* [PULL 01/27] vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom()
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
@ 2026-07-07 6:28 ` Cédric Le Goater
2026-07-07 6:28 ` [PULL 02/27] vfio/pci: Fix information leak in vfio_rom_read() Cédric Le Goater
` (26 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:28 UTC (permalink / raw)
To: qemu-devel; +Cc: Mario Casquero, Cédric Le Goater
From: Mario Casquero <mcasquer@redhat.com>
When vfio_device_get_region_info() fails in vfio_pci_load_rom(),
the function returns without setting vdev->rom_read_failed to true,
and without allocating vdev->rom. This leaves vdev->rom as NULL.
Signed-off-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260602070857.356526-1-mcasquer@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/vfio/pci.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 4d822b96b530c614671551589ce3584e9598f386..68ee3ce7dc254dd045ed2c1b21bebc53a4b4e3d6 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -1028,7 +1028,7 @@ static void vfio_update_msi(VFIOPCIDevice *vdev)
}
}
-static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
+static bool vfio_pci_load_rom(VFIOPCIDevice *vdev)
{
VFIODevice *vbasedev = &vdev->vbasedev;
struct vfio_region_info *reg_info = NULL;
@@ -1042,7 +1042,7 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
if (ret != 0) {
error_report("vfio: Error getting ROM info: %s", strerror(-ret));
- return;
+ return false;
}
trace_vfio_pci_load_rom(vbasedev->name, (unsigned long)reg_info->size,
@@ -1053,12 +1053,11 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
vdev->rom_offset = reg_info->offset;
if (!vdev->rom_size) {
- vdev->rom_read_failed = true;
error_report("vfio-pci: Cannot read device rom at %s", vbasedev->name);
error_printf("Device option ROM contents are probably invalid "
"(check dmesg).\nSkip option ROM probe with rombar=0, "
"or load from file with romfile=\n");
- return;
+ return false;
}
vdev->rom = g_malloc(size);
@@ -1114,6 +1113,8 @@ static void vfio_pci_load_rom(VFIOPCIDevice *vdev)
data[6] = -csum;
}
}
+
+ return true;
}
/* "Raw" read of underlying config space. */
@@ -1147,7 +1148,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
/* Load the ROM lazily when the guest tries to read it */
if (unlikely(!vdev->rom && !vdev->rom_read_failed)) {
- vfio_pci_load_rom(vdev);
+ vdev->rom_read_failed = !vfio_pci_load_rom(vdev);
}
memcpy(&val, vdev->rom + addr,
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 02/27] vfio/pci: Fix information leak in vfio_rom_read()
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
2026-07-07 6:28 ` [PULL 01/27] vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom() Cédric Le Goater
@ 2026-07-07 6:28 ` Cédric Le Goater
2026-07-07 6:28 ` [PULL 03/27] docs: Update vfio-user spec to describe DMA access mode bits Cédric Le Goater
` (25 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:28 UTC (permalink / raw)
To: qemu-devel
Cc: Cédric Le Goater, Philippe Mathieu-Daudé,
Mario Casquero
vfio_rom_read() can leak uninitialized stack data to the guest when a
read occurs at the end boundary of the ROM BAR.
Fix this by initializing the val union to 0xff, matching the ROM
initialization pattern used in vfio_pci_load_rom().
Reviewed-by: Philippe Mathieu-Daudé <philmd@mailo.com>
Reviewed-by: Mario Casquero <mcasquer@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260602074446.1206892-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/vfio/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 68ee3ce7dc254dd045ed2c1b21bebc53a4b4e3d6..6b04c6f94f9ade765e236d457e4828ac6199680a 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -1143,7 +1143,7 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
uint16_t word;
uint32_t dword;
uint64_t qword;
- } val;
+ } val = { .qword = ~0ULL };
uint64_t data = 0;
/* Load the ROM lazily when the guest tries to read it */
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 03/27] docs: Update vfio-user spec to describe DMA access mode bits
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
2026-07-07 6:28 ` [PULL 01/27] vfio/pci: Initialize rom_read_failed in vfio_pci_load_rom() Cédric Le Goater
2026-07-07 6:28 ` [PULL 02/27] vfio/pci: Fix information leak in vfio_rom_read() Cédric Le Goater
@ 2026-07-07 6:28 ` Cédric Le Goater
2026-07-07 6:28 ` [PULL 04/27] vfio-user: validate VERSION replies Cédric Le Goater
` (24 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:28 UTC (permalink / raw)
To: qemu-devel; +Cc: Mattias Nissler, John Levon, Cédric Le Goater
From: Mattias Nissler <mnissler@meta.com>
This makes the intended access mode explicit when registering DMA
regions with the server. A new "file I/O" access mode is defined, which
can be used if the file descriptor provided by the client doesn't
support `mmap()`.
Signed-off-by: Mattias Nissler <mnissler@meta.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20260602133829.305842-1-mnissler@meta.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
docs/interop/vfio-user.rst | 82 ++++++++++++++++++++++++--------------
1 file changed, 51 insertions(+), 31 deletions(-)
diff --git a/docs/interop/vfio-user.rst b/docs/interop/vfio-user.rst
index 12deb25102af217f7f292b4cb655dc4a6a92439a..1c92f442d232ce6ce880868bb7062e42481b69ae 100644
--- a/docs/interop/vfio-user.rst
+++ b/docs/interop/vfio-user.rst
@@ -604,27 +604,31 @@ Request
The request payload for this message is a structure of the following format:
-+-------------+--------+-------------+
-| Name | Offset | Size |
-+=============+========+=============+
-| argsz | 0 | 4 |
-+-------------+--------+-------------+
-| flags | 4 | 4 |
-+-------------+--------+-------------+
-| | +-----+------------+ |
-| | | Bit | Definition | |
-| | +=====+============+ |
-| | | 0 | readable | |
-| | +-----+------------+ |
-| | | 1 | writeable | |
-| | +-----+------------+ |
-+-------------+--------+-------------+
-| offset | 8 | 8 |
-+-------------+--------+-------------+
-| address | 16 | 8 |
-+-------------+--------+-------------+
-| size | 24 | 8 |
-+-------------+--------+-------------+
++-------------+--------+------------------------+
+| Name | Offset | Size |
++=============+========+========================+
+| argsz | 0 | 4 |
++-------------+--------+------------------------+
+| flags | 4 | 4 |
++-------------+--------+------------------------+
+| | +-----+-----------------------+ |
+| | | Bit | Definition | |
+| | +=====+=======================+ |
+| | | 0 | readable | |
+| | +-----+-----------------------+ |
+| | | 1 | writeable | |
+| | +-----+-----------------------+ |
+| | | 2 | access mode: mmap | |
+| | +-----+-----------------------+ |
+| | | 3 | access mode: file I/O | |
+| | +-----+-----------------------+ |
++-------------+--------+------------------------+
+| offset | 8 | 8 |
++-------------+--------+------------------------+
+| address | 16 | 8 |
++-------------+--------+------------------------+
+| size | 24 | 8 |
++-------------+--------+------------------------+
* *argsz* is the size of the above structure. Note there is no reply payload,
so this field differs from other message types.
@@ -634,6 +638,8 @@ The request payload for this message is a structure of the following format:
* *writeable* indicates that the region can be written to.
+ * *access mode* bits indicate how the region is to be accessed by the server.
+
* *offset* is the file offset of the region with respect to the associated file
descriptor, or zero if the region is not mappable
* *address* is the base DMA address of the region.
@@ -641,16 +647,30 @@ The request payload for this message is a structure of the following format:
This structure is 32 bytes in size, so the message size is 16 + 32 bytes.
-If the DMA region being added can be directly mapped by the server, a file
-descriptor must be sent as part of the message meta-data. The region can be
-mapped via the mmap() system call. On ``AF_UNIX`` sockets, the file descriptor
-must be passed as ``SCM_RIGHTS`` type ancillary data. Otherwise, if the DMA
-region cannot be directly mapped by the server, no file descriptor must be sent
-as part of the message meta-data and the DMA region can be accessed by the
-server using ``VFIO_USER_DMA_READ`` and ``VFIO_USER_DMA_WRITE`` messages,
-explained in `Read and Write Operations`_. A command to map over an existing
-region must be failed by the server with ``EEXIST`` set in error field in the
-reply.
+There are several alternative access modes for the server to use when accessing
+the region:
+
+* ``VFIO_USER_DMA_READ`` and ``VFIO_USER_DMA_WRITE`` messages, explained in
+ `Read and Write Operations`_.
+
+* ``mmap()`` a client-provided file descriptor, then perform direct accesses to
+ the underlying memory.
+
+* File I/O system calls (such as ``pread()`` / ``pwrite()``) against a
+ client-provided file descriptor.
+
+The access mode bits in the flags field indicate which access mode to use. If
+an access mode requiring a file descriptor is specified, but the client does
+not provide a file descriptor, the server must fail the request with
+``EINVAL``. If no access mode flag bit is set, the server should use ``mmap()``
+based access if the client provided a file descriptor and message-based access
+otherwise.
+
+On ``AF_UNIX`` sockets, the file descriptor must be passed as ``SCM_RIGHTS``
+type ancillary data.
+
+A command to map over an existing region must be failed by the server with
+``EEXIST`` set in the error field in the reply.
Reply
^^^^^
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 04/27] vfio-user: validate VERSION replies
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (2 preceding siblings ...)
2026-07-07 6:28 ` [PULL 03/27] docs: Update vfio-user spec to describe DMA access mode bits Cédric Le Goater
@ 2026-07-07 6:28 ` Cédric Le Goater
2026-07-07 6:28 ` [PULL 05/27] vfio/iommufd: Merge .dma_map_file() into .dma_map() Cédric Le Goater
` (23 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:28 UTC (permalink / raw)
To: qemu-devel; +Cc: GuoHan Zhao, John Levon, Cédric Le Goater
From: GuoHan Zhao <zhaoguohan@kylinos.cn>
The vfio-user protocol makes the VERSION payload optional, so a
reply may legally stop after the major and minor fields.
vfio_user_validate_version() currently assumes a capabilities string is
always present and NUL-terminated. When the server replies without
version data, QEMU ends up reusing the request-side capabilities buffer
and the terminating-NUL check underflows. Replies shorter than the fixed
VERSION header are also accessed before they are validated.
Reject replies shorter than the fixed VERSION header and only parse
capabilities when the reply actually carries version data.
Fixes: 36227628d824 (vfio-user: implement message send infrastructure)
Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20260603062138.4008583-1-zhaoguohan@kylinos.cn
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/vfio-user/proxy.c | 21 ++++++++++++++-------
1 file changed, 14 insertions(+), 7 deletions(-)
diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index 0f7d8425d61488f6af3747db4b9f5c774f3fc717..197aee07bf7a3e16b58f77b0ecb73bff46889ecb 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -1292,7 +1292,7 @@ bool vfio_user_validate_version(VFIOUserProxy *proxy, Error **errp)
{
g_autofree VFIOUserVersion *msgp = NULL;
GString *caps;
- char *reply;
+ const char *reply = "";
int size, caplen;
caps = caps_json();
@@ -1322,17 +1322,24 @@ bool vfio_user_validate_version(VFIOUserProxy *proxy, Error **errp)
return false;
}
- reply = msgp->capabilities;
- if (reply[msgp->hdr.size - sizeof(*msgp) - 1] != '\0') {
- error_setg(errp, "corrupt version reply");
+ if (msgp->hdr.size < sizeof(*msgp)) {
+ error_setg(errp, "short version reply");
return false;
}
- if (!caps_check(proxy, msgp->minor, reply, errp)) {
- return false;
+ if (msgp->hdr.size > sizeof(*msgp)) {
+ reply = msgp->capabilities;
+ if (reply[msgp->hdr.size - sizeof(*msgp) - 1] != '\0') {
+ error_setg(errp, "corrupt version reply");
+ return false;
+ }
+
+ if (!caps_check(proxy, msgp->minor, reply, errp)) {
+ return false;
+ }
}
- trace_vfio_user_version(msgp->major, msgp->minor, msgp->capabilities);
+ trace_vfio_user_version(msgp->major, msgp->minor, reply);
return true;
}
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 05/27] vfio/iommufd: Merge .dma_map_file() into .dma_map()
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (3 preceding siblings ...)
2026-07-07 6:28 ` [PULL 04/27] vfio-user: validate VERSION replies Cédric Le Goater
@ 2026-07-07 6:28 ` Cédric Le Goater
2026-07-07 6:28 ` [PULL 06/27] migration: Propagate errors in migration_completion_precopy() Cédric Le Goater
` (22 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:28 UTC (permalink / raw)
To: qemu-devel; +Cc: Cédric Le Goater, Alex Williamson
Simplify the VFIOIOMMUClass interface by removing the dma_map_file
handler. Move the logic to decide between the standard virtual and
file-backed mapping into the IOMMUFD backend, utilizing the
MemoryRegion already passed to the dma_map handler.
This removes redundant dispatch logic from the generic container layer
and let backends to manage their own mapping strategies. This is
similar to the vfio-user implementation.
Reviewed-by: Alex Williamson <alex@shazbot.org>
Link: https://lore.kernel.org/qemu-devel/20260608055758.359002-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
include/hw/vfio/vfio-container.h | 15 ----------
hw/vfio/container.c | 38 ------------------------
hw/vfio/iommufd.c | 50 +++++++++++++++++++++++---------
3 files changed, 37 insertions(+), 66 deletions(-)
diff --git a/include/hw/vfio/vfio-container.h b/include/hw/vfio/vfio-container.h
index b2e7f4312c31ed4b776ddb195b021e84ebed556f..a15ee2df2b9c82d7c5004685aa91c3339587e06c 100644
--- a/include/hw/vfio/vfio-container.h
+++ b/include/hw/vfio/vfio-container.h
@@ -172,21 +172,6 @@ struct VFIOIOMMUClass {
int (*dma_map)(const VFIOContainer *bcontainer,
hwaddr iova, uint64_t size,
void *vaddr, bool readonly, MemoryRegion *mr);
- /**
- * @dma_map_file
- *
- * Map a file range for the container.
- *
- * @bcontainer: #VFIOContainer to use for map
- * @iova: start address to map
- * @size: size of the range to map
- * @fd: descriptor of the file to map
- * @start: starting file offset of the range to map
- * @readonly: map read only if true
- */
- int (*dma_map_file)(const VFIOContainer *bcontainer,
- hwaddr iova, uint64_t size,
- int fd, unsigned long start, bool readonly);
/**
* @dma_unmap
*
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 56bd9ac0095df7b0f4da85f1d8dcb8d571fa9f2a..d09a6637324c6bf29b2fe22369082f87e280c98f 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -15,7 +15,6 @@
#include <linux/vfio.h>
#include "system/tcg.h"
-#include "system/ramblock.h"
#include "qapi/error.h"
#include "qemu/error-report.h"
#include "hw/vfio/vfio-container.h"
@@ -74,49 +73,12 @@ void vfio_address_space_insert(VFIOAddressSpace *space,
bcontainer->space = space;
}
-static bool vfio_container_can_dma_map_file(VFIOContainer *bcontainer,
- MemoryRegion *mr, int *fd)
-{
- VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
- RAMBlock *rb = mr->ram_block;
-
- if (!vioc->dma_map_file || !rb) {
- return false;
- }
-
- *fd = qemu_ram_get_fd(rb);
- if (*fd < 0) {
- return false;
- }
-
- /*
- * We can use IOMMU DMA mapping (IOMMU_IOAS_MAP_FILE) for :
- *
- * 1) Guest RAM blocks explicitly configured as shared (MAP_SHARED)
- * 2) RAM device sub-regions (MMIO BARs)
- *
- * Private RAM mappings (MAP_PRIVATE) are strictly excluded. Because
- * they are subject to copy-on-write (COW) anomalies, their underlying
- * PFNs can permanently diverge from the backing file
- */
- return qemu_ram_is_shared(rb) || memory_region_is_ram_device(mr);
-}
-
int vfio_container_dma_map(VFIOContainer *bcontainer,
hwaddr iova, uint64_t size,
void *vaddr, bool readonly, MemoryRegion *mr)
{
VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
- int mfd;
- if (vfio_container_can_dma_map_file(bcontainer, mr, &mfd)) {
- RAMBlock *rb = mr->ram_block;
- unsigned long start = vaddr - qemu_ram_get_host_addr(rb);
- unsigned long offset = qemu_ram_get_fd_offset(rb);
-
- return vioc->dma_map_file(bcontainer, iova, size, mfd, start + offset,
- readonly);
- }
g_assert(vioc->dma_map);
return vioc->dma_map(bcontainer, iova, size, vaddr, readonly, mr);
}
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 68f2ae6f9f667bb05c20e452e8c5b43da6558098..6ff668d2597e07c6953cf0f1997514aec199642c 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -20,6 +20,7 @@
#include "trace.h"
#include "qapi/error.h"
#include "system/iommufd.h"
+#include "system/ramblock.h"
#include "hw/core/iommu.h"
#include "hw/core/qdev.h"
#include "hw/vfio/vfio-cpr.h"
@@ -35,26 +36,50 @@
#define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO \
TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
+static bool iommufd_cdev_can_map_file_dma(MemoryRegion *mr, int *fd)
+{
+ RAMBlock *rb = mr ? mr->ram_block : NULL;
+
+ if (!rb) {
+ return false;
+ }
+
+ *fd = qemu_ram_get_fd(rb);
+ if (*fd < 0) {
+ return false;
+ }
+
+ /*
+ * Use iommufd_backend_map_file_dma() (IOMMU_IOAS_MAP_FILE) for:
+ * 1) Guest RAM blocks explicitly configured as shared (MAP_SHARED)
+ * 2) RAM device sub-regions (MMIO BARs)
+ *
+ * Private RAM mappings (MAP_PRIVATE) are excluded: copy-on-write
+ * semantics can cause their underlying PFNs to permanently diverge
+ * from the backing file.
+ */
+ return qemu_ram_is_shared(rb) || memory_region_is_ram_device(mr);
+}
+
static int iommufd_cdev_map(const VFIOContainer *bcontainer, hwaddr iova,
uint64_t size, void *vaddr, bool readonly,
MemoryRegion *mr)
{
const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
+ int fd;
- return iommufd_backend_map_dma(container->be,
- container->ioas_id,
- iova, size, vaddr, readonly);
-}
+ if (iommufd_cdev_can_map_file_dma(mr, &fd)) {
+ RAMBlock *rb = mr->ram_block;
+ unsigned long start = vaddr - qemu_ram_get_host_addr(rb);
+ unsigned long offset = qemu_ram_get_fd_offset(rb);
-static int iommufd_cdev_map_file(const VFIOContainer *bcontainer,
- hwaddr iova, uint64_t size,
- int fd, unsigned long start, bool readonly)
-{
- const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
+ return iommufd_backend_map_file_dma(container->be, container->ioas_id,
+ iova, size, fd,
+ start + offset, readonly);
+ }
- return iommufd_backend_map_file_dma(container->be,
- container->ioas_id,
- iova, size, fd, start, readonly);
+ return iommufd_backend_map_dma(container->be, container->ioas_id,
+ iova, size, vaddr, readonly);
}
static int iommufd_cdev_unmap(const VFIOContainer *bcontainer,
@@ -929,7 +954,6 @@ static void vfio_iommu_iommufd_class_init(ObjectClass *klass, const void *data)
VFIOIOMMUClass *vioc = VFIO_IOMMU_CLASS(klass);
vioc->dma_map = iommufd_cdev_map;
- vioc->dma_map_file = iommufd_cdev_map_file;
vioc->dma_unmap = iommufd_cdev_unmap;
vioc->attach_device = iommufd_cdev_attach;
vioc->detach_device = iommufd_cdev_detach;
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 06/27] migration: Propagate errors in migration_completion_precopy()
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (4 preceding siblings ...)
2026-07-07 6:28 ` [PULL 05/27] vfio/iommufd: Merge .dma_map_file() into .dma_map() Cédric Le Goater
@ 2026-07-07 6:28 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 07/27] migration/ram: Use migration_bitmap_sync_precopy() for postcopy discard Cédric Le Goater
` (21 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:28 UTC (permalink / raw)
To: qemu-devel
Cc: Avihai Horon, Philippe Mathieu-Daudé, Peter Xu,
Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
migration_completion_precopy() doesn't propagate errors to migration
core which leads to error information loss. Fix that.
This prepares for a follow-up where migration_switchover_start() can
fail on switchover-ack and still report a useful error.
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-2-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
migration/savevm.h | 2 +-
migration/migration.c | 13 ++++++++-----
migration/savevm.c | 29 +++++++++++++++++------------
3 files changed, 26 insertions(+), 18 deletions(-)
diff --git a/migration/savevm.h b/migration/savevm.h
index 96fdf96d4ef6f7fd174f50e8c1402f0b6d6b9e1f..b6bb4fa977fae84ed121b0668cdefdf49e3d9c67 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -44,7 +44,7 @@ void qemu_savevm_state_header(QEMUFile *f);
int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy);
void qemu_savevm_state_cleanup(void);
void qemu_savevm_state_complete_postcopy(QEMUFile *f);
-int qemu_savevm_state_complete_precopy(MigrationState *s);
+int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
void qemu_savevm_query_pending(MigPendingData *pending, bool exact);
int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
diff --git a/migration/migration.c b/migration/migration.c
index 0f56432d903054883679a66ac5bd853577b5df66..7e0a0bea7ae823ee5ef6e7ba8876c9222f9ac834 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2820,7 +2820,7 @@ static bool migration_switchover_start(MigrationState *s, Error **errp)
return true;
}
-static int migration_completion_precopy(MigrationState *s)
+static int migration_completion_precopy(MigrationState *s, Error **errp)
{
int ret;
@@ -2829,16 +2829,17 @@ static int migration_completion_precopy(MigrationState *s)
if (!migrate_mode_is_cpr()) {
ret = migration_stop_vm(s, RUN_STATE_FINISH_MIGRATE);
if (ret < 0) {
+ error_setg_errno(errp, -ret, "Failed to stop the VM");
goto out_unlock;
}
}
- if (!migration_switchover_start(s, NULL)) {
+ if (!migration_switchover_start(s, errp)) {
ret = -EFAULT;
goto out_unlock;
}
- ret = qemu_savevm_state_complete_precopy(s);
+ ret = qemu_savevm_state_complete_precopy(s, errp);
out_unlock:
bql_unlock();
return ret;
@@ -2875,7 +2876,7 @@ static void migration_completion(MigrationState *s)
Error *local_err = NULL;
if (s->state == MIGRATION_STATUS_ACTIVE) {
- ret = migration_completion_precopy(s);
+ ret = migration_completion_precopy(s, &local_err);
} else if (s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE) {
migration_completion_postcopy(s);
} else {
@@ -2906,7 +2907,9 @@ static void migration_completion(MigrationState *s)
return;
fail:
- if (qemu_file_get_error_obj(s->to_dst_file, &local_err)) {
+ if (local_err) {
+ migrate_error_propagate(s, local_err);
+ } else if (qemu_file_get_error_obj(s->to_dst_file, &local_err)) {
migrate_error_propagate(s, local_err);
} else if (ret) {
error_setg_errno(&local_err, -ret, "Error in migration completion");
diff --git a/migration/savevm.c b/migration/savevm.c
index 23adaf9dd9263b8dafe808f0637724fe4a5482b2..7e2a0c2b4a7470d9c2159eac1d18ae891740fe3e 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1771,28 +1771,34 @@ int qemu_savevm_state_non_iterable(QEMUFile *f, Error **errp)
return 0;
}
-int qemu_savevm_state_complete_precopy(MigrationState *s)
+int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp)
{
+ ERRP_GUARD();
QEMUFile *f = s->to_dst_file;
- Error *local_err = NULL;
int ret;
ret = qemu_savevm_state_complete_precopy_iterable(f, false);
if (ret) {
+ qemu_file_get_error_obj(f, errp);
+ error_prepend(errp, "Failed to save iterable device state: ");
return ret;
}
- /* TODO: pass error upper */
- ret = qemu_savevm_state_non_iterable(f, &local_err);
+ ret = qemu_savevm_state_non_iterable(f, errp);
if (ret) {
- migrate_error_propagate(s, error_copy(local_err));
- error_report_err(local_err);
return ret;
}
qemu_savevm_state_end_precopy(s, f);
- return qemu_fflush(f);
+ ret = qemu_fflush(f);
+ if (ret) {
+ qemu_file_get_error_obj(f, errp);
+ error_prepend(errp, "Failed to flush QEMUFile: ");
+ return ret;
+ }
+
+ return 0;
}
void qemu_savevm_query_pending(MigPendingData *pending, bool exact)
@@ -1874,13 +1880,12 @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
}
ret = qemu_file_get_error(f);
- if (ret == 0) {
- qemu_savevm_state_complete_precopy(ms);
- ret = qemu_file_get_error(f);
- }
- if (ret != 0) {
+ if (ret) {
error_setg_errno(errp, -ret, "Error while writing VM state");
+ goto cleanup;
}
+
+ ret = qemu_savevm_state_complete_precopy(ms, errp);
cleanup:
qemu_savevm_state_cleanup();
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 07/27] migration/ram: Use migration_bitmap_sync_precopy() for postcopy discard
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (5 preceding siblings ...)
2026-07-07 6:28 ` [PULL 06/27] migration: Propagate errors in migration_completion_precopy() Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 08/27] migration: Run final save_query_pending at switchover Cédric Le Goater
` (20 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Peter Xu, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
ram_postcopy_send_discard_bitmap() performs the final RAM dirty bitmap
sync at postcopy switchover, before sending discard bitmap to the
destination. Unlike the precopy switchover path, it currently calls the
raw migration_bitmap_sync() helper and passes last_stage=false.
Postcopy switchover is also a stopped-VM final sync point, so use
migration_bitmap_sync_precopy(true). This keeps RAM final bitmap sync
handling consistent across precopy and postcopy switchover, including
the precopy bitmap-sync notifier wrapper. Current notifier users are
safe in postcopy: virtio-balloon free-page hinting already opts out when
postcopy-ram is enabled [1].
This prepares for moving the final sync out of RAM completion/discard
paths and into migration_switchover_start(), where the migration core
can run a final save_query_pending pass for all modules uniformly.
[1] fd51e54fa102 ("virtio-balloon: don't start free page hinting if postcopy is possible")
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-3-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
migration/ram.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/migration/ram.c b/migration/ram.c
index bd519f1931cb0d0cde27765a95730179aba03027..55aa9b47dc8ab8463fd1aeba19726a493b81b070 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -2687,7 +2687,7 @@ void ram_postcopy_send_discard_bitmap(MigrationState *ms)
RCU_READ_LOCK_GUARD();
/* This should be our last sync, the src is now paused */
- migration_bitmap_sync(rs, false);
+ migration_bitmap_sync_precopy(true);
/* Easiest way to make sure we don't resume in the middle of a host-page */
rs->pss[RAM_CHANNEL_PRECOPY].last_sent_block = NULL;
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 08/27] migration: Run final save_query_pending at switchover
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (6 preceding siblings ...)
2026-07-07 6:29 ` [PULL 07/27] migration/ram: Use migration_bitmap_sync_precopy() for postcopy discard Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 09/27] migration: Log the approver in qemu_loadvm_approve_switchover() Cédric Le Goater
` (19 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
Before switchover, the source needs one last exact pending query so
modules can flush dirty state. This is currently done ad hoc in modules
handlers. For example, RAM syncs its dirty bitmap in its save_complete
handler.
This should be a general concept relevant for any module, so extract it
to migration core instead by running a final save_query_pending before
switchover.
The final query requires special handling by modules (e.g., it's called
with BQL locked, during VM stop), so extend save_query_pending
SaveVMHandlers callback and qemu_savevm_query_pending() with a "final"
flag so migration modules can tell the last pending query during
switchover from periodic iteration queries.
Call final pending query also in COLO checkpoint, which needs to flush
dirty state before the checkpoint's live state is saved. Unlike a
regular switchover, COLO reaches completion repeatedly for every
checkpoint, so this must be done on each one.
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-4-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
include/migration/register.h | 41 ++++++++++++++++++----------------
migration/savevm.h | 3 ++-
hw/s390x/s390-stattrib.c | 2 +-
hw/vfio/migration.c | 11 ++++++---
migration/block-dirty-bitmap.c | 11 ++++++---
migration/colo.c | 10 +++++++++
migration/migration.c | 14 ++++++++++--
migration/ram.c | 40 +++++++++++++++++++--------------
migration/savevm.c | 20 +++++++++++++----
hw/vfio/trace-events | 2 +-
migration/trace-events | 2 +-
11 files changed, 104 insertions(+), 52 deletions(-)
diff --git a/include/migration/register.h b/include/migration/register.h
index 5e5e0ee432e537781ce78e84b2ff2d81c33e8f37..6f632123f1d0710de0556e68ba53e068a1e02640 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -171,6 +171,28 @@ typedef struct SaveVMHandlers {
*/
bool (*is_active_iterate)(void *opaque);
+ /**
+ * @save_query_pending
+ *
+ * This estimates the remaining data to transfer on the source side.
+ *
+ * When @exact is true, a module must report accurate results. When
+ * @exact is false, a module may report estimates.
+ *
+ * It's highly recommended that modules implement a faster version of
+ * the query path (for example, by proper caching on the counters) if
+ * an accurate query will be time-consuming.
+ *
+ * @opaque: data pointer passed to register_savevm_live()
+ * @pending: pointer to a MigPendingData struct
+ * @exact: set to true for an accurate (slow) query
+ * @final: set to true for the final query during switchover. When final is
+ * true, the query is called with BQL locked. Otherwise, it's called with
+ * BQL unlocked.
+ */
+ void (*save_query_pending)(void *opaque, MigPendingData *pending,
+ bool exact, bool final);
+
/* This runs outside the BQL in the migration case, and
* within the lock in the savevm case. The callback had better only
* use data that is local to the migration thread or protected
@@ -210,25 +232,6 @@ typedef struct SaveVMHandlers {
*/
bool (*save_postcopy_prepare)(QEMUFile *f, void *opaque, Error **errp);
- /**
- * @save_query_pending
- *
- * This estimates the remaining data to transfer on the source side.
- *
- * When @exact is true, a module must report accurate results. When
- * @exact is false, a module may report estimates.
- *
- * It's highly recommended that modules implement a faster version of
- * the query path (for example, by proper caching on the counters) if
- * an accurate query will be time-consuming.
- *
- * @opaque: data pointer passed to register_savevm_live()
- * @pending: pointer to a MigPendingData struct
- * @exact: set to true for an accurate (slow) query
- */
- void (*save_query_pending)(void *opaque, MigPendingData *pending,
- bool exact);
-
/**
* @load_state
*
diff --git a/migration/savevm.h b/migration/savevm.h
index b6bb4fa977fae84ed121b0668cdefdf49e3d9c67..81abd96dda94c6c95cc40b3c188df23d11c19463 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -45,7 +45,8 @@ int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy);
void qemu_savevm_state_cleanup(void);
void qemu_savevm_state_complete_postcopy(QEMUFile *f);
int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
-void qemu_savevm_query_pending(MigPendingData *pending, bool exact);
+void qemu_savevm_query_pending_iter(MigPendingData *pending, bool exact);
+void qemu_savevm_query_pending_final(MigPendingData *pending);
int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
void qemu_savevm_state_end(QEMUFile *f);
diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c
index c334714b31ab4313e26c0cf57091a8cb21e55306..b0f04eb30c7f73e5dd91b1345d71a14cb404a4eb 100644
--- a/hw/s390x/s390-stattrib.c
+++ b/hw/s390x/s390-stattrib.c
@@ -190,7 +190,7 @@ static int cmma_save_setup(QEMUFile *f, void *opaque, Error **errp)
}
static void cmma_state_pending(void *opaque, MigPendingData *pending,
- bool exact)
+ bool exact, bool final)
{
S390StAttribState *sas = S390_STATTRIB(opaque);
S390StAttribClass *sac = S390_STATTRIB_GET_CLASS(sas);
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index fb12b9717f773fdde657911517de9d74c1eb3931..195498845ed95d6a55cf68537a100b4e83221fb0 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -622,13 +622,18 @@ static void vfio_state_pending_sync(VFIODevice *vbasedev)
}
static void vfio_state_pending(void *opaque, MigPendingData *pending,
- bool exact)
+ bool exact, bool final)
{
VFIODevice *vbasedev = opaque;
VFIOMigration *migration = vbasedev->migration;
uint64_t precopy_size, stopcopy_size;
- if (exact) {
+ /*
+ * The final pending query runs during switchover downtime. VFIO does not
+ * need a fresh device pending-data query then to get the latest dirty
+ * data, so avoid the extra work and report the cached counters below.
+ */
+ if (exact && !final) {
vfio_state_pending_sync(vbasedev);
}
@@ -646,7 +651,7 @@ static void vfio_state_pending(void *opaque, MigPendingData *pending,
trace_vfio_state_pending(vbasedev->name, migration->stopcopy_size,
migration->precopy_init_size,
- migration->precopy_dirty_size, exact);
+ migration->precopy_dirty_size, exact, final);
}
static bool vfio_is_active_iterate(void *opaque)
diff --git a/migration/block-dirty-bitmap.c b/migration/block-dirty-bitmap.c
index 7ef3759e5348a6907c0fb3773e2c6cbb0850632e..cba54e25cd50da924e1958bdfc23ce060784b0ac 100644
--- a/migration/block-dirty-bitmap.c
+++ b/migration/block-dirty-bitmap.c
@@ -767,13 +767,16 @@ static int dirty_bitmap_save_complete(QEMUFile *f, void *opaque)
}
static void dirty_bitmap_state_pending(void *opaque, MigPendingData *data,
- bool exact)
+ bool exact, bool final)
{
DBMSaveState *s = &((DBMState *)opaque)->save;
SaveBitmapState *dbms;
uint64_t pending = 0;
- bql_lock();
+ /* Final pending query is called with BQL locked */
+ if (!final) {
+ bql_lock();
+ }
QSIMPLEQ_FOREACH(dbms, &s->dbms_list, entry) {
uint64_t gran = bdrv_dirty_bitmap_granularity(dbms->bitmap);
@@ -783,7 +786,9 @@ static void dirty_bitmap_state_pending(void *opaque, MigPendingData *data,
pending += DIV_ROUND_UP(sectors * BDRV_SECTOR_SIZE, gran);
}
- bql_unlock();
+ if (!final) {
+ bql_unlock();
+ }
trace_dirty_bitmap_state_pending(pending);
diff --git a/migration/colo.c b/migration/colo.c
index 2d36f933cf155c1084565162294a61d32e28fe86..08632d5e4ad0d05de386ecf0af42f648fa24ecf5 100644
--- a/migration/colo.c
+++ b/migration/colo.c
@@ -409,6 +409,7 @@ static int colo_do_checkpoint_transaction(MigrationState *s,
QEMUFile *fb)
{
Error *local_err = NULL;
+ MigPendingData pending = {};
int ret = -1;
colo_send_message(s->to_dst_file, COLO_MESSAGE_CHECKPOINT_REQUEST,
@@ -465,6 +466,15 @@ static int colo_do_checkpoint_transaction(MigrationState *s,
if (migrate_auto_converge()) {
mig_throttle_counter_reset();
}
+
+ /*
+ * Run the final pending query so migration modules can flush their dirty
+ * state (e.g., RAM syncs its dirty bitmap) before this checkpoint's live
+ * state is saved. Unlike a regular switchover, COLO reaches completion
+ * repeatedly for every checkpoint, so this must be done on each one.
+ */
+ qemu_savevm_query_pending_final(&pending);
+
/*
* Only save VM's live state, which not including device state.
* TODO: We may need a timeout mechanism to prevent COLO process
diff --git a/migration/migration.c b/migration/migration.c
index 7e0a0bea7ae823ee5ef6e7ba8876c9222f9ac834..442f950c43cef47ed23856a16bdda3af5549a5bf 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2793,12 +2793,22 @@ static bool migration_switchover_prepare(MigrationState *s)
static bool migration_switchover_start(MigrationState *s, Error **errp)
{
ERRP_GUARD();
+ MigPendingData pending = {};
if (!migration_switchover_prepare(s)) {
error_setg(errp, "Switchover is interrupted");
return false;
}
+ /*
+ * The final query to the whole system on dirty data to make sure we
+ * collect the latest status of the VM. For precopy, source QEMU will
+ * dump all the dirty data during switchover. For postcopy, this will
+ * properly update all the dirty bitmaps to finally generate the
+ * correct discard bitmaps; see ram_postcopy_send_discard_bitmap().
+ */
+ qemu_savevm_query_pending_final(&pending);
+
/* Inactivate disks except in COLO */
if (!migrate_colo()) {
/*
@@ -3291,7 +3301,7 @@ static void migration_iteration_go_next(MigPendingData *pending)
/*
* Do a slow sync first before boosting the iteration count.
*/
- qemu_savevm_query_pending(pending, true);
+ qemu_savevm_query_pending_iter(pending, true);
/*
* Update the dirty information for the whole system for this
@@ -3342,7 +3352,7 @@ static MigIterateState migration_iteration_run(MigrationState *s)
bool complete_ready;
/* Fast path - get the estimated amount of pending data */
- qemu_savevm_query_pending(&pending, false);
+ qemu_savevm_query_pending_iter(&pending, false);
if (in_postcopy) {
/*
diff --git a/migration/ram.c b/migration/ram.c
index 55aa9b47dc8ab8463fd1aeba19726a493b81b070..8918b2f03b6fbcc98532bb45ab905f9bac59384c 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -2686,9 +2686,6 @@ void ram_postcopy_send_discard_bitmap(MigrationState *ms)
RCU_READ_LOCK_GUARD();
- /* This should be our last sync, the src is now paused */
- migration_bitmap_sync_precopy(true);
-
/* Easiest way to make sure we don't resume in the middle of a host-page */
rs->pss[RAM_CHANNEL_PRECOPY].last_sent_block = NULL;
rs->last_seen_block = NULL;
@@ -3376,10 +3373,6 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
rs->last_stage = !migration_in_colo_state();
WITH_RCU_READ_LOCK_GUARD() {
- if (!migration_in_postcopy()) {
- migration_bitmap_sync_precopy(true);
- }
-
ret = rdma_registration_start(f, RAM_CONTROL_FINISH);
if (ret < 0) {
qemu_file_set_error(f, ret);
@@ -3442,25 +3435,38 @@ static int ram_save_complete(QEMUFile *f, void *opaque)
return qemu_fflush(f);
}
-static void ram_state_pending(void *opaque, MigPendingData *pending,
- bool exact)
+static void ram_state_pending_sync(bool exact, bool final)
{
- RAMState **temp = opaque;
- RAMState *rs = *temp;
- uint64_t remaining_size;
-
/*
* Sync is not needed either with: (1) a fast query, or (2) after
* postcopy has started (no new dirty will generate anymore).
*/
- if (exact && !migration_in_postcopy()) {
+ if (!exact || migration_in_postcopy()) {
+ return;
+ }
+
+ /* Final pending query is called with BQL locked */
+ if (!final) {
bql_lock();
- WITH_RCU_READ_LOCK_GUARD() {
- migration_bitmap_sync_precopy(false);
- }
+ }
+
+ WITH_RCU_READ_LOCK_GUARD() {
+ migration_bitmap_sync_precopy(final);
+ }
+
+ if (!final) {
bql_unlock();
}
+}
+
+static void ram_state_pending(void *opaque, MigPendingData *pending,
+ bool exact, bool final)
+{
+ RAMState **temp = opaque;
+ RAMState *rs = *temp;
+ uint64_t remaining_size;
+ ram_state_pending_sync(exact, final);
remaining_size = rs->migration_dirty_pages * TARGET_PAGE_SIZE;
if (migrate_postcopy_ram()) {
diff --git a/migration/savevm.c b/migration/savevm.c
index 7e2a0c2b4a7470d9c2159eac1d18ae891740fe3e..74d622583e345bdc96b9189aad0c8f6bad41964d 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1801,7 +1801,8 @@ int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp)
return 0;
}
-void qemu_savevm_query_pending(MigPendingData *pending, bool exact)
+static void qemu_savevm_query_pending(MigPendingData *pending, bool exact,
+ bool final)
{
SaveStateEntry *se;
@@ -1814,7 +1815,7 @@ void qemu_savevm_query_pending(MigPendingData *pending, bool exact)
if (!qemu_savevm_state_active(se)) {
continue;
}
- se->ops->save_query_pending(se->opaque, pending, exact);
+ se->ops->save_query_pending(se->opaque, pending, exact, final);
}
pending->total_bytes = pending->precopy_bytes +
@@ -1826,13 +1827,24 @@ void qemu_savevm_query_pending(MigPendingData *pending, bool exact)
* close to reality when this got invoked frequently while iterating.
*/
mig_stats.dirty_bytes_total = pending->total_bytes;
-
- trace_qemu_savevm_query_pending(exact, pending->precopy_bytes,
+ trace_qemu_savevm_query_pending(exact, final, pending->precopy_bytes,
pending->stopcopy_bytes,
pending->postcopy_bytes,
pending->total_bytes);
}
+void qemu_savevm_query_pending_iter(MigPendingData *pending, bool exact)
+{
+ qemu_savevm_query_pending(pending, exact, false);
+}
+
+void qemu_savevm_query_pending_final(MigPendingData *pending)
+{
+ g_assert(bql_locked());
+
+ qemu_savevm_query_pending(pending, true, true);
+}
+
void qemu_savevm_state_cleanup(void)
{
SaveStateEntry *se;
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index 4c28b3291cc687c06490bdd090f393b67c9c4d88..fa2204f002970c31eb987ae13113a9a5edb3e172 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -176,7 +176,7 @@ vfio_save_device_config_state(const char *name) " (%s)"
vfio_save_iterate(const char *name, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy initial size %"PRIu64" precopy dirty size %"PRIu64
vfio_save_iterate_start(const char *name) " (%s)"
vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer size %"PRIu64
-vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool exact) " (%s) stopcopy size %"PRIu64" precopy initial size %"PRIu64" precopy dirty size %"PRIu64 " exact %d"
+vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool exact, bool final) " (%s) stopcopy size %"PRIu64", precopy initial size %"PRIu64", precopy dirty size %"PRIu64", exact %d, final %d"
vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
vfio_vmstate_change_prepare(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
diff --git a/migration/trace-events b/migration/trace-events
index de99d976abc637e9361f8467daacf3cc8787976f..1c9212d3e20555902f008e4c999f32642cc8fa48 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -7,7 +7,7 @@ qemu_loadvm_state_section_partend(uint32_t section_id) "%u"
qemu_loadvm_state_post_main(int ret) "%d"
qemu_loadvm_state_section_startfull(uint32_t section_id, const char *idstr, uint32_t instance_id, uint32_t version_id) "%u(%s) %u %u"
qemu_savevm_send_packaged(void) ""
-qemu_savevm_query_pending(bool exact, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total) "exact=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64
+qemu_savevm_query_pending(bool exact, bool final, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total) "exact=%d, final=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64
loadvm_state_switchover_ack_needed(unsigned int switchover_ack_pending_num) "Switchover ack pending num=%u"
loadvm_state_setup(void) ""
loadvm_state_cleanup(void) ""
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 09/27] migration: Log the approver in qemu_loadvm_approve_switchover()
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (7 preceding siblings ...)
2026-07-07 6:29 ` [PULL 08/27] migration: Run final save_query_pending at switchover Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 10/27] migration: Replace switchover_ack_needed SaveVMHandler Cédric Le Goater
` (18 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Peter Xu, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
Pass the device name that approved switchover to
qemu_loadvm_approve_switchover() and log it in the trace for debugging
purposes.
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-5-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
migration/savevm.h | 2 +-
hw/vfio/migration.c | 2 +-
migration/savevm.c | 4 ++--
migration/trace-events | 2 +-
4 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/migration/savevm.h b/migration/savevm.h
index 81abd96dda94c6c95cc40b3c188df23d11c19463..44424be347494c51e6976749d7c60d27ca7f0628 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -71,7 +71,7 @@ void qemu_loadvm_state_cleanup(MigrationIncomingState *mis);
int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis,
Error **errp);
int qemu_load_device_state(QEMUFile *f, Error **errp);
-int qemu_loadvm_approve_switchover(void);
+int qemu_loadvm_approve_switchover(const char *approver);
int qemu_savevm_state_non_iterable(QEMUFile *f, Error **errp);
int qemu_savevm_state_non_iterable_early(QEMUFile *f,
JSONWriter *vmdesc,
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 195498845ed95d6a55cf68537a100b4e83221fb0..180b316baecb980fbd475b1426726697f340ccc8 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -847,7 +847,7 @@ static int vfio_load_state(QEMUFile *f, void *opaque, int version_id)
return -EINVAL;
}
- ret = qemu_loadvm_approve_switchover();
+ ret = qemu_loadvm_approve_switchover(vbasedev->name);
if (ret) {
error_report(
"%s: qemu_loadvm_approve_switchover failed, err=%d (%s)",
diff --git a/migration/savevm.c b/migration/savevm.c
index 74d622583e345bdc96b9189aad0c8f6bad41964d..be81de26160d195488e5fb09a88dc37a7a06a3fe 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -3174,7 +3174,7 @@ int qemu_load_device_state(QEMUFile *f, Error **errp)
return 0;
}
-int qemu_loadvm_approve_switchover(void)
+int qemu_loadvm_approve_switchover(const char *approver)
{
MigrationIncomingState *mis = migration_incoming_get_current();
@@ -3183,7 +3183,7 @@ int qemu_loadvm_approve_switchover(void)
}
mis->switchover_ack_pending_num--;
- trace_loadvm_approve_switchover(mis->switchover_ack_pending_num);
+ trace_loadvm_approve_switchover(approver, mis->switchover_ack_pending_num);
if (mis->switchover_ack_pending_num) {
return 0;
diff --git a/migration/trace-events b/migration/trace-events
index 1c9212d3e20555902f008e4c999f32642cc8fa48..c0c433744cd33d7e28496831bb8ce93c65670bf5 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -24,7 +24,7 @@ loadvm_postcopy_ram_handle_discard_end(void) ""
loadvm_postcopy_ram_handle_discard_header(const char *ramid, uint16_t len) "%s: %ud"
loadvm_process_command(const char *s, uint16_t len) "com=%s len=%d"
loadvm_process_command_ping(uint32_t val) "0x%x"
-loadvm_approve_switchover(unsigned int switchover_ack_pending_num) "Switchover ack pending num=%u"
+loadvm_approve_switchover(const char *approver, unsigned int switchover_ack_pending_num) "Approver %s, switchover_ack_pending_num %u"
postcopy_ram_listen_thread_exit(void) ""
postcopy_ram_listen_thread_start(void) ""
qemu_savevm_send_postcopy_advise(void) ""
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 10/27] migration: Replace switchover_ack_needed SaveVMHandler
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (8 preceding siblings ...)
2026-07-07 6:29 ` [PULL 09/27] migration: Log the approver in qemu_loadvm_approve_switchover() Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 11/27] migration: Rename switchover-ack code to legacy Cédric Le Goater
` (17 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Peter Xu, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
A new switchover-ack mechanism that will replace the existing one will
be added in the following patches. The new mechanism will not use
switchover_ack_needed SaveVMHandler, however, the old mechanism must
still be kept for backward compatibility.
To keep things clear and decrease API surface of old code, replace
switchover_ack_needed SaveVMHandler with a regular function
migration_request_switchover_ack().
No functional changes intended.
Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-6-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
docs/devel/migration/vfio.rst | 3 ---
include/migration/misc.h | 2 ++
include/migration/register.h | 13 -------------
hw/vfio/migration.c | 18 ++++++++++--------
migration/migration.c | 15 +++++++++++++++
migration/savevm.c | 21 ---------------------
migration/trace-events | 2 +-
7 files changed, 28 insertions(+), 46 deletions(-)
diff --git a/docs/devel/migration/vfio.rst b/docs/devel/migration/vfio.rst
index 691061d1820453a09df479f020abf0aab5fbabfd..854277b11ce64672f998ce1728bf8b5ddf1c129a 100644
--- a/docs/devel/migration/vfio.rst
+++ b/docs/devel/migration/vfio.rst
@@ -59,9 +59,6 @@ VFIO implements the device hooks for the iterative approach as follows:
* A ``save_live_iterate`` function that reads the VFIO device's data from the
vendor driver during iterative pre-copy phase.
-* A ``switchover_ack_needed`` function that checks if the VFIO device uses
- "switchover-ack" migration capability when this capability is enabled.
-
* A ``switchover_start`` function that in the multifd mode starts a thread that
reassembles the multifd received data and loads it in-order into the device.
In the non-multifd mode this function is a NOP.
diff --git a/include/migration/misc.h b/include/migration/misc.h
index d3d6e1f50d102d0f46f574423eb951232be9b86b..17b42949d4b68dc3ed9341d254e7ccc69e18735e 100644
--- a/include/migration/misc.h
+++ b/include/migration/misc.h
@@ -159,4 +159,6 @@ bool multifd_device_state_save_thread_should_exit(void);
void multifd_abort_device_state_save_threads(void);
bool multifd_join_device_state_save_threads(void);
+void migration_request_switchover_ack(const char *requester);
+
#endif
diff --git a/include/migration/register.h b/include/migration/register.h
index 6f632123f1d0710de0556e68ba53e068a1e02640..a61c4236d22423a8477876971f1d73fe2e802f4a 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -302,19 +302,6 @@ typedef struct SaveVMHandlers {
*/
int (*resume_prepare)(MigrationState *s, void *opaque);
- /**
- * @switchover_ack_needed
- *
- * Checks if switchover ack should be used. Called only on
- * destination.
- *
- * @opaque: data pointer passed to register_savevm_live()
- *
- * Returns true if switchover ack should be used and false
- * otherwise
- */
- bool (*switchover_ack_needed)(void *opaque);
-
/**
* @switchover_start
*
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 180b316baecb980fbd475b1426726697f340ccc8..7055cfbd3e04bd2b1e95c9be45b879cb0bf06212 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -487,6 +487,14 @@ static bool vfio_precopy_supported(VFIODevice *vbasedev)
return migration->mig_flags & VFIO_MIGRATION_PRE_COPY;
}
+static void vfio_request_switchover_ack(VFIODevice *vbasedev)
+{
+ if (vfio_precopy_supported(vbasedev)) {
+ /* Precopy support implies switchover-ack is needed */
+ migration_request_switchover_ack(vbasedev->name);
+ }
+}
+
/* ---------------------------------------------------------------------- */
static int vfio_save_prepare(void *opaque, Error **errp)
@@ -776,6 +784,8 @@ static int vfio_load_setup(QEMUFile *f, void *opaque, Error **errp)
return ret;
}
+ vfio_request_switchover_ack(vbasedev);
+
return 0;
}
@@ -874,13 +884,6 @@ static int vfio_load_state(QEMUFile *f, void *opaque, int version_id)
return ret;
}
-static bool vfio_switchover_ack_needed(void *opaque)
-{
- VFIODevice *vbasedev = opaque;
-
- return vfio_precopy_supported(vbasedev);
-}
-
static int vfio_switchover_start(void *opaque)
{
VFIODevice *vbasedev = opaque;
@@ -904,7 +907,6 @@ static const SaveVMHandlers savevm_vfio_handlers = {
.load_setup = vfio_load_setup,
.load_cleanup = vfio_load_cleanup,
.load_state = vfio_load_state,
- .switchover_ack_needed = vfio_switchover_ack_needed,
/*
* Multifd support
*/
diff --git a/migration/migration.c b/migration/migration.c
index 442f950c43cef47ed23856a16bdda3af5549a5bf..9a8d47ba9637eb57ee9f3bc6cfe8f580161fb36c 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2202,6 +2202,21 @@ void migration_rp_kick(MigrationState *s)
qemu_sem_post(&s->rp_state.rp_sem);
}
+/* This is called only on destination side */
+void migration_request_switchover_ack(const char *requester)
+{
+ MigrationIncomingState *mis = migration_incoming_get_current();
+
+ if (!migrate_switchover_ack()) {
+ return;
+ }
+
+ mis->switchover_ack_pending_num++;
+
+ trace_migration_request_switchover_ack(requester,
+ mis->switchover_ack_pending_num);
+}
+
static struct rp_cmd_args {
ssize_t len; /* -1 = variable */
const char *name;
diff --git a/migration/savevm.c b/migration/savevm.c
index be81de26160d195488e5fb09a88dc37a7a06a3fe..98639630277b7543db7400ec97d6b009603a03bc 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2800,23 +2800,6 @@ static int qemu_loadvm_state_header(QEMUFile *f, Error **errp)
return 0;
}
-static void qemu_loadvm_state_switchover_ack_needed(MigrationIncomingState *mis)
-{
- SaveStateEntry *se;
-
- QTAILQ_FOREACH(se, &savevm_state.handlers, entry) {
- if (!se->ops || !se->ops->switchover_ack_needed) {
- continue;
- }
-
- if (se->ops->switchover_ack_needed(se->opaque)) {
- mis->switchover_ack_pending_num++;
- }
- }
-
- trace_loadvm_state_switchover_ack_needed(mis->switchover_ack_pending_num);
-}
-
static int qemu_loadvm_state_setup(QEMUFile *f, Error **errp)
{
ERRP_GUARD();
@@ -3078,10 +3061,6 @@ int qemu_loadvm_state(QEMUFile *f, Error **errp)
return -EINVAL;
}
- if (migrate_switchover_ack()) {
- qemu_loadvm_state_switchover_ack_needed(mis);
- }
-
cpu_synchronize_all_pre_loadvm();
ret = qemu_loadvm_state_main(f, mis, errp);
diff --git a/migration/trace-events b/migration/trace-events
index c0c433744cd33d7e28496831bb8ce93c65670bf5..5955befcc66128b72dfdbc9711e5749f19b9faf8 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -8,7 +8,6 @@ qemu_loadvm_state_post_main(int ret) "%d"
qemu_loadvm_state_section_startfull(uint32_t section_id, const char *idstr, uint32_t instance_id, uint32_t version_id) "%u(%s) %u %u"
qemu_savevm_send_packaged(void) ""
qemu_savevm_query_pending(bool exact, bool final, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total) "exact=%d, final=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64
-loadvm_state_switchover_ack_needed(unsigned int switchover_ack_pending_num) "Switchover ack pending num=%u"
loadvm_state_setup(void) ""
loadvm_state_cleanup(void) ""
loadvm_handle_cmd_packaged(unsigned int length) "%u"
@@ -199,6 +198,7 @@ process_incoming_migration_co_postcopy_end_main(void) ""
postcopy_preempt_enabled(bool value) "%d"
migration_precopy_complete(void) ""
migration_call_notifiers(int type) "type=%d"
+migration_request_switchover_ack(const char *requester, unsigned int switchover_ack_pending_num) "Requester %s, switchover_ack_pending_num %u"
# migration-stats
migration_transferred_bytes(uint64_t qemu_file, uint64_t multifd, uint64_t rdma) "qemu_file %" PRIu64 " multifd %" PRIu64 " RDMA %" PRIu64
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 11/27] migration: Rename switchover-ack code to legacy
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (9 preceding siblings ...)
2026-07-07 6:29 ` [PULL 10/27] migration: Replace switchover_ack_needed SaveVMHandler Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 12/27] migration: Make switchover-ack re-usable Cédric Le Goater
` (16 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Peter Xu, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
A new switchover-ack mechanism will be added in the following patches.
However, the old mechanism must still be kept for backward
compatibility.
Rename existing code that will be used only for old switchover-ack
mechanism as legacy. This will help to distinguish legacy code from new
code and make it more readable and easier for removal later when no
longer needed.
No functional change intended.
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-7-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
include/migration/misc.h | 2 +-
migration/migration.h | 2 +-
hw/vfio/migration.c | 6 ++---
migration/migration.c | 8 +++----
migration/savevm.c | 49 +++++++++++++++++++++++++++-------------
migration/trace-events | 4 ++--
6 files changed, 44 insertions(+), 27 deletions(-)
diff --git a/include/migration/misc.h b/include/migration/misc.h
index 17b42949d4b68dc3ed9341d254e7ccc69e18735e..2b2fbb59a409a35163b4578cf0d386977d3e5f80 100644
--- a/include/migration/misc.h
+++ b/include/migration/misc.h
@@ -159,6 +159,6 @@ bool multifd_device_state_save_thread_should_exit(void);
void multifd_abort_device_state_save_threads(void);
bool multifd_join_device_state_save_threads(void);
-void migration_request_switchover_ack(const char *requester);
+void migration_request_switchover_ack_legacy(const char *requester);
#endif
diff --git a/migration/migration.h b/migration/migration.h
index 293ad60e07bd4dd059ec0e0b5aa2ed2d2ba11d29..570349d8581354bda30f5a37ccddf5476ec518ce 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -246,7 +246,7 @@ struct MigrationIncomingState {
* zero an ACK that it's OK to do switchover is sent to the source. No lock
* is needed as this field is updated serially.
*/
- unsigned int switchover_ack_pending_num;
+ unsigned int switchover_ack_pending_num_legacy;
/* Do exit on incoming migration failure */
bool exit_on_error;
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 7055cfbd3e04bd2b1e95c9be45b879cb0bf06212..6b7acb2fa19d3ee618e73365ca995bbdb4676055 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -487,11 +487,11 @@ static bool vfio_precopy_supported(VFIODevice *vbasedev)
return migration->mig_flags & VFIO_MIGRATION_PRE_COPY;
}
-static void vfio_request_switchover_ack(VFIODevice *vbasedev)
+static void vfio_request_switchover_ack_legacy(VFIODevice *vbasedev)
{
if (vfio_precopy_supported(vbasedev)) {
/* Precopy support implies switchover-ack is needed */
- migration_request_switchover_ack(vbasedev->name);
+ migration_request_switchover_ack_legacy(vbasedev->name);
}
}
@@ -784,7 +784,7 @@ static int vfio_load_setup(QEMUFile *f, void *opaque, Error **errp)
return ret;
}
- vfio_request_switchover_ack(vbasedev);
+ vfio_request_switchover_ack_legacy(vbasedev);
return 0;
}
diff --git a/migration/migration.c b/migration/migration.c
index 9a8d47ba9637eb57ee9f3bc6cfe8f580161fb36c..1d3387da0f4d5c64d64e8afb25af38ea143dad32 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2203,7 +2203,7 @@ void migration_rp_kick(MigrationState *s)
}
/* This is called only on destination side */
-void migration_request_switchover_ack(const char *requester)
+void migration_request_switchover_ack_legacy(const char *requester)
{
MigrationIncomingState *mis = migration_incoming_get_current();
@@ -2211,10 +2211,10 @@ void migration_request_switchover_ack(const char *requester)
return;
}
- mis->switchover_ack_pending_num++;
+ mis->switchover_ack_pending_num_legacy++;
- trace_migration_request_switchover_ack(requester,
- mis->switchover_ack_pending_num);
+ trace_migration_request_switchover_ack_legacy(
+ requester, mis->switchover_ack_pending_num_legacy);
}
static struct rp_cmd_args {
diff --git a/migration/savevm.c b/migration/savevm.c
index 98639630277b7543db7400ec97d6b009603a03bc..804c76e3bd93d6b4433df12d524a803491b0aa08 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2478,6 +2478,31 @@ static int loadvm_postcopy_handle_switchover_start(Error **errp)
return 0;
}
+/*
+ * If legacy switchover-ack is enabled but no device uses it, need to send an
+ * ACK to source that it's OK to switchover.
+ */
+static int loadvm_switchover_ack_no_users_legacy(MigrationIncomingState *mis,
+ Error **errp)
+{
+ int ret;
+
+ if (!migrate_switchover_ack()) {
+ return 0;
+ }
+
+ if (!mis->switchover_ack_pending_num_legacy) {
+ ret = migrate_send_rp_switchover_ack(mis);
+ if (ret) {
+ error_setg_errno(errp, -ret,
+ "Could not send switchover ack RP MSG");
+ return ret;
+ }
+ }
+
+ return 0;
+}
+
/*
* Process an incoming 'QEMU_VM_COMMAND'
* 0 just a normal return
@@ -2527,18 +2552,9 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
}
mis->to_src_file = qemu_file_get_return_path(f);
- /*
- * Switchover ack is enabled but no device uses it, so send an ACK to
- * source that it's OK to switchover. Do it here, after return path has
- * been created.
- */
- if (migrate_switchover_ack() && !mis->switchover_ack_pending_num) {
- ret = migrate_send_rp_switchover_ack(mis);
- if (ret) {
- error_setg_errno(errp, -ret,
- "Could not send switchover ack RP MSG");
- return ret;
- }
+ ret = loadvm_switchover_ack_no_users_legacy(mis, errp);
+ if (ret) {
+ return ret;
}
return 0;
@@ -3157,14 +3173,15 @@ int qemu_loadvm_approve_switchover(const char *approver)
{
MigrationIncomingState *mis = migration_incoming_get_current();
- if (!mis->switchover_ack_pending_num) {
+ if (!mis->switchover_ack_pending_num_legacy) {
return -EINVAL;
}
- mis->switchover_ack_pending_num--;
- trace_loadvm_approve_switchover(approver, mis->switchover_ack_pending_num);
+ mis->switchover_ack_pending_num_legacy--;
+ trace_loadvm_approve_switchover_legacy(
+ approver, mis->switchover_ack_pending_num_legacy);
- if (mis->switchover_ack_pending_num) {
+ if (mis->switchover_ack_pending_num_legacy) {
return 0;
}
diff --git a/migration/trace-events b/migration/trace-events
index 5955befcc66128b72dfdbc9711e5749f19b9faf8..a6b8c31ee1d3eddc59798d7a9b97d2718814e1cb 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -23,7 +23,7 @@ loadvm_postcopy_ram_handle_discard_end(void) ""
loadvm_postcopy_ram_handle_discard_header(const char *ramid, uint16_t len) "%s: %ud"
loadvm_process_command(const char *s, uint16_t len) "com=%s len=%d"
loadvm_process_command_ping(uint32_t val) "0x%x"
-loadvm_approve_switchover(const char *approver, unsigned int switchover_ack_pending_num) "Approver %s, switchover_ack_pending_num %u"
+loadvm_approve_switchover_legacy(const char *approver, unsigned int switchover_ack_pending_num_legacy) "Approver %s, switchover_ack_pending_num_legacy %u"
postcopy_ram_listen_thread_exit(void) ""
postcopy_ram_listen_thread_start(void) ""
qemu_savevm_send_postcopy_advise(void) ""
@@ -198,7 +198,7 @@ process_incoming_migration_co_postcopy_end_main(void) ""
postcopy_preempt_enabled(bool value) "%d"
migration_precopy_complete(void) ""
migration_call_notifiers(int type) "type=%d"
-migration_request_switchover_ack(const char *requester, unsigned int switchover_ack_pending_num) "Requester %s, switchover_ack_pending_num %u"
+migration_request_switchover_ack_legacy(const char *requester, unsigned int switchover_ack_pending_num_legacy) "Requester %s, switchover_ack_pending_num_legacy %u"
# migration-stats
migration_transferred_bytes(uint64_t qemu_file, uint64_t multifd, uint64_t rdma) "qemu_file %" PRIu64 " multifd %" PRIu64 " RDMA %" PRIu64
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 12/27] migration: Make switchover-ack re-usable
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (10 preceding siblings ...)
2026-07-07 6:29 ` [PULL 11/27] migration: Rename switchover-ack code to legacy Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 13/27] migration: Fail migration if switchover-ack is requested after switchover decision Cédric Le Goater
` (15 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Markus Armbruster, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
Switchover-ack is a mechanism to synchronize between source and
destination QEMU during migration to prevent the source from switching
over prematurely.
VFIO uses switchover-ack to ensure switchover happens only after
destination side has loaded the precopy initial bytes. This is important
for VFIO, as otherwise downtime could be impacted and be higher.
In its current state, switchover-ack is a one-time mechanism, meaning
that switchover is acked only once and past that another ACK cannot be
requested again. This was sufficient until now, as VFIO precopy initial
bytes was defined to be monotonically decreasing. Thus, when precopy
initial bytes reached zero for all VFIO devices, a single ACK would be
sent and its validity would hold.
However, now the new VFIO_PRECOPY_INFO_REINIT feature allows precopy
initial bytes to be re-initialized during precopy. Specifically, it
means that initial bytes can grow after reaching zero, which would
invalidate a previously sent switchover ACK.
To solve this, make switchover-ack reusable and allow devices to request
switchover ACKs when needed via the save_query_pending SaveVMHandler.
Since now switchover ACK can be requested for a specific device and in
different times, make switchover ACK per-device (instead of a single ACK
for all devices) and let source side do the pending ACKs accounting.
Keep the legacy switchover-ack mechanism for backward compatibility and
turn it on by a compatibility property for older machines. Enable the
property until VFIO implements the new switchover-ack.
Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-8-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
qapi/migration.json | 14 ++++----
include/migration/client-options.h | 1 +
include/migration/register.h | 2 ++
migration/migration.h | 32 ++++++++++++++++--
migration/savevm.h | 6 ++--
migration/colo.c | 2 +-
migration/migration.c | 37 ++++++++++++++-------
migration/options.c | 10 ++++++
migration/savevm.c | 53 +++++++++++++++++++++++-------
migration/trace-events | 5 +--
10 files changed, 124 insertions(+), 38 deletions(-)
diff --git a/qapi/migration.json b/qapi/migration.json
index e8756308cf9610182f75997ab81946f3b03dea63..d2f42c4b0ffd0a9e6bb757b8d105fed89b423537 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -508,14 +508,12 @@
# (since 7.1)
#
# @switchover-ack: If enabled, migration will not stop the source VM
-# and complete the migration until an ACK is received from the
-# destination that it's OK to do so. Exactly when this ACK is
-# sent depends on the migrated devices that use this feature. For
-# example, a device can use it to make sure some of its data is
-# sent and loaded in the destination before doing switchover.
-# This can reduce downtime if devices that support this capability
-# are present. 'return-path' capability must be enabled to use
-# it. (since 8.1)
+# and complete the migration until the destination has
+# acknowledged that it is OK to switchover. The acknowledgement
+# may depend, for example, on some device's data being loaded in
+# the destination before doing switchover. This can reduce
+# downtime if devices that support this capability are present.
+# Capability @return-path must be enabled to use it. (since 8.1)
#
# @dirty-limit: If enabled, migration will throttle vCPUs as needed to
# keep their dirty page rate within @vcpu-dirty-limit. This can
diff --git a/include/migration/client-options.h b/include/migration/client-options.h
index 289c9d776221ce3cf35d86f91ce3313fd79427d3..78b1daa1a615ceb601da5dc8914f4fb5fe04f8a9 100644
--- a/include/migration/client-options.h
+++ b/include/migration/client-options.h
@@ -13,6 +13,7 @@
/* properties */
bool migrate_send_switchover_start(void);
+bool migrate_switchover_ack_legacy(void);
/* capabilities */
diff --git a/include/migration/register.h b/include/migration/register.h
index a61c4236d22423a8477876971f1d73fe2e802f4a..5825eb30cb33e1721bec399f8a1c01df154d143b 100644
--- a/include/migration/register.h
+++ b/include/migration/register.h
@@ -23,6 +23,8 @@ typedef struct MigPendingData {
uint64_t postcopy_bytes;
/* Amount of pending bytes can be transferred only in stopcopy */
uint64_t stopcopy_bytes;
+ /* Number of new pending switchover ACKs */
+ uint32_t switchover_ack_pending;
/*
* Total pending data, modules do not need to update this field, it
* will be automatically calculated by migration core API.
diff --git a/migration/migration.h b/migration/migration.h
index 570349d8581354bda30f5a37ccddf5476ec518ce..44bce199cd8c3518998ad7204d599566d1ef9ddd 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -487,6 +487,29 @@ struct MigrationState {
*/
uint8_t clear_bitmap_shift;
+ /*
+ * This decides whether to use legacy switchover-ack or new switchover-ack.
+ * The main difference between them is that the former allows acknowledging
+ * switchover only once while the latter multiple times.
+ *
+ * In legacy, the destination keeps track of a pending ACKs counter. As
+ * migration progresses, the devices on the destination acknowledge
+ * switchover, decreasing the counter. When the counter reaches zero, a
+ * single ACK message is sent to the source via the return path, indicating
+ * that it's OK to switchover.
+ *
+ * In new switchover-ack, the source is the one that keeps track of a
+ * pending ACKs counter. As migration progresses, the destination sends ACK
+ * message per-device via the return path, which decrements the source
+ * counter. When the counter reaches zero, it's OK to switchover. During
+ * precopy, source-side devices may request additional ACKs, which increment
+ * the counter again.
+ *
+ * In both legacy and new schemes, we rely on per-device protocol to request
+ * switchover ACK from the destination-side counterpart.
+ */
+ bool switchover_ack_legacy;
+
/*
* This save hostname when out-going migration starts
*/
@@ -496,10 +519,13 @@ struct MigrationState {
JSONWriter *vmdesc;
/*
- * Indicates whether an ACK from the destination that it's OK to do
- * switchover has been received.
+ * Indicates the number of pending ACKs from the destination. The value may
+ * increase or decrease during precopy as new ACKs are requested or
+ * received. When zero is reached, it's OK to switchover. In legacy
+ * switchover-ack, it's initialized to 1 and decreased to zero upon ACK.
*/
- bool switchover_acked;
+ uint32_t switchover_ack_pending_num;
+
/* Is this a rdma migration */
bool rdma_migration;
diff --git a/migration/savevm.h b/migration/savevm.h
index 44424be347494c51e6976749d7c60d27ca7f0628..fb92d3bc8586553c490eb03d68be3cb56c8d0554 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -45,8 +45,10 @@ int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy);
void qemu_savevm_state_cleanup(void);
void qemu_savevm_state_complete_postcopy(QEMUFile *f);
int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
-void qemu_savevm_query_pending_iter(MigPendingData *pending, bool exact);
-void qemu_savevm_query_pending_final(MigPendingData *pending);
+void qemu_savevm_query_pending_iter(MigrationState *s, MigPendingData *pending,
+ bool exact);
+void qemu_savevm_query_pending_final(MigrationState *s,
+ MigPendingData *pending);
int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
void qemu_savevm_state_end(QEMUFile *f);
diff --git a/migration/colo.c b/migration/colo.c
index 08632d5e4ad0d05de386ecf0af42f648fa24ecf5..0cef0f6b0e650500496f51f49b2149154166a90f 100644
--- a/migration/colo.c
+++ b/migration/colo.c
@@ -473,7 +473,7 @@ static int colo_do_checkpoint_transaction(MigrationState *s,
* state is saved. Unlike a regular switchover, COLO reaches completion
* repeatedly for every checkpoint, so this must be done on each one.
*/
- qemu_savevm_query_pending_final(&pending);
+ qemu_savevm_query_pending_final(s, &pending);
/*
* Only save VM's live state, which not including device state.
diff --git a/migration/migration.c b/migration/migration.c
index 1d3387da0f4d5c64d64e8afb25af38ea143dad32..2b625da114dbfbbc8f77a359d896eb4b8c10378e 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1713,7 +1713,9 @@ int migrate_init(MigrationState *s, Error **errp)
s->vm_old_state = -1;
s->iteration_initial_bytes = 0;
s->threshold_size = 0;
- s->switchover_acked = false;
+ /* Legacy switchover-ack sends a single ACK for all devices */
+ qatomic_set(&s->switchover_ack_pending_num,
+ migrate_switchover_ack_legacy() ? 1 : 0);
s->rdma_migration = false;
/*
@@ -2207,7 +2209,7 @@ void migration_request_switchover_ack_legacy(const char *requester)
{
MigrationIncomingState *mis = migration_incoming_get_current();
- if (!migrate_switchover_ack()) {
+ if (!migrate_switchover_ack() || !migrate_switchover_ack_legacy()) {
return;
}
@@ -2463,9 +2465,18 @@ static void *source_return_path_thread(void *opaque)
break;
case MIG_RP_MSG_SWITCHOVER_ACK:
- ms->switchover_acked = true;
- trace_source_return_path_thread_switchover_acked();
+ {
+ uint32_t pending_num;
+
+ pending_num = qatomic_dec_fetch(&ms->switchover_ack_pending_num);
+ trace_source_return_path_thread_switchover_acked(pending_num);
+ if (pending_num == UINT32_MAX) {
+ error_setg(&err, "Switchover ack pending num underflowed");
+ goto out;
+ }
+
break;
+ }
default:
break;
@@ -2822,7 +2833,7 @@ static bool migration_switchover_start(MigrationState *s, Error **errp)
* properly update all the dirty bitmaps to finally generate the
* correct discard bitmaps; see ram_postcopy_send_discard_bitmap().
*/
- qemu_savevm_query_pending_final(&pending);
+ qemu_savevm_query_pending_final(s, &pending);
/* Inactivate disks except in COLO */
if (!migrate_colo()) {
@@ -3272,7 +3283,7 @@ static bool migration_can_switchover(MigrationState *s)
return true;
}
- return s->switchover_acked;
+ return qatomic_read(&s->switchover_ack_pending_num) == 0;
}
/* Migration thread iteration status */
@@ -3311,12 +3322,13 @@ static bool migration_iteration_next_ready(MigrationState *s,
return false;
}
-static void migration_iteration_go_next(MigPendingData *pending)
+static void migration_iteration_go_next(MigrationState *s,
+ MigPendingData *pending)
{
/*
* Do a slow sync first before boosting the iteration count.
*/
- qemu_savevm_query_pending_iter(pending, true);
+ qemu_savevm_query_pending_iter(s, pending, true);
/*
* Update the dirty information for the whole system for this
@@ -3362,12 +3374,12 @@ static MigIterateState migration_iteration_run(MigrationState *s)
Error *local_err = NULL;
bool in_postcopy = (s->state == MIGRATION_STATUS_POSTCOPY_DEVICE ||
s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE);
- bool can_switchover = migration_can_switchover(s);
+ bool can_switchover;
MigPendingData pending = { };
bool complete_ready;
/* Fast path - get the estimated amount of pending data */
- qemu_savevm_query_pending_iter(&pending, false);
+ qemu_savevm_query_pending_iter(s, &pending, false);
if (in_postcopy) {
/*
@@ -3408,9 +3420,12 @@ static MigIterateState migration_iteration_run(MigrationState *s)
* during postcopy phase.
*/
if (migration_iteration_next_ready(s, &pending)) {
- migration_iteration_go_next(&pending);
+ migration_iteration_go_next(s, &pending);
}
+ /* Check can switchover after qemu_savevm_query_pending() */
+ can_switchover = migration_can_switchover(s);
+
/* Should we switch to postcopy now? */
if (can_switchover && postcopy_should_start(s, &pending)) {
if (postcopy_start(s, &local_err)) {
diff --git a/migration/options.c b/migration/options.c
index 5cbfd29099ba69f8826cc57a0e9cb43ed68b3bf2..4c9b25372e03b55ee9127c027c5d4eefba796b06 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -110,6 +110,9 @@ const Property migration_properties[] = {
preempt_pre_7_2, false),
DEFINE_PROP_BOOL("multifd-clean-tls-termination", MigrationState,
multifd_clean_tls_termination, true),
+ /* Use legacy until VFIO implements new switchover-ack */
+ DEFINE_PROP_BOOL("switchover-ack-legacy", MigrationState,
+ switchover_ack_legacy, true),
/* Migration parameters */
DEFINE_PROP_UINT8("x-throttle-trigger-threshold", MigrationState,
@@ -467,6 +470,13 @@ bool migrate_rdma(void)
return s->rdma_migration;
}
+bool migrate_switchover_ack_legacy(void)
+{
+ MigrationState *s = migrate_get_current();
+
+ return s->switchover_ack_legacy;
+}
+
typedef enum WriteTrackingSupport {
WT_SUPPORT_UNKNOWN = 0,
WT_SUPPORT_ABSENT,
diff --git a/migration/savevm.c b/migration/savevm.c
index 804c76e3bd93d6b4433df12d524a803491b0aa08..1f6e696c50d189370a311c25d8eb092bc41c2b24 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1801,7 +1801,8 @@ int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp)
return 0;
}
-static void qemu_savevm_query_pending(MigPendingData *pending, bool exact,
+static void qemu_savevm_query_pending(MigrationState *s,
+ MigPendingData *pending, bool exact,
bool final)
{
SaveStateEntry *se;
@@ -1827,22 +1828,35 @@ static void qemu_savevm_query_pending(MigPendingData *pending, bool exact,
* close to reality when this got invoked frequently while iterating.
*/
mig_stats.dirty_bytes_total = pending->total_bytes;
- trace_qemu_savevm_query_pending(exact, final, pending->precopy_bytes,
- pending->stopcopy_bytes,
- pending->postcopy_bytes,
- pending->total_bytes);
+
+ if (migrate_switchover_ack() && !migrate_switchover_ack_legacy() &&
+ pending->switchover_ack_pending) {
+ /*
+ * NOTE: Currently we rely on per-device protocol to request switchover
+ * ACK from the device on the destination side.
+ */
+ qatomic_add(&s->switchover_ack_pending_num,
+ pending->switchover_ack_pending);
+ }
+
+ trace_qemu_savevm_query_pending(
+ exact, final, pending->precopy_bytes, pending->stopcopy_bytes,
+ pending->postcopy_bytes, pending->total_bytes,
+ pending->switchover_ack_pending,
+ qatomic_read(&s->switchover_ack_pending_num));
}
-void qemu_savevm_query_pending_iter(MigPendingData *pending, bool exact)
+void qemu_savevm_query_pending_iter(MigrationState *s, MigPendingData *pending,
+ bool exact)
{
- qemu_savevm_query_pending(pending, exact, false);
+ qemu_savevm_query_pending(s, pending, exact, false);
}
-void qemu_savevm_query_pending_final(MigPendingData *pending)
+void qemu_savevm_query_pending_final(MigrationState *s, MigPendingData *pending)
{
g_assert(bql_locked());
- qemu_savevm_query_pending(pending, true, true);
+ qemu_savevm_query_pending(s, pending, true, true);
}
void qemu_savevm_state_cleanup(void)
@@ -2487,7 +2501,7 @@ static int loadvm_switchover_ack_no_users_legacy(MigrationIncomingState *mis,
{
int ret;
- if (!migrate_switchover_ack()) {
+ if (!migrate_switchover_ack() || !migrate_switchover_ack_legacy()) {
return 0;
}
@@ -3169,7 +3183,7 @@ int qemu_load_device_state(QEMUFile *f, Error **errp)
return 0;
}
-int qemu_loadvm_approve_switchover(const char *approver)
+static int qemu_loadvm_approve_switchover_legacy(const char *approver)
{
MigrationIncomingState *mis = migration_incoming_get_current();
@@ -3188,6 +3202,23 @@ int qemu_loadvm_approve_switchover(const char *approver)
return migrate_send_rp_switchover_ack(mis);
}
+int qemu_loadvm_approve_switchover(const char *approver)
+{
+ MigrationIncomingState *mis = migration_incoming_get_current();
+
+ if (!migrate_switchover_ack()) {
+ return 0;
+ }
+
+ if (migrate_switchover_ack_legacy()) {
+ return qemu_loadvm_approve_switchover_legacy(approver);
+ }
+
+ trace_loadvm_approve_switchover(approver);
+
+ return migrate_send_rp_switchover_ack(mis);
+}
+
bool qemu_loadvm_load_state_buffer(const char *idstr, uint32_t instance_id,
char *buf, size_t len, Error **errp)
{
diff --git a/migration/trace-events b/migration/trace-events
index a6b8c31ee1d3eddc59798d7a9b97d2718814e1cb..f5339f4193d20d2a15abf713eeb2869df7149b4d 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -7,7 +7,7 @@ qemu_loadvm_state_section_partend(uint32_t section_id) "%u"
qemu_loadvm_state_post_main(int ret) "%d"
qemu_loadvm_state_section_startfull(uint32_t section_id, const char *idstr, uint32_t instance_id, uint32_t version_id) "%u(%s) %u %u"
qemu_savevm_send_packaged(void) ""
-qemu_savevm_query_pending(bool exact, bool final, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total) "exact=%d, final=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64
+qemu_savevm_query_pending(bool exact, bool final, uint64_t precopy, uint64_t stopcopy, uint64_t postcopy, uint64_t total, uint32_t switchover_ack_pending, uint32_t total_switchover_ack_pending) "exact=%d, final=%d, precopy=%"PRIu64", stopcopy=%"PRIu64", postcopy=%"PRIu64", total=%"PRIu64", collected switchover ack pending=%"PRIu32", total switchover ack pending=%"PRIu32
loadvm_state_setup(void) ""
loadvm_state_cleanup(void) ""
loadvm_handle_cmd_packaged(unsigned int length) "%u"
@@ -24,6 +24,7 @@ loadvm_postcopy_ram_handle_discard_header(const char *ramid, uint16_t len) "%s:
loadvm_process_command(const char *s, uint16_t len) "com=%s len=%d"
loadvm_process_command_ping(uint32_t val) "0x%x"
loadvm_approve_switchover_legacy(const char *approver, unsigned int switchover_ack_pending_num_legacy) "Approver %s, switchover_ack_pending_num_legacy %u"
+loadvm_approve_switchover(const char *approver) "Approver %s"
postcopy_ram_listen_thread_exit(void) ""
postcopy_ram_listen_thread_start(void) ""
qemu_savevm_send_postcopy_advise(void) ""
@@ -189,7 +190,7 @@ source_return_path_thread_loop_top(void) ""
source_return_path_thread_pong(uint32_t val) "0x%x"
source_return_path_thread_shut(uint32_t val) "0x%x"
source_return_path_thread_resume_ack(uint32_t v) "%"PRIu32
-source_return_path_thread_switchover_acked(void) ""
+source_return_path_thread_switchover_acked(uint32_t pending_num) "switchover_ack_pending_num %" PRIu32
source_return_path_thread_postcopy_package_loaded(void) ""
migration_thread_low_pending(uint64_t pending) "%" PRIu64
migrate_transferred(uint64_t transferred, uint64_t time_spent, uint64_t bandwidth, uint64_t avail_bw, uint64_t size) "transferred %" PRIu64 " time_spent %" PRIu64 " bandwidth %" PRIu64 " switchover_bw %" PRIu64 " max_size %" PRId64
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 13/27] migration: Fail migration if switchover-ack is requested after switchover decision
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (11 preceding siblings ...)
2026-07-07 6:29 ` [PULL 12/27] migration: Make switchover-ack re-usable Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 14/27] vfio/migration: Extract VFIO_MIG_FLAG_DEV_INIT_DATA_SENT sending to helper Cédric Le Goater
` (14 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
Switchover ACK is checked only during precopy while the guest is still
running. The last migration_can_switchover() decision and guest stop are
not atomic, so a device may want to request another switchover ACK in
the gap after switchover decision has been made but before the guest is
stopped. Migration would then miss that request, which can increase
downtime.
Cover this case by failing the migration if a switchover-ack was
requested during that time.
Ideally, precopy iterations should be resumed in this case, however,
VFIO doesn't support going back to precopy after being stopped, so
implementing such logic would require non-trivial changes to the guest
start/stop flow. Given the above and that this case should be rare,
failing the migration seems reasonable.
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-9-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
migration/savevm.h | 4 ++--
migration/colo.c | 6 +++++-
migration/migration.c | 4 +++-
migration/savevm.c | 19 ++++++++++++++++++-
4 files changed, 28 insertions(+), 5 deletions(-)
diff --git a/migration/savevm.h b/migration/savevm.h
index fb92d3bc8586553c490eb03d68be3cb56c8d0554..415198423f578049c209a1e40b796cfe63b410f0 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -47,8 +47,8 @@ void qemu_savevm_state_complete_postcopy(QEMUFile *f);
int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
void qemu_savevm_query_pending_iter(MigrationState *s, MigPendingData *pending,
bool exact);
-void qemu_savevm_query_pending_final(MigrationState *s,
- MigPendingData *pending);
+bool qemu_savevm_query_pending_final(MigrationState *s,
+ MigPendingData *pending, Error **errp);
int qemu_savevm_state_complete_precopy_iterable(QEMUFile *f, bool in_postcopy);
bool qemu_savevm_state_postcopy_prepare(QEMUFile *f, Error **errp);
void qemu_savevm_state_end(QEMUFile *f);
diff --git a/migration/colo.c b/migration/colo.c
index 0cef0f6b0e650500496f51f49b2149154166a90f..0f30a5926fdd83c7dca10e89601bced6e7af7124 100644
--- a/migration/colo.c
+++ b/migration/colo.c
@@ -473,7 +473,11 @@ static int colo_do_checkpoint_transaction(MigrationState *s,
* state is saved. Unlike a regular switchover, COLO reaches completion
* repeatedly for every checkpoint, so this must be done on each one.
*/
- qemu_savevm_query_pending_final(s, &pending);
+ if (!qemu_savevm_query_pending_final(s, &pending, &local_err)) {
+ ret = -1;
+ bql_unlock();
+ goto out;
+ }
/*
* Only save VM's live state, which not including device state.
diff --git a/migration/migration.c b/migration/migration.c
index 2b625da114dbfbbc8f77a359d896eb4b8c10378e..98603ee19c34531d069400d1ab0ed36b65bb228e 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2833,7 +2833,9 @@ static bool migration_switchover_start(MigrationState *s, Error **errp)
* properly update all the dirty bitmaps to finally generate the
* correct discard bitmaps; see ram_postcopy_send_discard_bitmap().
*/
- qemu_savevm_query_pending_final(s, &pending);
+ if (!qemu_savevm_query_pending_final(s, &pending, errp)) {
+ return false;
+ }
/* Inactivate disks except in COLO */
if (!migrate_colo()) {
diff --git a/migration/savevm.c b/migration/savevm.c
index 1f6e696c50d189370a311c25d8eb092bc41c2b24..f654a1c563df40d546e42018a3706e92fb11cfa7 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1852,11 +1852,28 @@ void qemu_savevm_query_pending_iter(MigrationState *s, MigPendingData *pending,
qemu_savevm_query_pending(s, pending, exact, false);
}
-void qemu_savevm_query_pending_final(MigrationState *s, MigPendingData *pending)
+bool qemu_savevm_query_pending_final(MigrationState *s, MigPendingData *pending,
+ Error **errp)
{
g_assert(bql_locked());
qemu_savevm_query_pending(s, pending, true, true);
+
+ /*
+ * Switchover-ack requests done after switchover decision are not allowed.
+ * Fail the migration in this case since we currently don't support going
+ * back to precopy.
+ */
+ if (migrate_switchover_ack() && !migrate_switchover_ack_legacy() &&
+ pending->switchover_ack_pending > 0) {
+ error_setg(errp,
+ "Switchover ACK was requested by %" PRIu32
+ " devices during switchover",
+ pending->switchover_ack_pending);
+ return false;
+ }
+
+ return true;
}
void qemu_savevm_state_cleanup(void)
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 14/27] vfio/migration: Extract VFIO_MIG_FLAG_DEV_INIT_DATA_SENT sending to helper
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (12 preceding siblings ...)
2026-07-07 6:29 ` [PULL 13/27] migration: Fail migration if switchover-ack is requested after switchover decision Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 15/27] vfio/migration: Add Error ** parameter to vfio_migration_init() Cédric Le Goater
` (13 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Peter Xu, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
Extract the VFIO_MIG_FLAG_DEV_INIT_DATA_SENT flag sending logic from
vfio_save_iterate() into vfio_send_init_data_flag() for clarity. Also
add a trace while at it.
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-10-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/vfio/migration.c | 26 +++++++++++++++++++++-----
hw/vfio/trace-events | 1 +
2 files changed, 22 insertions(+), 5 deletions(-)
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 6b7acb2fa19d3ee618e73365ca995bbdb4676055..45f8e346b4a69a798366d460eccf028f35e7a47f 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -480,6 +480,26 @@ static void vfio_update_estimated_pending_data(VFIOMigration *migration,
data_size);
}
+/* Returns true if the init data flag was sent, false otherwise */
+static bool vfio_send_init_data_flag(QEMUFile *f, VFIOMigration *migration)
+{
+ VFIODevice *vbasedev = migration->vbasedev;
+
+ if (!migrate_switchover_ack()) {
+ return false;
+ }
+
+ if (migration->precopy_init_size || migration->initial_data_sent) {
+ return false;
+ }
+
+ qemu_put_be64(f, VFIO_MIG_FLAG_DEV_INIT_DATA_SENT);
+ migration->initial_data_sent = true;
+ trace_vfio_send_init_data_flag(vbasedev->name);
+
+ return true;
+}
+
static bool vfio_precopy_supported(VFIODevice *vbasedev)
{
VFIOMigration *migration = vbasedev->migration;
@@ -693,11 +713,7 @@ static int vfio_save_iterate(QEMUFile *f, void *opaque)
vfio_update_estimated_pending_data(migration, data_size);
- if (migrate_switchover_ack() && !migration->precopy_init_size &&
- !migration->initial_data_sent) {
- qemu_put_be64(f, VFIO_MIG_FLAG_DEV_INIT_DATA_SENT);
- migration->initial_data_sent = true;
- } else {
+ if (!vfio_send_init_data_flag(f, migration)) {
qemu_put_be64(f, VFIO_MIG_FLAG_END_OF_STATE);
}
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index fa2204f002970c31eb987ae13113a9a5edb3e172..fe0d2cc06f946b3f0db28d13994fbd0dfd854fbd 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -177,6 +177,7 @@ vfio_save_iterate(const char *name, uint64_t precopy_init_size, uint64_t precopy
vfio_save_iterate_start(const char *name) " (%s)"
vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer size %"PRIu64
vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool exact, bool final) " (%s) stopcopy size %"PRIu64", precopy initial size %"PRIu64", precopy dirty size %"PRIu64", exact %d, final %d"
+vfio_send_init_data_flag(const char *name) " (%s)"
vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
vfio_vmstate_change_prepare(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 15/27] vfio/migration: Add Error ** parameter to vfio_migration_init()
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (13 preceding siblings ...)
2026-07-07 6:29 ` [PULL 14/27] vfio/migration: Extract VFIO_MIG_FLAG_DEV_INIT_DATA_SENT sending to helper Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 16/27] vfio/migration: Add new switchover-ack mechanism Cédric Le Goater
` (12 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
vfio_migration_init() already has many failure points and a new one will
be added in next patch.
Add Error ** parameter to vfio_migration_init() to report a detailed
error message through it. Refactor it to return bool as well.
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-11-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/vfio/migration.c | 36 ++++++++++++++++++------------------
1 file changed, 18 insertions(+), 18 deletions(-)
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 45f8e346b4a69a798366d460eccf028f35e7a47f..3ab6b7248fea34dec3b58e508f97c8be4c962ce4 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -1056,7 +1056,7 @@ static bool vfio_dma_logging_supported(VFIODevice *vbasedev)
return !ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature);
}
-static int vfio_migration_init(VFIODevice *vbasedev)
+static bool vfio_migration_init(VFIODevice *vbasedev, Error **errp)
{
int ret;
Object *obj;
@@ -1067,22 +1067,32 @@ static int vfio_migration_init(VFIODevice *vbasedev)
VMChangeStateHandler *prepare_cb;
if (!vbasedev->ops->vfio_get_object) {
- return -EINVAL;
+ error_setg(errp, "no vfio_get_object handler");
+ return false;
}
obj = vbasedev->ops->vfio_get_object(vbasedev);
if (!obj) {
- return -EINVAL;
+ error_setg(errp, "failed to get object");
+ return false;
}
ret = vfio_migration_query_flags(vbasedev, &mig_flags);
if (ret) {
- return ret;
+ if (ret == -ENOTTY) {
+ error_setg_errno(errp, -ret,
+ "migration is not supported in kernel");
+ } else {
+ error_setg_errno(errp, -ret, "failed to query migration flags");
+ }
+
+ return false;
}
/* Basic migration functionality must be supported */
if (!(mig_flags & VFIO_MIGRATION_STOP_COPY)) {
- return -EOPNOTSUPP;
+ error_setg(errp, "VFIO_MIGRATION_STOP_COPY is not supported");
+ return false;
}
vbasedev->migration = g_new0(VFIOMigration, 1);
@@ -1113,7 +1123,7 @@ static int vfio_migration_init(VFIODevice *vbasedev)
migration_add_notifier(&migration->migration_state,
vfio_migration_state_notifier);
- return 0;
+ return true;
}
static Error *multiple_devices_migration_blocker;
@@ -1279,18 +1289,8 @@ bool vfio_migration_realize(VFIODevice *vbasedev, Error **errp)
return !vfio_block_migration(vbasedev, err, errp);
}
- ret = vfio_migration_init(vbasedev);
- if (ret) {
- if (ret == -ENOTTY) {
- error_setg(&err, "%s: VFIO migration is not supported in kernel",
- vbasedev->name);
- } else {
- error_setg(&err,
- "%s: Migration couldn't be initialized for VFIO device, "
- "err: %d (%s)",
- vbasedev->name, ret, strerror(-ret));
- }
-
+ if (!vfio_migration_init(vbasedev, &err)) {
+ error_prepend(&err, "%s: VFIO migration init failed: ", vbasedev->name);
return !vfio_block_migration(vbasedev, err, errp);
}
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 16/27] vfio/migration: Add new switchover-ack mechanism
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (14 preceding siblings ...)
2026-07-07 6:29 ` [PULL 15/27] vfio/migration: Add Error ** parameter to vfio_migration_init() Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 17/27] vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature Cédric Le Goater
` (11 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Peter Xu, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
Add support for the new switchover-ack mechanism. This includes
requesting a switchover ACK on the first save_query_pending call (with
exact=false) if VFIO precopy is supported.
This achieves the same functionality of legacy switchover-ack but with
the new switchover-ack mechanism.
Keep legacy switchover-ack functionality for backward compatibility.
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-12-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/vfio/vfio-migration-internal.h | 1 +
hw/vfio/migration.c | 13 ++++++++++++-
hw/vfio/trace-events | 2 +-
3 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/hw/vfio/vfio-migration-internal.h b/hw/vfio/vfio-migration-internal.h
index a15fc74703998da1956a92c4fb8cfe9ff3a68867..dc741e51421eec6d4ad4d9ce0f9c0c2f6199788d 100644
--- a/hw/vfio/vfio-migration-internal.h
+++ b/hw/vfio/vfio-migration-internal.h
@@ -58,6 +58,7 @@ typedef struct VFIOMigration {
bool multifd_transfer;
VFIOMultifd *multifd;
bool initial_data_sent;
+ bool request_switchover_ack;
bool event_save_iterate_started;
bool event_precopy_empty_hit;
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 3ab6b7248fea34dec3b58e508f97c8be4c962ce4..ebe2eafded50cdc3c1518a2f1e768fdfe6722c5a 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -582,6 +582,9 @@ static int vfio_save_setup(QEMUFile *f, void *opaque, Error **errp)
}
vfio_query_precopy_size(migration);
+ if (migrate_switchover_ack() && !migrate_switchover_ack_legacy()) {
+ migration->request_switchover_ack = true;
+ }
break;
case VFIO_DEVICE_STATE_STOP:
@@ -634,6 +637,7 @@ static void vfio_save_cleanup(void *opaque)
migration->precopy_init_size = 0;
migration->precopy_dirty_size = 0;
migration->initial_data_sent = false;
+ migration->request_switchover_ack = false;
vfio_migration_cleanup(vbasedev);
trace_vfio_save_cleanup(vbasedev->name);
}
@@ -655,6 +659,7 @@ static void vfio_state_pending(void *opaque, MigPendingData *pending,
VFIODevice *vbasedev = opaque;
VFIOMigration *migration = vbasedev->migration;
uint64_t precopy_size, stopcopy_size;
+ bool request_switchover_ack = false;
/*
* The final pending query runs during switchover downtime. VFIO does not
@@ -676,10 +681,16 @@ static void vfio_state_pending(void *opaque, MigPendingData *pending,
pending->precopy_bytes += precopy_size;
pending->stopcopy_bytes += stopcopy_size;
+ if (migration->request_switchover_ack) {
+ pending->switchover_ack_pending++;
+ request_switchover_ack = true;
+ migration->request_switchover_ack = false;
+ }
trace_vfio_state_pending(vbasedev->name, migration->stopcopy_size,
migration->precopy_init_size,
- migration->precopy_dirty_size, exact, final);
+ migration->precopy_dirty_size,
+ request_switchover_ack, exact, final);
}
static bool vfio_is_active_iterate(void *opaque)
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index fe0d2cc06f946b3f0db28d13994fbd0dfd854fbd..c9d143826d38d77048ecf179cbda19a7184989a4 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -176,7 +176,7 @@ vfio_save_device_config_state(const char *name) " (%s)"
vfio_save_iterate(const char *name, uint64_t precopy_init_size, uint64_t precopy_dirty_size) " (%s) precopy initial size %"PRIu64" precopy dirty size %"PRIu64
vfio_save_iterate_start(const char *name) " (%s)"
vfio_save_setup(const char *name, uint64_t data_buffer_size) " (%s) data buffer size %"PRIu64
-vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool exact, bool final) " (%s) stopcopy size %"PRIu64", precopy initial size %"PRIu64", precopy dirty size %"PRIu64", exact %d, final %d"
+vfio_state_pending(const char *name, uint64_t stopcopy_size, uint64_t precopy_init_size, uint64_t precopy_dirty_size, bool request_switchover_ack, bool exact, bool final) " (%s) stopcopy size %"PRIu64", precopy initial size %"PRIu64", precopy dirty size %"PRIu64", request switchover ack %d, exact %d, final %d"
vfio_send_init_data_flag(const char *name) " (%s)"
vfio_vmstate_change(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
vfio_vmstate_change_prepare(const char *name, int running, const char *reason, const char *dev_state) " (%s) running %d reason %s device state %s"
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 17/27] vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (15 preceding siblings ...)
2026-07-07 6:29 ` [PULL 16/27] vfio/migration: Add new switchover-ack mechanism Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 18/27] vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during switchover Cédric Le Goater
` (10 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Peter Xu, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
According to VFIO uAPI, precopy initial_bytes is considered as critical
data that should be transferred and loaded prior to moving to STOP_COPY
state to ensure precopy phase would be effective.
As currently defined, initial_bytes can only decrease as it's being read
from the data fd. However, there are cases where a new chunk of
initial_bytes should be transferred during precopy.
The new VFIO_PRECOPY_INFO_REINIT feature addresses this and allows
reporting a new value for initial_bytes regardless of any previously
reported values.
Implement VFIO_PRECOPY_INFO_REINIT feature:
1. Opt-in for VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 to make
VFIO_PRECOPY_INFO_REINIT available.
2. Request a new switchover ACK if initial_bytes increases post of a
previous switchover ACK. This ensures the device is not moved to
STOP_COPY before initial_bytes has reached zero again.
Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-13-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
docs/devel/migration/vfio.rst | 14 +++++++
hw/vfio/vfio-migration-internal.h | 1 +
hw/vfio/migration.c | 68 ++++++++++++++++++++++++++++---
hw/vfio/trace-events | 4 +-
4 files changed, 80 insertions(+), 7 deletions(-)
diff --git a/docs/devel/migration/vfio.rst b/docs/devel/migration/vfio.rst
index 854277b11ce64672f998ce1728bf8b5ddf1c129a..f235c2d4f9d1bae5aa8bdcc2701340780d558f89 100644
--- a/docs/devel/migration/vfio.rst
+++ b/docs/devel/migration/vfio.rst
@@ -23,6 +23,20 @@ and recommends that the initial bytes are sent and loaded in the destination
before stopping the source VM. Enabling this migration capability will
guarantee that and thus, can potentially reduce downtime even further.
+For example, in mlx5 devices, the initial bytes hold metadata used for time
+consuming pre-allocations of resources on the destination. Although init bytes
+may be small in size and sending them may take little time, loading them in the
+destination can take a significant amount of time. Switchover-ack guarantees
+that this pre-allocation doesn't happen during downtime.
+
+Initial bytes was originally defined to be monotonically decreasing, however
+there are cases where a new chunk of initial bytes should be transferred during
+precopy, e.g., due to a device reconfiguration, etc. The
+VFIO_PRECOPY_INFO_REINIT feature addresses this and when supported, allows to
+report a new initial bytes value regardless of any previously reported values.
+In this case, a new switchover ACK will be requested to make sure the new
+initial bytes are loaded in the destination before switching over.
+
To support migration of multiple devices that might do P2P transactions between
themselves, VFIO migration uAPI defines an intermediate P2P quiescent state.
While in the P2P quiescent state, P2P DMA transactions cannot be initiated by
diff --git a/hw/vfio/vfio-migration-internal.h b/hw/vfio/vfio-migration-internal.h
index dc741e51421eec6d4ad4d9ce0f9c0c2f6199788d..a1c58b112685d868c6f942d6225b553d44bb6613 100644
--- a/hw/vfio/vfio-migration-internal.h
+++ b/hw/vfio/vfio-migration-internal.h
@@ -45,6 +45,7 @@ typedef struct VFIOMigration {
void *data_buffer;
size_t data_buffer_size;
uint64_t mig_flags;
+ bool precopy_info_v2_used;
/*
* NOTE: all three sizes cached are reported from VFIO's uAPI, which
* are defined as estimate only. QEMU should not trust these values
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index ebe2eafded50cdc3c1518a2f1e768fdfe6722c5a..1e172dd10bfc3561741aa90bf1e237cd6847eb63 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -373,9 +373,11 @@ static int vfio_query_stop_copy_size(VFIODevice *vbasedev)
static int vfio_query_precopy_size(VFIOMigration *migration)
{
+ VFIODevice *vbasedev = migration->vbasedev;
struct vfio_precopy_info precopy = {
.argsz = sizeof(precopy),
};
+ bool reinit = false;
int ret = 0;
if (ioctl(migration->data_fd, VFIO_MIG_GET_PRECOPY_INFO, &precopy)) {
@@ -383,25 +385,43 @@ static int vfio_query_precopy_size(VFIOMigration *migration)
migration->precopy_dirty_size = 0;
ret = -errno;
warn_report_once("VFIO device %s ioctl(VFIO_MIG_GET_PRECOPY_INFO) "
- "failed (%d)", migration->vbasedev->name, ret);
+ "failed (%d)", vbasedev->name, ret);
} else {
bool overflow;
migration->precopy_init_size = precopy.initial_bytes;
migration->precopy_dirty_size = precopy.dirty_bytes;
+ /*
+ * struct vfio_precopy_info.flags is valid only if
+ * VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2 is used.
+ */
+ if (migration->precopy_info_v2_used) {
+ reinit = precopy.flags & VFIO_PRECOPY_INFO_REINIT;
+ }
- overflow = vfio_migration_check_overflow(migration->vbasedev,
+ overflow = vfio_migration_check_overflow(vbasedev,
migration->precopy_init_size, "precopy init size");
- overflow |= vfio_migration_check_overflow(migration->vbasedev,
+ overflow |= vfio_migration_check_overflow(vbasedev,
migration->precopy_dirty_size, "precopy dirty size");
if (overflow) {
ret = -ERANGE;
}
}
- trace_vfio_query_precopy_size(migration->vbasedev->name,
- migration->precopy_init_size,
- migration->precopy_dirty_size, ret);
+ trace_vfio_query_precopy_size(vbasedev->name, migration->precopy_init_size,
+ migration->precopy_dirty_size, reinit, ret);
+
+ /*
+ * If we got new initial_bytes after previous initial_bytes were
+ * transferred, request a new switchover ACK. Don't request if legacy
+ * switchover-ack is used.
+ */
+ if (reinit && migration->initial_data_sent &&
+ !migrate_switchover_ack_legacy()) {
+ migration->initial_data_sent = false;
+ migration->request_switchover_ack = true;
+ trace_vfio_query_precopy_size_request_switchover_ack(vbasedev->name);
+ }
return ret;
}
@@ -1054,6 +1074,27 @@ static int vfio_migration_query_flags(VFIODevice *vbasedev, uint64_t *mig_flags)
return 0;
}
+/* Returns 1 on success, 0 if not supported and negative errno on failure */
+static int vfio_migration_set_precopy_info_v2(VFIODevice *vbasedev)
+{
+ uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature),
+ sizeof(uint64_t))] = {};
+ struct vfio_device_feature *feature = (struct vfio_device_feature *)buf;
+
+ feature->argsz = sizeof(buf);
+ feature->flags =
+ VFIO_DEVICE_FEATURE_SET | VFIO_DEVICE_FEATURE_MIG_PRECOPY_INFOv2;
+ if (ioctl(vbasedev->fd, VFIO_DEVICE_FEATURE, feature)) {
+ if (errno == ENOTTY) {
+ return 0;
+ }
+
+ return -errno;
+ }
+
+ return 1;
+}
+
static bool vfio_dma_logging_supported(VFIODevice *vbasedev)
{
uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature),
@@ -1075,6 +1116,7 @@ static bool vfio_migration_init(VFIODevice *vbasedev, Error **errp)
char id[256] = "";
g_autofree char *path = NULL, *oid = NULL;
uint64_t mig_flags = 0;
+ bool precopy_info_v2_used = false;
VMChangeStateHandler *prepare_cb;
if (!vbasedev->ops->vfio_get_object) {
@@ -1106,12 +1148,22 @@ static bool vfio_migration_init(VFIODevice *vbasedev, Error **errp)
return false;
}
+ if (mig_flags & VFIO_MIGRATION_PRE_COPY) {
+ ret = vfio_migration_set_precopy_info_v2(vbasedev);
+ if (ret < 0) {
+ error_setg_errno(errp, -ret, "failed to set precopy info v2");
+ return false;
+ }
+ precopy_info_v2_used = ret;
+ }
+
vbasedev->migration = g_new0(VFIOMigration, 1);
migration = vbasedev->migration;
migration->vbasedev = vbasedev;
migration->device_state = VFIO_DEVICE_STATE_RUNNING;
migration->data_fd = -1;
migration->mig_flags = mig_flags;
+ migration->precopy_info_v2_used = precopy_info_v2_used;
vbasedev->dirty_pages_supported = vfio_dma_logging_supported(vbasedev);
@@ -1134,6 +1186,10 @@ static bool vfio_migration_init(VFIODevice *vbasedev, Error **errp)
migration_add_notifier(&migration->migration_state,
vfio_migration_state_notifier);
+ trace_vfio_migration_init(vbasedev->name, migration->mig_flags,
+ migration->precopy_info_v2_used,
+ vbasedev->dirty_pages_supported);
+
return true;
}
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index c9d143826d38d77048ecf179cbda19a7184989a4..f71d0bbc0a5440e4ccd374fac4733af08438e7be 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -159,11 +159,13 @@ vfio_load_state_device_buffer_starved(const char *name, uint32_t idx) " (%s) idx
vfio_load_state_device_buffer_load_start(const char *name, uint32_t idx) " (%s) idx %"PRIu32
vfio_load_state_device_buffer_load_end(const char *name, uint32_t idx) " (%s) idx %"PRIu32
vfio_load_state_device_buffer_end(const char *name) " (%s)"
+vfio_migration_init(const char *name, uint64_t mig_flags, bool precopy_info_v2_used, bool dirty_pages_supported) " (%s) mig_flags 0x%"PRIx64", precopy_info_v2_used %d, dirty_pages_supported %d"
vfio_migration_realize(const char *name) " (%s)"
vfio_migration_set_device_state(const char *name, const char *state) " (%s) state %s"
vfio_migration_set_state(const char *name, const char *new_state, const char *recover_state) " (%s) new state %s, recover state %s"
vfio_migration_state_notifier(const char *name, int state) " (%s) state %d"
-vfio_query_precopy_size(const char *name, uint64_t init_size, uint64_t dirty_size, int ret) " (%s) init %"PRIu64" dirty %"PRIu64" ret %d"
+vfio_query_precopy_size(const char *name, uint64_t init_size, uint64_t dirty_size, bool reinit, int ret) " (%s) init %"PRIu64", dirty %"PRIu64", reinit %d, ret %d"
+vfio_query_precopy_size_request_switchover_ack(const char *name) " (%s)"
vfio_query_stop_copy_size(const char *name, uint64_t size, int ret) " (%s) stopcopy size %"PRIu64" ret %d"
vfio_save_block(const char *name, int data_size) " (%s) data_size %d"
vfio_save_block_precopy_empty_hit(const char *name) " (%s)"
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 18/27] vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during switchover
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (16 preceding siblings ...)
2026-07-07 6:29 ` [PULL 17/27] vfio/migration: Implement VFIO_PRECOPY_INFO_REINIT feature Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 19/27] migration: Enable new switchover-ack Cédric Le Goater
` (9 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Peter Xu, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
VFIO_REPCOPY_INFO_REINIT is checked only during precopy, before the
switchover decision. However, the switchover decision and guest stop are
not atomic, so a VFIO device may want to set VFIO_PRECOPY_INFO_REINIT
and request another switchover ACK in the gap after switchover decision
has been made but before the guest is stopped. This would be missed and
may increase downtime.
Solve this by checking if VFIO_PRECOPY_INFO_REINIT was set during that
gap, and request a new switchover-ack in the final save_state_pending
call. Query precopy info after vCPUs are stopped but before
transitioning from PRE_COPY state, when its valid to call the ioctl.
Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-14-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/vfio/migration.c | 32 ++++++++++++++++++++++++++++++++
1 file changed, 32 insertions(+)
diff --git a/hw/vfio/migration.c b/hw/vfio/migration.c
index 1e172dd10bfc3561741aa90bf1e237cd6847eb63..73c49d8c24f21803de7c8615da63abecfd76b882 100644
--- a/hw/vfio/migration.c
+++ b/hw/vfio/migration.c
@@ -685,6 +685,9 @@ static void vfio_state_pending(void *opaque, MigPendingData *pending,
* The final pending query runs during switchover downtime. VFIO does not
* need a fresh device pending-data query then to get the latest dirty
* data, so avoid the extra work and report the cached counters below.
+ * On the other hand, precopy sync is needed to check if switchover ACK was
+ * requested, but that's already done during guest stop when device is in
+ * PRE_COPY state.
*/
if (exact && !final) {
vfio_state_pending_sync(vbasedev);
@@ -964,6 +967,26 @@ static const SaveVMHandlers savevm_vfio_handlers = {
/* ---------------------------------------------------------------------- */
+static void vfio_final_precopy_reinit_check(VFIODevice *vbasedev)
+{
+ VFIOMigration *migration = vbasedev->migration;
+ int ret;
+
+ if (!migration->precopy_info_v2_used || !migrate_switchover_ack() ||
+ migrate_switchover_ack_legacy()) {
+ return;
+ }
+
+ ret = vfio_query_precopy_size(migration);
+ if (ret) {
+ error_report("%s: Final precopy reinit check failed (err: %d)",
+ vbasedev->name, ret);
+ /* If query failed, assume reinit and request switchover-ack */
+ migration->request_switchover_ack = true;
+ migration->initial_data_sent = false;
+ }
+}
+
static void vfio_vmstate_change_prepare(void *opaque, bool running,
RunState state)
{
@@ -977,6 +1000,15 @@ static void vfio_vmstate_change_prepare(void *opaque, bool running,
VFIO_DEVICE_STATE_PRE_COPY_P2P :
VFIO_DEVICE_STATE_RUNNING_P2P;
+ if (migration->device_state == VFIO_DEVICE_STATE_PRE_COPY) {
+ /*
+ * Now that vCPUs are stopped, check if new init_bytes are available
+ * since switchover decision, to be reported in the final
+ * save_query_pending.
+ */
+ vfio_final_precopy_reinit_check(vbasedev);
+ }
+
ret = vfio_migration_set_state_or_reset(vbasedev, new_state, &local_err);
if (ret) {
/*
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 19/27] migration: Enable new switchover-ack
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (17 preceding siblings ...)
2026-07-07 6:29 ` [PULL 18/27] vfio/migration: Check VFIO_PRECOPY_INFO_REINIT during switchover Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 20/27] migration: Refactor migration_completion_precopy() to return bool Cédric Le Goater
` (8 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
Now that VFIO has implemented new switchover-ack, enable it for new
machines and keep legacy behavior for old machines.
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-15-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/core/machine.c | 1 +
migration/options.c | 3 +--
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 5b97df6db962476ed6fea5444d29e6cbaa810feb..15886a56b194239efba3db54e961b612c70dbaa1 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -48,6 +48,7 @@ GlobalProperty hw_compat_11_0[] = {
{ TYPE_ARM_SMMUV3, "ril", "on" },
{ TYPE_ARM_SMMUV3, "ssidsize", "0" },
{ TYPE_ARM_SMMUV3, "oas", "44" },
+ { "migration", "switchover-ack-legacy", "on" },
};
const size_t hw_compat_11_0_len = G_N_ELEMENTS(hw_compat_11_0);
diff --git a/migration/options.c b/migration/options.c
index 4c9b25372e03b55ee9127c027c5d4eefba796b06..dfce19405d4583894c2d22578a8e1d32da613d54 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -110,9 +110,8 @@ const Property migration_properties[] = {
preempt_pre_7_2, false),
DEFINE_PROP_BOOL("multifd-clean-tls-termination", MigrationState,
multifd_clean_tls_termination, true),
- /* Use legacy until VFIO implements new switchover-ack */
DEFINE_PROP_BOOL("switchover-ack-legacy", MigrationState,
- switchover_ack_legacy, true),
+ switchover_ack_legacy, false),
/* Migration parameters */
DEFINE_PROP_UINT8("x-throttle-trigger-threshold", MigrationState,
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 20/27] migration: Refactor migration_completion_precopy() to return bool
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (18 preceding siblings ...)
2026-07-07 6:29 ` [PULL 19/27] migration: Enable new switchover-ack Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 21/27] migration: Fix "switchover" used as a verb in comments and docs Cédric Le Goater
` (7 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
migration_completion_precopy() reports its error through the Error
**errp argument, so its int return value carries no information beyond
success/failure. Convert it to return a bool, matching the common
convention.
Convert its underlying helper qemu_savevm_state_complete_precopy()
likewise, and in turn qemu_savevm_state_non_iterable(), which it calls.
Adjust all callers accordingly.
Refactor and clean migration_completion() code too, which no longer
needs to track int return values.
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-16-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
migration/savevm.h | 4 ++--
migration/migration.c | 35 ++++++++++++++---------------------
migration/savevm.c | 32 +++++++++++++++-----------------
3 files changed, 31 insertions(+), 40 deletions(-)
diff --git a/migration/savevm.h b/migration/savevm.h
index 415198423f578049c209a1e40b796cfe63b410f0..f7dcdd7d1b6b7b5397eb1b6aab5cb5816a92f1a8 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -44,7 +44,7 @@ void qemu_savevm_state_header(QEMUFile *f);
int qemu_savevm_state_iterate(QEMUFile *f, bool postcopy);
void qemu_savevm_state_cleanup(void);
void qemu_savevm_state_complete_postcopy(QEMUFile *f);
-int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
+bool qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp);
void qemu_savevm_query_pending_iter(MigrationState *s, MigPendingData *pending,
bool exact);
bool qemu_savevm_query_pending_final(MigrationState *s,
@@ -74,7 +74,7 @@ int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis,
Error **errp);
int qemu_load_device_state(QEMUFile *f, Error **errp);
int qemu_loadvm_approve_switchover(const char *approver);
-int qemu_savevm_state_non_iterable(QEMUFile *f, Error **errp);
+bool qemu_savevm_state_non_iterable(QEMUFile *f, Error **errp);
int qemu_savevm_state_non_iterable_early(QEMUFile *f,
JSONWriter *vmdesc,
Error **errp);
diff --git a/migration/migration.c b/migration/migration.c
index 98603ee19c34531d069400d1ab0ed36b65bb228e..7d5acd93c32393c9611731ab153b23f4bbc826a3 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2659,8 +2659,7 @@ static int postcopy_start(MigrationState *ms, Error **errp)
*/
qemu_savevm_send_postcopy_listen(fb);
- ret = qemu_savevm_state_non_iterable(fb, errp);
- if (ret) {
+ if (!qemu_savevm_state_non_iterable(fb, errp)) {
error_prepend(errp, "Postcopy save non-iterable states failed: ");
goto fail_closefb;
}
@@ -2858,22 +2857,22 @@ static bool migration_switchover_start(MigrationState *s, Error **errp)
return true;
}
-static int migration_completion_precopy(MigrationState *s, Error **errp)
+static bool migration_completion_precopy(MigrationState *s, Error **errp)
{
- int ret;
+ bool ret = false;
bql_lock();
if (!migrate_mode_is_cpr()) {
- ret = migration_stop_vm(s, RUN_STATE_FINISH_MIGRATE);
- if (ret < 0) {
- error_setg_errno(errp, -ret, "Failed to stop the VM");
+ int r = migration_stop_vm(s, RUN_STATE_FINISH_MIGRATE);
+
+ if (r < 0) {
+ error_setg_errno(errp, -r, "Failed to stop the VM");
goto out_unlock;
}
}
if (!migration_switchover_start(s, errp)) {
- ret = -EFAULT;
goto out_unlock;
}
@@ -2910,18 +2909,17 @@ static void migration_completion_postcopy(MigrationState *s)
*/
static void migration_completion(MigrationState *s)
{
- int ret = 0;
Error *local_err = NULL;
if (s->state == MIGRATION_STATUS_ACTIVE) {
- ret = migration_completion_precopy(s, &local_err);
+ if (!migration_completion_precopy(s, &local_err)) {
+ goto fail;
+ }
} else if (s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE) {
migration_completion_postcopy(s);
} else {
- ret = -1;
- }
-
- if (ret < 0) {
+ error_setg(&local_err, "Unexpected migration completion status %s",
+ MigrationStatus_str(s->state));
goto fail;
}
@@ -2945,12 +2943,7 @@ static void migration_completion(MigrationState *s)
return;
fail:
- if (local_err) {
- migrate_error_propagate(s, local_err);
- } else if (qemu_file_get_error_obj(s->to_dst_file, &local_err)) {
- migrate_error_propagate(s, local_err);
- } else if (ret) {
- error_setg_errno(&local_err, -ret, "Error in migration completion");
+ if (local_err || qemu_file_get_error_obj(s->to_dst_file, &local_err)) {
migrate_error_propagate(s, local_err);
}
@@ -3863,7 +3856,7 @@ static void *bg_migration_thread(void *opaque)
goto fail_with_bql;
}
- if (qemu_savevm_state_non_iterable(fb, &local_err)) {
+ if (!qemu_savevm_state_non_iterable(fb, &local_err)) {
error_prepend(&local_err, "Failed to save non-iterable devices ");
goto fail_with_bql;
}
diff --git a/migration/savevm.c b/migration/savevm.c
index f654a1c563df40d546e42018a3706e92fb11cfa7..bbb8d2b47c6452b228c67cbbdaacc7c333985be7 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1737,13 +1737,12 @@ void qemu_savevm_state_end_precopy(MigrationState *s, QEMUFile *f)
qemu_savevm_state_vm_desc(s, f);
}
-int qemu_savevm_state_non_iterable(QEMUFile *f, Error **errp)
+bool qemu_savevm_state_non_iterable(QEMUFile *f, Error **errp)
{
MigrationState *ms = migrate_get_current();
int64_t start_ts_each, end_ts_each;
JSONWriter *vmdesc = ms->vmdesc;
SaveStateEntry *se;
- int ret;
/* Making sure cpu states are synchronized before saving non-iterable */
cpu_synchronize_all_states();
@@ -1756,9 +1755,8 @@ int qemu_savevm_state_non_iterable(QEMUFile *f, Error **errp)
start_ts_each = qemu_clock_get_us(QEMU_CLOCK_REALTIME);
- ret = vmstate_save(f, se, vmdesc, errp);
- if (ret) {
- return ret;
+ if (vmstate_save(f, se, vmdesc, errp) < 0) {
+ return false;
}
end_ts_each = qemu_clock_get_us(QEMU_CLOCK_REALTIME);
@@ -1768,10 +1766,10 @@ int qemu_savevm_state_non_iterable(QEMUFile *f, Error **errp)
trace_vmstate_downtime_checkpoint("src-non-iterable-saved");
- return 0;
+ return true;
}
-int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp)
+bool qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp)
{
ERRP_GUARD();
QEMUFile *f = s->to_dst_file;
@@ -1781,12 +1779,11 @@ int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp)
if (ret) {
qemu_file_get_error_obj(f, errp);
error_prepend(errp, "Failed to save iterable device state: ");
- return ret;
+ return false;
}
- ret = qemu_savevm_state_non_iterable(f, errp);
- if (ret) {
- return ret;
+ if (!qemu_savevm_state_non_iterable(f, errp)) {
+ return false;
}
qemu_savevm_state_end_precopy(s, f);
@@ -1795,10 +1792,10 @@ int qemu_savevm_state_complete_precopy(MigrationState *s, Error **errp)
if (ret) {
qemu_file_get_error_obj(f, errp);
error_prepend(errp, "Failed to flush QEMUFile: ");
- return ret;
+ return false;
}
- return 0;
+ return true;
}
static void qemu_savevm_query_pending(MigrationState *s,
@@ -1928,7 +1925,9 @@ static int qemu_savevm_state(QEMUFile *f, Error **errp)
goto cleanup;
}
- ret = qemu_savevm_state_complete_precopy(ms, errp);
+ if (!qemu_savevm_state_complete_precopy(ms, errp)) {
+ ret = -1;
+ }
cleanup:
qemu_savevm_state_cleanup();
@@ -1962,9 +1961,8 @@ int qemu_save_device_state(QEMUFile *f, Error **errp)
return ret;
}
- ret = qemu_savevm_state_non_iterable(f, errp);
- if (ret) {
- return ret;
+ if (!qemu_savevm_state_non_iterable(f, errp)) {
+ return -1;
}
qemu_savevm_state_end(f);
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 21/27] migration: Fix "switchover" used as a verb in comments and docs
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (19 preceding siblings ...)
2026-07-07 6:29 ` [PULL 20/27] migration: Refactor migration_completion_precopy() to return bool Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 22/27] iommufd: Introduce handler for device ATS support Cédric Le Goater
` (6 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Avihai Horon, Cédric Le Goater
From: Avihai Horon <avihaih@nvidia.com>
"Switchover" is a noun; the verb form is "switch over". Replace all
instances where "switchover" was incorrectly used as a verb in comments
and documentation.
Signed-off-by: Avihai Horon <avihaih@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260706085211.13905-17-avihaih@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
qapi/migration.json | 4 ++--
migration/migration.h | 6 +++---
migration/migration.c | 4 ++--
migration/savevm.c | 2 +-
4 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/qapi/migration.json b/qapi/migration.json
index d2f42c4b0ffd0a9e6bb757b8d105fed89b423537..66bd900465a2d757baf863baa0937a18b4585d2a 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -509,7 +509,7 @@
#
# @switchover-ack: If enabled, migration will not stop the source VM
# and complete the migration until the destination has
-# acknowledged that it is OK to switchover. The acknowledgement
+# acknowledged that it is OK to switch over. The acknowledgement
# may depend, for example, on some device's data being loaded in
# the destination before doing switchover. This can reduce
# downtime if devices that support this capability are present.
@@ -919,7 +919,7 @@
# migration can use during switchover phase, in bytes per
# second. **Note:** this does not limit the bandwidth during
# switchover, but only for calculations when making decisions to
-# switchover. By default, this value is zero, which means QEMU
+# switch over. By default, this value is zero, which means QEMU
# will estimate the bandwidth automatically. This can be set
# when the estimated value is not accurate, while the user is
# able to guarantee such bandwidth is available when switching
diff --git a/migration/migration.h b/migration/migration.h
index 44bce199cd8c3518998ad7204d599566d1ef9ddd..631421c784bc1cee7073ff6ff0011188fc810592 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -496,12 +496,12 @@ struct MigrationState {
* migration progresses, the devices on the destination acknowledge
* switchover, decreasing the counter. When the counter reaches zero, a
* single ACK message is sent to the source via the return path, indicating
- * that it's OK to switchover.
+ * that it's OK to switch over.
*
* In new switchover-ack, the source is the one that keeps track of a
* pending ACKs counter. As migration progresses, the destination sends ACK
* message per-device via the return path, which decrements the source
- * counter. When the counter reaches zero, it's OK to switchover. During
+ * counter. When the counter reaches zero, it's OK to switch over. During
* precopy, source-side devices may request additional ACKs, which increment
* the counter again.
*
@@ -521,7 +521,7 @@ struct MigrationState {
/*
* Indicates the number of pending ACKs from the destination. The value may
* increase or decrease during precopy as new ACKs are requested or
- * received. When zero is reached, it's OK to switchover. In legacy
+ * received. When zero is reached, it's OK to switch over. In legacy
* switchover-ack, it's initialized to 1 and decreased to zero upon ACK.
*/
uint32_t switchover_ack_pending_num;
diff --git a/migration/migration.c b/migration/migration.c
index 7d5acd93c32393c9611731ab153b23f4bbc826a3..9736c14458b9eb87e14ac242e7aff0c6b5bf6900 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -3293,7 +3293,7 @@ static bool migration_iteration_next_ready(MigrationState *s,
MigPendingData *pending)
{
/*
- * If the estimated values already suggest us to switchover, mark this
+ * If the estimated values already suggest us to switch over, mark this
* iteration finished, time to do a slow sync.
*/
if (pending->total_bytes <= s->threshold_size) {
@@ -3418,7 +3418,7 @@ static MigIterateState migration_iteration_run(MigrationState *s)
migration_iteration_go_next(s, &pending);
}
- /* Check can switchover after qemu_savevm_query_pending() */
+ /* Check if we can switch over after qemu_savevm_query_pending() */
can_switchover = migration_can_switchover(s);
/* Should we switch to postcopy now? */
diff --git a/migration/savevm.c b/migration/savevm.c
index bbb8d2b47c6452b228c67cbbdaacc7c333985be7..34dd06f9f732dee7d3c6d0458da8bb67f23d76b4 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2509,7 +2509,7 @@ static int loadvm_postcopy_handle_switchover_start(Error **errp)
/*
* If legacy switchover-ack is enabled but no device uses it, need to send an
- * ACK to source that it's OK to switchover.
+ * ACK to source that it's OK to switch over.
*/
static int loadvm_switchover_ack_no_users_legacy(MigrationIncomingState *mis,
Error **errp)
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 22/27] iommufd: Introduce handler for device ATS support
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (20 preceding siblings ...)
2026-07-07 6:29 ` [PULL 21/27] migration: Fix "switchover" used as a verb in comments and docs Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 23/27] vfio/pci: Add ats property Cédric Le Goater
` (5 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Nathan Chen, Shameer Kolothum, Cédric Le Goater
From: Nathan Chen <nathanc@nvidia.com>
Introduce a support_ats() handler that returns whether ATS is supported
for a device associated with a host IOMMU device, checking if the
IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED capability bit is set.
Implement this handler in a new function for iommufd.
Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Link: https://lore.kernel.org/qemu-devel/20260623204943.989903-2-nathanc@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
include/system/host_iommu_device.h | 9 +++++++++
backends/iommufd.c | 8 ++++++++
2 files changed, 17 insertions(+)
diff --git a/include/system/host_iommu_device.h b/include/system/host_iommu_device.h
index f0003015832855b7173475559ef411bee31d1c86..2cb53653406ceec30906120ffbfd263a3d0810e8 100644
--- a/include/system/host_iommu_device.h
+++ b/include/system/host_iommu_device.h
@@ -133,6 +133,15 @@ struct HostIOMMUDeviceClass {
* Returns: true on success, false on failure.
*/
bool (*get_pasid_info)(HostIOMMUDevice *hiod, PasidInfo *pasid_info);
+ /**
+ * @support_ats: Returns true if ATS can be used by the device,
+ * false if the host IOMMU reports it is unavailable.
+ *
+ * @hiod: handle to the host IOMMU device
+ *
+ * Returns: true if ATS is supported, false otherwise
+ */
+ bool (*support_ats)(HostIOMMUDevice *hiod);
};
/*
diff --git a/backends/iommufd.c b/backends/iommufd.c
index 09624cd6526b4027b82b02dad3e6494231fedc2c..4b40aaebe6cbb9d27b0d0b15f093a79fac9ed3b3 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -638,6 +638,13 @@ static int hiod_iommufd_get_cap(HostIOMMUDevice *hiod, int cap, Error **errp)
}
}
+static bool hiod_iommufd_support_ats(HostIOMMUDevice *hiod)
+{
+ HostIOMMUDeviceCaps *caps = &hiod->caps;
+
+ return !(caps->hw_caps & IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED);
+}
+
static bool hiod_iommufd_get_pasid_info(HostIOMMUDevice *hiod,
PasidInfo *pasid_info)
{
@@ -660,6 +667,7 @@ static void hiod_iommufd_class_init(ObjectClass *oc, const void *data)
hiodc->get_cap = hiod_iommufd_get_cap;
hiodc->get_pasid_info = hiod_iommufd_get_pasid_info;
+ hiodc->support_ats = hiod_iommufd_support_ats;
};
static const TypeInfo types[] = {
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 23/27] vfio/pci: Add ats property
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (21 preceding siblings ...)
2026-07-07 6:29 ` [PULL 22/27] iommufd: Introduce handler for device ATS support Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 24/27] vfio/pci: Propagate errors in vfio_pci_load_rom() using Error API Cédric Le Goater
` (4 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Nathan Chen, Shameer Kolothum, Cédric Le Goater
From: Nathan Chen <nathanc@nvidia.com>
Add an "ats" OnOffAuto property to vfio-pci. When the device has an ATS
extended capability in config space but we should not expose it (ats=off,
or ats=auto and kernel reports IOMMU_HW_CAP_PCI_ATS_NOT_SUPPORTED), mask
the capability so the guest does not see it.
If ATS is explicitly requested but not supported by the kernel, fail
device realize.
This aligns with the kernel's per-device effective ATS reporting and allows
vfio-pci to mask ATS when the host kernel reports ATS as unsupported.
Emit a warning when ats=on is requested but the physical device does not
advertise ATS, since ATS cannot be exposed to the guest in this case.
Emit a warning when ats=auto, ats cap is present on the physical device,
but kernel reports ATS as unsupported.
Suggested-by: Shameer Kolothum <skolothumtho@nvidia.com>
Signed-off-by: Nathan Chen <nathanc@nvidia.com>
Reviewed-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260623204943.989903-3-nathanc@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/vfio/pci.h | 1 +
hw/vfio/pci.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++---
2 files changed, 85 insertions(+), 4 deletions(-)
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index cf56711587058b8cf5197945755fff2456168c00..fe52e9df6e67707c9899d418b0261afeedf4aab2 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -188,6 +188,7 @@ struct VFIOPCIDevice {
bool clear_parent_atomics_on_exit;
bool skip_vsc_check;
uint16_t vpasid_cap_offset;
+ OnOffAuto ats;
VFIODisplay *dpy;
Notifier irqchip_change_notifier;
VFIOPCICPR cpr;
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 6b04c6f94f9ade765e236d457e4828ac6199680a..c7f163399f8fbcc4ff70819a0d67879eb26980f9 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2548,10 +2548,53 @@ static bool vfio_pci_synthesize_pasid_cap(VFIOPCIDevice *vdev, Error **errp)
return true;
}
-static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
+/*
+ * Determine whether ATS capability should be advertised for @vdev, based on
+ * whether it was enabled on the command line and whether it is supported
+ * according to the kernel.
+ *
+ * Store whether ATS capability should be advertised in @ats_needed.
+ *
+ * Returns false only when ats=on is explicitly requested but the kernel
+ * reports it is not supported. Returns true in all other cases.
+ */
+static bool vfio_pci_ats_requested_and_supported(VFIOPCIDevice *vdev,
+ bool *ats_needed, Error **errp)
+{
+ HostIOMMUDevice *hiod = vdev->vbasedev.hiod;
+ HostIOMMUDeviceClass *hiodc;
+ bool ats_supported;
+ *ats_needed = false;
+
+ if (vdev->ats == ON_OFF_AUTO_OFF) {
+ return true;
+ }
+
+ *ats_needed = true;
+ if (!hiod) {
+ return true;
+ }
+ hiodc = HOST_IOMMU_DEVICE_GET_CLASS(hiod);
+ if (!hiodc || !hiodc->support_ats) {
+ return true;
+ }
+
+ ats_supported = hiodc->support_ats(hiod);
+ if (vdev->ats == ON_OFF_AUTO_ON && !ats_supported) {
+ error_setg(errp, "vfio-pci: ATS requested but not supported by kernel");
+ *ats_needed = false;
+ return false;
+ }
+
+ *ats_needed = ats_supported;
+ return true;
+}
+
+static void vfio_add_ext_cap(VFIOPCIDevice *vdev, bool ats_needed)
{
PCIDevice *pdev = PCI_DEVICE(vdev);
bool pasid_cap_added = false;
+ bool ats_cap_present = false;
Error *err = NULL;
uint32_t header;
uint16_t cap_id, next, size;
@@ -2637,7 +2680,19 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
*/
case PCI_EXT_CAP_ID_PASID:
pasid_cap_added = true;
- /* fallthrough */
+ pcie_add_capability(pdev, cap_id, cap_ver, next, size);
+ break;
+ case PCI_EXT_CAP_ID_ATS:
+ ats_cap_present = true;
+ /*
+ * If ATS is requested and supported according to the kernel, add
+ * the ATS capability. If not supported according to the kernel or
+ * disabled on the qemu command line, omit the ATS cap.
+ */
+ if (ats_needed) {
+ pcie_add_capability(pdev, cap_id, cap_ver, next, size);
+ }
+ break;
default:
pcie_add_capability(pdev, cap_id, cap_ver, next, size);
}
@@ -2648,6 +2703,16 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
error_report_err(err);
}
+ if (vdev->ats == ON_OFF_AUTO_ON && !ats_cap_present) {
+ warn_report("vfio-pci: ats=on requested, but host device has no "
+ "ATS extended capability");
+ }
+
+ if (vdev->ats == ON_OFF_AUTO_AUTO && ats_cap_present && !ats_needed) {
+ warn_report("vfio-pci: host kernel reports ATS unsupported; "
+ "ATS capability will be masked");
+ }
+
/* Cleanup chain head ID if necessary */
if (pci_get_word(pdev->config + PCI_CONFIG_SPACE_SIZE) == 0xFFFF) {
pci_set_word(pdev->config + PCI_CONFIG_SPACE_SIZE, 0);
@@ -2659,6 +2724,7 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
bool vfio_pci_add_capabilities(VFIOPCIDevice *vdev, Error **errp)
{
PCIDevice *pdev = PCI_DEVICE(vdev);
+ bool ats_needed = false;
if (!(pdev->config[PCI_STATUS] & PCI_STATUS_CAP_LIST) ||
!pdev->config[PCI_CAPABILITY_LIST]) {
@@ -2669,7 +2735,11 @@ bool vfio_pci_add_capabilities(VFIOPCIDevice *vdev, Error **errp)
return false;
}
- vfio_add_ext_cap(vdev);
+ if (!vfio_pci_ats_requested_and_supported(vdev, &ats_needed, errp)) {
+ return false;
+ }
+
+ vfio_add_ext_cap(vdev, ats_needed);
return true;
}
@@ -3819,6 +3889,7 @@ static const Property vfio_pci_properties[] = {
DEFINE_PROP_BOOL("skip-vsc-check", VFIOPCIDevice, skip_vsc_check, true),
DEFINE_PROP_UINT16("x-vpasid-cap-offset", VFIOPCIDevice,
vpasid_cap_offset, 0),
+ DEFINE_PROP_ON_OFF_AUTO("ats", VFIOPCIDevice, ats, ON_OFF_AUTO_AUTO),
};
static void vfio_pci_set_fd(Object *obj, const char *str, Error **errp)
@@ -3970,13 +4041,22 @@ static void vfio_pci_class_init(ObjectClass *klass, const void *data)
"destination when doing live "
"migration of device state via "
"multifd channels");
- object_class_property_set_description(klass, /* 11.0 */
+ object_class_property_set_description(klass, /* 11.0 */
"x-vpasid-cap-offset",
"PCIe extended configuration space offset at which to place a "
"synthetic PASID extended capability when PASID is enabled via "
"a vIOMMU. A value of 0 (default) places the capability at the "
"end of the extended configuration space. The offset must be "
"4-byte aligned and within the PCIe extended configuration space");
+ object_class_property_set_description(klass, /* 11.1 */
+ "ats",
+ "Control guest visibility of the ATS PCIe extended capability. "
+ "Valid values are on, off, and auto (default). "
+ "'off' always masks ATS. "
+ "'on' requires ATS support for the device and fails realize if the "
+ "host kernel reports ATS as unavailable for this device. "
+ "'auto' masks ATS only when the host kernel reports "
+ "ATS as unavailable");
}
static const TypeInfo vfio_pci_info = {
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 24/27] vfio/pci: Propagate errors in vfio_pci_load_rom() using Error API
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (22 preceding siblings ...)
2026-07-07 6:29 ` [PULL 23/27] vfio/pci: Add ats property Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 25/27] vfio/listener: Fix translated_addr for non-identity-mapped RAM sections Cédric Le Goater
` (3 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel
Cc: Mario Casquero, Cédric Le Goater,
Philippe Mathieu-Daudé
From: Mario Casquero <mcasquer@redhat.com>
Updates vfio_pci_load_rom() to use Error API for error propagation
instead of error_report(), improving error handling consistency.
Signed-off-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Link: https://lore.kernel.org/qemu-devel/20260625094307.148542-1-mcasquer@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/vfio/pci.c | 32 +++++++++++++++++++++-----------
1 file changed, 21 insertions(+), 11 deletions(-)
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index c7f163399f8fbcc4ff70819a0d67879eb26980f9..e6d1adfd3655ce3c1baf8977c82223d23af9b770 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -1028,7 +1028,7 @@ static void vfio_update_msi(VFIOPCIDevice *vdev)
}
}
-static bool vfio_pci_load_rom(VFIOPCIDevice *vdev)
+static bool vfio_pci_load_rom(VFIOPCIDevice *vdev, Error **errp)
{
VFIODevice *vbasedev = &vdev->vbasedev;
struct vfio_region_info *reg_info = NULL;
@@ -1041,7 +1041,7 @@ static bool vfio_pci_load_rom(VFIOPCIDevice *vdev)
®_info);
if (ret != 0) {
- error_report("vfio: Error getting ROM info: %s", strerror(-ret));
+ error_setg_errno(errp, -ret, "vfio: Error getting ROM info");
return false;
}
@@ -1053,10 +1053,13 @@ static bool vfio_pci_load_rom(VFIOPCIDevice *vdev)
vdev->rom_offset = reg_info->offset;
if (!vdev->rom_size) {
- error_report("vfio-pci: Cannot read device rom at %s", vbasedev->name);
- error_printf("Device option ROM contents are probably invalid "
- "(check dmesg).\nSkip option ROM probe with rombar=0, "
- "or load from file with romfile=\n");
+ vdev->rom_size = 0;
+ vdev->rom_offset = 0;
+ error_setg(errp, "vfio-pci: Device ROM size is zero at %s",
+ vbasedev->name);
+ error_append_hint(errp, "Device option ROM contents are probably "
+ "invalid (check dmesg).\nSkip option ROM probe "
+ "with rombar=0, or load from file with romfile=\n");
return false;
}
@@ -1077,10 +1080,12 @@ static bool vfio_pci_load_rom(VFIOPCIDevice *vdev)
if (bytes == -EINTR || bytes == -EAGAIN) {
continue;
}
- error_report("vfio: Error reading device ROM: %s",
- strreaderror(bytes));
-
- break;
+ error_setg_errno(errp, -bytes, "vfio: Error reading device ROM");
+ g_free(vdev->rom);
+ vdev->rom = NULL;
+ vdev->rom_size = 0;
+ vdev->rom_offset = 0;
+ return false;
}
}
@@ -1148,7 +1153,12 @@ static uint64_t vfio_rom_read(void *opaque, hwaddr addr, unsigned size)
/* Load the ROM lazily when the guest tries to read it */
if (unlikely(!vdev->rom && !vdev->rom_read_failed)) {
- vdev->rom_read_failed = !vfio_pci_load_rom(vdev);
+ Error *local_err = NULL;
+
+ vdev->rom_read_failed = !vfio_pci_load_rom(vdev, &local_err);
+ if (vdev->rom_read_failed) {
+ error_report_err(local_err);
+ }
}
memcpy(&val, vdev->rom + addr,
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 25/27] vfio/listener: Fix translated_addr for non-identity-mapped RAM sections
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (23 preceding siblings ...)
2026-07-07 6:29 ` [PULL 24/27] vfio/pci: Propagate errors in vfio_pci_load_rom() using Error API Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 26/27] backends/iommufd: Fix dev_id and type order in viommu trace Cédric Le Goater
` (2 subsequent siblings)
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel
Cc: Cédric Le Goater, Zhenzhong Duan,
Philippe Mathieu-Daudé
In vfio_listener_region_del(), when dirty tracking is active and a
writable RAM section is deleted, a synthetic IOMMUTLBEntry is built to
flush dirty pages. Setting translated_addr to the IOVA (GPA) is only
correct for identity-mapped regions where GPA == ram_addr_t.
For RAM sections with GPA far above main RAM (e.g., nested VT-d interrupt
remapping table at 58 TB), translated_addr is too large, causing a crash
in physical_memory_set_dirty_lebitmap() when indexing beyond the allocated
dirty memory blocks array :
bitmap_set_atomic(map=NULL, start=1, nr=1)
physical_memory_set_dirty_range(start=0x380004040000, length=4096)
physical_memory_set_dirty_lebitmap(start=0x380004040000, pages=3)
vfio_container_query_dirty_bitmap(translated_addr=0x380004040000)
vfio_legacy_dma_unmap_one(iova=0x380004040000, size=12288)
vfio_listener_region_del()
Fix this by setting translated_addr to the ram_addr_t of the section, which
is consistent with other vfio dirty tracking code:
translated_addr = memory_region_get_ram_addr(section->mr) +
section->offset_within_region;
Cc: Zhenzhong Duan <zhenzhong.duan@intel.com>
Fixes: 6e360c06176c ("vfio/listener: Add missing dirty tracking in region_del")
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Tested-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Link: https://lore.kernel.org/qemu-devel/20260625134352.3122572-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/vfio/listener.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 109b5d61af4a09cf22f0ebbb9f3fc4ca87295b38..c19600e980a8d02217b5d9df4aca8f879ab2c5d5 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -731,7 +731,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
}
/*
- * Fake an IOTLB entry for writable identity mapping which is needed
+ * Fake an IOTLB entry for writable RAM sections which is needed
* by dirty tracking when switch out of PT domain. In fact, in
* unmap_bitmap, only translated_addr field is used to set dirty
* bitmap.
@@ -746,7 +746,8 @@ static void vfio_listener_region_del(MemoryListener *listener,
if (global_dirty_tracking && memory_region_is_ram(section->mr) &&
!section->readonly) {
entry.iova = iova;
- entry.translated_addr = iova;
+ entry.translated_addr = memory_region_get_ram_addr(section->mr) +
+ section->offset_within_region;
iotlb = &entry;
}
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 26/27] backends/iommufd: Fix dev_id and type order in viommu trace
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (24 preceding siblings ...)
2026-07-07 6:29 ` [PULL 25/27] vfio/listener: Fix translated_addr for non-identity-mapped RAM sections Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-07 6:29 ` [PULL 27/27] vfio/pci: Reject invalid MSI-X Table and PBA BIR values Cédric Le Goater
2026-07-08 5:53 ` [PULL 00/27] vfio queue Stefan Hajnoczi
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Shameer Kolothum, Nicolin Chen, Cédric Le Goater
From: Shameer Kolothum <skolothumtho@nvidia.com>
The trace event receives dev_id before type, but its format string prints
them in the wrong order. Correct the order.
Fixes: f2d31df0d925 ("backends/iommufd: Introduce iommufd_backend_alloc_viommu")
Reported-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260706103653.84243-1-skolothumtho@nvidia.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
backends/trace-events | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/backends/trace-events b/backends/trace-events
index b63420b73ee7363518530d981590080b00d9bcbd..009a25b0be96a437af029b6de90782fc27a85669 100644
--- a/backends/trace-events
+++ b/backends/trace-events
@@ -21,7 +21,7 @@ iommufd_backend_free_id(int iommufd, uint32_t id, int ret) " iommufd=%d id=%d (%
iommufd_backend_set_dirty(int iommufd, uint32_t hwpt_id, bool start, int ret) " iommufd=%d hwpt=%u enable=%d (%d)"
iommufd_backend_get_dirty_bitmap(int iommufd, uint32_t hwpt_id, uint64_t iova, uint64_t size, uint64_t flags, uint64_t page_size, int ret) " iommufd=%d hwpt=%u iova=0x%"PRIx64" size=0x%"PRIx64" flags=0x%"PRIx64" page_size=0x%"PRIx64" (%d)"
iommufd_backend_invalidate_cache(int iommufd, uint32_t id, uint32_t data_type, uint32_t entry_len, uint32_t entry_num, uint32_t done_num, uint64_t data_ptr, int ret) " iommufd=%d id=%u data_type=%u entry_len=%u entry_num=%u done_num=%u data_ptr=0x%"PRIx64" (%d)"
-iommufd_backend_alloc_viommu(int iommufd, uint32_t dev_id, uint32_t type, uint32_t hwpt_id, uint64_t data_ptr, uint32_t data_len, uint32_t viommu_id, int ret) " iommufd=%d type=%u dev_id=%u hwpt_id=%u data_ptr=0x%"PRIx64" data_len=0x%x viommu_id=%u (%d)"
+iommufd_backend_alloc_viommu(int iommufd, uint32_t dev_id, uint32_t type, uint32_t hwpt_id, uint64_t data_ptr, uint32_t data_len, uint32_t viommu_id, int ret) " iommufd=%d dev_id=%u type=%u hwpt_id=%u data_ptr=0x%"PRIx64" data_len=0x%x viommu_id=%u (%d)"
iommufd_backend_alloc_vdev(int iommufd, uint32_t dev_id, uint32_t viommu_id, uint64_t virt_id, uint32_t vdev_id, int ret) " iommufd=%d dev_id=%u viommu_id=%u virt_id=0x%"PRIx64" vdev_id=%u (%d)"
iommufd_viommu_alloc_eventq(int iommufd, uint32_t viommu_id, uint32_t type, uint32_t veventq_id, uint32_t veventq_fd, int ret) " iommufd=%d viommu_id=%u type=%u veventq_id=%u veventq_fd=%u (%d)"
iommufd_backend_alloc_hw_queue(int iommufd, uint32_t viommu_id, uint32_t queue_type, uint32_t index, uint64_t addr, uint64_t size, uint32_t queue_id, int ret) " iommufd=%d viommu_id=%u queue_type=%u index=%u addr=0x%"PRIx64" size=0x%"PRIx64" queue_id=%u (%d)"
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* [PULL 27/27] vfio/pci: Reject invalid MSI-X Table and PBA BIR values
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (25 preceding siblings ...)
2026-07-07 6:29 ` [PULL 26/27] backends/iommufd: Fix dev_id and type order in viommu trace Cédric Le Goater
@ 2026-07-07 6:29 ` Cédric Le Goater
2026-07-08 5:53 ` [PULL 00/27] vfio queue Stefan Hajnoczi
27 siblings, 0 replies; 33+ messages in thread
From: Cédric Le Goater @ 2026-07-07 6:29 UTC (permalink / raw)
To: qemu-devel; +Cc: Cédric Le Goater, Feifan Qian, Alex Williamson
The 3-bit MSI-X BIR fields permit values 0-7, but VFIOPCIDevice::bars[]
only contains BAR0-BAR5 (6 entries). An invalid BIR value of 6 or 7
can cause an out-of-bounds array access (CWE-129) in vfio_msix_early_setup().
Add range checks immediately after extracting the BIR values.
Reported-by: Feifan Qian <bea1e@proton.me>
Fixes: 65501a745dba ("vfio: vfio-pci device assignment driver")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3878
Reviewed-by: Alex Williamson <alex@shazbot.org>
Link: https://lore.kernel.org/qemu-devel/20260706161334.2165482-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
hw/vfio/pci.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index e6d1adfd3655ce3c1baf8977c82223d23af9b770..c204706e63045c930bda7977adc8034f907b6890 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -1791,6 +1791,14 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp)
msix->pba_offset = pba & ~PCI_MSIX_FLAGS_BIRMASK;
msix->entries = (ctrl & PCI_MSIX_FLAGS_QSIZE) + 1;
+ if (msix->table_bar >= ARRAY_SIZE(vdev->bars) ||
+ msix->pba_bar >= ARRAY_SIZE(vdev->bars)) {
+ error_setg(errp, "invalid MSI-X BIR, table_bar=%d pba_bar=%d",
+ msix->table_bar, msix->pba_bar);
+ g_free(msix);
+ return false;
+ }
+
ret = vfio_device_get_irq_info(&vdev->vbasedev, VFIO_PCI_MSIX_IRQ_INDEX,
&irq_info);
if (ret < 0) {
--
2.54.0
^ permalink raw reply related [flat|nested] 33+ messages in thread* Re: [PULL 00/27] vfio queue
2026-07-07 6:28 [PULL 00/27] vfio queue Cédric Le Goater
` (26 preceding siblings ...)
2026-07-07 6:29 ` [PULL 27/27] vfio/pci: Reject invalid MSI-X Table and PBA BIR values Cédric Le Goater
@ 2026-07-08 5:53 ` Stefan Hajnoczi
27 siblings, 0 replies; 33+ messages in thread
From: Stefan Hajnoczi @ 2026-07-08 5:53 UTC (permalink / raw)
To: Cédric Le Goater; +Cc: qemu-devel, Cédric Le Goater
[-- Attachment #1: Type: text/plain, Size: 116 bytes --]
Applied, thanks.
Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 33+ messages in thread