A device takes a reference to its group's kvm at the first open and
drops it at the last close, so that device->kvm stays valid for the
driver in between. QEMU's cpr-exec and cpr-transfer keep the device
open while the VM is re-created, so the first VM stays referenced for
as long as the device is: its vcpus, mm and in-kernel PIT thread with
it. Seen as a second KVM instance in debugfs after a live update of a
vGPU VM.

Only three drivers read device->kvm after open_device(): KVMGT,
vfio_ap and vfio-pci's zdev support. Let them say so with
needs_kvm_ref, and take no reference for the others, which then can't
keep a VM alive. Tested with nvidia-vgpu-vfio 595.71.03 on RTX 6000
Ada SR-IOV VFs, a vfio-pci variant driver that doesn't read the
pointer.

Fixes: 2b48f52f2bff ("vfio: fix deadlock between group lock and kvm lock")
https://virtuozzo.atlassian.net/browse/VSTOR-150597
Feature: fix ms/vfio

Assisted-by: LLM
Signed-off-by: Andrey Drobyshev <[email protected]>
---
 drivers/gpu/drm/i915/gvt/kvmgt.c  | 1 +
 drivers/s390/crypto/vfio_ap_ops.c | 1 +
 drivers/vfio/pci/vfio_pci_core.c  | 1 +
 drivers/vfio/vfio_main.c          | 6 ++++--
 include/linux/vfio.h              | 6 ++++++
 5 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c
index 96d23717684f..a0d2f9f4b720 100644
--- a/drivers/gpu/drm/i915/gvt/kvmgt.c
+++ b/drivers/gpu/drm/i915/gvt/kvmgt.c
@@ -1418,6 +1418,7 @@ static int intel_vgpu_init_dev(struct vfio_device 
*vfio_dev)
        int ret;
 
        vgpu->gvt = kdev_to_i915(mdev->type->parent->dev)->gvt;
+       vfio_dev->needs_kvm_ref = true;
        ret = intel_gvt_create_vgpu(vgpu, type->conf);
        if (ret)
                return ret;
diff --git a/drivers/s390/crypto/vfio_ap_ops.c 
b/drivers/s390/crypto/vfio_ap_ops.c
index 766557547f83..78e8566a9ced 100644
--- a/drivers/s390/crypto/vfio_ap_ops.c
+++ b/drivers/s390/crypto/vfio_ap_ops.c
@@ -779,6 +779,7 @@ static int vfio_ap_mdev_init_dev(struct vfio_device *vdev)
                container_of(vdev, struct ap_matrix_mdev, vdev);
 
        matrix_mdev->mdev = to_mdev_device(vdev->dev);
+       vdev->needs_kvm_ref = true;
        vfio_ap_matrix_init(&matrix_dev->info, &matrix_mdev->matrix);
        matrix_mdev->pqap_hook = handle_pqap;
        vfio_ap_matrix_init(&matrix_dev->info, &matrix_mdev->shadow_apcb);
diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
index 7e360f6f89eb..1b02c2fb6c20 100644
--- a/drivers/vfio/pci/vfio_pci_core.c
+++ b/drivers/vfio/pci/vfio_pci_core.c
@@ -2094,6 +2094,7 @@ int vfio_pci_core_init_dev(struct vfio_device *core_vdev)
 
        vdev->pdev = to_pci_dev(core_vdev->dev);
        vdev->irq_type = VFIO_PCI_NUM_IRQS;
+       core_vdev->needs_kvm_ref = IS_ENABLED(CONFIG_VFIO_PCI_ZDEV_KVM);
        mutex_init(&vdev->igate);
        spin_lock_init(&vdev->irqlock);
        mutex_init(&vdev->ioeventfds_lock);
diff --git a/drivers/vfio/vfio_main.c b/drivers/vfio/vfio_main.c
index bf01fc64ee64..dfeee692c2a4 100644
--- a/drivers/vfio/vfio_main.c
+++ b/drivers/vfio/vfio_main.c
@@ -441,7 +441,8 @@ void vfio_device_get_kvm_safe(struct vfio_device *device, 
struct kvm *kvm)
 
        lockdep_assert_held(&device->dev_set->lock);
 
-       if (!kvm)
+       /* Only a driver that reads device->kvm needs the KVM referenced */
+       if (!kvm || !device->needs_kvm_ref)
                return;
 
        pfn = symbol_get(kvm_put_kvm);
@@ -1505,7 +1506,8 @@ static void vfio_device_file_set_kvm(struct file *file, 
struct kvm *kvm)
  * @kvm: KVM to link
  *
  * When a VFIO device is first opened the KVM will be available in
- * device->kvm if one was associated with the file.
+ * device->kvm if one was associated with the file and the driver set
+ * needs_kvm_ref.
  */
 void vfio_file_set_kvm(struct file *file, struct kvm *kvm)
 {
diff --git a/include/linux/vfio.h b/include/linux/vfio.h
index e90859956514..96a09843e0a6 100644
--- a/include/linux/vfio.h
+++ b/include/linux/vfio.h
@@ -52,6 +52,12 @@ struct vfio_device {
        struct vfio_device_set *dev_set;
        struct list_head dev_set_list;
        unsigned int migration_flags;
+       /*
+        * Set before registration by a driver that reads device->kvm after
+        * open_device(): the core then keeps the KVM the device was opened
+        * with referenced until close_device().
+        */
+       bool needs_kvm_ref;
        struct kvm *kvm;
 
        /* Members below here are private, not for driver use */
-- 
2.47.1

_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel

Reply via email to