Re: [PATCH] vfio: Use file-based reference counting for KVM

[Steffen Eiden <seiden@linux.ibm.com>]

On Wed, Sep 02, 2026 at 02:19:14PM -0600, Alex Williamson wrote:
> On Wed, 12 Aug 2026 20:55:30 +0200
> Steffen Eiden <seiden@linux.ibm.com> wrote:
> 
> > Replace manual module reference counting with file-based reference
> > counting for KVM integration. Previously, VFIO used symbol_get() to
> > obtain function pointers for kvm_get_kvm_safe() and kvm_put_kvm(),
> > then manually tracked module references through these symbols. This
> > approach required storing the put_kvm function pointer in each device
> > and carefully managing symbol references. Remove the put_kvm field in
> > struct vfio_device as is it no longer used.
> > 
> > Pass struct file pointers instead of struct kvm pointers throughout the
> > VFIO-KVM interface. This leverages the kernel's existing file reference
> > counting mechanism via get_file()/get_file_active() and fput(),
> > eliminating the need for manual module reference tracking. The
> > file->private_data field provides access to the underlying struct kvm
> > when needed.
> > 
> > group->kvm and df->kvm hold a reference of their own, taken when the
> > pointer is stored and dropped when it is overwritten or cleared. They
> > have to: the kvm-vfio device fd holds a VM reference of its own, so the
> > VM file can be closed and released while the kvm-vfio device is still
> > alive and still pointing at it. filp_cachep is SLAB_TYPESAFE_BY_RCU, so
> > a stale pointer left in those slots could be made to reference a
> > recycled, unrelated file.
> > 
> > kvm->file itself carries no reference, so that it does not pin the VM.
> > It is only ever read with get_file_active(), which is safe because
> > kvm_vm_release() clears it, i.e. before the struct file is freed.
> > 
> > This simplifies the code and removes all remaining externally exported
> > symbols for KVM, paving the path for a second concurrent KVM module.
> > 
> > Suggested-by: Jason Gunthorpe <jgg@nvidia.com>
> > Co-developed-by: Sean Christopherson <seanjc@google.com>
> > Signed-off-by: Sean Christopherson <seanjc@google.com>
> > Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
> > ---
> > This is a spin-off for the arm-on-s390 series for fast-lane merging
> > requested by sean[0]. It is based on patch 1 [1] of the v6 of the
> > arm-on-s390 series but with some fixes for some issues pointed out by
> > sashiko. The useless rcu protection of kvm->file is removed and
> > the getting-the-file-handle process is streamlined.
> 
> We'll need a shared branch to merge this across two subsystems and the
> vfio-ap driver.  Based on $Subject and LoC I can volunteer to provide
> that once we're settled.  A couple minor issues below...
>

Thank you for this, would be great!

> > diff --git a/drivers/vfio/pci/vfio_pci_zdev.c b/drivers/vfio/pci/vfio_pci_zdev.c
> > index 0990fdb146b7..d3a110101353 100644
> > --- a/drivers/vfio/pci/vfio_pci_zdev.c
> > +++ b/drivers/vfio/pci/vfio_pci_zdev.c
> > @@ -144,6 +144,7 @@ int vfio_pci_info_zdev_add_caps(struct vfio_pci_core_device *vdev,
> >  int vfio_pci_zdev_open_device(struct vfio_pci_core_device *vdev)
> >  {
> >  	struct zpci_dev *zdev = to_zpci(vdev->pdev);
> > +	struct kvm *kvm;
> >  
> >  	if (!zdev)
> >  		return -ENODEV;
> > @@ -151,8 +152,12 @@ int vfio_pci_zdev_open_device(struct vfio_pci_core_device *vdev)
> >  	if (!vdev->vdev.kvm)
> >  		return 0;
> >  
> > +	kvm = vdev->vdev.kvm->private_data;
> > +	if (!kvm)
> > +		return -ENOENT;
> > +
> >  	if (zpci_kvm_hook.kvm_register)
> > -		return zpci_kvm_hook.kvm_register(zdev, vdev->vdev.kvm);
> > +		return zpci_kvm_hook.kvm_register(zdev, kvm);
> 
> There are conflicts here with Farhan's 9f240376d034 ("s390/pci: Store
> PCI error information for passthrough devices"), we need to maintain
> the error exit funnel through stop mediation.
>

just sent a rebased v2 with that issue resolved.

> >  	return -ENOENT;
> >  }
> > diff --git a/drivers/vfio/vfio.h b/drivers/vfio/vfio.h
> > index 7728bc99b63d..f76504d707e1 100644
> > --- a/drivers/vfio/vfio.h
> > +++ b/drivers/vfio/vfio.h
> > @@ -23,7 +23,7 @@ struct vfio_device_file {
> >  	u8 access_granted;
> >  	u32 devid; /* only valid when iommufd is valid */
> >  	spinlock_t kvm_ref_lock; /* protect kvm field */
> > -	struct kvm *kvm;
> > +	struct file *kvm;
> >  	struct iommufd_ctx *iommufd; /* protected by struct vfio_device_set::lock */
> >  };
> >  
> > @@ -88,7 +88,7 @@ struct vfio_group {
> >  #endif
> >  	enum vfio_group_type		type;
> >  	struct mutex			group_lock;
> > -	struct kvm			*kvm;
> > +	struct file			*kvm;
> >  	struct file			*opened_file;
> >  	struct iommufd_ctx		*iommufd;
> >  	spinlock_t			kvm_ref_lock;
> > @@ -107,7 +107,7 @@ void vfio_device_group_unuse_iommu(struct vfio_device *device);
> >  void vfio_df_group_close(struct vfio_device_file *df);
> >  struct vfio_group *vfio_group_from_file(struct file *file);
> >  bool vfio_group_enforced_coherent(struct vfio_group *group);
> > -void vfio_group_set_kvm(struct vfio_group *group, struct kvm *kvm);
> > +void vfio_group_set_kvm(struct vfio_group *group, struct file *kvm);
> >  bool vfio_device_has_container(struct vfio_device *device);
> >  int __init vfio_group_init(void);
> >  void vfio_group_cleanup(void);
> 
> There's a stub in the !CONFIG_VFIO_GROUP set of declarations below this
> that isn't updated to the new prototype, build breaks.  Thanks,
> 
> Alex

Ah I missed that. fixed in v2.

	Steffen