Series comparison

-[PULL 00/13] vfio queue
+[PULL 00/21] vfio queue
-The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:
+The following changes since commit 825b96dbcee23d134b691fc75618b59c5f53da32:
-  Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)
+  Merge tag 'migration-20250310-pull-request' of https://gitlab.com/farosas/qemu into staging (2025-03-11 09:32:07 +0800)
 are available in the Git repository at:
-  https://github.com/legoater/qemu/ tags/pull-vfio-20230911
+  https://github.com/legoater/qemu/ tags/pull-vfio-20250311
-for you to fetch changes up to a31fe5daeaa230556145bfc04af1bd4e68f377fa:
+for you to fetch changes up to 4d9607481560e6c8e1508a0aafe94f86a0503c8c:
-  vfio/common: Separate vfio-pci ranges (2023-09-11 08:34:06 +0200)
+  vfio/pci: Drop debug commentary from x-device-dirty-page-tracking (2025-03-11 19:04:58 +0100)
 ----------------------------------------------------------------
 vfio queue:
-* Small downtime optimisation for VFIO migration
+* Fixed endianness of VFIO device state packets
-* P2P support for VFIO migration
+* Improved IGD passthrough support with legacy mode
-* Introduction of a save_prepare() handler to fail VFIO migration
+* Improved build
-* Fix on DMA logging ranges calculation for OVMF enabling dynamic window
+* Added support for old AMD GPUs (x550)
 * Updated property documentation
 ----------------------------------------------------------------
-Avihai Horon (11):
+Joao Martins (1):
-      vfio/migration: Move from STOP_COPY to STOP in vfio_save_cleanup()
+      vfio/pci: Drop debug commentary from x-device-dirty-page-tracking
       sysemu: Add prepare callback to struct VMChangeStateEntry
       qdev: Add qdev_add_vm_change_state_handler_full()
       vfio/migration: Add P2P support for VFIO migration
       vfio/migration: Allow migration of multiple P2P supporting devices
       migration: Add migration prefix to functions in target.c
       vfio/migration: Fail adding device with enable-migration=on and existing blocker
       migration: Move more initializations to migrate_init()
       migration: Add .save_prepare() handler to struct SaveVMHandlers
       vfio/migration: Block VFIO migration with postcopy migration
       vfio/migration: Block VFIO migration with background snapshot
-Joao Martins (2):
+Maciej S. Szmigiero (1):
-      vfio/migration: Refactor PRE_COPY and RUNNING state checks
+      vfio/migration: Use BE byte order for device state wire packets
       vfio/common: Separate vfio-pci ranges
- docs/devel/vfio-migration.rst     |  93 +++++++++++++++++-----------
+Philippe Mathieu-Daudé (8):
- include/hw/vfio/vfio-common.h     |   2 +
+      system: Declare qemu_[min/max]rampagesize() in 'system/hostmem.h'
- include/migration/register.h      |   5 ++
+      hw/vfio/spapr: Do not include <linux/kvm.h>
- include/sysemu/runstate.h         |   7 +++
+      hw/vfio/common: Include missing 'system/tcg.h' header
- migration/migration.h             |   6 +-
+      hw/vfio/common: Get target page size using runtime helpers
- migration/savevm.h                |   1 +
+      hw/vfio: Compile some common objects once
- hw/core/vm-change-state-handler.c |  14 ++++-
+      hw/vfio: Compile more objects once
- hw/vfio/common.c                  | 126 ++++++++++++++++++++++++++++++--------
+      hw/vfio: Compile iommufd.c once
- hw/vfio/migration.c               | 106 +++++++++++++++++++++++++++-----
+      hw/vfio: Compile display.c once
- migration/migration.c             |  33 ++++++----
- migration/savevm.c                |  32 ++++++++--
+Tomita Moeko (10):
- migration/target.c                |   8 +--
+      vfio/igd: Remove GTT write quirk in IO BAR 4
- softmmu/runstate.c                |  40 ++++++++++++
+      vfio/igd: Do not include GTT stolen size in etc/igd-bdsm-size
- hw/vfio/trace-events              |   3 +-
+      vfio/igd: Consolidate OpRegion initialization into a single function
-files changed, 377 insertions(+), 99 deletions(-)
+      vfio/igd: Move LPC bridge initialization to a separate function
       vfio/pci: Add placeholder for device-specific config space quirks
       vfio/igd: Refactor vfio_probe_igd_bar4_quirk into pci config quirk
       vfio/igd: Decouple common quirks from legacy mode
       vfio/igd: Handle x-igd-opregion option in config quirk
       vfio/igd: Introduce x-igd-lpc option for LPC bridge ID quirk
       vfio/igd: Fix broken KVMGT OpRegion support
 Vasilis Liaskovitis (1):
       vfio/pci-quirks: Exclude non-ioport BAR from ATI quirk
  hw/vfio/pci.h               |  11 +-
  include/exec/ram_addr.h     |   3 -
  include/system/hostmem.h    |   3 +
  hw/ppc/spapr_caps.c         |   1 +
  hw/s390x/s390-virtio-ccw.c  |   1 +
  hw/vfio/common.c            |   9 +-
  hw/vfio/igd.c               | 529 +++++++++++++++++++-------------------------
  hw/vfio/iommufd.c           |   1 -
  hw/vfio/migration-multifd.c |  15 +-
  hw/vfio/migration.c         |   1 -
  hw/vfio/pci-quirks.c        |  53 +----
  hw/vfio/pci.c               |  35 +--
  hw/vfio/spapr.c             |   4 +-
  hw/vfio/meson.build         |  27 ++-
 files changed, 288 insertions(+), 405 deletions(-)

-New patch
+[PULL 01/21] vfio/igd: Remove GTT write quirk in IO BAR 4
+From: Tomita Moeko <tomitamoeko@gmail.com>
 The IO BAR4 of IGD devices contains a pair of 32-bit address/data
 registers, MMIO_Index (0x0) and MMIO_Data (0x4), which provide access
 to the MMIO BAR0 (GTTMMADR) from IO space. These registers are probably
 only used by the VBIOS, and are not documented by intel. The observed
 layout of MMIO_Index register is:
 2   1      0
 +-------------------------------------------------------------------+
 |                        Offset                        | Rsvd | Sel |
 +-------------------------------------------------------------------+
 - Offset: Byte offset in specified region, 4-byte aligned.
 - Sel: Region selector
 : MMIO register region (first half of MMIO BAR0)
 : GTT region (second half of MMIO BAR0). Pre Gen11 only.
 Currently, QEMU implements a quirk that adjusts the guest Data Stolen
 Memory (DSM) region address to be (addr - host BDSM + guest BDSM) when
 programming GTT entries via IO BAR4, assuming guest still programs GTT
 with host DSM address, which is not the case. Guest's BDSM register is
 emulated and initialized to 0 at startup by QEMU, then SeaBIOS programs
 its value[1]. As result, the address programmed to GTT entries by VBIOS
 running in guest are valid GPA, and this unnecessary adjustment brings
 inconsistency.
 [1] https://gitlab.com/qemu-project/seabios/-/blob/1.12-stable/src/fw/pciinit.c#L319-332
 Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
 Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
 Tested-by: Alex Williamson <alex.williamson@redhat.com>
 Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
 Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-2-tomitamoeko@gmail.com
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
  hw/vfio/igd.c | 191 +-------------------------------------------------
 file changed, 1 insertion(+), 190 deletions(-)
 diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/igd.c
 +++ b/hw/vfio/igd.c
@@ -XXX,XX +XXX,XX @@ static int igd_gen(VFIOPCIDevice *vdev)
      return -1;
  }
 -typedef struct VFIOIGDQuirk {
 -    struct VFIOPCIDevice *vdev;
 -    uint32_t index;
 -    uint64_t bdsm;
 -} VFIOIGDQuirk;
 -
  #define IGD_GMCH 0x50 /* Graphics Control Register */
  #define IGD_BDSM 0x5c /* Base Data of Stolen Memory */
  #define IGD_BDSM_GEN11 0xc0 /* Base Data of Stolen Memory of gen 11 and later */
@@ -XXX,XX +XXX,XX @@ static int vfio_pci_igd_lpc_init(VFIOPCIDevice *vdev,
      return ret;
  }
 -/*
 - * IGD Gen8 and newer support up to 8MB for the GTT and use a 64bit PTE
 - * entry, older IGDs use 2MB and 32bit.  Each PTE maps a 4k page.  Therefore
 - * we either have 2M/4k * 4 = 2k or 8M/4k * 8 = 16k as the maximum iobar index
 - * for programming the GTT.
 - *
 - * See linux:include/drm/i915_drm.h for shift and mask values.
 - */
 -static int vfio_igd_gtt_max(VFIOPCIDevice *vdev)
 -{
 -    uint32_t gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, sizeof(gmch));
 -    int gen = igd_gen(vdev);
 -    uint64_t ggms_size = igd_gtt_memory_size(gen, gmch);
 -
 -    return (ggms_size / (4 * KiB)) * (gen < 8 ? 4 : 8);
 -}
 -
 -/*
 - * The IGD ROM will make use of stolen memory (GGMS) for support of VESA modes.
 - * Somehow the host stolen memory range is used for this, but how the ROM gets
 - * it is a mystery, perhaps it's hardcoded into the ROM.  Thankfully though, it
 - * reprograms the GTT through the IOBAR where we can trap it and transpose the
 - * programming to the VM allocated buffer.  That buffer gets reserved by the VM
 - * firmware via the fw_cfg entry added below.  Here we're just monitoring the
 - * IOBAR address and data registers to detect a write sequence targeting the
 - * GTTADR.  This code is developed by observed behavior and doesn't have a
 - * direct spec reference, unfortunately.
 - */
 -static uint64_t vfio_igd_quirk_data_read(void *opaque,
 -                                         hwaddr addr, unsigned size)
 -{
 -    VFIOIGDQuirk *igd = opaque;
 -    VFIOPCIDevice *vdev = igd->vdev;
 -
 -    igd->index = ~0;
 -
 -    return vfio_region_read(&vdev->bars[4].region, addr + 4, size);
 -}
 -
 -static void vfio_igd_quirk_data_write(void *opaque, hwaddr addr,
 -                                      uint64_t data, unsigned size)
 -{
 -    VFIOIGDQuirk *igd = opaque;
 -    VFIOPCIDevice *vdev = igd->vdev;
 -    uint64_t val = data;
 -    int gen = igd_gen(vdev);
 -
 -    /*
 -     * Programming the GGMS starts at index 0x1 and uses every 4th index (ie.
 -     * 0x1, 0x5, 0x9, 0xd,...).  For pre-Gen8 each 4-byte write is a whole PTE
 -     * entry, with 0th bit enable set.  For Gen8 and up, PTEs are 64bit, so
 -     * entries 0x5 & 0xd are the high dword, in our case zero.  Each PTE points
 -     * to a 4k page, which we translate to a page from the VM allocated region,
 -     * pointed to by the BDSM register.  If this is not set, we fail.
 -     *
 -     * We trap writes to the full configured GTT size, but we typically only
 -     * see the vBIOS writing up to (nearly) the 1MB barrier.  In fact it often
 -     * seems to miss the last entry for an even 1MB GTT.  Doing a gratuitous
 -     * write of that last entry does work, but is hopefully unnecessary since
 -     * we clear the previous GTT on initialization.
 -     */
 -    if ((igd->index % 4 == 1) && igd->index < vfio_igd_gtt_max(vdev)) {
 -        if (gen < 8 || (igd->index % 8 == 1)) {
 -            uint64_t base;
 -
 -            if (gen < 11) {
 -                base = pci_get_long(vdev->pdev.config + IGD_BDSM);
 -            } else {
 -                base = pci_get_quad(vdev->pdev.config + IGD_BDSM_GEN11);
 -            }
 -            if (!base) {
 -                hw_error("vfio-igd: Guest attempted to program IGD GTT before "
 -                         "BIOS reserved stolen memory.  Unsupported BIOS?");
 -            }
 -
 -            val = data - igd->bdsm + base;
 -        } else {
 -            val = 0; /* upper 32bits of pte, we only enable below 4G PTEs */
 -        }
 -
 -        trace_vfio_pci_igd_bar4_write(vdev->vbasedev.name,
 -                                      igd->index, data, val);
 -    }
 -
 -    vfio_region_write(&vdev->bars[4].region, addr + 4, val, size);
 -
 -    igd->index = ~0;
 -}
 -
 -static const MemoryRegionOps vfio_igd_data_quirk = {
 -    .read = vfio_igd_quirk_data_read,
 -    .write = vfio_igd_quirk_data_write,
 -    .endianness = DEVICE_LITTLE_ENDIAN,
 -};
 -
 -static uint64_t vfio_igd_quirk_index_read(void *opaque,
 -                                          hwaddr addr, unsigned size)
 -{
 -    VFIOIGDQuirk *igd = opaque;
 -    VFIOPCIDevice *vdev = igd->vdev;
 -
 -    igd->index = ~0;
 -
 -    return vfio_region_read(&vdev->bars[4].region, addr, size);
 -}
 -
 -static void vfio_igd_quirk_index_write(void *opaque, hwaddr addr,
 -                                       uint64_t data, unsigned size)
 -{
 -    VFIOIGDQuirk *igd = opaque;
 -    VFIOPCIDevice *vdev = igd->vdev;
 -
 -    igd->index = data;
 -
 -    vfio_region_write(&vdev->bars[4].region, addr, data, size);
 -}
 -
 -static const MemoryRegionOps vfio_igd_index_quirk = {
 -    .read = vfio_igd_quirk_index_read,
 -    .write = vfio_igd_quirk_index_write,
 -    .endianness = DEVICE_LITTLE_ENDIAN,
 -};
 -
  #define IGD_GGC_MMIO_OFFSET     0x108040
  #define IGD_BDSM_MMIO_OFFSET    0x1080C0
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
      g_autofree struct vfio_region_info *opregion = NULL;
      g_autofree struct vfio_region_info *host = NULL;
      g_autofree struct vfio_region_info *lpc = NULL;
 -    VFIOQuirk *quirk;
 -    VFIOIGDQuirk *igd;
      PCIDevice *lpc_bridge;
 -    int i, ret, gen;
 +    int ret, gen;
      uint64_t ggms_size, gms_size;
      uint64_t *bdsm_size;
      uint32_t gmch;
 -    uint16_t cmd_orig, cmd;
      Error *err = NULL;
      /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
          return;
      }
 -    /* Setup our quirk to munge GTT addresses to the VM allocated buffer */
 -    quirk = vfio_quirk_alloc(2);
 -    igd = quirk->data = g_malloc0(sizeof(*igd));
 -    igd->vdev = vdev;
 -    igd->index = ~0;
 -    if (gen < 11) {
 -        igd->bdsm = vfio_pci_read_config(&vdev->pdev, IGD_BDSM, 4);
 -    } else {
 -        igd->bdsm = vfio_pci_read_config(&vdev->pdev, IGD_BDSM_GEN11, 4);
 -        igd->bdsm |=
 -            (uint64_t)vfio_pci_read_config(&vdev->pdev, IGD_BDSM_GEN11 + 4, 4) << 32;
 -    }
 -    igd->bdsm &= ~((1 * MiB) - 1); /* 1MB aligned */
 -
 -    memory_region_init_io(&quirk->mem[0], OBJECT(vdev), &vfio_igd_index_quirk,
 -                          igd, "vfio-igd-index-quirk", 4);
 -    memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
 -                                        0, &quirk->mem[0], 1);
 -
 -    memory_region_init_io(&quirk->mem[1], OBJECT(vdev), &vfio_igd_data_quirk,
 -                          igd, "vfio-igd-data-quirk", 4);
 -    memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
 -                                        4, &quirk->mem[1], 1);
 -
 -    QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
 -
      /*
       * Allow user to override dsm size using x-igd-gms option, in multiples of
       * 32MiB. This option should only be used when the desired size cannot be
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
          pci_set_quad(vdev->emulated_config_bits + IGD_BDSM_GEN11, ~0);
      }
 -    /*
 -     * This IOBAR gives us access to GTTADR, which allows us to write to
 -     * the GTT itself.  So let's go ahead and write zero to all the GTT
 -     * entries to avoid spurious DMA faults.  Be sure I/O access is enabled
 -     * before talking to the device.
 -     */
 -    if (pread(vdev->vbasedev.fd, &cmd_orig, sizeof(cmd_orig),
 -              vdev->config_offset + PCI_COMMAND) != sizeof(cmd_orig)) {
 -        error_report("IGD device %s - failed to read PCI command register",
 -                     vdev->vbasedev.name);
 -    }
 -
 -    cmd = cmd_orig | PCI_COMMAND_IO;
 -
 -    if (pwrite(vdev->vbasedev.fd, &cmd, sizeof(cmd),
 -               vdev->config_offset + PCI_COMMAND) != sizeof(cmd)) {
 -        error_report("IGD device %s - failed to write PCI command register",
 -                     vdev->vbasedev.name);
 -    }
 -
 -    for (i = 1; i < vfio_igd_gtt_max(vdev); i += 4) {
 -        vfio_region_write(&vdev->bars[4].region, 0, i, 4);
 -        vfio_region_write(&vdev->bars[4].region, 4, 0, 4);
 -    }
 -
 -    if (pwrite(vdev->vbasedev.fd, &cmd_orig, sizeof(cmd_orig),
 -               vdev->config_offset + PCI_COMMAND) != sizeof(cmd_orig)) {
 -        error_report("IGD device %s - failed to restore PCI command register",
 -                     vdev->vbasedev.name);
 -    }
 -
      trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name,
                                      (ggms_size + gms_size) / MiB);
  }
 --
 .48.1

-[PULL 03/13] qdev: Add qdev_add_vm_change_state_handler_full()
+[PULL 02/21] vfio/igd: Do not include GTT stolen size in etc/igd-bdsm-size
-From: Avihai Horon <avihaih@nvidia.com>
+From: Tomita Moeko <tomitamoeko@gmail.com>
-Add qdev_add_vm_change_state_handler_full() variant that allows setting
+Though GTT Stolen Memory (GSM) is right below Data Stolen Memory (DSM)
-a prepare callback in addition to the main callback.
+in host address space, direct access to GSM is prohibited, and it is
 not mapped to guest address space. Both host and guest accesses GSM
 indirectly through the second half of MMIO BAR0 (GTTMMADR).
-This will facilitate adding P2P support for VFIO migration in the
+Guest firmware only need to reserve a memory region for DSM and program
-following patches.
+the BDSM register with the base address of that region, that's actually
 what both SeaBIOS[1] and IgdAssignmentDxe does now.
-Signed-off-by: Avihai Horon <avihaih@nvidia.com>
+[1] https://gitlab.com/qemu-project/seabios/-/blob/1.12-stable/src/fw/pciinit.c#L319-332
-Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
+Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
-Tested-by: YangHang Liu <yanghliu@redhat.com>
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
 Tested-by: Alex Williamson <alex.williamson@redhat.com>
 Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
 Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-3-tomitamoeko@gmail.com
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- include/sysemu/runstate.h         |  3 +++
+ hw/vfio/igd.c | 28 +++-------------------------
- hw/core/vm-change-state-handler.c | 14 +++++++++++++-
+file changed, 3 insertions(+), 25 deletions(-)
 files changed, 16 insertions(+), 1 deletion(-)
-diff --git a/include/sysemu/runstate.h b/include/sysemu/runstate.h
+diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/runstate.h
+--- a/hw/vfio/igd.c
-+++ b/include/sysemu/runstate.h
++++ b/hw/vfio/igd.c
-@@ -XXX,XX +XXX,XX @@ qemu_add_vm_change_state_handler_prio_full(VMChangeStateHandler *cb,
+@@ -XXX,XX +XXX,XX @@ static int igd_gen(VFIOPCIDevice *vdev)
- VMChangeStateEntry *qdev_add_vm_change_state_handler(DeviceState *dev,
-                                                      VMChangeStateHandler *cb,
+ #define IGD_GMCH_GEN6_GMS_SHIFT     3       /* SNB_GMCH in i915 */
-                                                      void *opaque);
+ #define IGD_GMCH_GEN6_GMS_MASK      0x1f
-+VMChangeStateEntry *qdev_add_vm_change_state_handler_full(
+-#define IGD_GMCH_GEN6_GGMS_SHIFT    8
-+    DeviceState *dev, VMChangeStateHandler *cb,
+-#define IGD_GMCH_GEN6_GGMS_MASK     0x3
-+    VMChangeStateHandler *prepare_cb, void *opaque);
+ #define IGD_GMCH_GEN8_GMS_SHIFT     8       /* BDW_GMCH in i915 */
- void qemu_del_vm_change_state_handler(VMChangeStateEntry *e);
+ #define IGD_GMCH_GEN8_GMS_MASK      0xff
- /**
+-#define IGD_GMCH_GEN8_GGMS_SHIFT    6
-  * vm_state_notify: Notify the state of the VM
+-#define IGD_GMCH_GEN8_GGMS_MASK     0x3
-diff --git a/hw/core/vm-change-state-handler.c b/hw/core/vm-change-state-handler.c
+-
-index XXXXXXX..XXXXXXX 100644
+-static uint64_t igd_gtt_memory_size(int gen, uint16_t gmch)
---- a/hw/core/vm-change-state-handler.c
+-{
-+++ b/hw/core/vm-change-state-handler.c
+-    uint64_t ggms;
-@@ -XXX,XX +XXX,XX @@ static int qdev_get_dev_tree_depth(DeviceState *dev)
+-
- VMChangeStateEntry *qdev_add_vm_change_state_handler(DeviceState *dev,
+-    if (gen < 8) {
-                                                      VMChangeStateHandler *cb,
+-        ggms = (gmch >> IGD_GMCH_GEN6_GGMS_SHIFT) & IGD_GMCH_GEN6_GGMS_MASK;
-                                                      void *opaque)
+-    } else {
-+{
+-        ggms = (gmch >> IGD_GMCH_GEN8_GGMS_SHIFT) & IGD_GMCH_GEN8_GGMS_MASK;
-+    return qdev_add_vm_change_state_handler_full(dev, cb, NULL, opaque);
+-        if (ggms != 0) {
-+}
+-            ggms = 1ULL << ggms;
-+
+-        }
-+/*
+-    }
-+ * Exactly like qdev_add_vm_change_state_handler() but passes a prepare_cb
+-
-+ * argument too.
+-    return ggms * MiB;
-+ */
+-}
-+VMChangeStateEntry *qdev_add_vm_change_state_handler_full(
-+    DeviceState *dev, VMChangeStateHandler *cb,
+ static uint64_t igd_stolen_memory_size(int gen, uint32_t gmch)
 +    VMChangeStateHandler *prepare_cb, void *opaque)
  {
-     int depth = qdev_get_dev_tree_depth(dev);
+@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
+     g_autofree struct vfio_region_info *lpc = NULL;
--    return qemu_add_vm_change_state_handler_prio(cb, opaque, depth);
+     PCIDevice *lpc_bridge;
-+    return qemu_add_vm_change_state_handler_prio_full(cb, prepare_cb, opaque,
+     int ret, gen;
-+                                                      depth);
+-    uint64_t ggms_size, gms_size;
 +    uint64_t gms_size;
      uint64_t *bdsm_size;
      uint32_t gmch;
      Error *err = NULL;
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
          }
      }
 -    ggms_size = igd_gtt_memory_size(gen, gmch);
      gms_size = igd_stolen_memory_size(gen, gmch);
      /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
       * config offset 0x5C.
       */
      bdsm_size = g_malloc(sizeof(*bdsm_size));
 -    *bdsm_size = cpu_to_le64(ggms_size + gms_size);
 +    *bdsm_size = cpu_to_le64(gms_size);
      fw_cfg_add_file(fw_cfg_find(), "etc/igd-bdsm-size",
                      bdsm_size, sizeof(*bdsm_size));
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
          pci_set_quad(vdev->emulated_config_bits + IGD_BDSM_GEN11, ~0);
      }
 -    trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name,
 -                                    (ggms_size + gms_size) / MiB);
 +    trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name, (gms_size / MiB));
  }
 --
-.41.0
+.48.1

-[PULL 11/13] vfio/migration: Block VFIO migration with postcopy migration
+[PULL 03/21] vfio/igd: Consolidate OpRegion initialization into a single function
-From: Avihai Horon <avihaih@nvidia.com>
+From: Tomita Moeko <tomitamoeko@gmail.com>
-VFIO migration is not compatible with postcopy migration. A VFIO device
+Both x-igd-opregion option and legacy mode require identical steps to
-in the destination can't handle page faults for pages that have not been
+set up OpRegion for IGD devices. Consolidate these steps into a single
-sent yet.
+vfio_pci_igd_setup_opregion function.
-Doing such migration will cause the VM to crash in the destination:
+The function call in pci.c is wrapped with ifdef temporarily to prevent
+build error for non-x86 archs, it will be removed after we decouple it
-qemu-system-x86_64: VFIO_MAP_DMA failed: Bad address
+from legacy mode.
-qemu-system-x86_64: vfio_dma_map(0x55a28c7659d0, 0xc0000, 0xb000, 0x7f1b11a00000) = -14 (Bad address)
-qemu: hardware error: vfio: DMA mapping failed, unable to continue
+Additionally, move vfio_pci_igd_opregion_init to igd.c to prevent it
+from being compiled in non-x86 builds.
-To prevent this, block VFIO migration with postcopy migration.
+Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
-Reported-by: Yanghang Liu <yanghliu@redhat.com>
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
-Signed-off-by: Avihai Horon <avihaih@nvidia.com>
+Tested-by: Alex Williamson <alex.williamson@redhat.com>
-Tested-by: Yanghang Liu <yanghliu@redhat.com>
+Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
-Reviewed-by: Peter Xu <peterx@redhat.com>
+Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-4-tomitamoeko@gmail.com
 [ clg: Fixed spelling in vfio_pci_igd_setup_opregion() ]
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- hw/vfio/migration.c | 22 ++++++++++++++++++++++
+ hw/vfio/pci.h        |   4 +-
-file changed, 22 insertions(+)
+ hw/vfio/igd.c        | 101 +++++++++++++++++++++++++++++++++++--------
+ hw/vfio/pci-quirks.c |  50 ---------------------
-diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
+ hw/vfio/pci.c        |  22 ++--------
-index XXXXXXX..XXXXXXX 100644
+files changed, 88 insertions(+), 89 deletions(-)
---- a/hw/vfio/migration.c
-+++ b/hw/vfio/migration.c
+diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
-@@ -XXX,XX +XXX,XX @@ static bool vfio_precopy_supported(VFIODevice *vbasedev)
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/vfio/pci.h
- /* ---------------------------------------------------------------------- */
++++ b/hw/vfio/pci.h
+@@ -XXX,XX +XXX,XX @@ int vfio_pci_get_pci_hot_reset_info(VFIOPCIDevice *vdev,
-+static int vfio_save_prepare(void *opaque, Error **errp)
  bool vfio_populate_vga(VFIOPCIDevice *vdev, Error **errp);
 -bool vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
 -                                struct vfio_region_info *info,
 -                                Error **errp);
 +bool vfio_pci_igd_setup_opregion(VFIOPCIDevice *vdev, Error **errp);
  void vfio_display_reset(VFIOPCIDevice *vdev);
  bool vfio_display_probe(VFIOPCIDevice *vdev, Error **errp);
 diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/igd.c
 +++ b/hw/vfio/igd.c
@@ -XXX,XX +XXX,XX @@ static int igd_gen(VFIOPCIDevice *vdev)
      return -1;
  }
 +#define IGD_ASLS 0xfc /* ASL Storage Register */
  #define IGD_GMCH 0x50 /* Graphics Control Register */
  #define IGD_BDSM 0x5c /* Base Data of Stolen Memory */
  #define IGD_BDSM_GEN11 0xc0 /* Base Data of Stolen Memory of gen 11 and later */
@@ -XXX,XX +XXX,XX @@ static uint64_t igd_stolen_memory_size(int gen, uint32_t gmch)
      return 0;
  }
 +/*
 + * The OpRegion includes the Video BIOS Table, which seems important for
 + * telling the driver what sort of outputs it has.  Without this, the device
 + * may work in the guest, but we may not get output.  This also requires BIOS
 + * support to reserve and populate a section of guest memory sufficient for
 + * the table and to write the base address of that memory to the ASLS register
 + * of the IGD device.
 + */
 +static bool vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
 +                                       struct vfio_region_info *info,
 +                                       Error **errp)
 +{
-+    VFIODevice *vbasedev = opaque;
++    int ret;
 +
 +    vdev->igd_opregion = g_malloc0(info->size);
 +    ret = pread(vdev->vbasedev.fd, vdev->igd_opregion,
 +                info->size, info->offset);
 +    if (ret != info->size) {
 +        error_setg(errp, "failed to read IGD OpRegion");
 +        g_free(vdev->igd_opregion);
 +        vdev->igd_opregion = NULL;
 +        return false;
 +    }
 +
 +    /*
-+     * Snapshot doesn't use postcopy, so allow snapshot even if postcopy is on.
++     * Provide fw_cfg with a copy of the OpRegion which the VM firmware is to
 +     * allocate 32bit reserved memory for, copy these contents into, and write
 +     * the reserved memory base address to the device ASLS register at 0xFC.
 +     * Alignment of this reserved region seems flexible, but using a 4k page
 +     * alignment seems to work well.  This interface assumes a single IGD
 +     * device, which may be at VM address 00:02.0 in legacy mode or another
 +     * address in UPT mode.
 +     *
 +     * NB, there may be future use cases discovered where the VM should have
 +     * direct interaction with the host OpRegion, in which case the write to
 +     * the ASLS register would trigger MemoryRegion setup to enable that.
 +     */
-+    if (runstate_check(RUN_STATE_SAVE_VM)) {
++    fw_cfg_add_file(fw_cfg_find(), "etc/igd-opregion",
-+        return 0;
++                    vdev->igd_opregion, info->size);
-+    }
++
-+
++    trace_vfio_pci_igd_opregion_enabled(vdev->vbasedev.name);
-+    if (migrate_postcopy_ram()) {
++
-+        error_setg(
++    pci_set_long(vdev->pdev.config + IGD_ASLS, 0);
-+            errp, "%s: VFIO migration is not supported with postcopy migration",
++    pci_set_long(vdev->pdev.wmask + IGD_ASLS, ~0);
-+            vbasedev->name);
++    pci_set_long(vdev->emulated_config_bits + IGD_ASLS, ~0);
-+        return -EOPNOTSUPP;
++
-+    }
++    return true;
 +
 +    return 0;
 +}
 +
- static int vfio_save_setup(QEMUFile *f, void *opaque)
++bool vfio_pci_igd_setup_opregion(VFIOPCIDevice *vdev, Error **errp)
 +{
 +    g_autofree struct vfio_region_info *opregion = NULL;
 +    int ret;
 +
 +    /* Hotplugging is not supported for opregion access */
 +    if (vdev->pdev.qdev.hotplugged) {
 +        error_setg(errp, "IGD OpRegion is not supported on hotplugged device");
 +        return false;
 +    }
 +
 +    ret = vfio_get_dev_region_info(&vdev->vbasedev,
 +                    VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
 +                    VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, &opregion);
 +    if (ret) {
 +        error_setg_errno(errp, -ret,
 +                         "Device does not supports IGD OpRegion feature");
 +        return false;
 +    }
 +
 +    if (!vfio_pci_igd_opregion_init(vdev, opregion, errp)) {
 +        return false;
 +    }
 +
 +    return true;
 +}
 +
  /*
   * The rather short list of registers that we copy from the host devices.
   * The LPC/ISA bridge values are definitely needed to support the vBIOS, the
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
  void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
  {
-     VFIODevice *vbasedev = opaque;
+     g_autofree struct vfio_region_info *rom = NULL;
-@@ -XXX,XX +XXX,XX @@ static bool vfio_switchover_ack_needed(void *opaque)
+-    g_autofree struct vfio_region_info *opregion = NULL;
      g_autofree struct vfio_region_info *host = NULL;
      g_autofree struct vfio_region_info *lpc = NULL;
      PCIDevice *lpc_bridge;
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
       * Check whether we have all the vfio device specific regions to
       * support legacy mode (added in Linux v4.6).  If not, bail.
       */
 -    ret = vfio_get_dev_region_info(&vdev->vbasedev,
 -                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
 -                        VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, &opregion);
 -    if (ret) {
 -        error_report("IGD device %s does not support OpRegion access,"
 -                     "legacy mode disabled", vdev->vbasedev.name);
 -        return;
 -    }
 -
      ret = vfio_get_dev_region_info(&vdev->vbasedev,
                          VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
                          VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG, &host);
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
          return;
      }
 +    /* Setup OpRegion access */
 +    if (!vfio_pci_igd_setup_opregion(vdev, &err)) {
 +        error_append_hint(&err, "IGD legacy mode disabled\n");
 +        error_report_err(err);
 +        return;
 +    }
 +
      /* Create our LPC/ISA bridge */
      ret = vfio_pci_igd_lpc_init(vdev, lpc);
      if (ret) {
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
          return;
      }
 -    /* Setup OpRegion access */
 -    if (!vfio_pci_igd_opregion_init(vdev, opregion, &err)) {
 -        error_append_hint(&err, "IGD legacy mode disabled\n");
 -        error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
 -        return;
 -    }
 -
      /*
       * Allow user to override dsm size using x-igd-gms option, in multiples of
       * 32MiB. This option should only be used when the desired size cannot be
 diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/pci-quirks.c
 +++ b/hw/vfio/pci-quirks.c
@@ -XXX,XX +XXX,XX @@ static void vfio_probe_rtl8168_bar2_quirk(VFIOPCIDevice *vdev, int nr)
      trace_vfio_quirk_rtl8168_probe(vdev->vbasedev.name);
  }
- static const SaveVMHandlers savevm_vfio_handlers = {
+-#define IGD_ASLS 0xfc /* ASL Storage Register */
-+    .save_prepare = vfio_save_prepare,
+-
-     .save_setup = vfio_save_setup,
+-/*
-     .save_cleanup = vfio_save_cleanup,
+- * The OpRegion includes the Video BIOS Table, which seems important for
-     .state_pending_estimate = vfio_state_pending_estimate,
+- * telling the driver what sort of outputs it has.  Without this, the device
 - * may work in the guest, but we may not get output.  This also requires BIOS
 - * support to reserve and populate a section of guest memory sufficient for
 - * the table and to write the base address of that memory to the ASLS register
 - * of the IGD device.
 - */
 -bool vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
 -                                struct vfio_region_info *info, Error **errp)
 -{
 -    int ret;
 -
 -    vdev->igd_opregion = g_malloc0(info->size);
 -    ret = pread(vdev->vbasedev.fd, vdev->igd_opregion,
 -                info->size, info->offset);
 -    if (ret != info->size) {
 -        error_setg(errp, "failed to read IGD OpRegion");
 -        g_free(vdev->igd_opregion);
 -        vdev->igd_opregion = NULL;
 -        return false;
 -    }
 -
 -    /*
 -     * Provide fw_cfg with a copy of the OpRegion which the VM firmware is to
 -     * allocate 32bit reserved memory for, copy these contents into, and write
 -     * the reserved memory base address to the device ASLS register at 0xFC.
 -     * Alignment of this reserved region seems flexible, but using a 4k page
 -     * alignment seems to work well.  This interface assumes a single IGD
 -     * device, which may be at VM address 00:02.0 in legacy mode or another
 -     * address in UPT mode.
 -     *
 -     * NB, there may be future use cases discovered where the VM should have
 -     * direct interaction with the host OpRegion, in which case the write to
 -     * the ASLS register would trigger MemoryRegion setup to enable that.
 -     */
 -    fw_cfg_add_file(fw_cfg_find(), "etc/igd-opregion",
 -                    vdev->igd_opregion, info->size);
 -
 -    trace_vfio_pci_igd_opregion_enabled(vdev->vbasedev.name);
 -
 -    pci_set_long(vdev->pdev.config + IGD_ASLS, 0);
 -    pci_set_long(vdev->pdev.wmask + IGD_ASLS, ~0);
 -    pci_set_long(vdev->emulated_config_bits + IGD_ASLS, ~0);
 -
 -    return true;
 -}
 -
  /*
   * Common quirk probe entry points.
   */
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
@@ -XXX,XX +XXX,XX @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
          vfio_bar_quirk_setup(vdev, i);
      }
 +#ifdef CONFIG_VFIO_IGD
      if (!vdev->igd_opregion &&
          vdev->features & VFIO_FEATURE_ENABLE_IGD_OPREGION) {
 -        g_autofree struct vfio_region_info *opregion = NULL;
 -
 -        if (vdev->pdev.qdev.hotplugged) {
 -            error_setg(errp,
 -                       "cannot support IGD OpRegion feature on hotplugged "
 -                       "device");
 -            goto out_unset_idev;
 -        }
 -
 -        ret = vfio_get_dev_region_info(vbasedev,
 -                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
 -                        VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, &opregion);
 -        if (ret) {
 -            error_setg_errno(errp, -ret,
 -                             "does not support requested IGD OpRegion feature");
 -            goto out_unset_idev;
 -        }
 -
 -        if (!vfio_pci_igd_opregion_init(vdev, opregion, errp)) {
 +        if (!vfio_pci_igd_setup_opregion(vdev, errp)) {
              goto out_unset_idev;
          }
      }
 +#endif
      /* QEMU emulates all of MSI & MSIX */
      if (pdev->cap_present & QEMU_PCI_CAP_MSIX) {
 --
-.41.0
+.48.1

-[PULL 05/13] vfio/migration: Add P2P support for VFIO migration
+[PULL 04/21] vfio/igd: Move LPC bridge initialization to a separate function
-From: Avihai Horon <avihaih@nvidia.com>
+From: Tomita Moeko <tomitamoeko@gmail.com>
-VFIO migration uAPI defines an optional intermediate P2P quiescent
+A new option will soon be introduced to decouple the LPC bridge/Host
-state. While in the P2P quiescent state, P2P DMA transactions cannot be
+bridge ID quirk from legacy mode. To prepare for this, move the LPC
-initiated by the device, but the device can respond to incoming ones.
+bridge initialization into a separate function.
 Additionally, all outstanding P2P transactions are guaranteed to have
 been completed by the time the device enters this state.
-The purpose of this state is to support migration of multiple devices
+Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
-that might do P2P transactions between themselves.
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
+Tested-by: Alex Williamson <alex.williamson@redhat.com>
-Add support for P2P migration by transitioning all the devices to the
+Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
-P2P quiescent state before stopping or starting the devices. Use the new
+Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-5-tomitamoeko@gmail.com
 VMChangeStateHandler prepare_cb to achieve that behavior.
 This will allow migration of multiple VFIO devices if all of them
 support P2P migration.
 Signed-off-by: Avihai Horon <avihaih@nvidia.com>
 Tested-by: YangHang Liu <yanghliu@redhat.com>
 Reviewed-by: Cédric Le Goater <clg@redhat.com>
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- docs/devel/vfio-migration.rst | 93 +++++++++++++++++++++--------------
+ hw/vfio/igd.c | 122 +++++++++++++++++++++++++++++---------------------
- hw/vfio/common.c              |  6 ++-
+file changed, 70 insertions(+), 52 deletions(-)
  hw/vfio/migration.c           | 46 +++++++++++++++--
  hw/vfio/trace-events          |  1 +
 files changed, 105 insertions(+), 41 deletions(-)
-diff --git a/docs/devel/vfio-migration.rst b/docs/devel/vfio-migration.rst
+diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/devel/vfio-migration.rst
+--- a/hw/vfio/igd.c
-+++ b/docs/devel/vfio-migration.rst
++++ b/hw/vfio/igd.c
-@@ -XXX,XX +XXX,XX @@ and recommends that the initial bytes are sent and loaded in the destination
+@@ -XXX,XX +XXX,XX @@ static int vfio_pci_igd_lpc_init(VFIOPCIDevice *vdev,
- before stopping the source VM. Enabling this migration capability will
+     return ret;
  guarantee that and thus, can potentially reduce downtime even further.
 -Note that currently VFIO migration is supported only for a single device. This
 -is due to VFIO migration's lack of P2P support. However, P2P support is planned
 -to be added later on.
 +To support migration of multiple devices that might do P2P transactions between
 +themselves, VFIO migration uAPI defines an intermediate P2P quiescent state.
 +While in the P2P quiescent state, P2P DMA transactions cannot be initiated by
 +the device, but the device can respond to incoming ones. Additionally, all
 +outstanding P2P transactions are guaranteed to have been completed by the time
 +the device enters this state.
 +
 +All the devices that support P2P migration are first transitioned to the P2P
 +quiescent state and only then are they stopped or started. This makes migration
 +safe P2P-wise, since starting and stopping the devices is not done atomically
 +for all the devices together.
 +
 +Thus, multiple VFIO devices migration is allowed only if all the devices
 +support P2P migration. Single VFIO device migration is allowed regardless of
 +P2P migration support.
  A detailed description of the UAPI for VFIO device migration can be found in
  the comment for the ``vfio_device_mig_state`` structure in the header file
@@ -XXX,XX +XXX,XX @@ will be blocked.
  Flow of state changes during Live migration
  ===========================================
 -Below is the flow of state change during live migration.
 +Below is the state change flow during live migration for a VFIO device that
 +supports both precopy and P2P migration. The flow for devices that don't
 +support it is similar, except that the relevant states for precopy and P2P are
 +skipped.
  The values in the parentheses represent the VM state, the migration state, and
  the VFIO device state, respectively.
 -The text in the square brackets represents the flow if the VFIO device supports
 -pre-copy.
  Live migration save path
  ------------------------
  ::
 -                        QEMU normal running state
 -                        (RUNNING, _NONE, _RUNNING)
 -                                  |
 +                           QEMU normal running state
 +                           (RUNNING, _NONE, _RUNNING)
 +                                      |
                       migrate_init spawns migration_thread
 -                Migration thread then calls each device's .save_setup()
 -                  (RUNNING, _SETUP, _RUNNING [_PRE_COPY])
 -                                  |
 -                  (RUNNING, _ACTIVE, _RUNNING [_PRE_COPY])
 -      If device is active, get pending_bytes by .state_pending_{estimate,exact}()
 -          If total pending_bytes >= threshold_size, call .save_live_iterate()
 -                  [Data of VFIO device for pre-copy phase is copied]
 -        Iterate till total pending bytes converge and are less than threshold
 -                                  |
 -  On migration completion, vCPU stops and calls .save_live_complete_precopy for
 -  each active device. The VFIO device is then transitioned into _STOP_COPY state
 -                  (FINISH_MIGRATE, _DEVICE, _STOP_COPY)
 -                                  |
 -     For the VFIO device, iterate in .save_live_complete_precopy until
 -                         pending data is 0
 -                   (FINISH_MIGRATE, _DEVICE, _STOP)
 -                                  |
 -                 (FINISH_MIGRATE, _COMPLETED, _STOP)
 -             Migraton thread schedules cleanup bottom half and exits
 +            Migration thread then calls each device's .save_setup()
 +                          (RUNNING, _SETUP, _PRE_COPY)
 +                                      |
 +                         (RUNNING, _ACTIVE, _PRE_COPY)
 +  If device is active, get pending_bytes by .state_pending_{estimate,exact}()
 +       If total pending_bytes >= threshold_size, call .save_live_iterate()
 +                Data of VFIO device for pre-copy phase is copied
 +      Iterate till total pending bytes converge and are less than threshold
 +                                      |
 +       On migration completion, the vCPUs and the VFIO device are stopped
 +              The VFIO device is first put in P2P quiescent state
 +                    (FINISH_MIGRATE, _ACTIVE, _PRE_COPY_P2P)
 +                                      |
 +                Then the VFIO device is put in _STOP_COPY state
 +                     (FINISH_MIGRATE, _ACTIVE, _STOP_COPY)
 +         .save_live_complete_precopy() is called for each active device
 +      For the VFIO device, iterate in .save_live_complete_precopy() until
 +                               pending data is 0
 +                                      |
 +                     (POSTMIGRATE, _COMPLETED, _STOP_COPY)
 +            Migraton thread schedules cleanup bottom half and exits
 +                                      |
 +                           .save_cleanup() is called
 +                        (POSTMIGRATE, _COMPLETED, _STOP)
  Live migration resume path
  --------------------------
  ::
 -              Incoming migration calls .load_setup for each device
 -                       (RESTORE_VM, _ACTIVE, _STOP)
 -                                 |
 -       For each device, .load_state is called for that device section data
 -                       (RESTORE_VM, _ACTIVE, _RESUMING)
 -                                 |
 -    At the end, .load_cleanup is called for each device and vCPUs are started
 -                       (RUNNING, _NONE, _RUNNING)
 +             Incoming migration calls .load_setup() for each device
 +                          (RESTORE_VM, _ACTIVE, _STOP)
 +                                      |
 +     For each device, .load_state() is called for that device section data
 +                        (RESTORE_VM, _ACTIVE, _RESUMING)
 +                                      |
 +  At the end, .load_cleanup() is called for each device and vCPUs are started
 +              The VFIO device is first put in P2P quiescent state
 +                        (RUNNING, _ACTIVE, _RUNNING_P2P)
 +                                      |
 +                           (RUNNING, _NONE, _RUNNING)
  Postcopy
  ========
 diff --git a/hw/vfio/common.c b/hw/vfio/common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/common.c
 +++ b/hw/vfio/common.c
@@ -XXX,XX +XXX,XX @@ bool vfio_device_state_is_running(VFIODevice *vbasedev)
  {
      VFIOMigration *migration = vbasedev->migration;
 -    return migration->device_state == VFIO_DEVICE_STATE_RUNNING;
 +    return migration->device_state == VFIO_DEVICE_STATE_RUNNING ||
 +           migration->device_state == VFIO_DEVICE_STATE_RUNNING_P2P;
  }
- bool vfio_device_state_is_precopy(VFIODevice *vbasedev)
++static bool vfio_pci_igd_setup_lpc_bridge(VFIOPCIDevice *vdev, Error **errp)
  {
      VFIOMigration *migration = vbasedev->migration;
 -    return migration->device_state == VFIO_DEVICE_STATE_PRE_COPY;
 +    return migration->device_state == VFIO_DEVICE_STATE_PRE_COPY ||
 +           migration->device_state == VFIO_DEVICE_STATE_PRE_COPY_P2P;
  }
  static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
 diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/migration.c
 +++ b/hw/vfio/migration.c
@@ -XXX,XX +XXX,XX @@ static const char *mig_state_to_str(enum vfio_device_mig_state state)
          return "STOP_COPY";
      case VFIO_DEVICE_STATE_RESUMING:
          return "RESUMING";
 +    case VFIO_DEVICE_STATE_RUNNING_P2P:
 +        return "RUNNING_P2P";
      case VFIO_DEVICE_STATE_PRE_COPY:
          return "PRE_COPY";
 +    case VFIO_DEVICE_STATE_PRE_COPY_P2P:
 +        return "PRE_COPY_P2P";
      default:
          return "UNKNOWN STATE";
      }
@@ -XXX,XX +XXX,XX @@ static const SaveVMHandlers savevm_vfio_handlers = {
  /* ---------------------------------------------------------------------- */
 +static void vfio_vmstate_change_prepare(void *opaque, bool running,
 +                                        RunState state)
 +{
-+    VFIODevice *vbasedev = opaque;
++    g_autofree struct vfio_region_info *host = NULL;
-+    VFIOMigration *migration = vbasedev->migration;
++    g_autofree struct vfio_region_info *lpc = NULL;
-+    enum vfio_device_mig_state new_state;
++    PCIDevice *lpc_bridge;
 +    int ret;
 +
-+    new_state = migration->device_state == VFIO_DEVICE_STATE_PRE_COPY ?
++    /*
-+                    VFIO_DEVICE_STATE_PRE_COPY_P2P :
++     * Copying IDs or creating new devices are not supported on hotplug
-+                    VFIO_DEVICE_STATE_RUNNING_P2P;
++     */
 +    if (vdev->pdev.qdev.hotplugged) {
 +        error_setg(errp, "IGD LPC is not supported on hotplugged device");
 +        return false;
 +    }
 +
 +    /*
-+     * If setting the device in new_state fails, the device should be reset.
++     * We need to create an LPC/ISA bridge at PCI bus address 00:1f.0 that we
-+     * To do so, use ERROR state as a recover state.
++     * can stuff host values into, so if there's already one there and it's not
 +     * one we can hack on, this quirk is no-go.  Sorry Q35.
 +     */
-+    ret = vfio_migration_set_state(vbasedev, new_state,
++    lpc_bridge = pci_find_device(pci_device_root_bus(&vdev->pdev),
-+                                   VFIO_DEVICE_STATE_ERROR);
++                                 0, PCI_DEVFN(0x1f, 0));
-+    if (ret) {
++    if (lpc_bridge && !object_dynamic_cast(OBJECT(lpc_bridge),
-+        /*
++                                           "vfio-pci-igd-lpc-bridge")) {
-+         * Migration should be aborted in this case, but vm_state_notify()
++        error_setg(errp,
-+         * currently does not support reporting failures.
++                   "Cannot create LPC bridge due to existing device at 1f.0");
-+         */
++        return false;
 +        if (migrate_get_current()->to_dst_file) {
 +            qemu_file_set_error(migrate_get_current()->to_dst_file, ret);
 +        }
 +    }
 +
-+    trace_vfio_vmstate_change_prepare(vbasedev->name, running,
++    /*
-+                                      RunState_str(state),
++     * Check whether we have all the vfio device specific regions to
-+                                      mig_state_to_str(new_state));
++     * support LPC quirk (added in Linux v4.6).
 +     */
 +    ret = vfio_get_dev_region_info(&vdev->vbasedev,
 +                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
 +                        VFIO_REGION_SUBTYPE_INTEL_IGD_LPC_CFG, &lpc);
 +    if (ret) {
 +        error_setg(errp, "IGD LPC bridge access is not supported by kernel");
 +        return false;
 +    }
 +
 +    ret = vfio_get_dev_region_info(&vdev->vbasedev,
 +                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
 +                        VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG, &host);
 +    if (ret) {
 +        error_setg(errp, "IGD host bridge access is not supported by kernel");
 +        return false;
 +    }
 +
 +    /* Create/modify LPC bridge */
 +    ret = vfio_pci_igd_lpc_init(vdev, lpc);
 +    if (ret) {
 +        error_setg(errp, "Failed to create/modify LPC bridge for IGD");
 +        return false;
 +    }
 +
 +    /* Stuff some host values into the VM PCI host bridge */
 +    ret = vfio_pci_igd_host_init(vdev, host);
 +    if (ret) {
 +        error_setg(errp, "Failed to modify host bridge for IGD");
 +        return false;
 +    }
 +
 +    return true;
 +}
 +
- static void vfio_vmstate_change(void *opaque, bool running, RunState state)
+ #define IGD_GGC_MMIO_OFFSET     0x108040
  #define IGD_BDSM_MMIO_OFFSET    0x1080C0
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
  void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
  {
-     VFIODevice *vbasedev = opaque;
+     g_autofree struct vfio_region_info *rom = NULL;
-@@ -XXX,XX +XXX,XX @@ static int vfio_migration_init(VFIODevice *vbasedev)
+-    g_autofree struct vfio_region_info *host = NULL;
-     char id[256] = "";
+-    g_autofree struct vfio_region_info *lpc = NULL;
-     g_autofree char *path = NULL, *oid = NULL;
+-    PCIDevice *lpc_bridge;
-     uint64_t mig_flags = 0;
+     int ret, gen;
-+    VMChangeStateHandler *prepare_cb;
+     uint64_t gms_size;
+     uint64_t *bdsm_size;
-     if (!vbasedev->ops->vfio_get_object) {
+@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
-         return -EINVAL;
+         return;
-@@ -XXX,XX +XXX,XX @@ static int vfio_migration_init(VFIODevice *vbasedev)
+     }
-     register_savevm_live(id, VMSTATE_INSTANCE_ID_ANY, 1, &savevm_vfio_handlers,
-                          vbasedev);
+-    /*
+-     * We need to create an LPC/ISA bridge at PCI bus address 00:1f.0 that we
--    migration->vm_state = qdev_add_vm_change_state_handler(vbasedev->dev,
+-     * can stuff host values into, so if there's already one there and it's not
--                                                           vfio_vmstate_change,
+-     * one we can hack on, legacy mode is no-go.  Sorry Q35.
--                                                           vbasedev);
+-     */
-+    prepare_cb = migration->mig_flags & VFIO_MIGRATION_P2P ?
+-    lpc_bridge = pci_find_device(pci_device_root_bus(&vdev->pdev),
-+                     vfio_vmstate_change_prepare :
+-                                 0, PCI_DEVFN(0x1f, 0));
-+                     NULL;
+-    if (lpc_bridge && !object_dynamic_cast(OBJECT(lpc_bridge),
-+    migration->vm_state = qdev_add_vm_change_state_handler_full(
+-                                           "vfio-pci-igd-lpc-bridge")) {
-+        vbasedev->dev, vfio_vmstate_change, prepare_cb, vbasedev);
+-        error_report("IGD device %s cannot support legacy mode due to existing "
-     migration->migration_state.notify = vfio_migration_state_notifier;
+-                     "devices at address 1f.0", vdev->vbasedev.name);
-     add_migration_state_change_notifier(&migration->migration_state);
+-        return;
+-    }
-diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
+-
-index XXXXXXX..XXXXXXX 100644
+     /*
---- a/hw/vfio/trace-events
+      * IGD is not a standard, they like to change their specs often.  We
-+++ b/hw/vfio/trace-events
+      * only attempt to support back to SandBridge and we hope that newer
-@@ -XXX,XX +XXX,XX @@ vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer
+@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
- vfio_state_pending_estimate(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy 0x%"PRIx64" postcopy 0x%"PRIx64" precopy initial size 0x%"PRIx64" precopy dirty size 0x%"PRIx64
+         return;
- vfio_state_pending_exact(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy 0x%"PRIx64" postcopy 0x%"PRIx64" stopcopy size 0x%"PRIx64" precopy initial size 0x%"PRIx64" precopy dirty size 0x%"PRIx64
+     }
- vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
-+vfio_vmstate_change_prepare(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
+-    /*
 -     * Check whether we have all the vfio device specific regions to
 -     * support legacy mode (added in Linux v4.6).  If not, bail.
 -     */
 -    ret = vfio_get_dev_region_info(&vdev->vbasedev,
 -                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
 -                        VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG, &host);
 -    if (ret) {
 -        error_report("IGD device %s does not support host bridge access,"
 -                     "legacy mode disabled", vdev->vbasedev.name);
 -        return;
 -    }
 -
 -    ret = vfio_get_dev_region_info(&vdev->vbasedev,
 -                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
 -                        VFIO_REGION_SUBTYPE_INTEL_IGD_LPC_CFG, &lpc);
 -    if (ret) {
 -        error_report("IGD device %s does not support LPC bridge access,"
 -                     "legacy mode disabled", vdev->vbasedev.name);
 -        return;
 -    }
 -
      gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, 4);
      /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
          return;
      }
 -    /* Create our LPC/ISA bridge */
 -    ret = vfio_pci_igd_lpc_init(vdev, lpc);
 -    if (ret) {
 -        error_report("IGD device %s failed to create LPC bridge, "
 -                     "legacy mode disabled", vdev->vbasedev.name);
 -        return;
 -    }
 -
 -    /* Stuff some host values into the VM PCI host bridge */
 -    ret = vfio_pci_igd_host_init(vdev, host);
 -    if (ret) {
 -        error_report("IGD device %s failed to modify host bridge, "
 -                     "legacy mode disabled", vdev->vbasedev.name);
 +    /* Setup LPC bridge / Host bridge PCI IDs */
 +    if (!vfio_pci_igd_setup_lpc_bridge(vdev, &err)) {
 +        error_append_hint(&err, "IGD legacy mode disabled\n");
 +        error_report_err(err);
          return;
      }
 --
-.41.0
+.48.1

-[PULL 12/13] vfio/migration: Block VFIO migration with background snapshot
+[PULL 05/21] vfio/pci: Add placeholder for device-specific config space quirks
-From: Avihai Horon <avihaih@nvidia.com>
+From: Tomita Moeko <tomitamoeko@gmail.com>
-Background snapshot allows creating a snapshot of the VM while it's
+IGD devices require device-specific quirk to be applied to their PCI
-running and keeping it small by not including dirty RAM pages.
+config space. Currently, it is put in the BAR4 quirk that does nothing
 to BAR4 itself. Add a placeholder for PCI config space quirks to hold
 that quirk later.
-The way it works is by first stopping the VM, saving the non-iterable
+Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
-devices' state and then starting the VM and saving the RAM while write
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
-protecting it with UFFD. The resulting snapshot represents the VM state
+Tested-by: Alex Williamson <alex.williamson@redhat.com>
-at snapshot start.
+Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
+Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-6-tomitamoeko@gmail.com
 VFIO migration is not compatible with background snapshot.
 First of all, VFIO device state is not even saved in background snapshot
 because only non-iterable device state is saved. But even if it was
 saved, after starting the VM, a VFIO device could dirty pages without it
 being detected by UFFD write protection. This would corrupt the
 snapshot, as the RAM in it would not represent the RAM at snapshot
 start.
 To prevent this, block VFIO migration with background snapshot.
 Signed-off-by: Avihai Horon <avihaih@nvidia.com>
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- hw/vfio/migration.c | 11 ++++++++++-
+ hw/vfio/pci.h        | 1 +
-file changed, 10 insertions(+), 1 deletion(-)
+ hw/vfio/pci-quirks.c | 5 +++++
  hw/vfio/pci.c        | 4 ++++
 files changed, 10 insertions(+)
-diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
+diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/vfio/migration.c
+--- a/hw/vfio/pci.h
-+++ b/hw/vfio/migration.c
++++ b/hw/vfio/pci.h
-@@ -XXX,XX +XXX,XX @@ static int vfio_save_prepare(void *opaque, Error **errp)
+@@ -XXX,XX +XXX,XX @@ uint64_t vfio_vga_read(void *opaque, hwaddr addr, unsigned size);
-     VFIODevice *vbasedev = opaque;
+ void vfio_vga_write(void *opaque, hwaddr addr, uint64_t data, unsigned size);
-     /*
+ bool vfio_opt_rom_in_denylist(VFIOPCIDevice *vdev);
--     * Snapshot doesn't use postcopy, so allow snapshot even if postcopy is on.
++bool vfio_config_quirk_setup(VFIOPCIDevice *vdev, Error **errp);
-+     * Snapshot doesn't use postcopy nor background snapshot, so allow snapshot
+ void vfio_vga_quirk_setup(VFIOPCIDevice *vdev);
-+     * even if they are on.
+ void vfio_vga_quirk_exit(VFIOPCIDevice *vdev);
-      */
+ void vfio_vga_quirk_finalize(VFIOPCIDevice *vdev);
-     if (runstate_check(RUN_STATE_SAVE_VM)) {
+diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
-         return 0;
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static int vfio_save_prepare(void *opaque, Error **errp)
+--- a/hw/vfio/pci-quirks.c
-         return -EOPNOTSUPP;
++++ b/hw/vfio/pci-quirks.c
@@ -XXX,XX +XXX,XX @@ static void vfio_probe_rtl8168_bar2_quirk(VFIOPCIDevice *vdev, int nr)
  /*
   * Common quirk probe entry points.
   */
 +bool vfio_config_quirk_setup(VFIOPCIDevice *vdev, Error **errp)
 +{
 +    return true;
 +}
 +
  void vfio_vga_quirk_setup(VFIOPCIDevice *vdev)
  {
      vfio_vga_probe_ati_3c3_quirk(vdev);
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
@@ -XXX,XX +XXX,XX @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
          goto out_unset_idev;
      }
-+    if (migrate_background_snapshot()) {
++    if (!vfio_config_quirk_setup(vdev, errp)) {
-+        error_setg(
++        goto out_unset_idev;
 +            errp,
 +            "%s: VFIO migration is not supported with background snapshot",
 +            vbasedev->name);
 +        return -EOPNOTSUPP;
 +    }
 +
-     return 0;
+     if (vdev->vga) {
- }
+         vfio_vga_quirk_setup(vdev);
+     }
 --
-.41.0
+.48.1

-[PULL 07/13] migration: Add migration prefix to functions in target.c
+[PULL 06/21] vfio/igd: Refactor vfio_probe_igd_bar4_quirk into pci config quirk
-From: Avihai Horon <avihaih@nvidia.com>
+From: Tomita Moeko <tomitamoeko@gmail.com>
-The functions in target.c are not static, yet they don't have a proper
+The actual IO BAR4 write quirk in vfio_probe_igd_bar4_quirk was removed
-migration prefix. Add such prefix.
+in previous change, leaving the function not matching its name, so move
 it into the newly introduced vfio_config_quirk_setup. There is no
 functional change in this commit.
-Signed-off-by: Avihai Horon <avihaih@nvidia.com>
+For now, to align with current legacy mode behavior, it returns and
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
+proceeds on error. Later it will fail on error after decoupling the
 quirks from legacy mode.
 Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
 Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
 Tested-by: Alex Williamson <alex.williamson@redhat.com>
 Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
 Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-7-tomitamoeko@gmail.com
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- migration/migration.h | 4 ++--
+ hw/vfio/pci.h        |  2 +-
- migration/migration.c | 6 +++---
+ hw/vfio/igd.c        | 21 ++++++++++++---------
- migration/savevm.c    | 2 +-
+ hw/vfio/pci-quirks.c |  6 +++++-
- migration/target.c    | 8 ++++----
+files changed, 18 insertions(+), 11 deletions(-)
 files changed, 10 insertions(+), 10 deletions(-)
-diff --git a/migration/migration.h b/migration/migration.h
+diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
 index XXXXXXX..XXXXXXX 100644
---- a/migration/migration.h
+--- a/hw/vfio/pci.h
-+++ b/migration/migration.h
++++ b/hw/vfio/pci.h
-@@ -XXX,XX +XXX,XX @@ void migration_consume_urgent_request(void);
+@@ -XXX,XX +XXX,XX @@ bool vfio_add_virt_caps(VFIOPCIDevice *vdev, Error **errp);
- bool migration_rate_limit(void);
+ void vfio_quirk_reset(VFIOPCIDevice *vdev);
- void migration_cancel(const Error *error);
+ VFIOQuirk *vfio_quirk_alloc(int nr_mem);
+ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr);
--void populate_vfio_info(MigrationInfo *info);
+-void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr);
--void reset_vfio_bytes_transferred(void);
++bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp);
-+void migration_populate_vfio_info(MigrationInfo *info);
-+void migration_reset_vfio_bytes_transferred(void);
+ extern const PropertyInfo qdev_prop_nv_gpudirect_clique;
- void postcopy_temp_page_reset(PostcopyTmpPage *tmp_page);
+diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
  #endif
 diff --git a/migration/migration.c b/migration/migration.c
 index XXXXXXX..XXXXXXX 100644
---- a/migration/migration.c
+--- a/hw/vfio/igd.c
-+++ b/migration/migration.c
++++ b/hw/vfio/igd.c
-@@ -XXX,XX +XXX,XX @@ static void fill_source_migration_info(MigrationInfo *info)
+@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
-         populate_time_info(info, s);
+     QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, bdsm_quirk, next);
-         populate_ram_info(info, s);
+ }
-         populate_disk_info(info);
--        populate_vfio_info(info);
+-void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
-+        migration_populate_vfio_info(info);
++bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev,
-         break;
++                                 Error **errp G_GNUC_UNUSED)
-     case MIGRATION_STATUS_COLO:
+ {
-         info->has_status = true;
+     g_autofree struct vfio_region_info *rom = NULL;
-@@ -XXX,XX +XXX,XX @@ static void fill_source_migration_info(MigrationInfo *info)
+     int ret, gen;
-     case MIGRATION_STATUS_COMPLETED:
+@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
-         populate_time_info(info, s);
+      * PCI bus address.
          populate_ram_info(info, s);
 -        populate_vfio_info(info);
 +        migration_populate_vfio_info(info);
          break;
      case MIGRATION_STATUS_FAILED:
          info->has_status = true;
@@ -XXX,XX +XXX,XX @@ static bool migrate_prepare(MigrationState *s, bool blk, bool blk_inc,
       */
-     memset(&mig_stats, 0, sizeof(mig_stats));
+     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
-     memset(&compression_counters, 0, sizeof(compression_counters));
+-        !vfio_is_vga(vdev) || nr != 4 ||
--    reset_vfio_bytes_transferred();
++        !vfio_is_vga(vdev) ||
-+    migration_reset_vfio_bytes_transferred();
+         &vdev->pdev != pci_find_device(pci_device_root_bus(&vdev->pdev),
+, PCI_DEVFN(0x2, 0))) {
 -        return;
 +        return true;
      }
      /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
      if (gen == -1) {
          error_report("IGD device %s is unsupported in legacy mode, "
                       "try SandyBridge or newer", vdev->vbasedev.name);
 -        return;
 +        return true;
      }
      /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
      if ((ret || !rom->size) && !vdev->pdev.romfile) {
          error_report("IGD device %s has no ROM, legacy mode disabled",
                       vdev->vbasedev.name);
 -        return;
 +        return true;
      }
      /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
          error_report("IGD device %s hotplugged, ROM disabled, "
                       "legacy mode disabled", vdev->vbasedev.name);
          vdev->rom_read_failed = true;
 -        return;
 +        return true;
      }
      gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, 4);
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
          error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
          error_report("IGD device %s failed to enable VGA access, "
                       "legacy mode disabled", vdev->vbasedev.name);
 -        return;
 +        return true;
      }
      /* Setup OpRegion access */
      if (!vfio_pci_igd_setup_opregion(vdev, &err)) {
          error_append_hint(&err, "IGD legacy mode disabled\n");
          error_report_err(err);
 -        return;
 +        return true;
      }
      /* Setup LPC bridge / Host bridge PCI IDs */
      if (!vfio_pci_igd_setup_lpc_bridge(vdev, &err)) {
          error_append_hint(&err, "IGD legacy mode disabled\n");
          error_report_err(err);
 -        return;
 +        return true;
      }
      /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
      }
      trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name, (gms_size / MiB));
 +
 +    return true;
  }
 diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/pci-quirks.c
 +++ b/hw/vfio/pci-quirks.c
@@ -XXX,XX +XXX,XX @@ static void vfio_probe_rtl8168_bar2_quirk(VFIOPCIDevice *vdev, int nr)
   */
  bool vfio_config_quirk_setup(VFIOPCIDevice *vdev, Error **errp)
  {
 +#ifdef CONFIG_VFIO_IGD
 +    if (!vfio_probe_igd_config_quirk(vdev, errp)) {
 +        return false;
 +    }
 +#endif
      return true;
  }
-diff --git a/migration/savevm.c b/migration/savevm.c
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ void vfio_bar_quirk_setup(VFIOPCIDevice *vdev, int nr)
---- a/migration/savevm.c
+     vfio_probe_rtl8168_bar2_quirk(vdev, nr);
-+++ b/migration/savevm.c
+ #ifdef CONFIG_VFIO_IGD
-@@ -XXX,XX +XXX,XX @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
+     vfio_probe_igd_bar0_quirk(vdev, nr);
-     migrate_init(ms);
+-    vfio_probe_igd_bar4_quirk(vdev, nr);
      memset(&mig_stats, 0, sizeof(mig_stats));
      memset(&compression_counters, 0, sizeof(compression_counters));
 -    reset_vfio_bytes_transferred();
 +    migration_reset_vfio_bytes_transferred();
      ms->to_dst_file = f;
      qemu_mutex_unlock_iothread();
 diff --git a/migration/target.c b/migration/target.c
 index XXXXXXX..XXXXXXX 100644
 --- a/migration/target.c
 +++ b/migration/target.c
@@ -XXX,XX +XXX,XX @@
  #endif
- #ifdef CONFIG_VFIO
--void populate_vfio_info(MigrationInfo *info)
-+void migration_populate_vfio_info(MigrationInfo *info)
- {
-     if (vfio_mig_active()) {
-         info->vfio = g_malloc0(sizeof(*info->vfio));
-@@ -XXX,XX +XXX,XX @@ void populate_vfio_info(MigrationInfo *info)
-     }
  }
--void reset_vfio_bytes_transferred(void)
-+void migration_reset_vfio_bytes_transferred(void)
- {
-     vfio_reset_bytes_transferred();
- }
- #else
--void populate_vfio_info(MigrationInfo *info)
-+void migration_populate_vfio_info(MigrationInfo *info)
- {
- }
--void reset_vfio_bytes_transferred(void)
-+void migration_reset_vfio_bytes_transferred(void)
- {
- }
- #endif
 --
-.41.0
+.48.1

-New patch
+[PULL 07/21] vfio/igd: Decouple common quirks from legacy mode
+From: Tomita Moeko <tomitamoeko@gmail.com>
 So far, IGD-specific quirks all require enabling legacy mode, which is
 toggled by assigning IGD to 00:02.0. However, some quirks, like the BDSM
 and GGC register quirks, should be applied to all supported IGD devices.
 A new config option, x-igd-legacy-mode=[on|off|auto], is introduced to
 control the legacy mode only quirks. The default value is "auto", which
 keeps current behavior that enables legacy mode implicitly and continues
 on error when all following conditions are met.
 * Machine type is i440fx
 * IGD device is at guest BDF 00:02.0
 If any one of the conditions above is not met, the default behavior is
 equivalent to "off", QEMU will fail immediately if any error occurs.
 Users can also use "on" to force enabling legacy mode. It checks if all
 the conditions above are met and set up legacy mode. QEMU will also fail
 immediately on error in this case.
 Additionally, the hotplug check in legacy mode is removed as hotplugging
 IGD device is never supported, and it will be checked when enabling the
 OpRegion quirk.
 Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
 Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
 Tested-by: Alex Williamson <alex.williamson@redhat.com>
 Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
 Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-8-tomitamoeko@gmail.com
 [ clg: - Changed warn_report() by info_report() in
          vfio_probe_igd_config_quirk() as suggested by Alex W.
        - Fixed spelling in vfio_probe_igd_config_quirk () ]
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
  hw/vfio/pci.h |   1 +
  hw/vfio/igd.c | 127 +++++++++++++++++++++++++++++---------------------
  hw/vfio/pci.c |   2 +
 files changed, 77 insertions(+), 53 deletions(-)
 diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/pci.h
 +++ b/hw/vfio/pci.h
@@ -XXX,XX +XXX,XX @@ struct VFIOPCIDevice {
      uint32_t display_xres;
      uint32_t display_yres;
      int32_t bootindex;
 +    OnOffAuto igd_legacy_mode;
      uint32_t igd_gms;
      OffAutoPCIBAR msix_relo;
      uint8_t nv_gpudirect_clique;
 diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/igd.c
 +++ b/hw/vfio/igd.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/error-report.h"
  #include "qapi/error.h"
  #include "qapi/qmp/qerror.h"
 +#include "hw/boards.h"
  #include "hw/hw.h"
  #include "hw/nvram/fw_cfg.h"
  #include "pci.h"
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
       * bus address.
       */
      if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
 -        !vfio_is_vga(vdev) || nr != 0 ||
 -        &vdev->pdev != pci_find_device(pci_device_root_bus(&vdev->pdev),
 -                                       0, PCI_DEVFN(0x2, 0))) {
 +        !vfio_is_vga(vdev) || nr != 0) {
          return;
      }
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
      QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, bdsm_quirk, next);
  }
 -bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev,
 -                                 Error **errp G_GNUC_UNUSED)
 +bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
  {
 -    g_autofree struct vfio_region_info *rom = NULL;
      int ret, gen;
      uint64_t gms_size;
      uint64_t *bdsm_size;
      uint32_t gmch;
 +    bool legacy_mode_enabled = false;
      Error *err = NULL;
      /*
@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev,
       * PCI bus address.
       */
      if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
 -        !vfio_is_vga(vdev) ||
 -        &vdev->pdev != pci_find_device(pci_device_root_bus(&vdev->pdev),
 -                                       0, PCI_DEVFN(0x2, 0))) {
 +        !vfio_is_vga(vdev)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev,
          return true;
      }
 -    /*
 -     * Most of what we're doing here is to enable the ROM to run, so if
 -     * there's no ROM, there's no point in setting up this quirk.
 -     * NB. We only seem to get BIOS ROMs, so a UEFI VM would need CSM support.
 -     */
 -    ret = vfio_get_region_info(&vdev->vbasedev,
 -                               VFIO_PCI_ROM_REGION_INDEX, &rom);
 -    if ((ret || !rom->size) && !vdev->pdev.romfile) {
 -        error_report("IGD device %s has no ROM, legacy mode disabled",
 -                     vdev->vbasedev.name);
 -        return true;
 -    }
 -
 -    /*
 -     * Ignore the hotplug corner case, mark the ROM failed, we can't
 -     * create the devices we need for legacy mode in the hotplug scenario.
 -     */
 -    if (vdev->pdev.qdev.hotplugged) {
 -        error_report("IGD device %s hotplugged, ROM disabled, "
 -                     "legacy mode disabled", vdev->vbasedev.name);
 -        vdev->rom_read_failed = true;
 -        return true;
 -    }
 -
      gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, 4);
      /*
 -     * If IGD VGA Disable is clear (expected) and VGA is not already enabled,
 -     * try to enable it.  Probably shouldn't be using legacy mode without VGA,
 -     * but also no point in us enabling VGA if disabled in hardware.
 +     * For backward compatibility, enable legacy mode when
 +     * - Machine type is i440fx (pc_piix)
 +     * - IGD device is at guest BDF 00:02.0
 +     * - Not manually disabled by x-igd-legacy-mode=off
       */
 -    if (!(gmch & 0x2) && !vdev->vga && !vfio_populate_vga(vdev, &err)) {
 -        error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
 -        error_report("IGD device %s failed to enable VGA access, "
 -                     "legacy mode disabled", vdev->vbasedev.name);
 -        return true;
 -    }
 +    if ((vdev->igd_legacy_mode != ON_OFF_AUTO_OFF) &&
 +        !strcmp(MACHINE_GET_CLASS(qdev_get_machine())->family, "pc_piix") &&
 +        (&vdev->pdev == pci_find_device(pci_device_root_bus(&vdev->pdev),
 +        0, PCI_DEVFN(0x2, 0)))) {
 +        /*
 +         * IGD legacy mode requires:
 +         * - VBIOS in ROM BAR or file
 +         * - VGA IO/MMIO ranges are claimed by IGD
 +         * - OpRegion
 +         * - Same LPC bridge and Host bridge VID/DID/SVID/SSID as host
 +         */
 +        g_autofree struct vfio_region_info *rom = NULL;
 +
 +        legacy_mode_enabled = true;
 +        info_report("IGD legacy mode enabled, "
 +                    "use x-igd-legacy-mode=off to disable it if unwanted.");
 +
 +        /*
 +         * Most of what we're doing here is to enable the ROM to run, so if
 +         * there's no ROM, there's no point in setting up this quirk.
 +         * NB. We only seem to get BIOS ROMs, so UEFI VM would need CSM support.
 +         */
 +        ret = vfio_get_region_info(&vdev->vbasedev,
 +                                   VFIO_PCI_ROM_REGION_INDEX, &rom);
 +        if ((ret || !rom->size) && !vdev->pdev.romfile) {
 +            error_setg(&err, "Device has no ROM");
 +            goto error;
 +        }
 -    /* Setup OpRegion access */
 -    if (!vfio_pci_igd_setup_opregion(vdev, &err)) {
 -        error_append_hint(&err, "IGD legacy mode disabled\n");
 -        error_report_err(err);
 -        return true;
 -    }
 +        /*
 +         * If IGD VGA Disable is clear (expected) and VGA is not already
 +         * enabled, try to enable it. Probably shouldn't be using legacy mode
 +         * without VGA, but also no point in us enabling VGA if disabled in
 +         * hardware.
 +         */
 +        if (!(gmch & 0x2) && !vdev->vga && !vfio_populate_vga(vdev, &err)) {
 +            error_setg(&err, "Unable to enable VGA access");
 +            goto error;
 +        }
 -    /* Setup LPC bridge / Host bridge PCI IDs */
 -    if (!vfio_pci_igd_setup_lpc_bridge(vdev, &err)) {
 -        error_append_hint(&err, "IGD legacy mode disabled\n");
 -        error_report_err(err);
 -        return true;
 +        /* Setup OpRegion access */
 +        if (!vfio_pci_igd_setup_opregion(vdev, &err)) {
 +            goto error;
 +        }
 +
 +        /* Setup LPC bridge / Host bridge PCI IDs */
 +        if (!vfio_pci_igd_setup_lpc_bridge(vdev, &err)) {
 +            goto error;
 +        }
 +    } else if (vdev->igd_legacy_mode == ON_OFF_AUTO_ON) {
 +        error_setg(&err,
 +                   "Machine is not i440fx or assigned BDF is not 00:02.0");
 +        goto error;
      }
      /*
@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev,
      trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name, (gms_size / MiB));
      return true;
 +
 +error:
 +    /*
 +     * When legacy mode is implicity enabled, continue on error,
 +     * to keep compatibility
 +     */
 +    if (legacy_mode_enabled && (vdev->igd_legacy_mode == ON_OFF_AUTO_AUTO)) {
 +        error_report_err(err);
 +        error_report("IGD legacy mode disabled");
 +        return true;
 +    }
 +
 +    error_propagate(errp, err);
 +    return false;
  }
 diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/pci.c
 +++ b/hw/vfio/pci.c
@@ -XXX,XX +XXX,XX @@ static const Property vfio_pci_dev_properties[] = {
                      VFIO_FEATURE_ENABLE_REQ_BIT, true),
      DEFINE_PROP_BIT("x-igd-opregion", VFIOPCIDevice, features,
                      VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT, false),
 +    DEFINE_PROP_ON_OFF_AUTO("x-igd-legacy-mode", VFIOPCIDevice,
 +                            igd_legacy_mode, ON_OFF_AUTO_AUTO),
      DEFINE_PROP_ON_OFF_AUTO("enable-migration", VFIOPCIDevice,
                              vbasedev.enable_migration, ON_OFF_AUTO_AUTO),
      DEFINE_PROP("x-migration-multifd-transfer", VFIOPCIDevice,
 --
 .48.1

-[PULL 10/13] migration: Add .save_prepare() handler to struct SaveVMHandlers
+[PULL 08/21] vfio/igd: Handle x-igd-opregion option in config quirk
-From: Avihai Horon <avihaih@nvidia.com>
+From: Tomita Moeko <tomitamoeko@gmail.com>
-Add a new .save_prepare() handler to struct SaveVMHandlers. This handler
+Both enable OpRegion option (x-igd-opregion) and legacy mode require
-is called early, even before migration starts, and can be used by
+setting up OpRegion copy for IGD devices. As the config quirk no longer
-devices to perform early checks.
+depends on legacy mode, we can now handle x-igd-opregion option there
 instead of in vfio_realize.
-Refactor migrate_init() to be able to return errors and call
+Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
-.save_prepare() from there.
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
+Tested-by: Alex Williamson <alex.williamson@redhat.com>
-Suggested-by: Peter Xu <peterx@redhat.com>
+Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
-Signed-off-by: Avihai Horon <avihaih@nvidia.com>
+Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-9-tomitamoeko@gmail.com
 Reviewed-by: Peter Xu <peterx@redhat.com>
 Reviewed-by: Cédric Le Goater <clg@redhat.com>
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- include/migration/register.h |  5 +++++
+ hw/vfio/pci.h |  2 --
- migration/migration.h        |  2 +-
+ hw/vfio/igd.c | 14 +++++++++-----
- migration/savevm.h           |  1 +
+ hw/vfio/pci.c |  9 ---------
- migration/migration.c        | 15 +++++++++++++--
+files changed, 9 insertions(+), 16 deletions(-)
  migration/savevm.c           | 29 ++++++++++++++++++++++++++++-
 files changed, 48 insertions(+), 4 deletions(-)
-diff --git a/include/migration/register.h b/include/migration/register.h
+diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/migration/register.h
+--- a/hw/vfio/pci.h
-+++ b/include/migration/register.h
++++ b/hw/vfio/pci.h
-@@ -XXX,XX +XXX,XX @@ typedef struct SaveVMHandlers {
+@@ -XXX,XX +XXX,XX @@ int vfio_pci_get_pci_hot_reset_info(VFIOPCIDevice *vdev,
-     /* This runs inside the iothread lock.  */
-     SaveStateHandler *save_state;
+ bool vfio_populate_vga(VFIOPCIDevice *vdev, Error **errp);
-+    /*
+-bool vfio_pci_igd_setup_opregion(VFIOPCIDevice *vdev, Error **errp);
-+     * save_prepare is called early, even before migration starts, and can be
+-
-+     * used to perform early checks.
+ void vfio_display_reset(VFIOPCIDevice *vdev);
-+     */
+ bool vfio_display_probe(VFIOPCIDevice *vdev, Error **errp);
-+    int (*save_prepare)(void *opaque, Error **errp);
+ void vfio_display_finalize(VFIOPCIDevice *vdev);
-     void (*save_cleanup)(void *opaque);
+diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
      int (*save_live_complete_postcopy)(QEMUFile *f, void *opaque);
      int (*save_live_complete_precopy)(QEMUFile *f, void *opaque);
 diff --git a/migration/migration.h b/migration/migration.h
 index XXXXXXX..XXXXXXX 100644
---- a/migration/migration.h
+--- a/hw/vfio/igd.c
-+++ b/migration/migration.h
++++ b/hw/vfio/igd.c
-@@ -XXX,XX +XXX,XX @@ void migrate_fd_connect(MigrationState *s, Error *error_in);
+@@ -XXX,XX +XXX,XX @@ static bool vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
- bool migration_is_setup_or_active(int state);
+     return true;
  bool migration_is_running(int state);
 -void migrate_init(MigrationState *s);
 +int migrate_init(MigrationState *s, Error **errp);
  bool migration_is_blocked(Error **errp);
  /* True if outgoing migration has entered postcopy phase */
  bool migration_in_postcopy(void);
 diff --git a/migration/savevm.h b/migration/savevm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/migration/savevm.h
 +++ b/migration/savevm.h
@@ -XXX,XX +XXX,XX @@
  bool qemu_savevm_state_blocked(Error **errp);
  void qemu_savevm_non_migratable_list(strList **reasons);
 +int qemu_savevm_state_prepare(Error **errp);
  void qemu_savevm_state_setup(QEMUFile *f);
  bool qemu_savevm_state_guest_unplug_pending(void);
  int qemu_savevm_state_resume_prepare(MigrationState *s);
 diff --git a/migration/migration.c b/migration/migration.c
 index XXXXXXX..XXXXXXX 100644
 --- a/migration/migration.c
 +++ b/migration/migration.c
@@ -XXX,XX +XXX,XX @@ bool migration_is_active(MigrationState *s)
              s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE);
  }
--void migrate_init(MigrationState *s)
+-bool vfio_pci_igd_setup_opregion(VFIOPCIDevice *vdev, Error **errp)
-+int migrate_init(MigrationState *s, Error **errp)
++static bool vfio_pci_igd_setup_opregion(VFIOPCIDevice *vdev, Error **errp)
  {
-+    int ret;
+     g_autofree struct vfio_region_info *opregion = NULL;
-+
+     int ret;
-+    ret = qemu_savevm_state_prepare(errp);
+@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
-+    if (ret) {
+             goto error;
-+        return ret;
+         }
 -        /* Setup OpRegion access */
 -        if (!vfio_pci_igd_setup_opregion(vdev, &err)) {
 -            goto error;
 -        }
 +        /* Enable OpRegion quirk */
 +        vdev->features |= VFIO_FEATURE_ENABLE_IGD_OPREGION;
          /* Setup LPC bridge / Host bridge PCI IDs */
          if (!vfio_pci_igd_setup_lpc_bridge(vdev, &err)) {
@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
          goto error;
      }
 +    /* Setup OpRegion access */
 +    if ((vdev->features & VFIO_FEATURE_ENABLE_IGD_OPREGION) &&
 +        !vfio_pci_igd_setup_opregion(vdev, errp)) {
 +        goto error;
 +    }
 +
      /*
-      * Reinitialise all migration state, except
+      * Allow user to override dsm size using x-igd-gms option, in multiples of
-      * parameters/capabilities that the user set, and
+      * 32MiB. This option should only be used when the desired size cannot be
-@@ -XXX,XX +XXX,XX @@ void migrate_init(MigrationState *s)
+diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
-     memset(&mig_stats, 0, sizeof(mig_stats));
+index XXXXXXX..XXXXXXX 100644
-     memset(&compression_counters, 0, sizeof(compression_counters));
+--- a/hw/vfio/pci.c
-     migration_reset_vfio_bytes_transferred();
++++ b/hw/vfio/pci.c
-+
+@@ -XXX,XX +XXX,XX @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
-+    return 0;
+         vfio_bar_quirk_setup(vdev, i);
  }
  int migrate_add_blocker_internal(Error *reason, Error **errp)
@@ -XXX,XX +XXX,XX @@ static bool migrate_prepare(MigrationState *s, bool blk, bool blk_inc,
          migrate_set_block_incremental(true);
      }
--    migrate_init(s);
+-#ifdef CONFIG_VFIO_IGD
-+    if (migrate_init(s, errp)) {
+-    if (!vdev->igd_opregion &&
-+        return false;
+-        vdev->features & VFIO_FEATURE_ENABLE_IGD_OPREGION) {
-+    }
+-        if (!vfio_pci_igd_setup_opregion(vdev, errp)) {
+-            goto out_unset_idev;
-     return true;
+-        }
- }
+-    }
-diff --git a/migration/savevm.c b/migration/savevm.c
+-#endif
-index XXXXXXX..XXXXXXX 100644
+-
---- a/migration/savevm.c
+     /* QEMU emulates all of MSI & MSIX */
-+++ b/migration/savevm.c
+     if (pdev->cap_present & QEMU_PCI_CAP_MSIX) {
-@@ -XXX,XX +XXX,XX @@ bool qemu_savevm_state_guest_unplug_pending(void)
+         memset(vdev->emulated_config_bits + pdev->msix_cap, 0xff,
      return false;
  }
 +int qemu_savevm_state_prepare(Error **errp)
 +{
 +    SaveStateEntry *se;
 +    int ret;
 +
 +    QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
 +        if (!se->ops || !se->ops->save_prepare) {
 +            continue;
 +        }
 +        if (se->ops->is_active) {
 +            if (!se->ops->is_active(se->opaque)) {
 +                continue;
 +            }
 +        }
 +
 +        ret = se->ops->save_prepare(se->opaque, errp);
 +        if (ret < 0) {
 +            return ret;
 +        }
 +    }
 +
 +    return 0;
 +}
 +
  void qemu_savevm_state_setup(QEMUFile *f)
  {
      MigrationState *ms = migrate_get_current();
@@ -XXX,XX +XXX,XX @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
          return -EINVAL;
      }
 -    migrate_init(ms);
 +    ret = migrate_init(ms, errp);
 +    if (ret) {
 +        return ret;
 +    }
      ms->to_dst_file = f;
      qemu_mutex_unlock_iothread();
 --
-.41.0
+.48.1

-New patch
+[PULL 09/21] vfio/igd: Introduce x-igd-lpc option for LPC bridge ID quirk
+From: Tomita Moeko <tomitamoeko@gmail.com>
+The LPC bridge/Host bridge IDs quirk is also not dependent on legacy
+mode. Recent Windows driver no longer depends on these IDs, as well as
+Linux i915 driver, while UEFI GOP seems still needs them. Make it an
+option to allow users enabling and disabling it as needed.
+Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
+Tested-by: Alex Williamson <alex.williamson@redhat.com>
+Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
+Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-10-tomitamoeko@gmail.com
+[ clg: - Fixed spelling in vfio_probe_igd_config_quirk() ]
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ hw/vfio/pci.h |  3 +++
+ hw/vfio/igd.c | 14 ++++++++------
+ hw/vfio/pci.c |  2 ++
+files changed, 13 insertions(+), 6 deletions(-)
+diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/vfio/pci.h
++++ b/hw/vfio/pci.h
+@@ -XXX,XX +XXX,XX @@ struct VFIOPCIDevice {
+ #define VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT 2
+ #define VFIO_FEATURE_ENABLE_IGD_OPREGION \
+                                 (1 << VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT)
++#define VFIO_FEATURE_ENABLE_IGD_LPC_BIT 3
++#define VFIO_FEATURE_ENABLE_IGD_LPC \
++                                (1 << VFIO_FEATURE_ENABLE_IGD_LPC_BIT)
+     OnOffAuto display;
+     uint32_t display_xres;
+     uint32_t display_yres;
+diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/vfio/igd.c
++++ b/hw/vfio/igd.c
+@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
+             goto error;
+         }
+-        /* Enable OpRegion quirk */
++        /* Enable OpRegion and LPC bridge quirk */
+         vdev->features |= VFIO_FEATURE_ENABLE_IGD_OPREGION;
+-
+-        /* Setup LPC bridge / Host bridge PCI IDs */
+-        if (!vfio_pci_igd_setup_lpc_bridge(vdev, &err)) {
+-            goto error;
+-        }
++        vdev->features |= VFIO_FEATURE_ENABLE_IGD_LPC;
+     } else if (vdev->igd_legacy_mode == ON_OFF_AUTO_ON) {
+         error_setg(&err,
+                    "Machine is not i440fx or assigned BDF is not 00:02.0");
+@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
+         goto error;
+     }
++    /* Setup LPC bridge / Host bridge PCI IDs */
++    if ((vdev->features & VFIO_FEATURE_ENABLE_IGD_LPC) &&
++        !vfio_pci_igd_setup_lpc_bridge(vdev, errp)) {
++        goto error;
++     }
++
+     /*
+      * Allow user to override dsm size using x-igd-gms option, in multiples of
+      * 32MiB. This option should only be used when the desired size cannot be
+diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/vfio/pci.c
++++ b/hw/vfio/pci.c
+@@ -XXX,XX +XXX,XX @@ static const Property vfio_pci_dev_properties[] = {
+                     VFIO_FEATURE_ENABLE_REQ_BIT, true),
+     DEFINE_PROP_BIT("x-igd-opregion", VFIOPCIDevice, features,
+                     VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT, false),
++    DEFINE_PROP_BIT("x-igd-lpc", VFIOPCIDevice, features,
++                    VFIO_FEATURE_ENABLE_IGD_LPC_BIT, false),
+     DEFINE_PROP_ON_OFF_AUTO("x-igd-legacy-mode", VFIOPCIDevice,
+                             igd_legacy_mode, ON_OFF_AUTO_AUTO),
+     DEFINE_PROP_ON_OFF_AUTO("enable-migration", VFIOPCIDevice,
+--
+.48.1

-[PULL 02/13] sysemu: Add prepare callback to struct VMChangeStateEntry
+[PULL 10/21] vfio/igd: Fix broken KVMGT OpRegion support
-From: Avihai Horon <avihaih@nvidia.com>
+From: Tomita Moeko <tomitamoeko@gmail.com>
-Add prepare callback to struct VMChangeStateEntry.
+The KVMGT/GVT-g vGPU also exposes OpRegion. But unlike IGD passthrough,
 it only needs the OpRegion quirk. A previous change moved x-igd-opregion
 handling to config quirk breaks KVMGT functionality as it brings extra
 checks and applied other quirks. Here we check if the device is mdev
 (KVMGT) or not (passthrough), and then applies corresponding quirks.
-The prepare callback is optional and can be set by the new function
+As before, users must manually specify x-igd-opregion=on to enable it
-qemu_add_vm_change_state_handler_prio_full() that allows setting this
+on KVMGT devices. In the future, we may check the VID/DID and enable
-callback in addition to the main callback.
+OpRegion automatically.
-The prepare callbacks and main callbacks are called in two separate
+Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
-phases: First all prepare callbacks are called and only then all main
+Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
-callbacks are called.
+Tested-by: Alex Williamson <alex.williamson@redhat.com>
+Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
-The purpose of the new prepare callback is to allow all devices to run a
+Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-11-tomitamoeko@gmail.com
 preliminary task before calling the devices' main callbacks.
 This will facilitate adding P2P support for VFIO migration where all
 VFIO devices need to be put in an intermediate P2P quiescent state
 before being stopped or started by the main callback.
 Signed-off-by: Avihai Horon <avihaih@nvidia.com>
 Reviewed-by: Cédric Le Goater <clg@redhat.com>
 Tested-by: YangHang Liu <yanghliu@redhat.com>
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- include/sysemu/runstate.h |  4 ++++
+ hw/vfio/igd.c | 27 ++++++++++++++++++++++++++-
- softmmu/runstate.c        | 40 +++++++++++++++++++++++++++++++++++++++
+file changed, 26 insertions(+), 1 deletion(-)
 files changed, 44 insertions(+)
-diff --git a/include/sysemu/runstate.h b/include/sysemu/runstate.h
+diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/runstate.h
+--- a/hw/vfio/igd.c
-+++ b/include/sysemu/runstate.h
++++ b/hw/vfio/igd.c
-@@ -XXX,XX +XXX,XX @@ VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb,
+@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
-                                                      void *opaque);
+     QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, bdsm_quirk, next);
  VMChangeStateEntry *qemu_add_vm_change_state_handler_prio(
          VMChangeStateHandler *cb, void *opaque, int priority);
 +VMChangeStateEntry *
 +qemu_add_vm_change_state_handler_prio_full(VMChangeStateHandler *cb,
 +                                           VMChangeStateHandler *prepare_cb,
 +                                           void *opaque, int priority);
  VMChangeStateEntry *qdev_add_vm_change_state_handler(DeviceState *dev,
                                                       VMChangeStateHandler *cb,
                                                       void *opaque);
 diff --git a/softmmu/runstate.c b/softmmu/runstate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/runstate.c
 +++ b/softmmu/runstate.c
@@ -XXX,XX +XXX,XX @@ void qemu_system_vmstop_request(RunState state)
  }
- struct VMChangeStateEntry {
-     VMChangeStateHandler *cb;
+-bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
-+    VMChangeStateHandler *prepare_cb;
++static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
-     void *opaque;
+ {
-     QTAILQ_ENTRY(VMChangeStateEntry) entries;
+     int ret, gen;
-     int priority;
+     uint64_t gms_size;
-@@ -XXX,XX +XXX,XX @@ static QTAILQ_HEAD(, VMChangeStateEntry) vm_change_state_head =
+@@ -XXX,XX +XXX,XX @@ error:
-  */
+     error_propagate(errp, err);
- VMChangeStateEntry *qemu_add_vm_change_state_handler_prio(
+     return false;
-         VMChangeStateHandler *cb, void *opaque, int priority)
+ }
 +
 +/*
 + * KVMGT/GVT-g vGPU exposes an emulated OpRegion. So far, users have to specify
 + * x-igd-opregion=on to enable the access.
 + * TODO: Check VID/DID and enable opregion access automatically
 + */
 +static bool vfio_pci_kvmgt_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 +{
-+    return qemu_add_vm_change_state_handler_prio_full(cb, NULL, opaque,
++    if ((vdev->features & VFIO_FEATURE_ENABLE_IGD_OPREGION) &&
-+                                                      priority);
++        !vfio_pci_igd_setup_opregion(vdev, errp)) {
 +        return false;
 +    }
 +
 +    return true;
 +}
 +
-+/**
++bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
-+ * qemu_add_vm_change_state_handler_prio_full:
++{
-+ * @cb: the main callback to invoke
++    /* KVMGT/GVT-g vGPU is exposed as mdev */
-+ * @prepare_cb: a callback to invoke before the main callback
++    if (vdev->vbasedev.mdev) {
-+ * @opaque: user data passed to the callbacks
++        return vfio_pci_kvmgt_config_quirk(vdev, errp);
-+ * @priority: low priorities execute first when the vm runs and the reverse is
++    }
 + *            true when the vm stops
 + *
 + * Register a main callback function and an optional prepare callback function
 + * that are invoked when the vm starts or stops running. The main callback and
 + * the prepare callback are called in two separate phases: First all prepare
 + * callbacks are called and only then all main callbacks are called. As its
 + * name suggests, the prepare callback can be used to do some preparatory work
 + * before invoking the main callback.
 + *
 + * Returns: an entry to be freed using qemu_del_vm_change_state_handler()
 + */
 +VMChangeStateEntry *
 +qemu_add_vm_change_state_handler_prio_full(VMChangeStateHandler *cb,
 +                                           VMChangeStateHandler *prepare_cb,
 +                                           void *opaque, int priority)
  {
      VMChangeStateEntry *e;
      VMChangeStateEntry *other;
      e = g_malloc0(sizeof(*e));
      e->cb = cb;
 +    e->prepare_cb = prepare_cb;
      e->opaque = opaque;
      e->priority = priority;
@@ -XXX,XX +XXX,XX @@ void vm_state_notify(bool running, RunState state)
      trace_vm_state_notify(running, state, RunState_str(state));
      if (running) {
 +        QTAILQ_FOREACH_SAFE(e, &vm_change_state_head, entries, next) {
 +            if (e->prepare_cb) {
 +                e->prepare_cb(e->opaque, running, state);
 +            }
 +        }
 +
-         QTAILQ_FOREACH_SAFE(e, &vm_change_state_head, entries, next) {
++    return vfio_pci_igd_config_quirk(vdev, errp);
-             e->cb(e->opaque, running, state);
++}
          }
      } else {
 +        QTAILQ_FOREACH_REVERSE_SAFE(e, &vm_change_state_head, entries, next) {
 +            if (e->prepare_cb) {
 +                e->prepare_cb(e->opaque, running, state);
 +            }
 +        }
 +
          QTAILQ_FOREACH_REVERSE_SAFE(e, &vm_change_state_head, entries, next) {
              e->cb(e->opaque, running, state);
          }
 --
-.41.0
+.48.1

-[PULL 09/13] migration: Move more initializations to migrate_init()
+[PULL 11/21] vfio/migration: Use BE byte order for device state wire packets
-From: Avihai Horon <avihaih@nvidia.com>
+From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>
-Initialization of mig_stats, compression_counters and VFIO bytes
+Wire data commonly use BE byte order (including in the existing migration
-transferred is hard-coded in migration code path and snapshot code path.
+protocol), use it also for for VFIO device state packets.
-Make the code cleaner by initializing them in migrate_init().
+This will allow VFIO multifd device state transfer between hosts with
 different endianness.
 Although currently there is no such use case, it's good to have it now
 for completeness.
-Suggested-by: Cédric Le Goater <clg@redhat.com>
+Reviewed-by: Avihai Horon <avihaih@nvidia.com>
-Signed-off-by: Avihai Horon <avihaih@nvidia.com>
+Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
+Link: https://lore.kernel.org/qemu-devel/dcfc04cc1a50655650dbac8398e2742ada84ee39.1741611079.git.maciej.szmigiero@oracle.com
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- migration/migration.c | 14 +++++++-------
+ hw/vfio/migration-multifd.c | 15 ++++++++++-----
- migration/savevm.c    |  3 ---
+file changed, 10 insertions(+), 5 deletions(-)
 files changed, 7 insertions(+), 10 deletions(-)
-diff --git a/migration/migration.c b/migration/migration.c
+diff --git a/hw/vfio/migration-multifd.c b/hw/vfio/migration-multifd.c
 index XXXXXXX..XXXXXXX 100644
---- a/migration/migration.c
+--- a/hw/vfio/migration-multifd.c
-+++ b/migration/migration.c
++++ b/hw/vfio/migration-multifd.c
-@@ -XXX,XX +XXX,XX @@ void migrate_init(MigrationState *s)
+@@ -XXX,XX +XXX,XX @@
-     s->iteration_initial_bytes = 0;
+ #include "hw/vfio/vfio-common.h"
-     s->threshold_size = 0;
+ #include "migration/misc.h"
-     s->switchover_acked = false;
+ #include "qapi/error.h"
-+    /*
++#include "qemu/bswap.h"
-+     * set mig_stats compression_counters memory to zero for a
+ #include "qemu/error-report.h"
-+     * new migration
+ #include "qemu/lockable.h"
-+     */
+ #include "qemu/main-loop.h"
-+    memset(&mig_stats, 0, sizeof(mig_stats));
+@@ -XXX,XX +XXX,XX @@ bool vfio_multifd_load_state_buffer(void *opaque, char *data, size_t data_size,
-+    memset(&compression_counters, 0, sizeof(compression_counters));
+         return false;
 +    migration_reset_vfio_bytes_transferred();
  }
  int migrate_add_blocker_internal(Error *reason, Error **errp)
@@ -XXX,XX +XXX,XX @@ static bool migrate_prepare(MigrationState *s, bool blk, bool blk_inc,
      }
-     migrate_init(s);
++    packet->version = be32_to_cpu(packet->version);
--    /*
+     if (packet->version != VFIO_DEVICE_STATE_PACKET_VER_CURRENT) {
--     * set mig_stats compression_counters memory to zero for a
+         error_setg(errp, "%s: packet has unknown version %" PRIu32,
--     * new migration
+                    vbasedev->name, packet->version);
--     */
+         return false;
 -    memset(&mig_stats, 0, sizeof(mig_stats));
 -    memset(&compression_counters, 0, sizeof(compression_counters));
 -    migration_reset_vfio_bytes_transferred();
      return true;
  }
 diff --git a/migration/savevm.c b/migration/savevm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/migration/savevm.c
 +++ b/migration/savevm.c
@@ -XXX,XX +XXX,XX @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
      }
-     migrate_init(ms);
++    packet->idx = be32_to_cpu(packet->idx);
--    memset(&mig_stats, 0, sizeof(mig_stats));
++    packet->flags = be32_to_cpu(packet->flags);
--    memset(&compression_counters, 0, sizeof(compression_counters));
++
--    migration_reset_vfio_bytes_transferred();
+     if (packet->idx == UINT32_MAX) {
-     ms->to_dst_file = f;
+         error_setg(errp, "%s: packet index is invalid", vbasedev->name);
+         return false;
-     qemu_mutex_unlock_iothread();
+@@ -XXX,XX +XXX,XX @@ vfio_save_complete_precopy_thread_config_state(VFIODevice *vbasedev,
      packet_len = sizeof(*packet) + bioc->usage;
      packet = g_malloc0(packet_len);
 -    packet->version = VFIO_DEVICE_STATE_PACKET_VER_CURRENT;
 -    packet->idx = idx;
 -    packet->flags = VFIO_DEVICE_STATE_CONFIG_STATE;
 +    packet->version = cpu_to_be32(VFIO_DEVICE_STATE_PACKET_VER_CURRENT);
 +    packet->idx = cpu_to_be32(idx);
 +    packet->flags = cpu_to_be32(VFIO_DEVICE_STATE_CONFIG_STATE);
      memcpy(&packet->data, bioc->data, bioc->usage);
      if (!multifd_queue_device_state(idstr, instance_id,
@@ -XXX,XX +XXX,XX @@ vfio_multifd_save_complete_precopy_thread(SaveLiveCompletePrecopyThreadData *d,
      }
      packet = g_malloc0(sizeof(*packet) + migration->data_buffer_size);
 -    packet->version = VFIO_DEVICE_STATE_PACKET_VER_CURRENT;
 +    packet->version = cpu_to_be32(VFIO_DEVICE_STATE_PACKET_VER_CURRENT);
      for (idx = 0; ; idx++) {
          ssize_t data_size;
@@ -XXX,XX +XXX,XX @@ vfio_multifd_save_complete_precopy_thread(SaveLiveCompletePrecopyThreadData *d,
              break;
          }
 -        packet->idx = idx;
 +        packet->idx = cpu_to_be32(idx);
          packet_size = sizeof(*packet) + data_size;
          if (!multifd_queue_device_state(d->idstr, d->instance_id,
 --
-.41.0
+.48.1

-New patch
+[PULL 12/21] system: Declare qemu_[min/max]rampagesize() in 'system/hostmem.h'
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Both qemu_minrampagesize() and qemu_maxrampagesize() are
+related to host memory backends, having the following call
+stack:
+  qemu_minrampagesize()
+     -> find_min_backend_pagesize()
+         -> object_dynamic_cast(obj, TYPE_MEMORY_BACKEND)
+  qemu_maxrampagesize()
+     -> find_max_backend_pagesize()
+        -> object_dynamic_cast(obj, TYPE_MEMORY_BACKEND)
+Having TYPE_MEMORY_BACKEND defined in "system/hostmem.h":
+  include/system/hostmem.h:23:#define TYPE_MEMORY_BACKEND "memory-backend"
+Move their prototype declaration to "system/hostmem.h".
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-Id: <20250308230917.18907-7-philmd@linaro.org>
+Acked-by: David Hildenbrand <david@redhat.com>
+Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-2-philmd@linaro.org
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ include/exec/ram_addr.h    | 3 ---
+ include/system/hostmem.h   | 3 +++
+ hw/ppc/spapr_caps.c        | 1 +
+ hw/s390x/s390-virtio-ccw.c | 1 +
+ hw/vfio/spapr.c            | 1 +
+files changed, 6 insertions(+), 3 deletions(-)
+diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/exec/ram_addr.h
++++ b/include/exec/ram_addr.h
+@@ -XXX,XX +XXX,XX @@ static inline unsigned long int ramblock_recv_bitmap_offset(void *host_addr,
+ bool ramblock_is_pmem(RAMBlock *rb);
+-long qemu_minrampagesize(void);
+-long qemu_maxrampagesize(void);
+-
+ /**
+  * qemu_ram_alloc_from_file,
+  * qemu_ram_alloc_from_fd:  Allocate a ram block from the specified backing
+diff --git a/include/system/hostmem.h b/include/system/hostmem.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/system/hostmem.h
++++ b/include/system/hostmem.h
+@@ -XXX,XX +XXX,XX @@ bool host_memory_backend_is_mapped(HostMemoryBackend *backend);
+ size_t host_memory_backend_pagesize(HostMemoryBackend *memdev);
+ char *host_memory_backend_get_name(HostMemoryBackend *backend);
++long qemu_minrampagesize(void);
++long qemu_maxrampagesize(void);
++
+ #endif
+diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ppc/spapr_caps.c
++++ b/hw/ppc/spapr_caps.c
+@@ -XXX,XX +XXX,XX @@
+ #include "kvm_ppc.h"
+ #include "migration/vmstate.h"
+ #include "system/tcg.h"
++#include "system/hostmem.h"
+ #include "hw/ppc/spapr.h"
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/s390x/tod.h"
+ #include "system/system.h"
+ #include "system/cpus.h"
++#include "system/hostmem.h"
+ #include "target/s390x/kvm/pv.h"
+ #include "migration/blocker.h"
+ #include "qapi/visitor.h"
+diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/vfio/spapr.c
++++ b/hw/vfio/spapr.c
+@@ -XXX,XX +XXX,XX @@
+ #include <linux/kvm.h>
+ #endif
+ #include "system/kvm.h"
++#include "system/hostmem.h"
+ #include "exec/address-spaces.h"
+ #include "hw/vfio/vfio-common.h"
+--
+.48.1

-New patch
+[PULL 13/21] hw/vfio/spapr: Do not include <linux/kvm.h>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+<linux/kvm.h> is already included by "system/kvm.h" in the next line.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Cédric Le Goater <clg@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-Id: <20250307180337.14811-3-philmd@linaro.org>
+Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-3-philmd@linaro.org
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ hw/vfio/spapr.c | 3 ---
+file changed, 3 deletions(-)
+diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/vfio/spapr.c
++++ b/hw/vfio/spapr.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include <sys/ioctl.h>
+ #include <linux/vfio.h>
+-#ifdef CONFIG_KVM
+-#include <linux/kvm.h>
+-#endif
+ #include "system/kvm.h"
+ #include "system/hostmem.h"
+ #include "exec/address-spaces.h"
+--
+.48.1

-[PULL 08/13] vfio/migration: Fail adding device with enable-migration=on and existing blocker
+[PULL 14/21] hw/vfio/common: Include missing 'system/tcg.h' header
-From: Avihai Horon <avihaih@nvidia.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-If a device with enable-migration=on is added and it causes a migration
+Always include necessary headers explicitly, to avoid
-blocker, adding the device should fail with a proper error.
+when refactoring unrelated ones:
-This is not the case with multiple device migration blocker when the
+  hw/vfio/common.c:1176:45: error: implicit declaration of function ‘tcg_enabled’;
-blocker already exists. If the blocker already exists and a device with
+|                                             tcg_enabled() ? DIRTY_CLIENTS_ALL :
-enable-migration=on is added which causes a migration blocker, adding
+        |                                             ^~~~~~~~~~~
 the device will succeed.
-Fix it by failing adding the device in such case.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
-Fixes: 8bbcb64a71d8 ("vfio/migration: Make VFIO migration non-experimental")
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Avihai Horon <avihaih@nvidia.com>
 Reviewed-by: Cédric Le Goater <clg@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-Id: <20250307180337.14811-2-philmd@linaro.org>
+Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-4-philmd@linaro.org
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- hw/vfio/common.c | 7 +++++--
+ hw/vfio/common.c | 1 +
-file changed, 5 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+)
 diff --git a/hw/vfio/common.c b/hw/vfio/common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/common.c
 +++ b/hw/vfio/common.c
-@@ -XXX,XX +XXX,XX @@ int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
+@@ -XXX,XX +XXX,XX @@
- {
+ #include "migration/misc.h"
-     int ret;
+ #include "migration/blocker.h"
+ #include "migration/qemu-file.h"
--    if (multiple_devices_migration_blocker ||
++#include "system/tcg.h"
--        vfio_multiple_devices_migration_is_supported()) {
+ #include "system/tpm.h"
-+    if (vfio_multiple_devices_migration_is_supported()) {
-         return 0;
+ VFIODeviceList vfio_device_list =
      }
@@ -XXX,XX +XXX,XX @@ int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
          return -EINVAL;
      }
 +    if (multiple_devices_migration_blocker) {
 +        return 0;
 +    }
 +
      error_setg(&multiple_devices_migration_blocker,
                 "Multiple VFIO devices migration is supported only if all of "
                 "them support P2P migration");
 --
-.41.0
+.48.1

-[PULL 13/13] vfio/common: Separate vfio-pci ranges
+[PULL 15/21] hw/vfio/common: Get target page size using runtime helpers
-From: Joao Martins <joao.m.martins@oracle.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-QEMU computes the DMA logging ranges for two predefined ranges: 32-bit
+Prefer runtime helpers to get target page size.
 and 64-bit. In the OVMF case, when the dynamic MMIO window is enabled,
 QEMU includes in the 64-bit range the RAM regions at the lower part
 and vfio-pci device RAM regions which are at the top of the address
 space. This range contains a large gap and the size can be bigger than
 the dirty tracking HW limits of some devices (MLX5 has a 2^42 limit).
-To avoid such large ranges, introduce a new PCI range covering the
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-vfio-pci device RAM regions, this only if the addresses are above 4GB
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-to avoid breaking potential SeaBIOS guests.
+Message-Id: <20250305153929.43687-3-philmd@linaro.org>
+Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-5-philmd@linaro.org
 [ clg: - wrote commit log
        - fixed overlapping 32-bit and PCI ranges when using SeaBIOS ]
 Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 Fixes: 5255bbf4ec16 ("vfio/common: Add device dirty page tracking start/stop")
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- hw/vfio/common.c     | 71 +++++++++++++++++++++++++++++++++++++-------
+ hw/vfio/common.c | 8 +++++---
- hw/vfio/trace-events |  2 +-
+file changed, 5 insertions(+), 3 deletions(-)
 files changed, 61 insertions(+), 12 deletions(-)
 diff --git a/hw/vfio/common.c b/hw/vfio/common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/common.c
 +++ b/hw/vfio/common.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/vfio/vfio-common.h"
- #include "hw/vfio/vfio.h"
-+#include "hw/vfio/pci.h"
  #include "exec/address-spaces.h"
  #include "exec/memory.h"
  #include "exec/ram_addr.h"
-@@ -XXX,XX +XXX,XX @@ typedef struct VFIODirtyRanges {
++#include "exec/target_page.h"
-     hwaddr max32;
+ #include "hw/hw.h"
-     hwaddr min64;
+ #include "qemu/error-report.h"
-     hwaddr max64;
+ #include "qemu/main-loop.h"
-+    hwaddr minpci64;
+@@ -XXX,XX +XXX,XX @@ static void vfio_register_ram_discard_listener(VFIOContainerBase *bcontainer,
-+    hwaddr maxpci64;
+                                                MemoryRegionSection *section)
  } VFIODirtyRanges;
  typedef struct VFIODirtyRangesListener {
@@ -XXX,XX +XXX,XX @@ typedef struct VFIODirtyRangesListener {
      MemoryListener listener;
  } VFIODirtyRangesListener;
 +static bool vfio_section_is_vfio_pci(MemoryRegionSection *section,
 +                                     VFIOContainer *container)
 +{
 +    VFIOPCIDevice *pcidev;
 +    VFIODevice *vbasedev;
 +    VFIOGroup *group;
 +    Object *owner;
 +
 +    owner = memory_region_owner(section->mr);
 +
 +    QLIST_FOREACH(group, &container->group_list, container_next) {
 +        QLIST_FOREACH(vbasedev, &group->device_list, next) {
 +            if (vbasedev->type != VFIO_DEVICE_TYPE_PCI) {
 +                continue;
 +            }
 +            pcidev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
 +            if (OBJECT(pcidev) == owner) {
 +                return true;
 +            }
 +        }
 +    }
 +
 +    return false;
 +}
 +
  static void vfio_dirty_tracking_update(MemoryListener *listener,
                                         MemoryRegionSection *section)
  {
-@@ -XXX,XX +XXX,XX @@ static void vfio_dirty_tracking_update(MemoryListener *listener,
+     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
-     }
++    int target_page_size = qemu_target_page_size();
+     VFIORamDiscardListener *vrdl;
-     /*
--     * The address space passed to the dirty tracker is reduced to two ranges:
+     /* Ignore some corner cases not relevant in practice. */
--     * one for 32-bit DMA ranges, and another one for 64-bit DMA ranges.
+-    g_assert(QEMU_IS_ALIGNED(section->offset_within_region, TARGET_PAGE_SIZE));
-+     * The address space passed to the dirty tracker is reduced to three ranges:
++    g_assert(QEMU_IS_ALIGNED(section->offset_within_region, target_page_size));
-+     * one for 32-bit DMA ranges, one for 64-bit DMA ranges and one for the
+     g_assert(QEMU_IS_ALIGNED(section->offset_within_address_space,
-+     * PCI 64-bit hole.
+-                             TARGET_PAGE_SIZE));
-+     *
+-    g_assert(QEMU_IS_ALIGNED(int128_get64(section->size), TARGET_PAGE_SIZE));
-      * The underlying reports of dirty will query a sub-interval of each of
++                             target_page_size));
-      * these ranges.
++    g_assert(QEMU_IS_ALIGNED(int128_get64(section->size), target_page_size));
-      *
--     * The purpose of the dual range handling is to handle known cases of big
+     vrdl = g_new0(VFIORamDiscardListener, 1);
--     * holes in the address space, like the x86 AMD 1T hole. The alternative
+     vrdl->bcontainer = bcontainer;
 -     * would be an IOVATree but that has a much bigger runtime overhead and
 -     * unnecessary complexity.
 +     * The purpose of the three range handling is to handle known cases of big
 +     * holes in the address space, like the x86 AMD 1T hole, and firmware (like
 +     * OVMF) which may relocate the pci-hole64 to the end of the address space.
 +     * The latter would otherwise generate large ranges for tracking, stressing
 +     * the limits of supported hardware. The pci-hole32 will always be below 4G
 +     * (overlapping or not) so it doesn't need special handling and is part of
 +     * the 32-bit range.
 +     *
 +     * The alternative would be an IOVATree but that has a much bigger runtime
 +     * overhead and unnecessary complexity.
       */
 -    min = (end <= UINT32_MAX) ? &range->min32 : &range->min64;
 -    max = (end <= UINT32_MAX) ? &range->max32 : &range->max64;
 -
 +    if (vfio_section_is_vfio_pci(section, dirty->container) &&
 +        iova >= UINT32_MAX) {
 +        min = &range->minpci64;
 +        max = &range->maxpci64;
 +    } else {
 +        min = (end <= UINT32_MAX) ? &range->min32 : &range->min64;
 +        max = (end <= UINT32_MAX) ? &range->max32 : &range->max64;
 +    }
      if (*min > iova) {
          *min = iova;
      }
@@ -XXX,XX +XXX,XX @@ static void vfio_dirty_tracking_init(VFIOContainer *container,
      memset(&dirty, 0, sizeof(dirty));
      dirty.ranges.min32 = UINT32_MAX;
      dirty.ranges.min64 = UINT64_MAX;
 +    dirty.ranges.minpci64 = UINT64_MAX;
      dirty.listener = vfio_dirty_tracking_listener;
      dirty.container = container;
@@ -XXX,XX +XXX,XX @@ vfio_device_feature_dma_logging_start_create(VFIOContainer *container,
       * DMA logging uAPI guarantees to support at least a number of ranges that
       * fits into a single host kernel base page.
       */
 -    control->num_ranges = !!tracking->max32 + !!tracking->max64;
 +    control->num_ranges = !!tracking->max32 + !!tracking->max64 +
 +        !!tracking->maxpci64;
      ranges = g_try_new0(struct vfio_device_feature_dma_logging_range,
                          control->num_ranges);
      if (!ranges) {
@@ -XXX,XX +XXX,XX @@ vfio_device_feature_dma_logging_start_create(VFIOContainer *container,
      if (tracking->max64) {
          ranges->iova = tracking->min64;
          ranges->length = (tracking->max64 - tracking->min64) + 1;
 +        ranges++;
 +    }
 +    if (tracking->maxpci64) {
 +        ranges->iova = tracking->minpci64;
 +        ranges->length = (tracking->maxpci64 - tracking->minpci64) + 1;
      }
      trace_vfio_device_dirty_tracking_start(control->num_ranges,
                                             tracking->min32, tracking->max32,
 -                                           tracking->min64, tracking->max64);
 +                                           tracking->min64, tracking->max64,
 +                                           tracking->minpci64, tracking->maxpci64);
      return feature;
  }
 diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/trace-events
 +++ b/hw/vfio/trace-events
@@ -XXX,XX +XXX,XX @@ vfio_known_safe_misalignment(const char *name, uint64_t iova, uint64_t offset_wi
  vfio_listener_region_add_no_dma_map(const char *name, uint64_t iova, uint64_t size, uint64_t page_size) "Region \"%s\" 0x%"PRIx64" size=0x%"PRIx64" is not aligned to 0x%"PRIx64" and cannot be mapped for DMA"
  vfio_listener_region_del(uint64_t start, uint64_t end) "region_del 0x%"PRIx64" - 0x%"PRIx64
  vfio_device_dirty_tracking_update(uint64_t start, uint64_t end, uint64_t min, uint64_t max) "section 0x%"PRIx64" - 0x%"PRIx64" -> update [0x%"PRIx64" - 0x%"PRIx64"]"
 -vfio_device_dirty_tracking_start(int nr_ranges, uint64_t min32, uint64_t max32, uint64_t min64, uint64_t max64) "nr_ranges %d 32:[0x%"PRIx64" - 0x%"PRIx64"], 64:[0x%"PRIx64" - 0x%"PRIx64"]"
 +vfio_device_dirty_tracking_start(int nr_ranges, uint64_t min32, uint64_t max32, uint64_t min64, uint64_t max64, uint64_t minpci, uint64_t maxpci) "nr_ranges %d 32:[0x%"PRIx64" - 0x%"PRIx64"], 64:[0x%"PRIx64" - 0x%"PRIx64"], pci64:[0x%"PRIx64" - 0x%"PRIx64"]"
  vfio_disconnect_container(int fd) "close container->fd=%d"
  vfio_put_group(int fd) "close group->fd=%d"
  vfio_get_device(const char * name, unsigned int flags, unsigned int num_regions, unsigned int num_irqs) "Device %s flags: %u, regions: %u, irqs: %u"
 --
-.41.0
+.48.1

-[PULL 01/13] vfio/migration: Move from STOP_COPY to STOP in vfio_save_cleanup()
+[PULL 16/21] hw/vfio: Compile some common objects once
-From: Avihai Horon <avihaih@nvidia.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Changing the device state from STOP_COPY to STOP can take time as the
+Some files don't rely on any target-specific knowledge
-device may need to free resources and do other operations as part of the
+and can be compiled once:
 transition. Currently, this is done in vfio_save_complete_precopy() and
 therefore it is counted in the migration downtime.
-To avoid this, change the device state from STOP_COPY to STOP in
+ - helpers.c
-vfio_save_cleanup(), which is called after migration has completed and
+ - container-base.c
-thus is not part of migration downtime.
+ - migration.c (removing unnecessary "exec/ram_addr.h")
  - migration-multifd.c
  - cpr.c
-Signed-off-by: Avihai Horon <avihaih@nvidia.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Tested-by: YangHang Liu <yanghliu@redhat.com>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Cédric Le Goater <clg@redhat.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Message-Id: <20250308230917.18907-4-philmd@linaro.org>
 Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-6-philmd@linaro.org
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- hw/vfio/migration.c | 19 +++++++++++++------
+ hw/vfio/migration.c |  1 -
-file changed, 13 insertions(+), 6 deletions(-)
+ hw/vfio/meson.build | 13 ++++++++-----
 files changed, 8 insertions(+), 6 deletions(-)
 diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/migration.c
 +++ b/hw/vfio/migration.c
-@@ -XXX,XX +XXX,XX @@ static void vfio_save_cleanup(void *opaque)
+@@ -XXX,XX +XXX,XX @@
-     VFIODevice *vbasedev = opaque;
+ #include "qapi/error.h"
-     VFIOMigration *migration = vbasedev->migration;
+ #include "qapi/qapi-events-vfio.h"
+ #include "exec/ramlist.h"
-+    /*
+-#include "exec/ram_addr.h"
-+     * Changing device state from STOP_COPY to STOP can take time. Do it here,
+ #include "pci.h"
-+     * after migration has completed, so it won't increase downtime.
+ #include "trace.h"
-+     */
+ #include "hw/hw.h"
-+    if (migration->device_state == VFIO_DEVICE_STATE_STOP_COPY) {
+diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
-+        /*
+index XXXXXXX..XXXXXXX 100644
-+         * If setting the device in STOP state fails, the device should be
+--- a/hw/vfio/meson.build
-+         * reset. To do so, use ERROR state as a recover state.
++++ b/hw/vfio/meson.build
-+         */
+@@ -XXX,XX +XXX,XX @@
-+        vfio_migration_set_state(vbasedev, VFIO_DEVICE_STATE_STOP,
+ vfio_ss = ss.source_set()
-+                                 VFIO_DEVICE_STATE_ERROR);
+ vfio_ss.add(files(
-+    }
+-  'helpers.c',
    'common.c',
 -  'container-base.c',
    'container.c',
 -  'migration.c',
 -  'migration-multifd.c',
 -  'cpr.c',
  ))
  vfio_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr.c'))
  vfio_ss.add(when: 'CONFIG_IOMMUFD', if_true: files(
@@ -XXX,XX +XXX,XX @@ vfio_ss.add(when: 'CONFIG_VFIO_AP', if_true: files('ap.c'))
  vfio_ss.add(when: 'CONFIG_VFIO_IGD', if_true: files('igd.c'))
  specific_ss.add_all(when: 'CONFIG_VFIO', if_true: vfio_ss)
 +
-     g_free(migration->data_buffer);
++system_ss.add(when: 'CONFIG_VFIO', if_true: files(
-     migration->data_buffer = NULL;
++  'helpers.c',
-     migration->precopy_init_size = 0;
++  'container-base.c',
-@@ -XXX,XX +XXX,XX @@ static int vfio_save_complete_precopy(QEMUFile *f, void *opaque)
++  'migration.c',
-         return ret;
++  'migration-multifd.c',
-     }
++  'cpr.c',
++))
 -    /*
 -     * If setting the device in STOP state fails, the device should be reset.
 -     * To do so, use ERROR state as a recover state.
 -     */
 -    ret = vfio_migration_set_state(vbasedev, VFIO_DEVICE_STATE_STOP,
 -                                   VFIO_DEVICE_STATE_ERROR);
      trace_vfio_save_complete_precopy(vbasedev->name, ret);
      return ret;
 --
-.41.0
+.48.1

-New patch
+[PULL 17/21] hw/vfio: Compile more objects once
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+These files depend on the VFIO symbol in their Kconfig
+definition. They don't rely on target specific definitions,
+move them to system_ss[] to build them once.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Cédric Le Goater <clg@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-Id: <20250308230917.18907-5-philmd@linaro.org>
+Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-7-philmd@linaro.org
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ hw/vfio/meson.build | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/vfio/meson.build
++++ b/hw/vfio/meson.build
+@@ -XXX,XX +XXX,XX @@ vfio_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
+ ))
+ vfio_ss.add(when: 'CONFIG_VFIO_CCW', if_true: files('ccw.c'))
+ vfio_ss.add(when: 'CONFIG_VFIO_PLATFORM', if_true: files('platform.c'))
+-vfio_ss.add(when: 'CONFIG_VFIO_XGMAC', if_true: files('calxeda-xgmac.c'))
+-vfio_ss.add(when: 'CONFIG_VFIO_AMD_XGBE', if_true: files('amd-xgbe.c'))
+ vfio_ss.add(when: 'CONFIG_VFIO_AP', if_true: files('ap.c'))
+ vfio_ss.add(when: 'CONFIG_VFIO_IGD', if_true: files('igd.c'))
+ specific_ss.add_all(when: 'CONFIG_VFIO', if_true: vfio_ss)
++system_ss.add(when: 'CONFIG_VFIO_XGMAC', if_true: files('calxeda-xgmac.c'))
++system_ss.add(when: 'CONFIG_VFIO_AMD_XGBE', if_true: files('amd-xgbe.c'))
+ system_ss.add(when: 'CONFIG_VFIO', if_true: files(
+   'helpers.c',
+   'container-base.c',
+--
+.48.1

-New patch
+[PULL 18/21] hw/vfio: Compile iommufd.c once
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+Removing unused "exec/ram_addr.h" header allow to compile
+iommufd.c once for all targets.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Cédric Le Goater <clg@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-Id: <20250308230917.18907-6-philmd@linaro.org>
+Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-8-philmd@linaro.org
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ hw/vfio/iommufd.c   | 1 -
+ hw/vfio/meson.build | 6 +++---
+files changed, 3 insertions(+), 4 deletions(-)
+diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/vfio/iommufd.c
++++ b/hw/vfio/iommufd.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/cutils.h"
+ #include "qemu/chardev_open.h"
+ #include "pci.h"
+-#include "exec/ram_addr.h"
+ static int iommufd_cdev_map(const VFIOContainerBase *bcontainer, hwaddr iova,
+                             ram_addr_t size, void *vaddr, bool readonly)
+diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/vfio/meson.build
++++ b/hw/vfio/meson.build
+@@ -XXX,XX +XXX,XX @@ vfio_ss.add(files(
+   'container.c',
+ ))
+ vfio_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr.c'))
+-vfio_ss.add(when: 'CONFIG_IOMMUFD', if_true: files(
+-  'iommufd.c',
+-))
+ vfio_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
+   'display.c',
+   'pci-quirks.c',
+@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VFIO', if_true: files(
+   'migration-multifd.c',
+   'cpr.c',
+ ))
++system_ss.add(when: ['CONFIG_VFIO', 'CONFIG_IOMMUFD'], if_true: files(
++  'iommufd.c',
++))
+--
+.48.1

-New patch
+[PULL 19/21] hw/vfio: Compile display.c once
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
+display.c doesn't rely on target specific definitions,
+move it to system_ss[] to build it once.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Cédric Le Goater <clg@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-Id: <20250308230917.18907-8-philmd@linaro.org>
+Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-9-philmd@linaro.org
+Signed-off-by: Cédric Le Goater <clg@redhat.com>
+---
+ hw/vfio/meson.build | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/vfio/meson.build
++++ b/hw/vfio/meson.build
+@@ -XXX,XX +XXX,XX @@ vfio_ss.add(files(
+ ))
+ vfio_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr.c'))
+ vfio_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
+-  'display.c',
+   'pci-quirks.c',
+   'pci.c',
+ ))
+@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VFIO', if_true: files(
+ system_ss.add(when: ['CONFIG_VFIO', 'CONFIG_IOMMUFD'], if_true: files(
+   'iommufd.c',
+ ))
++system_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
++  'display.c',
++))
+--
+.48.1

-[PULL 06/13] vfio/migration: Allow migration of multiple P2P supporting devices
+[PULL 20/21] vfio/pci-quirks: Exclude non-ioport BAR from ATI quirk
-From: Avihai Horon <avihaih@nvidia.com>
+From: Vasilis Liaskovitis <vliaskovitis@suse.com>
-Now that P2P support has been added to VFIO migration, allow migration
+The ATI BAR4 quirk is targeting an ioport BAR. Older devices may
-of multiple devices if all of them support P2P migration.
+have a BAR4 which is not an ioport, causing a segfault here. Test
 the BAR type to skip these devices.
-Single device migration is allowed regardless of P2P migration support.
+Similar to
 "8f419c5b: vfio/pci-quirks: Exclude non-ioport BAR from NVIDIA quirk"
-Signed-off-by: Avihai Horon <avihaih@nvidia.com>
+Untested, as I don't have the card to test.
-Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
-Reviewed-by: Cédric Le Goater <clg@redhat.com>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2856
-Tested-by: YangHang Liu <yanghliu@redhat.com>
+Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
 Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
 Link: https://lore.kernel.org/qemu-devel/20250310235833.41026-1-vliaskovitis@suse.com
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- hw/vfio/common.c | 26 ++++++++++++++++++--------
+ hw/vfio/pci-quirks.c | 2 +-
-file changed, 18 insertions(+), 8 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/vfio/common.c b/hw/vfio/common.c
+diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/vfio/common.c
+--- a/hw/vfio/pci-quirks.c
-+++ b/hw/vfio/common.c
++++ b/hw/vfio/pci-quirks.c
-@@ -XXX,XX +XXX,XX @@ bool vfio_mig_active(void)
+@@ -XXX,XX +XXX,XX @@ static void vfio_probe_ati_bar4_quirk(VFIOPCIDevice *vdev, int nr)
- static Error *multiple_devices_migration_blocker;
+     /* This windows doesn't seem to be used except by legacy VGA code */
+     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_ATI, PCI_ANY_ID) ||
--static unsigned int vfio_migratable_device_num(void)
+-        !vdev->vga || nr != 4) {
-+/*
++        !vdev->vga || nr != 4 || !vdev->bars[4].ioport) {
 + * Multiple devices migration is allowed only if all devices support P2P
 + * migration. Single device migration is allowed regardless of P2P migration
 + * support.
 + */
 +static bool vfio_multiple_devices_migration_is_supported(void)
  {
      VFIOGroup *group;
      VFIODevice *vbasedev;
      unsigned int device_num = 0;
 +    bool all_support_p2p = true;
      QLIST_FOREACH(group, &vfio_group_list, next) {
          QLIST_FOREACH(vbasedev, &group->device_list, next) {
              if (vbasedev->migration) {
                  device_num++;
 +
 +                if (!(vbasedev->migration->mig_flags & VFIO_MIGRATION_P2P)) {
 +                    all_support_p2p = false;
 +                }
              }
          }
      }
 -    return device_num;
 +    return all_support_p2p || device_num <= 1;
  }
  int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
@@ -XXX,XX +XXX,XX @@ int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
      int ret;
      if (multiple_devices_migration_blocker ||
 -        vfio_migratable_device_num() <= 1) {
 +        vfio_multiple_devices_migration_is_supported()) {
          return 0;
      }
      if (vbasedev->enable_migration == ON_OFF_AUTO_ON) {
 -        error_setg(errp, "Migration is currently not supported with multiple "
 -                         "VFIO devices");
 +        error_setg(errp, "Multiple VFIO devices migration is supported only if "
 +                         "all of them support P2P migration");
          return -EINVAL;
      }
      error_setg(&multiple_devices_migration_blocker,
 -               "Migration is currently not supported with multiple "
 -               "VFIO devices");
 +               "Multiple VFIO devices migration is supported only if all of "
 +               "them support P2P migration");
      ret = migrate_add_blocker(multiple_devices_migration_blocker, errp);
      if (ret < 0) {
          error_free(multiple_devices_migration_blocker);
@@ -XXX,XX +XXX,XX @@ int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
  void vfio_unblock_multiple_devices_migration(void)
  {
      if (!multiple_devices_migration_blocker ||
 -        vfio_migratable_device_num() > 1) {
 +        !vfio_multiple_devices_migration_is_supported()) {
          return;
      }
 --
-.41.0
+.48.1

-[PULL 04/13] vfio/migration: Refactor PRE_COPY and RUNNING state checks
+[PULL 21/21] vfio/pci: Drop debug commentary from x-device-dirty-page-tracking
 From: Joao Martins <joao.m.martins@oracle.com>
-Move the PRE_COPY and RUNNING state checks to helper functions.
+The intent behind the x-device-dirty-page-tracking option is twofold:
-This is in preparation for adding P2P VFIO migration support, where
+) development/testing in the presence of VFs with VF dirty page tracking
-these helpers will also test for PRE_COPY_P2P and RUNNING_P2P states.
 ) deliberately choosing platform dirty tracker over the VF one.
 Item 2) scenario is useful when VF dirty tracker is not as fast as
 IOMMU, or there's some limitations around it (e.g. number of them is
 limited; aggregated address space under tracking is limited),
 efficiency/scalability (e.g. 1 pagetable in IOMMU dirty tracker to scan
 vs N VFs) or just troubleshooting. Given item 2 it is not restricted to
 debugging, hence drop the debug parenthesis from the option description.
 Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
-Signed-off-by: Avihai Horon <avihaih@nvidia.com>
 Reviewed-by: Cédric Le Goater <clg@redhat.com>
-Tested-by: YangHang Liu <yanghliu@redhat.com>
+Link: https://lore.kernel.org/qemu-devel/20250311174807.79825-1-joao.m.martins@oracle.com
 [ clg: Fixed subject spelling ]
 Signed-off-by: Cédric Le Goater <clg@redhat.com>
 ---
- include/hw/vfio/vfio-common.h |  2 ++
+ hw/vfio/pci.c | 2 +-
- hw/vfio/common.c              | 22 ++++++++++++++++++----
+file changed, 1 insertion(+), 1 deletion(-)
  hw/vfio/migration.c           | 10 ++++------
 files changed, 24 insertions(+), 10 deletions(-)
-diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
+diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/vfio/vfio-common.h
+--- a/hw/vfio/pci.c
-+++ b/include/hw/vfio/vfio-common.h
++++ b/hw/vfio/pci.c
-@@ -XXX,XX +XXX,XX @@ void vfio_unblock_multiple_devices_migration(void);
+@@ -XXX,XX +XXX,XX @@ static void vfio_pci_dev_class_init(ObjectClass *klass, void *data)
- bool vfio_viommu_preset(VFIODevice *vbasedev);
+     object_class_property_set_description(klass, /* 9.1 */
- int64_t vfio_mig_bytes_transferred(void);
+                                           "x-device-dirty-page-tracking",
- void vfio_reset_bytes_transferred(void);
+                                           "Disable device dirty page tracking and use "
-+bool vfio_device_state_is_running(VFIODevice *vbasedev);
+-                                          "container-based dirty page tracking (DEBUG)");
-+bool vfio_device_state_is_precopy(VFIODevice *vbasedev);
++                                          "container-based dirty page tracking");
+     object_class_property_set_description(klass, /* 9.1 */
- #ifdef CONFIG_LINUX
+                                           "migration-events",
- int vfio_get_region_info(VFIODevice *vbasedev, int index,
+                                           "Emit VFIO migration QAPI event when a VFIO device "
 diff --git a/hw/vfio/common.c b/hw/vfio/common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/common.c
 +++ b/hw/vfio/common.c
@@ -XXX,XX +XXX,XX @@ static void vfio_set_migration_error(int err)
      }
  }
 +bool vfio_device_state_is_running(VFIODevice *vbasedev)
 +{
 +    VFIOMigration *migration = vbasedev->migration;
 +
 +    return migration->device_state == VFIO_DEVICE_STATE_RUNNING;
 +}
 +
 +bool vfio_device_state_is_precopy(VFIODevice *vbasedev)
 +{
 +    VFIOMigration *migration = vbasedev->migration;
 +
 +    return migration->device_state == VFIO_DEVICE_STATE_PRE_COPY;
 +}
 +
  static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
  {
      VFIOGroup *group;
@@ -XXX,XX +XXX,XX @@ static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
              }
              if (vbasedev->pre_copy_dirty_page_tracking == ON_OFF_AUTO_OFF &&
 -                (migration->device_state == VFIO_DEVICE_STATE_RUNNING ||
 -                 migration->device_state == VFIO_DEVICE_STATE_PRE_COPY)) {
 +                (vfio_device_state_is_running(vbasedev) ||
 +                 vfio_device_state_is_precopy(vbasedev))) {
                  return false;
              }
          }
@@ -XXX,XX +XXX,XX @@ static bool vfio_devices_all_running_and_mig_active(VFIOContainer *container)
                  return false;
              }
 -            if (migration->device_state == VFIO_DEVICE_STATE_RUNNING ||
 -                migration->device_state == VFIO_DEVICE_STATE_PRE_COPY) {
 +            if (vfio_device_state_is_running(vbasedev) ||
 +                vfio_device_state_is_precopy(vbasedev)) {
                  continue;
              } else {
                  return false;
 diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/vfio/migration.c
 +++ b/hw/vfio/migration.c
@@ -XXX,XX +XXX,XX @@ static void vfio_state_pending_estimate(void *opaque, uint64_t *must_precopy,
      VFIODevice *vbasedev = opaque;
      VFIOMigration *migration = vbasedev->migration;
 -    if (migration->device_state != VFIO_DEVICE_STATE_PRE_COPY) {
 +    if (!vfio_device_state_is_precopy(vbasedev)) {
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void vfio_state_pending_exact(void *opaque, uint64_t *must_precopy,
      vfio_query_stop_copy_size(vbasedev, &stop_copy_size);
      *must_precopy += stop_copy_size;
 -    if (migration->device_state == VFIO_DEVICE_STATE_PRE_COPY) {
 +    if (vfio_device_state_is_precopy(vbasedev)) {
          vfio_query_precopy_size(migration);
          *must_precopy +=
@@ -XXX,XX +XXX,XX @@ static void vfio_state_pending_exact(void *opaque, uint64_t *must_precopy,
  static bool vfio_is_active_iterate(void *opaque)
  {
      VFIODevice *vbasedev = opaque;
 -    VFIOMigration *migration = vbasedev->migration;
 -    return migration->device_state == VFIO_DEVICE_STATE_PRE_COPY;
 +    return vfio_device_state_is_precopy(vbasedev);
  }
  static int vfio_save_iterate(QEMUFile *f, void *opaque)
@@ -XXX,XX +XXX,XX @@ static const SaveVMHandlers savevm_vfio_handlers = {
  static void vfio_vmstate_change(void *opaque, bool running, RunState state)
  {
      VFIODevice *vbasedev = opaque;
 -    VFIOMigration *migration = vbasedev->migration;
      enum vfio_device_mig_state new_state;
      int ret;
@@ -XXX,XX +XXX,XX @@ static void vfio_vmstate_change(void *opaque, bool running, RunState state)
          new_state = VFIO_DEVICE_STATE_RUNNING;
      } else {
          new_state =
 -            (migration->device_state == VFIO_DEVICE_STATE_PRE_COPY &&
 +            (vfio_device_state_is_precopy(vbasedev) &&
               (state == RUN_STATE_FINISH_MIGRATE || state == RUN_STATE_PAUSED)) ?
                  VFIO_DEVICE_STATE_STOP_COPY :
                  VFIO_DEVICE_STATE_STOP;
 --
-.41.0
+.48.1

The following changes since commit c5ea91da443b458352c1b629b490ee6631775cb4:

Merge tag 'pull-trivial-patches' of https://gitlab.com/mjt0k/qemu into staging (2023-09-08 10:06:25 -0400)

are available in the Git repository at:

https://github.com/legoater/qemu/ tags/pull-vfio-20230911

for you to fetch changes up to a31fe5daeaa230556145bfc04af1bd4e68f377fa:

vfio/common: Separate vfio-pci ranges (2023-09-11 08:34:06 +0200)

----------------------------------------------------------------
vfio queue:

* Small downtime optimisation for VFIO migration
* P2P support for VFIO migration
* Introduction of a save_prepare() handler to fail VFIO migration
* Fix on DMA logging ranges calculation for OVMF enabling dynamic window

----------------------------------------------------------------
Avihai Horon (11):
      vfio/migration: Move from STOP_COPY to STOP in vfio_save_cleanup()
      sysemu: Add prepare callback to struct VMChangeStateEntry
      qdev: Add qdev_add_vm_change_state_handler_full()
      vfio/migration: Add P2P support for VFIO migration
      vfio/migration: Allow migration of multiple P2P supporting devices
      migration: Add migration prefix to functions in target.c
      vfio/migration: Fail adding device with enable-migration=on and existing blocker
      migration: Move more initializations to migrate_init()
      migration: Add .save_prepare() handler to struct SaveVMHandlers
      vfio/migration: Block VFIO migration with postcopy migration
      vfio/migration: Block VFIO migration with background snapshot

Joao Martins (2):
      vfio/migration: Refactor PRE_COPY and RUNNING state checks
      vfio/common: Separate vfio-pci ranges

From: Avihai Horon <avihaih@nvidia.com>

Changing the device state from STOP_COPY to STOP can take time as the
device may need to free resources and do other operations as part of the
transition. Currently, this is done in vfio_save_complete_precopy() and
therefore it is counted in the migration downtime.

To avoid this, change the device state from STOP_COPY to STOP in
vfio_save_cleanup(), which is called after migration has completed and
thus is not part of migration downtime.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -XXX,XX +XXX,XX @@ static void vfio_save_cleanup(void *opaque)
     VFIODevice *vbasedev = opaque;
     VFIOMigration *migration = vbasedev->migration;
 
+    /*
+     * Changing device state from STOP_COPY to STOP can take time. Do it here,
+     * after migration has completed, so it won't increase downtime.
+     */
+    if (migration->device_state == VFIO_DEVICE_STATE_STOP_COPY) {
+        /*
+         * If setting the device in STOP state fails, the device should be
+         * reset. To do so, use ERROR state as a recover state.
+         */
+        vfio_migration_set_state(vbasedev, VFIO_DEVICE_STATE_STOP,
+                                 VFIO_DEVICE_STATE_ERROR);
+    }
+
     g_free(migration->data_buffer);
     migration->data_buffer = NULL;
     migration->precopy_init_size = 0;
@@ -XXX,XX +XXX,XX @@ static int vfio_save_complete_precopy(QEMUFile *f, void *opaque)
         return ret;
     }
 
-    /*
-     * If setting the device in STOP state fails, the device should be reset.
-     * To do so, use ERROR state as a recover state.
-     */
-    ret = vfio_migration_set_state(vbasedev, VFIO_DEVICE_STATE_STOP,
-                                   VFIO_DEVICE_STATE_ERROR);
     trace_vfio_save_complete_precopy(vbasedev->name, ret);
 
     return ret;
-- 
2.41.0

From: Avihai Horon <avihaih@nvidia.com>

Add prepare callback to struct VMChangeStateEntry.

The prepare callback is optional and can be set by the new function
qemu_add_vm_change_state_handler_prio_full() that allows setting this
callback in addition to the main callback.

The prepare callbacks and main callbacks are called in two separate
phases: First all prepare callbacks are called and only then all main
callbacks are called.

The purpose of the new prepare callback is to allow all devices to run a
preliminary task before calling the devices' main callbacks.

This will facilitate adding P2P support for VFIO migration where all
VFIO devices need to be put in an intermediate P2P quiescent state
before being stopped or started by the main callback.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/sysemu/runstate.h |  4 ++++
 softmmu/runstate.c        | 40 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+)

diff --git a/include/sysemu/runstate.h b/include/sysemu/runstate.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/runstate.h
+++ b/include/sysemu/runstate.h
@@ -XXX,XX +XXX,XX @@ VMChangeStateEntry *qemu_add_vm_change_state_handler(VMChangeStateHandler *cb,
                                                      void *opaque);
 VMChangeStateEntry *qemu_add_vm_change_state_handler_prio(
         VMChangeStateHandler *cb, void *opaque, int priority);
+VMChangeStateEntry *
+qemu_add_vm_change_state_handler_prio_full(VMChangeStateHandler *cb,
+                                           VMChangeStateHandler *prepare_cb,
+                                           void *opaque, int priority);
 VMChangeStateEntry *qdev_add_vm_change_state_handler(DeviceState *dev,
                                                      VMChangeStateHandler *cb,
                                                      void *opaque);
diff --git a/softmmu/runstate.c b/softmmu/runstate.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/runstate.c
+++ b/softmmu/runstate.c
@@ -XXX,XX +XXX,XX @@ void qemu_system_vmstop_request(RunState state)
 }
 struct VMChangeStateEntry {
     VMChangeStateHandler *cb;
+    VMChangeStateHandler *prepare_cb;
     void *opaque;
     QTAILQ_ENTRY(VMChangeStateEntry) entries;
     int priority;
@@ -XXX,XX +XXX,XX @@ static QTAILQ_HEAD(, VMChangeStateEntry) vm_change_state_head =
  */
 VMChangeStateEntry *qemu_add_vm_change_state_handler_prio(
         VMChangeStateHandler *cb, void *opaque, int priority)
+{
+    return qemu_add_vm_change_state_handler_prio_full(cb, NULL, opaque,
+                                                      priority);
+}
+
+/**
+ * qemu_add_vm_change_state_handler_prio_full:
+ * @cb: the main callback to invoke
+ * @prepare_cb: a callback to invoke before the main callback
+ * @opaque: user data passed to the callbacks
+ * @priority: low priorities execute first when the vm runs and the reverse is
+ *            true when the vm stops
+ *
+ * Register a main callback function and an optional prepare callback function
+ * that are invoked when the vm starts or stops running. The main callback and
+ * the prepare callback are called in two separate phases: First all prepare
+ * callbacks are called and only then all main callbacks are called. As its
+ * name suggests, the prepare callback can be used to do some preparatory work
+ * before invoking the main callback.
+ *
+ * Returns: an entry to be freed using qemu_del_vm_change_state_handler()
+ */
+VMChangeStateEntry *
+qemu_add_vm_change_state_handler_prio_full(VMChangeStateHandler *cb,
+                                           VMChangeStateHandler *prepare_cb,
+                                           void *opaque, int priority)
 {
     VMChangeStateEntry *e;
     VMChangeStateEntry *other;
 
     e = g_malloc0(sizeof(*e));
     e->cb = cb;
+    e->prepare_cb = prepare_cb;
     e->opaque = opaque;
     e->priority = priority;
 
@@ -XXX,XX +XXX,XX @@ void vm_state_notify(bool running, RunState state)
     trace_vm_state_notify(running, state, RunState_str(state));
 
     if (running) {
+        QTAILQ_FOREACH_SAFE(e, &vm_change_state_head, entries, next) {
+            if (e->prepare_cb) {
+                e->prepare_cb(e->opaque, running, state);
+            }
+        }
+
         QTAILQ_FOREACH_SAFE(e, &vm_change_state_head, entries, next) {
             e->cb(e->opaque, running, state);
         }
     } else {
+        QTAILQ_FOREACH_REVERSE_SAFE(e, &vm_change_state_head, entries, next) {
+            if (e->prepare_cb) {
+                e->prepare_cb(e->opaque, running, state);
+            }
+        }
+
         QTAILQ_FOREACH_REVERSE_SAFE(e, &vm_change_state_head, entries, next) {
             e->cb(e->opaque, running, state);
         }
-- 
2.41.0

From: Avihai Horon <avihaih@nvidia.com>

Add qdev_add_vm_change_state_handler_full() variant that allows setting
a prepare callback in addition to the main callback.

This will facilitate adding P2P support for VFIO migration in the
following patches.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/sysemu/runstate.h         |  3 +++
 hw/core/vm-change-state-handler.c | 14 +++++++++++++-
 2 files changed, 16 insertions(+), 1 deletion(-)

From: Joao Martins <joao.m.martins@oracle.com>

Move the PRE_COPY and RUNNING state checks to helper functions.

This is in preparation for adding P2P VFIO migration support, where
these helpers will also test for PRE_COPY_P2P and RUNNING_P2P states.

Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-common.h |  2 ++
 hw/vfio/common.c              | 22 ++++++++++++++++++----
 hw/vfio/migration.c           | 10 ++++------
 3 files changed, 24 insertions(+), 10 deletions(-)

diff --git a/include/hw/vfio/vfio-common.h b/include/hw/vfio/vfio-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/vfio/vfio-common.h
+++ b/include/hw/vfio/vfio-common.h
@@ -XXX,XX +XXX,XX @@ void vfio_unblock_multiple_devices_migration(void);
 bool vfio_viommu_preset(VFIODevice *vbasedev);
 int64_t vfio_mig_bytes_transferred(void);
 void vfio_reset_bytes_transferred(void);
+bool vfio_device_state_is_running(VFIODevice *vbasedev);
+bool vfio_device_state_is_precopy(VFIODevice *vbasedev);
 
 #ifdef CONFIG_LINUX
 int vfio_get_region_info(VFIODevice *vbasedev, int index,
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -XXX,XX +XXX,XX @@ static void vfio_set_migration_error(int err)
     }
 }
 
+bool vfio_device_state_is_running(VFIODevice *vbasedev)
+{
+    VFIOMigration *migration = vbasedev->migration;
+
+    return migration->device_state == VFIO_DEVICE_STATE_RUNNING;
+}
+
+bool vfio_device_state_is_precopy(VFIODevice *vbasedev)
+{
+    VFIOMigration *migration = vbasedev->migration;
+
+    return migration->device_state == VFIO_DEVICE_STATE_PRE_COPY;
+}
+
 static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
 {
     VFIOGroup *group;
@@ -XXX,XX +XXX,XX @@ static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
             }
 
             if (vbasedev->pre_copy_dirty_page_tracking == ON_OFF_AUTO_OFF &&
-                (migration->device_state == VFIO_DEVICE_STATE_RUNNING ||
-                 migration->device_state == VFIO_DEVICE_STATE_PRE_COPY)) {
+                (vfio_device_state_is_running(vbasedev) ||
+                 vfio_device_state_is_precopy(vbasedev))) {
                 return false;
             }
         }
@@ -XXX,XX +XXX,XX @@ static bool vfio_devices_all_running_and_mig_active(VFIOContainer *container)
                 return false;
             }
 
-            if (migration->device_state == VFIO_DEVICE_STATE_RUNNING ||
-                migration->device_state == VFIO_DEVICE_STATE_PRE_COPY) {
+            if (vfio_device_state_is_running(vbasedev) ||
+                vfio_device_state_is_precopy(vbasedev)) {
                 continue;
             } else {
                 return false;
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -XXX,XX +XXX,XX @@ static void vfio_state_pending_estimate(void *opaque, uint64_t *must_precopy,
     VFIODevice *vbasedev = opaque;
     VFIOMigration *migration = vbasedev->migration;
 
-    if (migration->device_state != VFIO_DEVICE_STATE_PRE_COPY) {
+    if (!vfio_device_state_is_precopy(vbasedev)) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void vfio_state_pending_exact(void *opaque, uint64_t *must_precopy,
     vfio_query_stop_copy_size(vbasedev, &stop_copy_size);
     *must_precopy += stop_copy_size;
 
-    if (migration->device_state == VFIO_DEVICE_STATE_PRE_COPY) {
+    if (vfio_device_state_is_precopy(vbasedev)) {
         vfio_query_precopy_size(migration);
 
         *must_precopy +=
@@ -XXX,XX +XXX,XX @@ static void vfio_state_pending_exact(void *opaque, uint64_t *must_precopy,
 static bool vfio_is_active_iterate(void *opaque)
 {
     VFIODevice *vbasedev = opaque;
-    VFIOMigration *migration = vbasedev->migration;
 
-    return migration->device_state == VFIO_DEVICE_STATE_PRE_COPY;
+    return vfio_device_state_is_precopy(vbasedev);
 }
 
 static int vfio_save_iterate(QEMUFile *f, void *opaque)
@@ -XXX,XX +XXX,XX @@ static const SaveVMHandlers savevm_vfio_handlers = {
 static void vfio_vmstate_change(void *opaque, bool running, RunState state)
 {
     VFIODevice *vbasedev = opaque;
-    VFIOMigration *migration = vbasedev->migration;
     enum vfio_device_mig_state new_state;
     int ret;
 
@@ -XXX,XX +XXX,XX @@ static void vfio_vmstate_change(void *opaque, bool running, RunState state)
         new_state = VFIO_DEVICE_STATE_RUNNING;
     } else {
         new_state =
-            (migration->device_state == VFIO_DEVICE_STATE_PRE_COPY &&
+            (vfio_device_state_is_precopy(vbasedev) &&
              (state == RUN_STATE_FINISH_MIGRATE || state == RUN_STATE_PAUSED)) ?
                 VFIO_DEVICE_STATE_STOP_COPY :
                 VFIO_DEVICE_STATE_STOP;
-- 
2.41.0

From: Avihai Horon <avihaih@nvidia.com>

VFIO migration uAPI defines an optional intermediate P2P quiescent
state. While in the P2P quiescent state, P2P DMA transactions cannot be
initiated by the device, but the device can respond to incoming ones.
Additionally, all outstanding P2P transactions are guaranteed to have
been completed by the time the device enters this state.

The purpose of this state is to support migration of multiple devices
that might do P2P transactions between themselves.

Add support for P2P migration by transitioning all the devices to the
P2P quiescent state before stopping or starting the devices. Use the new
VMChangeStateHandler prepare_cb to achieve that behavior.

This will allow migration of multiple VFIO devices if all of them
support P2P migration.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/devel/vfio-migration.rst | 93 +++++++++++++++++++++--------------
 hw/vfio/common.c              |  6 ++-
 hw/vfio/migration.c           | 46 +++++++++++++++--
 hw/vfio/trace-events          |  1 +
 4 files changed, 105 insertions(+), 41 deletions(-)

diff --git a/docs/devel/vfio-migration.rst b/docs/devel/vfio-migration.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/vfio-migration.rst
+++ b/docs/devel/vfio-migration.rst
@@ -XXX,XX +XXX,XX @@ and recommends that the initial bytes are sent and loaded in the destination
 before stopping the source VM. Enabling this migration capability will
 guarantee that and thus, can potentially reduce downtime even further.
 
-Note that currently VFIO migration is supported only for a single device. This
-is due to VFIO migration's lack of P2P support. However, P2P support is planned
-to be added later on.
+To support migration of multiple devices that might do P2P transactions between
+themselves, VFIO migration uAPI defines an intermediate P2P quiescent state.
+While in the P2P quiescent state, P2P DMA transactions cannot be initiated by
+the device, but the device can respond to incoming ones. Additionally, all
+outstanding P2P transactions are guaranteed to have been completed by the time
+the device enters this state.
+
+All the devices that support P2P migration are first transitioned to the P2P
+quiescent state and only then are they stopped or started. This makes migration
+safe P2P-wise, since starting and stopping the devices is not done atomically
+for all the devices together.
+
+Thus, multiple VFIO devices migration is allowed only if all the devices
+support P2P migration. Single VFIO device migration is allowed regardless of
+P2P migration support.
 
 A detailed description of the UAPI for VFIO device migration can be found in
 the comment for the ``vfio_device_mig_state`` structure in the header file
@@ -XXX,XX +XXX,XX @@ will be blocked.
 Flow of state changes during Live migration
 ===========================================
 
-Below is the flow of state change during live migration.
+Below is the state change flow during live migration for a VFIO device that
+supports both precopy and P2P migration. The flow for devices that don't
+support it is similar, except that the relevant states for precopy and P2P are
+skipped.
 The values in the parentheses represent the VM state, the migration state, and
 the VFIO device state, respectively.
-The text in the square brackets represents the flow if the VFIO device supports
-pre-copy.
 
 Live migration save path
 ------------------------
 
 ::
 
-                        QEMU normal running state
-                        (RUNNING, _NONE, _RUNNING)
-                                  |
+                           QEMU normal running state
+                           (RUNNING, _NONE, _RUNNING)
+                                      |
                      migrate_init spawns migration_thread
-                Migration thread then calls each device's .save_setup()
-                  (RUNNING, _SETUP, _RUNNING [_PRE_COPY])
-                                  |
-                  (RUNNING, _ACTIVE, _RUNNING [_PRE_COPY])
-      If device is active, get pending_bytes by .state_pending_{estimate,exact}()
-          If total pending_bytes >= threshold_size, call .save_live_iterate()
-                  [Data of VFIO device for pre-copy phase is copied]
-        Iterate till total pending bytes converge and are less than threshold
-                                  |
-  On migration completion, vCPU stops and calls .save_live_complete_precopy for
-  each active device. The VFIO device is then transitioned into _STOP_COPY state
-                  (FINISH_MIGRATE, _DEVICE, _STOP_COPY)
-                                  |
-     For the VFIO device, iterate in .save_live_complete_precopy until
-                         pending data is 0
-                   (FINISH_MIGRATE, _DEVICE, _STOP)
-                                  |
-                 (FINISH_MIGRATE, _COMPLETED, _STOP)
-             Migraton thread schedules cleanup bottom half and exits
+            Migration thread then calls each device's .save_setup()
+                          (RUNNING, _SETUP, _PRE_COPY)
+                                      |
+                         (RUNNING, _ACTIVE, _PRE_COPY)
+  If device is active, get pending_bytes by .state_pending_{estimate,exact}()
+       If total pending_bytes >= threshold_size, call .save_live_iterate()
+                Data of VFIO device for pre-copy phase is copied
+      Iterate till total pending bytes converge and are less than threshold
+                                      |
+       On migration completion, the vCPUs and the VFIO device are stopped
+              The VFIO device is first put in P2P quiescent state
+                    (FINISH_MIGRATE, _ACTIVE, _PRE_COPY_P2P)
+                                      |
+                Then the VFIO device is put in _STOP_COPY state
+                     (FINISH_MIGRATE, _ACTIVE, _STOP_COPY)
+         .save_live_complete_precopy() is called for each active device
+      For the VFIO device, iterate in .save_live_complete_precopy() until
+                               pending data is 0
+                                      |
+                     (POSTMIGRATE, _COMPLETED, _STOP_COPY)
+            Migraton thread schedules cleanup bottom half and exits
+                                      |
+                           .save_cleanup() is called
+                        (POSTMIGRATE, _COMPLETED, _STOP)
 
 Live migration resume path
 --------------------------
 
 ::
 
-              Incoming migration calls .load_setup for each device
-                       (RESTORE_VM, _ACTIVE, _STOP)
-                                 |
-       For each device, .load_state is called for that device section data
-                       (RESTORE_VM, _ACTIVE, _RESUMING)
-                                 |
-    At the end, .load_cleanup is called for each device and vCPUs are started
-                       (RUNNING, _NONE, _RUNNING)
+             Incoming migration calls .load_setup() for each device
+                          (RESTORE_VM, _ACTIVE, _STOP)
+                                      |
+     For each device, .load_state() is called for that device section data
+                        (RESTORE_VM, _ACTIVE, _RESUMING)
+                                      |
+  At the end, .load_cleanup() is called for each device and vCPUs are started
+              The VFIO device is first put in P2P quiescent state
+                        (RUNNING, _ACTIVE, _RUNNING_P2P)
+                                      |
+                           (RUNNING, _NONE, _RUNNING)
 
 Postcopy
 ========
diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -XXX,XX +XXX,XX @@ bool vfio_device_state_is_running(VFIODevice *vbasedev)
 {
     VFIOMigration *migration = vbasedev->migration;
 
-    return migration->device_state == VFIO_DEVICE_STATE_RUNNING;
+    return migration->device_state == VFIO_DEVICE_STATE_RUNNING ||
+           migration->device_state == VFIO_DEVICE_STATE_RUNNING_P2P;
 }
 
 bool vfio_device_state_is_precopy(VFIODevice *vbasedev)
 {
     VFIOMigration *migration = vbasedev->migration;
 
-    return migration->device_state == VFIO_DEVICE_STATE_PRE_COPY;
+    return migration->device_state == VFIO_DEVICE_STATE_PRE_COPY ||
+           migration->device_state == VFIO_DEVICE_STATE_PRE_COPY_P2P;
 }
 
 static bool vfio_devices_all_dirty_tracking(VFIOContainer *container)
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -XXX,XX +XXX,XX @@ static const char *mig_state_to_str(enum vfio_device_mig_state state)
         return "STOP_COPY";
     case VFIO_DEVICE_STATE_RESUMING:
         return "RESUMING";
+    case VFIO_DEVICE_STATE_RUNNING_P2P:
+        return "RUNNING_P2P";
     case VFIO_DEVICE_STATE_PRE_COPY:
         return "PRE_COPY";
+    case VFIO_DEVICE_STATE_PRE_COPY_P2P:
+        return "PRE_COPY_P2P";
     default:
         return "UNKNOWN STATE";
     }
@@ -XXX,XX +XXX,XX @@ static const SaveVMHandlers savevm_vfio_handlers = {
 
 /* ---------------------------------------------------------------------- */
 
+static void vfio_vmstate_change_prepare(void *opaque, bool running,
+                                        RunState state)
+{
+    VFIODevice *vbasedev = opaque;
+    VFIOMigration *migration = vbasedev->migration;
+    enum vfio_device_mig_state new_state;
+    int ret;
+
+    new_state = migration->device_state == VFIO_DEVICE_STATE_PRE_COPY ?
+                    VFIO_DEVICE_STATE_PRE_COPY_P2P :
+                    VFIO_DEVICE_STATE_RUNNING_P2P;
+
+    /*
+     * If setting the device in new_state fails, the device should be reset.
+     * To do so, use ERROR state as a recover state.
+     */
+    ret = vfio_migration_set_state(vbasedev, new_state,
+                                   VFIO_DEVICE_STATE_ERROR);
+    if (ret) {
+        /*
+         * Migration should be aborted in this case, but vm_state_notify()
+         * currently does not support reporting failures.
+         */
+        if (migrate_get_current()->to_dst_file) {
+            qemu_file_set_error(migrate_get_current()->to_dst_file, ret);
+        }
+    }
+
+    trace_vfio_vmstate_change_prepare(vbasedev->name, running,
+                                      RunState_str(state),
+                                      mig_state_to_str(new_state));
+}
+
 static void vfio_vmstate_change(void *opaque, bool running, RunState state)
 {
     VFIODevice *vbasedev = opaque;
@@ -XXX,XX +XXX,XX @@ static int vfio_migration_init(VFIODevice *vbasedev)
     char id[256] = "";
     g_autofree char *path = NULL, *oid = NULL;
     uint64_t mig_flags = 0;
+    VMChangeStateHandler *prepare_cb;
 
     if (!vbasedev->ops->vfio_get_object) {
         return -EINVAL;
@@ -XXX,XX +XXX,XX @@ static int vfio_migration_init(VFIODevice *vbasedev)
     register_savevm_live(id, VMSTATE_INSTANCE_ID_ANY, 1, &savevm_vfio_handlers,
                          vbasedev);
 
-    migration->vm_state = qdev_add_vm_change_state_handler(vbasedev->dev,
-                                                           vfio_vmstate_change,
-                                                           vbasedev);
+    prepare_cb = migration->mig_flags & VFIO_MIGRATION_P2P ?
+                     vfio_vmstate_change_prepare :
+                     NULL;
+    migration->vm_state = qdev_add_vm_change_state_handler_full(
+        vbasedev->dev, vfio_vmstate_change, prepare_cb, vbasedev);
     migration->migration_state.notify = vfio_migration_state_notifier;
     add_migration_state_change_notifier(&migration->migration_state);
 
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -XXX,XX +XXX,XX @@ vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer
 vfio_state_pending_estimate(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy 0x%"PRIx64" postcopy 0x%"PRIx64" precopy initial size 0x%"PRIx64" precopy dirty size 0x%"PRIx64
 vfio_state_pending_exact(const char *name, uint64_t precopy, uint64_t postcopy, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy 0x%"PRIx64" postcopy 0x%"PRIx64" stopcopy size 0x%"PRIx64" precopy initial size 0x%"PRIx64" precopy dirty size 0x%"PRIx64
 vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
+vfio_vmstate_change_prepare(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
-- 
2.41.0

From: Avihai Horon <avihaih@nvidia.com>

Now that P2P support has been added to VFIO migration, allow migration
of multiple devices if all of them support P2P migration.

Single device migration is allowed regardless of P2P migration support.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: YangHang Liu <yanghliu@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -XXX,XX +XXX,XX @@ bool vfio_mig_active(void)
 
 static Error *multiple_devices_migration_blocker;
 
-static unsigned int vfio_migratable_device_num(void)
+/*
+ * Multiple devices migration is allowed only if all devices support P2P
+ * migration. Single device migration is allowed regardless of P2P migration
+ * support.
+ */
+static bool vfio_multiple_devices_migration_is_supported(void)
 {
     VFIOGroup *group;
     VFIODevice *vbasedev;
     unsigned int device_num = 0;
+    bool all_support_p2p = true;
 
     QLIST_FOREACH(group, &vfio_group_list, next) {
         QLIST_FOREACH(vbasedev, &group->device_list, next) {
             if (vbasedev->migration) {
                 device_num++;
+
+                if (!(vbasedev->migration->mig_flags & VFIO_MIGRATION_P2P)) {
+                    all_support_p2p = false;
+                }
             }
         }
     }
 
-    return device_num;
+    return all_support_p2p || device_num <= 1;
 }
 
 int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
@@ -XXX,XX +XXX,XX @@ int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
     int ret;
 
     if (multiple_devices_migration_blocker ||
-        vfio_migratable_device_num() <= 1) {
+        vfio_multiple_devices_migration_is_supported()) {
         return 0;
     }
 
     if (vbasedev->enable_migration == ON_OFF_AUTO_ON) {
-        error_setg(errp, "Migration is currently not supported with multiple "
-                         "VFIO devices");
+        error_setg(errp, "Multiple VFIO devices migration is supported only if "
+                         "all of them support P2P migration");
         return -EINVAL;
     }
 
     error_setg(&multiple_devices_migration_blocker,
-               "Migration is currently not supported with multiple "
-               "VFIO devices");
+               "Multiple VFIO devices migration is supported only if all of "
+               "them support P2P migration");
     ret = migrate_add_blocker(multiple_devices_migration_blocker, errp);
     if (ret < 0) {
         error_free(multiple_devices_migration_blocker);
@@ -XXX,XX +XXX,XX @@ int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
 void vfio_unblock_multiple_devices_migration(void)
 {
     if (!multiple_devices_migration_blocker ||
-        vfio_migratable_device_num() > 1) {
+        !vfio_multiple_devices_migration_is_supported()) {
         return;
     }
 
-- 
2.41.0

From: Avihai Horon <avihaih@nvidia.com>

The functions in target.c are not static, yet they don't have a proper
migration prefix. Add such prefix.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 migration/migration.h | 4 ++--
 migration/migration.c | 6 +++---
 migration/savevm.c    | 2 +-
 migration/target.c    | 8 ++++----
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/migration/migration.h b/migration/migration.h
index XXXXXXX..XXXXXXX 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -XXX,XX +XXX,XX @@ void migration_consume_urgent_request(void);
 bool migration_rate_limit(void);
 void migration_cancel(const Error *error);
 
-void populate_vfio_info(MigrationInfo *info);
-void reset_vfio_bytes_transferred(void);
+void migration_populate_vfio_info(MigrationInfo *info);
+void migration_reset_vfio_bytes_transferred(void);
 void postcopy_temp_page_reset(PostcopyTmpPage *tmp_page);
 
 #endif
diff --git a/migration/migration.c b/migration/migration.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -XXX,XX +XXX,XX @@ static void fill_source_migration_info(MigrationInfo *info)
         populate_time_info(info, s);
         populate_ram_info(info, s);
         populate_disk_info(info);
-        populate_vfio_info(info);
+        migration_populate_vfio_info(info);
         break;
     case MIGRATION_STATUS_COLO:
         info->has_status = true;
@@ -XXX,XX +XXX,XX @@ static void fill_source_migration_info(MigrationInfo *info)
     case MIGRATION_STATUS_COMPLETED:
         populate_time_info(info, s);
         populate_ram_info(info, s);
-        populate_vfio_info(info);
+        migration_populate_vfio_info(info);
         break;
     case MIGRATION_STATUS_FAILED:
         info->has_status = true;
@@ -XXX,XX +XXX,XX @@ static bool migrate_prepare(MigrationState *s, bool blk, bool blk_inc,
      */
     memset(&mig_stats, 0, sizeof(mig_stats));
     memset(&compression_counters, 0, sizeof(compression_counters));
-    reset_vfio_bytes_transferred();
+    migration_reset_vfio_bytes_transferred();
 
     return true;
 }
diff --git a/migration/savevm.c b/migration/savevm.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -XXX,XX +XXX,XX @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
     migrate_init(ms);
     memset(&mig_stats, 0, sizeof(mig_stats));
     memset(&compression_counters, 0, sizeof(compression_counters));
-    reset_vfio_bytes_transferred();
+    migration_reset_vfio_bytes_transferred();
     ms->to_dst_file = f;
 
     qemu_mutex_unlock_iothread();
diff --git a/migration/target.c b/migration/target.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/target.c
+++ b/migration/target.c
@@ -XXX,XX +XXX,XX @@
 #endif
 
 #ifdef CONFIG_VFIO
-void populate_vfio_info(MigrationInfo *info)
+void migration_populate_vfio_info(MigrationInfo *info)
 {
     if (vfio_mig_active()) {
         info->vfio = g_malloc0(sizeof(*info->vfio));
@@ -XXX,XX +XXX,XX @@ void populate_vfio_info(MigrationInfo *info)
     }
 }
 
-void reset_vfio_bytes_transferred(void)
+void migration_reset_vfio_bytes_transferred(void)
 {
     vfio_reset_bytes_transferred();
 }
 #else
-void populate_vfio_info(MigrationInfo *info)
+void migration_populate_vfio_info(MigrationInfo *info)
 {
 }
 
-void reset_vfio_bytes_transferred(void)
+void migration_reset_vfio_bytes_transferred(void)
 {
 }
 #endif
-- 
2.41.0

From: Avihai Horon <avihaih@nvidia.com>

If a device with enable-migration=on is added and it causes a migration
blocker, adding the device should fail with a proper error.

This is not the case with multiple device migration blocker when the
blocker already exists. If the blocker already exists and a device with
enable-migration=on is added which causes a migration blocker, adding
the device will succeed.

Fix it by failing adding the device in such case.

Fixes: 8bbcb64a71d8 ("vfio/migration: Make VFIO migration non-experimental")
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -XXX,XX +XXX,XX @@ int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
 {
     int ret;
 
-    if (multiple_devices_migration_blocker ||
-        vfio_multiple_devices_migration_is_supported()) {
+    if (vfio_multiple_devices_migration_is_supported()) {
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ int vfio_block_multiple_devices_migration(VFIODevice *vbasedev, Error **errp)
         return -EINVAL;
     }
 
+    if (multiple_devices_migration_blocker) {
+        return 0;
+    }
+
     error_setg(&multiple_devices_migration_blocker,
                "Multiple VFIO devices migration is supported only if all of "
                "them support P2P migration");
-- 
2.41.0

From: Avihai Horon <avihaih@nvidia.com>

Initialization of mig_stats, compression_counters and VFIO bytes
transferred is hard-coded in migration code path and snapshot code path.

Make the code cleaner by initializing them in migrate_init().

Suggested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 migration/migration.c | 14 +++++++-------
 migration/savevm.c    |  3 ---
 2 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -XXX,XX +XXX,XX @@ void migrate_init(MigrationState *s)
     s->iteration_initial_bytes = 0;
     s->threshold_size = 0;
     s->switchover_acked = false;
+    /*
+     * set mig_stats compression_counters memory to zero for a
+     * new migration
+     */
+    memset(&mig_stats, 0, sizeof(mig_stats));
+    memset(&compression_counters, 0, sizeof(compression_counters));
+    migration_reset_vfio_bytes_transferred();
 }
 
 int migrate_add_blocker_internal(Error *reason, Error **errp)
@@ -XXX,XX +XXX,XX @@ static bool migrate_prepare(MigrationState *s, bool blk, bool blk_inc,
     }
 
     migrate_init(s);
-    /*
-     * set mig_stats compression_counters memory to zero for a
-     * new migration
-     */
-    memset(&mig_stats, 0, sizeof(mig_stats));
-    memset(&compression_counters, 0, sizeof(compression_counters));
-    migration_reset_vfio_bytes_transferred();
 
     return true;
 }
diff --git a/migration/savevm.c b/migration/savevm.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -XXX,XX +XXX,XX @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
     }
 
     migrate_init(ms);
-    memset(&mig_stats, 0, sizeof(mig_stats));
-    memset(&compression_counters, 0, sizeof(compression_counters));
-    migration_reset_vfio_bytes_transferred();
     ms->to_dst_file = f;
 
     qemu_mutex_unlock_iothread();
-- 
2.41.0

From: Avihai Horon <avihaih@nvidia.com>

Add a new .save_prepare() handler to struct SaveVMHandlers. This handler
is called early, even before migration starts, and can be used by
devices to perform early checks.

Refactor migrate_init() to be able to return errors and call
.save_prepare() from there.

Suggested-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/migration/register.h |  5 +++++
 migration/migration.h        |  2 +-
 migration/savevm.h           |  1 +
 migration/migration.c        | 15 +++++++++++++--
 migration/savevm.c           | 29 ++++++++++++++++++++++++++++-
 5 files changed, 48 insertions(+), 4 deletions(-)

diff --git a/include/migration/register.h b/include/migration/register.h
index XXXXXXX..XXXXXXX 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -XXX,XX +XXX,XX @@ typedef struct SaveVMHandlers {
     /* This runs inside the iothread lock.  */
     SaveStateHandler *save_state;
 
+    /*
+     * save_prepare is called early, even before migration starts, and can be
+     * used to perform early checks.
+     */
+    int (*save_prepare)(void *opaque, Error **errp);
     void (*save_cleanup)(void *opaque);
     int (*save_live_complete_postcopy)(QEMUFile *f, void *opaque);
     int (*save_live_complete_precopy)(QEMUFile *f, void *opaque);
diff --git a/migration/migration.h b/migration/migration.h
index XXXXXXX..XXXXXXX 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -XXX,XX +XXX,XX @@ void migrate_fd_connect(MigrationState *s, Error *error_in);
 bool migration_is_setup_or_active(int state);
 bool migration_is_running(int state);
 
-void migrate_init(MigrationState *s);
+int migrate_init(MigrationState *s, Error **errp);
 bool migration_is_blocked(Error **errp);
 /* True if outgoing migration has entered postcopy phase */
 bool migration_in_postcopy(void);
diff --git a/migration/savevm.h b/migration/savevm.h
index XXXXXXX..XXXXXXX 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -XXX,XX +XXX,XX @@
 
 bool qemu_savevm_state_blocked(Error **errp);
 void qemu_savevm_non_migratable_list(strList **reasons);
+int qemu_savevm_state_prepare(Error **errp);
 void qemu_savevm_state_setup(QEMUFile *f);
 bool qemu_savevm_state_guest_unplug_pending(void);
 int qemu_savevm_state_resume_prepare(MigrationState *s);
diff --git a/migration/migration.c b/migration/migration.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -XXX,XX +XXX,XX @@ bool migration_is_active(MigrationState *s)
             s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE);
 }
 
-void migrate_init(MigrationState *s)
+int migrate_init(MigrationState *s, Error **errp)
 {
+    int ret;
+
+    ret = qemu_savevm_state_prepare(errp);
+    if (ret) {
+        return ret;
+    }
+
     /*
      * Reinitialise all migration state, except
      * parameters/capabilities that the user set, and
@@ -XXX,XX +XXX,XX @@ void migrate_init(MigrationState *s)
     memset(&mig_stats, 0, sizeof(mig_stats));
     memset(&compression_counters, 0, sizeof(compression_counters));
     migration_reset_vfio_bytes_transferred();
+
+    return 0;
 }
 
 int migrate_add_blocker_internal(Error *reason, Error **errp)
@@ -XXX,XX +XXX,XX @@ static bool migrate_prepare(MigrationState *s, bool blk, bool blk_inc,
         migrate_set_block_incremental(true);
     }
 
-    migrate_init(s);
+    if (migrate_init(s, errp)) {
+        return false;
+    }
 
     return true;
 }
diff --git a/migration/savevm.c b/migration/savevm.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -XXX,XX +XXX,XX @@ bool qemu_savevm_state_guest_unplug_pending(void)
     return false;
 }
 
+int qemu_savevm_state_prepare(Error **errp)
+{
+    SaveStateEntry *se;
+    int ret;
+
+    QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
+        if (!se->ops || !se->ops->save_prepare) {
+            continue;
+        }
+        if (se->ops->is_active) {
+            if (!se->ops->is_active(se->opaque)) {
+                continue;
+            }
+        }
+
+        ret = se->ops->save_prepare(se->opaque, errp);
+        if (ret < 0) {
+            return ret;
+        }
+    }
+
+    return 0;
+}
+
 void qemu_savevm_state_setup(QEMUFile *f)
 {
     MigrationState *ms = migrate_get_current();
@@ -XXX,XX +XXX,XX @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
         return -EINVAL;
     }
 
-    migrate_init(ms);
+    ret = migrate_init(ms, errp);
+    if (ret) {
+        return ret;
+    }
     ms->to_dst_file = f;
 
     qemu_mutex_unlock_iothread();
-- 
2.41.0

From: Avihai Horon <avihaih@nvidia.com>

VFIO migration is not compatible with postcopy migration. A VFIO device
in the destination can't handle page faults for pages that have not been
sent yet.

Doing such migration will cause the VM to crash in the destination:

qemu-system-x86_64: VFIO_MAP_DMA failed: Bad address
qemu-system-x86_64: vfio_dma_map(0x55a28c7659d0, 0xc0000, 0xb000, 0x7f1b11a00000) = -14 (Bad address)
qemu: hardware error: vfio: DMA mapping failed, unable to continue

To prevent this, block VFIO migration with postcopy migration.

Reported-by: Yanghang Liu <yanghliu@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Tested-by: Yanghang Liu <yanghliu@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -XXX,XX +XXX,XX @@ static bool vfio_precopy_supported(VFIODevice *vbasedev)
 
 /* ---------------------------------------------------------------------- */
 
+static int vfio_save_prepare(void *opaque, Error **errp)
+{
+    VFIODevice *vbasedev = opaque;
+
+    /*
+     * Snapshot doesn't use postcopy, so allow snapshot even if postcopy is on.
+     */
+    if (runstate_check(RUN_STATE_SAVE_VM)) {
+        return 0;
+    }
+
+    if (migrate_postcopy_ram()) {
+        error_setg(
+            errp, "%s: VFIO migration is not supported with postcopy migration",
+            vbasedev->name);
+        return -EOPNOTSUPP;
+    }
+
+    return 0;
+}
+
 static int vfio_save_setup(QEMUFile *f, void *opaque)
 {
     VFIODevice *vbasedev = opaque;
@@ -XXX,XX +XXX,XX @@ static bool vfio_switchover_ack_needed(void *opaque)
 }
 
 static const SaveVMHandlers savevm_vfio_handlers = {
+    .save_prepare = vfio_save_prepare,
     .save_setup = vfio_save_setup,
     .save_cleanup = vfio_save_cleanup,
     .state_pending_estimate = vfio_state_pending_estimate,
-- 
2.41.0

From: Avihai Horon <avihaih@nvidia.com>

Background snapshot allows creating a snapshot of the VM while it's
running and keeping it small by not including dirty RAM pages.

The way it works is by first stopping the VM, saving the non-iterable
devices' state and then starting the VM and saving the RAM while write
protecting it with UFFD. The resulting snapshot represents the VM state
at snapshot start.

VFIO migration is not compatible with background snapshot.
First of all, VFIO device state is not even saved in background snapshot
because only non-iterable device state is saved. But even if it was
saved, after starting the VM, a VFIO device could dirty pages without it
being detected by UFFD write protection. This would corrupt the
snapshot, as the RAM in it would not represent the RAM at snapshot
start.

To prevent this, block VFIO migration with background snapshot.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -XXX,XX +XXX,XX @@ static int vfio_save_prepare(void *opaque, Error **errp)
     VFIODevice *vbasedev = opaque;
 
     /*
-     * Snapshot doesn't use postcopy, so allow snapshot even if postcopy is on.
+     * Snapshot doesn't use postcopy nor background snapshot, so allow snapshot
+     * even if they are on.
      */
     if (runstate_check(RUN_STATE_SAVE_VM)) {
         return 0;
@@ -XXX,XX +XXX,XX @@ static int vfio_save_prepare(void *opaque, Error **errp)
         return -EOPNOTSUPP;
     }
 
+    if (migrate_background_snapshot()) {
+        error_setg(
+            errp,
+            "%s: VFIO migration is not supported with background snapshot",
+            vbasedev->name);
+        return -EOPNOTSUPP;
+    }
+
     return 0;
 }
 
-- 
2.41.0

From: Joao Martins <joao.m.martins@oracle.com>

QEMU computes the DMA logging ranges for two predefined ranges: 32-bit
and 64-bit. In the OVMF case, when the dynamic MMIO window is enabled,
QEMU includes in the 64-bit range the RAM regions at the lower part
and vfio-pci device RAM regions which are at the top of the address
space. This range contains a large gap and the size can be bigger than
the dirty tracking HW limits of some devices (MLX5 has a 2^42 limit).

To avoid such large ranges, introduce a new PCI range covering the
vfio-pci device RAM regions, this only if the addresses are above 4GB
to avoid breaking potential SeaBIOS guests.

[ clg: - wrote commit log
       - fixed overlapping 32-bit and PCI ranges when using SeaBIOS ]

Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Fixes: 5255bbf4ec16 ("vfio/common: Add device dirty page tracking start/stop")
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c     | 71 +++++++++++++++++++++++++++++++++++++-------
 hw/vfio/trace-events |  2 +-
 2 files changed, 61 insertions(+), 12 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/vfio/vfio-common.h"
 #include "hw/vfio/vfio.h"
+#include "hw/vfio/pci.h"
 #include "exec/address-spaces.h"
 #include "exec/memory.h"
 #include "exec/ram_addr.h"
@@ -XXX,XX +XXX,XX @@ typedef struct VFIODirtyRanges {
     hwaddr max32;
     hwaddr min64;
     hwaddr max64;
+    hwaddr minpci64;
+    hwaddr maxpci64;
 } VFIODirtyRanges;
 
 typedef struct VFIODirtyRangesListener {
@@ -XXX,XX +XXX,XX @@ typedef struct VFIODirtyRangesListener {
     MemoryListener listener;
 } VFIODirtyRangesListener;
 
+static bool vfio_section_is_vfio_pci(MemoryRegionSection *section,
+                                     VFIOContainer *container)
+{
+    VFIOPCIDevice *pcidev;
+    VFIODevice *vbasedev;
+    VFIOGroup *group;
+    Object *owner;
+
+    owner = memory_region_owner(section->mr);
+
+    QLIST_FOREACH(group, &container->group_list, container_next) {
+        QLIST_FOREACH(vbasedev, &group->device_list, next) {
+            if (vbasedev->type != VFIO_DEVICE_TYPE_PCI) {
+                continue;
+            }
+            pcidev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
+            if (OBJECT(pcidev) == owner) {
+                return true;
+            }
+        }
+    }
+
+    return false;
+}
+
 static void vfio_dirty_tracking_update(MemoryListener *listener,
                                        MemoryRegionSection *section)
 {
@@ -XXX,XX +XXX,XX @@ static void vfio_dirty_tracking_update(MemoryListener *listener,
     }
 
     /*
-     * The address space passed to the dirty tracker is reduced to two ranges:
-     * one for 32-bit DMA ranges, and another one for 64-bit DMA ranges.
+     * The address space passed to the dirty tracker is reduced to three ranges:
+     * one for 32-bit DMA ranges, one for 64-bit DMA ranges and one for the
+     * PCI 64-bit hole.
+     *
      * The underlying reports of dirty will query a sub-interval of each of
      * these ranges.
      *
-     * The purpose of the dual range handling is to handle known cases of big
-     * holes in the address space, like the x86 AMD 1T hole. The alternative
-     * would be an IOVATree but that has a much bigger runtime overhead and
-     * unnecessary complexity.
+     * The purpose of the three range handling is to handle known cases of big
+     * holes in the address space, like the x86 AMD 1T hole, and firmware (like
+     * OVMF) which may relocate the pci-hole64 to the end of the address space.
+     * The latter would otherwise generate large ranges for tracking, stressing
+     * the limits of supported hardware. The pci-hole32 will always be below 4G
+     * (overlapping or not) so it doesn't need special handling and is part of
+     * the 32-bit range.
+     *
+     * The alternative would be an IOVATree but that has a much bigger runtime
+     * overhead and unnecessary complexity.
      */
-    min = (end <= UINT32_MAX) ? &range->min32 : &range->min64;
-    max = (end <= UINT32_MAX) ? &range->max32 : &range->max64;
-
+    if (vfio_section_is_vfio_pci(section, dirty->container) &&
+        iova >= UINT32_MAX) {
+        min = &range->minpci64;
+        max = &range->maxpci64;
+    } else {
+        min = (end <= UINT32_MAX) ? &range->min32 : &range->min64;
+        max = (end <= UINT32_MAX) ? &range->max32 : &range->max64;
+    }
     if (*min > iova) {
         *min = iova;
     }
@@ -XXX,XX +XXX,XX @@ static void vfio_dirty_tracking_init(VFIOContainer *container,
     memset(&dirty, 0, sizeof(dirty));
     dirty.ranges.min32 = UINT32_MAX;
     dirty.ranges.min64 = UINT64_MAX;
+    dirty.ranges.minpci64 = UINT64_MAX;
     dirty.listener = vfio_dirty_tracking_listener;
     dirty.container = container;
 
@@ -XXX,XX +XXX,XX @@ vfio_device_feature_dma_logging_start_create(VFIOContainer *container,
      * DMA logging uAPI guarantees to support at least a number of ranges that
      * fits into a single host kernel base page.
      */
-    control->num_ranges = !!tracking->max32 + !!tracking->max64;
+    control->num_ranges = !!tracking->max32 + !!tracking->max64 +
+        !!tracking->maxpci64;
     ranges = g_try_new0(struct vfio_device_feature_dma_logging_range,
                         control->num_ranges);
     if (!ranges) {
@@ -XXX,XX +XXX,XX @@ vfio_device_feature_dma_logging_start_create(VFIOContainer *container,
     if (tracking->max64) {
         ranges->iova = tracking->min64;
         ranges->length = (tracking->max64 - tracking->min64) + 1;
+        ranges++;
+    }
+    if (tracking->maxpci64) {
+        ranges->iova = tracking->minpci64;
+        ranges->length = (tracking->maxpci64 - tracking->minpci64) + 1;
     }
 
     trace_vfio_device_dirty_tracking_start(control->num_ranges,
                                            tracking->min32, tracking->max32,
-                                           tracking->min64, tracking->max64);
+                                           tracking->min64, tracking->max64,
+                                           tracking->minpci64, tracking->maxpci64);
 
     return feature;
 }
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -XXX,XX +XXX,XX @@ vfio_known_safe_misalignment(const char *name, uint64_t iova, uint64_t offset_wi
 vfio_listener_region_add_no_dma_map(const char *name, uint64_t iova, uint64_t size, uint64_t page_size) "Region \"%s\" 0x%"PRIx64" size=0x%"PRIx64" is not aligned to 0x%"PRIx64" and cannot be mapped for DMA"
 vfio_listener_region_del(uint64_t start, uint64_t end) "region_del 0x%"PRIx64" - 0x%"PRIx64
 vfio_device_dirty_tracking_update(uint64_t start, uint64_t end, uint64_t min, uint64_t max) "section 0x%"PRIx64" - 0x%"PRIx64" -> update [0x%"PRIx64" - 0x%"PRIx64"]"
-vfio_device_dirty_tracking_start(int nr_ranges, uint64_t min32, uint64_t max32, uint64_t min64, uint64_t max64) "nr_ranges %d 32:[0x%"PRIx64" - 0x%"PRIx64"], 64:[0x%"PRIx64" - 0x%"PRIx64"]"
+vfio_device_dirty_tracking_start(int nr_ranges, uint64_t min32, uint64_t max32, uint64_t min64, uint64_t max64, uint64_t minpci, uint64_t maxpci) "nr_ranges %d 32:[0x%"PRIx64" - 0x%"PRIx64"], 64:[0x%"PRIx64" - 0x%"PRIx64"], pci64:[0x%"PRIx64" - 0x%"PRIx64"]"
 vfio_disconnect_container(int fd) "close container->fd=%d"
 vfio_put_group(int fd) "close group->fd=%d"
 vfio_get_device(const char * name, unsigned int flags, unsigned int num_regions, unsigned int num_irqs) "Device %s flags: %u, regions: %u, irqs: %u"
-- 
2.41.0

The following changes since commit 825b96dbcee23d134b691fc75618b59c5f53da32:

Merge tag 'migration-20250310-pull-request' of https://gitlab.com/farosas/qemu into staging (2025-03-11 09:32:07 +0800)

are available in the Git repository at:

https://github.com/legoater/qemu/ tags/pull-vfio-20250311

for you to fetch changes up to 4d9607481560e6c8e1508a0aafe94f86a0503c8c:

vfio/pci: Drop debug commentary from x-device-dirty-page-tracking (2025-03-11 19:04:58 +0100)

----------------------------------------------------------------
vfio queue:

* Fixed endianness of VFIO device state packets
* Improved IGD passthrough support with legacy mode
* Improved build
* Added support for old AMD GPUs (x550)
* Updated property documentation

----------------------------------------------------------------
Joao Martins (1):
      vfio/pci: Drop debug commentary from x-device-dirty-page-tracking

Maciej S. Szmigiero (1):
      vfio/migration: Use BE byte order for device state wire packets

Philippe Mathieu-Daudé (8):
      system: Declare qemu_[min/max]rampagesize() in 'system/hostmem.h'
      hw/vfio/spapr: Do not include <linux/kvm.h>
      hw/vfio/common: Include missing 'system/tcg.h' header
      hw/vfio/common: Get target page size using runtime helpers
      hw/vfio: Compile some common objects once
      hw/vfio: Compile more objects once
      hw/vfio: Compile iommufd.c once
      hw/vfio: Compile display.c once

Tomita Moeko (10):
      vfio/igd: Remove GTT write quirk in IO BAR 4
      vfio/igd: Do not include GTT stolen size in etc/igd-bdsm-size
      vfio/igd: Consolidate OpRegion initialization into a single function
      vfio/igd: Move LPC bridge initialization to a separate function
      vfio/pci: Add placeholder for device-specific config space quirks
      vfio/igd: Refactor vfio_probe_igd_bar4_quirk into pci config quirk
      vfio/igd: Decouple common quirks from legacy mode
      vfio/igd: Handle x-igd-opregion option in config quirk
      vfio/igd: Introduce x-igd-lpc option for LPC bridge ID quirk
      vfio/igd: Fix broken KVMGT OpRegion support

Vasilis Liaskovitis (1):
      vfio/pci-quirks: Exclude non-ioport BAR from ATI quirk

From: Tomita Moeko <tomitamoeko@gmail.com>

The IO BAR4 of IGD devices contains a pair of 32-bit address/data
registers, MMIO_Index (0x0) and MMIO_Data (0x4), which provide access
to the MMIO BAR0 (GTTMMADR) from IO space. These registers are probably
only used by the VBIOS, and are not documented by intel. The observed
layout of MMIO_Index register is:
 31                                                   2   1      0
+-------------------------------------------------------------------+
|                        Offset                        | Rsvd | Sel |
+-------------------------------------------------------------------+
- Offset: Byte offset in specified region, 4-byte aligned.
- Sel: Region selector
       0: MMIO register region (first half of MMIO BAR0)
       1: GTT region (second half of MMIO BAR0). Pre Gen11 only.

Currently, QEMU implements a quirk that adjusts the guest Data Stolen
Memory (DSM) region address to be (addr - host BDSM + guest BDSM) when
programming GTT entries via IO BAR4, assuming guest still programs GTT
with host DSM address, which is not the case. Guest's BDSM register is
emulated and initialized to 0 at startup by QEMU, then SeaBIOS programs
its value[1]. As result, the address programmed to GTT entries by VBIOS
running in guest are valid GPA, and this unnecessary adjustment brings
inconsistency.

[1] https://gitlab.com/qemu-project/seabios/-/blob/1.12-stable/src/fw/pciinit.c#L319-332

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -XXX,XX +XXX,XX @@ static int igd_gen(VFIOPCIDevice *vdev)
     return -1;
 }
 
-typedef struct VFIOIGDQuirk {
-    struct VFIOPCIDevice *vdev;
-    uint32_t index;
-    uint64_t bdsm;
-} VFIOIGDQuirk;
-
 #define IGD_GMCH 0x50 /* Graphics Control Register */
 #define IGD_BDSM 0x5c /* Base Data of Stolen Memory */
 #define IGD_BDSM_GEN11 0xc0 /* Base Data of Stolen Memory of gen 11 and later */
@@ -XXX,XX +XXX,XX @@ static int vfio_pci_igd_lpc_init(VFIOPCIDevice *vdev,
     return ret;
 }
 
-/*
- * IGD Gen8 and newer support up to 8MB for the GTT and use a 64bit PTE
- * entry, older IGDs use 2MB and 32bit.  Each PTE maps a 4k page.  Therefore
- * we either have 2M/4k * 4 = 2k or 8M/4k * 8 = 16k as the maximum iobar index
- * for programming the GTT.
- *
- * See linux:include/drm/i915_drm.h for shift and mask values.
- */
-static int vfio_igd_gtt_max(VFIOPCIDevice *vdev)
-{
-    uint32_t gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, sizeof(gmch));
-    int gen = igd_gen(vdev);
-    uint64_t ggms_size = igd_gtt_memory_size(gen, gmch);
-
-    return (ggms_size / (4 * KiB)) * (gen < 8 ? 4 : 8);
-}
-
-/*
- * The IGD ROM will make use of stolen memory (GGMS) for support of VESA modes.
- * Somehow the host stolen memory range is used for this, but how the ROM gets
- * it is a mystery, perhaps it's hardcoded into the ROM.  Thankfully though, it
- * reprograms the GTT through the IOBAR where we can trap it and transpose the
- * programming to the VM allocated buffer.  That buffer gets reserved by the VM
- * firmware via the fw_cfg entry added below.  Here we're just monitoring the
- * IOBAR address and data registers to detect a write sequence targeting the
- * GTTADR.  This code is developed by observed behavior and doesn't have a
- * direct spec reference, unfortunately.
- */
-static uint64_t vfio_igd_quirk_data_read(void *opaque,
-                                         hwaddr addr, unsigned size)
-{
-    VFIOIGDQuirk *igd = opaque;
-    VFIOPCIDevice *vdev = igd->vdev;
-
-    igd->index = ~0;
-
-    return vfio_region_read(&vdev->bars[4].region, addr + 4, size);
-}
-
-static void vfio_igd_quirk_data_write(void *opaque, hwaddr addr,
-                                      uint64_t data, unsigned size)
-{
-    VFIOIGDQuirk *igd = opaque;
-    VFIOPCIDevice *vdev = igd->vdev;
-    uint64_t val = data;
-    int gen = igd_gen(vdev);
-
-    /*
-     * Programming the GGMS starts at index 0x1 and uses every 4th index (ie.
-     * 0x1, 0x5, 0x9, 0xd,...).  For pre-Gen8 each 4-byte write is a whole PTE
-     * entry, with 0th bit enable set.  For Gen8 and up, PTEs are 64bit, so
-     * entries 0x5 & 0xd are the high dword, in our case zero.  Each PTE points
-     * to a 4k page, which we translate to a page from the VM allocated region,
-     * pointed to by the BDSM register.  If this is not set, we fail.
-     *
-     * We trap writes to the full configured GTT size, but we typically only
-     * see the vBIOS writing up to (nearly) the 1MB barrier.  In fact it often
-     * seems to miss the last entry for an even 1MB GTT.  Doing a gratuitous
-     * write of that last entry does work, but is hopefully unnecessary since
-     * we clear the previous GTT on initialization.
-     */
-    if ((igd->index % 4 == 1) && igd->index < vfio_igd_gtt_max(vdev)) {
-        if (gen < 8 || (igd->index % 8 == 1)) {
-            uint64_t base;
-
-            if (gen < 11) {
-                base = pci_get_long(vdev->pdev.config + IGD_BDSM);
-            } else {
-                base = pci_get_quad(vdev->pdev.config + IGD_BDSM_GEN11);
-            }
-            if (!base) {
-                hw_error("vfio-igd: Guest attempted to program IGD GTT before "
-                         "BIOS reserved stolen memory.  Unsupported BIOS?");
-            }
-
-            val = data - igd->bdsm + base;
-        } else {
-            val = 0; /* upper 32bits of pte, we only enable below 4G PTEs */
-        }
-
-        trace_vfio_pci_igd_bar4_write(vdev->vbasedev.name,
-                                      igd->index, data, val);
-    }
-
-    vfio_region_write(&vdev->bars[4].region, addr + 4, val, size);
-
-    igd->index = ~0;
-}
-
-static const MemoryRegionOps vfio_igd_data_quirk = {
-    .read = vfio_igd_quirk_data_read,
-    .write = vfio_igd_quirk_data_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
-static uint64_t vfio_igd_quirk_index_read(void *opaque,
-                                          hwaddr addr, unsigned size)
-{
-    VFIOIGDQuirk *igd = opaque;
-    VFIOPCIDevice *vdev = igd->vdev;
-
-    igd->index = ~0;
-
-    return vfio_region_read(&vdev->bars[4].region, addr, size);
-}
-
-static void vfio_igd_quirk_index_write(void *opaque, hwaddr addr,
-                                       uint64_t data, unsigned size)
-{
-    VFIOIGDQuirk *igd = opaque;
-    VFIOPCIDevice *vdev = igd->vdev;
-
-    igd->index = data;
-
-    vfio_region_write(&vdev->bars[4].region, addr, data, size);
-}
-
-static const MemoryRegionOps vfio_igd_index_quirk = {
-    .read = vfio_igd_quirk_index_read,
-    .write = vfio_igd_quirk_index_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
 #define IGD_GGC_MMIO_OFFSET     0x108040
 #define IGD_BDSM_MMIO_OFFSET    0x1080C0
 
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
     g_autofree struct vfio_region_info *opregion = NULL;
     g_autofree struct vfio_region_info *host = NULL;
     g_autofree struct vfio_region_info *lpc = NULL;
-    VFIOQuirk *quirk;
-    VFIOIGDQuirk *igd;
     PCIDevice *lpc_bridge;
-    int i, ret, gen;
+    int ret, gen;
     uint64_t ggms_size, gms_size;
     uint64_t *bdsm_size;
     uint32_t gmch;
-    uint16_t cmd_orig, cmd;
     Error *err = NULL;
 
     /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
         return;
     }
 
-    /* Setup our quirk to munge GTT addresses to the VM allocated buffer */
-    quirk = vfio_quirk_alloc(2);
-    igd = quirk->data = g_malloc0(sizeof(*igd));
-    igd->vdev = vdev;
-    igd->index = ~0;
-    if (gen < 11) {
-        igd->bdsm = vfio_pci_read_config(&vdev->pdev, IGD_BDSM, 4);
-    } else {
-        igd->bdsm = vfio_pci_read_config(&vdev->pdev, IGD_BDSM_GEN11, 4);
-        igd->bdsm |=
-            (uint64_t)vfio_pci_read_config(&vdev->pdev, IGD_BDSM_GEN11 + 4, 4) << 32;
-    }
-    igd->bdsm &= ~((1 * MiB) - 1); /* 1MB aligned */
-
-    memory_region_init_io(&quirk->mem[0], OBJECT(vdev), &vfio_igd_index_quirk,
-                          igd, "vfio-igd-index-quirk", 4);
-    memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
-                                        0, &quirk->mem[0], 1);
-
-    memory_region_init_io(&quirk->mem[1], OBJECT(vdev), &vfio_igd_data_quirk,
-                          igd, "vfio-igd-data-quirk", 4);
-    memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,
-                                        4, &quirk->mem[1], 1);
-
-    QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, quirk, next);
-
     /*
      * Allow user to override dsm size using x-igd-gms option, in multiples of
      * 32MiB. This option should only be used when the desired size cannot be
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
         pci_set_quad(vdev->emulated_config_bits + IGD_BDSM_GEN11, ~0);
     }
 
-    /*
-     * This IOBAR gives us access to GTTADR, which allows us to write to
-     * the GTT itself.  So let's go ahead and write zero to all the GTT
-     * entries to avoid spurious DMA faults.  Be sure I/O access is enabled
-     * before talking to the device.
-     */
-    if (pread(vdev->vbasedev.fd, &cmd_orig, sizeof(cmd_orig),
-              vdev->config_offset + PCI_COMMAND) != sizeof(cmd_orig)) {
-        error_report("IGD device %s - failed to read PCI command register",
-                     vdev->vbasedev.name);
-    }
-
-    cmd = cmd_orig | PCI_COMMAND_IO;
-
-    if (pwrite(vdev->vbasedev.fd, &cmd, sizeof(cmd),
-               vdev->config_offset + PCI_COMMAND) != sizeof(cmd)) {
-        error_report("IGD device %s - failed to write PCI command register",
-                     vdev->vbasedev.name);
-    }
-
-    for (i = 1; i < vfio_igd_gtt_max(vdev); i += 4) {
-        vfio_region_write(&vdev->bars[4].region, 0, i, 4);
-        vfio_region_write(&vdev->bars[4].region, 4, 0, 4);
-    }
-
-    if (pwrite(vdev->vbasedev.fd, &cmd_orig, sizeof(cmd_orig),
-               vdev->config_offset + PCI_COMMAND) != sizeof(cmd_orig)) {
-        error_report("IGD device %s - failed to restore PCI command register",
-                     vdev->vbasedev.name);
-    }
-
     trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name,
                                     (ggms_size + gms_size) / MiB);
 }
-- 
2.48.1

From: Tomita Moeko <tomitamoeko@gmail.com>

Though GTT Stolen Memory (GSM) is right below Data Stolen Memory (DSM)
in host address space, direct access to GSM is prohibited, and it is
not mapped to guest address space. Both host and guest accesses GSM
indirectly through the second half of MMIO BAR0 (GTTMMADR).

Guest firmware only need to reserve a memory region for DSM and program
the BDSM register with the base address of that region, that's actually
what both SeaBIOS[1] and IgdAssignmentDxe does now.

[1] https://gitlab.com/qemu-project/seabios/-/blob/1.12-stable/src/fw/pciinit.c#L319-332

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -XXX,XX +XXX,XX @@ static int igd_gen(VFIOPCIDevice *vdev)
 
 #define IGD_GMCH_GEN6_GMS_SHIFT     3       /* SNB_GMCH in i915 */
 #define IGD_GMCH_GEN6_GMS_MASK      0x1f
-#define IGD_GMCH_GEN6_GGMS_SHIFT    8
-#define IGD_GMCH_GEN6_GGMS_MASK     0x3
 #define IGD_GMCH_GEN8_GMS_SHIFT     8       /* BDW_GMCH in i915 */
 #define IGD_GMCH_GEN8_GMS_MASK      0xff
-#define IGD_GMCH_GEN8_GGMS_SHIFT    6
-#define IGD_GMCH_GEN8_GGMS_MASK     0x3
-
-static uint64_t igd_gtt_memory_size(int gen, uint16_t gmch)
-{
-    uint64_t ggms;
-
-    if (gen < 8) {
-        ggms = (gmch >> IGD_GMCH_GEN6_GGMS_SHIFT) & IGD_GMCH_GEN6_GGMS_MASK;
-    } else {
-        ggms = (gmch >> IGD_GMCH_GEN8_GGMS_SHIFT) & IGD_GMCH_GEN8_GGMS_MASK;
-        if (ggms != 0) {
-            ggms = 1ULL << ggms;
-        }
-    }
-
-    return ggms * MiB;
-}
 
 static uint64_t igd_stolen_memory_size(int gen, uint32_t gmch)
 {
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
     g_autofree struct vfio_region_info *lpc = NULL;
     PCIDevice *lpc_bridge;
     int ret, gen;
-    uint64_t ggms_size, gms_size;
+    uint64_t gms_size;
     uint64_t *bdsm_size;
     uint32_t gmch;
     Error *err = NULL;
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
         }
     }
 
-    ggms_size = igd_gtt_memory_size(gen, gmch);
     gms_size = igd_stolen_memory_size(gen, gmch);
 
     /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
      * config offset 0x5C.
      */
     bdsm_size = g_malloc(sizeof(*bdsm_size));
-    *bdsm_size = cpu_to_le64(ggms_size + gms_size);
+    *bdsm_size = cpu_to_le64(gms_size);
     fw_cfg_add_file(fw_cfg_find(), "etc/igd-bdsm-size",
                     bdsm_size, sizeof(*bdsm_size));
 
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
         pci_set_quad(vdev->emulated_config_bits + IGD_BDSM_GEN11, ~0);
     }
 
-    trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name,
-                                    (ggms_size + gms_size) / MiB);
+    trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name, (gms_size / MiB));
 }
-- 
2.48.1

From: Tomita Moeko <tomitamoeko@gmail.com>

Both x-igd-opregion option and legacy mode require identical steps to
set up OpRegion for IGD devices. Consolidate these steps into a single
vfio_pci_igd_setup_opregion function.

The function call in pci.c is wrapped with ifdef temporarily to prevent
build error for non-x86 archs, it will be removed after we decouple it
from legacy mode.

Additionally, move vfio_pci_igd_opregion_init to igd.c to prevent it
from being compiled in non-x86 builds.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-4-tomitamoeko@gmail.com
[ clg: Fixed spelling in vfio_pci_igd_setup_opregion() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.h        |   4 +-
 hw/vfio/igd.c        | 101 +++++++++++++++++++++++++++++++++++--------
 hw/vfio/pci-quirks.c |  50 ---------------------
 hw/vfio/pci.c        |  22 ++--------
 4 files changed, 88 insertions(+), 89 deletions(-)

diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -XXX,XX +XXX,XX @@ int vfio_pci_get_pci_hot_reset_info(VFIOPCIDevice *vdev,
 
 bool vfio_populate_vga(VFIOPCIDevice *vdev, Error **errp);
 
-bool vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
-                                struct vfio_region_info *info,
-                                Error **errp);
+bool vfio_pci_igd_setup_opregion(VFIOPCIDevice *vdev, Error **errp);
 
 void vfio_display_reset(VFIOPCIDevice *vdev);
 bool vfio_display_probe(VFIOPCIDevice *vdev, Error **errp);
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -XXX,XX +XXX,XX @@ static int igd_gen(VFIOPCIDevice *vdev)
     return -1;
 }
 
+#define IGD_ASLS 0xfc /* ASL Storage Register */
 #define IGD_GMCH 0x50 /* Graphics Control Register */
 #define IGD_BDSM 0x5c /* Base Data of Stolen Memory */
 #define IGD_BDSM_GEN11 0xc0 /* Base Data of Stolen Memory of gen 11 and later */
@@ -XXX,XX +XXX,XX @@ static uint64_t igd_stolen_memory_size(int gen, uint32_t gmch)
     return 0;
 }
 
+/*
+ * The OpRegion includes the Video BIOS Table, which seems important for
+ * telling the driver what sort of outputs it has.  Without this, the device
+ * may work in the guest, but we may not get output.  This also requires BIOS
+ * support to reserve and populate a section of guest memory sufficient for
+ * the table and to write the base address of that memory to the ASLS register
+ * of the IGD device.
+ */
+static bool vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
+                                       struct vfio_region_info *info,
+                                       Error **errp)
+{
+    int ret;
+
+    vdev->igd_opregion = g_malloc0(info->size);
+    ret = pread(vdev->vbasedev.fd, vdev->igd_opregion,
+                info->size, info->offset);
+    if (ret != info->size) {
+        error_setg(errp, "failed to read IGD OpRegion");
+        g_free(vdev->igd_opregion);
+        vdev->igd_opregion = NULL;
+        return false;
+    }
+
+    /*
+     * Provide fw_cfg with a copy of the OpRegion which the VM firmware is to
+     * allocate 32bit reserved memory for, copy these contents into, and write
+     * the reserved memory base address to the device ASLS register at 0xFC.
+     * Alignment of this reserved region seems flexible, but using a 4k page
+     * alignment seems to work well.  This interface assumes a single IGD
+     * device, which may be at VM address 00:02.0 in legacy mode or another
+     * address in UPT mode.
+     *
+     * NB, there may be future use cases discovered where the VM should have
+     * direct interaction with the host OpRegion, in which case the write to
+     * the ASLS register would trigger MemoryRegion setup to enable that.
+     */
+    fw_cfg_add_file(fw_cfg_find(), "etc/igd-opregion",
+                    vdev->igd_opregion, info->size);
+
+    trace_vfio_pci_igd_opregion_enabled(vdev->vbasedev.name);
+
+    pci_set_long(vdev->pdev.config + IGD_ASLS, 0);
+    pci_set_long(vdev->pdev.wmask + IGD_ASLS, ~0);
+    pci_set_long(vdev->emulated_config_bits + IGD_ASLS, ~0);
+
+    return true;
+}
+
+bool vfio_pci_igd_setup_opregion(VFIOPCIDevice *vdev, Error **errp)
+{
+    g_autofree struct vfio_region_info *opregion = NULL;
+    int ret;
+
+    /* Hotplugging is not supported for opregion access */
+    if (vdev->pdev.qdev.hotplugged) {
+        error_setg(errp, "IGD OpRegion is not supported on hotplugged device");
+        return false;
+    }
+
+    ret = vfio_get_dev_region_info(&vdev->vbasedev,
+                    VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
+                    VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, &opregion);
+    if (ret) {
+        error_setg_errno(errp, -ret,
+                         "Device does not supports IGD OpRegion feature");
+        return false;
+    }
+
+    if (!vfio_pci_igd_opregion_init(vdev, opregion, errp)) {
+        return false;
+    }
+
+    return true;
+}
+
 /*
  * The rather short list of registers that we copy from the host devices.
  * The LPC/ISA bridge values are definitely needed to support the vBIOS, the
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
 void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
 {
     g_autofree struct vfio_region_info *rom = NULL;
-    g_autofree struct vfio_region_info *opregion = NULL;
     g_autofree struct vfio_region_info *host = NULL;
     g_autofree struct vfio_region_info *lpc = NULL;
     PCIDevice *lpc_bridge;
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
      * Check whether we have all the vfio device specific regions to
      * support legacy mode (added in Linux v4.6).  If not, bail.
      */
-    ret = vfio_get_dev_region_info(&vdev->vbasedev,
-                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
-                        VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, &opregion);
-    if (ret) {
-        error_report("IGD device %s does not support OpRegion access,"
-                     "legacy mode disabled", vdev->vbasedev.name);
-        return;
-    }
-
     ret = vfio_get_dev_region_info(&vdev->vbasedev,
                         VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
                         VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG, &host);
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
         return;
     }
 
+    /* Setup OpRegion access */
+    if (!vfio_pci_igd_setup_opregion(vdev, &err)) {
+        error_append_hint(&err, "IGD legacy mode disabled\n");
+        error_report_err(err);
+        return;
+    }
+
     /* Create our LPC/ISA bridge */
     ret = vfio_pci_igd_lpc_init(vdev, lpc);
     if (ret) {
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
         return;
     }
 
-    /* Setup OpRegion access */
-    if (!vfio_pci_igd_opregion_init(vdev, opregion, &err)) {
-        error_append_hint(&err, "IGD legacy mode disabled\n");
-        error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
-        return;
-    }
-
     /*
      * Allow user to override dsm size using x-igd-gms option, in multiples of
      * 32MiB. This option should only be used when the desired size cannot be
diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci-quirks.c
+++ b/hw/vfio/pci-quirks.c
@@ -XXX,XX +XXX,XX @@ static void vfio_probe_rtl8168_bar2_quirk(VFIOPCIDevice *vdev, int nr)
     trace_vfio_quirk_rtl8168_probe(vdev->vbasedev.name);
 }
 
-#define IGD_ASLS 0xfc /* ASL Storage Register */
-
-/*
- * The OpRegion includes the Video BIOS Table, which seems important for
- * telling the driver what sort of outputs it has.  Without this, the device
- * may work in the guest, but we may not get output.  This also requires BIOS
- * support to reserve and populate a section of guest memory sufficient for
- * the table and to write the base address of that memory to the ASLS register
- * of the IGD device.
- */
-bool vfio_pci_igd_opregion_init(VFIOPCIDevice *vdev,
-                                struct vfio_region_info *info, Error **errp)
-{
-    int ret;
-
-    vdev->igd_opregion = g_malloc0(info->size);
-    ret = pread(vdev->vbasedev.fd, vdev->igd_opregion,
-                info->size, info->offset);
-    if (ret != info->size) {
-        error_setg(errp, "failed to read IGD OpRegion");
-        g_free(vdev->igd_opregion);
-        vdev->igd_opregion = NULL;
-        return false;
-    }
-
-    /*
-     * Provide fw_cfg with a copy of the OpRegion which the VM firmware is to
-     * allocate 32bit reserved memory for, copy these contents into, and write
-     * the reserved memory base address to the device ASLS register at 0xFC.
-     * Alignment of this reserved region seems flexible, but using a 4k page
-     * alignment seems to work well.  This interface assumes a single IGD
-     * device, which may be at VM address 00:02.0 in legacy mode or another
-     * address in UPT mode.
-     *
-     * NB, there may be future use cases discovered where the VM should have
-     * direct interaction with the host OpRegion, in which case the write to
-     * the ASLS register would trigger MemoryRegion setup to enable that.
-     */
-    fw_cfg_add_file(fw_cfg_find(), "etc/igd-opregion",
-                    vdev->igd_opregion, info->size);
-
-    trace_vfio_pci_igd_opregion_enabled(vdev->vbasedev.name);
-
-    pci_set_long(vdev->pdev.config + IGD_ASLS, 0);
-    pci_set_long(vdev->pdev.wmask + IGD_ASLS, ~0);
-    pci_set_long(vdev->emulated_config_bits + IGD_ASLS, ~0);
-
-    return true;
-}
-
 /*
  * Common quirk probe entry points.
  */
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -XXX,XX +XXX,XX @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
         vfio_bar_quirk_setup(vdev, i);
     }
 
+#ifdef CONFIG_VFIO_IGD
     if (!vdev->igd_opregion &&
         vdev->features & VFIO_FEATURE_ENABLE_IGD_OPREGION) {
-        g_autofree struct vfio_region_info *opregion = NULL;
-
-        if (vdev->pdev.qdev.hotplugged) {
-            error_setg(errp,
-                       "cannot support IGD OpRegion feature on hotplugged "
-                       "device");
-            goto out_unset_idev;
-        }
-
-        ret = vfio_get_dev_region_info(vbasedev,
-                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
-                        VFIO_REGION_SUBTYPE_INTEL_IGD_OPREGION, &opregion);
-        if (ret) {
-            error_setg_errno(errp, -ret,
-                             "does not support requested IGD OpRegion feature");
-            goto out_unset_idev;
-        }
-
-        if (!vfio_pci_igd_opregion_init(vdev, opregion, errp)) {
+        if (!vfio_pci_igd_setup_opregion(vdev, errp)) {
             goto out_unset_idev;
         }
     }
+#endif
 
     /* QEMU emulates all of MSI & MSIX */
     if (pdev->cap_present & QEMU_PCI_CAP_MSIX) {
-- 
2.48.1

From: Tomita Moeko <tomitamoeko@gmail.com>

A new option will soon be introduced to decouple the LPC bridge/Host
bridge ID quirk from legacy mode. To prepare for this, move the LPC
bridge initialization into a separate function.

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -XXX,XX +XXX,XX @@ static int vfio_pci_igd_lpc_init(VFIOPCIDevice *vdev,
     return ret;
 }
 
+static bool vfio_pci_igd_setup_lpc_bridge(VFIOPCIDevice *vdev, Error **errp)
+{
+    g_autofree struct vfio_region_info *host = NULL;
+    g_autofree struct vfio_region_info *lpc = NULL;
+    PCIDevice *lpc_bridge;
+    int ret;
+
+    /*
+     * Copying IDs or creating new devices are not supported on hotplug
+     */
+    if (vdev->pdev.qdev.hotplugged) {
+        error_setg(errp, "IGD LPC is not supported on hotplugged device");
+        return false;
+    }
+
+    /*
+     * We need to create an LPC/ISA bridge at PCI bus address 00:1f.0 that we
+     * can stuff host values into, so if there's already one there and it's not
+     * one we can hack on, this quirk is no-go.  Sorry Q35.
+     */
+    lpc_bridge = pci_find_device(pci_device_root_bus(&vdev->pdev),
+                                 0, PCI_DEVFN(0x1f, 0));
+    if (lpc_bridge && !object_dynamic_cast(OBJECT(lpc_bridge),
+                                           "vfio-pci-igd-lpc-bridge")) {
+        error_setg(errp,
+                   "Cannot create LPC bridge due to existing device at 1f.0");
+        return false;
+    }
+
+    /*
+     * Check whether we have all the vfio device specific regions to
+     * support LPC quirk (added in Linux v4.6).
+     */
+    ret = vfio_get_dev_region_info(&vdev->vbasedev,
+                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
+                        VFIO_REGION_SUBTYPE_INTEL_IGD_LPC_CFG, &lpc);
+    if (ret) {
+        error_setg(errp, "IGD LPC bridge access is not supported by kernel");
+        return false;
+    }
+
+    ret = vfio_get_dev_region_info(&vdev->vbasedev,
+                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
+                        VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG, &host);
+    if (ret) {
+        error_setg(errp, "IGD host bridge access is not supported by kernel");
+        return false;
+    }
+
+    /* Create/modify LPC bridge */
+    ret = vfio_pci_igd_lpc_init(vdev, lpc);
+    if (ret) {
+        error_setg(errp, "Failed to create/modify LPC bridge for IGD");
+        return false;
+    }
+
+    /* Stuff some host values into the VM PCI host bridge */
+    ret = vfio_pci_igd_host_init(vdev, host);
+    if (ret) {
+        error_setg(errp, "Failed to modify host bridge for IGD");
+        return false;
+    }
+
+    return true;
+}
+
 #define IGD_GGC_MMIO_OFFSET     0x108040
 #define IGD_BDSM_MMIO_OFFSET    0x1080C0
 
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
 void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
 {
     g_autofree struct vfio_region_info *rom = NULL;
-    g_autofree struct vfio_region_info *host = NULL;
-    g_autofree struct vfio_region_info *lpc = NULL;
-    PCIDevice *lpc_bridge;
     int ret, gen;
     uint64_t gms_size;
     uint64_t *bdsm_size;
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
         return;
     }
 
-    /*
-     * We need to create an LPC/ISA bridge at PCI bus address 00:1f.0 that we
-     * can stuff host values into, so if there's already one there and it's not
-     * one we can hack on, legacy mode is no-go.  Sorry Q35.
-     */
-    lpc_bridge = pci_find_device(pci_device_root_bus(&vdev->pdev),
-                                 0, PCI_DEVFN(0x1f, 0));
-    if (lpc_bridge && !object_dynamic_cast(OBJECT(lpc_bridge),
-                                           "vfio-pci-igd-lpc-bridge")) {
-        error_report("IGD device %s cannot support legacy mode due to existing "
-                     "devices at address 1f.0", vdev->vbasedev.name);
-        return;
-    }
-
     /*
      * IGD is not a standard, they like to change their specs often.  We
      * only attempt to support back to SandBridge and we hope that newer
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
         return;
     }
 
-    /*
-     * Check whether we have all the vfio device specific regions to
-     * support legacy mode (added in Linux v4.6).  If not, bail.
-     */
-    ret = vfio_get_dev_region_info(&vdev->vbasedev,
-                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
-                        VFIO_REGION_SUBTYPE_INTEL_IGD_HOST_CFG, &host);
-    if (ret) {
-        error_report("IGD device %s does not support host bridge access,"
-                     "legacy mode disabled", vdev->vbasedev.name);
-        return;
-    }
-
-    ret = vfio_get_dev_region_info(&vdev->vbasedev,
-                        VFIO_REGION_TYPE_PCI_VENDOR_TYPE | PCI_VENDOR_ID_INTEL,
-                        VFIO_REGION_SUBTYPE_INTEL_IGD_LPC_CFG, &lpc);
-    if (ret) {
-        error_report("IGD device %s does not support LPC bridge access,"
-                     "legacy mode disabled", vdev->vbasedev.name);
-        return;
-    }
-
     gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, 4);
 
     /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
         return;
     }
 
-    /* Create our LPC/ISA bridge */
-    ret = vfio_pci_igd_lpc_init(vdev, lpc);
-    if (ret) {
-        error_report("IGD device %s failed to create LPC bridge, "
-                     "legacy mode disabled", vdev->vbasedev.name);
-        return;
-    }
-
-    /* Stuff some host values into the VM PCI host bridge */
-    ret = vfio_pci_igd_host_init(vdev, host);
-    if (ret) {
-        error_report("IGD device %s failed to modify host bridge, "
-                     "legacy mode disabled", vdev->vbasedev.name);
+    /* Setup LPC bridge / Host bridge PCI IDs */
+    if (!vfio_pci_igd_setup_lpc_bridge(vdev, &err)) {
+        error_append_hint(&err, "IGD legacy mode disabled\n");
+        error_report_err(err);
         return;
     }
 
-- 
2.48.1

From: Tomita Moeko <tomitamoeko@gmail.com>

IGD devices require device-specific quirk to be applied to their PCI
config space. Currently, it is put in the BAR4 quirk that does nothing
to BAR4 itself. Add a placeholder for PCI config space quirks to hold
that quirk later.

diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -XXX,XX +XXX,XX @@ uint64_t vfio_vga_read(void *opaque, hwaddr addr, unsigned size);
 void vfio_vga_write(void *opaque, hwaddr addr, uint64_t data, unsigned size);
 
 bool vfio_opt_rom_in_denylist(VFIOPCIDevice *vdev);
+bool vfio_config_quirk_setup(VFIOPCIDevice *vdev, Error **errp);
 void vfio_vga_quirk_setup(VFIOPCIDevice *vdev);
 void vfio_vga_quirk_exit(VFIOPCIDevice *vdev);
 void vfio_vga_quirk_finalize(VFIOPCIDevice *vdev);
diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci-quirks.c
+++ b/hw/vfio/pci-quirks.c
@@ -XXX,XX +XXX,XX @@ static void vfio_probe_rtl8168_bar2_quirk(VFIOPCIDevice *vdev, int nr)
 /*
  * Common quirk probe entry points.
  */
+bool vfio_config_quirk_setup(VFIOPCIDevice *vdev, Error **errp)
+{
+    return true;
+}
+
 void vfio_vga_quirk_setup(VFIOPCIDevice *vdev)
 {
     vfio_vga_probe_ati_3c3_quirk(vdev);
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -XXX,XX +XXX,XX @@ static void vfio_realize(PCIDevice *pdev, Error **errp)
         goto out_unset_idev;
     }
 
+    if (!vfio_config_quirk_setup(vdev, errp)) {
+        goto out_unset_idev;
+    }
+
     if (vdev->vga) {
         vfio_vga_quirk_setup(vdev);
     }
-- 
2.48.1

From: Tomita Moeko <tomitamoeko@gmail.com>

The actual IO BAR4 write quirk in vfio_probe_igd_bar4_quirk was removed
in previous change, leaving the function not matching its name, so move
it into the newly introduced vfio_config_quirk_setup. There is no
functional change in this commit.

For now, to align with current legacy mode behavior, it returns and
proceeds on error. Later it will fail on error after decoupling the
quirks from legacy mode.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-7-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.h        |  2 +-
 hw/vfio/igd.c        | 21 ++++++++++++---------
 hw/vfio/pci-quirks.c |  6 +++++-
 3 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -XXX,XX +XXX,XX @@ bool vfio_add_virt_caps(VFIOPCIDevice *vdev, Error **errp);
 void vfio_quirk_reset(VFIOPCIDevice *vdev);
 VFIOQuirk *vfio_quirk_alloc(int nr_mem);
 void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr);
-void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr);
+bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp);
 
 extern const PropertyInfo qdev_prop_nv_gpudirect_clique;
 
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
     QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, bdsm_quirk, next);
 }
 
-void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
+bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev,
+                                 Error **errp G_GNUC_UNUSED)
 {
     g_autofree struct vfio_region_info *rom = NULL;
     int ret, gen;
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
      * PCI bus address.
      */
     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
-        !vfio_is_vga(vdev) || nr != 4 ||
+        !vfio_is_vga(vdev) ||
         &vdev->pdev != pci_find_device(pci_device_root_bus(&vdev->pdev),
                                        0, PCI_DEVFN(0x2, 0))) {
-        return;
+        return true;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
     if (gen == -1) {
         error_report("IGD device %s is unsupported in legacy mode, "
                      "try SandyBridge or newer", vdev->vbasedev.name);
-        return;
+        return true;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
     if ((ret || !rom->size) && !vdev->pdev.romfile) {
         error_report("IGD device %s has no ROM, legacy mode disabled",
                      vdev->vbasedev.name);
-        return;
+        return true;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
         error_report("IGD device %s hotplugged, ROM disabled, "
                      "legacy mode disabled", vdev->vbasedev.name);
         vdev->rom_read_failed = true;
-        return;
+        return true;
     }
 
     gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, 4);
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
         error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
         error_report("IGD device %s failed to enable VGA access, "
                      "legacy mode disabled", vdev->vbasedev.name);
-        return;
+        return true;
     }
 
     /* Setup OpRegion access */
     if (!vfio_pci_igd_setup_opregion(vdev, &err)) {
         error_append_hint(&err, "IGD legacy mode disabled\n");
         error_report_err(err);
-        return;
+        return true;
     }
 
     /* Setup LPC bridge / Host bridge PCI IDs */
     if (!vfio_pci_igd_setup_lpc_bridge(vdev, &err)) {
         error_append_hint(&err, "IGD legacy mode disabled\n");
         error_report_err(err);
-        return;
+        return true;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar4_quirk(VFIOPCIDevice *vdev, int nr)
     }
 
     trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name, (gms_size / MiB));
+
+    return true;
 }
diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci-quirks.c
+++ b/hw/vfio/pci-quirks.c
@@ -XXX,XX +XXX,XX @@ static void vfio_probe_rtl8168_bar2_quirk(VFIOPCIDevice *vdev, int nr)
  */
 bool vfio_config_quirk_setup(VFIOPCIDevice *vdev, Error **errp)
 {
+#ifdef CONFIG_VFIO_IGD
+    if (!vfio_probe_igd_config_quirk(vdev, errp)) {
+        return false;
+    }
+#endif
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ void vfio_bar_quirk_setup(VFIOPCIDevice *vdev, int nr)
     vfio_probe_rtl8168_bar2_quirk(vdev, nr);
 #ifdef CONFIG_VFIO_IGD
     vfio_probe_igd_bar0_quirk(vdev, nr);
-    vfio_probe_igd_bar4_quirk(vdev, nr);
 #endif
 }
 
-- 
2.48.1

From: Tomita Moeko <tomitamoeko@gmail.com>

So far, IGD-specific quirks all require enabling legacy mode, which is
toggled by assigning IGD to 00:02.0. However, some quirks, like the BDSM
and GGC register quirks, should be applied to all supported IGD devices.
A new config option, x-igd-legacy-mode=[on|off|auto], is introduced to
control the legacy mode only quirks. The default value is "auto", which
keeps current behavior that enables legacy mode implicitly and continues
on error when all following conditions are met.
* Machine type is i440fx
* IGD device is at guest BDF 00:02.0

If any one of the conditions above is not met, the default behavior is
equivalent to "off", QEMU will fail immediately if any error occurs.

Users can also use "on" to force enabling legacy mode. It checks if all
the conditions above are met and set up legacy mode. QEMU will also fail
immediately on error in this case.

Additionally, the hotplug check in legacy mode is removed as hotplugging
IGD device is never supported, and it will be checked when enabling the
OpRegion quirk.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-8-tomitamoeko@gmail.com
[ clg: - Changed warn_report() by info_report() in
         vfio_probe_igd_config_quirk() as suggested by Alex W.
       - Fixed spelling in vfio_probe_igd_config_quirk () ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.h |   1 +
 hw/vfio/igd.c | 127 +++++++++++++++++++++++++++++---------------------
 hw/vfio/pci.c |   2 +
 3 files changed, 77 insertions(+), 53 deletions(-)

diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -XXX,XX +XXX,XX @@ struct VFIOPCIDevice {
     uint32_t display_xres;
     uint32_t display_yres;
     int32_t bootindex;
+    OnOffAuto igd_legacy_mode;
     uint32_t igd_gms;
     OffAutoPCIBAR msix_relo;
     uint8_t nv_gpudirect_clique;
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
+#include "hw/boards.h"
 #include "hw/hw.h"
 #include "hw/nvram/fw_cfg.h"
 #include "pci.h"
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
      * bus address.
      */
     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
-        !vfio_is_vga(vdev) || nr != 0 ||
-        &vdev->pdev != pci_find_device(pci_device_root_bus(&vdev->pdev),
-                                       0, PCI_DEVFN(0x2, 0))) {
+        !vfio_is_vga(vdev) || nr != 0) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
     QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, bdsm_quirk, next);
 }
 
-bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev,
-                                 Error **errp G_GNUC_UNUSED)
+bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 {
-    g_autofree struct vfio_region_info *rom = NULL;
     int ret, gen;
     uint64_t gms_size;
     uint64_t *bdsm_size;
     uint32_t gmch;
+    bool legacy_mode_enabled = false;
     Error *err = NULL;
 
     /*
@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev,
      * PCI bus address.
      */
     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
-        !vfio_is_vga(vdev) ||
-        &vdev->pdev != pci_find_device(pci_device_root_bus(&vdev->pdev),
-                                       0, PCI_DEVFN(0x2, 0))) {
+        !vfio_is_vga(vdev)) {
         return true;
     }
 
@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev,
         return true;
     }
 
-    /*
-     * Most of what we're doing here is to enable the ROM to run, so if
-     * there's no ROM, there's no point in setting up this quirk.
-     * NB. We only seem to get BIOS ROMs, so a UEFI VM would need CSM support.
-     */
-    ret = vfio_get_region_info(&vdev->vbasedev,
-                               VFIO_PCI_ROM_REGION_INDEX, &rom);
-    if ((ret || !rom->size) && !vdev->pdev.romfile) {
-        error_report("IGD device %s has no ROM, legacy mode disabled",
-                     vdev->vbasedev.name);
-        return true;
-    }
-
-    /*
-     * Ignore the hotplug corner case, mark the ROM failed, we can't
-     * create the devices we need for legacy mode in the hotplug scenario.
-     */
-    if (vdev->pdev.qdev.hotplugged) {
-        error_report("IGD device %s hotplugged, ROM disabled, "
-                     "legacy mode disabled", vdev->vbasedev.name);
-        vdev->rom_read_failed = true;
-        return true;
-    }
-
     gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, 4);
 
     /*
-     * If IGD VGA Disable is clear (expected) and VGA is not already enabled,
-     * try to enable it.  Probably shouldn't be using legacy mode without VGA,
-     * but also no point in us enabling VGA if disabled in hardware.
+     * For backward compatibility, enable legacy mode when
+     * - Machine type is i440fx (pc_piix)
+     * - IGD device is at guest BDF 00:02.0
+     * - Not manually disabled by x-igd-legacy-mode=off
      */
-    if (!(gmch & 0x2) && !vdev->vga && !vfio_populate_vga(vdev, &err)) {
-        error_reportf_err(err, VFIO_MSG_PREFIX, vdev->vbasedev.name);
-        error_report("IGD device %s failed to enable VGA access, "
-                     "legacy mode disabled", vdev->vbasedev.name);
-        return true;
-    }
+    if ((vdev->igd_legacy_mode != ON_OFF_AUTO_OFF) &&
+        !strcmp(MACHINE_GET_CLASS(qdev_get_machine())->family, "pc_piix") &&
+        (&vdev->pdev == pci_find_device(pci_device_root_bus(&vdev->pdev),
+        0, PCI_DEVFN(0x2, 0)))) {
+        /*
+         * IGD legacy mode requires:
+         * - VBIOS in ROM BAR or file
+         * - VGA IO/MMIO ranges are claimed by IGD
+         * - OpRegion
+         * - Same LPC bridge and Host bridge VID/DID/SVID/SSID as host
+         */
+        g_autofree struct vfio_region_info *rom = NULL;
+
+        legacy_mode_enabled = true;
+        info_report("IGD legacy mode enabled, "
+                    "use x-igd-legacy-mode=off to disable it if unwanted.");
+
+        /*
+         * Most of what we're doing here is to enable the ROM to run, so if
+         * there's no ROM, there's no point in setting up this quirk.
+         * NB. We only seem to get BIOS ROMs, so UEFI VM would need CSM support.
+         */
+        ret = vfio_get_region_info(&vdev->vbasedev,
+                                   VFIO_PCI_ROM_REGION_INDEX, &rom);
+        if ((ret || !rom->size) && !vdev->pdev.romfile) {
+            error_setg(&err, "Device has no ROM");
+            goto error;
+        }
 
-    /* Setup OpRegion access */
-    if (!vfio_pci_igd_setup_opregion(vdev, &err)) {
-        error_append_hint(&err, "IGD legacy mode disabled\n");
-        error_report_err(err);
-        return true;
-    }
+        /*
+         * If IGD VGA Disable is clear (expected) and VGA is not already
+         * enabled, try to enable it. Probably shouldn't be using legacy mode
+         * without VGA, but also no point in us enabling VGA if disabled in
+         * hardware.
+         */
+        if (!(gmch & 0x2) && !vdev->vga && !vfio_populate_vga(vdev, &err)) {
+            error_setg(&err, "Unable to enable VGA access");
+            goto error;
+        }
 
-    /* Setup LPC bridge / Host bridge PCI IDs */
-    if (!vfio_pci_igd_setup_lpc_bridge(vdev, &err)) {
-        error_append_hint(&err, "IGD legacy mode disabled\n");
-        error_report_err(err);
-        return true;
+        /* Setup OpRegion access */
+        if (!vfio_pci_igd_setup_opregion(vdev, &err)) {
+            goto error;
+        }
+
+        /* Setup LPC bridge / Host bridge PCI IDs */
+        if (!vfio_pci_igd_setup_lpc_bridge(vdev, &err)) {
+            goto error;
+        }
+    } else if (vdev->igd_legacy_mode == ON_OFF_AUTO_ON) {
+        error_setg(&err,
+                   "Machine is not i440fx or assigned BDF is not 00:02.0");
+        goto error;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev,
     trace_vfio_pci_igd_bdsm_enabled(vdev->vbasedev.name, (gms_size / MiB));
 
     return true;
+
+error:
+    /*
+     * When legacy mode is implicity enabled, continue on error,
+     * to keep compatibility
+     */
+    if (legacy_mode_enabled && (vdev->igd_legacy_mode == ON_OFF_AUTO_AUTO)) {
+        error_report_err(err);
+        error_report("IGD legacy mode disabled");
+        return true;
+    }
+
+    error_propagate(errp, err);
+    return false;
 }
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -XXX,XX +XXX,XX @@ static const Property vfio_pci_dev_properties[] = {
                     VFIO_FEATURE_ENABLE_REQ_BIT, true),
     DEFINE_PROP_BIT("x-igd-opregion", VFIOPCIDevice, features,
                     VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT, false),
+    DEFINE_PROP_ON_OFF_AUTO("x-igd-legacy-mode", VFIOPCIDevice,
+                            igd_legacy_mode, ON_OFF_AUTO_AUTO),
     DEFINE_PROP_ON_OFF_AUTO("enable-migration", VFIOPCIDevice,
                             vbasedev.enable_migration, ON_OFF_AUTO_AUTO),
     DEFINE_PROP("x-migration-multifd-transfer", VFIOPCIDevice,
-- 
2.48.1

From: Tomita Moeko <tomitamoeko@gmail.com>

Both enable OpRegion option (x-igd-opregion) and legacy mode require
setting up OpRegion copy for IGD devices. As the config quirk no longer
depends on legacy mode, we can now handle x-igd-opregion option there
instead of in vfio_realize.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-9-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.h |  2 --
 hw/vfio/igd.c | 14 +++++++++-----
 hw/vfio/pci.c |  9 ---------
 3 files changed, 9 insertions(+), 16 deletions(-)

From: Tomita Moeko <tomitamoeko@gmail.com>

The LPC bridge/Host bridge IDs quirk is also not dependent on legacy
mode. Recent Windows driver no longer depends on these IDs, as well as
Linux i915 driver, while UEFI GOP seems still needs them. Make it an
option to allow users enabling and disabling it as needed.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Corvin Köhne <c.koehne@beckhoff.com>
Link: https://lore.kernel.org/qemu-devel/20250306180131.32970-10-tomitamoeko@gmail.com
[ clg: - Fixed spelling in vfio_probe_igd_config_quirk() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.h |  3 +++
 hw/vfio/igd.c | 14 ++++++++------
 hw/vfio/pci.c |  2 ++
 3 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -XXX,XX +XXX,XX @@ struct VFIOPCIDevice {
 #define VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT 2
 #define VFIO_FEATURE_ENABLE_IGD_OPREGION \
                                 (1 << VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT)
+#define VFIO_FEATURE_ENABLE_IGD_LPC_BIT 3
+#define VFIO_FEATURE_ENABLE_IGD_LPC \
+                                (1 << VFIO_FEATURE_ENABLE_IGD_LPC_BIT)
     OnOffAuto display;
     uint32_t display_xres;
     uint32_t display_yres;
diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
             goto error;
         }
 
-        /* Enable OpRegion quirk */
+        /* Enable OpRegion and LPC bridge quirk */
         vdev->features |= VFIO_FEATURE_ENABLE_IGD_OPREGION;
-
-        /* Setup LPC bridge / Host bridge PCI IDs */
-        if (!vfio_pci_igd_setup_lpc_bridge(vdev, &err)) {
-            goto error;
-        }
+        vdev->features |= VFIO_FEATURE_ENABLE_IGD_LPC;
     } else if (vdev->igd_legacy_mode == ON_OFF_AUTO_ON) {
         error_setg(&err,
                    "Machine is not i440fx or assigned BDF is not 00:02.0");
@@ -XXX,XX +XXX,XX @@ bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
         goto error;
     }
 
+    /* Setup LPC bridge / Host bridge PCI IDs */
+    if ((vdev->features & VFIO_FEATURE_ENABLE_IGD_LPC) &&
+        !vfio_pci_igd_setup_lpc_bridge(vdev, errp)) {
+        goto error;
+     }
+
     /*
      * Allow user to override dsm size using x-igd-gms option, in multiples of
      * 32MiB. This option should only be used when the desired size cannot be
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -XXX,XX +XXX,XX @@ static const Property vfio_pci_dev_properties[] = {
                     VFIO_FEATURE_ENABLE_REQ_BIT, true),
     DEFINE_PROP_BIT("x-igd-opregion", VFIOPCIDevice, features,
                     VFIO_FEATURE_ENABLE_IGD_OPREGION_BIT, false),
+    DEFINE_PROP_BIT("x-igd-lpc", VFIOPCIDevice, features,
+                    VFIO_FEATURE_ENABLE_IGD_LPC_BIT, false),
     DEFINE_PROP_ON_OFF_AUTO("x-igd-legacy-mode", VFIOPCIDevice,
                             igd_legacy_mode, ON_OFF_AUTO_AUTO),
     DEFINE_PROP_ON_OFF_AUTO("enable-migration", VFIOPCIDevice,
-- 
2.48.1

From: Tomita Moeko <tomitamoeko@gmail.com>

The KVMGT/GVT-g vGPU also exposes OpRegion. But unlike IGD passthrough,
it only needs the OpRegion quirk. A previous change moved x-igd-opregion
handling to config quirk breaks KVMGT functionality as it brings extra
checks and applied other quirks. Here we check if the device is mdev
(KVMGT) or not (passthrough), and then applies corresponding quirks.

As before, users must manually specify x-igd-opregion=on to enable it
on KVMGT devices. In the future, we may check the VID/DID and enable
OpRegion automatically.

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
     QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, bdsm_quirk, next);
 }
 
-bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
+static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 {
     int ret, gen;
     uint64_t gms_size;
@@ -XXX,XX +XXX,XX @@ error:
     error_propagate(errp, err);
     return false;
 }
+
+/*
+ * KVMGT/GVT-g vGPU exposes an emulated OpRegion. So far, users have to specify
+ * x-igd-opregion=on to enable the access.
+ * TODO: Check VID/DID and enable opregion access automatically
+ */
+static bool vfio_pci_kvmgt_config_quirk(VFIOPCIDevice *vdev, Error **errp)
+{
+    if ((vdev->features & VFIO_FEATURE_ENABLE_IGD_OPREGION) &&
+        !vfio_pci_igd_setup_opregion(vdev, errp)) {
+        return false;
+    }
+
+    return true;
+}
+
+bool vfio_probe_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
+{
+    /* KVMGT/GVT-g vGPU is exposed as mdev */
+    if (vdev->vbasedev.mdev) {
+        return vfio_pci_kvmgt_config_quirk(vdev, errp);
+    }
+
+    return vfio_pci_igd_config_quirk(vdev, errp);
+}
-- 
2.48.1

From: "Maciej S. Szmigiero" <maciej.szmigiero@oracle.com>

Wire data commonly use BE byte order (including in the existing migration
protocol), use it also for for VFIO device state packets.

This will allow VFIO multifd device state transfer between hosts with
different endianness.
Although currently there is no such use case, it's good to have it now
for completeness.

Reviewed-by: Avihai Horon <avihaih@nvidia.com>
Signed-off-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Link: https://lore.kernel.org/qemu-devel/dcfc04cc1a50655650dbac8398e2742ada84ee39.1741611079.git.maciej.szmigiero@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration-multifd.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/hw/vfio/migration-multifd.c b/hw/vfio/migration-multifd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/migration-multifd.c
+++ b/hw/vfio/migration-multifd.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/vfio/vfio-common.h"
 #include "migration/misc.h"
 #include "qapi/error.h"
+#include "qemu/bswap.h"
 #include "qemu/error-report.h"
 #include "qemu/lockable.h"
 #include "qemu/main-loop.h"
@@ -XXX,XX +XXX,XX @@ bool vfio_multifd_load_state_buffer(void *opaque, char *data, size_t data_size,
         return false;
     }
 
+    packet->version = be32_to_cpu(packet->version);
     if (packet->version != VFIO_DEVICE_STATE_PACKET_VER_CURRENT) {
         error_setg(errp, "%s: packet has unknown version %" PRIu32,
                    vbasedev->name, packet->version);
         return false;
     }
 
+    packet->idx = be32_to_cpu(packet->idx);
+    packet->flags = be32_to_cpu(packet->flags);
+
     if (packet->idx == UINT32_MAX) {
         error_setg(errp, "%s: packet index is invalid", vbasedev->name);
         return false;
@@ -XXX,XX +XXX,XX @@ vfio_save_complete_precopy_thread_config_state(VFIODevice *vbasedev,
 
     packet_len = sizeof(*packet) + bioc->usage;
     packet = g_malloc0(packet_len);
-    packet->version = VFIO_DEVICE_STATE_PACKET_VER_CURRENT;
-    packet->idx = idx;
-    packet->flags = VFIO_DEVICE_STATE_CONFIG_STATE;
+    packet->version = cpu_to_be32(VFIO_DEVICE_STATE_PACKET_VER_CURRENT);
+    packet->idx = cpu_to_be32(idx);
+    packet->flags = cpu_to_be32(VFIO_DEVICE_STATE_CONFIG_STATE);
     memcpy(&packet->data, bioc->data, bioc->usage);
 
     if (!multifd_queue_device_state(idstr, instance_id,
@@ -XXX,XX +XXX,XX @@ vfio_multifd_save_complete_precopy_thread(SaveLiveCompletePrecopyThreadData *d,
     }
 
     packet = g_malloc0(sizeof(*packet) + migration->data_buffer_size);
-    packet->version = VFIO_DEVICE_STATE_PACKET_VER_CURRENT;
+    packet->version = cpu_to_be32(VFIO_DEVICE_STATE_PACKET_VER_CURRENT);
 
     for (idx = 0; ; idx++) {
         ssize_t data_size;
@@ -XXX,XX +XXX,XX @@ vfio_multifd_save_complete_precopy_thread(SaveLiveCompletePrecopyThreadData *d,
             break;
         }
 
-        packet->idx = idx;
+        packet->idx = cpu_to_be32(idx);
         packet_size = sizeof(*packet) + data_size;
 
         if (!multifd_queue_device_state(d->idstr, d->instance_id,
-- 
2.48.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Both qemu_minrampagesize() and qemu_maxrampagesize() are
related to host memory backends, having the following call
stack:

qemu_minrampagesize()
     -> find_min_backend_pagesize()
         -> object_dynamic_cast(obj, TYPE_MEMORY_BACKEND)

qemu_maxrampagesize()
     -> find_max_backend_pagesize()
        -> object_dynamic_cast(obj, TYPE_MEMORY_BACKEND)

Having TYPE_MEMORY_BACKEND defined in "system/hostmem.h":

include/system/hostmem.h:23:#define TYPE_MEMORY_BACKEND "memory-backend"

Move their prototype declaration to "system/hostmem.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-Id: <20250308230917.18907-7-philmd@linaro.org>
Acked-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-2-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/exec/ram_addr.h    | 3 ---
 include/system/hostmem.h   | 3 +++
 hw/ppc/spapr_caps.c        | 1 +
 hw/s390x/s390-virtio-ccw.c | 1 +
 hw/vfio/spapr.c            | 1 +
 5 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/include/exec/ram_addr.h b/include/exec/ram_addr.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/ram_addr.h
+++ b/include/exec/ram_addr.h
@@ -XXX,XX +XXX,XX @@ static inline unsigned long int ramblock_recv_bitmap_offset(void *host_addr,
 
 bool ramblock_is_pmem(RAMBlock *rb);
 
-long qemu_minrampagesize(void);
-long qemu_maxrampagesize(void);
-
 /**
  * qemu_ram_alloc_from_file,
  * qemu_ram_alloc_from_fd:  Allocate a ram block from the specified backing
diff --git a/include/system/hostmem.h b/include/system/hostmem.h
index XXXXXXX..XXXXXXX 100644
--- a/include/system/hostmem.h
+++ b/include/system/hostmem.h
@@ -XXX,XX +XXX,XX @@ bool host_memory_backend_is_mapped(HostMemoryBackend *backend);
 size_t host_memory_backend_pagesize(HostMemoryBackend *memdev);
 char *host_memory_backend_get_name(HostMemoryBackend *backend);
 
+long qemu_minrampagesize(void);
+long qemu_maxrampagesize(void);
+
 #endif
diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/spapr_caps.c
+++ b/hw/ppc/spapr_caps.c
@@ -XXX,XX +XXX,XX @@
 #include "kvm_ppc.h"
 #include "migration/vmstate.h"
 #include "system/tcg.h"
+#include "system/hostmem.h"
 
 #include "hw/ppc/spapr.h"
 
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/s390x/tod.h"
 #include "system/system.h"
 #include "system/cpus.h"
+#include "system/hostmem.h"
 #include "target/s390x/kvm/pv.h"
 #include "migration/blocker.h"
 #include "qapi/visitor.h"
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -XXX,XX +XXX,XX @@
 #include <linux/kvm.h>
 #endif
 #include "system/kvm.h"
+#include "system/hostmem.h"
 #include "exec/address-spaces.h"
 
 #include "hw/vfio/vfio-common.h"
-- 
2.48.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

<linux/kvm.h> is already included by "system/kvm.h" in the next line.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-Id: <20250307180337.14811-3-philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-3-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/spapr.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include <sys/ioctl.h>
 #include <linux/vfio.h>
-#ifdef CONFIG_KVM
-#include <linux/kvm.h>
-#endif
 #include "system/kvm.h"
 #include "system/hostmem.h"
 #include "exec/address-spaces.h"
-- 
2.48.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Always include necessary headers explicitly, to avoid
when refactoring unrelated ones:

hw/vfio/common.c:1176:45: error: implicit declaration of function ‘tcg_enabled’;
   1176 |                                             tcg_enabled() ? DIRTY_CLIENTS_ALL :
        |                                             ^~~~~~~~~~~

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-Id: <20250307180337.14811-2-philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-4-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/misc.h"
 #include "migration/blocker.h"
 #include "migration/qemu-file.h"
+#include "system/tcg.h"
 #include "system/tpm.h"
 
 VFIODeviceList vfio_device_list =
-- 
2.48.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Prefer runtime helpers to get target page size.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20250305153929.43687-3-philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-5-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/common.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "exec/memory.h"
 #include "exec/ram_addr.h"
+#include "exec/target_page.h"
 #include "hw/hw.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
@@ -XXX,XX +XXX,XX @@ static void vfio_register_ram_discard_listener(VFIOContainerBase *bcontainer,
                                                MemoryRegionSection *section)
 {
     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
+    int target_page_size = qemu_target_page_size();
     VFIORamDiscardListener *vrdl;
 
     /* Ignore some corner cases not relevant in practice. */
-    g_assert(QEMU_IS_ALIGNED(section->offset_within_region, TARGET_PAGE_SIZE));
+    g_assert(QEMU_IS_ALIGNED(section->offset_within_region, target_page_size));
     g_assert(QEMU_IS_ALIGNED(section->offset_within_address_space,
-                             TARGET_PAGE_SIZE));
-    g_assert(QEMU_IS_ALIGNED(int128_get64(section->size), TARGET_PAGE_SIZE));
+                             target_page_size));
+    g_assert(QEMU_IS_ALIGNED(int128_get64(section->size), target_page_size));
 
     vrdl = g_new0(VFIORamDiscardListener, 1);
     vrdl->bcontainer = bcontainer;
-- 
2.48.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Some files don't rely on any target-specific knowledge
and can be compiled once:

- helpers.c
 - container-base.c
 - migration.c (removing unnecessary "exec/ram_addr.h")
 - migration-multifd.c
 - cpr.c

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-Id: <20250308230917.18907-4-philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-6-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c |  1 -
 hw/vfio/meson.build | 13 ++++++++-----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qapi/qapi-events-vfio.h"
 #include "exec/ramlist.h"
-#include "exec/ram_addr.h"
 #include "pci.h"
 #include "trace.h"
 #include "hw/hw.h"
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -XXX,XX +XXX,XX @@
 vfio_ss = ss.source_set()
 vfio_ss.add(files(
-  'helpers.c',
   'common.c',
-  'container-base.c',
   'container.c',
-  'migration.c',
-  'migration-multifd.c',
-  'cpr.c',
 ))
 vfio_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr.c'))
 vfio_ss.add(when: 'CONFIG_IOMMUFD', if_true: files(
@@ -XXX,XX +XXX,XX @@ vfio_ss.add(when: 'CONFIG_VFIO_AP', if_true: files('ap.c'))
 vfio_ss.add(when: 'CONFIG_VFIO_IGD', if_true: files('igd.c'))
 
 specific_ss.add_all(when: 'CONFIG_VFIO', if_true: vfio_ss)
+
+system_ss.add(when: 'CONFIG_VFIO', if_true: files(
+  'helpers.c',
+  'container-base.c',
+  'migration.c',
+  'migration-multifd.c',
+  'cpr.c',
+))
-- 
2.48.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

These files depend on the VFIO symbol in their Kconfig
definition. They don't rely on target specific definitions,
move them to system_ss[] to build them once.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-Id: <20250308230917.18907-5-philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-7-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/meson.build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -XXX,XX +XXX,XX @@ vfio_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
 ))
 vfio_ss.add(when: 'CONFIG_VFIO_CCW', if_true: files('ccw.c'))
 vfio_ss.add(when: 'CONFIG_VFIO_PLATFORM', if_true: files('platform.c'))
-vfio_ss.add(when: 'CONFIG_VFIO_XGMAC', if_true: files('calxeda-xgmac.c'))
-vfio_ss.add(when: 'CONFIG_VFIO_AMD_XGBE', if_true: files('amd-xgbe.c'))
 vfio_ss.add(when: 'CONFIG_VFIO_AP', if_true: files('ap.c'))
 vfio_ss.add(when: 'CONFIG_VFIO_IGD', if_true: files('igd.c'))
 
 specific_ss.add_all(when: 'CONFIG_VFIO', if_true: vfio_ss)
 
+system_ss.add(when: 'CONFIG_VFIO_XGMAC', if_true: files('calxeda-xgmac.c'))
+system_ss.add(when: 'CONFIG_VFIO_AMD_XGBE', if_true: files('amd-xgbe.c'))
 system_ss.add(when: 'CONFIG_VFIO', if_true: files(
   'helpers.c',
   'container-base.c',
-- 
2.48.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Removing unused "exec/ram_addr.h" header allow to compile
iommufd.c once for all targets.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-Id: <20250308230917.18907-6-philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-8-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c   | 1 -
 hw/vfio/meson.build | 6 +++---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/cutils.h"
 #include "qemu/chardev_open.h"
 #include "pci.h"
-#include "exec/ram_addr.h"
 
 static int iommufd_cdev_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                             ram_addr_t size, void *vaddr, bool readonly)
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -XXX,XX +XXX,XX @@ vfio_ss.add(files(
   'container.c',
 ))
 vfio_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr.c'))
-vfio_ss.add(when: 'CONFIG_IOMMUFD', if_true: files(
-  'iommufd.c',
-))
 vfio_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
   'display.c',
   'pci-quirks.c',
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VFIO', if_true: files(
   'migration-multifd.c',
   'cpr.c',
 ))
+system_ss.add(when: ['CONFIG_VFIO', 'CONFIG_IOMMUFD'], if_true: files(
+  'iommufd.c',
+))
-- 
2.48.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

display.c doesn't rely on target specific definitions,
move it to system_ss[] to build it once.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-Id: <20250308230917.18907-8-philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250311085743.21724-9-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/meson.build | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -XXX,XX +XXX,XX @@ vfio_ss.add(files(
 ))
 vfio_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr.c'))
 vfio_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
-  'display.c',
   'pci-quirks.c',
   'pci.c',
 ))
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VFIO', if_true: files(
 system_ss.add(when: ['CONFIG_VFIO', 'CONFIG_IOMMUFD'], if_true: files(
   'iommufd.c',
 ))
+system_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
+  'display.c',
+))
-- 
2.48.1

From: Vasilis Liaskovitis <vliaskovitis@suse.com>

The ATI BAR4 quirk is targeting an ioport BAR. Older devices may
have a BAR4 which is not an ioport, causing a segfault here. Test
the BAR type to skip these devices.

Similar to
"8f419c5b: vfio/pci-quirks: Exclude non-ioport BAR from NVIDIA quirk"

Untested, as I don't have the card to test.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2856
Signed-off-by: Vasilis Liaskovitis <vliaskovitis@suse.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250310235833.41026-1-vliaskovitis@suse.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci-quirks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci-quirks.c
+++ b/hw/vfio/pci-quirks.c
@@ -XXX,XX +XXX,XX @@ static void vfio_probe_ati_bar4_quirk(VFIOPCIDevice *vdev, int nr)
 
     /* This windows doesn't seem to be used except by legacy VGA code */
     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_ATI, PCI_ANY_ID) ||
-        !vdev->vga || nr != 4) {
+        !vdev->vga || nr != 4 || !vdev->bars[4].ioport) {
         return;
     }
 
-- 
2.48.1

From: Joao Martins <joao.m.martins@oracle.com>

The intent behind the x-device-dirty-page-tracking option is twofold:

1) development/testing in the presence of VFs with VF dirty page tracking

2) deliberately choosing platform dirty tracker over the VF one.

Item 2) scenario is useful when VF dirty tracker is not as fast as
IOMMU, or there's some limitations around it (e.g. number of them is
limited; aggregated address space under tracking is limited),
efficiency/scalability (e.g. 1 pagetable in IOMMU dirty tracker to scan
vs N VFs) or just troubleshooting. Given item 2 it is not restricted to
debugging, hence drop the debug parenthesis from the option description.

Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250311174807.79825-1-joao.m.martins@oracle.com
[ clg: Fixed subject spelling ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -XXX,XX +XXX,XX @@ static void vfio_pci_dev_class_init(ObjectClass *klass, void *data)
     object_class_property_set_description(klass, /* 9.1 */
                                           "x-device-dirty-page-tracking",
                                           "Disable device dirty page tracking and use "
-                                          "container-based dirty page tracking (DEBUG)");
+                                          "container-based dirty page tracking");
     object_class_property_set_description(klass, /* 9.1 */
                                           "migration-events",
                                           "Emit VFIO migration QAPI event when a VFIO device "
-- 
2.48.1