[PATCH 29/60] kvm: Implement KVM_CREATE_PLANE ioctl

[Serge Hallyn]

On Mon, Jun 08, 2026 at 04:42:21PM +0200, Jörg Rödel wrote:
> From: Paolo Bonzini <pbonzini at redhat.com>
> 
> Add a new VM ioctl to create a new plane. It returns a new file
> descriptor which supports per-plane ioctls.
> 
> Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
> Co-developed-by: Joerg Roedel <joerg.roedel at amd.com>
> Signed-off-by: Joerg Roedel <joerg.roedel at amd.com>
> ---
>  include/uapi/linux/kvm.h |  2 ++
>  virt/kvm/kvm_main.c      | 75 ++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 77 insertions(+)
> 
> diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h
> index 813f964a6dc1..24e34b8e4819 100644
> --- a/include/uapi/linux/kvm.h
> +++ b/include/uapi/linux/kvm.h
> @@ -1355,6 +1355,8 @@ struct kvm_s390_keyop {
>  #define KVM_GET_DEVICE_ATTR	  _IOW(KVMIO,  0xe2, struct kvm_device_attr)
>  #define KVM_HAS_DEVICE_ATTR	  _IOW(KVMIO,  0xe3, struct kvm_device_attr)
>  
> +#define KVM_CREATE_PLANE	  _IO(KVMIO, 0xe4)
> +
>  /*
>   * ioctls for vcpu fds
>   */
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index 5a0277e2ac7c..03a44ff62f0f 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -4843,6 +4843,34 @@ static long kvm_vcpu_compat_ioctl(struct file *filp,
>  }
>  #endif
>  
> +static long kvm_plane_ioctl(struct file *filp, unsigned int ioctl,
> +			    unsigned long arg)
> +{
> +	struct kvm_plane *plane = filp->private_data;
> +
> +	if (plane->kvm->mm != current->mm || plane->kvm->vm_dead)
> +		return -EIO;
> +
> +	switch (ioctl) {
> +	default:
> +		return -ENOTTY;
> +	}
> +}
> +
> +static int kvm_plane_release(struct inode *inode, struct file *filp)
> +{
> +	struct kvm_plane *plane = filp->private_data;
> +
> +	kvm_put_kvm(plane->kvm);
> +	return 0;
> +}
> +
> +static struct file_operations kvm_plane_fops = {
> +	.unlocked_ioctl = kvm_plane_ioctl,
> +	.release = kvm_plane_release,
> +	KVM_COMPAT(kvm_plane_ioctl),
> +};
> +
>  static int kvm_device_mmap(struct file *filp, struct vm_area_struct *vma)
>  {
>  	struct kvm_device *dev = filp->private_data;
> @@ -5288,6 +5316,49 @@ static int kvm_vm_ioctl_get_stats_fd(struct kvm *kvm)
>  	return fd;
>  }
>  
> +static int kvm_vm_ioctl_create_plane(struct kvm *kvm, unsigned id)
> +{
> +	struct kvm_plane *plane;
> +	struct file *file;
> +	int r, fd;
> +
> +	if (id >= kvm_arch_max_planes(kvm) ||
> +	    WARN_ON_ONCE(id >= KVM_MAX_PLANES))
> +		return -EINVAL;
> +
> +	guard(mutex)(&kvm->lock);
> +	if (kvm->planes[id])
> +		return -EEXIST;
> +
> +	fd = get_unused_fd_flags(O_CLOEXEC);
> +	if (fd < 0)
> +		return fd;
> +
> +	plane = kvm_create_plane(kvm, id);
> +	if (!plane) {
> +		r = -ENOMEM;
> +		goto put_fd;
> +	}
> +
> +	kvm_get_kvm(kvm);
> +	file = anon_inode_getfile("kvm-plane", &kvm_plane_fops, plane, O_RDWR);
> +	if (IS_ERR(file)) {
> +		r = PTR_ERR(file);
> +		goto put_kvm;
> +	}
> +
> +	fd_install(fd, file);
> +	return fd;
> +
> +put_kvm:
> +	kvm_put_kvm(kvm);
> +	kvm_destroy_one_plane(plane);

I believe shashiko is right here, and I don't see it changed in a later
patch:  kvm->planes[id] will still point to the now-freed plane.
Probably best if kvm_destroy_one_plane(plane) sets that to NULL itself
after freeing the plane.

> +put_fd:
> +	put_unused_fd(fd);
> +	return r;
> +}
> +
> +
>  #define SANITY_CHECK_MEM_REGION_FIELD(field)					\
>  do {										\
>  	BUILD_BUG_ON(offsetof(struct kvm_userspace_memory_region, field) !=		\
> @@ -5306,6 +5377,9 @@ static long kvm_vm_ioctl(struct file *filp,
>  	if (kvm->mm != current->mm || kvm->vm_dead)
>  		return -EIO;
>  	switch (ioctl) {
> +	case KVM_CREATE_PLANE:
> +		r = kvm_vm_ioctl_create_plane(kvm, arg);
> +		break;
>  	case KVM_CREATE_VCPU:
>  		r = kvm_vm_ioctl_create_vcpu(kvm, arg);
>  		break;
> @@ -6676,6 +6750,7 @@ int kvm_init(unsigned vcpu_size, unsigned vcpu_align, struct module *module)
>  	kvm_chardev_ops.owner = module;
>  	kvm_vm_fops.owner = module;
>  	kvm_vcpu_fops.owner = module;
> +	kvm_plane_fops.owner = module;
>  	kvm_device_fops.owner = module;
>  
>  	kvm_preempt_ops.sched_in = kvm_sched_in;
> -- 
> 2.53.0
>