[PULL 00/23] vfio queue

[PULL 00/23] vfio queue

[Cédric Le Goater]

The following changes since commit 30e8a06b64aa58a3990ba39cb5d09531e7d265e0:

  Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2026-06-29 17:41:42 +0200)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-vfio-20260630

for you to fetch changes up to afe79bb7bf7fe16f418d6e10522946e13da04384:

  vfio/listener: Fix translated_addr for non-identity-mapped RAM sections (2026-06-30 05:35:56 +0200)

----------------------------------------------------------------
vfio queue:

* Fixes ROM read issues in vfio/pci: information leak, error
  propagation, and uninitialized state
* Validates VERSION replies in vfio-user and updates the spec
  for DMA access mode bits
* Merges .dma_map_file() into .dma_map() in the iommufd backend
* Reworks switchover-ack to be re-usable and implements the
  VFIO_PRECOPY_INFO_REINIT feature for additional pre-copy
  iterations before switchover
* Adds ATS support for passthrough devices via iommufd
* Fixes translated_addr for non-identity-mapped RAM sections in
  the VFIO listener

----------------------------------------------------------------
Avihai Horon (14):
      migration: Propagate errors in migration_completion_precopy()
      migration/ram: Use migration_bitmap_sync_precopy() for postcopy discard
      migration: Run final save_query_pending at switchover
      migration: Log the approver in qemu_loadvm_approve_switchover()
      migration: Replace switchover_ack_needed SaveVMHandler
      migration: Rename switchover-ack code to legacy
      migration: Make switchover-ack re-usable
      migration: Fail migration if switchover-ack is requested after switchover decision
      vfio/migration: Extract VFIO_MIG_FLAG_DEV_INIT_DATA_SENT sending to helper
      vfio/migration: Add Error ** parameter to vfio_migration_init()
      vfio/migration: Add new switchover-ack mechanism
      vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature
      vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during switchover
      migration: Enable new switchover-ack

Cédric Le Goater (3):
      vfio/pci: Fix information leak in vfio_rom_read()
      vfio/iommufd: Merge .dma_map_file() into .dma_map()
      vfio/listener: Fix translated_addr for non-identity-mapped RAM sections

GuoHan Zhao (1):
      vfio-user: validate VERSION replies

Mario Casquero (2):
      vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom()
      vfio/pci: Propagate errors in vfio_pci_load_rom() using Error API

Mattias Nissler (1):
      docs: Update vfio-user spec to describe DMA access mode bits

Nathan Chen (2):
      iommufd: Introduce handler for device ATS support
      vfio/pci: Add ats property

 docs/devel/migration/vfio.rst      |  17 +++-
 docs/interop/vfio-user.rst         |  82 +++++++++------
 qapi/migration.json                |  14 ++-
 hw/vfio/pci.h                      |   1 +
 hw/vfio/vfio-migration-internal.h  |   2 +
 include/hw/vfio/vfio-container.h   |  15 ---
 include/migration/client-options.h |   1 +
 include/migration/misc.h           |   2 +
 include/migration/register.h       |  56 +++++-----
 include/system/host_iommu_device.h |   9 ++
 migration/migration.h              |  34 ++++++-
 migration/savevm.h                 |   9 +-
 backends/iommufd.c                 |   8 ++
 hw/core/machine.c                  |   1 +
 hw/s390x/s390-stattrib.c           |   2 +-
 hw/vfio-user/proxy.c               |  21 ++--
 hw/vfio/container.c                |  38 -------
 hw/vfio/iommufd.c                  |  50 ++++++---
 hw/vfio/listener.c                 |   5 +-
 hw/vfio/migration.c                | 204 +++++++++++++++++++++++++++++--------
 hw/vfio/pci.c                      | 129 +++++++++++++++++++----
 migration/block-dirty-bitmap.c     |  11 +-
 migration/migration.c              |  73 ++++++++++---
 migration/options.c                |   9 ++
 migration/ram.c                    |  40 ++++----
 migration/savevm.c                 | 173 +++++++++++++++++++++----------
 hw/vfio/trace-events               |   7 +-
 migration/trace-events             |   9 +-
 28 files changed, 709 insertions(+), 313 deletions(-)

[PULL 01/23] vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom()

[Cédric Le Goater]

From: Mario Casquero <mcasquer@redhat.com>

When vfio_device_get_region_info() fails in vfio_pci_load_rom(),
the function returns without setting vdev->rom_read_failed to true,
and without allocating vdev->rom. This leaves vdev->rom as NULL.

Signed-off-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260602070857.356526-1-mcasquer@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 4d822b96b530c614671551589ce3584e9598f386..68ee3ce7dc254dd045ed2c1b21bebc53a4b4e3d6 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -1028,7 +1028,7 @@ static void vfio_update_msi(VFIOPCIDevice *vdev)
     }
 }
 
-static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
+static bool vfio_pci_load_rom(VFIOPCIDevice *vdev)
 {
     VFIODevice *vbasedev = &vdev->vbasedev;
     struct vfio_region_info *reg_info = NULL;
@@ -1042,7 +1042,7 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
 
     if (ret != 0) {
         error_report("vfio: Error getting ROM info: %s", strerror(-ret));
-        return;
+        return false;
     }
 
     trace_vfio_pci_load_rom(vbasedev->name, (unsigned long)reg_info->size,
@@ -1053,12 +1053,11 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
     vdev->rom_offset = reg_info->offset;
 
     if (!vdev->rom_size) {
-        vdev->rom_read_failed = true;
         error_report("vfio-pci: Cannot read device rom at %s", vbasedev->name);
         error_printf("Device option ROM contents are probably invalid "
                     "(check dmesg).\nSkip option ROM probe with rombar=0, "
                     "or load from file with romfile=\n");
-        return;
+        return false;
     }
 
     vdev->rom = g_malloc(size);
@@ -1114,6 +1113,8 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
             data[6] = -csum;
         }
     }
+
+    return true;
 }
 
 /* "Raw" read of underlying config space. */
@@ -1147,7 +1148,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
 
     /* Load the ROM lazily when the guest tries to read it */
     if (unlikely(!vdev->rom && !vdev->rom_read_failed)) {
-        vfio_pci_load_rom(vdev);
+        vdev->rom_read_failed = !vfio_pci_load_rom(vdev);
     }
 
     memcpy(&val, vdev->rom + addr,
-- 
2.54.0

[PULL 02/23] vfio/pci: Fix information leak in vfio_rom_read()

[Cédric Le Goater]

vfio_rom_read() can leak uninitialized stack data to the guest when a
read occurs at the end boundary of the ROM BAR.

Fix this by initializing the val union to 0xff, matching the ROM
initialization pattern used in vfio_pci_load_rom().

Reviewed-by: Philippe Mathieu-Daudé <philmd@mailo.com>
Reviewed-by: Mario Casquero <mcasquer@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260602074446.1206892-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 68ee3ce7dc254dd045ed2c1b21bebc53a4b4e3d6..6b04c6f94f9ade765e236d457e4828ac6199680a 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -1143,7 +1143,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
         uint16_t word;
         uint32_t dword;
         uint64_t qword;
-    } val;
+    } val = { .qword = ~0ULL };
     uint64_t data = 0;
 
     /* Load the ROM lazily when the guest tries to read it */
-- 
2.54.0

[PULL 03/23] docs: Update vfio-user spec to describe DMA access mode bits

[Cédric Le Goater]

From: Mattias Nissler <mnissler@meta.com>

This makes the intended access mode explicit when registering DMA
regions with the server. A new "file I/O" access mode is defined, which
can be used if the file descriptor provided by the client doesn't
support `mmap()`.

Signed-off-by: Mattias Nissler <mnissler@meta.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20260602133829.305842-1-mnissler@meta.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/interop/vfio-user.rst | 82 ++++++++++++++++++++++++--------------
 1 file changed, 51 insertions(+), 31 deletions(-)

diff --git a/docs/interop/vfio-user.rst b/docs/interop/vfio-user.rst
index 12deb25102af217f7f292b4cb655dc4a6a92439a..1c92f442d232ce6ce880868bb7062e42481b69ae 100644
--- a/docs/interop/vfio-user.rst
+++ b/docs/interop/vfio-user.rst
@@ -604,27 +604,31 @@ Request
 
 The request payload for this message is a structure of the following format:
 
-+-------------+--------+-------------+
-| Name        | Offset | Size        |
-+=============+========+=============+
-| argsz       | 0      | 4           |
-+-------------+--------+-------------+
-| flags       | 4      | 4           |
-+-------------+--------+-------------+
-|             | +-----+------------+ |
-|             | | Bit | Definition | |
-|             | +=====+============+ |
-|             | | 0   | readable   | |
-|             | +-----+------------+ |
-|             | | 1   | writeable  | |
-|             | +-----+------------+ |
-+-------------+--------+-------------+
-| offset      | 8      | 8           |
-+-------------+--------+-------------+
-| address     | 16     | 8           |
-+-------------+--------+-------------+
-| size        | 24     | 8           |
-+-------------+--------+-------------+
++-------------+--------+------------------------+
+| Name        | Offset | Size                   |
++=============+========+========================+
+| argsz       | 0      | 4                      |
++-------------+--------+------------------------+
+| flags       | 4      | 4                      |
++-------------+--------+------------------------+
+|             | +-----+-----------------------+ |
+|             | | Bit | Definition            | |
+|             | +=====+=======================+ |
+|             | | 0   | readable              | |
+|             | +-----+-----------------------+ |
+|             | | 1   | writeable             | |
+|             | +-----+-----------------------+ |
+|             | | 2   | access mode: mmap     | |
+|             | +-----+-----------------------+ |
+|             | | 3   | access mode: file I/O | |
+|             | +-----+-----------------------+ |
++-------------+--------+------------------------+
+| offset      | 8      | 8                      |
++-------------+--------+------------------------+
+| address     | 16     | 8                      |
++-------------+--------+------------------------+
+| size        | 24     | 8                      |
++-------------+--------+------------------------+
 
 * *argsz* is the size of the above structure. Note there is no reply payload,
   so this field differs from other message types.
@@ -634,6 +638,8 @@ The request payload for this message is a structure of the following format:
 
   * *writeable* indicates that the region can be written to.
 
+  * *access mode* bits indicate how the region is to be accessed by the server.
+
 * *offset* is the file offset of the region with respect to the associated file
   descriptor, or zero if the region is not mappable
 * *address* is the base DMA address of the region.
@@ -641,16 +647,30 @@ The request payload for this message is a structure of the following format:
 
 This structure is 32 bytes in size, so the message size is 16 + 32 bytes.
 
-If the DMA region being added can be directly mapped by the server, a file
-descriptor must be sent as part of the message meta-data. The region can be
-mapped via the mmap() system call. On ``AF_UNIX`` sockets, the file descriptor
-must be passed as ``SCM_RIGHTS`` type ancillary data.  Otherwise, if the DMA
-region cannot be directly mapped by the server, no file descriptor must be sent
-as part of the message meta-data and the DMA region can be accessed by the
-server using ``VFIO_USER_DMA_READ`` and ``VFIO_USER_DMA_WRITE`` messages,
-explained in `Read and Write Operations`_. A command to map over an existing
-region must be failed by the server with ``EEXIST`` set in error field in the
-reply.
+There are several alternative access modes for the server to use when accessing
+the region:
+
+* ``VFIO_USER_DMA_READ`` and ``VFIO_USER_DMA_WRITE`` messages, explained in
+  `Read and Write Operations`_.
+
+* ``mmap()`` a client-provided file descriptor, then perform direct accesses to
+  the underlying memory.
+
+* File I/O system calls (such as ``pread()`` / ``pwrite()``) against a
+  client-provided file descriptor.
+
+The access mode bits in the flags field indicate which access mode to use. If
+an access mode requiring a file descriptor is specified, but the client does
+not provide a file descriptor, the server must fail the request with
+``EINVAL``. If no access mode flag bit is set, the server should use ``mmap()``
+based access if the client provided a file descriptor and message-based access
+otherwise.
+
+On ``AF_UNIX`` sockets, the file descriptor must be passed as ``SCM_RIGHTS``
+type ancillary data.
+
+A command to map over an existing region must be failed by the server with
+``EEXIST`` set in the error field in the reply.
 
 Reply
 ^^^^^
-- 
2.54.0

[PULL 04/23] vfio-user: validate VERSION replies

[Cédric Le Goater]

From: GuoHan Zhao <zhaoguohan@kylinos.cn>

The vfio-user protocol makes the VERSION payload optional, so a
reply may legally stop after the major and minor fields.

vfio_user_validate_version() currently assumes a capabilities string is
always present and NUL-terminated. When the server replies without
version data, QEMU ends up reusing the request-side capabilities buffer
and the terminating-NUL check underflows. Replies shorter than the fixed
VERSION header are also accessed before they are validated.

Reject replies shorter than the fixed VERSION header and only parse
capabilities when the reply actually carries version data.

Fixes: 36227628d824 (vfio-user: implement message send infrastructure)
Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20260603062138.4008583-1-zhaoguohan@kylinos.cn
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/proxy.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index 0f7d8425d61488f6af3747db4b9f5c774f3fc717..197aee07bf7a3e16b58f77b0ecb73bff46889ecb 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -1292,7 +1292,7 @@ bool vfio_user_validate_version(VFIOUserProxy *proxy, Error **errp)
 {
     g_autofree VFIOUserVersion *msgp = NULL;
     GString *caps;
-    char *reply;
+    const char *reply = "";
     int size, caplen;
 
     caps = caps_json();
@@ -1322,17 +1322,24 @@ bool vfio_user_validate_version(VFIOUserProxy *proxy, Error **errp)
         return false;
     }
 
-    reply = msgp->capabilities;
-    if (reply[msgp->hdr.size - sizeof(*msgp) - 1] != '\0') {
-        error_setg(errp, "corrupt version reply");
+    if (msgp->hdr.size < sizeof(*msgp)) {
+        error_setg(errp, "short version reply");
         return false;
     }
 
-    if (!caps_check(proxy, msgp->minor, reply, errp)) {
-        return false;
+    if (msgp->hdr.size > sizeof(*msgp)) {
+        reply = msgp->capabilities;
+        if (reply[msgp->hdr.size - sizeof(*msgp) - 1] != '\0') {
+            error_setg(errp, "corrupt version reply");
+            return false;
+        }
+
+        if (!caps_check(proxy, msgp->minor, reply, errp)) {
+            return false;
+        }
     }
 
-    trace_vfio_user_version(msgp->major, msgp->minor, msgp->capabilities);
+    trace_vfio_user_version(msgp->major, msgp->minor, reply);
     return true;
 }
 
-- 
2.54.0

[PULL 05/23] vfio/iommufd: Merge .dma_map_file() into .dma_map()

[Cédric Le Goater]

Simplify the VFIOIOMMUClass interface by removing the dma_map_file
handler. Move the logic to decide between the standard virtual and
file-backed mapping into the IOMMUFD backend, utilizing the
MemoryRegion already passed to the dma_map handler.

This removes redundant dispatch logic from the generic container layer
and let backends to manage their own mapping strategies. This is
similar to the vfio-user implementation.

Reviewed-by: Alex Williamson <alex@shazbot.org>
Link: https://lore.kernel.org/qemu-devel/20260608055758.359002-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-container.h | 15 ----------
 hw/vfio/container.c              | 38 ------------------------
 hw/vfio/iommufd.c                | 50 +++++++++++++++++++++++---------
 3 files changed, 37 insertions(+), 66 deletions(-)

diff --git a/include/hw/vfio/vfio-container.h b/include/hw/vfio/vfio-container.h
index b2e7f4312c31ed4b776ddb195b021e84ebed556f..a15ee2df2b9c82d7c5004685aa91c3339587e06c 100644
--- a/include/hw/vfio/vfio-container.h
+++ b/include/hw/vfio/vfio-container.h
@@ -172,21 +172,6 @@ struct VFIOIOMMUClass {
     int (*dma_map)(const VFIOContainer *bcontainer,
                    hwaddr iova, uint64_t size,
                    void *vaddr, bool readonly, MemoryRegion *mr);
-    /**
-     * @dma_map_file
-     *
-     * Map a file range for the container.
-     *
-     * @bcontainer: #VFIOContainer to use for map
-     * @iova: start address to map
-     * @size: size of the range to map
-     * @fd: descriptor of the file to map
-     * @start: starting file offset of the range to map
-     * @readonly: map read only if true
-     */
-    int (*dma_map_file)(const VFIOContainer *bcontainer,
-                        hwaddr iova, uint64_t size,
-                        int fd, unsigned long start, bool readonly);
     /**
      * @dma_unmap
      *
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 56bd9ac0095df7b0f4da85f1d8dcb8d571fa9f2a..d09a6637324c6bf29b2fe22369082f87e280c98f 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -15,7 +15,6 @@
 #include <linux/vfio.h>
 
 #include "system/tcg.h"
-#include "system/ramblock.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/vfio/vfio-container.h"
@@ -74,49 +73,12 @@ void vfio_address_space_insert(VFIOAddressSpace *space,
     bcontainer->space = space;
 }
 
-static bool vfio_container_can_dma_map_file(VFIOContainer *bcontainer,
-                                            MemoryRegion *mr, int *fd)
-{
-    VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
-    RAMBlock *rb = mr->ram_block;
-
-    if (!vioc->dma_map_file || !rb) {
-        return false;
-    }
-
-    *fd = qemu_ram_get_fd(rb);
-    if (*fd < 0) {
-        return false;
-    }
-
-    /*
-     * We can use IOMMU DMA mapping (IOMMU_IOAS_MAP_FILE) for :
-     *
-     * 1) Guest RAM blocks explicitly configured as shared (MAP_SHARED)
-     * 2) RAM device sub-regions (MMIO BARs)
-     *
-     * Private RAM mappings (MAP_PRIVATE) are strictly excluded. Because
-     * they are subject to copy-on-write (COW) anomalies, their underlying
-     * PFNs can permanently diverge from the backing file
-     */
-    return qemu_ram_is_shared(rb) || memory_region_is_ram_device(mr);
-}
-
 int vfio_container_dma_map(VFIOContainer *bcontainer,
                            hwaddr iova, uint64_t size,
                            void *vaddr, bool readonly, MemoryRegion *mr)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
-    int mfd;
 
-    if (vfio_container_can_dma_map_file(bcontainer, mr, &mfd)) {
-        RAMBlock *rb = mr->ram_block;
-        unsigned long start = vaddr - qemu_ram_get_host_addr(rb);
-        unsigned long offset = qemu_ram_get_fd_offset(rb);
-
-        return vioc->dma_map_file(bcontainer, iova, size, mfd, start + offset,
-                                  readonly);
-    }
     g_assert(vioc->dma_map);
     return vioc->dma_map(bcontainer, iova, size, vaddr, readonly, mr);
 }
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 68f2ae6f9f667bb05c20e452e8c5b43da6558098..6ff668d2597e07c6953cf0f1997514aec199642c 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -20,6 +20,7 @@
 #include "trace.h"
 #include "qapi/error.h"
 #include "system/iommufd.h"
+#include "system/ramblock.h"
 #include "hw/core/iommu.h"
 #include "hw/core/qdev.h"
 #include "hw/vfio/vfio-cpr.h"
@@ -35,26 +36,50 @@
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO             \
             TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
 
+static bool iommufd_cdev_can_map_file_dma(MemoryRegion *mr, int *fd)
+{
+    RAMBlock *rb = mr ? mr->ram_block : NULL;
+
+    if (!rb) {
+        return false;
+    }
+
+    *fd = qemu_ram_get_fd(rb);
+    if (*fd < 0) {
+        return false;
+    }
+
+    /*
+     * Use iommufd_backend_map_file_dma() (IOMMU_IOAS_MAP_FILE) for:
+     * 1) Guest RAM blocks explicitly configured as shared (MAP_SHARED)
+     * 2) RAM device sub-regions (MMIO BARs)
+     *
+     * Private RAM mappings (MAP_PRIVATE) are excluded: copy-on-write
+     * semantics can cause their underlying PFNs to permanently diverge
+     * from the backing file.
+     */
+    return qemu_ram_is_shared(rb) || memory_region_is_ram_device(mr);
+}
+
 static int iommufd_cdev_map(const VFIOContainer *bcontainer, hwaddr iova,
                             uint64_t size, void *vaddr, bool readonly,
                             MemoryRegion *mr)
 {
     const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
+    int fd;
 
-    return iommufd_backend_map_dma(container->be,
-                                   container->ioas_id,
-                                   iova, size, vaddr, readonly);
-}
+    if (iommufd_cdev_can_map_file_dma(mr, &fd)) {
+        RAMBlock *rb = mr->ram_block;
+        unsigned long start = vaddr - qemu_ram_get_host_addr(rb);
+        unsigned long offset = qemu_ram_get_fd_offset(rb);
 
-static int iommufd_cdev_map_file(const VFIOContainer *bcontainer,
-                                 hwaddr iova, uint64_t size,
-                                 int fd, unsigned long start, bool readonly)
-{
-    const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
+        return iommufd_backend_map_file_dma(container->be, container->ioas_id,
+                                            iova, size, fd,
+                                            start + offset, readonly);
+    }
 
-    return iommufd_backend_map_file_dma(container->be,
-                                        container->ioas_id,
-                                        iova, size, fd, start, readonly);
+    return iommufd_backend_map_dma(container->be, container->ioas_id,
+                                   iova, size, vaddr, readonly);
 }
 
 static int iommufd_cdev_unmap(const VFIOContainer *bcontainer,
@@ -929,7 +954,6 @@ static void vfio_iommu_iommufd_class_init(ObjectClass *klass, const void *data)
     VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
 
     vioc->dma_map = iommufd_cdev_map;
-    vioc->dma_map_file = iommufd_cdev_map_file;
     vioc->dma_unmap = iommufd_cdev_unmap;
     vioc->attach_device = iommufd_cdev_attach;
     vioc->detach_device = iommufd_cdev_detach;
-- 
2.54.0

[PULL 06/23] migration: Propagate errors in migration_completion_precopy()

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

migration_completion_precopy() doesn't propagate errors to migration
core which leads to error information loss. Fix that.

This prepares for a follow-up where migration_switchover_start() can
fail on switchover-ack and still report a useful error.

Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-2-avihaih@nvidia.com
[ clg: error_prepend adjustment in qemu_savevm_state_complete_precopy() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 migration/savevm.h    |  2 +-
 migration/migration.c | 13 ++++++++-----
 migration/savevm.c    | 29 +++++++++++++++++------------
 3 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/migration/savevm.h b/migration/savevm.h
index 96fdf96d4ef6f7fd174f50e8c1402f0b6d6b9e1f..b6bb4fa977fae84ed121b0668cdefdf49e3d9c67 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -44,7 +44,7 @@ void qemu_savevm_state_header(QEMUFile *f);
 int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy);
 void qemu_savevm_state_cleanup(void);
 void qemu_savevm_state_complete_postcopy(QEMUFile *f);
-int qemu_savevm_state_complete_precopy(MigrationState *s);
+int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
 void qemu_savevm_query_pending(MigPendingData *pending, bool exact);
 int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
 bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
diff --git a/migration/migration.c b/migration/migration.c
index 278cad502aebca133dd5fd41363980f9bf9ad496..0f9e891cf85c8e5074f7f9800515e244fa413fa2 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2814,7 +2814,7 @@ static bool migration_switchover_start(MigrationState *s, Error **errp)
     return true;
 }
 
-static int migration_completion_precopy(MigrationState *s)
+static int migration_completion_precopy(MigrationState *s, Error **errp)
 {
     int ret;
 
@@ -2823,16 +2823,17 @@ static int migration_completion_precopy(MigrationState *s)
     if (!migrate_mode_is_cpr()) {
         ret = migration_stop_vm(s, RUN_STATE_FINISH_MIGRATE);
         if (ret < 0) {
+            error_setg_errno(errp, -ret, "Failed to stop the VM");
             goto out_unlock;
         }
     }
 
-    if (!migration_switchover_start(s, NULL)) {
+    if (!migration_switchover_start(s, errp)) {
         ret = -EFAULT;
         goto out_unlock;
     }
 
-    ret = qemu_savevm_state_complete_precopy(s);
+    ret = qemu_savevm_state_complete_precopy(s, errp);
 out_unlock:
     bql_unlock();
     return ret;
@@ -2869,7 +2870,7 @@ static void migration_completion(MigrationState *s)
     Error *local_err = NULL;
 
     if (s->state == MIGRATION_STATUS_ACTIVE) {
-        ret = migration_completion_precopy(s);
+        ret = migration_completion_precopy(s, &local_err);
     } else if (s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE) {
         migration_completion_postcopy(s);
     } else {
@@ -2900,7 +2901,9 @@ static void migration_completion(MigrationState *s)
     return;
 
 fail:
-    if (qemu_file_get_error_obj(s->to_dst_file, &local_err)) {
+    if (local_err) {
+        migrate_error_propagate(s, local_err);
+    } else if (qemu_file_get_error_obj(s->to_dst_file, &local_err)) {
         migrate_error_propagate(s, local_err);
     } else if (ret) {
         error_setg_errno(&local_err, -ret, "Error in migration completion");
diff --git a/migration/savevm.c b/migration/savevm.c
index 23adaf9dd9263b8dafe808f0637724fe4a5482b2..7e2a0c2b4a7470d9c2159eac1d18ae891740fe3e 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1771,28 +1771,34 @@ int qemu_savevm_state_non_iterable(QEMUFile *f, Error **errp)
     return 0;
 }
 
-int qemu_savevm_state_complete_precopy(MigrationState *s)
+int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp)
 {
+    ERRP_GUARD();
     QEMUFile *f = s->to_dst_file;
-    Error *local_err = NULL;
     int ret;
 
     ret = qemu_savevm_state_complete_precopy_iterable(f, false);
     if (ret) {
+        qemu_file_get_error_obj(f, errp);
+        error_prepend(errp, "Failed to save iterable device state: ");
         return ret;
     }
 
-    /* TODO: pass error upper */
-    ret = qemu_savevm_state_non_iterable(f, &local_err);
+    ret = qemu_savevm_state_non_iterable(f, errp);
     if (ret) {
-        migrate_error_propagate(s, error_copy(local_err));
-        error_report_err(local_err);
         return ret;
     }
 
     qemu_savevm_state_end_precopy(s, f);
 
-    return qemu_fflush(f);
+    ret = qemu_fflush(f);
+    if (ret) {
+        qemu_file_get_error_obj(f, errp);
+        error_prepend(errp, "Failed to flush QEMUFile: ");
+        return ret;
+    }
+
+    return 0;
 }
 
 void qemu_savevm_query_pending(MigPendingData *pending, bool exact)
@@ -1874,13 +1880,12 @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
     }
 
     ret = qemu_file_get_error(f);
-    if (ret == 0) {
-        qemu_savevm_state_complete_precopy(ms);
-        ret = qemu_file_get_error(f);
-    }
-    if (ret != 0) {
+    if (ret) {
         error_setg_errno(errp, -ret, "Error while writing VM state");
+        goto cleanup;
     }
+
+    ret = qemu_savevm_state_complete_precopy(ms, errp);
 cleanup:
     qemu_savevm_state_cleanup();
 
-- 
2.54.0

[PULL 07/23] migration/ram: Use migration_bitmap_sync_precopy() for postcopy discard

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

ram_postcopy_send_discard_bitmap() performs the final RAM dirty bitmap
sync at postcopy switchover, before sending discard bitmap to the
destination. Unlike the precopy switchover path, it currently calls the
raw migration_bitmap_sync() helper and passes last_stage=false.

Postcopy switchover is also a stopped-VM final sync point, so use
migration_bitmap_sync_precopy(true). This keeps RAM final bitmap sync
handling consistent across precopy and postcopy switchover, including
the precopy bitmap-sync notifier wrapper. Current notifier users are
safe in postcopy: virtio-balloon free-page hinting already opts out when
postcopy-ram is enabled [1].

This prepares for moving the final sync out of RAM completion/discard
paths and into migration_switchover_start(), where the migration core
can run a final save_query_pending pass for all modules uniformly.

[1] fd51e54fa102 ("virtio-balloon: don't start free page hinting if postcopy is possible")

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-3-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 migration/ram.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/migration/ram.c b/migration/ram.c
index bd519f1931cb0d0cde27765a95730179aba03027..55aa9b47dc8ab8463fd1aeba19726a493b81b070 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -2687,7 +2687,7 @@ void ram_postcopy_send_discard_bitmap(MigrationState *ms)
     RCU_READ_LOCK_GUARD();
 
     /* This should be our last sync, the src is now paused */
-    migration_bitmap_sync(rs, false);
+    migration_bitmap_sync_precopy(true);
 
     /* Easiest way to make sure we don't resume in the middle of a host-page */
     rs->pss[RAM_CHANNEL_PRECOPY].last_sent_block = NULL;
-- 
2.54.0

[PULL 08/23] migration: Run final save_query_pending at switchover

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

Before switchover, the source needs one last exact pending query so
modules can flush dirty state. This is currently done ad hoc in modules
handlers. For example, RAM syncs its dirty bitmap in its save_complete
handler.

This should be a general concept relevant for any module, so extract it
to migration core instead by running a final save_query_pending before
switchover.

The final query requires special handling by modules (e.g., it's called
with BQL locked, during VM stop), so extend save_query_pending
SaveVMHandlers callback and qemu_savevm_query_pending() with a "final"
flag so migration modules can tell the last pending query during
switchover from periodic iteration queries.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Jason J. Herne <jjhern@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-4-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/migration/register.h   | 41 ++++++++++++++++++----------------
 migration/savevm.h             |  3 ++-
 hw/s390x/s390-stattrib.c       |  2 +-
 hw/vfio/migration.c            | 11 ++++++---
 migration/block-dirty-bitmap.c | 11 ++++++---
 migration/migration.c          | 14 ++++++++++--
 migration/ram.c                | 40 +++++++++++++++++++--------------
 migration/savevm.c             | 20 +++++++++++++----
 hw/vfio/trace-events           |  2 +-
 migration/trace-events         |  2 +-
 10 files changed, 94 insertions(+), 52 deletions(-)

diff --git a/include/migration/register.h b/include/migration/register.h
index 5e5e0ee432e537781ce78e84b2ff2d81c33e8f37..6f632123f1d0710de0556e68ba53e068a1e02640 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -171,6 +171,28 @@ typedef struct SaveVMHandlers {
      */
     bool (*is_active_iterate)(void *opaque);
 
+    /**
+     * @save_query_pending
+     *
+     * This estimates the remaining data to transfer on the source side.
+     *
+     * When @exact is true, a module must report accurate results.  When
+     * @exact is false, a module may report estimates.
+     *
+     * It's highly recommended that modules implement a faster version of
+     * the query path (for example, by proper caching on the counters) if
+     * an accurate query will be time-consuming.
+     *
+     * @opaque: data pointer passed to register_savevm_live()
+     * @pending: pointer to a MigPendingData struct
+     * @exact: set to true for an accurate (slow) query
+     * @final: set to true for the final query during switchover. When final is
+     * true, the query is called with BQL locked. Otherwise, it's called with
+     * BQL unlocked.
+     */
+    void (*save_query_pending)(void *opaque, MigPendingData *pending,
+                               bool exact, bool final);
+
     /* This runs outside the BQL in the migration case, and
      * within the lock in the savevm case.  The callback had better only
      * use data that is local to the migration thread or protected
@@ -210,25 +232,6 @@ typedef struct SaveVMHandlers {
      */
     bool (*save_postcopy_prepare)(QEMUFile *f, void *opaque, Error **errp);
 
-    /**
-     * @save_query_pending
-     *
-     * This estimates the remaining data to transfer on the source side.
-     *
-     * When @exact is true, a module must report accurate results.  When
-     * @exact is false, a module may report estimates.
-     *
-     * It's highly recommended that modules implement a faster version of
-     * the query path (for example, by proper caching on the counters) if
-     * an accurate query will be time-consuming.
-     *
-     * @opaque: data pointer passed to register_savevm_live()
-     * @pending: pointer to a MigPendingData struct
-     * @exact: set to true for an accurate (slow) query
-     */
-    void (*save_query_pending)(void *opaque, MigPendingData *pending,
-                               bool exact);
-
     /**
      * @load_state
      *
diff --git a/migration/savevm.h b/migration/savevm.h
index b6bb4fa977fae84ed121b0668cdefdf49e3d9c67..81abd96dda94c6c95cc40b3c188df23d11c19463 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -45,7 +45,8 @@ int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy);
 void qemu_savevm_state_cleanup(void);
 void qemu_savevm_state_complete_postcopy(QEMUFile *f);
 int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
-void qemu_savevm_query_pending(MigPendingData *pending, bool exact);
+void qemu_savevm_query_pending_iter(MigPendingData *pending, bool exact);
+void qemu_savevm_query_pending_final(MigPendingData *pending);
 int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
 bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
 void qemu_savevm_state_end(QEMUFile *f);
diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c
index c334714b31ab4313e26c0cf57091a8cb21e55306..b0f04eb30c7f73e5dd91b1345d71a14cb404a4eb 100644
--- a/hw/s390x/s390-stattrib.c
+++ b/hw/s390x/s390-stattrib.c
@@ -190,7 +190,7 @@ static int cmma_save_setup(QEMUFile *f, void *opaque, Error **errp)
 }
 
 static void cmma_state_pending(void *opaque, MigPendingData *pending,
-                               bool exact)
+                               bool exact, bool final)
 {
     S390StAttribState *sas = S390_STATTRIB(opaque);
     S390StAttribClass *sac = S390_STATTRIB_GET_CLASS(sas);
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index fb12b9717f773fdde657911517de9d74c1eb3931..195498845ed95d6a55cf68537a100b4e83221fb0 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -622,13 +622,18 @@ static void vfio_state_pending_sync(VFIODevice *vbasedev)
 }
 
 static void vfio_state_pending(void *opaque, MigPendingData *pending,
-                               bool exact)
+                               bool exact, bool final)
 {
     VFIODevice *vbasedev = opaque;
     VFIOMigration *migration = vbasedev->migration;
     uint64_t precopy_size, stopcopy_size;
 
-    if (exact) {
+    /*
+     * The final pending query runs during switchover downtime. VFIO does not
+     * need a fresh device pending-data query then to get the latest dirty
+     * data, so avoid the extra work and report the cached counters below.
+     */
+    if (exact && !final) {
         vfio_state_pending_sync(vbasedev);
     }
 
@@ -646,7 +651,7 @@ static void vfio_state_pending(void *opaque, MigPendingData *pending,
 
     trace_vfio_state_pending(vbasedev->name, migration->stopcopy_size,
                              migration->precopy_init_size,
-                             migration->precopy_dirty_size, exact);
+                             migration->precopy_dirty_size, exact, final);
 }
 
 static bool vfio_is_active_iterate(void *opaque)
diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
index 7ef3759e5348a6907c0fb3773e2c6cbb0850632e..cba54e25cd50da924e1958bdfc23ce060784b0ac 100644
--- a/migration/block-dirty-bitmap.c
+++ b/migration/block-dirty-bitmap.c
@@ -767,13 +767,16 @@ static int dirty_bitmap_save_complete(QEMUFile *f, void *opaque)
 }
 
 static void dirty_bitmap_state_pending(void *opaque, MigPendingData *data,
-                                       bool exact)
+                                       bool exact, bool final)
 {
     DBMSaveState *s = &((DBMState *)opaque)->save;
     SaveBitmapState *dbms;
     uint64_t pending = 0;
 
-    bql_lock();
+    /* Final pending query is called with BQL locked */
+    if (!final) {
+        bql_lock();
+    }
 
     QSIMPLEQ_FOREACH(dbms, &s->dbms_list, entry) {
         uint64_t gran = bdrv_dirty_bitmap_granularity(dbms->bitmap);
@@ -783,7 +786,9 @@ static void dirty_bitmap_state_pending(void *opaque, MigPendingData *data,
         pending += DIV_ROUND_UP(sectors * BDRV_SECTOR_SIZE, gran);
     }
 
-    bql_unlock();
+    if (!final) {
+        bql_unlock();
+    }
 
     trace_dirty_bitmap_state_pending(pending);
 
diff --git a/migration/migration.c b/migration/migration.c
index 0f9e891cf85c8e5074f7f9800515e244fa413fa2..ea0b236597087cc005541e1916ceabb229afab4b 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2787,12 +2787,22 @@ static bool migration_switchover_prepare(MigrationState *s)
 static bool migration_switchover_start(MigrationState *s, Error **errp)
 {
     ERRP_GUARD();
+    MigPendingData pending = {};
 
     if (!migration_switchover_prepare(s)) {
         error_setg(errp, "Switchover is interrupted");
         return false;
     }
 
+    /*
+     * The final query to the whole system on dirty data to make sure we
+     * collect the latest status of the VM.  For precopy, source QEMU will
+     * dump all the dirty data during switchover.  For postcopy, this will
+     * properly update all the dirty bitmaps to finally generate the
+     * correct discard bitmaps; see ram_postcopy_send_discard_bitmap().
+     */
+    qemu_savevm_query_pending_final(&pending);
+
     /* Inactivate disks except in COLO */
     if (!migrate_colo()) {
         /*
@@ -3285,7 +3295,7 @@ static void migration_iteration_go_next(MigPendingData *pending)
     /*
      * Do a slow sync first before boosting the iteration count.
      */
-    qemu_savevm_query_pending(pending, true);
+    qemu_savevm_query_pending_iter(pending, true);
 
     /*
      * Update the dirty information for the whole system for this
@@ -3336,7 +3346,7 @@ static MigIterateState migration_iteration_run(MigrationState *s)
     bool complete_ready;
 
     /* Fast path - get the estimated amount of pending data */
-    qemu_savevm_query_pending(&pending, false);
+    qemu_savevm_query_pending_iter(&pending, false);
 
     if (in_postcopy) {
         /*
diff --git a/migration/ram.c b/migration/ram.c
index 55aa9b47dc8ab8463fd1aeba19726a493b81b070..8918b2f03b6fbcc98532bb45ab905f9bac59384c 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -2686,9 +2686,6 @@ void ram_postcopy_send_discard_bitmap(MigrationState *ms)
 
     RCU_READ_LOCK_GUARD();
 
-    /* This should be our last sync, the src is now paused */
-    migration_bitmap_sync_precopy(true);
-
     /* Easiest way to make sure we don't resume in the middle of a host-page */
     rs->pss[RAM_CHANNEL_PRECOPY].last_sent_block = NULL;
     rs->last_seen_block = NULL;
@@ -3376,10 +3373,6 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
     rs->last_stage = !migration_in_colo_state();
 
     WITH_RCU_READ_LOCK_GUARD() {
-        if (!migration_in_postcopy()) {
-            migration_bitmap_sync_precopy(true);
-        }
-
         ret = rdma_registration_start(f, RAM_CONTROL_FINISH);
         if (ret < 0) {
             qemu_file_set_error(f, ret);
@@ -3442,25 +3435,38 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
     return qemu_fflush(f);
 }
 
-static void ram_state_pending(void *opaque, MigPendingData *pending,
-                              bool exact)
+static void ram_state_pending_sync(bool exact, bool final)
 {
-    RAMState **temp = opaque;
-    RAMState *rs = *temp;
-    uint64_t remaining_size;
-
     /*
      * Sync is not needed either with: (1) a fast query, or (2) after
      * postcopy has started (no new dirty will generate anymore).
      */
-    if (exact && !migration_in_postcopy()) {
+    if (!exact || migration_in_postcopy()) {
+        return;
+    }
+
+    /* Final pending query is called with BQL locked */
+    if (!final) {
         bql_lock();
-        WITH_RCU_READ_LOCK_GUARD() {
-            migration_bitmap_sync_precopy(false);
-        }
+    }
+
+    WITH_RCU_READ_LOCK_GUARD() {
+        migration_bitmap_sync_precopy(final);
+    }
+
+    if (!final) {
         bql_unlock();
     }
+}
+
+static void ram_state_pending(void *opaque, MigPendingData *pending,
+                              bool exact, bool final)
+{
+    RAMState **temp = opaque;
+    RAMState *rs = *temp;
+    uint64_t remaining_size;
 
+    ram_state_pending_sync(exact, final);
     remaining_size = rs->migration_dirty_pages * TARGET_PAGE_SIZE;
 
     if (migrate_postcopy_ram()) {
diff --git a/migration/savevm.c b/migration/savevm.c
index 7e2a0c2b4a7470d9c2159eac1d18ae891740fe3e..74d622583e345bdc96b9189aad0c8f6bad41964d 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1801,7 +1801,8 @@ int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp)
     return 0;
 }
 
-void qemu_savevm_query_pending(MigPendingData *pending, bool exact)
+static void qemu_savevm_query_pending(MigPendingData *pending, bool exact,
+                                      bool final)
 {
     SaveStateEntry *se;
 
@@ -1814,7 +1815,7 @@ void qemu_savevm_query_pending(MigPendingData *pending, bool exact)
         if (!qemu_savevm_state_active(se)) {
             continue;
         }
-        se->ops->save_query_pending(se->opaque, pending, exact);
+        se->ops->save_query_pending(se->opaque, pending, exact, final);
     }
 
     pending->total_bytes = pending->precopy_bytes +
@@ -1826,13 +1827,24 @@ void qemu_savevm_query_pending(MigPendingData *pending, bool exact)
      * close to reality when this got invoked frequently while iterating.
      */
     mig_stats.dirty_bytes_total = pending->total_bytes;
-
-    trace_qemu_savevm_query_pending(exact, pending->precopy_bytes,
+    trace_qemu_savevm_query_pending(exact, final, pending->precopy_bytes,
                                     pending->stopcopy_bytes,
                                     pending->postcopy_bytes,
                                     pending->total_bytes);
 }
 
+void qemu_savevm_query_pending_iter(MigPendingData *pending, bool exact)
+{
+    qemu_savevm_query_pending(pending, exact, false);
+}
+
+void qemu_savevm_query_pending_final(MigPendingData *pending)
+{
+    g_assert(bql_locked());
+
+    qemu_savevm_query_pending(pending, true, true);
+}
+
 void qemu_savevm_state_cleanup(void)
 {
     SaveStateEntry *se;
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index 4c28b3291cc687c06490bdd090f393b67c9c4d88..fa2204f002970c31eb987ae13113a9a5edb3e172 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -176,7 +176,7 @@ vfio_save_device_config_state(const char *name) " (%s)"
 vfio_save_iterate(const char *name, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy initial size %"PRIu64" precopy dirty size %"PRIu64
 vfio_save_iterate_start(const char *name) " (%s)"
 vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer size %"PRIu64
-vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool exact) " (%s) stopcopy size %"PRIu64" precopy initial size %"PRIu64" precopy dirty size %"PRIu64 " exact %d"
+vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool exact, bool final) " (%s) stopcopy size %"PRIu64", precopy initial size %"PRIu64", precopy dirty size %"PRIu64", exact %d, final %d"
 vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
 vfio_vmstate_change_prepare(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
 
diff --git a/migration/trace-events b/migration/trace-events
index de99d976abc637e9361f8467daacf3cc8787976f..1c9212d3e20555902f008e4c999f32642cc8fa48 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -7,7 +7,7 @@ qemu_loadvm_state_section_partend(uint32_t section_id) "%u"
 qemu_loadvm_state_post_main(int ret) "%d"
 qemu_loadvm_state_section_startfull(uint32_t section_id, const char *idstr, uint32_t instance_id, uint32_t version_id) "%u(%s) %u %u"
 qemu_savevm_send_packaged(void) ""
-qemu_savevm_query_pending(bool exact, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total) "exact=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64
+qemu_savevm_query_pending(bool exact, bool final, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total) "exact=%d, final=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64
 loadvm_state_switchover_ack_needed(unsigned int switchover_ack_pending_num) "Switchover ack pending num=%u"
 loadvm_state_setup(void) ""
 loadvm_state_cleanup(void) ""
-- 
2.54.0

[PULL 09/23] migration: Log the approver in qemu_loadvm_approve_switchover()

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

Pass the device name that approved switchover to
qemu_loadvm_approve_switchover() and log it in the trace for debugging
purposes.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-5-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 migration/savevm.h     | 2 +-
 hw/vfio/migration.c    | 2 +-
 migration/savevm.c     | 4 ++--
 migration/trace-events | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/migration/savevm.h b/migration/savevm.h
index 81abd96dda94c6c95cc40b3c188df23d11c19463..44424be347494c51e6976749d7c60d27ca7f0628 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -71,7 +71,7 @@ void qemu_loadvm_state_cleanup(MigrationIncomingState *mis);
 int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis,
                            Error **errp);
 int qemu_load_device_state(QEMUFile *f, Error **errp);
-int qemu_loadvm_approve_switchover(void);
+int qemu_loadvm_approve_switchover(const char *approver);
 int qemu_savevm_state_non_iterable(QEMUFile *f, Error **errp);
 int qemu_savevm_state_non_iterable_early(QEMUFile *f,
                                          JSONWriter *vmdesc,
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 195498845ed95d6a55cf68537a100b4e83221fb0..180b316baecb980fbd475b1426726697f340ccc8 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -847,7 +847,7 @@ static int vfio_load_state(QEMUFile *f, void *opaque, int version_id)
                 return -EINVAL;
             }
 
-            ret = qemu_loadvm_approve_switchover();
+            ret = qemu_loadvm_approve_switchover(vbasedev->name);
             if (ret) {
                 error_report(
                     "%s: qemu_loadvm_approve_switchover failed, err=%d (%s)",
diff --git a/migration/savevm.c b/migration/savevm.c
index 74d622583e345bdc96b9189aad0c8f6bad41964d..be81de26160d195488e5fb09a88dc37a7a06a3fe 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -3174,7 +3174,7 @@ int qemu_load_device_state(QEMUFile *f, Error **errp)
     return 0;
 }
 
-int qemu_loadvm_approve_switchover(void)
+int qemu_loadvm_approve_switchover(const char *approver)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
 
@@ -3183,7 +3183,7 @@ int qemu_loadvm_approve_switchover(void)
     }
 
     mis->switchover_ack_pending_num--;
-    trace_loadvm_approve_switchover(mis->switchover_ack_pending_num);
+    trace_loadvm_approve_switchover(approver, mis->switchover_ack_pending_num);
 
     if (mis->switchover_ack_pending_num) {
         return 0;
diff --git a/migration/trace-events b/migration/trace-events
index 1c9212d3e20555902f008e4c999f32642cc8fa48..c0c433744cd33d7e28496831bb8ce93c65670bf5 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -24,7 +24,7 @@ loadvm_postcopy_ram_handle_discard_end(void) ""
 loadvm_postcopy_ram_handle_discard_header(const char *ramid, uint16_t len) "%s: %ud"
 loadvm_process_command(const char *s, uint16_t len) "com=%s len=%d"
 loadvm_process_command_ping(uint32_t val) "0x%x"
-loadvm_approve_switchover(unsigned int switchover_ack_pending_num) "Switchover ack pending num=%u"
+loadvm_approve_switchover(const char *approver, unsigned int switchover_ack_pending_num) "Approver %s, switchover_ack_pending_num %u"
 postcopy_ram_listen_thread_exit(void) ""
 postcopy_ram_listen_thread_start(void) ""
 qemu_savevm_send_postcopy_advise(void) ""
-- 
2.54.0

[PULL 10/23] migration: Replace switchover_ack_needed SaveVMHandler

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

A new switchover-ack mechanism that will replace the existing one will
be added in the following patches. The new mechanism will not use
switchover_ack_needed SaveVMHandler, however, the old mechanism must
still be kept for backward compatibility.

To keep things clear and decrease API surface of old code, replace
switchover_ack_needed SaveVMHandler with a regular function
migration_request_switchover_ack().

No functional changes intended.

Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-6-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/devel/migration/vfio.rst |  3 ---
 include/migration/misc.h      |  2 ++
 include/migration/register.h  | 13 -------------
 hw/vfio/migration.c           | 18 ++++++++++--------
 migration/migration.c         | 15 +++++++++++++++
 migration/savevm.c            | 21 ---------------------
 migration/trace-events        |  2 +-
 7 files changed, 28 insertions(+), 46 deletions(-)

diff --git a/docs/devel/migration/vfio.rst b/docs/devel/migration/vfio.rst
index 691061d1820453a09df479f020abf0aab5fbabfd..854277b11ce64672f998ce1728bf8b5ddf1c129a 100644
--- a/docs/devel/migration/vfio.rst
+++ b/docs/devel/migration/vfio.rst
@@ -59,9 +59,6 @@ VFIO implements the device hooks for the iterative approach as follows:
 * A ``save_live_iterate`` function that reads the VFIO device's data from the
   vendor driver during iterative pre-copy phase.
 
-* A ``switchover_ack_needed`` function that checks if the VFIO device uses
-  "switchover-ack" migration capability when this capability is enabled.
-
 * A ``switchover_start`` function that in the multifd mode starts a thread that
   reassembles the multifd received data and loads it in-order into the device.
   In the non-multifd mode this function is a NOP.
diff --git a/include/migration/misc.h b/include/migration/misc.h
index 3159a5e53c3c9aa3c1642ebd5ea4c43aef0675d0..a2219c981b07eca8a79287367e6f808d73b7af6d 100644
--- a/include/migration/misc.h
+++ b/include/migration/misc.h
@@ -156,4 +156,6 @@ bool multifd_device_state_save_thread_should_exit(void);
 void multifd_abort_device_state_save_threads(void);
 bool multifd_join_device_state_save_threads(void);
 
+void migration_request_switchover_ack(const char *requester);
+
 #endif
diff --git a/include/migration/register.h b/include/migration/register.h
index 6f632123f1d0710de0556e68ba53e068a1e02640..a61c4236d22423a8477876971f1d73fe2e802f4a 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -302,19 +302,6 @@ typedef struct SaveVMHandlers {
      */
     int (*resume_prepare)(MigrationState *s, void *opaque);
 
-    /**
-     * @switchover_ack_needed
-     *
-     * Checks if switchover ack should be used. Called only on
-     * destination.
-     *
-     * @opaque: data pointer passed to register_savevm_live()
-     *
-     * Returns true if switchover ack should be used and false
-     * otherwise
-     */
-    bool (*switchover_ack_needed)(void *opaque);
-
     /**
      * @switchover_start
      *
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 180b316baecb980fbd475b1426726697f340ccc8..7055cfbd3e04bd2b1e95c9be45b879cb0bf06212 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -487,6 +487,14 @@ static bool vfio_precopy_supported(VFIODevice *vbasedev)
     return migration->mig_flags & VFIO_MIGRATION_PRE_COPY;
 }
 
+static void vfio_request_switchover_ack(VFIODevice *vbasedev)
+{
+    if (vfio_precopy_supported(vbasedev)) {
+        /* Precopy support implies switchover-ack is needed */
+        migration_request_switchover_ack(vbasedev->name);
+    }
+}
+
 /* ---------------------------------------------------------------------- */
 
 static int vfio_save_prepare(void *opaque, Error **errp)
@@ -776,6 +784,8 @@ static int vfio_load_setup(QEMUFile *f, void *opaque, Error **errp)
         return ret;
     }
 
+    vfio_request_switchover_ack(vbasedev);
+
     return 0;
 }
 
@@ -874,13 +884,6 @@ static int vfio_load_state(QEMUFile *f, void *opaque, int version_id)
     return ret;
 }
 
-static bool vfio_switchover_ack_needed(void *opaque)
-{
-    VFIODevice *vbasedev = opaque;
-
-    return vfio_precopy_supported(vbasedev);
-}
-
 static int vfio_switchover_start(void *opaque)
 {
     VFIODevice *vbasedev = opaque;
@@ -904,7 +907,6 @@ static const SaveVMHandlers savevm_vfio_handlers = {
     .load_setup = vfio_load_setup,
     .load_cleanup = vfio_load_cleanup,
     .load_state = vfio_load_state,
-    .switchover_ack_needed = vfio_switchover_ack_needed,
     /*
      * Multifd support
      */
diff --git a/migration/migration.c b/migration/migration.c
index ea0b236597087cc005541e1916ceabb229afab4b..4d5e3b7c5ab7ad9ee2a5d0fca2e308b4f23be82e 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2196,6 +2196,21 @@ void migration_rp_kick(MigrationState *s)
     qemu_sem_post(&s->rp_state.rp_sem);
 }
 
+/* This is called only on destination side */
+void migration_request_switchover_ack(const char *requester)
+{
+    MigrationIncomingState *mis = migration_incoming_get_current();
+
+    if (!migrate_switchover_ack()) {
+        return;
+    }
+
+    mis->switchover_ack_pending_num++;
+
+    trace_migration_request_switchover_ack(requester,
+                                           mis->switchover_ack_pending_num);
+}
+
 static struct rp_cmd_args {
     ssize_t     len; /* -1 = variable */
     const char *name;
diff --git a/migration/savevm.c b/migration/savevm.c
index be81de26160d195488e5fb09a88dc37a7a06a3fe..98639630277b7543db7400ec97d6b009603a03bc 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2800,23 +2800,6 @@ static int qemu_loadvm_state_header(QEMUFile *f, Error **errp)
     return 0;
 }
 
-static void qemu_loadvm_state_switchover_ack_needed(MigrationIncomingState *mis)
-{
-    SaveStateEntry *se;
-
-    QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
-        if (!se->ops || !se->ops->switchover_ack_needed) {
-            continue;
-        }
-
-        if (se->ops->switchover_ack_needed(se->opaque)) {
-            mis->switchover_ack_pending_num++;
-        }
-    }
-
-    trace_loadvm_state_switchover_ack_needed(mis->switchover_ack_pending_num);
-}
-
 static int qemu_loadvm_state_setup(QEMUFile *f, Error **errp)
 {
     ERRP_GUARD();
@@ -3078,10 +3061,6 @@ int qemu_loadvm_state(QEMUFile *f, Error **errp)
         return -EINVAL;
     }
 
-    if (migrate_switchover_ack()) {
-        qemu_loadvm_state_switchover_ack_needed(mis);
-    }
-
     cpu_synchronize_all_pre_loadvm();
 
     ret = qemu_loadvm_state_main(f, mis, errp);
diff --git a/migration/trace-events b/migration/trace-events
index c0c433744cd33d7e28496831bb8ce93c65670bf5..5955befcc66128b72dfdbc9711e5749f19b9faf8 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -8,7 +8,6 @@ qemu_loadvm_state_post_main(int ret) "%d"
 qemu_loadvm_state_section_startfull(uint32_t section_id, const char *idstr, uint32_t instance_id, uint32_t version_id) "%u(%s) %u %u"
 qemu_savevm_send_packaged(void) ""
 qemu_savevm_query_pending(bool exact, bool final, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total) "exact=%d, final=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64
-loadvm_state_switchover_ack_needed(unsigned int switchover_ack_pending_num) "Switchover ack pending num=%u"
 loadvm_state_setup(void) ""
 loadvm_state_cleanup(void) ""
 loadvm_handle_cmd_packaged(unsigned int length) "%u"
@@ -199,6 +198,7 @@ process_incoming_migration_co_postcopy_end_main(void) ""
 postcopy_preempt_enabled(bool value) "%d"
 migration_precopy_complete(void) ""
 migration_call_notifiers(int type) "type=%d"
+migration_request_switchover_ack(const char *requester, unsigned int switchover_ack_pending_num) "Requester %s, switchover_ack_pending_num %u"
 
 # migration-stats
 migration_transferred_bytes(uint64_t qemu_file, uint64_t multifd, uint64_t rdma) "qemu_file %" PRIu64 " multifd %" PRIu64 " RDMA %" PRIu64
-- 
2.54.0

[PULL 11/23] migration: Rename switchover-ack code to legacy

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

A new switchover-ack mechanism will be added in the following patches.
However, the old mechanism must still be kept for backward
compatibility.

Rename existing code that will be used only for old switchover-ack
mechanism as legacy. This will help to distinguish legacy code from new
code and make it more readable and easier for removal later when no
longer needed.

No functional change intended.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-7-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/migration/misc.h |  2 +-
 migration/migration.h    |  2 +-
 hw/vfio/migration.c      |  6 ++---
 migration/migration.c    |  8 +++----
 migration/savevm.c       | 49 +++++++++++++++++++++++++++-------------
 migration/trace-events   |  4 ++--
 6 files changed, 44 insertions(+), 27 deletions(-)

diff --git a/include/migration/misc.h b/include/migration/misc.h
index a2219c981b07eca8a79287367e6f808d73b7af6d..4b43413aee61fa88397c30601d1ca5aad3127716 100644
--- a/include/migration/misc.h
+++ b/include/migration/misc.h
@@ -156,6 +156,6 @@ bool multifd_device_state_save_thread_should_exit(void);
 void multifd_abort_device_state_save_threads(void);
 bool multifd_join_device_state_save_threads(void);
 
-void migration_request_switchover_ack(const char *requester);
+void migration_request_switchover_ack_legacy(const char *requester);
 
 #endif
diff --git a/migration/migration.h b/migration/migration.h
index 293ad60e07bd4dd059ec0e0b5aa2ed2d2ba11d29..570349d8581354bda30f5a37ccddf5476ec518ce 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -246,7 +246,7 @@ struct MigrationIncomingState {
      * zero an ACK that it's OK to do switchover is sent to the source. No lock
      * is needed as this field is updated serially.
      */
-    unsigned int switchover_ack_pending_num;
+    unsigned int switchover_ack_pending_num_legacy;
 
     /* Do exit on incoming migration failure */
     bool exit_on_error;
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 7055cfbd3e04bd2b1e95c9be45b879cb0bf06212..6b7acb2fa19d3ee618e73365ca995bbdb4676055 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -487,11 +487,11 @@ static bool vfio_precopy_supported(VFIODevice *vbasedev)
     return migration->mig_flags & VFIO_MIGRATION_PRE_COPY;
 }
 
-static void vfio_request_switchover_ack(VFIODevice *vbasedev)
+static void vfio_request_switchover_ack_legacy(VFIODevice *vbasedev)
 {
     if (vfio_precopy_supported(vbasedev)) {
         /* Precopy support implies switchover-ack is needed */
-        migration_request_switchover_ack(vbasedev->name);
+        migration_request_switchover_ack_legacy(vbasedev->name);
     }
 }
 
@@ -784,7 +784,7 @@ static int vfio_load_setup(QEMUFile *f, void *opaque, Error **errp)
         return ret;
     }
 
-    vfio_request_switchover_ack(vbasedev);
+    vfio_request_switchover_ack_legacy(vbasedev);
 
     return 0;
 }
diff --git a/migration/migration.c b/migration/migration.c
index 4d5e3b7c5ab7ad9ee2a5d0fca2e308b4f23be82e..c88b4618017a18f0464b70c4cf0dcfc03b099a22 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2197,7 +2197,7 @@ void migration_rp_kick(MigrationState *s)
 }
 
 /* This is called only on destination side */
-void migration_request_switchover_ack(const char *requester)
+void migration_request_switchover_ack_legacy(const char *requester)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
 
@@ -2205,10 +2205,10 @@ void migration_request_switchover_ack(const char *requester)
         return;
     }
 
-    mis->switchover_ack_pending_num++;
+    mis->switchover_ack_pending_num_legacy++;
 
-    trace_migration_request_switchover_ack(requester,
-                                           mis->switchover_ack_pending_num);
+    trace_migration_request_switchover_ack_legacy(
+        requester, mis->switchover_ack_pending_num_legacy);
 }
 
 static struct rp_cmd_args {
diff --git a/migration/savevm.c b/migration/savevm.c
index 98639630277b7543db7400ec97d6b009603a03bc..804c76e3bd93d6b4433df12d524a803491b0aa08 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2478,6 +2478,31 @@ static int loadvm_postcopy_handle_switchover_start(Error **errp)
     return 0;
 }
 
+/*
+ * If legacy switchover-ack is enabled but no device uses it, need to send an
+ * ACK to source that it's OK to switchover.
+ */
+static int loadvm_switchover_ack_no_users_legacy(MigrationIncomingState *mis,
+                                                 Error **errp)
+{
+    int ret;
+
+    if (!migrate_switchover_ack()) {
+        return 0;
+    }
+
+    if (!mis->switchover_ack_pending_num_legacy) {
+        ret = migrate_send_rp_switchover_ack(mis);
+        if (ret) {
+            error_setg_errno(errp, -ret,
+                             "Could not send switchover ack RP MSG");
+            return ret;
+        }
+    }
+
+    return 0;
+}
+
 /*
  * Process an incoming 'QEMU_VM_COMMAND'
  * 0           just a normal return
@@ -2527,18 +2552,9 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
         }
         mis->to_src_file = qemu_file_get_return_path(f);
 
-        /*
-         * Switchover ack is enabled but no device uses it, so send an ACK to
-         * source that it's OK to switchover. Do it here, after return path has
-         * been created.
-         */
-        if (migrate_switchover_ack() && !mis->switchover_ack_pending_num) {
-            ret = migrate_send_rp_switchover_ack(mis);
-            if (ret) {
-                error_setg_errno(errp, -ret,
-                                 "Could not send switchover ack RP MSG");
-                return ret;
-            }
+        ret = loadvm_switchover_ack_no_users_legacy(mis, errp);
+        if (ret) {
+            return ret;
         }
         return 0;
 
@@ -3157,14 +3173,15 @@ int qemu_loadvm_approve_switchover(const char *approver)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
 
-    if (!mis->switchover_ack_pending_num) {
+    if (!mis->switchover_ack_pending_num_legacy) {
         return -EINVAL;
     }
 
-    mis->switchover_ack_pending_num--;
-    trace_loadvm_approve_switchover(approver, mis->switchover_ack_pending_num);
+    mis->switchover_ack_pending_num_legacy--;
+    trace_loadvm_approve_switchover_legacy(
+        approver, mis->switchover_ack_pending_num_legacy);
 
-    if (mis->switchover_ack_pending_num) {
+    if (mis->switchover_ack_pending_num_legacy) {
         return 0;
     }
 
diff --git a/migration/trace-events b/migration/trace-events
index 5955befcc66128b72dfdbc9711e5749f19b9faf8..a6b8c31ee1d3eddc59798d7a9b97d2718814e1cb 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -23,7 +23,7 @@ loadvm_postcopy_ram_handle_discard_end(void) ""
 loadvm_postcopy_ram_handle_discard_header(const char *ramid, uint16_t len) "%s: %ud"
 loadvm_process_command(const char *s, uint16_t len) "com=%s len=%d"
 loadvm_process_command_ping(uint32_t val) "0x%x"
-loadvm_approve_switchover(const char *approver, unsigned int switchover_ack_pending_num) "Approver %s, switchover_ack_pending_num %u"
+loadvm_approve_switchover_legacy(const char *approver, unsigned int switchover_ack_pending_num_legacy) "Approver %s, switchover_ack_pending_num_legacy %u"
 postcopy_ram_listen_thread_exit(void) ""
 postcopy_ram_listen_thread_start(void) ""
 qemu_savevm_send_postcopy_advise(void) ""
@@ -198,7 +198,7 @@ process_incoming_migration_co_postcopy_end_main(void) ""
 postcopy_preempt_enabled(bool value) "%d"
 migration_precopy_complete(void) ""
 migration_call_notifiers(int type) "type=%d"
-migration_request_switchover_ack(const char *requester, unsigned int switchover_ack_pending_num) "Requester %s, switchover_ack_pending_num %u"
+migration_request_switchover_ack_legacy(const char *requester, unsigned int switchover_ack_pending_num_legacy) "Requester %s, switchover_ack_pending_num_legacy %u"
 
 # migration-stats
 migration_transferred_bytes(uint64_t qemu_file, uint64_t multifd, uint64_t rdma) "qemu_file %" PRIu64 " multifd %" PRIu64 " RDMA %" PRIu64
-- 
2.54.0

[PULL 12/23] migration: Make switchover-ack re-usable

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

Switchover-ack is a mechanism to synchronize between source and
destination QEMU during migration to prevent the source from switching
over prematurely.

VFIO uses switchover-ack to ensure switchover happens only after
destination side has loaded the precopy initial bytes. This is important
for VFIO, as otherwise downtime could be impacted and be higher.

In its current state, switchover-ack is a one-time mechanism, meaning
that switchover is acked only once and past that another ACK cannot be
requested again. This was sufficient until now, as VFIO precopy initial
bytes was defined to be monotonically decreasing. Thus, when precopy
initial bytes reached zero for all VFIO devices, a single ACK would be
sent and its validity would hold.

However, now the new VFIO_PRECOPY_INFO_REINIT feature allows precopy
initial bytes to be re-initialized during precopy. Specifically, it
means that initial bytes can grow after reaching zero, which would
invalidate a previously sent switchover ACK.

To solve this, make switchover-ack reusable and allow devices to request
switchover ACKs when needed via the save_query_pending SaveVMHandler.

Since now switchover ACK can be requested for a specific device and in
different times, make switchover ACK per-device (instead of a single ACK
for all devices) and let source side do the pending ACKs accounting.

Keep the legacy switchover-ack mechanism for backward compatibility and
turn it on by a compatibility property for older machines. Enable the
property until VFIO implements the new switchover-ack.

Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-8-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 qapi/migration.json                | 14 ++++----
 include/migration/client-options.h |  1 +
 include/migration/register.h       |  2 ++
 migration/migration.h              | 32 ++++++++++++++++--
 migration/savevm.h                 |  6 ++--
 migration/migration.c              | 37 ++++++++++++++-------
 migration/options.c                | 10 ++++++
 migration/savevm.c                 | 53 +++++++++++++++++++++++-------
 migration/trace-events             |  5 +--
 9 files changed, 123 insertions(+), 37 deletions(-)

diff --git a/qapi/migration.json b/qapi/migration.json
index e8756308cf9610182f75997ab81946f3b03dea63..d2f42c4b0ffd0a9e6bb757b8d105fed89b423537 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -508,14 +508,12 @@
 #     (since 7.1)
 #
 # @switchover-ack: If enabled, migration will not stop the source VM
-#     and complete the migration until an ACK is received from the
-#     destination that it's OK to do so.  Exactly when this ACK is
-#     sent depends on the migrated devices that use this feature.  For
-#     example, a device can use it to make sure some of its data is
-#     sent and loaded in the destination before doing switchover.
-#     This can reduce downtime if devices that support this capability
-#     are present.  'return-path' capability must be enabled to use
-#     it.  (since 8.1)
+#     and complete the migration until the destination has
+#     acknowledged that it is OK to switchover.  The acknowledgement
+#     may depend, for example, on some device's data being loaded in
+#     the destination before doing switchover.  This can reduce
+#     downtime if devices that support this capability are present.
+#     Capability @return-path must be enabled to use it.  (since 8.1)
 #
 # @dirty-limit: If enabled, migration will throttle vCPUs as needed to
 #     keep their dirty page rate within @vcpu-dirty-limit.  This can
diff --git a/include/migration/client-options.h b/include/migration/client-options.h
index 289c9d776221ce3cf35d86f91ce3313fd79427d3..78b1daa1a615ceb601da5dc8914f4fb5fe04f8a9 100644
--- a/include/migration/client-options.h
+++ b/include/migration/client-options.h
@@ -13,6 +13,7 @@
 
 /* properties */
 bool migrate_send_switchover_start(void);
+bool migrate_switchover_ack_legacy(void);
 
 /* capabilities */
 
diff --git a/include/migration/register.h b/include/migration/register.h
index a61c4236d22423a8477876971f1d73fe2e802f4a..5825eb30cb33e1721bec399f8a1c01df154d143b 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -23,6 +23,8 @@ typedef struct MigPendingData {
     uint64_t postcopy_bytes;
     /* Amount of pending bytes can be transferred only in stopcopy */
     uint64_t stopcopy_bytes;
+    /* Number of new pending switchover ACKs */
+    uint32_t switchover_ack_pending;
     /*
      * Total pending data, modules do not need to update this field, it
      * will be automatically calculated by migration core API.
diff --git a/migration/migration.h b/migration/migration.h
index 570349d8581354bda30f5a37ccddf5476ec518ce..44bce199cd8c3518998ad7204d599566d1ef9ddd 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -487,6 +487,29 @@ struct MigrationState {
      */
     uint8_t clear_bitmap_shift;
 
+    /*
+     * This decides whether to use legacy switchover-ack or new switchover-ack.
+     * The main difference between them is that the former allows acknowledging
+     * switchover only once while the latter multiple times.
+     *
+     * In legacy, the destination keeps track of a pending ACKs counter. As
+     * migration progresses, the devices on the destination acknowledge
+     * switchover, decreasing the counter. When the counter reaches zero, a
+     * single ACK message is sent to the source via the return path, indicating
+     * that it's OK to switchover.
+     *
+     * In new switchover-ack, the source is the one that keeps track of a
+     * pending ACKs counter. As migration progresses, the destination sends ACK
+     * message per-device via the return path, which decrements the source
+     * counter. When the counter reaches zero, it's OK to switchover. During
+     * precopy, source-side devices may request additional ACKs, which increment
+     * the counter again.
+     *
+     * In both legacy and new schemes, we rely on per-device protocol to request
+     * switchover ACK from the destination-side counterpart.
+     */
+    bool switchover_ack_legacy;
+
     /*
      * This save hostname when out-going migration starts
      */
@@ -496,10 +519,13 @@ struct MigrationState {
     JSONWriter *vmdesc;
 
     /*
-     * Indicates whether an ACK from the destination that it's OK to do
-     * switchover has been received.
+     * Indicates the number of pending ACKs from the destination. The value may
+     * increase or decrease during precopy as new ACKs are requested or
+     * received. When zero is reached, it's OK to switchover. In legacy
+     * switchover-ack, it's initialized to 1 and decreased to zero upon ACK.
      */
-    bool switchover_acked;
+    uint32_t switchover_ack_pending_num;
+
     /* Is this a rdma migration */
     bool rdma_migration;
 
diff --git a/migration/savevm.h b/migration/savevm.h
index 44424be347494c51e6976749d7c60d27ca7f0628..fb92d3bc8586553c490eb03d68be3cb56c8d0554 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -45,8 +45,10 @@ int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy);
 void qemu_savevm_state_cleanup(void);
 void qemu_savevm_state_complete_postcopy(QEMUFile *f);
 int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
-void qemu_savevm_query_pending_iter(MigPendingData *pending, bool exact);
-void qemu_savevm_query_pending_final(MigPendingData *pending);
+void qemu_savevm_query_pending_iter(MigrationState *s, MigPendingData *pending,
+                                    bool exact);
+void qemu_savevm_query_pending_final(MigrationState *s,
+                                     MigPendingData *pending);
 int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
 bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
 void qemu_savevm_state_end(QEMUFile *f);
diff --git a/migration/migration.c b/migration/migration.c
index c88b4618017a18f0464b70c4cf0dcfc03b099a22..7da86fb08aa4d694155d87b8603aeecbd31e27c0 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1707,7 +1707,9 @@ int migrate_init(MigrationState *s, Error **errp)
     s->vm_old_state = -1;
     s->iteration_initial_bytes = 0;
     s->threshold_size = 0;
-    s->switchover_acked = false;
+    /* Legacy switchover-ack sends a single ACK for all devices */
+    qatomic_set(&s->switchover_ack_pending_num,
+                migrate_switchover_ack_legacy() ? 1 : 0);
     s->rdma_migration = false;
 
     /*
@@ -2201,7 +2203,7 @@ void migration_request_switchover_ack_legacy(const char *requester)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
 
-    if (!migrate_switchover_ack()) {
+    if (!migrate_switchover_ack() || !migrate_switchover_ack_legacy()) {
         return;
     }
 
@@ -2457,9 +2459,18 @@ static void *source_return_path_thread(void *opaque)
             break;
 
         case MIG_RP_MSG_SWITCHOVER_ACK:
-            ms->switchover_acked = true;
-            trace_source_return_path_thread_switchover_acked();
+        {
+            uint32_t pending_num;
+
+            pending_num = qatomic_dec_fetch(&ms->switchover_ack_pending_num);
+            trace_source_return_path_thread_switchover_acked(pending_num);
+            if (pending_num == UINT32_MAX) {
+                error_setg(&err, "Switchover ack pending num underflowed");
+                goto out;
+            }
+
             break;
+        }
 
         default:
             break;
@@ -2816,7 +2827,7 @@ static bool migration_switchover_start(MigrationState *s, Error **errp)
      * properly update all the dirty bitmaps to finally generate the
      * correct discard bitmaps; see ram_postcopy_send_discard_bitmap().
      */
-    qemu_savevm_query_pending_final(&pending);
+    qemu_savevm_query_pending_final(s, &pending);
 
     /* Inactivate disks except in COLO */
     if (!migrate_colo()) {
@@ -3266,7 +3277,7 @@ static bool migration_can_switchover(MigrationState *s)
         return true;
     }
 
-    return s->switchover_acked;
+    return qatomic_read(&s->switchover_ack_pending_num) == 0;
 }
 
 /* Migration thread iteration status */
@@ -3305,12 +3316,13 @@ static bool migration_iteration_next_ready(MigrationState *s,
     return false;
 }
 
-static void migration_iteration_go_next(MigPendingData *pending)
+static void migration_iteration_go_next(MigrationState *s,
+                                        MigPendingData *pending)
 {
     /*
      * Do a slow sync first before boosting the iteration count.
      */
-    qemu_savevm_query_pending_iter(pending, true);
+    qemu_savevm_query_pending_iter(s, pending, true);
 
     /*
      * Update the dirty information for the whole system for this
@@ -3356,12 +3368,12 @@ static MigIterateState migration_iteration_run(MigrationState *s)
     Error *local_err = NULL;
     bool in_postcopy = (s->state == MIGRATION_STATUS_POSTCOPY_DEVICE ||
                         s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE);
-    bool can_switchover = migration_can_switchover(s);
+    bool can_switchover;
     MigPendingData pending = { };
     bool complete_ready;
 
     /* Fast path - get the estimated amount of pending data */
-    qemu_savevm_query_pending_iter(&pending, false);
+    qemu_savevm_query_pending_iter(s, &pending, false);
 
     if (in_postcopy) {
         /*
@@ -3402,9 +3414,12 @@ static MigIterateState migration_iteration_run(MigrationState *s)
          * during postcopy phase.
          */
         if (migration_iteration_next_ready(s, &pending)) {
-            migration_iteration_go_next(&pending);
+            migration_iteration_go_next(s, &pending);
         }
 
+        /* Check can switchover after qemu_savevm_query_pending() */
+        can_switchover = migration_can_switchover(s);
+
         /* Should we switch to postcopy now? */
         if (can_switchover && postcopy_should_start(s, &pending)) {
             if (postcopy_start(s, &local_err)) {
diff --git a/migration/options.c b/migration/options.c
index 5cbfd29099ba69f8826cc57a0e9cb43ed68b3bf2..4c9b25372e03b55ee9127c027c5d4eefba796b06 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -110,6 +110,9 @@ const Property migration_properties[] = {
                      preempt_pre_7_2, false),
     DEFINE_PROP_BOOL("multifd-clean-tls-termination", MigrationState,
                      multifd_clean_tls_termination, true),
+    /* Use legacy until VFIO implements new switchover-ack */
+    DEFINE_PROP_BOOL("switchover-ack-legacy", MigrationState,
+                     switchover_ack_legacy, true),
 
     /* Migration parameters */
     DEFINE_PROP_UINT8("x-throttle-trigger-threshold", MigrationState,
@@ -467,6 +470,13 @@ bool migrate_rdma(void)
     return s->rdma_migration;
 }
 
+bool migrate_switchover_ack_legacy(void)
+{
+    MigrationState *s = migrate_get_current();
+
+    return s->switchover_ack_legacy;
+}
+
 typedef enum WriteTrackingSupport {
     WT_SUPPORT_UNKNOWN = 0,
     WT_SUPPORT_ABSENT,
diff --git a/migration/savevm.c b/migration/savevm.c
index 804c76e3bd93d6b4433df12d524a803491b0aa08..1f6e696c50d189370a311c25d8eb092bc41c2b24 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1801,7 +1801,8 @@ int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp)
     return 0;
 }
 
-static void qemu_savevm_query_pending(MigPendingData *pending, bool exact,
+static void qemu_savevm_query_pending(MigrationState *s,
+                                      MigPendingData *pending, bool exact,
                                       bool final)
 {
     SaveStateEntry *se;
@@ -1827,22 +1828,35 @@ static void qemu_savevm_query_pending(MigPendingData *pending, bool exact,
      * close to reality when this got invoked frequently while iterating.
      */
     mig_stats.dirty_bytes_total = pending->total_bytes;
-    trace_qemu_savevm_query_pending(exact, final, pending->precopy_bytes,
-                                    pending->stopcopy_bytes,
-                                    pending->postcopy_bytes,
-                                    pending->total_bytes);
+
+    if (migrate_switchover_ack() && !migrate_switchover_ack_legacy() &&
+        pending->switchover_ack_pending) {
+        /*
+         * NOTE: Currently we rely on per-device protocol to request switchover
+         * ACK from the device on the destination side.
+         */
+        qatomic_add(&s->switchover_ack_pending_num,
+                    pending->switchover_ack_pending);
+    }
+
+    trace_qemu_savevm_query_pending(
+        exact, final, pending->precopy_bytes, pending->stopcopy_bytes,
+        pending->postcopy_bytes, pending->total_bytes,
+        pending->switchover_ack_pending,
+        qatomic_read(&s->switchover_ack_pending_num));
 }
 
-void qemu_savevm_query_pending_iter(MigPendingData *pending, bool exact)
+void qemu_savevm_query_pending_iter(MigrationState *s, MigPendingData *pending,
+                                    bool exact)
 {
-    qemu_savevm_query_pending(pending, exact, false);
+    qemu_savevm_query_pending(s, pending, exact, false);
 }
 
-void qemu_savevm_query_pending_final(MigPendingData *pending)
+void qemu_savevm_query_pending_final(MigrationState *s, MigPendingData *pending)
 {
     g_assert(bql_locked());
 
-    qemu_savevm_query_pending(pending, true, true);
+    qemu_savevm_query_pending(s, pending, true, true);
 }
 
 void qemu_savevm_state_cleanup(void)
@@ -2487,7 +2501,7 @@ static int loadvm_switchover_ack_no_users_legacy(MigrationIncomingState *mis,
 {
     int ret;
 
-    if (!migrate_switchover_ack()) {
+    if (!migrate_switchover_ack() || !migrate_switchover_ack_legacy()) {
         return 0;
     }
 
@@ -3169,7 +3183,7 @@ int qemu_load_device_state(QEMUFile *f, Error **errp)
     return 0;
 }
 
-int qemu_loadvm_approve_switchover(const char *approver)
+static int qemu_loadvm_approve_switchover_legacy(const char *approver)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
 
@@ -3188,6 +3202,23 @@ int qemu_loadvm_approve_switchover(const char *approver)
     return migrate_send_rp_switchover_ack(mis);
 }
 
+int qemu_loadvm_approve_switchover(const char *approver)
+{
+    MigrationIncomingState *mis = migration_incoming_get_current();
+
+    if (!migrate_switchover_ack()) {
+        return 0;
+    }
+
+    if (migrate_switchover_ack_legacy()) {
+        return qemu_loadvm_approve_switchover_legacy(approver);
+    }
+
+    trace_loadvm_approve_switchover(approver);
+
+    return migrate_send_rp_switchover_ack(mis);
+}
+
 bool qemu_loadvm_load_state_buffer(const char *idstr, uint32_t instance_id,
                                    char *buf, size_t len, Error **errp)
 {
diff --git a/migration/trace-events b/migration/trace-events
index a6b8c31ee1d3eddc59798d7a9b97d2718814e1cb..f5339f4193d20d2a15abf713eeb2869df7149b4d 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -7,7 +7,7 @@ qemu_loadvm_state_section_partend(uint32_t section_id) "%u"
 qemu_loadvm_state_post_main(int ret) "%d"
 qemu_loadvm_state_section_startfull(uint32_t section_id, const char *idstr, uint32_t instance_id, uint32_t version_id) "%u(%s) %u %u"
 qemu_savevm_send_packaged(void) ""
-qemu_savevm_query_pending(bool exact, bool final, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total) "exact=%d, final=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64
+qemu_savevm_query_pending(bool exact, bool final, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total, uint32_t switchover_ack_pending, uint32_t total_switchover_ack_pending) "exact=%d, final=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64", collected switchover ack pending=%"PRIu32", total switchover ack pending=%"PRIu32
 loadvm_state_setup(void) ""
 loadvm_state_cleanup(void) ""
 loadvm_handle_cmd_packaged(unsigned int length) "%u"
@@ -24,6 +24,7 @@ loadvm_postcopy_ram_handle_discard_header(const char *ramid, uint16_t len) "%s:
 loadvm_process_command(const char *s, uint16_t len) "com=%s len=%d"
 loadvm_process_command_ping(uint32_t val) "0x%x"
 loadvm_approve_switchover_legacy(const char *approver, unsigned int switchover_ack_pending_num_legacy) "Approver %s, switchover_ack_pending_num_legacy %u"
+loadvm_approve_switchover(const char *approver) "Approver %s"
 postcopy_ram_listen_thread_exit(void) ""
 postcopy_ram_listen_thread_start(void) ""
 qemu_savevm_send_postcopy_advise(void) ""
@@ -189,7 +190,7 @@ source_return_path_thread_loop_top(void) ""
 source_return_path_thread_pong(uint32_t val) "0x%x"
 source_return_path_thread_shut(uint32_t val) "0x%x"
 source_return_path_thread_resume_ack(uint32_t v) "%"PRIu32
-source_return_path_thread_switchover_acked(void) ""
+source_return_path_thread_switchover_acked(uint32_t pending_num) "switchover_ack_pending_num %" PRIu32
 source_return_path_thread_postcopy_package_loaded(void) ""
 migration_thread_low_pending(uint64_t pending) "%" PRIu64
 migrate_transferred(uint64_t transferred, uint64_t time_spent, uint64_t bandwidth, uint64_t avail_bw, uint64_t size) "transferred %" PRIu64 " time_spent %" PRIu64 " bandwidth %" PRIu64 " switchover_bw %" PRIu64 " max_size %" PRId64
-- 
2.54.0

[PULL 13/23] migration: Fail migration if switchover-ack is requested after switchover decision

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

Switchover ACK is checked only during precopy while the guest is still
running. The last migration_can_switchover() decision and guest stop are
not atomic, so a device may want to request another switchover ACK in
the gap after switchover decision has been made but before the guest is
stopped. Migration would then miss that request, which can increase
downtime.

Cover this case by failing the migration if a switchover-ack was
requested during that time.

Ideally, precopy iterations should be resumed in this case, however,
VFIO doesn't support going back to precopy after being stopped, so
implementing such logic would require non-trivial changes to the guest
start/stop flow. Given the above and that this case should be rare,
failing the migration seems reasonable.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-9-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 migration/savevm.h    |  4 ++--
 migration/migration.c |  4 +++-
 migration/savevm.c    | 19 ++++++++++++++++++-
 3 files changed, 23 insertions(+), 4 deletions(-)

diff --git a/migration/savevm.h b/migration/savevm.h
index fb92d3bc8586553c490eb03d68be3cb56c8d0554..415198423f578049c209a1e40b796cfe63b410f0 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -47,8 +47,8 @@ void qemu_savevm_state_complete_postcopy(QEMUFile *f);
 int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
 void qemu_savevm_query_pending_iter(MigrationState *s, MigPendingData *pending,
                                     bool exact);
-void qemu_savevm_query_pending_final(MigrationState *s,
-                                     MigPendingData *pending);
+bool qemu_savevm_query_pending_final(MigrationState *s,
+                                     MigPendingData *pending, Error **errp);
 int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
 bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
 void qemu_savevm_state_end(QEMUFile *f);
diff --git a/migration/migration.c b/migration/migration.c
index 7da86fb08aa4d694155d87b8603aeecbd31e27c0..898695a81920b7b255c7ed17b13a9065d66d8c44 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2827,7 +2827,9 @@ static bool migration_switchover_start(MigrationState *s, Error **errp)
      * properly update all the dirty bitmaps to finally generate the
      * correct discard bitmaps; see ram_postcopy_send_discard_bitmap().
      */
-    qemu_savevm_query_pending_final(s, &pending);
+    if (!qemu_savevm_query_pending_final(s, &pending, errp)) {
+        return false;
+    }
 
     /* Inactivate disks except in COLO */
     if (!migrate_colo()) {
diff --git a/migration/savevm.c b/migration/savevm.c
index 1f6e696c50d189370a311c25d8eb092bc41c2b24..f654a1c563df40d546e42018a3706e92fb11cfa7 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1852,11 +1852,28 @@ void qemu_savevm_query_pending_iter(MigrationState *s, MigPendingData *pending,
     qemu_savevm_query_pending(s, pending, exact, false);
 }
 
-void qemu_savevm_query_pending_final(MigrationState *s, MigPendingData *pending)
+bool qemu_savevm_query_pending_final(MigrationState *s, MigPendingData *pending,
+                                     Error **errp)
 {
     g_assert(bql_locked());
 
     qemu_savevm_query_pending(s, pending, true, true);
+
+    /*
+     * Switchover-ack requests done after switchover decision are not allowed.
+     * Fail the migration in this case since we currently don't support going
+     * back to precopy.
+     */
+    if (migrate_switchover_ack() && !migrate_switchover_ack_legacy() &&
+        pending->switchover_ack_pending > 0) {
+        error_setg(errp,
+                   "Switchover ACK was requested by %" PRIu32
+                   " devices during switchover",
+                   pending->switchover_ack_pending);
+        return false;
+    }
+
+    return true;
 }
 
 void qemu_savevm_state_cleanup(void)
-- 
2.54.0

[PULL 14/23] vfio/migration: Extract VFIO_MIG_FLAG_DEV_INIT_DATA_SENT sending to helper

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

Extract the VFIO_MIG_FLAG_DEV_INIT_DATA_SENT flag sending logic from
vfio_save_iterate() into vfio_send_init_data_flag() for clarity. Also
add a trace while at it.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-10-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c  | 26 +++++++++++++++++++++-----
 hw/vfio/trace-events |  1 +
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 6b7acb2fa19d3ee618e73365ca995bbdb4676055..45f8e346b4a69a798366d460eccf028f35e7a47f 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -480,6 +480,26 @@ static void vfio_update_estimated_pending_data(VFIOMigration *migration,
                                          data_size);
 }
 
+/* Returns true if the init data flag was sent, false otherwise */
+static bool vfio_send_init_data_flag(QEMUFile *f, VFIOMigration *migration)
+{
+    VFIODevice *vbasedev = migration->vbasedev;
+
+    if (!migrate_switchover_ack()) {
+        return false;
+    }
+
+    if (migration->precopy_init_size || migration->initial_data_sent) {
+        return false;
+    }
+
+    qemu_put_be64(f, VFIO_MIG_FLAG_DEV_INIT_DATA_SENT);
+    migration->initial_data_sent = true;
+    trace_vfio_send_init_data_flag(vbasedev->name);
+
+    return true;
+}
+
 static bool vfio_precopy_supported(VFIODevice *vbasedev)
 {
     VFIOMigration *migration = vbasedev->migration;
@@ -693,11 +713,7 @@ static int vfio_save_iterate(QEMUFile *f, void *opaque)
 
     vfio_update_estimated_pending_data(migration, data_size);
 
-    if (migrate_switchover_ack() && !migration->precopy_init_size &&
-        !migration->initial_data_sent) {
-        qemu_put_be64(f, VFIO_MIG_FLAG_DEV_INIT_DATA_SENT);
-        migration->initial_data_sent = true;
-    } else {
+    if (!vfio_send_init_data_flag(f, migration)) {
         qemu_put_be64(f, VFIO_MIG_FLAG_END_OF_STATE);
     }
 
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index fa2204f002970c31eb987ae13113a9a5edb3e172..fe0d2cc06f946b3f0db28d13994fbd0dfd854fbd 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -177,6 +177,7 @@ vfio_save_iterate(const char *name, uint64_t precopy_init_size, uint64_t precopy
 vfio_save_iterate_start(const char *name) " (%s)"
 vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer size %"PRIu64
 vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool exact, bool final) " (%s) stopcopy size %"PRIu64", precopy initial size %"PRIu64", precopy dirty size %"PRIu64", exact %d, final %d"
+vfio_send_init_data_flag(const char *name) " (%s)"
 vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
 vfio_vmstate_change_prepare(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
 
-- 
2.54.0

[PULL 15/23] vfio/migration: Add Error ** parameter to vfio_migration_init()

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

vfio_migration_init() already has many failure points and a new one will
be added in next patch.

Add Error ** parameter to vfio_migration_init() to report a detailed
error message through it. Refactor it to return bool as well.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-11-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 45f8e346b4a69a798366d460eccf028f35e7a47f..3ab6b7248fea34dec3b58e508f97c8be4c962ce4 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -1056,7 +1056,7 @@ static bool vfio_dma_logging_supported(VFIODevice *vbasedev)
     return !ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature);
 }
 
-static int vfio_migration_init(VFIODevice *vbasedev)
+static bool vfio_migration_init(VFIODevice *vbasedev, Error **errp)
 {
     int ret;
     Object *obj;
@@ -1067,22 +1067,32 @@ static int vfio_migration_init(VFIODevice *vbasedev)
     VMChangeStateHandler *prepare_cb;
 
     if (!vbasedev->ops->vfio_get_object) {
-        return -EINVAL;
+        error_setg(errp, "no vfio_get_object handler");
+        return false;
     }
 
     obj = vbasedev->ops->vfio_get_object(vbasedev);
     if (!obj) {
-        return -EINVAL;
+        error_setg(errp, "failed to get object");
+        return false;
     }
 
     ret = vfio_migration_query_flags(vbasedev, &mig_flags);
     if (ret) {
-        return ret;
+        if (ret == -ENOTTY) {
+            error_setg_errno(errp, -ret,
+                             "migration is not supported in kernel");
+        } else {
+            error_setg_errno(errp, -ret, "failed to query migration flags");
+        }
+
+        return false;
     }
 
     /* Basic migration functionality must be supported */
     if (!(mig_flags & VFIO_MIGRATION_STOP_COPY)) {
-        return -EOPNOTSUPP;
+        error_setg(errp, "VFIO_MIGRATION_STOP_COPY is not supported");
+        return false;
     }
 
     vbasedev->migration = g_new0(VFIOMigration, 1);
@@ -1113,7 +1123,7 @@ static int vfio_migration_init(VFIODevice *vbasedev)
     migration_add_notifier(&migration->migration_state,
                            vfio_migration_state_notifier);
 
-    return 0;
+    return true;
 }
 
 static Error *multiple_devices_migration_blocker;
@@ -1279,18 +1289,8 @@ bool vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
         return !vfio_block_migration(vbasedev, err, errp);
     }
 
-    ret = vfio_migration_init(vbasedev);
-    if (ret) {
-        if (ret == -ENOTTY) {
-            error_setg(&err, "%s: VFIO migration is not supported in kernel",
-                       vbasedev->name);
-        } else {
-            error_setg(&err,
-                       "%s: Migration couldn't be initialized for VFIO device, "
-                       "err: %d (%s)",
-                       vbasedev->name, ret, strerror(-ret));
-        }
-
+    if (!vfio_migration_init(vbasedev, &err)) {
+        error_prepend(&err, "%s: VFIO migration init failed: ", vbasedev->name);
         return !vfio_block_migration(vbasedev, err, errp);
     }
 
-- 
2.54.0

[PULL 16/23] vfio/migration: Add new switchover-ack mechanism

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

Add support for the new switchover-ack mechanism. This includes
requesting a switchover ACK on the first save_query_pending call (with
exact=false) if VFIO precopy is supported.

This achieves the same functionality of legacy switchover-ack but with
the new switchover-ack mechanism.

Keep legacy switchover-ack functionality for backward compatibility.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-12-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/vfio-migration-internal.h |  1 +
 hw/vfio/migration.c               | 13 ++++++++++++-
 hw/vfio/trace-events              |  2 +-
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/vfio-migration-internal.h b/hw/vfio/vfio-migration-internal.h
index a15fc74703998da1956a92c4fb8cfe9ff3a68867..dc741e51421eec6d4ad4d9ce0f9c0c2f6199788d 100644
--- a/hw/vfio/vfio-migration-internal.h
+++ b/hw/vfio/vfio-migration-internal.h
@@ -58,6 +58,7 @@ typedef struct VFIOMigration {
     bool multifd_transfer;
     VFIOMultifd *multifd;
     bool initial_data_sent;
+    bool request_switchover_ack;
 
     bool event_save_iterate_started;
     bool event_precopy_empty_hit;
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 3ab6b7248fea34dec3b58e508f97c8be4c962ce4..ebe2eafded50cdc3c1518a2f1e768fdfe6722c5a 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -582,6 +582,9 @@ static int vfio_save_setup(QEMUFile *f, void *opaque, Error **errp)
             }
 
             vfio_query_precopy_size(migration);
+            if (migrate_switchover_ack() && !migrate_switchover_ack_legacy()) {
+                migration->request_switchover_ack = true;
+            }
 
             break;
         case VFIO_DEVICE_STATE_STOP:
@@ -634,6 +637,7 @@ static void vfio_save_cleanup(void *opaque)
     migration->precopy_init_size = 0;
     migration->precopy_dirty_size = 0;
     migration->initial_data_sent = false;
+    migration->request_switchover_ack = false;
     vfio_migration_cleanup(vbasedev);
     trace_vfio_save_cleanup(vbasedev->name);
 }
@@ -655,6 +659,7 @@ static void vfio_state_pending(void *opaque, MigPendingData *pending,
     VFIODevice *vbasedev = opaque;
     VFIOMigration *migration = vbasedev->migration;
     uint64_t precopy_size, stopcopy_size;
+    bool request_switchover_ack = false;
 
     /*
      * The final pending query runs during switchover downtime. VFIO does not
@@ -676,10 +681,16 @@ static void vfio_state_pending(void *opaque, MigPendingData *pending,
 
     pending->precopy_bytes += precopy_size;
     pending->stopcopy_bytes += stopcopy_size;
+    if (migration->request_switchover_ack) {
+        pending->switchover_ack_pending++;
+        request_switchover_ack = true;
+        migration->request_switchover_ack = false;
+    }
 
     trace_vfio_state_pending(vbasedev->name, migration->stopcopy_size,
                              migration->precopy_init_size,
-                             migration->precopy_dirty_size, exact, final);
+                             migration->precopy_dirty_size,
+                             request_switchover_ack, exact, final);
 }
 
 static bool vfio_is_active_iterate(void *opaque)
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index fe0d2cc06f946b3f0db28d13994fbd0dfd854fbd..c9d143826d38d77048ecf179cbda19a7184989a4 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -176,7 +176,7 @@ vfio_save_device_config_state(const char *name) " (%s)"
 vfio_save_iterate(const char *name, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy initial size %"PRIu64" precopy dirty size %"PRIu64
 vfio_save_iterate_start(const char *name) " (%s)"
 vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer size %"PRIu64
-vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool exact, bool final) " (%s) stopcopy size %"PRIu64", precopy initial size %"PRIu64", precopy dirty size %"PRIu64", exact %d, final %d"
+vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool request_switchover_ack, bool exact, bool final) " (%s) stopcopy size %"PRIu64", precopy initial size %"PRIu64", precopy dirty size %"PRIu64", request switchover ack %d, exact %d, final %d"
 vfio_send_init_data_flag(const char *name) " (%s)"
 vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
 vfio_vmstate_change_prepare(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
-- 
2.54.0

[PULL 17/23] vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

According to VFIO uAPI, precopy initial_bytes is considered as critical
data that should be transferred and loaded prior to moving to STOP_COPY
state to ensure precopy phase would be effective.

As currently defined, initial_bytes can only decrease as it's being read
from the data fd. However, there are cases where a new chunk of
initial_bytes should be transferred during precopy.

The new VFIO_PRECOPY_INFO_REINIT feature addresses this and allows
reporting a new value for initial_bytes regardless of any previously
reported values.

Implement VFIO_PRECOPY_INFO_REINIT feature:
1. Opt-in for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 to make
   VFIO_PRECOPY_INFO_REINIT available.
2. Request a new switchover ACK if initial_bytes increases post of a
   previous switchover ACK. This ensures the device is not moved to
   STOP_COPY before initial_bytes has reached zero again.

Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-13-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/devel/migration/vfio.rst     | 14 +++++++
 hw/vfio/vfio-migration-internal.h |  1 +
 hw/vfio/migration.c               | 68 ++++++++++++++++++++++++++++---
 hw/vfio/trace-events              |  4 +-
 4 files changed, 80 insertions(+), 7 deletions(-)

diff --git a/docs/devel/migration/vfio.rst b/docs/devel/migration/vfio.rst
index 854277b11ce64672f998ce1728bf8b5ddf1c129a..f235c2d4f9d1bae5aa8bdcc2701340780d558f89 100644
--- a/docs/devel/migration/vfio.rst
+++ b/docs/devel/migration/vfio.rst
@@ -23,6 +23,20 @@ and recommends that the initial bytes are sent and loaded in the destination
 before stopping the source VM. Enabling this migration capability will
 guarantee that and thus, can potentially reduce downtime even further.
 
+For example, in mlx5 devices, the initial bytes hold metadata used for time
+consuming pre-allocations of resources on the destination. Although init bytes
+may be small in size and sending them may take little time, loading them in the
+destination can take a significant amount of time. Switchover-ack guarantees
+that this pre-allocation doesn't happen during downtime.
+
+Initial bytes was originally defined to be monotonically decreasing, however
+there are cases where a new chunk of initial bytes should be transferred during
+precopy, e.g., due to a device reconfiguration, etc. The
+VFIO_PRECOPY_INFO_REINIT feature addresses this and when supported, allows to
+report a new initial bytes value regardless of any previously reported values.
+In this case, a new switchover ACK will be requested to make sure the new
+initial bytes are loaded in the destination before switching over.
+
 To support migration of multiple devices that might do P2P transactions between
 themselves, VFIO migration uAPI defines an intermediate P2P quiescent state.
 While in the P2P quiescent state, P2P DMA transactions cannot be initiated by
diff --git a/hw/vfio/vfio-migration-internal.h b/hw/vfio/vfio-migration-internal.h
index dc741e51421eec6d4ad4d9ce0f9c0c2f6199788d..a1c58b112685d868c6f942d6225b553d44bb6613 100644
--- a/hw/vfio/vfio-migration-internal.h
+++ b/hw/vfio/vfio-migration-internal.h
@@ -45,6 +45,7 @@ typedef struct VFIOMigration {
     void *data_buffer;
     size_t data_buffer_size;
     uint64_t mig_flags;
+    bool precopy_info_v2_used;
     /*
      * NOTE: all three sizes cached are reported from VFIO's uAPI, which
      * are defined as estimate only.  QEMU should not trust these values
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index ebe2eafded50cdc3c1518a2f1e768fdfe6722c5a..1e172dd10bfc3561741aa90bf1e237cd6847eb63 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -373,9 +373,11 @@ static int vfio_query_stop_copy_size(VFIODevice *vbasedev)
 
 static int vfio_query_precopy_size(VFIOMigration *migration)
 {
+    VFIODevice *vbasedev = migration->vbasedev;
     struct vfio_precopy_info precopy = {
         .argsz = sizeof(precopy),
     };
+    bool reinit = false;
     int ret = 0;
 
     if (ioctl(migration->data_fd, VFIO_MIG_GET_PRECOPY_INFO, &precopy)) {
@@ -383,25 +385,43 @@ static int vfio_query_precopy_size(VFIOMigration *migration)
         migration->precopy_dirty_size = 0;
         ret = -errno;
         warn_report_once("VFIO device %s ioctl(VFIO_MIG_GET_PRECOPY_INFO) "
-                         "failed (%d)", migration->vbasedev->name, ret);
+                         "failed (%d)", vbasedev->name, ret);
     } else {
         bool overflow;
 
         migration->precopy_init_size = precopy.initial_bytes;
         migration->precopy_dirty_size = precopy.dirty_bytes;
+        /*
+         * struct vfio_precopy_info.flags is valid only if
+         * VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 is used.
+         */
+         if (migration->precopy_info_v2_used) {
+            reinit = precopy.flags & VFIO_PRECOPY_INFO_REINIT;
+        }
 
-        overflow  = vfio_migration_check_overflow(migration->vbasedev,
+        overflow  = vfio_migration_check_overflow(vbasedev,
                          migration->precopy_init_size,  "precopy init size");
-        overflow |= vfio_migration_check_overflow(migration->vbasedev,
+        overflow |= vfio_migration_check_overflow(vbasedev,
                          migration->precopy_dirty_size, "precopy dirty size");
         if (overflow) {
             ret = -ERANGE;
         }
     }
 
-    trace_vfio_query_precopy_size(migration->vbasedev->name,
-                                  migration->precopy_init_size,
-                                  migration->precopy_dirty_size, ret);
+    trace_vfio_query_precopy_size(vbasedev->name, migration->precopy_init_size,
+                                  migration->precopy_dirty_size, reinit, ret);
+
+    /*
+     * If we got new initial_bytes after previous initial_bytes were
+     * transferred, request a new switchover ACK. Don't request if legacy
+     * switchover-ack is used.
+     */
+    if (reinit && migration->initial_data_sent &&
+        !migrate_switchover_ack_legacy()) {
+        migration->initial_data_sent = false;
+        migration->request_switchover_ack = true;
+        trace_vfio_query_precopy_size_request_switchover_ack(vbasedev->name);
+    }
 
     return ret;
 }
@@ -1054,6 +1074,27 @@ static int vfio_migration_query_flags(VFIODevice *vbasedev, uint64_t *mig_flags)
     return 0;
 }
 
+/* Returns 1 on success, 0 if not supported and negative errno on failure */
+static int vfio_migration_set_precopy_info_v2(VFIODevice *vbasedev)
+{
+    uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature),
+                              sizeof(uint64_t))] = {};
+    struct vfio_device_feature *feature = (struct vfio_device_feature *)buf;
+
+    feature->argsz = sizeof(buf);
+    feature->flags =
+        VFIO_DEVICE_FEATURE_SET | VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2;
+    if (ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature)) {
+        if (errno == ENOTTY) {
+            return 0;
+        }
+
+        return -errno;
+    }
+
+    return 1;
+}
+
 static bool vfio_dma_logging_supported(VFIODevice *vbasedev)
 {
     uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature),
@@ -1075,6 +1116,7 @@ static bool vfio_migration_init(VFIODevice *vbasedev, Error **errp)
     char id[256] = "";
     g_autofree char *path = NULL, *oid = NULL;
     uint64_t mig_flags = 0;
+    bool precopy_info_v2_used = false;
     VMChangeStateHandler *prepare_cb;
 
     if (!vbasedev->ops->vfio_get_object) {
@@ -1106,12 +1148,22 @@ static bool vfio_migration_init(VFIODevice *vbasedev, Error **errp)
         return false;
     }
 
+    if (mig_flags & VFIO_MIGRATION_PRE_COPY) {
+        ret = vfio_migration_set_precopy_info_v2(vbasedev);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret, "failed to set precopy info v2");
+            return false;
+        }
+        precopy_info_v2_used = ret;
+    }
+
     vbasedev->migration = g_new0(VFIOMigration, 1);
     migration = vbasedev->migration;
     migration->vbasedev = vbasedev;
     migration->device_state = VFIO_DEVICE_STATE_RUNNING;
     migration->data_fd = -1;
     migration->mig_flags = mig_flags;
+    migration->precopy_info_v2_used = precopy_info_v2_used;
 
     vbasedev->dirty_pages_supported = vfio_dma_logging_supported(vbasedev);
 
@@ -1134,6 +1186,10 @@ static bool vfio_migration_init(VFIODevice *vbasedev, Error **errp)
     migration_add_notifier(&migration->migration_state,
                            vfio_migration_state_notifier);
 
+    trace_vfio_migration_init(vbasedev->name, migration->mig_flags,
+                              migration->precopy_info_v2_used,
+                              vbasedev->dirty_pages_supported);
+
     return true;
 }
 
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index c9d143826d38d77048ecf179cbda19a7184989a4..f71d0bbc0a5440e4ccd374fac4733af08438e7be 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -159,11 +159,13 @@ vfio_load_state_device_buffer_starved(const char *name, uint32_t idx) " (%s) idx
 vfio_load_state_device_buffer_load_start(const char *name, uint32_t idx) " (%s) idx %"PRIu32
 vfio_load_state_device_buffer_load_end(const char *name, uint32_t idx) " (%s) idx %"PRIu32
 vfio_load_state_device_buffer_end(const char *name) " (%s)"
+vfio_migration_init(const char *name, uint64_t mig_flags, bool precopy_info_v2_used, bool dirty_pages_supported) " (%s) mig_flags 0x%"PRIx64", precopy_info_v2_used %d, dirty_pages_supported %d"
 vfio_migration_realize(const char *name) " (%s)"
 vfio_migration_set_device_state(const char *name, const char *state) " (%s) state %s"
 vfio_migration_set_state(const char *name, const char *new_state, const char *recover_state) " (%s) new state %s, recover state %s"
 vfio_migration_state_notifier(const char *name, int state) " (%s) state %d"
-vfio_query_precopy_size(const char *name, uint64_t init_size, uint64_t dirty_size, int ret) " (%s) init %"PRIu64" dirty %"PRIu64" ret %d"
+vfio_query_precopy_size(const char *name, uint64_t init_size, uint64_t dirty_size, bool reinit, int ret) " (%s) init %"PRIu64", dirty %"PRIu64", reinit %d, ret %d"
+vfio_query_precopy_size_request_switchover_ack(const char *name) " (%s)"
 vfio_query_stop_copy_size(const char *name, uint64_t size, int ret) " (%s) stopcopy size %"PRIu64" ret %d"
 vfio_save_block(const char *name, int data_size) " (%s) data_size %d"
 vfio_save_block_precopy_empty_hit(const char *name) " (%s)"
-- 
2.54.0

[PULL 18/23] vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during switchover

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

VFIO_REPCOPY_INFO_REINIT is checked only during precopy, before the
switchover decision. However, the switchover decision and guest stop are
not atomic, so a VFIO device may want to set VFIO_PRECOPY_INFO_REINIT
and request another switchover ACK in the gap after switchover decision
has been made but before the guest is stopped. This would be missed and
may increase downtime.

Solve this by checking if VFIO_PRECOPY_INFO_REINIT was set during that
gap, and request a new switchover-ack in the final save_state_pending
call. Query precopy info after vCPUs are stopped but before
transitioning from PRE_COPY state, when its valid to call the ioctl.

Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-14-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/migration.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 1e172dd10bfc3561741aa90bf1e237cd6847eb63..73c49d8c24f21803de7c8615da63abecfd76b882 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -685,6 +685,9 @@ static void vfio_state_pending(void *opaque, MigPendingData *pending,
      * The final pending query runs during switchover downtime. VFIO does not
      * need a fresh device pending-data query then to get the latest dirty
      * data, so avoid the extra work and report the cached counters below.
+     * On the other hand, precopy sync is needed to check if switchover ACK was
+     * requested, but that's already done during guest stop when device is in
+     * PRE_COPY state.
      */
     if (exact && !final) {
         vfio_state_pending_sync(vbasedev);
@@ -964,6 +967,26 @@ static const SaveVMHandlers savevm_vfio_handlers = {
 
 /* ---------------------------------------------------------------------- */
 
+static void vfio_final_precopy_reinit_check(VFIODevice *vbasedev)
+{
+    VFIOMigration *migration = vbasedev->migration;
+    int ret;
+
+    if (!migration->precopy_info_v2_used || !migrate_switchover_ack() ||
+        migrate_switchover_ack_legacy()) {
+        return;
+    }
+
+    ret = vfio_query_precopy_size(migration);
+    if (ret) {
+        error_report("%s: Final precopy reinit check failed (err: %d)",
+                     vbasedev->name, ret);
+        /* If query failed, assume reinit and request switchover-ack */
+        migration->request_switchover_ack = true;
+        migration->initial_data_sent = false;
+    }
+}
+
 static void vfio_vmstate_change_prepare(void *opaque, bool running,
                                         RunState state)
 {
@@ -977,6 +1000,15 @@ static void vfio_vmstate_change_prepare(void *opaque, bool running,
                     VFIO_DEVICE_STATE_PRE_COPY_P2P :
                     VFIO_DEVICE_STATE_RUNNING_P2P;
 
+    if (migration->device_state == VFIO_DEVICE_STATE_PRE_COPY) {
+        /*
+         * Now that vCPUs are stopped, check if new init_bytes are available
+         * since switchover decision, to be reported in the final
+         * save_query_pending.
+         */
+        vfio_final_precopy_reinit_check(vbasedev);
+    }
+
     ret = vfio_migration_set_state_or_reset(vbasedev, new_state, &local_err);
     if (ret) {
         /*
-- 
2.54.0

[PULL 19/23] migration: Enable new switchover-ack

[Cédric Le Goater]

From: Avihai Horon <avihaih@nvidia.com>

Now that VFIO has implemented new switchover-ack, enable it for new
machines and keep legacy behavior for old machines.

Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-15-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/core/machine.c   | 1 +
 migration/options.c | 3 +--
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 5b97df6db962476ed6fea5444d29e6cbaa810feb..15886a56b194239efba3db54e961b612c70dbaa1 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -48,6 +48,7 @@ GlobalProperty hw_compat_11_0[] = {
     { TYPE_ARM_SMMUV3, "ril", "on" },
     { TYPE_ARM_SMMUV3, "ssidsize", "0" },
     { TYPE_ARM_SMMUV3, "oas", "44" },
+    { "migration", "switchover-ack-legacy", "on" },
 };
 const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0);
 
diff --git a/migration/options.c b/migration/options.c
index 4c9b25372e03b55ee9127c027c5d4eefba796b06..dfce19405d4583894c2d22578a8e1d32da613d54 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -110,9 +110,8 @@ const Property migration_properties[] = {
                      preempt_pre_7_2, false),
     DEFINE_PROP_BOOL("multifd-clean-tls-termination", MigrationState,
                      multifd_clean_tls_termination, true),
-    /* Use legacy until VFIO implements new switchover-ack */
     DEFINE_PROP_BOOL("switchover-ack-legacy", MigrationState,
-                     switchover_ack_legacy, true),
+                     switchover_ack_legacy, false),
 
     /* Migration parameters */
     DEFINE_PROP_UINT8("x-throttle-trigger-threshold", MigrationState,
-- 
2.54.0

[PULL 20/23] iommufd: Introduce handler for device ATS support

[Cédric Le Goater]

From: Nathan Chen <nathanc@nvidia.com>

Introduce a support_ats() handler that returns whether ATS is supported
for a device associated with a host IOMMU device, checking if the
IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED capability bit is set.

Implement this handler in a new function for iommufd.

Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260623204943.989903-2-nathanc@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/system/host_iommu_device.h | 9 +++++++++
 backends/iommufd.c                 | 8 ++++++++
 2 files changed, 17 insertions(+)

diff --git a/include/system/host_iommu_device.h b/include/system/host_iommu_device.h
index f0003015832855b7173475559ef411bee31d1c86..2cb53653406ceec30906120ffbfd263a3d0810e8 100644
--- a/include/system/host_iommu_device.h
+++ b/include/system/host_iommu_device.h
@@ -133,6 +133,15 @@ struct HostIOMMUDeviceClass {
      * Returns: true on success, false on failure.
      */
     bool (*get_pasid_info)(HostIOMMUDevice *hiod, PasidInfo *pasid_info);
+    /**
+     *  @support_ats: Returns true if ATS can be used by the device,
+     *  false if the host IOMMU reports it is unavailable.
+     *
+     *  @hiod: handle to the host IOMMU device
+     *
+     *  Returns: true if ATS is supported, false otherwise
+     */
+    bool (*support_ats)(HostIOMMUDevice *hiod);
 };
 
 /*
diff --git a/backends/iommufd.c b/backends/iommufd.c
index 09624cd6526b4027b82b02dad3e6494231fedc2c..4b40aaebe6cbb9d27b0d0b15f093a79fac9ed3b3 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -638,6 +638,13 @@ static int hiod_iommufd_get_cap(HostIOMMUDevice *hiod, int cap, Error **errp)
     }
 }
 
+static bool hiod_iommufd_support_ats(HostIOMMUDevice *hiod)
+{
+    HostIOMMUDeviceCaps *caps = &hiod->caps;
+
+    return !(caps->hw_caps & IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED);
+}
+
 static bool hiod_iommufd_get_pasid_info(HostIOMMUDevice *hiod,
                                         PasidInfo *pasid_info)
 {
@@ -660,6 +667,7 @@ static void hiod_iommufd_class_init(ObjectClass *oc, const void *data)
 
     hiodc->get_cap = hiod_iommufd_get_cap;
     hiodc->get_pasid_info = hiod_iommufd_get_pasid_info;
+    hiodc->support_ats = hiod_iommufd_support_ats;
 };
 
 static const TypeInfo types[] = {
-- 
2.54.0

[PULL 21/23] vfio/pci: Add ats property

[Cédric Le Goater]

From: Nathan Chen <nathanc@nvidia.com>

Add an "ats" OnOffAuto property to vfio-pci. When the device has an ATS
extended capability in config space but we should not expose it (ats=off,
or ats=auto and kernel reports IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED), mask
the capability so the guest does not see it.

If ATS is explicitly requested but not supported by the kernel, fail
device realize.

This aligns with the kernel's per-device effective ATS reporting and allows
vfio-pci to mask ATS when the host kernel reports ATS as unsupported.

Emit a warning when ats=on is requested but the physical device does not
advertise ATS, since ATS cannot be exposed to the guest in this case.

Emit a warning when ats=auto, ats cap is present on the physical device,
but kernel reports ATS as unsupported.

Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260623204943.989903-3-nathanc@nvidia.com
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.h |  1 +
 hw/vfio/pci.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++---
 2 files changed, 85 insertions(+), 4 deletions(-)

diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index cf56711587058b8cf5197945755fff2456168c00..fe52e9df6e67707c9899d418b0261afeedf4aab2 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -188,6 +188,7 @@ struct VFIOPCIDevice {
     bool clear_parent_atomics_on_exit;
     bool skip_vsc_check;
     uint16_t vpasid_cap_offset;
+    OnOffAuto ats;
     VFIODisplay *dpy;
     Notifier irqchip_change_notifier;
     VFIOPCICPR cpr;
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 6b04c6f94f9ade765e236d457e4828ac6199680a..c7f163399f8fbcc4ff70819a0d67879eb26980f9 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2548,10 +2548,53 @@ static bool vfio_pci_synthesize_pasid_cap(VFIOPCIDevice *vdev, Error **errp)
     return true;
 }
 
-static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
+/*
+ * Determine whether ATS capability should be advertised for @vdev, based on
+ * whether it was enabled on the command line and whether it is supported
+ * according to the kernel.
+ *
+ * Store whether ATS capability should be advertised in @ats_needed.
+ *
+ * Returns false only when ats=on is explicitly requested but the kernel
+ * reports it is not supported. Returns true in all other cases.
+ */
+static bool vfio_pci_ats_requested_and_supported(VFIOPCIDevice *vdev,
+                                                 bool *ats_needed, Error **errp)
+{
+    HostIOMMUDevice *hiod = vdev->vbasedev.hiod;
+    HostIOMMUDeviceClass *hiodc;
+    bool ats_supported;
+    *ats_needed = false;
+
+    if (vdev->ats == ON_OFF_AUTO_OFF) {
+        return true;
+    }
+
+    *ats_needed = true;
+    if (!hiod) {
+        return true;
+    }
+    hiodc = HOST_IOMMU_DEVICE_GET_CLASS(hiod);
+    if (!hiodc || !hiodc->support_ats) {
+        return true;
+    }
+
+    ats_supported = hiodc->support_ats(hiod);
+    if (vdev->ats == ON_OFF_AUTO_ON && !ats_supported) {
+        error_setg(errp, "vfio-pci: ATS requested but not supported by kernel");
+        *ats_needed = false;
+        return false;
+    }
+
+    *ats_needed = ats_supported;
+    return true;
+}
+
+static void vfio_add_ext_cap(VFIOPCIDevice *vdev, bool ats_needed)
 {
     PCIDevice *pdev = PCI_DEVICE(vdev);
     bool pasid_cap_added = false;
+    bool ats_cap_present = false;
     Error *err = NULL;
     uint32_t header;
     uint16_t cap_id, next, size;
@@ -2637,7 +2680,19 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
          */
         case PCI_EXT_CAP_ID_PASID:
             pasid_cap_added = true;
-            /* fallthrough */
+            pcie_add_capability(pdev, cap_id, cap_ver, next, size);
+            break;
+        case PCI_EXT_CAP_ID_ATS:
+            ats_cap_present = true;
+            /*
+             * If ATS is requested and supported according to the kernel, add
+             * the ATS capability. If not supported according to the kernel or
+             * disabled on the qemu command line, omit the ATS cap.
+             */
+            if (ats_needed) {
+                pcie_add_capability(pdev, cap_id, cap_ver, next, size);
+            }
+            break;
         default:
             pcie_add_capability(pdev, cap_id, cap_ver, next, size);
         }
@@ -2648,6 +2703,16 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
         error_report_err(err);
     }
 
+    if (vdev->ats == ON_OFF_AUTO_ON && !ats_cap_present) {
+        warn_report("vfio-pci: ats=on requested, but host device has no "
+                    "ATS extended capability");
+    }
+
+    if (vdev->ats == ON_OFF_AUTO_AUTO && ats_cap_present && !ats_needed) {
+        warn_report("vfio-pci: host kernel reports ATS unsupported; "
+                    "ATS capability will be masked");
+    }
+
     /* Cleanup chain head ID if necessary */
     if (pci_get_word(pdev->config + PCI_CONFIG_SPACE_SIZE) == 0xFFFF) {
         pci_set_word(pdev->config + PCI_CONFIG_SPACE_SIZE, 0);
@@ -2659,6 +2724,7 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
 bool vfio_pci_add_capabilities(VFIOPCIDevice *vdev, Error **errp)
 {
     PCIDevice *pdev = PCI_DEVICE(vdev);
+    bool ats_needed = false;
 
     if (!(pdev->config[PCI_STATUS] & PCI_STATUS_CAP_LIST) ||
         !pdev->config[PCI_CAPABILITY_LIST]) {
@@ -2669,7 +2735,11 @@ bool vfio_pci_add_capabilities(VFIOPCIDevice *vdev, Error **errp)
         return false;
     }
 
-    vfio_add_ext_cap(vdev);
+    if (!vfio_pci_ats_requested_and_supported(vdev, &ats_needed, errp)) {
+        return false;
+    }
+
+    vfio_add_ext_cap(vdev, ats_needed);
     return true;
 }
 
@@ -3819,6 +3889,7 @@ static const Property vfio_pci_properties[] = {
     DEFINE_PROP_BOOL("skip-vsc-check", VFIOPCIDevice, skip_vsc_check, true),
     DEFINE_PROP_UINT16("x-vpasid-cap-offset", VFIOPCIDevice,
                        vpasid_cap_offset, 0),
+    DEFINE_PROP_ON_OFF_AUTO("ats", VFIOPCIDevice, ats, ON_OFF_AUTO_AUTO),
 };
 
 static void vfio_pci_set_fd(Object *obj, const char *str, Error **errp)
@@ -3970,13 +4041,22 @@ static void vfio_pci_class_init(ObjectClass *klass, const void *data)
                                           "destination when doing live "
                                           "migration of device state via "
                                           "multifd channels");
-   object_class_property_set_description(klass, /* 11.0 */
+    object_class_property_set_description(klass, /* 11.0 */
                                           "x-vpasid-cap-offset",
                                           "PCIe extended configuration space offset at which to place a "
                                           "synthetic PASID extended capability when PASID is enabled via "
                                           "a vIOMMU. A value of 0 (default) places the capability at the "
                                           "end of the extended configuration space. The offset must be "
                                           "4-byte aligned and within the PCIe extended configuration space");
+    object_class_property_set_description(klass, /* 11.1 */
+                                          "ats",
+                                          "Control guest visibility of the ATS PCIe extended capability. "
+                                          "Valid values are on, off, and auto (default). "
+                                          "'off' always masks ATS. "
+                                          "'on' requires ATS support for the device and fails realize if the "
+                                          "host kernel reports ATS as unavailable for this device. "
+                                          "'auto' masks ATS only when the host kernel reports "
+                                          "ATS as unavailable");
 }
 
 static const TypeInfo vfio_pci_info = {
-- 
2.54.0

[PULL 22/23] vfio/pci: Propagate errors in vfio_pci_load_rom() using Error API

[Cédric Le Goater]

From: Mario Casquero <mcasquer@redhat.com>

Updates vfio_pci_load_rom() to use Error API for error propagation
instead of error_report(), improving error handling consistency.

Signed-off-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Link: https://lore.kernel.org/qemu-devel/20260625094307.148542-1-mcasquer@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index c7f163399f8fbcc4ff70819a0d67879eb26980f9..e6d1adfd3655ce3c1baf8977c82223d23af9b770 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -1028,7 +1028,7 @@ static void vfio_update_msi(VFIOPCIDevice *vdev)
     }
 }
 
-static bool vfio_pci_load_rom(VFIOPCIDevice *vdev)
+static bool vfio_pci_load_rom(VFIOPCIDevice *vdev, Error **errp)
 {
     VFIODevice *vbasedev = &vdev->vbasedev;
     struct vfio_region_info *reg_info = NULL;
@@ -1041,7 +1041,7 @@ static bool vfio_pci_load_rom(VFIOPCIDevice *vdev)
                                       &reg_info);
 
     if (ret != 0) {
-        error_report("vfio: Error getting ROM info: %s", strerror(-ret));
+        error_setg_errno(errp, -ret, "vfio: Error getting ROM info");
         return false;
     }
 
@@ -1053,10 +1053,13 @@ static bool vfio_pci_load_rom(VFIOPCIDevice *vdev)
     vdev->rom_offset = reg_info->offset;
 
     if (!vdev->rom_size) {
-        error_report("vfio-pci: Cannot read device rom at %s", vbasedev->name);
-        error_printf("Device option ROM contents are probably invalid "
-                    "(check dmesg).\nSkip option ROM probe with rombar=0, "
-                    "or load from file with romfile=\n");
+        vdev->rom_size = 0;
+        vdev->rom_offset = 0;
+        error_setg(errp, "vfio-pci: Device ROM size is zero at %s",
+                   vbasedev->name);
+        error_append_hint(errp, "Device option ROM contents are probably "
+                          "invalid (check dmesg).\nSkip option ROM probe "
+                          "with rombar=0, or load from file with romfile=\n");
         return false;
     }
 
@@ -1077,10 +1080,12 @@ static bool vfio_pci_load_rom(VFIOPCIDevice *vdev)
             if (bytes == -EINTR || bytes == -EAGAIN) {
                 continue;
             }
-            error_report("vfio: Error reading device ROM: %s",
-                         strreaderror(bytes));
-
-            break;
+            error_setg_errno(errp, -bytes, "vfio: Error reading device ROM");
+            g_free(vdev->rom);
+            vdev->rom = NULL;
+            vdev->rom_size = 0;
+            vdev->rom_offset = 0;
+            return false;
         }
     }
 
@@ -1148,7 +1153,12 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
 
     /* Load the ROM lazily when the guest tries to read it */
     if (unlikely(!vdev->rom && !vdev->rom_read_failed)) {
-        vdev->rom_read_failed = !vfio_pci_load_rom(vdev);
+        Error *local_err = NULL;
+
+        vdev->rom_read_failed = !vfio_pci_load_rom(vdev, &local_err);
+        if (vdev->rom_read_failed) {
+            error_report_err(local_err);
+        }
     }
 
     memcpy(&val, vdev->rom + addr,
-- 
2.54.0

[PULL 23/23] vfio/listener: Fix translated_addr for non-identity-mapped RAM sections

[Cédric Le Goater]

In vfio_listener_region_del(), when dirty tracking is active and a
writable RAM section is deleted, a synthetic IOMMUTLBEntry is built to
flush dirty pages. Setting translated_addr to the IOVA (GPA) is only
correct for identity-mapped regions where GPA == ram_addr_t.

For RAM sections with GPA far above main RAM (e.g., nested VT-d interrupt
remapping table at 58 TB), translated_addr is too large, causing a crash
in physical_memory_set_dirty_lebitmap() when indexing beyond the allocated
dirty memory blocks array :

  bitmap_set_atomic(map=NULL, start=1, nr=1)
  physical_memory_set_dirty_range(start=0x380004040000, length=4096)
  physical_memory_set_dirty_lebitmap(start=0x380004040000, pages=3)
  vfio_container_query_dirty_bitmap(translated_addr=0x380004040000)
  vfio_legacy_dma_unmap_one(iova=0x380004040000, size=12288)
  vfio_listener_region_del()

Fix this by setting translated_addr to the ram_addr_t of the section, which
is consistent with other vfio dirty tracking code:

  translated_addr = memory_region_get_ram_addr(section->mr) +
                    section->offset_within_region;

Cc: Zhenzhong Duan <zhenzhong.duan@intel.com>
Fixes: 6e360c06176c ("vfio/listener: Add missing dirty tracking in region_del")
Link: https://lore.kernel.org/qemu-devel/20260625134352.3122572-1-clg@redhat.com
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Tested-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/listener.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 109b5d61af4a09cf22f0ebbb9f3fc4ca87295b38..c19600e980a8d02217b5d9df4aca8f879ab2c5d5 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -731,7 +731,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
         }
 
         /*
-         * Fake an IOTLB entry for writable identity mapping which is needed
+         * Fake an IOTLB entry for writable RAM sections which is needed
          * by dirty tracking when switch out of PT domain. In fact, in
          * unmap_bitmap, only translated_addr field is used to set dirty
          * bitmap.
@@ -746,7 +746,8 @@ static void vfio_listener_region_del(MemoryListener *listener,
         if (global_dirty_tracking && memory_region_is_ram(section->mr) &&
             !section->readonly) {
             entry.iova = iova;
-            entry.translated_addr = iova;
+            entry.translated_addr = memory_region_get_ram_addr(section->mr) +
+                                    section->offset_within_region;
             iotlb = &entry;
         }
 
-- 
2.54.0

Re: [PULL 00/23] vfio queue

[Stefan Hajnoczi]

On Tue, Jun 30, 2026 at 6:33 AM Cédric Le Goater <clg@redhat.com> wrote:
>
> The following changes since commit 30e8a06b64aa58a3990ba39cb5d09531e7d265e0:
>
>   Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2026-06-29 17:41:42 +0200)
>
> are available in the Git repository at:
>
>   https://github.com/legoater/qemu/ tags/pull-vfio-20260630
>
> for you to fetch changes up to afe79bb7bf7fe16f418d6e10522946e13da04384:
>
>   vfio/listener: Fix translated_addr for non-identity-mapped RAM sections (2026-06-30 05:35:56 +0200)

Hi Cedric,
This pull request breaks the migration test in the
ubuntu-24.04-s390x-all-system CI job:
https://gitlab.com/qemu-project/qemu/-/jobs/15157007316#L3078

>>> RUST_BACKTRACE=1 PYTHON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/pyvenv/bin/python3 QTEST_QEMU_IMG=./qemu-img MESON_TEST_ITERATION=1 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 QTEST_QEMU_VNC_BINARY=./tools/qemu-vnc/qemu-vnc MALLOC_PERTURB_=226 MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 G_TEST_DBUS_DAEMON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/tests/dbus-daemon.sh QTEST_QEMU_BINARY=./qemu-system-s390x ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 QTEST_QEMU_STORAGE_DAEMON_BINARY=./storage-daemon/qemu-storage-daemon /home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/tests/qtest/migration-test --tap -k --full
――――――――――――――――――――――――――――――――――――― ✀ ―――――――――――――――――――――――――――――――――――――
stderr:
Memory content inconsistency at 48b7000 first_byte = b5 last_byte = b4
current = b5 hit_edge = 1
Memory content inconsistency at 48b8000 first_byte = b5 last_byte = b4
current = b5 hit_edge = 1
Memory content inconsistency at 48b9000 first_byte = b5 last_byte = b4
current = b5 hit_edge = 1
Memory content inconsistency at 48ba000 first_byte = b5 last_byte = b4
current = b5 hit_edge = 1
Memory content inconsistency at 48bb000 first_byte = b5 last_byte = b4
current = b5 hit_edge = 1
Memory content inconsistency at 48bc000 first_byte = b5 last_byte = b4
current = b5 hit_edge = 1
Memory content inconsistency at 48bd000 first_byte = b5 last_byte = b4
current = b5 hit_edge = 1
Memory content inconsistency at 48be000 first_byte = b5 last_byte = b4
current = b5 hit_edge = 1
Memory content inconsistency at 48bf000 first_byte = b5 last_byte = b4
current = b5 hit_edge = 1
Memory content inconsistency at 48c0000 first_byte = b5 last_byte = b4
current = b5 hit_edge = 1
and in another 6975 pages**
ERROR:../tests/qtest/migration/framework.c:190:check_guests_ram:
assertion failed: (bad == 0)
(test program exited with status code -6)

Please take a look and resend the pull request with a fix.

Thanks,
Stefan

>
> ----------------------------------------------------------------
> vfio queue:
>
> * Fixes ROM read issues in vfio/pci: information leak, error
>   propagation, and uninitialized state
> * Validates VERSION replies in vfio-user and updates the spec
>   for DMA access mode bits
> * Merges .dma_map_file() into .dma_map() in the iommufd backend
> * Reworks switchover-ack to be re-usable and implements the
>   VFIO_PRECOPY_INFO_REINIT feature for additional pre-copy
>   iterations before switchover
> * Adds ATS support for passthrough devices via iommufd
> * Fixes translated_addr for non-identity-mapped RAM sections in
>   the VFIO listener
>
> ----------------------------------------------------------------
> Avihai Horon (14):
>       migration: Propagate errors in migration_completion_precopy()
>       migration/ram: Use migration_bitmap_sync_precopy() for postcopy discard
>       migration: Run final save_query_pending at switchover
>       migration: Log the approver in qemu_loadvm_approve_switchover()
>       migration: Replace switchover_ack_needed SaveVMHandler
>       migration: Rename switchover-ack code to legacy
>       migration: Make switchover-ack re-usable
>       migration: Fail migration if switchover-ack is requested after switchover decision
>       vfio/migration: Extract VFIO_MIG_FLAG_DEV_INIT_DATA_SENT sending to helper
>       vfio/migration: Add Error ** parameter to vfio_migration_init()
>       vfio/migration: Add new switchover-ack mechanism
>       vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature
>       vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during switchover
>       migration: Enable new switchover-ack
>
> Cédric Le Goater (3):
>       vfio/pci: Fix information leak in vfio_rom_read()
>       vfio/iommufd: Merge .dma_map_file() into .dma_map()
>       vfio/listener: Fix translated_addr for non-identity-mapped RAM sections
>
> GuoHan Zhao (1):
>       vfio-user: validate VERSION replies
>
> Mario Casquero (2):
>       vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom()
>       vfio/pci: Propagate errors in vfio_pci_load_rom() using Error API
>
> Mattias Nissler (1):
>       docs: Update vfio-user spec to describe DMA access mode bits
>
> Nathan Chen (2):
>       iommufd: Introduce handler for device ATS support
>       vfio/pci: Add ats property
>
>  docs/devel/migration/vfio.rst      |  17 +++-
>  docs/interop/vfio-user.rst         |  82 +++++++++------
>  qapi/migration.json                |  14 ++-
>  hw/vfio/pci.h                      |   1 +
>  hw/vfio/vfio-migration-internal.h  |   2 +
>  include/hw/vfio/vfio-container.h   |  15 ---
>  include/migration/client-options.h |   1 +
>  include/migration/misc.h           |   2 +
>  include/migration/register.h       |  56 +++++-----
>  include/system/host_iommu_device.h |   9 ++
>  migration/migration.h              |  34 ++++++-
>  migration/savevm.h                 |   9 +-
>  backends/iommufd.c                 |   8 ++
>  hw/core/machine.c                  |   1 +
>  hw/s390x/s390-stattrib.c           |   2 +-
>  hw/vfio-user/proxy.c               |  21 ++--
>  hw/vfio/container.c                |  38 -------
>  hw/vfio/iommufd.c                  |  50 ++++++---
>  hw/vfio/listener.c                 |   5 +-
>  hw/vfio/migration.c                | 204 +++++++++++++++++++++++++++++--------
>  hw/vfio/pci.c                      | 129 +++++++++++++++++++----
>  migration/block-dirty-bitmap.c     |  11 +-
>  migration/migration.c              |  73 ++++++++++---
>  migration/options.c                |   9 ++
>  migration/ram.c                    |  40 ++++----
>  migration/savevm.c                 | 173 +++++++++++++++++++++----------
>  hw/vfio/trace-events               |   7 +-
>  migration/trace-events             |   9 +-
>  28 files changed, 709 insertions(+), 313 deletions(-)
>
>

Re: [PULL 17/23] vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature

[Philippe Mathieu-Daudé]

On 30/6/26 06:31, Cédric Le Goater wrote:
> From: Avihai Horon <avihaih@nvidia.com>
> 
> According to VFIO uAPI, precopy initial_bytes is considered as critical
> data that should be transferred and loaded prior to moving to STOP_COPY
> state to ensure precopy phase would be effective.
> 
> As currently defined, initial_bytes can only decrease as it's being read
> from the data fd. However, there are cases where a new chunk of
> initial_bytes should be transferred during precopy.
> 
> The new VFIO_PRECOPY_INFO_REINIT feature addresses this and allows
> reporting a new value for initial_bytes regardless of any previously
> reported values.
> 
> Implement VFIO_PRECOPY_INFO_REINIT feature:
> 1. Opt-in for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 to make
>     VFIO_PRECOPY_INFO_REINIT available.
> 2. Request a new switchover ACK if initial_bytes increases post of a
>     previous switchover ACK. This ensures the device is not moved to
>     STOP_COPY before initial_bytes has reached zero again.
> 
> Acked-by: Peter Xu <peterx@redhat.com>
> Signed-off-by: Avihai Horon <avihaih@nvidia.com>
> Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-13-avihaih@nvidia.com
> Signed-off-by: Cédric Le Goater <clg@redhat.com>
> ---
>   docs/devel/migration/vfio.rst     | 14 +++++++
>   hw/vfio/vfio-migration-internal.h |  1 +
>   hw/vfio/migration.c               | 68 ++++++++++++++++++++++++++++---
>   hw/vfio/trace-events              |  4 +-
>   4 files changed, 80 insertions(+), 7 deletions(-)


> +/* Returns 1 on success, 0 if not supported and negative errno on failure */
> +static int vfio_migration_set_precopy_info_v2(VFIODevice *vbasedev)
> +{
> +    uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature),
> +                              sizeof(uint64_t))] = {};

What is the point of using uint64_t[] here?

> +    struct vfio_device_feature *feature = (struct vfio_device_feature *)buf;
> +
> +    feature->argsz = sizeof(buf);
> +    feature->flags =
> +        VFIO_DEVICE_FEATURE_SET | VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2;
> +    if (ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature)) {
> +        if (errno == ENOTTY) {
> +            return 0;
> +        }
> +
> +        return -errno;
> +    }
> +
> +    return 1;
> +}

Re: [PULL 00/23] vfio queue

[Cédric Le Goater]

On 7/2/26 21:24, Stefan Hajnoczi wrote:
> On Tue, Jun 30, 2026 at 6:33 AM Cédric Le Goater <clg@redhat.com> wrote:
>>
>> The following changes since commit 30e8a06b64aa58a3990ba39cb5d09531e7d265e0:
>>
>>    Merge tag 'net-pull-request' of https://github.com/jasowang/qemu into staging (2026-06-29 17:41:42 +0200)
>>
>> are available in the Git repository at:
>>
>>    https://github.com/legoater/qemu/ tags/pull-vfio-20260630
>>
>> for you to fetch changes up to afe79bb7bf7fe16f418d6e10522946e13da04384:
>>
>>    vfio/listener: Fix translated_addr for non-identity-mapped RAM sections (2026-06-30 05:35:56 +0200)
> 
> Hi Cedric,
> This pull request breaks the migration test in the
> ubuntu-24.04-s390x-all-system CI job:
> https://gitlab.com/qemu-project/qemu/-/jobs/15157007316#L3078

Oh. Sorry about that. I didn't see that when I ran CI.

Thanks,

C.


> 
>>>> RUST_BACKTRACE=1 PYTHON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/pyvenv/bin/python3 QTEST_QEMU_IMG=./qemu-img MESON_TEST_ITERATION=1 UBSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 QTEST_QEMU_VNC_BINARY=./tools/qemu-vnc/qemu-vnc MALLOC_PERTURB_=226 MSAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1:print_stacktrace=1 G_TEST_DBUS_DAEMON=/home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/tests/dbus-daemon.sh QTEST_QEMU_BINARY=./qemu-system-s390x ASAN_OPTIONS=halt_on_error=1:abort_on_error=1:print_summary=1 QTEST_QEMU_STORAGE_DAEMON_BINARY=./storage-daemon/qemu-storage-daemon /home/gitlab-runner/builds/P3MFS4LUf/0/qemu-project/qemu/build/tests/qtest/migration-test --tap -k --full
> ――――――――――――――――――――――――――――――――――――― ✀ ―――――――――――――――――――――――――――――――――――――
> stderr:
> Memory content inconsistency at 48b7000 first_byte = b5 last_byte = b4
> current = b5 hit_edge = 1
> Memory content inconsistency at 48b8000 first_byte = b5 last_byte = b4
> current = b5 hit_edge = 1
> Memory content inconsistency at 48b9000 first_byte = b5 last_byte = b4
> current = b5 hit_edge = 1
> Memory content inconsistency at 48ba000 first_byte = b5 last_byte = b4
> current = b5 hit_edge = 1
> Memory content inconsistency at 48bb000 first_byte = b5 last_byte = b4
> current = b5 hit_edge = 1
> Memory content inconsistency at 48bc000 first_byte = b5 last_byte = b4
> current = b5 hit_edge = 1
> Memory content inconsistency at 48bd000 first_byte = b5 last_byte = b4
> current = b5 hit_edge = 1
> Memory content inconsistency at 48be000 first_byte = b5 last_byte = b4
> current = b5 hit_edge = 1
> Memory content inconsistency at 48bf000 first_byte = b5 last_byte = b4
> current = b5 hit_edge = 1
> Memory content inconsistency at 48c0000 first_byte = b5 last_byte = b4
> current = b5 hit_edge = 1
> and in another 6975 pages**
> ERROR:../tests/qtest/migration/framework.c:190:check_guests_ram:
> assertion failed: (bad == 0)
> (test program exited with status code -6)
> 
> Please take a look and resend the pull request with a fix.
> 
> Thanks,
> Stefan
> 
>>
>> ----------------------------------------------------------------
>> vfio queue:
>>
>> * Fixes ROM read issues in vfio/pci: information leak, error
>>    propagation, and uninitialized state
>> * Validates VERSION replies in vfio-user and updates the spec
>>    for DMA access mode bits
>> * Merges .dma_map_file() into .dma_map() in the iommufd backend
>> * Reworks switchover-ack to be re-usable and implements the
>>    VFIO_PRECOPY_INFO_REINIT feature for additional pre-copy
>>    iterations before switchover
>> * Adds ATS support for passthrough devices via iommufd
>> * Fixes translated_addr for non-identity-mapped RAM sections in
>>    the VFIO listener
>>
>> ----------------------------------------------------------------
>> Avihai Horon (14):
>>        migration: Propagate errors in migration_completion_precopy()
>>        migration/ram: Use migration_bitmap_sync_precopy() for postcopy discard
>>        migration: Run final save_query_pending at switchover
>>        migration: Log the approver in qemu_loadvm_approve_switchover()
>>        migration: Replace switchover_ack_needed SaveVMHandler
>>        migration: Rename switchover-ack code to legacy
>>        migration: Make switchover-ack re-usable
>>        migration: Fail migration if switchover-ack is requested after switchover decision
>>        vfio/migration: Extract VFIO_MIG_FLAG_DEV_INIT_DATA_SENT sending to helper
>>        vfio/migration: Add Error ** parameter to vfio_migration_init()
>>        vfio/migration: Add new switchover-ack mechanism
>>        vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature
>>        vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during switchover
>>        migration: Enable new switchover-ack
>>
>> Cédric Le Goater (3):
>>        vfio/pci: Fix information leak in vfio_rom_read()
>>        vfio/iommufd: Merge .dma_map_file() into .dma_map()
>>        vfio/listener: Fix translated_addr for non-identity-mapped RAM sections
>>
>> GuoHan Zhao (1):
>>        vfio-user: validate VERSION replies
>>
>> Mario Casquero (2):
>>        vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom()
>>        vfio/pci: Propagate errors in vfio_pci_load_rom() using Error API
>>
>> Mattias Nissler (1):
>>        docs: Update vfio-user spec to describe DMA access mode bits
>>
>> Nathan Chen (2):
>>        iommufd: Introduce handler for device ATS support
>>        vfio/pci: Add ats property
>>
>>   docs/devel/migration/vfio.rst      |  17 +++-
>>   docs/interop/vfio-user.rst         |  82 +++++++++------
>>   qapi/migration.json                |  14 ++-
>>   hw/vfio/pci.h                      |   1 +
>>   hw/vfio/vfio-migration-internal.h  |   2 +
>>   include/hw/vfio/vfio-container.h   |  15 ---
>>   include/migration/client-options.h |   1 +
>>   include/migration/misc.h           |   2 +
>>   include/migration/register.h       |  56 +++++-----
>>   include/system/host_iommu_device.h |   9 ++
>>   migration/migration.h              |  34 ++++++-
>>   migration/savevm.h                 |   9 +-
>>   backends/iommufd.c                 |   8 ++
>>   hw/core/machine.c                  |   1 +
>>   hw/s390x/s390-stattrib.c           |   2 +-
>>   hw/vfio-user/proxy.c               |  21 ++--
>>   hw/vfio/container.c                |  38 -------
>>   hw/vfio/iommufd.c                  |  50 ++++++---
>>   hw/vfio/listener.c                 |   5 +-
>>   hw/vfio/migration.c                | 204 +++++++++++++++++++++++++++++--------
>>   hw/vfio/pci.c                      | 129 +++++++++++++++++++----
>>   migration/block-dirty-bitmap.c     |  11 +-
>>   migration/migration.c              |  73 ++++++++++---
>>   migration/options.c                |   9 ++
>>   migration/ram.c                    |  40 ++++----
>>   migration/savevm.c                 | 173 +++++++++++++++++++++----------
>>   hw/vfio/trace-events               |   7 +-
>>   migration/trace-events             |   9 +-
>>   28 files changed, 709 insertions(+), 313 deletions(-)
>>
>>
> 

Re: [PULL 08/23] migration: Run final save_query_pending at switchover

[Avihai Horon]

On 6/30/2026 7:30 AM, Cédric Le Goater wrote:
> External email: Use caution opening links or attachments
>
>
> From: Avihai Horon <avihaih@nvidia.com>
>
> Before switchover, the source needs one last exact pending query so
> modules can flush dirty state. This is currently done ad hoc in modules
> handlers. For example, RAM syncs its dirty bitmap in its save_complete
> handler.
>
> This should be a general concept relevant for any module, so extract it
> to migration core instead by running a final save_query_pending before
> switchover.
>
> The final query requires special handling by modules (e.g., it's called
> with BQL locked, during VM stop), so extend save_query_pending
> SaveVMHandlers callback and qemu_savevm_query_pending() with a "final"
> flag so migration modules can tell the last pending query during
> switchover from periodic iteration queries.
>
> Reviewed-by: Peter Xu <peterx@redhat.com>
> Signed-off-by: Avihai Horon <avihaih@nvidia.com>
> Reviewed-by: Jason J. Herne <jjhern@linux.ibm.com>
> Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-4-avihaih@nvidia.com
> Signed-off-by: Cédric Le Goater <clg@redhat.com>
> ---
>   include/migration/register.h   | 41 ++++++++++++++++++----------------
>   migration/savevm.h             |  3 ++-
>   hw/s390x/s390-stattrib.c       |  2 +-
>   hw/vfio/migration.c            | 11 ++++++---
>   migration/block-dirty-bitmap.c | 11 ++++++---
>   migration/migration.c          | 14 ++++++++++--
>   migration/ram.c                | 40 +++++++++++++++++++--------------
>   migration/savevm.c             | 20 +++++++++++++----
>   hw/vfio/trace-events           |  2 +-
>   migration/trace-events         |  2 +-
>   10 files changed, 94 insertions(+), 52 deletions(-)
>
> diff --git a/include/migration/register.h b/include/migration/register.h
> index 5e5e0ee432e537781ce78e84b2ff2d81c33e8f37..6f632123f1d0710de0556e68ba53e068a1e02640 100644
> --- a/include/migration/register.h
> +++ b/include/migration/register.h
> @@ -171,6 +171,28 @@ typedef struct SaveVMHandlers {
>        */
>       bool (*is_active_iterate)(void *opaque);
>
> +    /**
> +     * @save_query_pending
> +     *
> +     * This estimates the remaining data to transfer on the source side.
> +     *
> +     * When @exact is true, a module must report accurate results.  When
> +     * @exact is false, a module may report estimates.
> +     *
> +     * It's highly recommended that modules implement a faster version of
> +     * the query path (for example, by proper caching on the counters) if
> +     * an accurate query will be time-consuming.
> +     *
> +     * @opaque: data pointer passed to register_savevm_live()
> +     * @pending: pointer to a MigPendingData struct
> +     * @exact: set to true for an accurate (slow) query
> +     * @final: set to true for the final query during switchover. When final is
> +     * true, the query is called with BQL locked. Otherwise, it's called with
> +     * BQL unlocked.
> +     */
> +    void (*save_query_pending)(void *opaque, MigPendingData *pending,
> +                               bool exact, bool final);
> +
>       /* This runs outside the BQL in the migration case, and
>        * within the lock in the savevm case.  The callback had better only
>        * use data that is local to the migration thread or protected
> @@ -210,25 +232,6 @@ typedef struct SaveVMHandlers {
>        */
>       bool (*save_postcopy_prepare)(QEMUFile *f, void *opaque, Error **errp);
>
> -    /**
> -     * @save_query_pending
> -     *
> -     * This estimates the remaining data to transfer on the source side.
> -     *
> -     * When @exact is true, a module must report accurate results.  When
> -     * @exact is false, a module may report estimates.
> -     *
> -     * It's highly recommended that modules implement a faster version of
> -     * the query path (for example, by proper caching on the counters) if
> -     * an accurate query will be time-consuming.
> -     *
> -     * @opaque: data pointer passed to register_savevm_live()
> -     * @pending: pointer to a MigPendingData struct
> -     * @exact: set to true for an accurate (slow) query
> -     */
> -    void (*save_query_pending)(void *opaque, MigPendingData *pending,
> -                               bool exact);
> -
>       /**
>        * @load_state
>        *
> diff --git a/migration/savevm.h b/migration/savevm.h
> index b6bb4fa977fae84ed121b0668cdefdf49e3d9c67..81abd96dda94c6c95cc40b3c188df23d11c19463 100644
> --- a/migration/savevm.h
> +++ b/migration/savevm.h
> @@ -45,7 +45,8 @@ int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy);
>   void qemu_savevm_state_cleanup(void);
>   void qemu_savevm_state_complete_postcopy(QEMUFile *f);
>   int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
> -void qemu_savevm_query_pending(MigPendingData *pending, bool exact);
> +void qemu_savevm_query_pending_iter(MigPendingData *pending, bool exact);
> +void qemu_savevm_query_pending_final(MigPendingData *pending);
>   int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
>   bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
>   void qemu_savevm_state_end(QEMUFile *f);
> diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c
> index c334714b31ab4313e26c0cf57091a8cb21e55306..b0f04eb30c7f73e5dd91b1345d71a14cb404a4eb 100644
> --- a/hw/s390x/s390-stattrib.c
> +++ b/hw/s390x/s390-stattrib.c
> @@ -190,7 +190,7 @@ static int cmma_save_setup(QEMUFile *f, void *opaque, Error **errp)
>   }
>
>   static void cmma_state_pending(void *opaque, MigPendingData *pending,
> -                               bool exact)
> +                               bool exact, bool final)
>   {
>       S390StAttribState *sas = S390_STATTRIB(opaque);
>       S390StAttribClass *sac = S390_STATTRIB_GET_CLASS(sas);
> diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
> index fb12b9717f773fdde657911517de9d74c1eb3931..195498845ed95d6a55cf68537a100b4e83221fb0 100644
> --- a/hw/vfio/migration.c
> +++ b/hw/vfio/migration.c
> @@ -622,13 +622,18 @@ static void vfio_state_pending_sync(VFIODevice *vbasedev)
>   }
>
>   static void vfio_state_pending(void *opaque, MigPendingData *pending,
> -                               bool exact)
> +                               bool exact, bool final)
>   {
>       VFIODevice *vbasedev = opaque;
>       VFIOMigration *migration = vbasedev->migration;
>       uint64_t precopy_size, stopcopy_size;
>
> -    if (exact) {
> +    /*
> +     * The final pending query runs during switchover downtime. VFIO does not
> +     * need a fresh device pending-data query then to get the latest dirty
> +     * data, so avoid the extra work and report the cached counters below.
> +     */
> +    if (exact && !final) {
>           vfio_state_pending_sync(vbasedev);
>       }
>
> @@ -646,7 +651,7 @@ static void vfio_state_pending(void *opaque, MigPendingData *pending,
>
>       trace_vfio_state_pending(vbasedev->name, migration->stopcopy_size,
>                                migration->precopy_init_size,
> -                             migration->precopy_dirty_size, exact);
> +                             migration->precopy_dirty_size, exact, final);
>   }
>
>   static bool vfio_is_active_iterate(void *opaque)
> diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
> index 7ef3759e5348a6907c0fb3773e2c6cbb0850632e..cba54e25cd50da924e1958bdfc23ce060784b0ac 100644
> --- a/migration/block-dirty-bitmap.c
> +++ b/migration/block-dirty-bitmap.c
> @@ -767,13 +767,16 @@ static int dirty_bitmap_save_complete(QEMUFile *f, void *opaque)
>   }
>
>   static void dirty_bitmap_state_pending(void *opaque, MigPendingData *data,
> -                                       bool exact)
> +                                       bool exact, bool final)
>   {
>       DBMSaveState *s = &((DBMState *)opaque)->save;
>       SaveBitmapState *dbms;
>       uint64_t pending = 0;
>
> -    bql_lock();
> +    /* Final pending query is called with BQL locked */
> +    if (!final) {
> +        bql_lock();
> +    }
>
>       QSIMPLEQ_FOREACH(dbms, &s->dbms_list, entry) {
>           uint64_t gran = bdrv_dirty_bitmap_granularity(dbms->bitmap);
> @@ -783,7 +786,9 @@ static void dirty_bitmap_state_pending(void *opaque, MigPendingData *data,
>           pending += DIV_ROUND_UP(sectors * BDRV_SECTOR_SIZE, gran);
>       }
>
> -    bql_unlock();
> +    if (!final) {
> +        bql_unlock();
> +    }
>
>       trace_dirty_bitmap_state_pending(pending);
>
> diff --git a/migration/migration.c b/migration/migration.c
> index 0f9e891cf85c8e5074f7f9800515e244fa413fa2..ea0b236597087cc005541e1916ceabb229afab4b 100644
> --- a/migration/migration.c
> +++ b/migration/migration.c
> @@ -2787,12 +2787,22 @@ static bool migration_switchover_prepare(MigrationState *s)
>   static bool migration_switchover_start(MigrationState *s, Error **errp)
>   {
>       ERRP_GUARD();
> +    MigPendingData pending = {};
>
>       if (!migration_switchover_prepare(s)) {
>           error_setg(errp, "Switchover is interrupted");
>           return false;
>       }
>
> +    /*
> +     * The final query to the whole system on dirty data to make sure we
> +     * collect the latest status of the VM.  For precopy, source QEMU will
> +     * dump all the dirty data during switchover.  For postcopy, this will
> +     * properly update all the dirty bitmaps to finally generate the
> +     * correct discard bitmaps; see ram_postcopy_send_discard_bitmap().
> +     */
> +    qemu_savevm_query_pending_final(&pending);
> +
>       /* Inactivate disks except in COLO */
>       if (!migrate_colo()) {
>           /*
> @@ -3285,7 +3295,7 @@ static void migration_iteration_go_next(MigPendingData *pending)
>       /*
>        * Do a slow sync first before boosting the iteration count.
>        */
> -    qemu_savevm_query_pending(pending, true);
> +    qemu_savevm_query_pending_iter(pending, true);
>
>       /*
>        * Update the dirty information for the whole system for this
> @@ -3336,7 +3346,7 @@ static MigIterateState migration_iteration_run(MigrationState *s)
>       bool complete_ready;
>
>       /* Fast path - get the estimated amount of pending data */
> -    qemu_savevm_query_pending(&pending, false);
> +    qemu_savevm_query_pending_iter(&pending, false);
>
>       if (in_postcopy) {
>           /*
> diff --git a/migration/ram.c b/migration/ram.c
> index 55aa9b47dc8ab8463fd1aeba19726a493b81b070..8918b2f03b6fbcc98532bb45ab905f9bac59384c 100644
> --- a/migration/ram.c
> +++ b/migration/ram.c
> @@ -2686,9 +2686,6 @@ void ram_postcopy_send_discard_bitmap(MigrationState *ms)
>
>       RCU_READ_LOCK_GUARD();
>
> -    /* This should be our last sync, the src is now paused */
> -    migration_bitmap_sync_precopy(true);
> -
>       /* Easiest way to make sure we don't resume in the middle of a host-page */
>       rs->pss[RAM_CHANNEL_PRECOPY].last_sent_block = NULL;
>       rs->last_seen_block = NULL;
> @@ -3376,10 +3373,6 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
>       rs->last_stage = !migration_in_colo_state();
>
>       WITH_RCU_READ_LOCK_GUARD() {
> -        if (!migration_in_postcopy()) {
> -            migration_bitmap_sync_precopy(true);
> -        }
> -

(Got some technical issues receiving QEMU ML mails that I'm not CCed to, 
so replying here for Stefan's mail [1])

Seems like this patch overlooked the COLO case which calls 
ram_save_complete() on each checkpoint and expects the RAM complete 
handler to sync RAM dirty bitmap.
This patch moved this dirty sync from ram_save_complete() (the removed 
lines above) into a qemu_savevm_query_pending_final() called only once 
at migration_switchover_start().

I believe this is the root cause for the CI failure reported by Stefan, 
since I was able to repro this locally [2] and the diff below [3] fixed 
the issue [4].

I have zero knowledge in COLO so would really appreciate some feedback 
from Peter/COLO folks if that's a valid fix.

Thanks.

[1] 
https://lore.kernel.org/qemu-devel/CAJSP0QX-8L2CSX5q95Md5V6NTE_4p+K8Kr-QGbqKm2BBMtdh5Q@mail.gmail.com/

[2]

QTEST_QEMU_BINARY=./qemu-system-x86_64  ./tests/qtest/migration-test -k 
--full -r /x86_64/migration/colo
[...]
# Running /x86_64/migration/colo/plain/secondary_failover
# Using machine type: pc-q35-11.1
# starting QEMU: exec ./qemu-system-x86_64 -qtest 
unix:/tmp/qtest-1415533.sock -qtest-log /dev/null -chardev 
socket,path=/tmp/qtest-1415533.qmp,id=char0 -mon 
chardev=char0,mode=control -display none -audio
none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
pc-q35-11.1, -name source,debug-threads=on -machine 
memory-backend=mig.mem -object 
memory-backend-ram,id=mig.mem,size=150M,share=off -serial
  file:/tmp/migration-test-GF36R3/src_serial -drive 
if=none,id=d0,file=/tmp/migration-test-GF36R3/bootsect,format=raw 
-device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  
-accel qtest
# starting QEMU: exec ./qemu-system-x86_64 -qtest 
unix:/tmp/qtest-1415533.sock -qtest-log /dev/null -chardev 
socket,path=/tmp/qtest-1415533.qmp,id=char0 -mon 
chardev=char0,mode=control -display none -audio
none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
pc-q35-11.1, -name target,debug-threads=on -machine 
memory-backend=mig.mem -object 
memory-backend-ram,id=mig.mem,size=150M,share=off -serial
  file:/tmp/migration-test-GF36R3/dest_serial -incoming defer -drive 
if=none,id=d0,file=/tmp/migration-test-GF36R3/bootsect,format=raw 
-device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  -a
ccel qtest
Memory content inconsistency at ea2000 first_byte = 53 last_byte = 53 
current = 54 hit_edge = 0
Memory content inconsistency at ea3000 first_byte = 53 last_byte = 53 
current = 54 hit_edge = 0
Memory content inconsistency at ea4000 first_byte = 53 last_byte = 53 
current = 54 hit_edge = 0
Memory content inconsistency at ea5000 first_byte = 53 last_byte = 53 
current = 54 hit_edge = 0
Memory content inconsistency at ea6000 first_byte = 53 last_byte = 53 
current = 54 hit_edge = 0
Memory content inconsistency at ea7000 first_byte = 53 last_byte = 53 
current = 54 hit_edge = 0
Memory content inconsistency at ea8000 first_byte = 53 last_byte = 53 
current = 54 hit_edge = 0
Memory content inconsistency at ea9000 first_byte = 53 last_byte = 53 
current = 54 hit_edge = 0
Memory content inconsistency at eaa000 first_byte = 53 last_byte = 53 
current = 54 hit_edge = 0
Memory content inconsistency at eab000 first_byte = 53 last_byte = 53 
current = 54 hit_edge = 0
and in another 13488 pages**
ERROR:../tests/qtest/migration/framework.c:190:check_guests_ram: 
assertion failed: (bad == 0)
not ok /x86_64/migration/colo/plain/secondary_failover - 
ERROR:../tests/qtest/migration/framework.c:190:check_guests_ram: 
assertion failed: (bad == 0)
Bail out!

[3]

diff --git a/migration/colo.c b/migration/colo.c
index 2d36f933cf..5c486c09ef 100644
--- a/migration/colo.c
+++ b/migration/colo.c
@@ -409,6 +409,7 @@ static int 
colo_do_checkpoint_transaction(MigrationState *s,
                                            QEMUFile *fb)
  {
      Error *local_err = NULL;
+    MigPendingData pending = {};
      int ret = -1;

      colo_send_message(s->to_dst_file, COLO_MESSAGE_CHECKPOINT_REQUEST,
@@ -465,6 +466,18 @@ static int 
colo_do_checkpoint_transaction(MigrationState *s,
      if (migrate_auto_converge()) {
          mig_throttle_counter_reset();
      }
+
+    /*
+     * Run the final pending query so migration modules can flush their 
dirty
+     * state (e.g., RAM syncs its dirty bitmap) before this 
checkpoint's live
+     * state is saved. Unlike a regular switchover, COLO reaches completion
+     * repeatedly for every checkpoint, so this must be done on each one.
+     */
+    if (!qemu_savevm_query_pending_final(s, &pending, &local_err)) {
+        bql_unlock();
+        goto out;
+    }
+
      /*
       * Only save VM's live state, which not including device state.
       * TODO: We may need a timeout mechanism to prevent COLO process

[4]

QTEST_QEMU_BINARY=./qemu-system-x86_64  ./tests/qtest/migration-test -k 
--full -r /x86_64/migration/colo
[...]
# Running /x86_64/migration/colo/plain/secondary_failover
# Using machine type: pc-q35-11.1
# starting QEMU: exec ./qemu-system-x86_64 -qtest 
unix:/tmp/qtest-1417324.sock -qtest-log /dev/null -chardev 
socket,path=/tmp/qtest-1417324.qmp,id=char0 -mon 
chardev=char0,mode=control -display none -audio
none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
pc-q35-11.1, -name source,debug-threads=on -machine 
memory-backend=mig.mem -object 
memory-backend-ram,id=mig.mem,size=150M,share=off -serial
  file:/tmp/migration-test-0TMNR3/src_serial -drive 
if=none,id=d0,file=/tmp/migration-test-0TMNR3/bootsect,format=raw 
-device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  
-accel qtest
# starting QEMU: exec ./qemu-system-x86_64 -qtest 
unix:/tmp/qtest-1417324.sock -qtest-log /dev/null -chardev 
socket,path=/tmp/qtest-1417324.qmp,id=char0 -mon 
chardev=char0,mode=control -display none -audio
none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
pc-q35-11.1, -name target,debug-threads=on -machine 
memory-backend=mig.mem -object 
memory-backend-ram,id=mig.mem,size=150M,share=off -serial
  file:/tmp/migration-test-0TMNR3/dest_serial -incoming defer -drive 
if=none,id=d0,file=/tmp/migration-test-0TMNR3/bootsect,format=raw 
-device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  -a
ccel qtest
ok 2 /x86_64/migration/colo/plain/secondary_failover

>           ret = rdma_registration_start(f, RAM_CONTROL_FINISH);
>           if (ret < 0) {
>               qemu_file_set_error(f, ret);
> @@ -3442,25 +3435,38 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
>       return qemu_fflush(f);
>   }
>
> -static void ram_state_pending(void *opaque, MigPendingData *pending,
> -                              bool exact)
> +static void ram_state_pending_sync(bool exact, bool final)
>   {
> -    RAMState **temp = opaque;
> -    RAMState *rs = *temp;
> -    uint64_t remaining_size;
> -
>       /*
>        * Sync is not needed either with: (1) a fast query, or (2) after
>        * postcopy has started (no new dirty will generate anymore).
>        */
> -    if (exact && !migration_in_postcopy()) {
> +    if (!exact || migration_in_postcopy()) {
> +        return;
> +    }
> +
> +    /* Final pending query is called with BQL locked */
> +    if (!final) {
>           bql_lock();
> -        WITH_RCU_READ_LOCK_GUARD() {
> -            migration_bitmap_sync_precopy(false);
> -        }
> +    }
> +
> +    WITH_RCU_READ_LOCK_GUARD() {
> +        migration_bitmap_sync_precopy(final);
> +    }
> +
> +    if (!final) {
>           bql_unlock();
>       }
> +}
> +
> +static void ram_state_pending(void *opaque, MigPendingData *pending,
> +                              bool exact, bool final)
> +{
> +    RAMState **temp = opaque;
> +    RAMState *rs = *temp;
> +    uint64_t remaining_size;
>
> +    ram_state_pending_sync(exact, final);
>       remaining_size = rs->migration_dirty_pages * TARGET_PAGE_SIZE;
>
>       if (migrate_postcopy_ram()) {
> diff --git a/migration/savevm.c b/migration/savevm.c
> index 7e2a0c2b4a7470d9c2159eac1d18ae891740fe3e..74d622583e345bdc96b9189aad0c8f6bad41964d 100644
> --- a/migration/savevm.c
> +++ b/migration/savevm.c
> @@ -1801,7 +1801,8 @@ int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp)
>       return 0;
>   }
>
> -void qemu_savevm_query_pending(MigPendingData *pending, bool exact)
> +static void qemu_savevm_query_pending(MigPendingData *pending, bool exact,
> +                                      bool final)
>   {
>       SaveStateEntry *se;
>
> @@ -1814,7 +1815,7 @@ void qemu_savevm_query_pending(MigPendingData *pending, bool exact)
>           if (!qemu_savevm_state_active(se)) {
>               continue;
>           }
> -        se->ops->save_query_pending(se->opaque, pending, exact);
> +        se->ops->save_query_pending(se->opaque, pending, exact, final);
>       }
>
>       pending->total_bytes = pending->precopy_bytes +
> @@ -1826,13 +1827,24 @@ void qemu_savevm_query_pending(MigPendingData *pending, bool exact)
>        * close to reality when this got invoked frequently while iterating.
>        */
>       mig_stats.dirty_bytes_total = pending->total_bytes;
> -
> -    trace_qemu_savevm_query_pending(exact, pending->precopy_bytes,
> +    trace_qemu_savevm_query_pending(exact, final, pending->precopy_bytes,
>                                       pending->stopcopy_bytes,
>                                       pending->postcopy_bytes,
>                                       pending->total_bytes);
>   }
>
> +void qemu_savevm_query_pending_iter(MigPendingData *pending, bool exact)
> +{
> +    qemu_savevm_query_pending(pending, exact, false);
> +}
> +
> +void qemu_savevm_query_pending_final(MigPendingData *pending)
> +{
> +    g_assert(bql_locked());
> +
> +    qemu_savevm_query_pending(pending, true, true);
> +}
> +
>   void qemu_savevm_state_cleanup(void)
>   {
>       SaveStateEntry *se;
> diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
> index 4c28b3291cc687c06490bdd090f393b67c9c4d88..fa2204f002970c31eb987ae13113a9a5edb3e172 100644
> --- a/hw/vfio/trace-events
> +++ b/hw/vfio/trace-events
> @@ -176,7 +176,7 @@ vfio_save_device_config_state(const char *name) " (%s)"
>   vfio_save_iterate(const char *name, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy initial size %"PRIu64" precopy dirty size %"PRIu64
>   vfio_save_iterate_start(const char *name) " (%s)"
>   vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer size %"PRIu64
> -vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool exact) " (%s) stopcopy size %"PRIu64" precopy initial size %"PRIu64" precopy dirty size %"PRIu64 " exact %d"
> +vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool exact, bool final) " (%s) stopcopy size %"PRIu64", precopy initial size %"PRIu64", precopy dirty size %"PRIu64", exact %d, final %d"
>   vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
>   vfio_vmstate_change_prepare(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
>
> diff --git a/migration/trace-events b/migration/trace-events
> index de99d976abc637e9361f8467daacf3cc8787976f..1c9212d3e20555902f008e4c999f32642cc8fa48 100644
> --- a/migration/trace-events
> +++ b/migration/trace-events
> @@ -7,7 +7,7 @@ qemu_loadvm_state_section_partend(uint32_t section_id) "%u"
>   qemu_loadvm_state_post_main(int ret) "%d"
>   qemu_loadvm_state_section_startfull(uint32_t section_id, const char *idstr, uint32_t instance_id, uint32_t version_id) "%u(%s) %u %u"
>   qemu_savevm_send_packaged(void) ""
> -qemu_savevm_query_pending(bool exact, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total) "exact=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64
> +qemu_savevm_query_pending(bool exact, bool final, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total) "exact=%d, final=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64
>   loadvm_state_switchover_ack_needed(unsigned int switchover_ack_pending_num) "Switchover ack pending num=%u"
>   loadvm_state_setup(void) ""
>   loadvm_state_cleanup(void) ""
> --
> 2.54.0
>

Re: [PULL 17/23] vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature

[Avihai Horon]

On 7/3/2026 5:07 AM, Philippe Mathieu-Daudé wrote:
> External email: Use caution opening links or attachments
>
>
> On 30/6/26 06:31, Cédric Le Goater wrote:
>> From: Avihai Horon <avihaih@nvidia.com>
>>
>> According to VFIO uAPI, precopy initial_bytes is considered as critical
>> data that should be transferred and loaded prior to moving to STOP_COPY
>> state to ensure precopy phase would be effective.
>>
>> As currently defined, initial_bytes can only decrease as it's being read
>> from the data fd. However, there are cases where a new chunk of
>> initial_bytes should be transferred during precopy.
>>
>> The new VFIO_PRECOPY_INFO_REINIT feature addresses this and allows
>> reporting a new value for initial_bytes regardless of any previously
>> reported values.
>>
>> Implement VFIO_PRECOPY_INFO_REINIT feature:
>> 1. Opt-in for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 to make
>>     VFIO_PRECOPY_INFO_REINIT available.
>> 2. Request a new switchover ACK if initial_bytes increases post of a
>>     previous switchover ACK. This ensures the device is not moved to
>>     STOP_COPY before initial_bytes has reached zero again.
>>
>> Acked-by: Peter Xu <peterx@redhat.com>
>> Signed-off-by: Avihai Horon <avihaih@nvidia.com>
>> Link: 
>> https://lore.kernel.org/qemu-devel/20260622101214.25770-13-avihaih@nvidia.com
>> Signed-off-by: Cédric Le Goater <clg@redhat.com>
>> ---
>>   docs/devel/migration/vfio.rst     | 14 +++++++
>>   hw/vfio/vfio-migration-internal.h |  1 +
>>   hw/vfio/migration.c               | 68 ++++++++++++++++++++++++++++---
>>   hw/vfio/trace-events              |  4 +-
>>   4 files changed, 80 insertions(+), 7 deletions(-)
>
>
>> +/* Returns 1 on success, 0 if not supported and negative errno on 
>> failure */
>> +static int vfio_migration_set_precopy_info_v2(VFIODevice *vbasedev)
>> +{
>> +    uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature),
>> +                              sizeof(uint64_t))] = {};
>
> What is the point of using uint64_t[] here?

Since there is no data payload in this case, it's mainly for consistency 
with other VFIO_DEVICE_FEATURE ioctl call sites.

Thanks.

>
>> +    struct vfio_device_feature *feature = (struct 
>> vfio_device_feature *)buf;
>> +
>> +    feature->argsz = sizeof(buf);
>> +    feature->flags =
>> +        VFIO_DEVICE_FEATURE_SET | 
>> VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2;
>> +    if (ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature)) {
>> +        if (errno == ENOTTY) {
>> +            return 0;
>> +        }
>> +
>> +        return -errno;
>> +    }
>> +
>> +    return 1;
>> +}
>

Re: [PULL 08/23] migration: Run final save_query_pending at switchover

[Lukas Straub]

[-- Attachment #1: Type: text/plain, Size: 11854 bytes --]

On Fri, 3 Jul 2026 11:05:39 +0300
Avihai Horon <avihaih@nvidia.com> wrote:

> On 6/30/2026 7:30 AM, Cédric Le Goater wrote:
> > External email: Use caution opening links or attachments
> >
> >
> > From: Avihai Horon <avihaih@nvidia.com>
> >
> > Before switchover, the source needs one last exact pending query so
> > modules can flush dirty state. This is currently done ad hoc in modules
> > handlers. For example, RAM syncs its dirty bitmap in its save_complete
> > handler.
> >
> > This should be a general concept relevant for any module, so extract it
> > to migration core instead by running a final save_query_pending before
> > switchover.
> >
> > The final query requires special handling by modules (e.g., it's called
> > with BQL locked, during VM stop), so extend save_query_pending
> > SaveVMHandlers callback and qemu_savevm_query_pending() with a "final"
> > flag so migration modules can tell the last pending query during
> > switchover from periodic iteration queries.
> >
> > Reviewed-by: Peter Xu <peterx@redhat.com>
> > Signed-off-by: Avihai Horon <avihaih@nvidia.com>
> > Reviewed-by: Jason J. Herne <jjhern@linux.ibm.com>
> > Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-4-avihaih@nvidia.com
> > Signed-off-by: Cédric Le Goater <clg@redhat.com>
> > ---
> >   include/migration/register.h   | 41 ++++++++++++++++++----------------
> >   migration/savevm.h             |  3 ++-
> >   hw/s390x/s390-stattrib.c       |  2 +-
> >   hw/vfio/migration.c            | 11 ++++++---
> >   migration/block-dirty-bitmap.c | 11 ++++++---
> >   migration/migration.c          | 14 ++++++++++--
> >   migration/ram.c                | 40 +++++++++++++++++++--------------
> >   migration/savevm.c             | 20 +++++++++++++----
> >   hw/vfio/trace-events           |  2 +-
> >   migration/trace-events         |  2 +-
> >   10 files changed, 94 insertions(+), 52 deletions(-)
> >
> > [...]
> >
> > diff --git a/migration/migration.c b/migration/migration.c
> > index 0f9e891cf85c8e5074f7f9800515e244fa413fa2..ea0b236597087cc005541e1916ceabb229afab4b 100644
> > --- a/migration/migration.c
> > +++ b/migration/migration.c
> > @@ -2787,12 +2787,22 @@ static bool migration_switchover_prepare(MigrationState *s)
> >   static bool migration_switchover_start(MigrationState *s, Error **errp)
> >   {
> >       ERRP_GUARD();
> > +    MigPendingData pending = {};
> >
> >       if (!migration_switchover_prepare(s)) {
> >           error_setg(errp, "Switchover is interrupted");
> >           return false;
> >       }
> >
> > +    /*
> > +     * The final query to the whole system on dirty data to make sure we
> > +     * collect the latest status of the VM.  For precopy, source QEMU will
> > +     * dump all the dirty data during switchover.  For postcopy, this will
> > +     * properly update all the dirty bitmaps to finally generate the
> > +     * correct discard bitmaps; see ram_postcopy_send_discard_bitmap().
> > +     */
> > +    qemu_savevm_query_pending_final(&pending);
> > +
> >       /* Inactivate disks except in COLO */
> >       if (!migrate_colo()) {
> >           /*
> > @@ -3285,7 +3295,7 @@ static void migration_iteration_go_next(MigPendingData *pending)
> >       /*
> >        * Do a slow sync first before boosting the iteration count.
> >        */
> > -    qemu_savevm_query_pending(pending, true);
> > +    qemu_savevm_query_pending_iter(pending, true);
> >
> >       /*
> >        * Update the dirty information for the whole system for this
> > @@ -3336,7 +3346,7 @@ static MigIterateState migration_iteration_run(MigrationState *s)
> >       bool complete_ready;
> >
> >       /* Fast path - get the estimated amount of pending data */
> > -    qemu_savevm_query_pending(&pending, false);
> > +    qemu_savevm_query_pending_iter(&pending, false);
> >
> >       if (in_postcopy) {
> >           /*
> > diff --git a/migration/ram.c b/migration/ram.c
> > index 55aa9b47dc8ab8463fd1aeba19726a493b81b070..8918b2f03b6fbcc98532bb45ab905f9bac59384c 100644
> > --- a/migration/ram.c
> > +++ b/migration/ram.c
> > @@ -2686,9 +2686,6 @@ void ram_postcopy_send_discard_bitmap(MigrationState *ms)
> >
> >       RCU_READ_LOCK_GUARD();
> >
> > -    /* This should be our last sync, the src is now paused */
> > -    migration_bitmap_sync_precopy(true);
> > -
> >       /* Easiest way to make sure we don't resume in the middle of a host-page */
> >       rs->pss[RAM_CHANNEL_PRECOPY].last_sent_block = NULL;
> >       rs->last_seen_block = NULL;
> > @@ -3376,10 +3373,6 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
> >       rs->last_stage = !migration_in_colo_state();
> >
> >       WITH_RCU_READ_LOCK_GUARD() {
> > -        if (!migration_in_postcopy()) {
> > -            migration_bitmap_sync_precopy(true);
> > -        }
> > -  
> 
> (Got some technical issues receiving QEMU ML mails that I'm not CCed to, 
> so replying here for Stefan's mail [1])
> 
> Seems like this patch overlooked the COLO case which calls 
> ram_save_complete() on each checkpoint and expects the RAM complete 
> handler to sync RAM dirty bitmap.
> This patch moved this dirty sync from ram_save_complete() (the removed 
> lines above) into a qemu_savevm_query_pending_final() called only once 
> at migration_switchover_start().
> 
> I believe this is the root cause for the CI failure reported by Stefan, 
> since I was able to repro this locally [2] and the diff below [3] fixed 
> the issue [4].
> 
> I have zero knowledge in COLO so would really appreciate some feedback 
> from Peter/COLO folks if that's a valid fix.
> 
> Thanks.
> 
> [1] 
> https://lore.kernel.org/qemu-devel/CAJSP0QX-8L2CSX5q95Md5V6NTE_4p+K8Kr-QGbqKm2BBMtdh5Q@mail.gmail.com/
> 
> [2]
> 
> QTEST_QEMU_BINARY=./qemu-system-x86_64  ./tests/qtest/migration-test -k 
> --full -r /x86_64/migration/colo
> [...]
> # Running /x86_64/migration/colo/plain/secondary_failover
> # Using machine type: pc-q35-11.1
> # starting QEMU: exec ./qemu-system-x86_64 -qtest 
> unix:/tmp/qtest-1415533.sock -qtest-log /dev/null -chardev 
> socket,path=/tmp/qtest-1415533.qmp,id=char0 -mon 
> chardev=char0,mode=control -display none -audio
> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
> pc-q35-11.1, -name source,debug-threads=on -machine 
> memory-backend=mig.mem -object 
> memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>   file:/tmp/migration-test-GF36R3/src_serial -drive 
> if=none,id=d0,file=/tmp/migration-test-GF36R3/bootsect,format=raw 
> -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  
> -accel qtest
> # starting QEMU: exec ./qemu-system-x86_64 -qtest 
> unix:/tmp/qtest-1415533.sock -qtest-log /dev/null -chardev 
> socket,path=/tmp/qtest-1415533.qmp,id=char0 -mon 
> chardev=char0,mode=control -display none -audio
> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
> pc-q35-11.1, -name target,debug-threads=on -machine 
> memory-backend=mig.mem -object 
> memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>   file:/tmp/migration-test-GF36R3/dest_serial -incoming defer -drive 
> if=none,id=d0,file=/tmp/migration-test-GF36R3/bootsect,format=raw 
> -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  -a
> ccel qtest
> Memory content inconsistency at ea2000 first_byte = 53 last_byte = 53 
> current = 54 hit_edge = 0
> Memory content inconsistency at ea3000 first_byte = 53 last_byte = 53 
> current = 54 hit_edge = 0
> Memory content inconsistency at ea4000 first_byte = 53 last_byte = 53 
> current = 54 hit_edge = 0
> Memory content inconsistency at ea5000 first_byte = 53 last_byte = 53 
> current = 54 hit_edge = 0
> Memory content inconsistency at ea6000 first_byte = 53 last_byte = 53 
> current = 54 hit_edge = 0
> Memory content inconsistency at ea7000 first_byte = 53 last_byte = 53 
> current = 54 hit_edge = 0
> Memory content inconsistency at ea8000 first_byte = 53 last_byte = 53 
> current = 54 hit_edge = 0
> Memory content inconsistency at ea9000 first_byte = 53 last_byte = 53 
> current = 54 hit_edge = 0
> Memory content inconsistency at eaa000 first_byte = 53 last_byte = 53 
> current = 54 hit_edge = 0
> Memory content inconsistency at eab000 first_byte = 53 last_byte = 53 
> current = 54 hit_edge = 0
> and in another 13488 pages**
> ERROR:../tests/qtest/migration/framework.c:190:check_guests_ram: 
> assertion failed: (bad == 0)
> not ok /x86_64/migration/colo/plain/secondary_failover - 
> ERROR:../tests/qtest/migration/framework.c:190:check_guests_ram: 
> assertion failed: (bad == 0)
> Bail out!
> 
> [3]
> 
> diff --git a/migration/colo.c b/migration/colo.c
> index 2d36f933cf..5c486c09ef 100644
> --- a/migration/colo.c
> +++ b/migration/colo.c
> @@ -409,6 +409,7 @@ static int 
> colo_do_checkpoint_transaction(MigrationState *s,
>                                             QEMUFile *fb)
>   {
>       Error *local_err = NULL;
> +    MigPendingData pending = {};
>       int ret = -1;
> 
>       colo_send_message(s->to_dst_file, COLO_MESSAGE_CHECKPOINT_REQUEST,
> @@ -465,6 +466,18 @@ static int 
> colo_do_checkpoint_transaction(MigrationState *s,
>       if (migrate_auto_converge()) {
>           mig_throttle_counter_reset();
>       }
> +
> +    /*
> +     * Run the final pending query so migration modules can flush their 
> dirty
> +     * state (e.g., RAM syncs its dirty bitmap) before this 
> checkpoint's live
> +     * state is saved. Unlike a regular switchover, COLO reaches completion
> +     * repeatedly for every checkpoint, so this must be done on each one.
> +     */
> +    if (!qemu_savevm_query_pending_final(s, &pending, &local_err)) {
> +        bql_unlock();
> +        goto out;
> +    }
> +
>       /*
>        * Only save VM's live state, which not including device state.
>        * TODO: We may need a timeout mechanism to prevent COLO process

Hello,
This patch looks good to me.

Regards,
Lukas Straub

> 
> [4]
> 
> QTEST_QEMU_BINARY=./qemu-system-x86_64  ./tests/qtest/migration-test -k 
> --full -r /x86_64/migration/colo
> [...]
> # Running /x86_64/migration/colo/plain/secondary_failover
> # Using machine type: pc-q35-11.1
> # starting QEMU: exec ./qemu-system-x86_64 -qtest 
> unix:/tmp/qtest-1417324.sock -qtest-log /dev/null -chardev 
> socket,path=/tmp/qtest-1417324.qmp,id=char0 -mon 
> chardev=char0,mode=control -display none -audio
> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
> pc-q35-11.1, -name source,debug-threads=on -machine 
> memory-backend=mig.mem -object 
> memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>   file:/tmp/migration-test-0TMNR3/src_serial -drive 
> if=none,id=d0,file=/tmp/migration-test-0TMNR3/bootsect,format=raw 
> -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  
> -accel qtest
> # starting QEMU: exec ./qemu-system-x86_64 -qtest 
> unix:/tmp/qtest-1417324.sock -qtest-log /dev/null -chardev 
> socket,path=/tmp/qtest-1417324.qmp,id=char0 -mon 
> chardev=char0,mode=control -display none -audio
> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
> pc-q35-11.1, -name target,debug-threads=on -machine 
> memory-backend=mig.mem -object 
> memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>   file:/tmp/migration-test-0TMNR3/dest_serial -incoming defer -drive 
> if=none,id=d0,file=/tmp/migration-test-0TMNR3/bootsect,format=raw 
> -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  -a
> ccel qtest
> ok 2 /x86_64/migration/colo/plain/secondary_failover
> 
> > [...]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PULL 08/23] migration: Run final save_query_pending at switchover

[Cédric Le Goater]

On 7/3/26 10:05, Avihai Horon wrote:
> 
> On 6/30/2026 7:30 AM, Cédric Le Goater wrote:
>> External email: Use caution opening links or attachments
>>
>>
>> From: Avihai Horon <avihaih@nvidia.com>
>>
>> Before switchover, the source needs one last exact pending query so
>> modules can flush dirty state. This is currently done ad hoc in modules
>> handlers. For example, RAM syncs its dirty bitmap in its save_complete
>> handler.
>>
>> This should be a general concept relevant for any module, so extract it
>> to migration core instead by running a final save_query_pending before
>> switchover.
>>
>> The final query requires special handling by modules (e.g., it's called
>> with BQL locked, during VM stop), so extend save_query_pending
>> SaveVMHandlers callback and qemu_savevm_query_pending() with a "final"
>> flag so migration modules can tell the last pending query during
>> switchover from periodic iteration queries.
>>
>> Reviewed-by: Peter Xu <peterx@redhat.com>
>> Signed-off-by: Avihai Horon <avihaih@nvidia.com>
>> Reviewed-by: Jason J. Herne <jjhern@linux.ibm.com>
>> Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-4-avihaih@nvidia.com
>> Signed-off-by: Cédric Le Goater <clg@redhat.com>
>> ---
>>   include/migration/register.h   | 41 ++++++++++++++++++----------------
>>   migration/savevm.h             |  3 ++-
>>   hw/s390x/s390-stattrib.c       |  2 +-
>>   hw/vfio/migration.c            | 11 ++++++---
>>   migration/block-dirty-bitmap.c | 11 ++++++---
>>   migration/migration.c          | 14 ++++++++++--
>>   migration/ram.c                | 40 +++++++++++++++++++--------------
>>   migration/savevm.c             | 20 +++++++++++++----
>>   hw/vfio/trace-events           |  2 +-
>>   migration/trace-events         |  2 +-
>>   10 files changed, 94 insertions(+), 52 deletions(-)
>>
>> diff --git a/include/migration/register.h b/include/migration/register.h
>> index 5e5e0ee432e537781ce78e84b2ff2d81c33e8f37..6f632123f1d0710de0556e68ba53e068a1e02640 100644
>> --- a/include/migration/register.h
>> +++ b/include/migration/register.h
>> @@ -171,6 +171,28 @@ typedef struct SaveVMHandlers {
>>        */
>>       bool (*is_active_iterate)(void *opaque);
>>
>> +    /**
>> +     * @save_query_pending
>> +     *
>> +     * This estimates the remaining data to transfer on the source side.
>> +     *
>> +     * When @exact is true, a module must report accurate results.  When
>> +     * @exact is false, a module may report estimates.
>> +     *
>> +     * It's highly recommended that modules implement a faster version of
>> +     * the query path (for example, by proper caching on the counters) if
>> +     * an accurate query will be time-consuming.
>> +     *
>> +     * @opaque: data pointer passed to register_savevm_live()
>> +     * @pending: pointer to a MigPendingData struct
>> +     * @exact: set to true for an accurate (slow) query
>> +     * @final: set to true for the final query during switchover. When final is
>> +     * true, the query is called with BQL locked. Otherwise, it's called with
>> +     * BQL unlocked.
>> +     */
>> +    void (*save_query_pending)(void *opaque, MigPendingData *pending,
>> +                               bool exact, bool final);
>> +
>>       /* This runs outside the BQL in the migration case, and
>>        * within the lock in the savevm case.  The callback had better only
>>        * use data that is local to the migration thread or protected
>> @@ -210,25 +232,6 @@ typedef struct SaveVMHandlers {
>>        */
>>       bool (*save_postcopy_prepare)(QEMUFile *f, void *opaque, Error **errp);
>>
>> -    /**
>> -     * @save_query_pending
>> -     *
>> -     * This estimates the remaining data to transfer on the source side.
>> -     *
>> -     * When @exact is true, a module must report accurate results.  When
>> -     * @exact is false, a module may report estimates.
>> -     *
>> -     * It's highly recommended that modules implement a faster version of
>> -     * the query path (for example, by proper caching on the counters) if
>> -     * an accurate query will be time-consuming.
>> -     *
>> -     * @opaque: data pointer passed to register_savevm_live()
>> -     * @pending: pointer to a MigPendingData struct
>> -     * @exact: set to true for an accurate (slow) query
>> -     */
>> -    void (*save_query_pending)(void *opaque, MigPendingData *pending,
>> -                               bool exact);
>> -
>>       /**
>>        * @load_state
>>        *
>> diff --git a/migration/savevm.h b/migration/savevm.h
>> index b6bb4fa977fae84ed121b0668cdefdf49e3d9c67..81abd96dda94c6c95cc40b3c188df23d11c19463 100644
>> --- a/migration/savevm.h
>> +++ b/migration/savevm.h
>> @@ -45,7 +45,8 @@ int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy);
>>   void qemu_savevm_state_cleanup(void);
>>   void qemu_savevm_state_complete_postcopy(QEMUFile *f);
>>   int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
>> -void qemu_savevm_query_pending(MigPendingData *pending, bool exact);
>> +void qemu_savevm_query_pending_iter(MigPendingData *pending, bool exact);
>> +void qemu_savevm_query_pending_final(MigPendingData *pending);
>>   int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
>>   bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
>>   void qemu_savevm_state_end(QEMUFile *f);
>> diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c
>> index c334714b31ab4313e26c0cf57091a8cb21e55306..b0f04eb30c7f73e5dd91b1345d71a14cb404a4eb 100644
>> --- a/hw/s390x/s390-stattrib.c
>> +++ b/hw/s390x/s390-stattrib.c
>> @@ -190,7 +190,7 @@ static int cmma_save_setup(QEMUFile *f, void *opaque, Error **errp)
>>   }
>>
>>   static void cmma_state_pending(void *opaque, MigPendingData *pending,
>> -                               bool exact)
>> +                               bool exact, bool final)
>>   {
>>       S390StAttribState *sas = S390_STATTRIB(opaque);
>>       S390StAttribClass *sac = S390_STATTRIB_GET_CLASS(sas);
>> diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
>> index fb12b9717f773fdde657911517de9d74c1eb3931..195498845ed95d6a55cf68537a100b4e83221fb0 100644
>> --- a/hw/vfio/migration.c
>> +++ b/hw/vfio/migration.c
>> @@ -622,13 +622,18 @@ static void vfio_state_pending_sync(VFIODevice *vbasedev)
>>   }
>>
>>   static void vfio_state_pending(void *opaque, MigPendingData *pending,
>> -                               bool exact)
>> +                               bool exact, bool final)
>>   {
>>       VFIODevice *vbasedev = opaque;
>>       VFIOMigration *migration = vbasedev->migration;
>>       uint64_t precopy_size, stopcopy_size;
>>
>> -    if (exact) {
>> +    /*
>> +     * The final pending query runs during switchover downtime. VFIO does not
>> +     * need a fresh device pending-data query then to get the latest dirty
>> +     * data, so avoid the extra work and report the cached counters below.
>> +     */
>> +    if (exact && !final) {
>>           vfio_state_pending_sync(vbasedev);
>>       }
>>
>> @@ -646,7 +651,7 @@ static void vfio_state_pending(void *opaque, MigPendingData *pending,
>>
>>       trace_vfio_state_pending(vbasedev->name, migration->stopcopy_size,
>>                                migration->precopy_init_size,
>> -                             migration->precopy_dirty_size, exact);
>> +                             migration->precopy_dirty_size, exact, final);
>>   }
>>
>>   static bool vfio_is_active_iterate(void *opaque)
>> diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
>> index 7ef3759e5348a6907c0fb3773e2c6cbb0850632e..cba54e25cd50da924e1958bdfc23ce060784b0ac 100644
>> --- a/migration/block-dirty-bitmap.c
>> +++ b/migration/block-dirty-bitmap.c
>> @@ -767,13 +767,16 @@ static int dirty_bitmap_save_complete(QEMUFile *f, void *opaque)
>>   }
>>
>>   static void dirty_bitmap_state_pending(void *opaque, MigPendingData *data,
>> -                                       bool exact)
>> +                                       bool exact, bool final)
>>   {
>>       DBMSaveState *s = &((DBMState *)opaque)->save;
>>       SaveBitmapState *dbms;
>>       uint64_t pending = 0;
>>
>> -    bql_lock();
>> +    /* Final pending query is called with BQL locked */
>> +    if (!final) {
>> +        bql_lock();
>> +    }
>>
>>       QSIMPLEQ_FOREACH(dbms, &s->dbms_list, entry) {
>>           uint64_t gran = bdrv_dirty_bitmap_granularity(dbms->bitmap);
>> @@ -783,7 +786,9 @@ static void dirty_bitmap_state_pending(void *opaque, MigPendingData *data,
>>           pending += DIV_ROUND_UP(sectors * BDRV_SECTOR_SIZE, gran);
>>       }
>>
>> -    bql_unlock();
>> +    if (!final) {
>> +        bql_unlock();
>> +    }
>>
>>       trace_dirty_bitmap_state_pending(pending);
>>
>> diff --git a/migration/migration.c b/migration/migration.c
>> index 0f9e891cf85c8e5074f7f9800515e244fa413fa2..ea0b236597087cc005541e1916ceabb229afab4b 100644
>> --- a/migration/migration.c
>> +++ b/migration/migration.c
>> @@ -2787,12 +2787,22 @@ static bool migration_switchover_prepare(MigrationState *s)
>>   static bool migration_switchover_start(MigrationState *s, Error **errp)
>>   {
>>       ERRP_GUARD();
>> +    MigPendingData pending = {};
>>
>>       if (!migration_switchover_prepare(s)) {
>>           error_setg(errp, "Switchover is interrupted");
>>           return false;
>>       }
>>
>> +    /*
>> +     * The final query to the whole system on dirty data to make sure we
>> +     * collect the latest status of the VM.  For precopy, source QEMU will
>> +     * dump all the dirty data during switchover.  For postcopy, this will
>> +     * properly update all the dirty bitmaps to finally generate the
>> +     * correct discard bitmaps; see ram_postcopy_send_discard_bitmap().
>> +     */
>> +    qemu_savevm_query_pending_final(&pending);
>> +
>>       /* Inactivate disks except in COLO */
>>       if (!migrate_colo()) {
>>           /*
>> @@ -3285,7 +3295,7 @@ static void migration_iteration_go_next(MigPendingData *pending)
>>       /*
>>        * Do a slow sync first before boosting the iteration count.
>>        */
>> -    qemu_savevm_query_pending(pending, true);
>> +    qemu_savevm_query_pending_iter(pending, true);
>>
>>       /*
>>        * Update the dirty information for the whole system for this
>> @@ -3336,7 +3346,7 @@ static MigIterateState migration_iteration_run(MigrationState *s)
>>       bool complete_ready;
>>
>>       /* Fast path - get the estimated amount of pending data */
>> -    qemu_savevm_query_pending(&pending, false);
>> +    qemu_savevm_query_pending_iter(&pending, false);
>>
>>       if (in_postcopy) {
>>           /*
>> diff --git a/migration/ram.c b/migration/ram.c
>> index 55aa9b47dc8ab8463fd1aeba19726a493b81b070..8918b2f03b6fbcc98532bb45ab905f9bac59384c 100644
>> --- a/migration/ram.c
>> +++ b/migration/ram.c
>> @@ -2686,9 +2686,6 @@ void ram_postcopy_send_discard_bitmap(MigrationState *ms)
>>
>>       RCU_READ_LOCK_GUARD();
>>
>> -    /* This should be our last sync, the src is now paused */
>> -    migration_bitmap_sync_precopy(true);
>> -
>>       /* Easiest way to make sure we don't resume in the middle of a host-page */
>>       rs->pss[RAM_CHANNEL_PRECOPY].last_sent_block = NULL;
>>       rs->last_seen_block = NULL;
>> @@ -3376,10 +3373,6 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
>>       rs->last_stage = !migration_in_colo_state();
>>
>>       WITH_RCU_READ_LOCK_GUARD() {
>> -        if (!migration_in_postcopy()) {
>> -            migration_bitmap_sync_precopy(true);
>> -        }
>> -
> 
> (Got some technical issues receiving QEMU ML mails that I'm not CCed to, so replying here for Stefan's mail [1])
> 
> Seems like this patch overlooked the COLO case which calls ram_save_complete() on each checkpoint and expects the RAM complete handler to sync RAM dirty bitmap.
> This patch moved this dirty sync from ram_save_complete() (the removed lines above) into a qemu_savevm_query_pending_final() called only once at migration_switchover_start().
> 
> I believe this is the root cause for the CI failure reported by Stefan, since I was able to repro this locally [2] and the diff below [3] fixed the issue [4].
> 
> I have zero knowledge in COLO so would really appreciate some feedback from Peter/COLO folks if that's a valid fix.
> 
> Thanks.
> 
> [1] https://lore.kernel.org/qemu-devel/CAJSP0QX-8L2CSX5q95Md5V6NTE_4p+K8Kr-QGbqKm2BBMtdh5Q@mail.gmail.com/
> 
> [2]
> 
> QTEST_QEMU_BINARY=./qemu-system-x86_64  ./tests/qtest/migration-test -k --full -r /x86_64/migration/colo
> [...]
> # Running /x86_64/migration/colo/plain/secondary_failover
> # Using machine type: pc-q35-11.1
> # starting QEMU: exec ./qemu-system-x86_64 -qtest unix:/tmp/qtest-1415533.sock -qtest-log /dev/null -chardev socket,path=/tmp/qtest-1415533.qmp,id=char0 -mon chardev=char0,mode=control -display none -audio
> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine pc-q35-11.1, -name source,debug-threads=on -machine memory-backend=mig.mem -object memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>   file:/tmp/migration-test-GF36R3/src_serial -drive if=none,id=d0,file=/tmp/migration-test-GF36R3/bootsect,format=raw -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null -accel qtest
> # starting QEMU: exec ./qemu-system-x86_64 -qtest unix:/tmp/qtest-1415533.sock -qtest-log /dev/null -chardev socket,path=/tmp/qtest-1415533.qmp,id=char0 -mon chardev=char0,mode=control -display none -audio
> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine pc-q35-11.1, -name target,debug-threads=on -machine memory-backend=mig.mem -object memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>   file:/tmp/migration-test-GF36R3/dest_serial -incoming defer -drive if=none,id=d0,file=/tmp/migration-test-GF36R3/bootsect,format=raw -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  -a
> ccel qtest
> Memory content inconsistency at ea2000 first_byte = 53 last_byte = 53 current = 54 hit_edge = 0
> Memory content inconsistency at ea3000 first_byte = 53 last_byte = 53 current = 54 hit_edge = 0
> Memory content inconsistency at ea4000 first_byte = 53 last_byte = 53 current = 54 hit_edge = 0
> Memory content inconsistency at ea5000 first_byte = 53 last_byte = 53 current = 54 hit_edge = 0
> Memory content inconsistency at ea6000 first_byte = 53 last_byte = 53 current = 54 hit_edge = 0
> Memory content inconsistency at ea7000 first_byte = 53 last_byte = 53 current = 54 hit_edge = 0
> Memory content inconsistency at ea8000 first_byte = 53 last_byte = 53 current = 54 hit_edge = 0
> Memory content inconsistency at ea9000 first_byte = 53 last_byte = 53 current = 54 hit_edge = 0
> Memory content inconsistency at eaa000 first_byte = 53 last_byte = 53 current = 54 hit_edge = 0
> Memory content inconsistency at eab000 first_byte = 53 last_byte = 53 current = 54 hit_edge = 0
> and in another 13488 pages**
> ERROR:../tests/qtest/migration/framework.c:190:check_guests_ram: assertion failed: (bad == 0)
> not ok /x86_64/migration/colo/plain/secondary_failover - ERROR:../tests/qtest/migration/framework.c:190:check_guests_ram: assertion failed: (bad == 0)
> Bail out!
> 
> [3]
> 
> diff --git a/migration/colo.c b/migration/colo.c
> index 2d36f933cf..5c486c09ef 100644
> --- a/migration/colo.c
> +++ b/migration/colo.c
> @@ -409,6 +409,7 @@ static int colo_do_checkpoint_transaction(MigrationState *s,
>                                             QEMUFile *fb)
>   {
>       Error *local_err = NULL;
> +    MigPendingData pending = {};
>       int ret = -1;
> 
>       colo_send_message(s->to_dst_file, COLO_MESSAGE_CHECKPOINT_REQUEST,
> @@ -465,6 +466,18 @@ static int colo_do_checkpoint_transaction(MigrationState *s,
>       if (migrate_auto_converge()) {
>           mig_throttle_counter_reset();
>       }
> +
> +    /*
> +     * Run the final pending query so migration modules can flush their dirty
> +     * state (e.g., RAM syncs its dirty bitmap) before this checkpoint's live
> +     * state is saved. Unlike a regular switchover, COLO reaches completion
> +     * repeatedly for every checkpoint, so this must be done on each one.
> +     */
> +    if (!qemu_savevm_query_pending_final(s, &pending, &local_err)) {
> +        bql_unlock();
> +        goto out;
> +    }
> +
>       /*
>        * Only save VM's live state, which not including device state.
>        * TODO: We may need a timeout mechanism to prevent COLO process
> 
> [4]
> 
> QTEST_QEMU_BINARY=./qemu-system-x86_64  ./tests/qtest/migration-test -k --full -r /x86_64/migration/colo
> [...]
> # Running /x86_64/migration/colo/plain/secondary_failover
> # Using machine type: pc-q35-11.1
> # starting QEMU: exec ./qemu-system-x86_64 -qtest unix:/tmp/qtest-1417324.sock -qtest-log /dev/null -chardev socket,path=/tmp/qtest-1417324.qmp,id=char0 -mon chardev=char0,mode=control -display none -audio
> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine pc-q35-11.1, -name source,debug-threads=on -machine memory-backend=mig.mem -object memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>   file:/tmp/migration-test-0TMNR3/src_serial -drive if=none,id=d0,file=/tmp/migration-test-0TMNR3/bootsect,format=raw -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null -accel qtest
> # starting QEMU: exec ./qemu-system-x86_64 -qtest unix:/tmp/qtest-1417324.sock -qtest-log /dev/null -chardev socket,path=/tmp/qtest-1417324.qmp,id=char0 -mon chardev=char0,mode=control -display none -audio
> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine pc-q35-11.1, -name target,debug-threads=on -machine memory-backend=mig.mem -object memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>   file:/tmp/migration-test-0TMNR3/dest_serial -incoming defer -drive if=none,id=d0,file=/tmp/migration-test-0TMNR3/bootsect,format=raw -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  -a
> ccel qtest
> ok 2 /x86_64/migration/colo/plain/secondary_failover


The culprit appears to be patch 3:

   migration: Run final save_query_pending at switchover

I can reproduce the issue consistently with:

while [ 1 ]; do
     QTEST_QEMU_BINARY=./build/qemu-system-s390x \
         ./build/tests/qtest/migration-test \
         --full -p /s390x/migration/colo/plain/secondary_failover_checkpoint || break
done

The patch you proposed seems to fix the issue.

Could you send it as a follow-up patch? if Peter, Fabiano, Lukas
would prefer it to be integrated in the appropriate place, it
could be included in v5.


Thanks,

C.

Re: [PULL 17/23] vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature

[Philippe Mathieu-Daudé]

On 3/7/26 10:13, Avihai Horon wrote:
> 
> On 7/3/2026 5:07 AM, Philippe Mathieu-Daudé wrote:
>> External email: Use caution opening links or attachments
>>
>>
>> On 30/6/26 06:31, Cédric Le Goater wrote:
>>> From: Avihai Horon <avihaih@nvidia.com>
>>>
>>> According to VFIO uAPI, precopy initial_bytes is considered as critical
>>> data that should be transferred and loaded prior to moving to STOP_COPY
>>> state to ensure precopy phase would be effective.
>>>
>>> As currently defined, initial_bytes can only decrease as it's being read
>>> from the data fd. However, there are cases where a new chunk of
>>> initial_bytes should be transferred during precopy.
>>>
>>> The new VFIO_PRECOPY_INFO_REINIT feature addresses this and allows
>>> reporting a new value for initial_bytes regardless of any previously
>>> reported values.
>>>
>>> Implement VFIO_PRECOPY_INFO_REINIT feature:
>>> 1. Opt-in for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 to make
>>>     VFIO_PRECOPY_INFO_REINIT available.
>>> 2. Request a new switchover ACK if initial_bytes increases post of a
>>>     previous switchover ACK. This ensures the device is not moved to
>>>     STOP_COPY before initial_bytes has reached zero again.
>>>
>>> Acked-by: Peter Xu <peterx@redhat.com>
>>> Signed-off-by: Avihai Horon <avihaih@nvidia.com>
>>> Link: https://lore.kernel.org/qemu-devel/20260622101214.25770-13- 
>>> avihaih@nvidia.com
>>> Signed-off-by: Cédric Le Goater <clg@redhat.com>
>>> ---
>>>   docs/devel/migration/vfio.rst     | 14 +++++++
>>>   hw/vfio/vfio-migration-internal.h |  1 +
>>>   hw/vfio/migration.c               | 68 ++++++++++++++++++++++++++++---
>>>   hw/vfio/trace-events              |  4 +-
>>>   4 files changed, 80 insertions(+), 7 deletions(-)
>>
>>
>>> +/* Returns 1 on success, 0 if not supported and negative errno on 
>>> failure */
>>> +static int vfio_migration_set_precopy_info_v2(VFIODevice *vbasedev)
>>> +{
>>> +    uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature),
>>> +                              sizeof(uint64_t))] = {};
>>
>> What is the point of using uint64_t[] here?
> 
> Since there is no data payload in this case, it's mainly for consistency 
> with other VFIO_DEVICE_FEATURE ioctl call sites.

Ah, I didn't noticed. Does the VFIO_DEVICE_FEATURE ioctl expect
the buffer to be 64-bit aligned?

> 
> Thanks.
> 
>>
>>> +    struct vfio_device_feature *feature = (struct 
>>> vfio_device_feature *)buf;
>>> +
>>> +    feature->argsz = sizeof(buf);
>>> +    feature->flags =
>>> +        VFIO_DEVICE_FEATURE_SET | 
>>> VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2;
>>> +    if (ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature)) {
>>> +        if (errno == ENOTTY) {
>>> +            return 0;
>>> +        }
>>> +
>>> +        return -errno;
>>> +    }
>>> +
>>> +    return 1;
>>> +}
>>

Re: [PULL 08/23] migration: Run final save_query_pending at switchover

[Avihai Horon]

On 7/3/2026 11:44 AM, Cédric Le Goater wrote:
> External email: Use caution opening links or attachments
>
>
> On 7/3/26 10:05, Avihai Horon wrote:
>>
>> On 6/30/2026 7:30 AM, Cédric Le Goater wrote:
>>> External email: Use caution opening links or attachments
>>>
>>>
>>> From: Avihai Horon <avihaih@nvidia.com>
>>>
>>> Before switchover, the source needs one last exact pending query so
>>> modules can flush dirty state. This is currently done ad hoc in modules
>>> handlers. For example, RAM syncs its dirty bitmap in its save_complete
>>> handler.
>>>
>>> This should be a general concept relevant for any module, so extract it
>>> to migration core instead by running a final save_query_pending before
>>> switchover.
>>>
>>> The final query requires special handling by modules (e.g., it's called
>>> with BQL locked, during VM stop), so extend save_query_pending
>>> SaveVMHandlers callback and qemu_savevm_query_pending() with a "final"
>>> flag so migration modules can tell the last pending query during
>>> switchover from periodic iteration queries.
>>>
>>> Reviewed-by: Peter Xu <peterx@redhat.com>
>>> Signed-off-by: Avihai Horon <avihaih@nvidia.com>
>>> Reviewed-by: Jason J. Herne <jjhern@linux.ibm.com>
>>> Link: 
>>> https://lore.kernel.org/qemu-devel/20260622101214.25770-4-avihaih@nvidia.com
>>> Signed-off-by: Cédric Le Goater <clg@redhat.com>
>>> ---
>>>   include/migration/register.h   | 41 
>>> ++++++++++++++++++----------------
>>>   migration/savevm.h             |  3 ++-
>>>   hw/s390x/s390-stattrib.c       |  2 +-
>>>   hw/vfio/migration.c            | 11 ++++++---
>>>   migration/block-dirty-bitmap.c | 11 ++++++---
>>>   migration/migration.c          | 14 ++++++++++--
>>>   migration/ram.c                | 40 +++++++++++++++++++--------------
>>>   migration/savevm.c             | 20 +++++++++++++----
>>>   hw/vfio/trace-events           |  2 +-
>>>   migration/trace-events         |  2 +-
>>>   10 files changed, 94 insertions(+), 52 deletions(-)
>>>
>>> diff --git a/include/migration/register.h 
>>> b/include/migration/register.h
>>> index 
>>> 5e5e0ee432e537781ce78e84b2ff2d81c33e8f37..6f632123f1d0710de0556e68ba53e068a1e02640 
>>> 100644
>>> --- a/include/migration/register.h
>>> +++ b/include/migration/register.h
>>> @@ -171,6 +171,28 @@ typedef struct SaveVMHandlers {
>>>        */
>>>       bool (*is_active_iterate)(void *opaque);
>>>
>>> +    /**
>>> +     * @save_query_pending
>>> +     *
>>> +     * This estimates the remaining data to transfer on the source 
>>> side.
>>> +     *
>>> +     * When @exact is true, a module must report accurate results.  
>>> When
>>> +     * @exact is false, a module may report estimates.
>>> +     *
>>> +     * It's highly recommended that modules implement a faster 
>>> version of
>>> +     * the query path (for example, by proper caching on the 
>>> counters) if
>>> +     * an accurate query will be time-consuming.
>>> +     *
>>> +     * @opaque: data pointer passed to register_savevm_live()
>>> +     * @pending: pointer to a MigPendingData struct
>>> +     * @exact: set to true for an accurate (slow) query
>>> +     * @final: set to true for the final query during switchover. 
>>> When final is
>>> +     * true, the query is called with BQL locked. Otherwise, it's 
>>> called with
>>> +     * BQL unlocked.
>>> +     */
>>> +    void (*save_query_pending)(void *opaque, MigPendingData *pending,
>>> +                               bool exact, bool final);
>>> +
>>>       /* This runs outside the BQL in the migration case, and
>>>        * within the lock in the savevm case.  The callback had 
>>> better only
>>>        * use data that is local to the migration thread or protected
>>> @@ -210,25 +232,6 @@ typedef struct SaveVMHandlers {
>>>        */
>>>       bool (*save_postcopy_prepare)(QEMUFile *f, void *opaque, Error 
>>> **errp);
>>>
>>> -    /**
>>> -     * @save_query_pending
>>> -     *
>>> -     * This estimates the remaining data to transfer on the source 
>>> side.
>>> -     *
>>> -     * When @exact is true, a module must report accurate results.  
>>> When
>>> -     * @exact is false, a module may report estimates.
>>> -     *
>>> -     * It's highly recommended that modules implement a faster 
>>> version of
>>> -     * the query path (for example, by proper caching on the 
>>> counters) if
>>> -     * an accurate query will be time-consuming.
>>> -     *
>>> -     * @opaque: data pointer passed to register_savevm_live()
>>> -     * @pending: pointer to a MigPendingData struct
>>> -     * @exact: set to true for an accurate (slow) query
>>> -     */
>>> -    void (*save_query_pending)(void *opaque, MigPendingData *pending,
>>> -                               bool exact);
>>> -
>>>       /**
>>>        * @load_state
>>>        *
>>> diff --git a/migration/savevm.h b/migration/savevm.h
>>> index 
>>> b6bb4fa977fae84ed121b0668cdefdf49e3d9c67..81abd96dda94c6c95cc40b3c188df23d11c19463 
>>> 100644
>>> --- a/migration/savevm.h
>>> +++ b/migration/savevm.h
>>> @@ -45,7 +45,8 @@ int qemu_savevm_state_iterate(QEMUFile *f, bool 
>>> postcopy);
>>>   void qemu_savevm_state_cleanup(void);
>>>   void qemu_savevm_state_complete_postcopy(QEMUFile *f);
>>>   int qemu_savevm_state_complete_precopy(MigrationState *s, Error 
>>> **errp);
>>> -void qemu_savevm_query_pending(MigPendingData *pending, bool exact);
>>> +void qemu_savevm_query_pending_iter(MigPendingData *pending, bool 
>>> exact);
>>> +void qemu_savevm_query_pending_final(MigPendingData *pending);
>>>   int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool 
>>> in_postcopy);
>>>   bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
>>>   void qemu_savevm_state_end(QEMUFile *f);
>>> diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c
>>> index 
>>> c334714b31ab4313e26c0cf57091a8cb21e55306..b0f04eb30c7f73e5dd91b1345d71a14cb404a4eb 
>>> 100644
>>> --- a/hw/s390x/s390-stattrib.c
>>> +++ b/hw/s390x/s390-stattrib.c
>>> @@ -190,7 +190,7 @@ static int cmma_save_setup(QEMUFile *f, void 
>>> *opaque, Error **errp)
>>>   }
>>>
>>>   static void cmma_state_pending(void *opaque, MigPendingData *pending,
>>> -                               bool exact)
>>> +                               bool exact, bool final)
>>>   {
>>>       S390StAttribState *sas = S390_STATTRIB(opaque);
>>>       S390StAttribClass *sac = S390_STATTRIB_GET_CLASS(sas);
>>> diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
>>> index 
>>> fb12b9717f773fdde657911517de9d74c1eb3931..195498845ed95d6a55cf68537a100b4e83221fb0 
>>> 100644
>>> --- a/hw/vfio/migration.c
>>> +++ b/hw/vfio/migration.c
>>> @@ -622,13 +622,18 @@ static void vfio_state_pending_sync(VFIODevice 
>>> *vbasedev)
>>>   }
>>>
>>>   static void vfio_state_pending(void *opaque, MigPendingData *pending,
>>> -                               bool exact)
>>> +                               bool exact, bool final)
>>>   {
>>>       VFIODevice *vbasedev = opaque;
>>>       VFIOMigration *migration = vbasedev->migration;
>>>       uint64_t precopy_size, stopcopy_size;
>>>
>>> -    if (exact) {
>>> +    /*
>>> +     * The final pending query runs during switchover downtime. 
>>> VFIO does not
>>> +     * need a fresh device pending-data query then to get the 
>>> latest dirty
>>> +     * data, so avoid the extra work and report the cached counters 
>>> below.
>>> +     */
>>> +    if (exact && !final) {
>>>           vfio_state_pending_sync(vbasedev);
>>>       }
>>>
>>> @@ -646,7 +651,7 @@ static void vfio_state_pending(void *opaque, 
>>> MigPendingData *pending,
>>>
>>>       trace_vfio_state_pending(vbasedev->name, 
>>> migration->stopcopy_size,
>>> migration->precopy_init_size,
>>> - migration->precopy_dirty_size, exact);
>>> + migration->precopy_dirty_size, exact, final);
>>>   }
>>>
>>>   static bool vfio_is_active_iterate(void *opaque)
>>> diff --git a/migration/block-dirty-bitmap.c 
>>> b/migration/block-dirty-bitmap.c
>>> index 
>>> 7ef3759e5348a6907c0fb3773e2c6cbb0850632e..cba54e25cd50da924e1958bdfc23ce060784b0ac 
>>> 100644
>>> --- a/migration/block-dirty-bitmap.c
>>> +++ b/migration/block-dirty-bitmap.c
>>> @@ -767,13 +767,16 @@ static int dirty_bitmap_save_complete(QEMUFile 
>>> *f, void *opaque)
>>>   }
>>>
>>>   static void dirty_bitmap_state_pending(void *opaque, 
>>> MigPendingData *data,
>>> -                                       bool exact)
>>> +                                       bool exact, bool final)
>>>   {
>>>       DBMSaveState *s = &((DBMState *)opaque)->save;
>>>       SaveBitmapState *dbms;
>>>       uint64_t pending = 0;
>>>
>>> -    bql_lock();
>>> +    /* Final pending query is called with BQL locked */
>>> +    if (!final) {
>>> +        bql_lock();
>>> +    }
>>>
>>>       QSIMPLEQ_FOREACH(dbms, &s->dbms_list, entry) {
>>>           uint64_t gran = bdrv_dirty_bitmap_granularity(dbms->bitmap);
>>> @@ -783,7 +786,9 @@ static void dirty_bitmap_state_pending(void 
>>> *opaque, MigPendingData *data,
>>>           pending += DIV_ROUND_UP(sectors * BDRV_SECTOR_SIZE, gran);
>>>       }
>>>
>>> -    bql_unlock();
>>> +    if (!final) {
>>> +        bql_unlock();
>>> +    }
>>>
>>>       trace_dirty_bitmap_state_pending(pending);
>>>
>>> diff --git a/migration/migration.c b/migration/migration.c
>>> index 
>>> 0f9e891cf85c8e5074f7f9800515e244fa413fa2..ea0b236597087cc005541e1916ceabb229afab4b 
>>> 100644
>>> --- a/migration/migration.c
>>> +++ b/migration/migration.c
>>> @@ -2787,12 +2787,22 @@ static bool 
>>> migration_switchover_prepare(MigrationState *s)
>>>   static bool migration_switchover_start(MigrationState *s, Error 
>>> **errp)
>>>   {
>>>       ERRP_GUARD();
>>> +    MigPendingData pending = {};
>>>
>>>       if (!migration_switchover_prepare(s)) {
>>>           error_setg(errp, "Switchover is interrupted");
>>>           return false;
>>>       }
>>>
>>> +    /*
>>> +     * The final query to the whole system on dirty data to make 
>>> sure we
>>> +     * collect the latest status of the VM.  For precopy, source 
>>> QEMU will
>>> +     * dump all the dirty data during switchover.  For postcopy, 
>>> this will
>>> +     * properly update all the dirty bitmaps to finally generate the
>>> +     * correct discard bitmaps; see 
>>> ram_postcopy_send_discard_bitmap().
>>> +     */
>>> +    qemu_savevm_query_pending_final(&pending);
>>> +
>>>       /* Inactivate disks except in COLO */
>>>       if (!migrate_colo()) {
>>>           /*
>>> @@ -3285,7 +3295,7 @@ static void 
>>> migration_iteration_go_next(MigPendingData *pending)
>>>       /*
>>>        * Do a slow sync first before boosting the iteration count.
>>>        */
>>> -    qemu_savevm_query_pending(pending, true);
>>> +    qemu_savevm_query_pending_iter(pending, true);
>>>
>>>       /*
>>>        * Update the dirty information for the whole system for this
>>> @@ -3336,7 +3346,7 @@ static MigIterateState 
>>> migration_iteration_run(MigrationState *s)
>>>       bool complete_ready;
>>>
>>>       /* Fast path - get the estimated amount of pending data */
>>> -    qemu_savevm_query_pending(&pending, false);
>>> +    qemu_savevm_query_pending_iter(&pending, false);
>>>
>>>       if (in_postcopy) {
>>>           /*
>>> diff --git a/migration/ram.c b/migration/ram.c
>>> index 
>>> 55aa9b47dc8ab8463fd1aeba19726a493b81b070..8918b2f03b6fbcc98532bb45ab905f9bac59384c 
>>> 100644
>>> --- a/migration/ram.c
>>> +++ b/migration/ram.c
>>> @@ -2686,9 +2686,6 @@ void 
>>> ram_postcopy_send_discard_bitmap(MigrationState *ms)
>>>
>>>       RCU_READ_LOCK_GUARD();
>>>
>>> -    /* This should be our last sync, the src is now paused */
>>> -    migration_bitmap_sync_precopy(true);
>>> -
>>>       /* Easiest way to make sure we don't resume in the middle of a 
>>> host-page */
>>>       rs->pss[RAM_CHANNEL_PRECOPY].last_sent_block = NULL;
>>>       rs->last_seen_block = NULL;
>>> @@ -3376,10 +3373,6 @@ static int ram_save_complete(QEMUFile *f, 
>>> void *opaque)
>>>       rs->last_stage = !migration_in_colo_state();
>>>
>>>       WITH_RCU_READ_LOCK_GUARD() {
>>> -        if (!migration_in_postcopy()) {
>>> -            migration_bitmap_sync_precopy(true);
>>> -        }
>>> -
>>
>> (Got some technical issues receiving QEMU ML mails that I'm not CCed 
>> to, so replying here for Stefan's mail [1])
>>
>> Seems like this patch overlooked the COLO case which calls 
>> ram_save_complete() on each checkpoint and expects the RAM complete 
>> handler to sync RAM dirty bitmap.
>> This patch moved this dirty sync from ram_save_complete() (the 
>> removed lines above) into a qemu_savevm_query_pending_final() called 
>> only once at migration_switchover_start().
>>
>> I believe this is the root cause for the CI failure reported by 
>> Stefan, since I was able to repro this locally [2] and the diff below 
>> [3] fixed the issue [4].
>>
>> I have zero knowledge in COLO so would really appreciate some 
>> feedback from Peter/COLO folks if that's a valid fix.
>>
>> Thanks.
>>
>> [1] 
>> https://lore.kernel.org/qemu-devel/CAJSP0QX-8L2CSX5q95Md5V6NTE_4p+K8Kr-QGbqKm2BBMtdh5Q@mail.gmail.com/
>>
>> [2]
>>
>> QTEST_QEMU_BINARY=./qemu-system-x86_64 ./tests/qtest/migration-test 
>> -k --full -r /x86_64/migration/colo
>> [...]
>> # Running /x86_64/migration/colo/plain/secondary_failover
>> # Using machine type: pc-q35-11.1
>> # starting QEMU: exec ./qemu-system-x86_64 -qtest 
>> unix:/tmp/qtest-1415533.sock -qtest-log /dev/null -chardev 
>> socket,path=/tmp/qtest-1415533.qmp,id=char0 -mon 
>> chardev=char0,mode=control -display none -audio
>> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
>> pc-q35-11.1, -name source,debug-threads=on -machine 
>> memory-backend=mig.mem -object 
>> memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>>   file:/tmp/migration-test-GF36R3/src_serial -drive 
>> if=none,id=d0,file=/tmp/migration-test-GF36R3/bootsect,format=raw 
>> -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null 
>> -accel qtest
>> # starting QEMU: exec ./qemu-system-x86_64 -qtest 
>> unix:/tmp/qtest-1415533.sock -qtest-log /dev/null -chardev 
>> socket,path=/tmp/qtest-1415533.qmp,id=char0 -mon 
>> chardev=char0,mode=control -display none -audio
>> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
>> pc-q35-11.1, -name target,debug-threads=on -machine 
>> memory-backend=mig.mem -object 
>> memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>>   file:/tmp/migration-test-GF36R3/dest_serial -incoming defer -drive 
>> if=none,id=d0,file=/tmp/migration-test-GF36R3/bootsect,format=raw 
>> -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  -a
>> ccel qtest
>> Memory content inconsistency at ea2000 first_byte = 53 last_byte = 53 
>> current = 54 hit_edge = 0
>> Memory content inconsistency at ea3000 first_byte = 53 last_byte = 53 
>> current = 54 hit_edge = 0
>> Memory content inconsistency at ea4000 first_byte = 53 last_byte = 53 
>> current = 54 hit_edge = 0
>> Memory content inconsistency at ea5000 first_byte = 53 last_byte = 53 
>> current = 54 hit_edge = 0
>> Memory content inconsistency at ea6000 first_byte = 53 last_byte = 53 
>> current = 54 hit_edge = 0
>> Memory content inconsistency at ea7000 first_byte = 53 last_byte = 53 
>> current = 54 hit_edge = 0
>> Memory content inconsistency at ea8000 first_byte = 53 last_byte = 53 
>> current = 54 hit_edge = 0
>> Memory content inconsistency at ea9000 first_byte = 53 last_byte = 53 
>> current = 54 hit_edge = 0
>> Memory content inconsistency at eaa000 first_byte = 53 last_byte = 53 
>> current = 54 hit_edge = 0
>> Memory content inconsistency at eab000 first_byte = 53 last_byte = 53 
>> current = 54 hit_edge = 0
>> and in another 13488 pages**
>> ERROR:../tests/qtest/migration/framework.c:190:check_guests_ram: 
>> assertion failed: (bad == 0)
>> not ok /x86_64/migration/colo/plain/secondary_failover - 
>> ERROR:../tests/qtest/migration/framework.c:190:check_guests_ram: 
>> assertion failed: (bad == 0)
>> Bail out!
>>
>> [3]
>>
>> diff --git a/migration/colo.c b/migration/colo.c
>> index 2d36f933cf..5c486c09ef 100644
>> --- a/migration/colo.c
>> +++ b/migration/colo.c
>> @@ -409,6 +409,7 @@ static int 
>> colo_do_checkpoint_transaction(MigrationState *s,
>>                                             QEMUFile *fb)
>>   {
>>       Error *local_err = NULL;
>> +    MigPendingData pending = {};
>>       int ret = -1;
>>
>>       colo_send_message(s->to_dst_file, COLO_MESSAGE_CHECKPOINT_REQUEST,
>> @@ -465,6 +466,18 @@ static int 
>> colo_do_checkpoint_transaction(MigrationState *s,
>>       if (migrate_auto_converge()) {
>>           mig_throttle_counter_reset();
>>       }
>> +
>> +    /*
>> +     * Run the final pending query so migration modules can flush 
>> their dirty
>> +     * state (e.g., RAM syncs its dirty bitmap) before this 
>> checkpoint's live
>> +     * state is saved. Unlike a regular switchover, COLO reaches 
>> completion
>> +     * repeatedly for every checkpoint, so this must be done on each 
>> one.
>> +     */
>> +    if (!qemu_savevm_query_pending_final(s, &pending, &local_err)) {
>> +        bql_unlock();
>> +        goto out;
>> +    }
>> +
>>       /*
>>        * Only save VM's live state, which not including device state.
>>        * TODO: We may need a timeout mechanism to prevent COLO process
>>
>> [4]
>>
>> QTEST_QEMU_BINARY=./qemu-system-x86_64 ./tests/qtest/migration-test 
>> -k --full -r /x86_64/migration/colo
>> [...]
>> # Running /x86_64/migration/colo/plain/secondary_failover
>> # Using machine type: pc-q35-11.1
>> # starting QEMU: exec ./qemu-system-x86_64 -qtest 
>> unix:/tmp/qtest-1417324.sock -qtest-log /dev/null -chardev 
>> socket,path=/tmp/qtest-1417324.qmp,id=char0 -mon 
>> chardev=char0,mode=control -display none -audio
>> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
>> pc-q35-11.1, -name source,debug-threads=on -machine 
>> memory-backend=mig.mem -object 
>> memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>>   file:/tmp/migration-test-0TMNR3/src_serial -drive 
>> if=none,id=d0,file=/tmp/migration-test-0TMNR3/bootsect,format=raw 
>> -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null 
>> -accel qtest
>> # starting QEMU: exec ./qemu-system-x86_64 -qtest 
>> unix:/tmp/qtest-1417324.sock -qtest-log /dev/null -chardev 
>> socket,path=/tmp/qtest-1417324.qmp,id=char0 -mon 
>> chardev=char0,mode=control -display none -audio
>> none -run-with exit-with-parent=on -accel kvm -accel tcg -machine 
>> pc-q35-11.1, -name target,debug-threads=on -machine 
>> memory-backend=mig.mem -object 
>> memory-backend-ram,id=mig.mem,size=150M,share=off -serial
>>   file:/tmp/migration-test-0TMNR3/dest_serial -incoming defer -drive 
>> if=none,id=d0,file=/tmp/migration-test-0TMNR3/bootsect,format=raw 
>> -device ide-hd,drive=d0,secs=1,cyls=1,heads=1 -snapshot 2>/dev/null  -a
>> ccel qtest
>> ok 2 /x86_64/migration/colo/plain/secondary_failover
>
>
> The culprit appears to be patch 3:
>
>   migration: Run final save_query_pending at switchover
>
> I can reproduce the issue consistently with:
>
> while [ 1 ]; do
>     QTEST_QEMU_BINARY=./build/qemu-system-s390x \
>         ./build/tests/qtest/migration-test \
>         --full -p 
> /s390x/migration/colo/plain/secondary_failover_checkpoint || break
> done
>
> The patch you proposed seems to fix the issue.
>
> Could you send it as a follow-up patch? 

To make sure I get it straight, you suggest to merge your pull request 
and then send a separate fix patch for that with a proper Fixes tag, right?

> if Peter, Fabiano, Lukas
> would prefer it to be integrated in the appropriate place, it
> could be included in v5.
>
>
> Thanks,
>
> C.
>

Re: [PULL 17/23] vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature

[Avihai Horon]

On 7/3/2026 12:16 PM, Philippe Mathieu-Daudé wrote:
> External email: Use caution opening links or attachments
>
>
> On 3/7/26 10:13, Avihai Horon wrote:
>>
>> On 7/3/2026 5:07 AM, Philippe Mathieu-Daudé wrote:
>>> External email: Use caution opening links or attachments
>>>
>>>
>>> On 30/6/26 06:31, Cédric Le Goater wrote:
>>>> From: Avihai Horon <avihaih@nvidia.com>
>>>>
>>>> According to VFIO uAPI, precopy initial_bytes is considered as 
>>>> critical
>>>> data that should be transferred and loaded prior to moving to 
>>>> STOP_COPY
>>>> state to ensure precopy phase would be effective.
>>>>
>>>> As currently defined, initial_bytes can only decrease as it's being 
>>>> read
>>>> from the data fd. However, there are cases where a new chunk of
>>>> initial_bytes should be transferred during precopy.
>>>>
>>>> The new VFIO_PRECOPY_INFO_REINIT feature addresses this and allows
>>>> reporting a new value for initial_bytes regardless of any previously
>>>> reported values.
>>>>
>>>> Implement VFIO_PRECOPY_INFO_REINIT feature:
>>>> 1. Opt-in for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 to make
>>>>     VFIO_PRECOPY_INFO_REINIT available.
>>>> 2. Request a new switchover ACK if initial_bytes increases post of a
>>>>     previous switchover ACK. This ensures the device is not moved to
>>>>     STOP_COPY before initial_bytes has reached zero again.
>>>>
>>>> Acked-by: Peter Xu <peterx@redhat.com>
>>>> Signed-off-by: Avihai Horon <avihaih@nvidia.com>
>>>> Link: 
>>>> https://lore.kernel.org/qemu-devel/20260622101214.25770-13-
>>>> avihaih@nvidia.com
>>>> Signed-off-by: Cédric Le Goater <clg@redhat.com>
>>>> ---
>>>>   docs/devel/migration/vfio.rst     | 14 +++++++
>>>>   hw/vfio/vfio-migration-internal.h |  1 +
>>>>   hw/vfio/migration.c               | 68 
>>>> ++++++++++++++++++++++++++++---
>>>>   hw/vfio/trace-events              |  4 +-
>>>>   4 files changed, 80 insertions(+), 7 deletions(-)
>>>
>>>
>>>> +/* Returns 1 on success, 0 if not supported and negative errno on
>>>> failure */
>>>> +static int vfio_migration_set_precopy_info_v2(VFIODevice *vbasedev)
>>>> +{
>>>> +    uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature),
>>>> +                              sizeof(uint64_t))] = {};
>>>
>>> What is the point of using uint64_t[] here?
>>
>> Since there is no data payload in this case, it's mainly for consistency
>> with other VFIO_DEVICE_FEATURE ioctl call sites.
>
> Ah, I didn't noticed. Does the VFIO_DEVICE_FEATURE ioctl expect
> the buffer to be 64-bit aligned?

Nope.
AFAIU, the 64-bit alignment is for userspace, for the data payload to be 
aligned, in case it holds some 64-bit members.

>
>>
>> Thanks.
>>
>>>
>>>> +    struct vfio_device_feature *feature = (struct
>>>> vfio_device_feature *)buf;
>>>> +
>>>> +    feature->argsz = sizeof(buf);
>>>> +    feature->flags =
>>>> +        VFIO_DEVICE_FEATURE_SET |
>>>> VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2;
>>>> +    if (ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature)) {
>>>> +        if (errno == ENOTTY) {
>>>> +            return 0;
>>>> +        }
>>>> +
>>>> +        return -errno;
>>>> +    }
>>>> +
>>>> +    return 1;
>>>> +}
>>>
>

Re: [PULL 08/23] migration: Run final save_query_pending at switchover

[Cédric Le Goater]

>> The culprit appears to be patch 3:
>>
>>   migration: Run final save_query_pending at switchover
>>
>> I can reproduce the issue consistently with:
>>
>> while [ 1 ]; do
>>     QTEST_QEMU_BINARY=./build/qemu-system-s390x \
>>         ./build/tests/qtest/migration-test \
>>         --full -p /s390x/migration/colo/plain/secondary_failover_checkpoint || break
>> done
>>
>> The patch you proposed seems to fix the issue.
>>
>> Could you send it as a follow-up patch? 
> 
> To make sure I get it straight, you suggest to merge your pull request 

The merge request won't be merged as is. It's broken and I will
have to resend with a fix or without this series.

> and then send a separate fix patch for that with a proper Fixes tag, right?

We either handle the breakage with an extra patch like you proposed,
which has to be sent and reviewed, or :

>> if Peter, Fabiano, Lukas
>> would prefer it to be integrated in the appropriate place, it
>> could be included in v5.
We can address this in a v5 respin of the series by fixing it
where it belongs: in patch 3. I think that's the right place,
since bisect breaks at that point.

Let's see what Peter and Fabiano think.


Thanks,

C.

Re: [PULL 08/23] migration: Run final save_query_pending at switchover

[Avihai Horon]

On 7/3/2026 5:01 PM, Cédric Le Goater wrote:
> External email: Use caution opening links or attachments
>
>
>>> The culprit appears to be patch 3:
>>>
>>>   migration: Run final save_query_pending at switchover
>>>
>>> I can reproduce the issue consistently with:
>>>
>>> while [ 1 ]; do
>>>     QTEST_QEMU_BINARY=./build/qemu-system-s390x \
>>>         ./build/tests/qtest/migration-test \
>>>         --full -p 
>>> /s390x/migration/colo/plain/secondary_failover_checkpoint || break
>>> done
>>>
>>> The patch you proposed seems to fix the issue.
>>>
>>> Could you send it as a follow-up patch?
>>
>> To make sure I get it straight, you suggest to merge your pull request
>
> The merge request won't be merged as is. It's broken and I will
> have to resend with a fix or without this series.
>
>> and then send a separate fix patch for that with a proper Fixes tag, 
>> right?
>
> We either handle the breakage with an extra patch like you proposed,
> which has to be sent and reviewed, or :
>
>>> if Peter, Fabiano, Lukas
>>> would prefer it to be integrated in the appropriate place, it
>>> could be included in v5.
> We can address this in a v5 respin of the series by fixing it
> where it belongs: in patch 3. I think that's the right place,
> since bisect breaks at that point.
>
> Let's see what Peter and Fabiano think.

Hi Cedric,

I got the v5 ready to submit (it has the COLO fix + two new patches on 
top: one to refactor migration_completion_precopy to return bool and 
another to fix switchover typos).

Would you like me to send it?

Thanks.

Re: [PULL 08/23] migration: Run final save_query_pending at switchover

[Cédric Le Goater]

On 7/6/26 10:00, Avihai Horon wrote:
> 
> On 7/3/2026 5:01 PM, Cédric Le Goater wrote:
>> External email: Use caution opening links or attachments
>>
>>
>>>> The culprit appears to be patch 3:
>>>>
>>>>   migration: Run final save_query_pending at switchover
>>>>
>>>> I can reproduce the issue consistently with:
>>>>
>>>> while [ 1 ]; do
>>>>     QTEST_QEMU_BINARY=./build/qemu-system-s390x \
>>>>         ./build/tests/qtest/migration-test \
>>>>         --full -p /s390x/migration/colo/plain/secondary_failover_checkpoint || break
>>>> done
>>>>
>>>> The patch you proposed seems to fix the issue.
>>>>
>>>> Could you send it as a follow-up patch?
>>>
>>> To make sure I get it straight, you suggest to merge your pull request
>>
>> The merge request won't be merged as is. It's broken and I will
>> have to resend with a fix or without this series.
>>
>>> and then send a separate fix patch for that with a proper Fixes tag, right?
>>
>> We either handle the breakage with an extra patch like you proposed,
>> which has to be sent and reviewed, or :
>>
>>>> if Peter, Fabiano, Lukas
>>>> would prefer it to be integrated in the appropriate place, it
>>>> could be included in v5.
>> We can address this in a v5 respin of the series by fixing it
>> where it belongs: in patch 3. I think that's the right place,
>> since bisect breaks at that point.
>>
>> Let's see what Peter and Fabiano think.
> 
> Hi Cedric,
> 
> I got the v5 ready to submit (it has the COLO fix + two new patches on top: one to refactor migration_completion_precopy to return bool and another to fix switchover typos).
> 
> Would you like me to send it?

sure. sooner the better !

Thanks,

C.