[PULL 0/2] vfio queue

[PULL 0/2] vfio queue

[Cédric Le Goater]

The following changes since commit b428fe036233cbd15d37e3c027ab6ca4d3661a80:

  Merge tag 'pull-target-arm-20260731' of https://gitlab.com/pm215/qemu into staging (2026-07-31 16:19:04 -0400)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-vfio-20260802

for you to fetch changes up to 338d81b22b4dc6c45299da1114925a4b086d6e00:

  vfio/pci: Guard accel_irqchip_begin_route_changes() calls (2026-08-02 15:53:05 +0200)

----------------------------------------------------------------
vfio queue:

* Fix accel_irqchip_begin_route_changes() abort under TCG
* Fix SIGSEGV in vfio_connect_kvm_msi_virq() during loadvm

----------------------------------------------------------------
Cédric Le Goater (1):
      vfio/pci: Guard accel_irqchip_begin_route_changes() calls

Tycho Andersen (AMD) (1):
      hw/vfio: Fix liveness check in vfio_connect_kvm_msi_virq()

 hw/vfio/pci.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

[PULL 1/2] hw/vfio: Fix liveness check in vfio_connect_kvm_msi_virq()

[Cédric Le Goater]

From: "Tycho Andersen (AMD)" <tycho@kernel.org>

While working on savevm/loadvm for a new vfio device, I encountered the
crash below. Since vfio_connect_kvm_msi_virq() didn't check the ->use flag
for the vector, it would pass an unused vector down to
vfio_cpr_load_vector_fd() which would crash.

Fix this by checking the ->use flag along with the virq number to detect
whether a vector is valid or not.

Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
0x0000555555a891ef in vfio_cpr_load_vector_fd (vdev=vdev@entry=0x0,
    name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1) at ../hw/vfio/cpr.c:44
44	    g_autofree char *fdname = STRDUP_VECTOR_FD_NAME(vdev, name);
(gdb) bt
#0  0x0000555555a891ef in vfio_cpr_load_vector_fd
    (vdev=vdev@entry=0x0, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1)
    at ../hw/vfio/cpr.c:44
#1  0x0000555555ce64a1 in vfio_notifier_init
    (vdev=0x0, e=e@entry=0x5555586971b4, name=name@entry=0x555555eeb27e "kvm_interrupt", nr=nr@entry=1, errp=errp@entry=0x0) at ../hw/vfio/pci.c:79
#2  0x0000555555ce721e in vfio_connect_kvm_msi_virq (vector=0x5555586971a8, nr=nr@entry=1)
    at ../hw/vfio/pci.c:601
#3  0x0000555555cea5a5 in vfio_connect_kvm_msi_virq (nr=1, vector=<optimized out>)
    at ../hw/vfio/pci.c:597
#4  vfio_pci_commit_kvm_msi_virq_batch (vdev=0x55555906de40) at ../hw/vfio/pci.c:822
#5  0x0000555555cea9f2 in vfio_msix_enable (vdev=vdev@entry=0x55555906de40) at ../hw/vfio/pci.c:850
#6  0x0000555555ceb152 in vfio_pci_load_config (vbasedev=0x55555906e900, f=<optimized out>)
    at ../hw/vfio/pci.c:3088
#7  0x0000555555a8c765 in vfio_load_device_config_state (f=0x5555574a43d0, opaque=0x55555906e900)
    at ../hw/vfio/migration.c:278
#8  0x0000555555b3a522 in vmstate_load
    (f=f@entry=0x5555574a43d0, se=se@entry=0x5555591edd40, errp=errp@entry=0x7fffffffe130)
    at ../migration/savevm.c:971
#9  0x0000555555b3ab1a in qemu_loadvm_section_start_full
    (f=f@entry=0x5555574a43d0, type=type@entry=4 '\004', errp=errp@entry=0x7fffffffe130)
    at ../migration/savevm.c:2654
#10 0x0000555555b3e1ee in qemu_loadvm_state_main
    (f=f@entry=0x5555574a43d0, mis=mis@entry=0x5555571de5a0, errp=0x7fffffffe130,
    errp@entry=0x555557157c10 <error_fatal>) at ../migration/savevm.c:2973
#11 0x0000555555b3f7b7 in qemu_loadvm_state
    (f=f@entry=0x5555574a43d0, errp=errp@entry=0x555557157c10 <error_fatal>)
    at ../migration/savevm.c:3058
#12 0x0000555555b40863 in load_snapshot
    (name=0x7fffffffecc9 "foo", vmstate=vmstate@entry=0x0, has_devices=has_devices@entry=false, devices=devices@entry=0x0, errp=errp@entry=0x555557157c10 <error_fatal>) at ../migration/savevm.c:3452
#13 0x0000555555adc211 in qmp_x_exit_preconfig (errp=0x555557157c10 <error_fatal>) at ../system/vl.c:2817
#14 qmp_x_exit_preconfig (errp=0x555557157c10 <error_fatal>) at ../system/vl.c:2802
#15 0x0000555555adf8ed in qemu_init (argc=<optimized out>, argv=<optimized out>) at ../system/vl.c:3849
#16 0x00005555558903fd in main (argc=<optimized out>, argv=<optimized out>) at ../system/main.c:71

Fixes: 30edcb4d4e7a ("vfio-pci: preserve MSI")
Signed-off-by: Tycho Andersen (AMD) <tycho@kernel.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260727150038.2684512-1-tycho@kernel.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 380dd8c15f8d5bb98b725075978eef2e4e1e6c2d..b5280c3d2a366cd7cff4069936858ac651afeb6d 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -589,7 +589,7 @@ static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector, int nr)
 {
     const char *name = "kvm_interrupt";
 
-    if (vector->virq < 0) {
+    if (!vector->use || vector->virq < 0) {
         return;
     }
 
-- 
2.55.0

[PULL 2/2] vfio/pci: Guard accel_irqchip_begin_route_changes() calls

[Cédric Le Goater]

Since commit 49b2dcbd2422 ("accel/accel-irq: add generic
begin_route_changes"), accel_irqchip_begin_route_changes() aborts when
no accelerator irqchip is available. This causes a fatal error when
running VFIO passthrough devices under TCG emulation:

  qemu-system-aarch64: can't initiate route change, no accel irqchip available

The previous kvm_irqchip_begin_route_changes() was a simple inline
that did not have a fatal path. The VFIO code already handles the
absence of KVM MSI routing gracefully by falling back to userspace
handling, but the new generic function aborts before that fallback
can take effect.

Guard the call sites in hw/vfio/pci.c with
accel_msi_via_irqfd_enabled() so that route changes are only
initiated when an accelerator irqchip is actually present.

Fixes: 49b2dcbd2422 ("accel/accel-irq: add generic begin_route_changes")
Cc: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/qemu-devel/20260721105026.3932297-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index b5280c3d2a366cd7cff4069936858ac651afeb6d..428ab2f06983ba9ecb306975a4aca7f6efe1b855 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -699,7 +699,7 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
         if (msg) {
             if (vdev->defer_kvm_irq_routing) {
                 vfio_pci_add_kvm_msi_virq(vdev, vector, nr, true);
-            } else {
+            } else if (accel_msi_via_irqfd_enabled()) {
                 vfio_route_change = accel_irqchip_begin_route_changes();
                 vfio_pci_add_kvm_msi_virq(vdev, vector, nr, true);
                 accel_irqchip_commit_route_changes(&vfio_route_change);
@@ -801,7 +801,9 @@ void vfio_pci_prepare_kvm_msi_virq_batch(VFIOPCIDevice *vdev)
 {
     assert(!vdev->defer_kvm_irq_routing);
     vdev->defer_kvm_irq_routing = true;
-    vfio_route_change = accel_irqchip_begin_route_changes();
+    if (accel_msi_via_irqfd_enabled()) {
+        vfio_route_change = accel_irqchip_begin_route_changes();
+    }
 }
 
 void vfio_pci_commit_kvm_msi_virq_batch(VFIOPCIDevice *vdev)
-- 
2.55.0

Re: [PULL 0/2] vfio queue

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

[PULL 0/2] vfio queue

[Cédric Le Goater]

The following changes since commit 9a7b0a8618b1293d589a631183e80791ad7bf552:

  Merge tag 'pull-aspeed-20241104' of https://github.com/legoater/qemu into staging (2024-11-05 10:06:08 +0000)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-vfio-20241105

for you to fetch changes up to 89b516152777a8b54b117d90690ed9be62ba1177:

  vfio/migration: Add vfio_save_block_precopy_empty_hit trace event (2024-11-05 15:51:14 +0100)

----------------------------------------------------------------
vfio queue:

* Added migration trace events

----------------------------------------------------------------
Maciej S. Szmigiero (2):
      vfio/migration: Add save_{iterate, complete_precopy}_start trace events
      vfio/migration: Add vfio_save_block_precopy_empty_hit trace event

 include/hw/vfio/vfio-common.h |  3 +++
 hw/vfio/migration.c           | 17 +++++++++++++++++
 hw/vfio/trace-events          |  3 +++
 3 files changed, 23 insertions(+)

Re: [PULL 0/2] vfio queue

[Peter Maydell]

On Tue, 5 Nov 2024 at 16:59, Cédric Le Goater <clg@redhat.com> wrote:
>
> The following changes since commit 9a7b0a8618b1293d589a631183e80791ad7bf552:
>
>   Merge tag 'pull-aspeed-20241104' of https://github.com/legoater/qemu into staging (2024-11-05 10:06:08 +0000)
>
> are available in the Git repository at:
>
>   https://github.com/legoater/qemu/ tags/pull-vfio-20241105
>
> for you to fetch changes up to 89b516152777a8b54b117d90690ed9be62ba1177:
>
>   vfio/migration: Add vfio_save_block_precopy_empty_hit trace event (2024-11-05 15:51:14 +0100)
>
> ----------------------------------------------------------------
> vfio queue:
>
> * Added migration trace events
>


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/9.2
for any user-visible changes.

-- PMM

[PULL 0/2] vfio queue

[Cédric Le Goater]

The following changes since commit cbccded4a2b5d685a426a437e25f67d3a375b292:

  Merge tag 'pull-riscv-to-apply-20240308-1' of https://github.com/alistair23/qemu into staging (2024-03-08 11:47:01 +0000)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-vfio-20240310

for you to fetch changes up to 0cb51c183a91e882b10ead4ddf2321296a537c47:

  vfio: allow cpr-reboot migration if suspended (2024-03-08 22:10:13 +0100)

----------------------------------------------------------------
vfio queue:

* Allow cpr-reboot for vfio

----------------------------------------------------------------
Steve Sistare (2):
      vfio: register container for cpr
      vfio: allow cpr-reboot migration if suspended

 include/hw/vfio/vfio-common.h         |  3 +++
 include/hw/vfio/vfio-container-base.h |  1 +
 hw/vfio/common.c                      |  2 +-
 hw/vfio/container.c                   | 11 +++++++++-
 hw/vfio/cpr.c                         | 39 +++++++++++++++++++++++++++++++++++
 hw/vfio/iommufd.c                     |  6 ++++++
 hw/vfio/migration.c                   |  2 +-
 hw/vfio/meson.build                   |  1 +
 8 files changed, 62 insertions(+), 3 deletions(-)
 create mode 100644 hw/vfio/cpr.c

Re: [PULL 0/2] vfio queue

[Peter Maydell]

On Sun, 10 Mar 2024 at 19:20, Cédric Le Goater <clg@redhat.com> wrote:
>
> The following changes since commit cbccded4a2b5d685a426a437e25f67d3a375b292:
>
>   Merge tag 'pull-riscv-to-apply-20240308-1' of https://github.com/alistair23/qemu into staging (2024-03-08 11:47:01 +0000)
>
> are available in the Git repository at:
>
>   https://github.com/legoater/qemu/ tags/pull-vfio-20240310
>
> for you to fetch changes up to 0cb51c183a91e882b10ead4ddf2321296a537c47:
>
>   vfio: allow cpr-reboot migration if suspended (2024-03-08 22:10:13 +0100)
>
> ----------------------------------------------------------------
> vfio queue:
>
> * Allow cpr-reboot for vfio
>
> ----------------------------------------------------------------


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/9.0
for any user-visible changes.

-- PMM

[PULL 0/2] vfio queue

[Cédric Le Goater]

The following changes since commit 7a1dc45af581d2b643cdbf33c01fd96271616fbd:

  Merge tag 'pull-target-arm-20240126' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2024-01-26 18:16:35 +0000)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-vfio-20240129

for you to fetch changes up to d2b668fca5652760b435ce812a743bba03d2f316:

  vfio/pci: Clear MSI-X IRQ index always (2024-01-29 08:26:25 +0100)

----------------------------------------------------------------
vfio queue:

* Array type cleanup
* Fix for IRQ enablement

----------------------------------------------------------------
Cédric Le Goater (1):
      vfio/pci: Clear MSI-X IRQ index always

Paolo Bonzini (1):
      vfio: use matching sizeof type

 hw/vfio/common.c | 2 +-
 hw/vfio/pci.c    | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

Re: [PULL 0/2] vfio queue

[Peter Maydell]

On Mon, 29 Jan 2024 at 08:42, Cédric Le Goater <clg@redhat.com> wrote:
>
> The following changes since commit 7a1dc45af581d2b643cdbf33c01fd96271616fbd:
>
>   Merge tag 'pull-target-arm-20240126' of https://git.linaro.org/people/pmaydell/qemu-arm into staging (2024-01-26 18:16:35 +0000)
>
> are available in the Git repository at:
>
>   https://github.com/legoater/qemu/ tags/pull-vfio-20240129
>
> for you to fetch changes up to d2b668fca5652760b435ce812a743bba03d2f316:
>
>   vfio/pci: Clear MSI-X IRQ index always (2024-01-29 08:26:25 +0100)
>
> ----------------------------------------------------------------
> vfio queue:
>
> * Array type cleanup
> * Fix for IRQ enablement
>
> ----------------------------------------------------------------


Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/9.0
for any user-visible changes.

-- PMM

[PULL 0/2] vfio queue

[Cédric Le Goater]

The following changes since commit aa33508196f4e2da04625bee36e1f7be5b9267e7:

  Merge tag 'mem-2023-05-23' of https://github.com/davidhildenbrand/qemu into staging (2023-05-23 10:57:25 -0700)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-vfio-20230524

for you to fetch changes up to dbdea0dbfe2cef9ef6c752e9077e4fc98724194c:

  util/vfio-helpers: Use g_file_read_link() (2023-05-24 09:21:22 +0200)

----------------------------------------------------------------
vfio queue:

* Fix for a memory corruption due to an extra free
* Fix for a compile breakage

----------------------------------------------------------------
Akihiko Odaki (1):
      util/vfio-helpers: Use g_file_read_link()

Zhenzhong Duan (1):
      vfio/pci: Fix a use-after-free issue

 hw/vfio/pci.c       | 2 +-
 util/vfio-helpers.c | 8 +++++---
 2 files changed, 6 insertions(+), 4 deletions(-)

Re: [PULL 0/2] vfio queue

[Richard Henderson]

On 5/24/23 01:47, Cédric Le Goater wrote:
> The following changes since commit aa33508196f4e2da04625bee36e1f7be5b9267e7:
> 
>    Merge tag 'mem-2023-05-23' ofhttps://github.com/davidhildenbrand/qemu  into staging (2023-05-23 10:57:25 -0700)
> 
> are available in the Git repository at:
> 
>    https://github.com/legoater/qemu/  tags/pull-vfio-20230524
> 
> for you to fetch changes up to dbdea0dbfe2cef9ef6c752e9077e4fc98724194c:
> 
>    util/vfio-helpers: Use g_file_read_link() (2023-05-24 09:21:22 +0200)
> 
> ----------------------------------------------------------------
> vfio queue:
> 
> * Fix for a memory corruption due to an extra free
> * Fix for a compile breakage

Applied, thanks.  Please update https://wiki.qemu.org/ChangeLog/8.1 as appropriate.


r~