iommufd; /* protected by struct vfio_device_set::lock */
>  };
>  
> @@ -88,7 +88,7 @@ struct vfio_group {
>  #endif
>  	enum vfio_group_type		type;
>  	struct mutex			group_lock;
> -	struct kvm			*kvm;
> +	struct file			*kvm;
>  	struct file			*opened_file;
>  	struct iommufd_ctx		*iommufd;
>  	spinlock_t			kvm_ref_lock;
> @@ -107,7 +107,7 @@ void vfio_device_group_unuse_iommu(struct vfio_device *device);
>  void vfio_df_group_close(struct vfio_device_file *df);
>  struct vfio_group *vfio_group_from_file(struct file *file);
>  bool vfio_group_enforced_coherent(struct vfio_group *group);
> -void vfio_group_set_kvm(struct vfio_group *group, struct kvm *kvm);
> +void vfio_group_set_kvm(struct vfio_group *group, struct file *kvm);
>  bool vfio_device_has_container(struct vfio_device *device);
>  int __init vfio_group_init(void);
>  void vfio_group_cleanup(void);

There's a stub in the !CONFIG_VFIO_GROUP set of declarations below this
that isn't updated to the new prototype, build breaks.  Thanks,

Alex