[PATCH 0/3] scsi: PR live migration PREEMPT fixes

[PATCH 0/3] scsi: PR live migration PREEMPT fixes

[Stefan Hajnoczi]

These patches are for QEMU 11.1 and 11.0-stable because they are not release
blockers.

Testing SCSI Persistent Reservation live migration with the Linux LIO iSCSI
target exposed two issues:

1. The LIO target interprets the request's TYPE field even though the spec says
   it should be ignored. This led to PREEMPT commands failing on the LIO
   target. Work around this by sending a "valid" TYPE field value. I have also
   contacted the LIO maintainers about improving spec-compliance but QEMU needs
   to work with existing targets.

2. The LIO target removes all matching registrations, including the I_T nexus
   that is sending the PREEMPT command, when PREEMPT is used to remove
   registrations rather than preempt a reservation. This actually appears to
   comply with the spec, but the hardware target I previously tested against
   would not remove the calling I_T nexus' registration and therefore QEMU's
   behavior was wrong. Implement a fix that works regardless of the target.

Stefan Hajnoczi (3):
  scsi: adjust error_prepend() formatting
  scsi: always send valid PREEMPT TYPE field
  scsi: register again after PREEMPT without reservation

 include/scsi/constants.h | 10 ++++++++++
 hw/scsi/scsi-generic.c   | 24 ++++++++++++++++++++++--
 2 files changed, 32 insertions(+), 2 deletions(-)

-- 
2.53.0

[PATCH 1/3] scsi: adjust error_prepend() formatting

[Stefan Hajnoczi]

The error strings will be concatenated so add a separator to make the
combined error message easy to read.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/scsi/scsi-generic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index a2316a5266..b55d068323 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -439,7 +439,7 @@ static bool scsi_generic_pr_register(SCSIDevice *s, uint64_t key, Error **errp)
     ret = scsi_SG_IO(s->conf.blk, SG_DXFER_TO_DEV, cmd, sizeof(cmd),
                      buf, sizeof(buf), s->io_timeout, errp);
     if (ret < 0) {
-        error_prepend(errp, "PERSISTENT RESERVE OUT with REGISTER");
+        error_prepend(errp, "PERSISTENT RESERVE OUT with REGISTER: ");
         return false;
     }
     return true;
@@ -463,7 +463,7 @@ static bool scsi_generic_pr_preempt(SCSIDevice *s, uint64_t key,
     ret = scsi_SG_IO(s->conf.blk, SG_DXFER_TO_DEV, cmd, sizeof(cmd),
                      buf, sizeof(buf), s->io_timeout, errp);
     if (ret < 0) {
-        error_prepend(errp, "PERSISTENT RESERVE OUT with PREEMPT");
+        error_prepend(errp, "PERSISTENT RESERVE OUT with PREEMPT: ");
         return false;
     }
     return true;
-- 
2.53.0

[PATCH 2/3] scsi: always send valid PREEMPT TYPE field

[Stefan Hajnoczi]

The SPC-6 specification says that the PREEMPT service action ignores the
TYPE field when there is no reservation. However, the LIO Linux iSCSI
target rejects commands with a zero TYPE field. The field never ends up
being used in this case, so replace it with a "valid" value to work
around the issue.

Reported-by: Qing Wang <qinwang@redhat.com>
Buglink: https://redhat.atlassian.net/browse/RHEL-155807
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/scsi/constants.h | 10 ++++++++++
 hw/scsi/scsi-generic.c   | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/include/scsi/constants.h b/include/scsi/constants.h
index cb97bdb636..717e470a5d 100644
--- a/include/scsi/constants.h
+++ b/include/scsi/constants.h
@@ -340,4 +340,14 @@
 #define PRO_REGISTER_AND_MOVE                   0x07
 #define PRO_REPLACE_LOST_RESERVATION            0x08
 
+/*
+ * Persistent reservation types
+ */
+#define PR_TYPE_WRITE_EXCLUSIVE             0x1
+#define PR_TYPE_EXCLUSIVE_ACCESS            0x3
+#define PR_TYPE_WRITE_EXCLUSIVE_REG_ONLY    0x5
+#define PR_TYPE_EXCLUSIVE_ACCESS_REG_ONLY   0x6
+#define PR_TYPE_WRITE_EXCLUSIVE_ALL_REGS    0x7
+#define PR_TYPE_EXCLUSIVE_ACCESS_ALL_REGS   0x8
+
 #endif
diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index b55d068323..349dea6bdd 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -453,6 +453,16 @@ static bool scsi_generic_pr_preempt(SCSIDevice *s, uint64_t key,
     uint64_t key_be = cpu_to_be64(key);
     int ret;
 
+    /*
+     * The LIO iSCSI target in Linux up to at least version 7.0 rejects PREEMPT
+     * commands with a zero TYPE field although the SPC-6 specification says
+     * the field should be ignored when there is no persistent reservation.
+     * Work around this by choosing an arbitrary valid PR type value.
+     */
+    if (resv_type == 0) {
+        resv_type = PR_TYPE_WRITE_EXCLUSIVE;
+    }
+
     cmd[0] = PERSISTENT_RESERVE_OUT;
     cmd[1] = PRO_PREEMPT;
     cmd[2] = resv_type & 0xf;
-- 
2.53.0

[PATCH 3/3] scsi: register again after PREEMPT without reservation

[Stefan Hajnoczi]

The SCSI specification says PREEMPT without a reservation removes all
registrations with the given key. Try to register again after PREEMPT
since our key will have been removed.

In practice some SCSI targets keep the calling I_T nexus' registration
instead of removing it. Therefore we need to handle both the
spec-compliant and the non-compliant behavior.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/scsi/scsi-generic.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index 349dea6bdd..5182f9236d 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -513,6 +513,16 @@ bool scsi_generic_pr_state_preempt(SCSIDevice *s, Error **errp)
         if (!scsi_generic_pr_preempt(s, key, resv_type, errp)) {
             return false;
         }
+
+        /*
+         * Some SCSI targets, like the Linux LIO target, remove our
+         * registration when preempting without a reservation (resv_type is 0).
+         * Try to register again but ignore the error since a RESERVATION
+         * CONFLICT is expected if our registration remained in place.
+         */
+        if (resv_type == 0) {
+            scsi_generic_pr_register(s, key, NULL);
+        }
     }
     return true;
 }
-- 
2.53.0

Re: [PATCH 3/3] scsi: register again after PREEMPT without reservation

[Paolo Bonzini]

On 4/1/26 19:19, Stefan Hajnoczi wrote:
> The SCSI specification says PREEMPT without a reservation removes all
> registrations with the given key. Try to register again after PREEMPT
> since our key will have been removed.
> 
> In practice some SCSI targets keep the calling I_T nexus' registration
> instead of removing it. Therefore we need to handle both the
> spec-compliant and the non-compliant behavior.
> 
> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> ---
>   hw/scsi/scsi-generic.c | 10 ++++++++++
>   1 file changed, 10 insertions(+)
> 
> diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
> index 349dea6bdd..5182f9236d 100644
> --- a/hw/scsi/scsi-generic.c
> +++ b/hw/scsi/scsi-generic.c
> @@ -513,6 +513,16 @@ bool scsi_generic_pr_state_preempt(SCSIDevice *s, Error **errp)
>           if (!scsi_generic_pr_preempt(s, key, resv_type, errp)) {
>               return false;
>           }
> +
> +        /*
> +         * Some SCSI targets, like the Linux LIO target, remove our
> +         * registration when preempting without a reservation (resv_type is 0).
> +         * Try to register again but ignore the error since a RESERVATION
> +         * CONFLICT is expected if our registration remained in place.
> +         */
> +        if (resv_type == 0) {
> +            scsi_generic_pr_register(s, key, NULL);
> +        }

Hi Stefan,

I'm replying here for both patch 2 and patch 3.

Can this happen after the previous patch?  (Also it's conflicting to say 
  in patch 2 that LIO rejects PREEMPT, but also in this one that LIO 
unregisters the key).

And for patch 2, is a RELEASE needed after issuing PREEMPT with an 
artificial PR_TYPE_WRITE_EXCLUSIVE?

Paolo

Re: [PATCH 3/3] scsi: register again after PREEMPT without reservation

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 2353 bytes --]

On Wed, Apr 01, 2026 at 07:34:40PM +0200, Paolo Bonzini wrote:
> On 4/1/26 19:19, Stefan Hajnoczi wrote:
> > The SCSI specification says PREEMPT without a reservation removes all
> > registrations with the given key. Try to register again after PREEMPT
> > since our key will have been removed.
> > 
> > In practice some SCSI targets keep the calling I_T nexus' registration
> > instead of removing it. Therefore we need to handle both the
> > spec-compliant and the non-compliant behavior.
> > 
> > Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
> > ---
> >   hw/scsi/scsi-generic.c | 10 ++++++++++
> >   1 file changed, 10 insertions(+)
> > 
> > diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
> > index 349dea6bdd..5182f9236d 100644
> > --- a/hw/scsi/scsi-generic.c
> > +++ b/hw/scsi/scsi-generic.c
> > @@ -513,6 +513,16 @@ bool scsi_generic_pr_state_preempt(SCSIDevice *s, Error **errp)
> >           if (!scsi_generic_pr_preempt(s, key, resv_type, errp)) {
> >               return false;
> >           }
> > +
> > +        /*
> > +         * Some SCSI targets, like the Linux LIO target, remove our
> > +         * registration when preempting without a reservation (resv_type is 0).
> > +         * Try to register again but ignore the error since a RESERVATION
> > +         * CONFLICT is expected if our registration remained in place.
> > +         */
> > +        if (resv_type == 0) {
> > +            scsi_generic_pr_register(s, key, NULL);
> > +        }
> 
> Hi Stefan,
> 
> I'm replying here for both patch 2 and patch 3.
> 
> Can this happen after the previous patch?  (Also it's conflicting to say  in
> patch 2 that LIO rejects PREEMPT, but also in this one that LIO unregisters
> the key).

Yes. Both patches are needed.

The first patch gets LIO to process the PREEMPT. Before LIO would just
fail the command.

But once LIO processes the PREEMPT, we hit the next problem: PREEMPT
completes but our registration has been removed. So now we need to
register again after PREEMPT.

> And for patch 2, is a RELEASE needed after issuing PREEMPT with an
> artificial PR_TYPE_WRITE_EXCLUSIVE?

No, because PREEMPT will not acquire a reservation when there is no
reservation holder with the given key. PREEMPT will only remove
registrations in that case.

Stefan

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH 3/3] scsi: register again after PREEMPT without reservation

[Paolo Bonzini]

On Wed, Apr 1, 2026 at 8:31 PM Stefan Hajnoczi <stefanha@redhat.com> wrote:
> The first patch gets LIO to process the PREEMPT. Before LIO would just
> fail the command.
>
> But once LIO processes the PREEMPT, we hit the next problem: PREEMPT
> completes but our registration has been removed. So now we need to
> register again after PREEMPT.
>
> > And for patch 2, is a RELEASE needed after issuing PREEMPT with an
> > artificial PR_TYPE_WRITE_EXCLUSIVE?
>
> No, because PREEMPT will not acquire a reservation when there is no
> reservation holder with the given key. PREEMPT will only remove
> registrations in that case.

Thanks for explaining all this. I didn't understand the behavior where
the source does not have a reservation. Series

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

Paolo

Re: [PATCH 0/3] scsi: PR live migration PREEMPT fixes

[Paolo Bonzini]

Queued, thanks.

Paolo