uverbs: kill last remaining modular get_empty_filp user

Index: linux-2.6/drivers/infiniband/core/uverbs_main.c
===================================================================
@@ -372,7 +372,6 @@ static int ib_uverbs_event_close(struct 
 }
 
 static const struct file_operations uverbs_event_fops = {
-	.owner	 = THIS_MODULE,
 	.read 	 = ib_uverbs_event_read,
 	.poll    = ib_uverbs_event_poll,
 	.release = ib_uverbs_event_close,

@@ -516,26 +515,21 @@ struct file *ib_uverbs_alloc_event_file(
 		goto err;
 	}
 
-	filp = get_empty_filp();
+	/*
+	 * fops_get() can't fail here, because we're coming from a
+	 * system call on a uverbs file, which will already have a
+	 * module reference.
+	 */
+	filp = alloc_file(uverbs_event_mnt, uverbs_event_mnt->mnt_root,
+			  FMODE_READ, &uverbs_event_fops);
 	if (!filp) {
 		ret = -ENFILE;
 		goto err_fd;
 	}
 
+	filp->private_data = ev_file;
 	ev_file->file      = filp;
 
-	/*
-	 * fops_get() can't fail here, because we're coming from a
-	 * system call on a uverbs file, which will already have a
-	 * module reference.
-	 */
-	filp->f_op 	   = fops_get(&uverbs_event_fops);
-	filp->f_path.mnt 	   = mntget(uverbs_event_mnt);
-	filp->f_path.dentry 	   = dget(uverbs_event_mnt->mnt_root);
-	filp->f_mapping    = filp->f_path.dentry->d_inode->i_mapping;
-	filp->f_flags      = O_RDONLY;
-	filp->f_mode       = FMODE_READ;
-	filp->private_data = ev_file;
 
 	return filp;
 

Index: linux-2.6/fs/file_table.c
===================================================================
@@ -80,9 +80,13 @@ int proc_nr_files(ctl_table *table, int 
 }
 #endif
 
-/* Find an unused file structure and return a pointer to it.
+/*
+ * Find an unused file structure and return a pointer to it.
  * Returns NULL, if there are no more free file structures or
  * we run out of memory.
+ *
+ * Note that this is an internal helper.  Please use alloc_file
+ * or anon_inode_getfd instead.
  */
 struct file *get_empty_filp(void)
 {

@@ -135,8 +139,6 @@ fail:
 	return NULL;
 }
 
-EXPORT_SYMBOL(get_empty_filp);
-
 /**
  * alloc_file - allocate and initialize a 'struct file'
  * @mnt: the vfsmount on which the file will reside

index 2332188..733054d 100644
@@ -53,9 +53,9 @@ static struct dentry_operations anon_inodefs_dentry_operations = {
 };
 
 /**
- * anon_inode_getfd - creates a new file instance by hooking it up to an
- *                    anonymous inode, and a dentry that describe the "class"
- *                    of the file
+ * anon_inode_allocfd - creates a new file instance by hooking it up to an
+ *                      anonymous inode, and a dentry that describe the "class"
+ *                      of the file
  *
  * @pfd:     [out]   pointer to the file descriptor
  * @dpinode: [out]   pointer to the inode

@@ -69,10 +69,14 @@ static struct dentry_operations anon_inodefs_dentry_operations = {
  * All the files created with anon_inode_getfd() will share a single inode,
  * hence saving memory and avoiding code duplication for the file/inode/dentry
  * setup.
+ *
+ * Unlike the earlier anon_inode_allocfd() interface, this function does not
+ * call fd_install(), since the caller may have further initialization to do
+ * before it is safe to expose the file to userspace.
  */
-int anon_inode_getfd(int *pfd, struct inode **pinode, struct file **pfile,
-		     const char *name, const struct file_operations *fops,
-		     void *priv)
+int anon_inode_allocfd(int *pfd, struct inode **pinode, struct file **pfile,
+		       const char *name, const struct file_operations *fops,
+		       void *priv)
 {
 	struct qstr this;
 	struct dentry *dentry;

@@ -125,8 +129,6 @@ int anon_inode_getfd(int *pfd, struct inode **pinode, struct file **pfile,
 	file->f_version = 0;
 	file->private_data = priv;
 
-	fd_install(fd, file);
-
 	*pfd = fd;
 	*pinode = anon_inode_inode;
 	*pfile = file;

@@ -138,7 +140,7 @@ err_put_filp:
 	put_filp(file);
 	return error;
 }
-EXPORT_SYMBOL_GPL(anon_inode_getfd);
+EXPORT_SYMBOL_GPL(anon_inode_allocfd);
 
 /*
  * A single inode exists for all anon_inode files. Contrary to pipes,

index a9f130c..76e9cd2 100644
@@ -212,14 +212,12 @@ asmlinkage long sys_eventfd(unsigned int count)
 	init_waitqueue_head(&ctx->wqh);
 	ctx->count = count;
 
-	/*
-	 * When we call this, the initialization must be complete, since
-	 * anon_inode_getfd() will install the fd.
-	 */
-	error = anon_inode_getfd(&fd, &inode, &file, "[eventfd]",
-				 &eventfd_fops, ctx);
-	if (!error)
+	error = anon_inode_allocfd(&fd, &inode, &file, "[eventfd]",
+				   &eventfd_fops, ctx);
+	if (!error) {
+		fd_install(fd, file);
 		return fd;
+	}
 
 	kfree(ctx);
 	return error;

index a415f42..9edf018 100644
@@ -1089,11 +1089,13 @@ asmlinkage long sys_epoll_create(int size)
 	 * Creates all the items needed to setup an eventpoll file. That is,
 	 * a file structure, and inode and a free file descriptor.
 	 */
-	error = anon_inode_getfd(&fd, &inode, &file, "[eventpoll]",
-				 &eventpoll_fops, ep);
+	error = anon_inode_allocfd(&fd, &inode, &file, "[eventpoll]",
+				   &eventpoll_fops, ep);
 	if (error)
 		goto error_free;
 
+	fd_install(fd, file);
+
 	DNPRINTK(3, (KERN_INFO "[%p] eventpoll: sys_epoll_create(%d) = %d\n",
 		     current, size, fd));
 

index cb2b63a..16f71da 100644
@@ -221,14 +221,12 @@ asmlinkage long sys_signalfd(int ufd, sigset_t __user *user_mask, size_t sizemas
 
 		ctx->sigmask = sigmask;
 
-		/*
-		 * When we call this, the initialization must be complete, since
-		 * anon_inode_getfd() will install the fd.
-		 */
-		error = anon_inode_getfd(&ufd, &inode, &file, "[signalfd]",
-					 &signalfd_fops, ctx);
+		error = anon_inode_allocfd(&ufd, &inode, &file, "[signalfd]",
+					   &signalfd_fops, ctx);
 		if (error)
 			goto err_fdalloc;
+
+		fd_install(ufd, file);
 	} else {
 		file = fget(ufd);
 		if (!file)

index 10c80b5..6ce63e1 100644
@@ -199,13 +199,14 @@ asmlinkage long sys_timerfd_create(int clockid, int flags)
 	ctx->clockid = clockid;
 	hrtimer_init(&ctx->tmr, clockid, HRTIMER_MODE_ABS);
 
-	error = anon_inode_getfd(&ufd, &inode, &file, "[timerfd]",
-				 &timerfd_fops, ctx);
+	error = anon_inode_allocfd(&ufd, &inode, &file, "[timerfd]",
+				   &timerfd_fops, ctx);
 	if (error) {
 		kfree(ctx);
 		return error;
 	}
 
+	fd_install(ufd, file);
 	return ufd;
 }
 

index b2e1ba3..35f7ecb 100644
@@ -8,9 +8,9 @@
 #ifndef _LINUX_ANON_INODES_H
 #define _LINUX_ANON_INODES_H
 
-int anon_inode_getfd(int *pfd, struct inode **pinode, struct file **pfile,
-		     const char *name, const struct file_operations *fops,
-		     void *priv);
+int anon_inode_allocfd(int *pfd, struct inode **pinode, struct file **pfile,
+		       const char *name, const struct file_operations *fops,
+		       void *priv);
 
 #endif /* _LINUX_ANON_INODES_H */
 

index 32fbf80..a0bf208 100644
@@ -720,11 +720,12 @@ static int create_vcpu_fd(struct kvm_vcpu *vcpu)
 	struct inode *inode;
 	struct file *file;
 
-	r = anon_inode_getfd(&fd, &inode, &file,
-			     "kvm-vcpu", &kvm_vcpu_fops, vcpu);
+	r = anon_inode_allocfd(&fd, &inode, &file,
+			       "kvm-vcpu", &kvm_vcpu_fops, vcpu);
 	if (r)
 		return r;
 	atomic_inc(&vcpu->kvm->filp->f_count);
+	fd_install(fd, file);
 	return fd;
 }
 

@@ -1021,7 +1022,7 @@ static int kvm_dev_ioctl_create_vm(void)
 	kvm = kvm_create_vm();
 	if (IS_ERR(kvm))
 		return PTR_ERR(kvm);
-	r = anon_inode_getfd(&fd, &inode, &file, "kvm-vm", &kvm_vm_fops, kvm);
+	r = anon_inode_allocfd(&fd, &inode, &file, "kvm-vm", &kvm_vm_fops, kvm);
 	if (r) {
 		kvm_destroy_vm(kvm);
 		return r;

@@ -1029,6 +1030,8 @@ static int kvm_dev_ioctl_create_vm(void)
 
 	kvm->filp = file;
 
+	fd_install(fd, file);
+
 	return fd;
 }
 

index 7c2ac39..7629566 100644
@@ -40,11 +40,10 @@
 #include <linux/init.h>
 #include <linux/device.h>
 #include <linux/err.h>
-#include <linux/fs.h>
 #include <linux/poll.h>
 #include <linux/file.h>
-#include <linux/mount.h>
 #include <linux/cdev.h>
+#include <linux/anon_inodes.h>
 
 #include <asm/uaccess.h>
 

@@ -54,8 +53,6 @@ MODULE_AUTHOR("Roland Dreier");
 MODULE_DESCRIPTION("InfiniBand userspace verbs access");
 MODULE_LICENSE("Dual BSD/GPL");
 
-#define INFINIBANDEVENTFS_MAGIC	0x49426576	/* "IBev" */
-
 enum {
 	IB_UVERBS_MAJOR       = 231,
 	IB_UVERBS_BASE_MINOR  = 192,

@@ -112,8 +109,6 @@ static ssize_t (*uverbs_cmd_table[])(struct ib_uverbs_file *file,
 	[IB_USER_VERBS_CMD_DESTROY_SRQ]   	= ib_uverbs_destroy_srq,
 };
 
-static struct vfsmount *uverbs_event_mnt;
-
 static void ib_uverbs_add_one(struct ib_device *device);
 static void ib_uverbs_remove_one(struct ib_device *device);
 

@@ -495,6 +490,7 @@ struct file *ib_uverbs_alloc_event_file(struct ib_uverbs_file *uverbs_file,
 					int is_async, int *fd)
 {
 	struct ib_uverbs_event_file *ev_file;
+	struct inode *inode;
 	struct file *filp;
 	int ret;
 

@@ -510,37 +506,19 @@ struct file *ib_uverbs_alloc_event_file(struct ib_uverbs_file *uverbs_file,
 	ev_file->async_queue = NULL;
 	ev_file->is_async    = is_async;
 
-	*fd = get_unused_fd();
-	if (*fd < 0) {
-		ret = *fd;
-		goto err;
-	}
-
-	filp = get_empty_filp();
-	if (!filp) {
-		ret = -ENFILE;
-		goto err_fd;
-	}
-
-	ev_file->file      = filp;
-
 	/*
 	 * fops_get() can't fail here, because we're coming from a
 	 * system call on a uverbs file, which will already have a
 	 * module reference.
 	 */
-	filp->f_op 	   = fops_get(&uverbs_event_fops);
-	filp->f_path.mnt 	   = mntget(uverbs_event_mnt);
-	filp->f_path.dentry 	   = dget(uverbs_event_mnt->mnt_root);
-	filp->f_mapping    = filp->f_path.dentry->d_inode->i_mapping;
-	filp->f_flags      = O_RDONLY;
-	filp->f_mode       = FMODE_READ;
-	filp->private_data = ev_file;
+	ret = anon_inode_allocfd(fd, &inode, &filp, "[uverbs-event]",
+				 fops_get(&uverbs_event_fops), ev_file);
+	if (ret)
+		goto err;
 
-	return filp;
+	ev_file->file = filp;
 
-err_fd:
-	put_unused_fd(*fd);
+	return filp;
 
 err:
 	kfree(ev_file);

@@ -817,21 +795,6 @@ static void ib_uverbs_remove_one(struct ib_device *device)
 	kfree(uverbs_dev);
 }
 
-static int uverbs_event_get_sb(struct file_system_type *fs_type, int flags,
-			       const char *dev_name, void *data,
-			       struct vfsmount *mnt)
-{
-	return get_sb_pseudo(fs_type, "infinibandevent:", NULL,
-			     INFINIBANDEVENTFS_MAGIC, mnt);
-}
-
-static struct file_system_type uverbs_event_fs = {
-	/* No owner field so module can be unloaded */
-	.name    = "infinibandeventfs",
-	.get_sb  = uverbs_event_get_sb,
-	.kill_sb = kill_litter_super
-};
-
 static int __init ib_uverbs_init(void)
 {
 	int ret;

@@ -858,33 +821,14 @@ static int __init ib_uverbs_init(void)
 		goto out_class;
 	}
 
-	ret = register_filesystem(&uverbs_event_fs);
-	if (ret) {
-		printk(KERN_ERR "user_verbs: couldn't register infinibandeventfs\n");
-		goto out_class;
-	}
-
-	uverbs_event_mnt = kern_mount(&uverbs_event_fs);
-	if (IS_ERR(uverbs_event_mnt)) {
-		ret = PTR_ERR(uverbs_event_mnt);
-		printk(KERN_ERR "user_verbs: couldn't mount infinibandeventfs\n");
-		goto out_fs;
-	}
-
 	ret = ib_register_client(&uverbs_client);
 	if (ret) {
 		printk(KERN_ERR "user_verbs: couldn't register client\n");
-		goto out_mnt;
+		goto out_class;
 	}
 
 	return 0;
 
-out_mnt:
-	mntput(uverbs_event_mnt);
-
-out_fs:
-	unregister_filesystem(&uverbs_event_fs);
-
 out_class:
 	class_destroy(uverbs_class);
 

@@ -898,8 +842,6 @@ out:
 static void __exit ib_uverbs_cleanup(void)
 {
 	ib_unregister_client(&uverbs_client);
-	mntput(uverbs_event_mnt);
-	unregister_filesystem(&uverbs_event_fs);
 	class_destroy(uverbs_class);
 	unregister_chrdev_region(IB_UVERBS_BASE_DEV, IB_UVERBS_MAX_DEVICES);
 	idr_destroy(&ib_uverbs_pd_idr);

Index: linux-2.6/include/linux/kvm_host.h
===================================================================
@@ -113,7 +113,7 @@ struct kvm {
 					KVM_PRIVATE_MEM_SLOTS];
 	struct kvm_vcpu *vcpus[KVM_MAX_VCPUS];
 	struct list_head vm_list;
-	struct file *filp;
+	int refcount;
 	struct kvm_io_bus mmio_bus;
 	struct kvm_io_bus pio_bus;
 	struct kvm_vm_stat stat;

Index: linux-2.6/virt/kvm/kvm_main.c
===================================================================
@@ -169,6 +169,8 @@ static struct kvm *kvm_create_vm(void)
 	kvm_io_bus_init(&kvm->pio_bus);
 	mutex_init(&kvm->lock);
 	kvm_io_bus_init(&kvm->mmio_bus);
+	kvm->refcount = 1;
+
 	spin_lock(&kvm_lock);
 	list_add(&kvm->vm_list, &vm_list);
 	spin_unlock(&kvm_lock);

@@ -201,11 +203,16 @@ void kvm_free_physmem(struct kvm *kvm)
 		kvm_free_physmem_slot(&kvm->memslots[i], NULL);
 }
 
-static void kvm_destroy_vm(struct kvm *kvm)
+static void kvm_put_vm(struct kvm *kvm)
 {
 	struct mm_struct *mm = kvm->mm;
 
 	spin_lock(&kvm_lock);
+	if (--kvm->refcount) {
+		spin_lock(&kvm_lock);
+		return;
+	}
+
 	list_del(&kvm->vm_list);
 	spin_unlock(&kvm_lock);
 	kvm_io_bus_destroy(&kvm->pio_bus);

@@ -216,9 +223,7 @@ static void kvm_destroy_vm(struct kvm *k
 
 static int kvm_vm_release(struct inode *inode, struct file *filp)
 {
-	struct kvm *kvm = filp->private_data;
-
-	kvm_destroy_vm(kvm);
+	kvm_put_vm(filp->private_data);
 	return 0;
 }
 

@@ -700,7 +705,7 @@ static int kvm_vcpu_release(struct inode
 {
 	struct kvm_vcpu *vcpu = filp->private_data;
 
-	fput(vcpu->kvm->filp);
+	kvm_put_vm(vcpu->kvm);
 	return 0;
 }
 

@@ -724,7 +729,16 @@ static int create_vcpu_fd(struct kvm_vcp
 			     "kvm-vcpu", &kvm_vcpu_fops, vcpu);
 	if (r)
 		return r;
-	atomic_inc(&vcpu->kvm->filp->f_count);
+
+	/*
+	 * It is guaranteed that the refcount is non-zero here because
+	 * this function is only called as ioctl method on an open
+	 * file that has a reference to it.
+	 */
+	spin_lock(&kvm_lock);
+	vcpu->kvm->refcount++;
+	spin_unlock(&kvm_lock);
+
 	return fd;
 }
 

@@ -1023,12 +1037,10 @@ static int kvm_dev_ioctl_create_vm(void)
 		return PTR_ERR(kvm);
 	r = anon_inode_getfd(&fd, &inode, &file, "kvm-vm", &kvm_vm_fops, kvm);
 	if (r) {
-		kvm_destroy_vm(kvm);
+		kvm_put_vm(kvm);
 		return r;
 	}
 
-	kvm->filp = file;
-
 	return fd;
 }