[PATCH v3 0/8] PCI/KVM/VFIO: MSI address passthrough for Qualcomm WiFi devices

[Jose Ignacio Tornos Martinez <jtornosm@redhat.com>]

This series enables Qualcomm ath11k/ath12k WiFi devices to work in VM
passthrough scenarios, addressing a long-standing issue where these
devices fail to initialize when passed through to VMs via VFIO.

Qualcomm ath11k/ath12k WiFi devices have been broken in VM passthrough
since they were introduced. These devices have embedded firmware that
programs MSI target addresses directly into device BAR registers,
bypassing the standard PCI config MSI path. The driver extracts the
addr/data from the MSI descriptor and programs the firmware's private
registers. In a VM, the driver only sees the guest's virtual APIC
address instead of the host's physical IRTE address. The firmware
programs the guest address into the BAR registers, and the resulting
MSI writes hit a stale or invalid IRTE in the host's interrupt
remapping table, causing DMAR faults:

  DMAR: DRHD: ... INTR-REMAP
  DMAR: [INTR-REMAP] ... Present field in the IRTE entry is clear

Standard VFIO MSI virtualization handles PCI config space MSI
correctly (MHI interrupts work fine), but has no visibility into
firmware-managed BAR-level MSI programming.

Multiple attempts have been made to solve this over the past 2 years:

March 2024: Workaround using module parameters [1]
  - Required manually copying MSI values from host to VM
  - Rejected by Johannes Berg as too manual, suggested VMM solution

August 2024: QEMU + kernel solution by Alex Williamson [2]
  - Kernel disables MSI virtualization, QEMU intercepts config writes
  - Uses brute force pattern matching to infer MSI data writes
  - Stuck as RFC - no progress in 14+ months

No action from Qualcomm: Despite multiple reports [4], no vendor
solution.

The PCI reset support for these devices has already landed in mainline
(commit f8522a518e59 "PCI: Add device-specific reset for Qualcomm
WCN6855/WCN7850 WLAN") [3], solving the device reset path for VFIO
passthrough. This MSI series is the remaining piece, with both in
place, these Qualcomm WiFi devices would be fully operational in VMs
for the first time.

v1/v2 explored passing the host MSI address through VFIO extended
config space. Jason Gunthorpe pointed out [5] that a guest-initiated
approach via KVM paravirtualization would be cleaner, avoid VFIO
internal coupling, and generalize better to other devices with
similar firmware behavior. The proposal here is a new guest module
that tries to address this by creating a custom MSI domain that
provides the physical host values instead.

v3 implements this as a 3-piece kernel-only solution:

  1. Host side (KVM + VFIO): A new KVM hypercall
     (KVM_HC_PCI_MSI_ALLOC) dispatches to a VFIO handler that reads
     the host's physical MSI address/data for the passthrough device.
     Connected via function pointer in struct kvm to avoid hard
     subsystem dependencies.

  2. Guest side (PCI controller): A new MSI IRQ domain module
     (pci-kvm-msi, taking pci-hyperv.c as a reference as Jason
     suggested) that intercepts MSI composition for matched devices.
     In order to sync host initialization with the guest driver, it
     provides kvm_pci_msi_wait_ready() to poll the hypercall until the
     host MSI is configured, and kvm_pci_msi_get_address() to read
     cached values.

  3. Driver changes (ath11k, ath12k): Guarded with
     IS_ENABLED(CONFIG_PCI_KVM_MSI_DOMAIN). Call wait_ready after
     msi_enable in power_up, then use get_address where needed.
     Zero overhead on baremetal (kvm_para_available() returns false).

The solution requires no QEMU changes. Tested with WCN6855 (ath11k),
WCN7850 (ath12k), and QCN9274 (ath12k) on host with KVM/VFIO
passthrough, all three create fully working WiFi interfaces in
the guest VM.

Patches:
  1-3: Core infrastructure (VFIO helpers, KVM handler, guest module)
  4-5: ath11k support (link retry + KVM MSI integration)
  6-7: ath12k support (link retry + KVM MSI integration)
    8: QCN9274 device support (reset quirks + KVM MSI ID)

[1] https://lore.kernel.org/all/20240322104912.94811-1-jtornosm@redhat.com/
[2] https://lore.kernel.org/kvm/20240812170014.1583783-1-alex.williamson@redhat.com/
[3] https://lore.kernel.org/all/20261005105436.83962-1-jtornosm@redhat.com/
[4] https://lore.kernel.org/all/fc6bd06f-d52b-4dee-ab1b-4bb845cc0b95@quicinc.com/
[5] https://lore.kernel.org/all/20261014150047.GO14213@ziepe.ca/

---
v3: KVM paravirtualization approach based on Jason Gunthorpe feedback.
    New hypercall + guest MSI domain module replaces VFIO variant
    driver.
    Added QCN9274 support.
v2: https://lore.kernel.org/all/20261014142606.418972-1-jtornosm@redhat.com/
v1: https://lore.kernel.org/all/20260930140833.576941-1-jtornosm@redhat.com/

Jose Ignacio Tornos Martinez (8):
  vfio: add helper to find PCI device by vendor/device ID
  KVM: add PCI MSI hypercall for VFIO passthrough
  PCI: add KVM MSI domain guest module
  ath11k: add PCIe link recovery retry
  ath11k: use KVM MSI domain for VM passthrough
  ath12k: add PCIe link recovery retry
  ath12k: use KVM MSI domain for VM passthrough
  PCI: add QCN9274 to reset quirks and KVM MSI domain