The following changes since commit ffaf7f0376f8040ce9068d71ae9ae8722505c42e:

Merge tag 'pull-10.0-testing-and-gdstub-updates-100225-1' of https://gitlab.com/stsquad/qemu into staging (2025-02-10 13:26:17 -0500)

https://github.com/legoater/qemu/ tags/pull-vfio-20250211

for you to fetch changes up to be7d8579eb5758c0edf81eb068017a56471a77e0:

vfio: Remove superfluous error report in vfio_listener_region_add() (2025-02-11 14:15:19 +0100)

* Coverity fix

* IGD cleanups using VFIOQuirk

* SIGSEV fix in IOMMUFD host IOMMU device

* Improved error reporting for MMIO region mapping failures

Cédric Le Goater (8):

vfio/igd: Fix potential overflow in igd_gtt_memory_size()

util/error: Introduce warn_report_err_once()

vfio/pci: Replace "iommu_device" by "vIOMMU"

vfio: Rephrase comment in vfio_listener_region_add() error path

vfio: Introduce vfio_get_vfio_device()

vfio: Improve error reporting when MMIO region mapping fails

vfio: Remove reports of DMA mapping errors in backends

vfio: Remove superfluous error report in vfio_listener_region_add()

Tomita Moeko (3):

vfio/pci: declare generic quirks in a new header file

vfio/pci: introduce config_offset field in VFIOConfigMirrorQuirk

vfio/igd: use VFIOConfigMirrorQuirk for mirrored registers

Zhenzhong Duan (1):

vfio/iommufd: Fix SIGSEV in iommufd_cdev_attach()

hw/vfio/pci-quirks.h | 72 ++++++++++++++++++++++++

include/hw/vfio/vfio-common.h | 1 +

include/qapi/error.h | 12 ++++

backends/iommufd.c | 3 -

hw/vfio/common.c | 40 +++++++++----

hw/vfio/container.c | 2 -

hw/vfio/helpers.c | 10 ++++

hw/vfio/igd.c | 127 +++++++++++-------------------------------

hw/vfio/iommufd.c | 5 +-

hw/vfio/pci-quirks.c | 57 ++-----------------

hw/vfio/pci.c | 2 +-

util/error.c | 11 ++++

12 files changed, 177 insertions(+), 165 deletions(-)

create mode 100644 hw/vfio/pci-quirks.h

With the introduction of config_offset field, VFIOConfigMirrorQuirk can

now be used for those mirrored register in igd bar0. This eliminates

the need for the macro intoduced in 1a2623b5c9e7 ("vfio/igd: add macro

for declaring mirrored registers").

Link: https://lore.kernel.org/r/20250104154219.7209-4-tomitamoeko@gmail.com

hw/vfio/igd.c | 125 +++++++++++++-------------------------------------

1 file changed, 31 insertions(+), 94 deletions(-)

@@ -XXX,XX +XXX,XX @@

#include "hw/hw.h"

#include "hw/nvram/fw_cfg.h"

#include "pci.h"

+#include "pci-quirks.h"

#include "trace.h"

/*

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps vfio_igd_index_quirk = {

.endianness = DEVICE_LITTLE_ENDIAN,

};

-static uint64_t vfio_igd_pci_config_read(VFIOPCIDevice *vdev, uint64_t offset,

- unsigned size)

-{

- switch (size) {

- case 1:

- return pci_get_byte(vdev->pdev.config + offset);

- case 2:

- return pci_get_word(vdev->pdev.config + offset);

- case 4:

- return pci_get_long(vdev->pdev.config + offset);

- case 8:

- return pci_get_quad(vdev->pdev.config + offset);

- default:

- hw_error("igd: unsupported pci config read at %"PRIx64", size %u",

- offset, size);

- break;

- }

-

- return 0;

-}

-

-static void vfio_igd_pci_config_write(VFIOPCIDevice *vdev, uint64_t offset,

- switch (size) {

- case 1:

- pci_set_byte(vdev->pdev.config + offset, data);

- break;

- case 2:

- pci_set_word(vdev->pdev.config + offset, data);

- break;

- case 4:

- pci_set_long(vdev->pdev.config + offset, data);

- break;

- case 8:

- pci_set_quad(vdev->pdev.config + offset, data);

- break;

- default:

- hw_error("igd: unsupported pci config write at %"PRIx64", size %u",

- offset, size);

- break;

- }

-}

-

-#define VFIO_IGD_QUIRK_MIRROR_REG(reg, name) \

-static uint64_t vfio_igd_quirk_read_##name(void *opaque, \

- hwaddr addr, unsigned size) \

-{ \

- VFIOPCIDevice *vdev = opaque; \

- \

- return vfio_igd_pci_config_read(vdev, reg + addr, size); \

-} \

- \

-static void vfio_igd_quirk_write_##name(void *opaque, hwaddr addr, \

- uint64_t data, unsigned size) \

-{ \

- VFIOPCIDevice *vdev = opaque; \

- \

- vfio_igd_pci_config_write(vdev, reg + addr, data, size); \

-} \

- \

-static const MemoryRegionOps vfio_igd_quirk_mirror_##name = { \

- .read = vfio_igd_quirk_read_##name, \

- .write = vfio_igd_quirk_write_##name, \

- .endianness = DEVICE_LITTLE_ENDIAN, \

-VFIO_IGD_QUIRK_MIRROR_REG(IGD_GMCH, ggc)

-VFIO_IGD_QUIRK_MIRROR_REG(IGD_BDSM, bdsm)

-VFIO_IGD_QUIRK_MIRROR_REG(IGD_BDSM_GEN11, bdsm64)

void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)

{

+ VFIOQuirk *ggc_quirk, *bdsm_quirk;

+ VFIOConfigMirrorQuirk *ggc_mirror, *bdsm_mirror;

int gen;

@@ -XXX,XX +XXX,XX @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)

- quirk->data = vdev;

+ ggc_quirk = vfio_quirk_alloc(1);

+ ggc_mirror = ggc_quirk->data = g_malloc0(sizeof(*ggc_mirror));

+ ggc_mirror->mem = ggc_quirk->mem;

+ ggc_mirror->vdev = vdev;

+ ggc_mirror->bar = nr;

+ ggc_mirror->offset = IGD_GGC_MMIO_OFFSET;

+ ggc_mirror->config_offset = IGD_GMCH;

- memory_region_init_io(&quirk->mem[0], OBJECT(vdev),

- &vfio_igd_quirk_mirror_ggc, vdev,

+ memory_region_init_io(ggc_mirror->mem, OBJECT(vdev),

+ &vfio_generic_mirror_quirk, ggc_mirror,

"vfio-igd-ggc-quirk", 2);

- memory_region_add_subregion_overlap(vdev->bars[0].region.mem,

- IGD_GGC_MMIO_OFFSET, &quirk->mem[0],

+ memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,

+ ggc_mirror->offset, ggc_mirror->mem,

1);

- memory_region_init_io(&quirk->mem[1], OBJECT(vdev),

- &vfio_igd_quirk_mirror_bdsm, vdev,

- "vfio-igd-bdsm-quirk", 4);

- memory_region_add_subregion_overlap(vdev->bars[0].region.mem,

- IGD_BDSM_MMIO_OFFSET,

- &quirk->mem[1], 1);

- memory_region_init_io(&quirk->mem[1], OBJECT(vdev),

- &vfio_igd_quirk_mirror_bdsm64, vdev,

- "vfio-igd-bdsm-quirk", 8);

- memory_region_add_subregion_overlap(vdev->bars[0].region.mem,

- IGD_BDSM_MMIO_OFFSET,

- &quirk->mem[1], 1);

- }

+ QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, ggc_quirk, next);

+ bdsm_quirk = vfio_quirk_alloc(1);

+ bdsm_mirror = bdsm_quirk->data = g_malloc0(sizeof(*bdsm_mirror));

+ bdsm_mirror->mem = bdsm_quirk->mem;

+ bdsm_mirror->vdev = vdev;

+ bdsm_mirror->bar = nr;

+ bdsm_mirror->offset = IGD_BDSM_MMIO_OFFSET;

+ bdsm_mirror->config_offset = (gen < 11) ? IGD_BDSM : IGD_BDSM_GEN11;

+

+ memory_region_init_io(bdsm_mirror->mem, OBJECT(vdev),

+ &vfio_generic_mirror_quirk, bdsm_mirror,

+ "vfio-igd-bdsm-quirk", (gen < 11) ? 4 : 8);

+ memory_region_add_subregion_overlap(vdev->bars[nr].region.mem,

+ bdsm_mirror->offset, bdsm_mirror->mem,

+ 1);

+

+ QLIST_INSERT_HEAD(&vdev->bars[nr].quirks, bdsm_quirk, next);

The risk is mainly theoretical since the applied bit mask will keep

the 'ggms' shift value below 3. Nevertheless, let's use a 64 bit

integer type and resolve the coverity issue.

Resolves: Coverity CID 1585908

Fixes: 1e1eac5f3dcd ("vfio/igd: canonicalize memory size calculations")

Link: https://lore.kernel.org/r/20250107130604.669697-1-clg@redhat.com

hw/vfio/igd.c | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

@@ -XXX,XX +XXX,XX @@ static uint64_t igd_gtt_memory_size(int gen, uint16_t gmch)

} else {

ggms = (gmch >> IGD_GMCH_GEN8_GGMS_SHIFT) & IGD_GMCH_GEN8_GGMS_MASK;

if (ggms != 0) {

- ggms = 1 << ggms;

+ ggms = 1ULL << ggms;

Depending on the configuration of the host and VM, a passthrough

device may generate recurring DMA mapping errors at runtime. In such

cases, reporting the issue once is sufficient.

We have already the warn/error_report_once() routines taking a format

and arguments. Using the same design pattern, add a new warning

variant taking an 'Error *' parameter.

Cc: Markus Armbruster <armbru@redhat.com>

Reviewed-by: Markus Armbruster <armbru@redhat.com>

Link: https://lore.kernel.org/qemu-devel/20250206131438.1505542-2-clg@redhat.com

include/qapi/error.h | 12 ++++++++++++

util/error.c | 11 +++++++++++

2 files changed, 23 insertions(+)

diff --git a/include/qapi/error.h b/include/qapi/error.h

index XXXXXXX..XXXXXXX 100644

--- a/include/qapi/error.h

+++ b/include/qapi/error.h

@@ -XXX,XX +XXX,XX @@ void warn_reportf_err(Error *err, const char *fmt, ...)

void error_reportf_err(Error *err, const char *fmt, ...)

G_GNUC_PRINTF(2, 3);

+ * Similar to warn_report_err(), except it prints the message just once.

+ * Return true when it prints, false otherwise.

+bool warn_report_err_once_cond(bool *printed, Error *err);

+

+#define warn_report_err_once(err) \

+ ({ \

+ static bool print_once_; \

+ warn_report_err_once_cond(&print_once_, err); \

+ })

+

/*

* Just like error_setg(), except you get to specify the error class.

* Note: use of error classes other than ERROR_CLASS_GENERIC_ERROR is

diff --git a/util/error.c b/util/error.c

index XXXXXXX..XXXXXXX 100644

--- a/util/error.c

+++ b/util/error.c

@@ -XXX,XX +XXX,XX @@ void warn_report_err(Error *err)

error_free(err);

}

+bool warn_report_err_once_cond(bool *printed, Error *err)

+ if (*printed) {

+ error_free(err);

+ return false;

+ }

+ *printed = true;

+ warn_report_err(err);

void error_reportf_err(Error *err, const char *fmt, ...)

va_list ap;

Currently, the mapping handlers of the IOMMU backends, VFIO IOMMU Type

1 aka. legacy and IOMMUFD, return an errno and also report an error.

This can lead to excessive log messages at runtime for recurring DMA

mapping errors. Since these errors are already reported by the callers

in the vfio_container_dma_un/map() routines, simply remove them and

allow the callers to handle the reporting.

The mapping handler of the IOMMUFD backend has a comment suggesting

MMIO region mapping failures return EFAULT. I am not sure this is

entirely true, so keep the EFAULT case until the conditions are

clarified.

Link: https://lore.kernel.org/qemu-devel/20250206131438.1505542-7-clg@redhat.com

backends/iommufd.c | 3 ---

hw/vfio/container.c | 2 --

2 files changed, 5 deletions(-)

diff --git a/backends/iommufd.c b/backends/iommufd.c

--- a/backends/iommufd.c

+++ b/backends/iommufd.c

@@ -XXX,XX +XXX,XX @@ int iommufd_backend_map_dma(IOMMUFDBackend *be, uint32_t ioas_id, hwaddr iova,

/* TODO: Not support mapping hardware PCI BAR region for now. */

if (errno == EFAULT) {

warn_report("IOMMU_IOAS_MAP failed: %m, PCI BAR?");

- } else {

- error_report("IOMMU_IOAS_MAP failed: %m");

}

}

return ret;

@@ -XXX,XX +XXX,XX @@ int iommufd_backend_unmap_dma(IOMMUFDBackend *be, uint32_t ioas_id,

if (ret) {

ret = -errno;

- error_report("IOMMU_IOAS_UNMAP failed: %m");

}

diff --git a/hw/vfio/container.c b/hw/vfio/container.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/vfio/container.c

+++ b/hw/vfio/container.c

@@ -XXX,XX +XXX,XX @@ static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,

unmap.size -= 1ULL << ctz64(bcontainer->pgsizes);

continue;

}

- error_report("VFIO_UNMAP_DMA failed: %s", strerror(errno));

return -errno;

@@ -XXX,XX +XXX,XX @@ static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,

return 0;

- error_report("VFIO_MAP_DMA failed: %s", strerror(errno));

return -errno;

}

Device may only expose a specific portion of PCI config space through a

region in a BAR, such behavior is seen in igd GGC and BDSM mirrors in

BAR0. To handle these, config_offset is introduced to allow mirroring

arbitrary region in PCI config space.

Link: https://lore.kernel.org/r/20250104154219.7209-3-tomitamoeko@gmail.com

hw/vfio/pci-quirks.h | 3 ++-

hw/vfio/pci-quirks.c | 2 ++

2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/pci-quirks.h b/hw/vfio/pci-quirks.h

--- a/hw/vfio/pci-quirks.h

+++ b/hw/vfio/pci-quirks.h

@@ -XXX,XX +XXX,XX @@ extern const MemoryRegionOps vfio_generic_window_data_quirk;

*/

typedef struct VFIOConfigMirrorQuirk {

struct VFIOPCIDevice *vdev;

- uint32_t offset;

+ uint32_t offset; /* Offset in BAR */

+ uint32_t config_offset; /* Offset in PCI config space */

uint8_t bar;

MemoryRegion *mem;

uint8_t data[];

@@ -XXX,XX +XXX,XX @@ static uint64_t vfio_generic_quirk_mirror_read(void *opaque,

(void)vfio_region_read(&vdev->bars[mirror->bar].region,

addr + mirror->offset, size);

+ addr += mirror->config_offset;

data = vfio_pci_read_config(&vdev->pdev, addr, size);

trace_vfio_quirk_generic_mirror_read(vdev->vbasedev.name,

memory_region_name(mirror->mem),

@@ -XXX,XX +XXX,XX @@ static void vfio_generic_quirk_mirror_write(void *opaque, hwaddr addr,

VFIOConfigMirrorQuirk *mirror = opaque;

VFIOPCIDevice *vdev = mirror->vdev;

+ addr += mirror->config_offset;

vfio_pci_write_config(&vdev->pdev, addr, data, size);

trace_vfio_quirk_generic_mirror_write(vdev->vbasedev.name,

memory_region_name(mirror->mem),

Declare generic vfio_generic_{window_address,window_data,mirror}_quirk

in newly created pci_quirks.h so that they can be used elsewhere, like

igd.c.

Link: https://lore.kernel.org/r/20250104154219.7209-2-tomitamoeko@gmail.com

hw/vfio/pci-quirks.h | 71 ++++++++++++++++++++++++++++++++++++++++++++

hw/vfio/pci-quirks.c | 55 +++-------------------------------

2 files changed, 75 insertions(+), 51 deletions(-)

create mode 100644 hw/vfio/pci-quirks.h

diff --git a/hw/vfio/pci-quirks.h b/hw/vfio/pci-quirks.h

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/hw/vfio/pci-quirks.h

@@ -XXX,XX +XXX,XX @@

+/*

+ * vfio generic region quirks (mostly backdoors to PCI config space)

+ *

+ * Copyright Red Hat, Inc. 2012-2015

+ *

+ * Authors:

+ * Alex Williamson <alex.williamson@redhat.com>

+ *

+ * This work is licensed under the terms of the GNU GPL, version 2. See

+ * the COPYING file in the top-level directory.

+ */

+#ifndef HW_VFIO_VFIO_PCI_QUIRKS_H

+#define HW_VFIO_VFIO_PCI_QUIRKS_H

+#include "qemu/osdep.h"

+#include "exec/memop.h"

+

+/*

+ * The generic window quirks operate on an address and data register,

+ * vfio_generic_window_address_quirk handles the address register and

+ * vfio_generic_window_data_quirk handles the data register. These ops

+ * pass reads and writes through to hardware until a value matching the

+ * stored address match/mask is written. When this occurs, the data

+ * register access emulated PCI config space for the device rather than

+ * passing through accesses. This enables devices where PCI config space

+ * is accessible behind a window register to maintain the virtualization

+ * provided through vfio.

+ */

+typedef struct VFIOConfigWindowMatch {

+ uint32_t match;

+ uint32_t mask;

+} VFIOConfigWindowMatch;

+

+typedef struct VFIOConfigWindowQuirk {

+ struct VFIOPCIDevice *vdev;

+

+ uint32_t address_val;

+

+ uint32_t address_offset;

+ uint32_t data_offset;

+

+ bool window_enabled;

+ uint8_t bar;

+

+ MemoryRegion *addr_mem;

+ MemoryRegion *data_mem;

+

+ uint32_t nr_matches;

+ VFIOConfigWindowMatch matches[];

+} VFIOConfigWindowQuirk;

+

+extern const MemoryRegionOps vfio_generic_window_address_quirk;

+extern const MemoryRegionOps vfio_generic_window_data_quirk;

+

+/*

+ * The generic mirror quirk handles devices which expose PCI config space

+ * through a region within a BAR. When enabled, reads and writes are

+ * redirected through to emulated PCI config space. XXX if PCI config space

+ * used memory regions, this could just be an alias.

+ */

+typedef struct VFIOConfigMirrorQuirk {

+ struct VFIOPCIDevice *vdev;

+ uint32_t offset;

+ uint8_t bar;

+ MemoryRegion *mem;

+ uint8_t data[];

+} VFIOConfigMirrorQuirk;

+

+extern const MemoryRegionOps vfio_generic_mirror_quirk;

+

+#endif /* HW_VFIO_VFIO_PCI_QUIRKS_H */

@@ -XXX,XX +XXX,XX @@

#include "hw/nvram/fw_cfg.h"

#include "hw/qdev-properties.h"

#include "pci.h"

+#include "pci-quirks.h"

#include "trace.h"

/*

@@ -XXX,XX +XXX,XX @@ bool vfio_opt_rom_in_denylist(VFIOPCIDevice *vdev)