[PULL 00/12] vfio queue

[PULL 00/12] vfio queue

[Cédric Le Goater]

The following changes since commit 3c0b42c68f98fb276fa248012642be8cbf2cab70:

  Merge tag 'pull-request-2025-10-21' of https://gitlab.com/thuth/qemu into staging (2025-10-21 08:59:35 -0500)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-vfio-20251022

for you to fetch changes up to ecbe424a63c9f860a901d6a4a75724b046abd796:

  vfio: only check region info cache for initial regions (2025-10-22 08:12:52 +0200)

----------------------------------------------------------------
vfio queue:

* Fix CPR transfer
* Add support for VFIO_DMA_UNMAP_FLAG_ALL
* Fix vfio-user documentation
* Update Alex Williamson's email address
* Fix for vfio-region cache for the vGPU use case

----------------------------------------------------------------
Alex Williamson (1):
      MAINTAINERS: Update Alex Williamson's email address

John Levon (3):
      docs/system/devices/vfio-user: fix formatting
      vfio: rename field to "num_initial_regions"
      vfio: only check region info cache for initial regions

Zhenzhong Duan (8):
      vfio/container: Remap only populated parts in a section
      vfio/cpr-legacy: drop an erroneous assert
      vfio/iommufd: Set cpr.ioas_id on source side for CPR transfer
      vfio/iommufd: Restore vbasedev's reference to hwpt after CPR transfer
      accel/kvm: Fix an erroneous check on coalesced_mmio_ring
      vfio/container: Support unmap all in one ioctl()
      vfio/iommufd: Support unmap all in one ioctl()
      vfio/listener: Add an assertion for unmap_all

 MAINTAINERS                             |  4 ++--
 docs/system/devices/vfio-user.rst       |  2 +-
 include/hw/vfio/vfio-container-legacy.h |  1 +
 include/hw/vfio/vfio-cpr.h              |  2 +-
 include/hw/vfio/vfio-device.h           |  2 +-
 accel/kvm/kvm-all.c                     |  3 ++-
 hw/vfio-user/device.c                   |  2 +-
 hw/vfio/ccw.c                           |  4 ++--
 hw/vfio/container-legacy.c              | 38 ++++++++++++++++++--------------
 hw/vfio/cpr-legacy.c                    | 22 +++++++++++++------
 hw/vfio/device.c                        | 39 +++++++++++++++++++++------------
 hw/vfio/iommufd.c                       | 26 ++++++----------------
 hw/vfio/listener.c                      |  5 +++--
 hw/vfio/pci.c                           |  4 ++--
 .mailmap                                |  1 +
 15 files changed, 86 insertions(+), 69 deletions(-)

[PULL 01/12] vfio/container: Remap only populated parts in a section

[Cédric Le Goater]

From: Zhenzhong Duan <zhenzhong.duan@intel.com>

If there are multiple containers and unmap-all fails for some of them, we
need to remap vaddr for the other containers for which unmap-all succeeded.
When ram discard is enabled, we should only remap populated parts in a
section instead of the whole section.

Fixes: eba1f657cbb1 ("vfio/container: recover from unmap-all-vaddr failure")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steven Sistare <steven.sistare@oracle.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-2-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-cpr.h |  2 +-
 hw/vfio/cpr-legacy.c       | 20 +++++++++++++++-----
 hw/vfio/listener.c         |  4 ++--
 3 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 81f4e24e229ef35f5b14582ce6e58415e0ebf3df..4606da500a7969b6519b054280464608ae624bb9 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -68,7 +68,7 @@ bool vfio_cpr_container_match(struct VFIOLegacyContainer *container,
 void vfio_cpr_giommu_remap(struct VFIOContainer *bcontainer,
                            MemoryRegionSection *section);
 
-bool vfio_cpr_ram_discard_register_listener(
+bool vfio_cpr_ram_discard_replay_populated(
     struct VFIOContainer *bcontainer, MemoryRegionSection *section);
 
 void vfio_cpr_save_vector_fd(struct VFIOPCIDevice *vdev, const char *name,
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 80af7469d06b2f15a705a97c4b5ddd25a8044115..b4581e8f859323c1c45560f7d345b34f1ed9bd85 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -228,22 +228,32 @@ void vfio_cpr_giommu_remap(VFIOContainer *bcontainer,
     memory_region_iommu_replay(giommu->iommu_mr, &giommu->n);
 }
 
+static int vfio_cpr_rdm_remap(MemoryRegionSection *section, void *opaque)
+{
+    RamDiscardListener *rdl = opaque;
+
+    return rdl->notify_populate(rdl, section);
+}
+
 /*
  * In old QEMU, VFIO_DMA_UNMAP_FLAG_VADDR may fail on some mapping after
  * succeeding for others, so the latter have lost their vaddr.  Call this
- * to restore vaddr for a section with a RamDiscardManager.
+ * to restore vaddr for populated parts in a section with a RamDiscardManager.
  *
- * The ram discard listener already exists.  Call its populate function
+ * The ram discard listener already exists.  Call its replay_populated function
  * directly, which calls vfio_legacy_cpr_dma_map.
  */
-bool vfio_cpr_ram_discard_register_listener(VFIOContainer *bcontainer,
-                                            MemoryRegionSection *section)
+bool vfio_cpr_ram_discard_replay_populated(VFIOContainer *bcontainer,
+                                           MemoryRegionSection *section)
 {
+    RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
     VFIORamDiscardListener *vrdl =
         vfio_find_ram_discard_listener(bcontainer, section);
 
     g_assert(vrdl);
-    return vrdl->listener.notify_populate(&vrdl->listener, section) == 0;
+    return ram_discard_manager_replay_populated(rdm, section,
+                                                vfio_cpr_rdm_remap,
+                                                &vrdl->listener) == 0;
 }
 
 int vfio_cpr_group_get_device_fd(int d, const char *name)
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index c6bb58f5209a4c8eb67deac41a89c317fa391447..1b6e5065a3267ab08d2d3fea3c5b4965a80947e8 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -577,8 +577,8 @@ void vfio_container_region_add(VFIOContainer *bcontainer,
             if (!vfio_ram_discard_register_listener(bcontainer, section, &err)) {
                 goto fail;
             }
-        } else if (!vfio_cpr_ram_discard_register_listener(bcontainer,
-                                                           section)) {
+        } else if (!vfio_cpr_ram_discard_replay_populated(bcontainer,
+                                                          section)) {
             error_setg(&err,
                        "vfio_cpr_ram_discard_register_listener for %s failed",
                        memory_region_name(section->mr));
-- 
2.51.0

[PULL 02/12] vfio/cpr-legacy: drop an erroneous assert

[Cédric Le Goater]

From: Zhenzhong Duan <zhenzhong.duan@intel.com>

vfio_legacy_cpr_dma_map() is not only used in post_load on destination
but also error recovery path on source side. Assert it for destination
is wrong.

Fixes: 7e9f21411302 ("vfio/container: restore DMA vaddr")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-3-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-legacy.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index b4581e8f859323c1c45560f7d345b34f1ed9bd85..7184c9399128e71a658da51ba10c2440f1e54d92 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -52,8 +52,6 @@ static int vfio_legacy_cpr_dma_map(const VFIOContainer *bcontainer,
         .size = size,
     };
 
-    g_assert(cpr_is_incoming());
-
     if (ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map)) {
         return -errno;
     }
-- 
2.51.0

[PULL 03/12] vfio/iommufd: Set cpr.ioas_id on source side for CPR transfer

[Cédric Le Goater]

From: Zhenzhong Duan <zhenzhong.duan@intel.com>

On source side, if there are more than one VFIO devices and they
attach to same container, only the first device sets cpr.ioas_id,
the others are bypassed. We should set it for each device, or
else only first device works.

Fixes: 4296ee07455e ("vfio/iommufd: reconstruct device")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-4-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 68470d552eccc67afbf757de192ba53431e4840b..63a16d4dc1795d359ff298bcddda292d1e03028e 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -602,7 +602,6 @@ skip_ioas_alloc:
     container->be = vbasedev->iommufd;
     container->ioas_id = ioas_id;
     QLIST_INIT(&container->hwpt_list);
-    vbasedev->cpr.ioas_id = ioas_id;
 
     bcontainer = VFIO_IOMMU(container);
     vfio_address_space_insert(space, bcontainer);
@@ -636,6 +635,8 @@ skip_ioas_alloc:
     bcontainer->initialized = true;
 
 found_container:
+    vbasedev->cpr.ioas_id = container->ioas_id;
+
     ret = ioctl(devfd, VFIO_DEVICE_GET_INFO, &dev_info);
     if (ret) {
         error_setg_errno(errp, errno, "error getting device info");
-- 
2.51.0

[PULL 04/12] vfio/iommufd: Restore vbasedev's reference to hwpt after CPR transfer

[Cédric Le Goater]

From: Zhenzhong Duan <zhenzhong.duan@intel.com>

After CPR transfer, if there are more than one VFIO devices, device is
not added to hwpt->device_list and its reference to hwpt isn't restored
on destination. We still need to call iommufd_cdev_attach_container() to
restore it after a matching container is found, or else SIGSEV triggers.

Fixes: 4296ee07455e ("vfio/iommufd: reconstruct device")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-5-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 63a16d4dc1795d359ff298bcddda292d1e03028e..24a99efa87f4df268d0df7198f26bba37976874b 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -560,10 +560,9 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
             continue;
         }
 
-        if (!cpr_is_incoming()) {
+        if (!cpr_is_incoming() ||
+            (vbasedev->cpr.ioas_id == container->ioas_id)) {
             res = iommufd_cdev_attach_container(vbasedev, container, &err);
-        } else if (vbasedev->cpr.ioas_id == container->ioas_id) {
-            res = true;
         } else {
             continue;
         }
-- 
2.51.0

[PULL 05/12] accel/kvm: Fix an erroneous check on coalesced_mmio_ring

[Cédric Le Goater]

From: Zhenzhong Duan <zhenzhong.duan@intel.com>

According to KVM uAPI, coalesced mmio page is KVM_COALESCED_MMIO_PAGE_OFFSET
offset from kvm_run pages. For x86 it's 2 pages offset, for arm it's 1 page
offset currently. We shouldn't presume it's hardcoded 1 page or else
coalesced_mmio_ring will not be cleared in do_kvm_destroy_vcpu() in x86.

Fixes: 7ed0919119b0 ("migration: close kvm after cpr")
Cc: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-6-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 accel/kvm/kvm-all.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 56031925c4e9e6d46fb0e026e7b8dede2dabc7d2..f9254ae6546671e4569c190a098447becbdac0e0 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -525,7 +525,8 @@ static int do_kvm_destroy_vcpu(CPUState *cpu)
     }
 
     /* If I am the CPU that created coalesced_mmio_ring, then discard it */
-    if (s->coalesced_mmio_ring == (void *)cpu->kvm_run + PAGE_SIZE) {
+    if (s->coalesced_mmio_ring ==
+           (void *)cpu->kvm_run + s->coalesced_mmio * PAGE_SIZE) {
         s->coalesced_mmio_ring = NULL;
     }
 
-- 
2.51.0

[PULL 06/12] vfio/container: Support unmap all in one ioctl()

[Cédric Le Goater]

From: Zhenzhong Duan <zhenzhong.duan@intel.com>

VFIO type1 kernel uAPI supports unmapping whole address space in one call
since commit c19650995374 ("vfio/type1: implement unmap all"). Use the
unmap_all variant whenever it's supported in kernel.

Opportunistically pass VFIOLegacyContainer pointer in low level function
vfio_legacy_dma_unmap_one().

Co-developed-by: John Levon <levon@movementarian.org>
Signed-off-by: John Levon <levon@movementarian.org>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251009040134.334251-2-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-container-legacy.h |  1 +
 hw/vfio/container-legacy.c              | 38 ++++++++++++++-----------
 2 files changed, 23 insertions(+), 16 deletions(-)

diff --git a/include/hw/vfio/vfio-container-legacy.h b/include/hw/vfio/vfio-container-legacy.h
index 74a72df018b50490b95d80044a31247ba7c9fc3b..ffd594e80d64ee11ebc48940bc481b9aafc127d4 100644
--- a/include/hw/vfio/vfio-container-legacy.h
+++ b/include/hw/vfio/vfio-container-legacy.h
@@ -30,6 +30,7 @@ struct VFIOLegacyContainer {
 
     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
     unsigned iommu_type;
+    bool unmap_all_supported;
     QLIST_HEAD(, VFIOGroup) group_list;
     VFIOContainerCPR cpr;
 };
diff --git a/hw/vfio/container-legacy.c b/hw/vfio/container-legacy.c
index a3615d7b5dba8fce2f633e986036241e3cfd935d..8e9639603e08b2e1b13f1cd2ca51cc3e48913135 100644
--- a/hw/vfio/container-legacy.c
+++ b/hw/vfio/container-legacy.c
@@ -121,14 +121,14 @@ unmap_exit:
     return ret;
 }
 
-static int vfio_legacy_dma_unmap_one(const VFIOContainer *bcontainer,
+static int vfio_legacy_dma_unmap_one(const VFIOLegacyContainer *container,
                                      hwaddr iova, uint64_t size,
-                                     IOMMUTLBEntry *iotlb)
+                                     uint32_t flags, IOMMUTLBEntry *iotlb)
 {
-    const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    const VFIOContainer *bcontainer = VFIO_IOMMU(container);
     struct vfio_iommu_type1_dma_unmap unmap = {
         .argsz = sizeof(unmap),
-        .flags = 0,
+        .flags = flags,
         .iova = iova,
         .size = size,
     };
@@ -170,25 +170,28 @@ static int vfio_legacy_dma_unmap(const VFIOContainer *bcontainer,
                                  hwaddr iova, uint64_t size,
                                  IOMMUTLBEntry *iotlb, bool unmap_all)
 {
+    const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    uint32_t flags = 0;
     int ret;
 
     if (unmap_all) {
-        /* The unmap ioctl doesn't accept a full 64-bit span. */
-        Int128 llsize = int128_rshift(int128_2_64(), 1);
-
-        ret = vfio_legacy_dma_unmap_one(bcontainer, 0, int128_get64(llsize),
-                                        iotlb);
+        if (container->unmap_all_supported) {
+            flags = VFIO_DMA_UNMAP_FLAG_ALL;
+        } else {
+            /* The unmap ioctl doesn't accept a full 64-bit span. */
+            Int128 llsize = int128_rshift(int128_2_64(), 1);
+            size = int128_get64(llsize);
+
+            ret = vfio_legacy_dma_unmap_one(container, 0, size, flags, iotlb);
+            if (ret) {
+                return ret;
+            }
 
-        if (ret == 0) {
-            ret = vfio_legacy_dma_unmap_one(bcontainer, int128_get64(llsize),
-                                            int128_get64(llsize), iotlb);
+            iova = size;
         }
-
-    } else {
-        ret = vfio_legacy_dma_unmap_one(bcontainer, iova, size, iotlb);
     }
 
-    return ret;
+    return vfio_legacy_dma_unmap_one(container, iova, size, flags, iotlb);
 }
 
 static int vfio_legacy_dma_map(const VFIOContainer *bcontainer, hwaddr iova,
@@ -519,6 +522,9 @@ static bool vfio_legacy_setup(VFIOContainer *bcontainer, Error **errp)
 
     vfio_get_info_iova_range(info, bcontainer);
 
+    ret = ioctl(container->fd, VFIO_CHECK_EXTENSION, VFIO_UNMAP_ALL);
+    container->unmap_all_supported = !!ret;
+
     vfio_get_iommu_info_migration(container, info);
     return true;
 }
-- 
2.51.0

[PULL 07/12] vfio/iommufd: Support unmap all in one ioctl()

[Cédric Le Goater]

From: Zhenzhong Duan <zhenzhong.duan@intel.com>

IOMMUFD kernel uAPI supports unmapping whole address space in one call with
[iova, size] set to [0, UINT64_MAX], this can simplify iommufd_cdev_unmap()
a bit. See iommufd_ioas_unmap() in kernel for details.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251009040134.334251-3-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 24a99efa87f4df268d0df7198f26bba37976874b..fc9cd9d22ff2d6f126d3c0964d7033eee33ed9f2 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -62,21 +62,8 @@ static int iommufd_cdev_unmap(const VFIOContainer *bcontainer,
 {
     const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
 
-    /* unmap in halves */
     if (unmap_all) {
-        Int128 llsize = int128_rshift(int128_2_64(), 1);
-        int ret;
-
-        ret = iommufd_backend_unmap_dma(container->be, container->ioas_id,
-                                        0, int128_get64(llsize));
-
-        if (ret == 0) {
-            ret = iommufd_backend_unmap_dma(container->be, container->ioas_id,
-                                            int128_get64(llsize),
-                                            int128_get64(llsize));
-        }
-
-        return ret;
+        size = UINT64_MAX;
     }
 
     /* TODO: Handle dma_unmap_bitmap with iotlb args (migration) */
-- 
2.51.0

[PULL 08/12] vfio/listener: Add an assertion for unmap_all

[Cédric Le Goater]

From: Zhenzhong Duan <zhenzhong.duan@intel.com>

Currently the maximum of iommu address space is 64bit. So when a maximum
iommu memory section is deleted, it's in scope [0, 2^64). Add a
assertion for that.

Suggested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251009040134.334251-4-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/listener.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 1b6e5065a3267ab08d2d3fea3c5b4965a80947e8..2d7d3a464577ee258fac869e508e1b79aef2b53e 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -715,6 +715,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
         bool unmap_all = false;
 
         if (int128_eq(llsize, int128_2_64())) {
+            assert(!iova);
             unmap_all = true;
             llsize = int128_zero();
         }
-- 
2.51.0

[PULL 09/12] docs/system/devices/vfio-user: fix formatting

[Cédric Le Goater]

From: John Levon <john.levon@nutanix.com>

The example QEMU argument was not rendering properly, as it was not
indented.

Signed-off-by: John Levon <john.levon@nutanix.com>
Fixes: c688cc165b ("docs: add vfio-user documentation")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251009140206.386249-1-john.levon@nutanix.com
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/devices/vfio-user.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/system/devices/vfio-user.rst b/docs/system/devices/vfio-user.rst
index 30c2215f4ea5ad69c751bac4353ecaea7070b4f7..e10a6d0822993fc7565122d3dc6379853c541b16 100644
--- a/docs/system/devices/vfio-user.rst
+++ b/docs/system/devices/vfio-user.rst
@@ -20,7 +20,7 @@ Presuming a suitable ``vfio-user`` server has opened a socket at
 
 .. code-block:: console
 
--device '{"driver": "vfio-user-pci","socket": {"path": "/tmp/vfio-user.sock", "type": "unix"}}'
+  --device '{"driver": "vfio-user-pci","socket": {"path": "/tmp/vfio-user.sock", "type": "unix"}}'
 
 See `libvfio-user <https://github.com/nutanix/libvfio-user/>`_ for further
 information.
-- 
2.51.0

[PULL 10/12] MAINTAINERS: Update Alex Williamson's email address

[Cédric Le Goater]

From: Alex Williamson <alex.williamson@redhat.com>

Switch to a personal email account as I'll be leaving Red Hat soon.

Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013153543.3091169-1-alex.williamson@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 4 ++--
 .mailmap    | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 667acd933c7fef6d44796ed97e7f0c0bdf8e96fc..7a0809d82a365dc812b94ce363a7f0bb0d57cafa 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2285,7 +2285,7 @@ S: Maintained
 F: hw/usb/dev-serial.c
 
 VFIO
-M: Alex Williamson <alex.williamson@redhat.com>
+M: Alex Williamson <alex@shazbot.org>
 M: Cédric Le Goater <clg@redhat.com>
 S: Supported
 F: hw/vfio/*
@@ -2297,7 +2297,7 @@ F: migration/vfio-stub.c
 F: tests/functional/aarch64/test_device_passthrough.py
 
 vfio-igd
-M: Alex Williamson <alex.williamson@redhat.com>
+M: Alex Williamson <alex@shazbot.org>
 M: Cédric Le Goater <clg@redhat.com>
 M: Tomita Moeko <tomitamoeko@gmail.com>
 S: Supported
diff --git a/.mailmap b/.mailmap
index 15bec72470ead7cd953a15ef3a475ff93ae7b365..7f817d9f425c032be7988961faeb159ae6955b04 100644
--- a/.mailmap
+++ b/.mailmap
@@ -74,6 +74,7 @@ Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <aleksandar.markovic@imgte
 Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <amarkovic@wavecomp.com>
 Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> <arikalo@wavecomp.com>
 Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> <aleksandar.rikalo@rt-rk.com>
+Alex Williamson <alex@shazbot.org> <alex.williamson@redhat.com>
 Alexander Graf <agraf@csgraf.de> <agraf@suse.de>
 Ani Sinha <anisinha@redhat.com> <ani@anisinha.ca>
 Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
-- 
2.51.0

[PULL 11/12] vfio: rename field to "num_initial_regions"

[Cédric Le Goater]

From: John Levon <john.levon@nutanix.com>

We set VFIODevice::num_regions at initialization time, and do not
otherwise refresh it. As it is valid in theory for a VFIO device to
later increase the number of supported regions, rename the field to
"num_initial_regions" to better reflect its semantics.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Alex Williamson <alex@shazbot.org>
Link: https://lore.kernel.org/qemu-devel/20251014151227.2298892-2-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-device.h |  2 +-
 hw/vfio-user/device.c         |  2 +-
 hw/vfio/ccw.c                 |  4 ++--
 hw/vfio/device.c              | 12 ++++++------
 hw/vfio/iommufd.c             |  3 ++-
 hw/vfio/pci.c                 |  4 ++--
 6 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 7e9aed6d3cd424d718919a0b236d8acf1bc0deaf..0fe6c60ba2d65b0ef5de5ef0c75c43cfa8e89352 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -74,7 +74,7 @@ typedef struct VFIODevice {
     VFIODeviceOps *ops;
     VFIODeviceIOOps *io_ops;
     unsigned int num_irqs;
-    unsigned int num_regions;
+    unsigned int num_initial_regions;
     unsigned int flags;
     VFIOMigration *migration;
     Error *migration_blocker;
diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 0609a7dc25428c1e7efed1e7a4e85de91aace2d4..64ef35b3209429f7158d4ea79f095a5f16950d77 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -134,7 +134,7 @@ static int vfio_user_device_io_get_region_info(VFIODevice *vbasedev,
     VFIOUserFDs fds = { 0, 1, fd};
     int ret;
 
-    if (info->index > vbasedev->num_regions) {
+    if (info->index > vbasedev->num_initial_regions) {
         return -EINVAL;
     }
 
diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
index 9560b8d851b6b25e647476c51efe845ebff10410..4d9588e7aa1c0868fc2530d7e297676834d85259 100644
--- a/hw/vfio/ccw.c
+++ b/hw/vfio/ccw.c
@@ -484,9 +484,9 @@ static bool vfio_ccw_get_region(VFIOCCWDevice *vcdev, Error **errp)
      * We always expect at least the I/O region to be present. We also
      * may have a variable number of regions governed by capabilities.
      */
-    if (vdev->num_regions < VFIO_CCW_CONFIG_REGION_INDEX + 1) {
+    if (vdev->num_initial_regions < VFIO_CCW_CONFIG_REGION_INDEX + 1) {
         error_setg(errp, "vfio: too few regions (%u), expected at least %u",
-                   vdev->num_regions, VFIO_CCW_CONFIG_REGION_INDEX + 1);
+                   vdev->num_initial_regions, VFIO_CCW_CONFIG_REGION_INDEX + 1);
         return false;
     }
 
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 64f87503894791850b059b225762fd45d85ee16c..52079f4cf5bda7c1d9e6e3791a6c340a0e3f57ba 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -257,7 +257,7 @@ int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,
 {
     int i;
 
-    for (i = 0; i < vbasedev->num_regions; i++) {
+    for (i = 0; i < vbasedev->num_initial_regions; i++) {
         struct vfio_info_cap_header *hdr;
         struct vfio_region_info_cap_type *cap_type;
 
@@ -466,7 +466,7 @@ void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainer *bcontainer,
     int i;
 
     vbasedev->num_irqs = info->num_irqs;
-    vbasedev->num_regions = info->num_regions;
+    vbasedev->num_initial_regions = info->num_regions;
     vbasedev->flags = info->flags;
     vbasedev->reset_works = !!(info->flags & VFIO_DEVICE_FLAGS_RESET);
 
@@ -476,10 +476,10 @@ void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainer *bcontainer,
     QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
 
     vbasedev->reginfo = g_new0(struct vfio_region_info *,
-                               vbasedev->num_regions);
+                               vbasedev->num_initial_regions);
     if (vbasedev->use_region_fds) {
-        vbasedev->region_fds = g_new0(int, vbasedev->num_regions);
-        for (i = 0; i < vbasedev->num_regions; i++) {
+        vbasedev->region_fds = g_new0(int, vbasedev->num_initial_regions);
+        for (i = 0; i < vbasedev->num_initial_regions; i++) {
             vbasedev->region_fds[i] = -1;
         }
     }
@@ -489,7 +489,7 @@ void vfio_device_unprepare(VFIODevice *vbasedev)
 {
     int i;
 
-    for (i = 0; i < vbasedev->num_regions; i++) {
+    for (i = 0; i < vbasedev->num_initial_regions; i++) {
         g_free(vbasedev->reginfo[i]);
         if (vbasedev->region_fds != NULL && vbasedev->region_fds[i] != -1) {
             close(vbasedev->region_fds[i]);
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index fc9cd9d22ff2d6f126d3c0964d7033eee33ed9f2..bb5775aa711a668b7927865d19c3a27499ef49c8 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -650,7 +650,8 @@ found_container:
     vfio_iommufd_cpr_register_device(vbasedev);
 
     trace_iommufd_cdev_device_info(vbasedev->name, devfd, vbasedev->num_irqs,
-                                   vbasedev->num_regions, vbasedev->flags);
+                                   vbasedev->num_initial_regions,
+                                   vbasedev->flags);
     return true;
 
 err_listener_register:
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 06b06afc2b43d34d3a78ab874e3735eef91f529f..8b8bc5a42186d617ccfcc2307f62e19b53f46d50 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2975,9 +2975,9 @@ bool vfio_pci_populate_device(VFIOPCIDevice *vdev, Error **errp)
         return false;
     }
 
-    if (vbasedev->num_regions < VFIO_PCI_CONFIG_REGION_INDEX + 1) {
+    if (vbasedev->num_initial_regions < VFIO_PCI_CONFIG_REGION_INDEX + 1) {
         error_setg(errp, "unexpected number of io regions %u",
-                   vbasedev->num_regions);
+                   vbasedev->num_initial_regions);
         return false;
     }
 
-- 
2.51.0

[PULL 12/12] vfio: only check region info cache for initial regions

[Cédric Le Goater]

From: John Levon <john.levon@nutanix.com>

It is semantically valid for a VFIO device to increase the number of
regions after initialization. In this case, we'd attempt to check for
cached region info past the size of the ->reginfo array. Check for the
region index and skip the cache in these cases.

This also works around some VGPU use cases which appear to be a bug,
where VFIO_DEVICE_QUERY_GFX_PLANE returns a region index beyond the
reported ->num_regions.

Fixes: 95cdb024 ("vfio: add region info cache")
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Alex Williamson <alex@shazbot.org>
Link: https://lore.kernel.org/qemu-devel/20251014151227.2298892-3-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 52079f4cf5bda7c1d9e6e3791a6c340a0e3f57ba..8b63e765acbacdccc5365d000e2aa9bd49ae9701 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -205,10 +205,19 @@ int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
     int fd = -1;
     int ret;
 
-    /* check cache */
-    if (vbasedev->reginfo[index] != NULL) {
-        *info = vbasedev->reginfo[index];
-        return 0;
+    /*
+     * We only set up the region info cache for the initial number of regions.
+     *
+     * Since a VFIO device may later increase the number of regions then use
+     * such regions with an index past ->num_initial_regions, don't attempt to
+     * use the info cache in those cases.
+     */
+    if (index < vbasedev->num_initial_regions) {
+        /* check cache */
+        if (vbasedev->reginfo[index] != NULL) {
+            *info = vbasedev->reginfo[index];
+            return 0;
+        }
     }
 
     *info = g_malloc0(argsz);
@@ -236,10 +245,12 @@ retry:
         goto retry;
     }
 
-    /* fill cache */
-    vbasedev->reginfo[index] = *info;
-    if (vbasedev->region_fds != NULL) {
-        vbasedev->region_fds[index] = fd;
+    if (index < vbasedev->num_initial_regions) {
+        /* fill cache */
+        vbasedev->reginfo[index] = *info;
+        if (vbasedev->region_fds != NULL) {
+            vbasedev->region_fds[index] = fd;
+        }
     }
 
     return 0;
-- 
2.51.0

Re: [PULL 00/12] vfio queue

[Cédric Le Goater]

Michael,

On 10/22/25 14:18, Cédric Le Goater wrote:
> The following changes since commit 3c0b42c68f98fb276fa248012642be8cbf2cab70:
> 
>    Merge tag 'pull-request-2025-10-21' of https://gitlab.com/thuth/qemu into staging (2025-10-21 08:59:35 -0500)
> 
> are available in the Git repository at:
> 
>    https://github.com/legoater/qemu/ tags/pull-vfio-20251022
> 
> for you to fetch changes up to ecbe424a63c9f860a901d6a4a75724b046abd796:
> 
>    vfio: only check region info cache for initial regions (2025-10-22 08:12:52 +0200)
> 
> ----------------------------------------------------------------
> vfio queue:
> 
> * Fix CPR transfer
> * Add support for VFIO_DMA_UNMAP_FLAG_ALL
> * Fix vfio-user documentation
> * Update Alex Williamson's email address
> * Fix for vfio-region cache for the vGPU use case
> 
> ----------------------------------------------------------------
> Alex Williamson (1):
>        MAINTAINERS: Update Alex Williamson's email address
> 
> John Levon (3):
>        docs/system/devices/vfio-user: fix formatting
>        vfio: rename field to "num_initial_regions"
>        vfio: only check region info cache for initial regions
> 
> Zhenzhong Duan (8):
>        vfio/container: Remap only populated parts in a section
>        vfio/cpr-legacy: drop an erroneous assert
>        vfio/iommufd: Set cpr.ioas_id on source side for CPR transfer
>        vfio/iommufd: Restore vbasedev's reference to hwpt after CPR transfer
>        accel/kvm: Fix an erroneous check on coalesced_mmio_ring
>        vfio/container: Support unmap all in one ioctl()
>        vfio/iommufd: Support unmap all in one ioctl()
>        vfio/listener: Add an assertion for unmap_all
> 
>   MAINTAINERS                             |  4 ++--
>   docs/system/devices/vfio-user.rst       |  2 +-
>   include/hw/vfio/vfio-container-legacy.h |  1 +
>   include/hw/vfio/vfio-cpr.h              |  2 +-
>   include/hw/vfio/vfio-device.h           |  2 +-
>   accel/kvm/kvm-all.c                     |  3 ++-
>   hw/vfio-user/device.c                   |  2 +-
>   hw/vfio/ccw.c                           |  4 ++--
>   hw/vfio/container-legacy.c              | 38 ++++++++++++++++++--------------
>   hw/vfio/cpr-legacy.c                    | 22 +++++++++++++------
>   hw/vfio/device.c                        | 39 +++++++++++++++++++++------------
>   hw/vfio/iommufd.c                       | 26 ++++++----------------
>   hw/vfio/listener.c                      |  5 +++--
>   hw/vfio/pci.c                           |  4 ++--
>   .mailmap                                |  1 +
>   15 files changed, 86 insertions(+), 69 deletions(-)


Patch 11-12 are candidates for the stable-10.1 and patch "vfio: rename
field to "num_initial_regions" needs to be extended.

See https://github.com/legoater/qemu/commits/staging-10.1-vfio/

Thanks,

C.

Re: [PULL 00/12] vfio queue

[Richard Henderson]

On 10/22/25 07:18, Cédric Le Goater wrote:
> The following changes since commit 3c0b42c68f98fb276fa248012642be8cbf2cab70:
> 
>    Merge tag 'pull-request-2025-10-21' ofhttps://gitlab.com/thuth/qemu into staging (2025-10-21 08:59:35 -0500)
> 
> are available in the Git repository at:
> 
>    https://github.com/legoater/qemu/ tags/pull-vfio-20251022
> 
> for you to fetch changes up to ecbe424a63c9f860a901d6a4a75724b046abd796:
> 
>    vfio: only check region info cache for initial regions (2025-10-22 08:12:52 +0200)
> 
> ----------------------------------------------------------------
> vfio queue:
> 
> * Fix CPR transfer
> * Add support for VFIO_DMA_UNMAP_FLAG_ALL
> * Fix vfio-user documentation
> * Update Alex Williamson's email address
> * Fix for vfio-region cache for the vGPU use case

Applied, thanks.  Please update https://wiki.qemu.org/ChangeLog/10.2 as appropriate.

r~

Re: [PULL 00/12] vfio queue

[Michael Tokarev]

On 10/22/25 15:55, Cédric Le Goater wrote:
> Michael,
> 
> On 10/22/25 14:18, Cédric Le Goater wrote:
>> The following changes since commit 
>> 3c0b42c68f98fb276fa248012642be8cbf2cab70:
>>
>>    Merge tag 'pull-request-2025-10-21' of https://gitlab.com/thuth/ 
>> qemu into staging (2025-10-21 08:59:35 -0500)
>>
>> are available in the Git repository at:
>>
>>    https://github.com/legoater/qemu/ tags/pull-vfio-20251022
>>
>> for you to fetch changes up to ecbe424a63c9f860a901d6a4a75724b046abd796:
>>
>>    vfio: only check region info cache for initial regions (2025-10-22 
>> 08:12:52 +0200)
>>
>> ----------------------------------------------------------------
>> vfio queue:
>>
>> * Fix CPR transfer
>> * Add support for VFIO_DMA_UNMAP_FLAG_ALL
>> * Fix vfio-user documentation
>> * Update Alex Williamson's email address
>> * Fix for vfio-region cache for the vGPU use case
>>
>> ----------------------------------------------------------------
>> Alex Williamson (1):
>>        MAINTAINERS: Update Alex Williamson's email address
>>
>> John Levon (3):
>>        docs/system/devices/vfio-user: fix formatting
>>        vfio: rename field to "num_initial_regions"
>>        vfio: only check region info cache for initial regions
>>
>> Zhenzhong Duan (8):
>>        vfio/container: Remap only populated parts in a section
>>        vfio/cpr-legacy: drop an erroneous assert
>>        vfio/iommufd: Set cpr.ioas_id on source side for CPR transfer
>>        vfio/iommufd: Restore vbasedev's reference to hwpt after CPR 
>> transfer
>>        accel/kvm: Fix an erroneous check on coalesced_mmio_ring
>>        vfio/container: Support unmap all in one ioctl()
>>        vfio/iommufd: Support unmap all in one ioctl()
>>        vfio/listener: Add an assertion for unmap_all
..

> Patch 11-12 are candidates for the stable-10.1 and patch "vfio: rename
> field to "num_initial_regions" needs to be extended.
> 
> See https://github.com/legoater/qemu/commits/staging-10.1-vfio/

Thank you very much Cédric for this work!
I picked the 2 patches prepared by you, to staging-10.1 branch.
It's a nice thing - vfio/platform &Co has been removed in current
master branch, but it is still exist in 10.1 and earlier.

BTW, this pull request contains a number of fixes by Zhenzhong Duan
which seems to be fixes too, - shouldn't these be picked up to
the stable series as well?

Thank you!

/mjt

Re: [PULL 00/12] vfio queue

[Cédric Le Goater]

On 10/23/25 11:53, Michael Tokarev wrote:
> On 10/22/25 15:55, Cédric Le Goater wrote:
>> Michael,
>>
>> On 10/22/25 14:18, Cédric Le Goater wrote:
>>> The following changes since commit 3c0b42c68f98fb276fa248012642be8cbf2cab70:
>>>
>>>    Merge tag 'pull-request-2025-10-21' of https://gitlab.com/thuth/ qemu into staging (2025-10-21 08:59:35 -0500)
>>>
>>> are available in the Git repository at:
>>>
>>>    https://github.com/legoater/qemu/ tags/pull-vfio-20251022
>>>
>>> for you to fetch changes up to ecbe424a63c9f860a901d6a4a75724b046abd796:
>>>
>>>    vfio: only check region info cache for initial regions (2025-10-22 08:12:52 +0200)
>>>
>>> ----------------------------------------------------------------
>>> vfio queue:
>>>
>>> * Fix CPR transfer
>>> * Add support for VFIO_DMA_UNMAP_FLAG_ALL
>>> * Fix vfio-user documentation
>>> * Update Alex Williamson's email address
>>> * Fix for vfio-region cache for the vGPU use case
>>>
>>> ----------------------------------------------------------------
>>> Alex Williamson (1):
>>>        MAINTAINERS: Update Alex Williamson's email address
>>>
>>> John Levon (3):
>>>        docs/system/devices/vfio-user: fix formatting
>>>        vfio: rename field to "num_initial_regions"
>>>        vfio: only check region info cache for initial regions
>>>
>>> Zhenzhong Duan (8):
>>>        vfio/container: Remap only populated parts in a section
>>>        vfio/cpr-legacy: drop an erroneous assert
>>>        vfio/iommufd: Set cpr.ioas_id on source side for CPR transfer
>>>        vfio/iommufd: Restore vbasedev's reference to hwpt after CPR transfer
>>>        accel/kvm: Fix an erroneous check on coalesced_mmio_ring
>>>        vfio/container: Support unmap all in one ioctl()
>>>        vfio/iommufd: Support unmap all in one ioctl()
>>>        vfio/listener: Add an assertion for unmap_all
> ..
> 
>> Patch 11-12 are candidates for the stable-10.1 and patch "vfio: rename
>> field to "num_initial_regions" needs to be extended.
>>
>> See https://github.com/legoater/qemu/commits/staging-10.1-vfio/
> 
> Thank you very much Cédric for this work!
> I picked the 2 patches prepared by you, to staging-10.1 branch.
> It's a nice thing - vfio/platform &Co has been removed in current
> master branch, but it is still exist in 10.1 and earlier.
> 
> BTW, this pull request contains a number of fixes by Zhenzhong Duan
> which seems to be fixes too, - shouldn't these be picked up to
> the stable series as well?
The CPR related fixes are worth considering :

   vfio/iommufd: Restore vbasedev's reference to hwpt after CPR transfer
   vfio/iommufd: Set cpr.ioas_id on source side for CPR transfer
   vfio/cpr-legacy: drop an erroneous assert
   vfio/container: Remap only populated parts in a section

CPR is cutting-edge techno, so these fixes shouldn't have much impact
on our users at this time. Feel free to drop if the backport is too
complex. I haven't tried.

Thanks,

C.