From 6e360c06176c7fcd8cd4e5da3f46d3b45c0c0607 Mon Sep 17 00:00:00 2001 From: Zhenzhong Duan Date: Thu, 18 Dec 2025 01:26:28 -0500 Subject: [PATCH] vfio/listener: Add missing dirty tracking in region_del MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If a VFIO device in guest switches from passthrough(PT) domain to block domain, the whole memory address space is unmapped, but we passed a NULL iotlb entry to unmap_bitmap, then bitmap query didn't happen and we lost dirty pages. By constructing an iotlb entry with iova = gpa for unmap_bitmap, it can set dirty bits correctly. For IOMMU address space, we still send NULL iotlb because VFIO don't know the actual mappings in guest. It's vIOMMU's responsibility to send actual unmapping notifications, e.g., vtd_address_space_unmap_in_dirty_tracking(). Signed-off-by: Zhenzhong Duan Tested-by: Giovannio Cabiddu Reviewed-by: Yi Liu Link: https://lore.kernel.org/qemu-devel/20251218062643.624796-8-zhenzhong.duan@intel.com Signed-off-by: Cédric Le Goater --- hw/vfio/listener.c | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c index 62699cb772..813621f22f 100644 --- a/hw/vfio/listener.c +++ b/hw/vfio/listener.c @@ -713,14 +713,34 @@ static void vfio_listener_region_del(MemoryListener *listener, if (try_unmap) { bool unmap_all = false; + IOMMUTLBEntry entry = {}, *iotlb = NULL; if (int128_eq(llsize, int128_2_64())) { assert(!iova); unmap_all = true; llsize = int128_zero(); } + + /* + * Fake an IOTLB entry for identity mapping which is needed by dirty + * tracking when switch out of PT domain. In fact, in unmap_bitmap, + * only translated_addr field is used to set dirty bitmap. + * + * Note: When switch into PT domain from DMA domain, the whole IOMMU + * MR is deleted without iotlb, before that happen, we depend on + * vIOMMU to send unmap notification with accurate iotlb entry to + * VFIO. See vtd_address_space_unmap_in_dirty_tracking() for example, + * it is triggered during switching to block domain because vtd does + * not support direct switching from DMA to PT domain. + */ + if (global_dirty_tracking && memory_region_is_ram(section->mr)) { + entry.iova = iova; + entry.translated_addr = iova; + iotlb = &entry; + } + ret = vfio_container_dma_unmap(bcontainer, iova, int128_get64(llsize), - NULL, unmap_all); + iotlb, unmap_all); if (ret) { error_report("vfio_container_dma_unmap(%p, 0x%"HWADDR_PRIx", " "0x%"HWADDR_PRIx") = %d (%s)",