[PATCH 1/4] KVM: VFIO: clean up control flow in kvm_vfio_file_add()

[PATCH 1/4] KVM: VFIO: clean up control flow in kvm_vfio_file_add()

[Carlos López]

The struct file that this function fgets() is always passed to fput()
before returning, so use automatic cleanup via __free() to avoid several
jumps to the end of the function. Similarly, use a mutex guard to
completely remove the need to use gotos.

Signed-off-by: Carlos López <clopez@suse.de>
---
 virt/kvm/vfio.c | 29 +++++++++--------------------
 1 file changed, 9 insertions(+), 20 deletions(-)

diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
index 9f9acb66cc1e..2c91bad3333b 100644
--- a/virt/kvm/vfio.c
+++ b/virt/kvm/vfio.c
@@ -144,33 +144,26 @@ static int kvm_vfio_file_add(struct kvm_device *dev, unsigned int fd)
 {
 	struct kvm_vfio *kv = dev->private;
 	struct kvm_vfio_file *kvf;
-	struct file *filp;
-	int ret = 0;
+	struct file *filp __free(fput) = NULL;
 
 	filp = fget(fd);
 	if (!filp)
 		return -EBADF;
 
 	/* Ensure the FD is a vfio FD. */
-	if (!kvm_vfio_file_is_valid(filp)) {
-		ret = -EINVAL;
-		goto out_fput;
-	}
+	if (!kvm_vfio_file_is_valid(filp))
+		return -EINVAL;
 
-	mutex_lock(&kv->lock);
+	guard(mutex)(&kv->lock);
 
 	list_for_each_entry(kvf, &kv->file_list, node) {
-		if (kvf->file == filp) {
-			ret = -EEXIST;
-			goto out_unlock;
-		}
+		if (kvf->file == filp)
+			return -EEXIST;
 	}
 
 	kvf = kzalloc_obj(*kvf, GFP_KERNEL_ACCOUNT);
-	if (!kvf) {
-		ret = -ENOMEM;
-		goto out_unlock;
-	}
+	if (!kvf)
+		return -ENOMEM;
 
 	kvf->file = get_file(filp);
 	list_add_tail(&kvf->node, &kv->file_list);
@@ -178,11 +171,7 @@ static int kvm_vfio_file_add(struct kvm_device *dev, unsigned int fd)
 	kvm_vfio_file_set_kvm(kvf->file, dev->kvm);
 	kvm_vfio_update_coherency(dev);
 
-out_unlock:
-	mutex_unlock(&kv->lock);
-out_fput:
-	fput(filp);
-	return ret;
+	return 0;
 }
 
 static int kvm_vfio_file_del(struct kvm_device *dev, unsigned int fd)
-- 
2.51.0

[PATCH 2/4] KVM: VFIO: use mutex guard in kvm_vfio_file_set_spapr_tce()

[Carlos López]

Use a mutex guard to hold a lock for the entirety of the function, which
removes the need for a goto (whose label even has a misleading name
since 8152f8201088 ("fdget(), more trivial conversions"))

Signed-off-by: Carlos López <clopez@suse.de>
---
 virt/kvm/vfio.c | 19 ++++++-------------
 1 file changed, 6 insertions(+), 13 deletions(-)

diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
index 2c91bad3333b..02d373f66cba 100644
--- a/virt/kvm/vfio.c
+++ b/virt/kvm/vfio.c
@@ -225,9 +225,7 @@ static int kvm_vfio_file_set_spapr_tce(struct kvm_device *dev,
 	if (fd_empty(f))
 		return -EBADF;
 
-	ret = -ENOENT;
-
-	mutex_lock(&kv->lock);
+	guard(mutex)(&kv->lock);
 
 	list_for_each_entry(kvf, &kv->file_list, node) {
 		if (kvf->file != fd_file(f))
@@ -235,20 +233,15 @@ static int kvm_vfio_file_set_spapr_tce(struct kvm_device *dev,
 
 		if (!kvf->iommu_group) {
 			kvf->iommu_group = kvm_vfio_file_iommu_group(kvf->file);
-			if (WARN_ON_ONCE(!kvf->iommu_group)) {
-				ret = -EIO;
-				goto err_fdput;
-			}
+			if (WARN_ON_ONCE(!kvf->iommu_group))
+				return -EIO;
 		}
 
-		ret = kvm_spapr_tce_attach_iommu_group(dev->kvm, param.tablefd,
-						       kvf->iommu_group);
-		break;
+		return kvm_spapr_tce_attach_iommu_group(dev->kvm, param.tablefd,
+							kvf->iommu_group);
 	}
 
-err_fdput:
-	mutex_unlock(&kv->lock);
-	return ret;
+	return -ENOENT;
 }
 #endif
 
-- 
2.51.0

Re: [PATCH 2/4] KVM: VFIO: use mutex guard in kvm_vfio_file_set_spapr_tce()

[kernel test robot]

Hi Carlos,

kernel test robot noticed the following build warnings:

[auto build test WARNING on d2ea4ff1ce50787a98a3900b3fb1636f3620b7cf]

url:    https://github.com/intel-lab-lkp/linux/commits/Carlos-L-pez/KVM-VFIO-clean-up-control-flow-in-kvm_vfio_file_add/20260314-053050
base:   d2ea4ff1ce50787a98a3900b3fb1636f3620b7cf
patch link:    https://lore.kernel.org/r/20260313122040.1413091-5-clopez%40suse.de
patch subject: [PATCH 2/4] KVM: VFIO: use mutex guard in kvm_vfio_file_set_spapr_tce()
config: powerpc-allmodconfig (https://download.01.org/0day-ci/archive/20260403/202604031640.vckbuS2S-lkp@intel.com/config)
compiler: powerpc64-linux-gcc (GCC) 15.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260403/202604031640.vckbuS2S-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604031640.vckbuS2S-lkp@intel.com/

All warnings (new ones prefixed by >>):

   arch/powerpc/kvm/../../../virt/kvm/vfio.c: In function 'kvm_vfio_file_set_spapr_tce':
>> arch/powerpc/kvm/../../../virt/kvm/vfio.c:219:13: warning: unused variable 'ret' [-Wunused-variable]
     219 |         int ret;
         |             ^~~


vim +/ret +219 arch/powerpc/kvm/../../../virt/kvm/vfio.c

121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  211  
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  212  #ifdef CONFIG_SPAPR_TCE_IOMMU
2f99073a722beef Yi Liu               2023-07-18  213  static int kvm_vfio_file_set_spapr_tce(struct kvm_device *dev,
73b0565f19a8fbc Jason Gunthorpe      2022-05-04  214  				       void __user *arg)
73b0565f19a8fbc Jason Gunthorpe      2022-05-04  215  {
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  216  	struct kvm_vfio_spapr_tce param;
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  217  	struct kvm_vfio *kv = dev->private;
2f99073a722beef Yi Liu               2023-07-18  218  	struct kvm_vfio_file *kvf;
73b0565f19a8fbc Jason Gunthorpe      2022-05-04 @219  	int ret;
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  220  
73b0565f19a8fbc Jason Gunthorpe      2022-05-04  221  	if (copy_from_user(&param, arg, sizeof(struct kvm_vfio_spapr_tce)))
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  222  		return -EFAULT;
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  223  
8152f8201088350 Al Viro              2024-07-19  224  	CLASS(fd, f)(param.groupfd);
8152f8201088350 Al Viro              2024-07-19  225  	if (fd_empty(f))
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  226  		return -EBADF;
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  227  
db3d8c11676213b Carlos López         2026-03-13  228  	guard(mutex)(&kv->lock);
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  229  
2f99073a722beef Yi Liu               2023-07-18  230  	list_for_each_entry(kvf, &kv->file_list, node) {
1da91ea87aefe2c Al Viro              2024-05-31  231  		if (kvf->file != fd_file(f))
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  232  			continue;
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  233  
2f99073a722beef Yi Liu               2023-07-18  234  		if (!kvf->iommu_group) {
2f99073a722beef Yi Liu               2023-07-18  235  			kvf->iommu_group = kvm_vfio_file_iommu_group(kvf->file);
db3d8c11676213b Carlos López         2026-03-13  236  			if (WARN_ON_ONCE(!kvf->iommu_group))
db3d8c11676213b Carlos López         2026-03-13  237  				return -EIO;
819da99a7360f7e Jason Gunthorpe      2022-10-07  238  		}
d55d9e7a4572182 Jason Gunthorpe      2022-05-04  239  
db3d8c11676213b Carlos López         2026-03-13  240  		return kvm_spapr_tce_attach_iommu_group(dev->kvm, param.tablefd,
2f99073a722beef Yi Liu               2023-07-18  241  							kvf->iommu_group);
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  242  	}
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  243  
db3d8c11676213b Carlos López         2026-03-13  244  	return -ENOENT;
121f80ba68f1a57 Alexey Kardashevskiy 2017-03-22  245  }
73b0565f19a8fbc Jason Gunthorpe      2022-05-04  246  #endif
73b0565f19a8fbc Jason Gunthorpe      2022-05-04  247  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

[PATCH 3/4] KVM: VFIO: deduplicate file release logic

[Carlos López]

There are two callsites which destroy files in kv->file_list: the
function servicing KVM_DEV_VFIO_FILE_DEL, and the relase of the whole
KVM VFIO device. The process involves several steps, so move all those
into a single function, removing duplicate code.

Signed-off-by: Carlos López <clopez@suse.de>
---
 virt/kvm/vfio.c | 39 ++++++++++++++++++---------------------
 1 file changed, 18 insertions(+), 21 deletions(-)

diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
index 02d373f66cba..e1c88c0b82d9 100644
--- a/virt/kvm/vfio.c
+++ b/virt/kvm/vfio.c
@@ -174,6 +174,17 @@ static int kvm_vfio_file_add(struct kvm_device *dev, unsigned int fd)
 	return 0;
 }
 
+static void kvm_vfio_file_free(struct kvm_device *dev, struct kvm_vfio_file *kvf)
+{
+#ifdef CONFIG_SPAPR_TCE_IOMMU
+	kvm_spapr_tce_release_vfio_group(dev->kvm, kvf);
+#endif
+	kvm_vfio_file_set_kvm(kvf->file, NULL);
+	fput(kvf->file);
+	list_del(&kvf->node);
+	kfree(kvf);
+}
+
 static int kvm_vfio_file_del(struct kvm_device *dev, unsigned int fd)
 {
 	struct kvm_vfio *kv = dev->private;
@@ -189,18 +200,11 @@ static int kvm_vfio_file_del(struct kvm_device *dev, unsigned int fd)
 	mutex_lock(&kv->lock);
 
 	list_for_each_entry(kvf, &kv->file_list, node) {
-		if (kvf->file != fd_file(f))
-			continue;
-
-		list_del(&kvf->node);
-#ifdef CONFIG_SPAPR_TCE_IOMMU
-		kvm_spapr_tce_release_vfio_group(dev->kvm, kvf);
-#endif
-		kvm_vfio_file_set_kvm(kvf->file, NULL);
-		fput(kvf->file);
-		kfree(kvf);
-		ret = 0;
-		break;
+		if (kvf->file == fd_file(f)) {
+			kvm_vfio_file_free(dev, kvf);
+			ret = 0;
+			break;
+		}
 	}
 
 	kvm_vfio_update_coherency(dev);
@@ -308,15 +312,8 @@ static void kvm_vfio_release(struct kvm_device *dev)
 	struct kvm_vfio *kv = dev->private;
 	struct kvm_vfio_file *kvf, *tmp;
 
-	list_for_each_entry_safe(kvf, tmp, &kv->file_list, node) {
-#ifdef CONFIG_SPAPR_TCE_IOMMU
-		kvm_spapr_tce_release_vfio_group(dev->kvm, kvf);
-#endif
-		kvm_vfio_file_set_kvm(kvf->file, NULL);
-		fput(kvf->file);
-		list_del(&kvf->node);
-		kfree(kvf);
-	}
+	list_for_each_entry_safe(kvf, tmp, &kv->file_list, node)
+		kvm_vfio_file_free(dev, kvf);
 
 	kvm_vfio_update_coherency(dev);
 
-- 
2.51.0

[PATCH 4/4] KVM: VFIO: update coherency only if file was deleted

[Carlos López]

When servicing a KVM_DEV_VFIO_FILE_DEL request, if a file is removed
from kv->file_list, kv->noncoherent needs to be updated, in case we
can revert to using coherent DMA. However, if we found no candidate
to remove, there is no need to re-scan the list, so do it only if a
matching file was found.

To simplify the control flow, use a mutex guard so that we can return
early from within the search loop if the maching file is found.

Signed-off-by: Carlos López <clopez@suse.de>
---
 virt/kvm/vfio.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c
index e1c88c0b82d9..47a3b8d82735 100644
--- a/virt/kvm/vfio.c
+++ b/virt/kvm/vfio.c
@@ -190,27 +190,21 @@ static int kvm_vfio_file_del(struct kvm_device *dev, unsigned int fd)
 	struct kvm_vfio *kv = dev->private;
 	struct kvm_vfio_file *kvf;
 	CLASS(fd, f)(fd);
-	int ret;
 
 	if (fd_empty(f))
 		return -EBADF;
 
-	ret = -ENOENT;
-
-	mutex_lock(&kv->lock);
+	guard(mutex)(&kv->lock);
 
 	list_for_each_entry(kvf, &kv->file_list, node) {
 		if (kvf->file == fd_file(f)) {
 			kvm_vfio_file_free(dev, kvf);
-			ret = 0;
-			break;
+			kvm_vfio_update_coherency(dev);
+			return 0;
 		}
 	}
 
-	kvm_vfio_update_coherency(dev);
-
-	mutex_unlock(&kv->lock);
-	return ret;
+	return -ENOENT;
 }
 
 #ifdef CONFIG_SPAPR_TCE_IOMMU
-- 
2.51.0