Re: [PATCH v5 08/16] migration: Fail migration if switchover-ack is requested after switchover decision

[Lukas Straub <lukasstraub2@web.de>]

[-- Attachment #1: Type: text/plain, Size: 4890 bytes --]

On Mon, 6 Jul 2026 11:52:03 +0300
Avihai Horon <avihaih@nvidia.com> wrote:

> Switchover ACK is checked only during precopy while the guest is still
> running. The last migration_can_switchover() decision and guest stop are
> not atomic, so a device may want to request another switchover ACK in
> the gap after switchover decision has been made but before the guest is
> stopped. Migration would then miss that request, which can increase
> downtime.
> 
> Cover this case by failing the migration if a switchover-ack was
> requested during that time.
> 
> Ideally, precopy iterations should be resumed in this case, however,
> VFIO doesn't support going back to precopy after being stopped, so
> implementing such logic would require non-trivial changes to the guest
> start/stop flow. Given the above and that this case should be rare,
> failing the migration seems reasonable.
> 
> Signed-off-by: Avihai Horon <avihaih@nvidia.com>

For the COLO parts:
Reviewed-by: Lukas Straub <lukasstraub2@web.de>
Tested-by: Lukas Straub <lukasstraub2@web.de>

> ---
>  migration/savevm.h    |  4 ++--
>  migration/colo.c      |  6 +++++-
>  migration/migration.c |  4 +++-
>  migration/savevm.c    | 19 ++++++++++++++++++-
>  4 files changed, 28 insertions(+), 5 deletions(-)
> 
> diff --git a/migration/savevm.h b/migration/savevm.h
> index fb92d3bc85..415198423f 100644
> --- a/migration/savevm.h
> +++ b/migration/savevm.h
> @@ -47,8 +47,8 @@ void qemu_savevm_state_complete_postcopy(QEMUFile *f);
>  int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
>  void qemu_savevm_query_pending_iter(MigrationState *s, MigPendingData *pending,
>                                      bool exact);
> -void qemu_savevm_query_pending_final(MigrationState *s,
> -                                     MigPendingData *pending);
> +bool qemu_savevm_query_pending_final(MigrationState *s,
> +                                     MigPendingData *pending, Error **errp);
>  int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
>  bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
>  void qemu_savevm_state_end(QEMUFile *f);
> diff --git a/migration/colo.c b/migration/colo.c
> index 0cef0f6b0e..0f30a5926f 100644
> --- a/migration/colo.c
> +++ b/migration/colo.c
> @@ -473,7 +473,11 @@ static int colo_do_checkpoint_transaction(MigrationState *s,
>       * state is saved. Unlike a regular switchover, COLO reaches completion
>       * repeatedly for every checkpoint, so this must be done on each one.
>       */
> -    qemu_savevm_query_pending_final(s, &pending);
> +    if (!qemu_savevm_query_pending_final(s, &pending, &local_err)) {
> +        ret = -1;
> +        bql_unlock();
> +        goto out;
> +    }
>  
>      /*
>       * Only save VM's live state, which not including device state.
> diff --git a/migration/migration.c b/migration/migration.c
> index 2b625da114..98603ee19c 100644
> --- a/migration/migration.c
> +++ b/migration/migration.c
> @@ -2833,7 +2833,9 @@ static bool migration_switchover_start(MigrationState *s, Error **errp)
>       * properly update all the dirty bitmaps to finally generate the
>       * correct discard bitmaps; see ram_postcopy_send_discard_bitmap().
>       */
> -    qemu_savevm_query_pending_final(s, &pending);
> +    if (!qemu_savevm_query_pending_final(s, &pending, errp)) {
> +        return false;
> +    }
>  
>      /* Inactivate disks except in COLO */
>      if (!migrate_colo()) {
> diff --git a/migration/savevm.c b/migration/savevm.c
> index 1f6e696c50..f654a1c563 100644
> --- a/migration/savevm.c
> +++ b/migration/savevm.c
> @@ -1852,11 +1852,28 @@ void qemu_savevm_query_pending_iter(MigrationState *s, MigPendingData *pending,
>      qemu_savevm_query_pending(s, pending, exact, false);
>  }
>  
> -void qemu_savevm_query_pending_final(MigrationState *s, MigPendingData *pending)
> +bool qemu_savevm_query_pending_final(MigrationState *s, MigPendingData *pending,
> +                                     Error **errp)
>  {
>      g_assert(bql_locked());
>  
>      qemu_savevm_query_pending(s, pending, true, true);
> +
> +    /*
> +     * Switchover-ack requests done after switchover decision are not allowed.
> +     * Fail the migration in this case since we currently don't support going
> +     * back to precopy.
> +     */
> +    if (migrate_switchover_ack() && !migrate_switchover_ack_legacy() &&
> +        pending->switchover_ack_pending > 0) {
> +        error_setg(errp,
> +                   "Switchover ACK was requested by %" PRIu32
> +                   " devices during switchover",
> +                   pending->switchover_ack_pending);
> +        return false;
> +    }
> +
> +    return true;
>  }
>  
>  void qemu_savevm_state_cleanup(void)


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]