[Devel] [PATCH hci-8.1 1/2] vfio: take the kvm reference only for drivers that read device->kvm

[Andrey Drobyshev]

A device takes a reference to its group's kvm at the first open and
drops it at the last close, so that device->kvm stays valid for the
driver in between. QEMU's cpr-exec and cpr-transfer keep the device
open while the VM is re-created, so the first VM stays referenced for
as long as the device is: its vcpus, mm and in-kernel PIT thread with
it. Seen as a second KVM instance in debugfs after a live update of a
vGPU VM.

Only three drivers read device->kvm after open_device(): KVMGT,
vfio_ap and vfio-pci's zdev support. Let them say so with
needs_kvm_ref, and take no reference for the others, which then can't
keep a VM alive. Tested with nvidia-vgpu-vfio 595.71.03 on RTX 6000
Ada SR-IOV VFs, a vfio-pci variant driver that doesn't read the
pointer.

Fixes: 2b48f52f2bff ("vfio: fix deadlock between group lock and kvm lock")
https://virtuozzo.atlassian.net/browse/VSTOR-150597
Feature: fix ms/vfio

Assisted-by: LLM
Signed-off-by: Andrey Drobyshev <andrey.drobyshev at virtuozzo.com>
---
 drivers/gpu/drm/i915/gvt/kvmgt.c  | 1 +
 drivers/s390/crypto/vfio_ap_ops.c | 1 +
 drivers/vfio/pci/vfio_pci_core.c  | 1 +
 drivers/vfio/vfio_main.c          | 6 ++++--
 include/linux/vfio.h              | 6 ++++++
 5 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 96d23717684f..a0d2f9f4b720 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -1418,6 +1418,7 @@ static int intel_vgpu_init_dev(struct vfio_device *vfio_dev)
 	int ret;
 
 	vgpu->gvt = kdev_to_i915(mdev->type->parent->dev)->gvt;
+	vfio_dev->needs_kvm_ref = true;
 	ret = intel_gvt_create_vgpu(vgpu, type->conf);
 	if (ret)
 		return ret;
diff --git a/drivers/s390/crypto/vfio_ap_ops.c b/drivers/s390/crypto/vfio_ap_ops.c
index 766557547f83..78e8566a9ced 100644
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -779,6 +779,7 @@ static int vfio_ap_mdev_init_dev(struct vfio_device *vdev)
 		container_of(vdev, struct ap_matrix_mdev, vdev);
 
 	matrix_mdev->mdev = to_mdev_device(vdev->dev);
+	vdev->needs_kvm_ref = true;
 	vfio_ap_matrix_init(&matrix_dev->info, &matrix_mdev->matrix);
 	matrix_mdev->pqap_hook = handle_pqap;
 	vfio_ap_matrix_init(&matrix_dev->info, &matrix_mdev->shadow_apcb);
diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
index 7e360f6f89eb..1b02c2fb6c20 100644
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -2094,6 +2094,7 @@ int vfio_pci_core_init_dev(struct vfio_device *core_vdev)
 
 	vdev->pdev = to_pci_dev(core_vdev->dev);
 	vdev->irq_type = VFIO_PCI_NUM_IRQS;
+	core_vdev->needs_kvm_ref = IS_ENABLED(CONFIG_VFIO_PCI_ZDEV_KVM);
 	mutex_init(&vdev->igate);
 	spin_lock_init(&vdev->irqlock);
 	mutex_init(&vdev->ioeventfds_lock);
diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c
index bf01fc64ee64..dfeee692c2a4 100644
--- a/drivers/vfio/vfio_main.c
+++ b/drivers/vfio/vfio_main.c
@@ -441,7 +441,8 @@ void vfio_device_get_kvm_safe(struct vfio_device *device, struct kvm *kvm)
 
 	lockdep_assert_held(&device->dev_set->lock);
 
-	if (!kvm)
+	/* Only a driver that reads device->kvm needs the KVM referenced */
+	if (!kvm || !device->needs_kvm_ref)
 		return;
 
 	pfn = symbol_get(kvm_put_kvm);
@@ -1505,7 +1506,8 @@ static void vfio_device_file_set_kvm(struct file *file, struct kvm *kvm)
  * @kvm: KVM to link
  *
  * When a VFIO device is first opened the KVM will be available in
- * device->kvm if one was associated with the file.
+ * device->kvm if one was associated with the file and the driver set
+ * needs_kvm_ref.
  */
 void vfio_file_set_kvm(struct file *file, struct kvm *kvm)
 {
diff --git a/include/linux/vfio.h b/include/linux/vfio.h
index e90859956514..96a09843e0a6 100644
--- a/include/linux/vfio.h
+++ b/include/linux/vfio.h
@@ -52,6 +52,12 @@ struct vfio_device {
 	struct vfio_device_set *dev_set;
 	struct list_head dev_set_list;
 	unsigned int migration_flags;
+	/*
+	 * Set before registration by a driver that reads device->kvm after
+	 * open_device(): the core then keeps the KVM the device was opened
+	 * with referenced until close_device().
+	 */
+	bool needs_kvm_ref;
 	struct kvm *kvm;
 
 	/* Members below here are private, not for driver use */
-- 
2.47.1