[PATCH v3 0/3] migration/rdma: Misc RDMA migration fixes

[PATCH v3 0/3] migration/rdma: Misc RDMA migration fixes

[Yanfei Xu]

This series fixes three RDMA migration issues.

v2->v3:
  - patch3: Change the type of return value to bool. And add an assert
            check to unexpected WR type. (Peter)

v1->v2:
  - patch1/2: Collect Reviewed-by
  - patch2: Add reproducation step and error logs in commit message
  - patch3: Wrap the post-send op and retry logic into a helper, and
            retry only once after draining a completion when the queue
            is full. (I believe ENOMEM is only recoverable in the
            queue-full case, so we retry once; it should succeed after
            a completion is drained. Any further ENOMEM is treated as
            non-recoverable.)

Yanfei Xu (3):
  migration/rdma: Fix write-side shutdown
  migration/rdma: Post initial receive before accepting
  migration/rdma: Retry control sends on full queue

 migration/rdma.c       | 89 +++++++++++++++++++++++++-----------------
 migration/trace-events |  2 +-
 2 files changed, 55 insertions(+), 36 deletions(-)

-- 
2.20.1

[PATCH v3 1/3] migration/rdma: Fix write-side shutdown

[Yanfei Xu]

qio_channel_rdma_shutdown() reads rdmain for both the input and
output contexts.  As a result, a write-side shutdown marks the input
context as errored while leaving the output context active.  A shutdown
of both directions also fails to stop the output context.

Read rdmaout from the output context so each shutdown direction marks
the corresponding RDMA context as errored.

Fixes: 54db882f073a ("migration: implement the shutdown for RDMA QIOChannel")
Signed-off-by: Yanfei Xu <yanfei.xu@bytedance.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Peter Xu <peterx@redhat.com>
---
 migration/rdma.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/migration/rdma.c b/migration/rdma.c
index c076dc04e8..fc6cb75167 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -2993,7 +2993,7 @@ qio_channel_rdma_shutdown(QIOChannel *ioc,
     RCU_READ_LOCK_GUARD();
 
     rdmain = qatomic_rcu_read(&rioc->rdmain);
-    rdmaout = qatomic_rcu_read(&rioc->rdmain);
+    rdmaout = qatomic_rcu_read(&rioc->rdmaout);
 
     switch (how) {
     case QIO_CHANNEL_SHUTDOWN_READ:
-- 
2.20.1

Re: [PATCH v3 1/3] migration/rdma: Fix write-side shutdown

[Jinpu Wang]

On Sun, Aug 23, 2026 at 4:17 AM Yanfei Xu <yanfei.xu@bytedance.com> wrote:
>
> qio_channel_rdma_shutdown() reads rdmain for both the input and
> output contexts.  As a result, a write-side shutdown marks the input
> context as errored while leaving the output context active.  A shutdown
> of both directions also fails to stop the output context.
>
> Read rdmaout from the output context so each shutdown direction marks
> the corresponding RDMA context as errored.
>
> Fixes: 54db882f073a ("migration: implement the shutdown for RDMA QIOChannel")
> Signed-off-by: Yanfei Xu <yanfei.xu@bytedance.com>
> Reviewed-by: Fabiano Rosas <farosas@suse.de>
> Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Jack Wang <jinpu.wang@cloud.ionos.com>
> ---
>  migration/rdma.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/migration/rdma.c b/migration/rdma.c
> index c076dc04e8..fc6cb75167 100644
> --- a/migration/rdma.c
> +++ b/migration/rdma.c
> @@ -2993,7 +2993,7 @@ qio_channel_rdma_shutdown(QIOChannel *ioc,
>      RCU_READ_LOCK_GUARD();
>
>      rdmain = qatomic_rcu_read(&rioc->rdmain);
> -    rdmaout = qatomic_rcu_read(&rioc->rdmain);
> +    rdmaout = qatomic_rcu_read(&rioc->rdmaout);
>
>      switch (how) {
>      case QIO_CHANNEL_SHUTDOWN_READ:
> --
> 2.20.1

[PATCH v3 2/3] migration/rdma: Post initial receive before accepting

[Yanfei Xu]

The source return-path thread can send READY before the destination has
posted its initial receive.  Since RNR retries default to zero, the send
can fail and abort migration.

Post the initial receive before rdma_accept() to close this window.

Adding delays can easily reproduce it. For exmaple with sleep(1), error
could be found at the source side:

2026-08-20T05:55:11.471421Z qemu_rdma_exchange_get_response_start CONTROL: READY receiving...
2026-08-20T05:55:11.471422Z qemu_rdma_post_send_control CONTROL: sending QEMU FILE..
2026-08-20T05:55:11.471447Z qemu_rdma_poll_other other completion 2000 received left 0
2026-08-20T05:55:11.471589Z qemu_rdma_poll_recv completion 0 received (4000) left 0
2026-08-20T05:55:11.471592Z qemu_rdma_poll_other other completion 4000 received left 0
2026-08-20T05:55:11.471594Z qemu_rdma_exchange_get_response_start CONTROL: READY receiving...
2026-08-20T05:55:11.471596Z qemu_rdma_post_send_control CONTROL: sending QEMU FILE..
2026-08-20T05:55:11.471617Z qemu_rdma_poll_other other completion 2000 received left 0
2026-08-20T05:55:11.705561Z qemu_rdma_close
2026-08-20T05:55:11.705587Z qemu_rdma_close
2026-08-20T05:55:11.705626Z qemu-system-x86_64: rdma migration: send polling control error
2026-08-20T05:55:11.707001Z qemu-system-x86_64: warning: Early error. Sending error.
2026-08-20T05:55:11.707031Z qemu_rdma_post_send_control CONTROL: sending ERROR..
2026-08-20T05:55:11.707038Z qemu-system-x86_64: warning: rdma migration: send polling control error
2026-08-20T05:55:11.707301Z qemu_rdma_cleanup_disconnect
2026-08-20T05:55:11.710569Z qemu_rdma_cleanup_disconnect

Fixes: 55cc1b5937a8 ("migration: create a dedicated connection for rdma return path")
Signed-off-by: Yanfei Xu <yanfei.xu@bytedance.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Jack Wang <jinpu.wang@cloud.ionos.com>
---
 migration/rdma.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/migration/rdma.c b/migration/rdma.c
index fc6cb75167..b79f4263f7 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -3274,6 +3274,12 @@ static int qemu_rdma_accept(RDMAContext *rdma)
         }
     }
 
+    ret = qemu_rdma_post_recv_control(rdma, RDMA_WRID_READY, &err);
+    if (ret < 0) {
+        error_report_err(err);
+        goto err_rdma_dest_wait;
+    }
+
     /* Accept the second connection request for return path */
     if ((migrate_postcopy() || migrate_return_path())
         && !rdma->is_return_path) {
@@ -3306,12 +3312,6 @@ static int qemu_rdma_accept(RDMAContext *rdma)
     rdma_ack_cm_event(cm_event);
     rdma->connected = true;
 
-    ret = qemu_rdma_post_recv_control(rdma, RDMA_WRID_READY, &err);
-    if (ret < 0) {
-        error_report_err(err);
-        goto err_rdma_dest_wait;
-    }
-
     qemu_rdma_dump_gid("dest_connect", rdma->cm_id);
 
     return 0;
-- 
2.20.1

[PATCH v3 3/3] migration/rdma: Retry control sends on full queue

[Yanfei Xu]

RAM writes and control messages share the send queue. If outstanding
writes fill it, RDMA writes drain a completion and retry, but control
sends fail the migration.

Move send posting and queue-full handling into a common helper. On
ENOMEM, drain one outstanding RDMA write and retry the failed request
once. If no write is outstanding, or the retry still fails, propagate
the error.

Signed-off-by: Yanfei Xu <yanfei.xu@bytedance.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
---
 migration/rdma.c       | 75 ++++++++++++++++++++++++++----------------
 migration/trace-events |  2 +-
 2 files changed, 48 insertions(+), 29 deletions(-)

diff --git a/migration/rdma.c b/migration/rdma.c
index b79f4263f7..b7580ab54f 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -1553,6 +1553,51 @@ err_block_for_wrid:
     return -1;
 }
 
+/*
+ * Post a send work request, draining an outstanding RDMA write if the send
+ * queue is full.
+ */
+static bool qemu_rdma_post_send(RDMAContext *rdma,
+                               struct ibv_send_wr *send_wr,
+                               Error **errp)
+{
+    struct ibv_send_wr *bad_wr;
+    uint64_t wr_id = send_wr->wr_id & RDMA_WRID_TYPE_MASK;
+    const char *wr_desc;
+    int ret;
+
+    switch (wr_id) {
+    case RDMA_WRID_RDMA_WRITE:
+        wr_desc = "RDMA write";
+        break;
+    case RDMA_WRID_SEND_CONTROL:
+        wr_desc = "control send";
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    ret = ibv_post_send(rdma->qp, send_wr, &bad_wr);
+    if (ret == ENOMEM && rdma->nb_sent) {
+        trace_qemu_rdma_post_send_queue_full(send_wr->wr_id, rdma->nb_sent);
+        ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_RDMA_WRITE, NULL);
+        if (ret < 0) {
+            error_setg(errp, "rdma migration: failed to make room for %s",
+                       wr_desc);
+            return false;
+        }
+        ret = ibv_post_send(rdma->qp, send_wr, &bad_wr);
+    }
+
+    if (ret > 0) {
+        error_setg_errno(errp, ret, "rdma migration: post %s failed",
+                         wr_desc);
+        return false;
+    }
+
+    return true;
+}
+
 /*
  * Post a SEND message work request for the control channel
  * containing some data and block until the post completes.
@@ -1563,7 +1608,6 @@ static int qemu_rdma_post_send_control(RDMAContext *rdma, uint8_t *buf,
 {
     int ret;
     RDMAWorkRequestData *wr = &rdma->wr_data[RDMA_WRID_CONTROL];
-    struct ibv_send_wr *bad_wr;
     struct ibv_sge sge = {
                            .addr = (uintptr_t)(wr->control),
                            .length = head->len + sizeof(RDMAControlHeader),
@@ -1595,11 +1639,7 @@ static int qemu_rdma_post_send_control(RDMAContext *rdma, uint8_t *buf,
         memcpy(wr->control + sizeof(RDMAControlHeader), buf, head->len);
     }
 
-
-    ret = ibv_post_send(rdma->qp, &send_wr, &bad_wr);
-
-    if (ret > 0) {
-        error_setg(errp, "Failed to use post IB SEND for control");
+    if (!qemu_rdma_post_send(rdma, &send_wr, errp)) {
         return -1;
     }
 
@@ -1859,7 +1899,6 @@ static int qemu_rdma_write_one(RDMAContext *rdma,
 {
     struct ibv_sge sge;
     struct ibv_send_wr send_wr = { 0 };
-    struct ibv_send_wr *bad_wr;
     int reg_result_idx, ret;
     uint64_t chunk, chunks;
     uint64_t chunk_size = migrate_rdma_chunk_size();
@@ -1873,7 +1912,6 @@ static int qemu_rdma_write_one(RDMAContext *rdma,
                                .repeat = 1,
                              };
 
-retry:
     sge.addr = (uintptr_t)(block->local_host_addr +
                             (current_addr - block->offset));
     sge.length = length;
@@ -2026,26 +2064,7 @@ retry:
     trace_qemu_rdma_write_one_post(chunk, sge.addr, send_wr.wr.rdma.remote_addr,
                                    sge.length);
 
-    /*
-     * ibv_post_send() does not return negative error numbers,
-     * per the specification they are positive - no idea why.
-     */
-    ret = ibv_post_send(rdma->qp, &send_wr, &bad_wr);
-
-    if (ret == ENOMEM) {
-        trace_qemu_rdma_write_one_queue_full();
-        ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_RDMA_WRITE, NULL);
-        if (ret < 0) {
-            error_setg(errp, "rdma migration: failed to make "
-                         "room in full send queue!");
-            return -1;
-        }
-
-        goto retry;
-
-    } else if (ret > 0) {
-        error_setg_errno(errp, ret,
-                         "rdma migration: post rdma write failed");
+    if (!qemu_rdma_post_send(rdma, &send_wr, errp)) {
         return -1;
     }
 
diff --git a/migration/trace-events b/migration/trace-events
index bcc102e323..7197c9dc6d 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -250,7 +250,7 @@ qemu_rdma_unregister_waiting_send(uint64_t chunk) "Sending unregister for chunk:
 qemu_rdma_unregister_waiting_complete(uint64_t chunk) "Unregister for chunk: %" PRIu64 " complete."
 qemu_rdma_write_flush(int sent) "sent total: %d"
 qemu_rdma_write_one_post(uint64_t chunk, long addr, long remote, uint32_t len) "Posting chunk: %" PRIu64 ", addr: 0x%lx remote: 0x%lx, bytes %" PRIu32
-qemu_rdma_write_one_queue_full(void) ""
+qemu_rdma_post_send_queue_full(uint64_t wr_id, int sent) "send queue full, wr_id=%" PRIu64 ", outstanding writes=%d"
 qemu_rdma_write_one_recvregres(int mykey, int theirkey, uint64_t chunk) "Received registration result: my key: 0x%x their key 0x%x, chunk %" PRIu64
 qemu_rdma_write_one_sendreg(uint64_t chunk, int len, int index, int64_t offset) "Sending registration request chunk %" PRIu64 " for %d bytes, index: %d, offset: %" PRId64
 qemu_rdma_write_one_top(uint64_t chunks, uint64_t size) "Writing %" PRIu64 " chunks, (%" PRIu64 " MB)"
-- 
2.20.1

Re: [PATCH v3 3/3] migration/rdma: Retry control sends on full queue

[Jinpu Wang]

On Sun, Aug 23, 2026 at 4:18 AM Yanfei Xu <yanfei.xu@bytedance.com> wrote:
>
> RAM writes and control messages share the send queue. If outstanding
> writes fill it, RDMA writes drain a completion and retry, but control
> sends fail the migration.
>
> Move send posting and queue-full handling into a common helper. On
> ENOMEM, drain one outstanding RDMA write and retry the failed request
> once. If no write is outstanding, or the retry still fails, propagate
> the error.
>
> Signed-off-by: Yanfei Xu <yanfei.xu@bytedance.com>
> Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Jack Wang <jinpu.wang@cloud.ionos.com>
> ---
>  migration/rdma.c       | 75 ++++++++++++++++++++++++++----------------
>  migration/trace-events |  2 +-
>  2 files changed, 48 insertions(+), 29 deletions(-)
>
> diff --git a/migration/rdma.c b/migration/rdma.c
> index b79f4263f7..b7580ab54f 100644
> --- a/migration/rdma.c
> +++ b/migration/rdma.c
> @@ -1553,6 +1553,51 @@ err_block_for_wrid:
>      return -1;
>  }
>
> +/*
> + * Post a send work request, draining an outstanding RDMA write if the send
> + * queue is full.
> + */
> +static bool qemu_rdma_post_send(RDMAContext *rdma,
> +                               struct ibv_send_wr *send_wr,
> +                               Error **errp)
> +{
> +    struct ibv_send_wr *bad_wr;
> +    uint64_t wr_id = send_wr->wr_id & RDMA_WRID_TYPE_MASK;
> +    const char *wr_desc;
> +    int ret;
> +
> +    switch (wr_id) {
> +    case RDMA_WRID_RDMA_WRITE:
> +        wr_desc = "RDMA write";
> +        break;
> +    case RDMA_WRID_SEND_CONTROL:
> +        wr_desc = "control send";
> +        break;
> +    default:
> +        g_assert_not_reached();
> +    }
> +
> +    ret = ibv_post_send(rdma->qp, send_wr, &bad_wr);
> +    if (ret == ENOMEM && rdma->nb_sent) {
> +        trace_qemu_rdma_post_send_queue_full(send_wr->wr_id, rdma->nb_sent);
> +        ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_RDMA_WRITE, NULL);
> +        if (ret < 0) {
> +            error_setg(errp, "rdma migration: failed to make room for %s",
> +                       wr_desc);
> +            return false;
> +        }
> +        ret = ibv_post_send(rdma->qp, send_wr, &bad_wr);
> +    }
> +
> +    if (ret > 0) {
> +        error_setg_errno(errp, ret, "rdma migration: post %s failed",
> +                         wr_desc);
> +        return false;
> +    }
> +
> +    return true;
> +}
> +
>  /*
>   * Post a SEND message work request for the control channel
>   * containing some data and block until the post completes.
> @@ -1563,7 +1608,6 @@ static int qemu_rdma_post_send_control(RDMAContext *rdma, uint8_t *buf,
>  {
>      int ret;
>      RDMAWorkRequestData *wr = &rdma->wr_data[RDMA_WRID_CONTROL];
> -    struct ibv_send_wr *bad_wr;
>      struct ibv_sge sge = {
>                             .addr = (uintptr_t)(wr->control),
>                             .length = head->len + sizeof(RDMAControlHeader),
> @@ -1595,11 +1639,7 @@ static int qemu_rdma_post_send_control(RDMAContext *rdma, uint8_t *buf,
>          memcpy(wr->control + sizeof(RDMAControlHeader), buf, head->len);
>      }
>
> -
> -    ret = ibv_post_send(rdma->qp, &send_wr, &bad_wr);
> -
> -    if (ret > 0) {
> -        error_setg(errp, "Failed to use post IB SEND for control");
> +    if (!qemu_rdma_post_send(rdma, &send_wr, errp)) {
>          return -1;
>      }
>
> @@ -1859,7 +1899,6 @@ static int qemu_rdma_write_one(RDMAContext *rdma,
>  {
>      struct ibv_sge sge;
>      struct ibv_send_wr send_wr = { 0 };
> -    struct ibv_send_wr *bad_wr;
>      int reg_result_idx, ret;
>      uint64_t chunk, chunks;
>      uint64_t chunk_size = migrate_rdma_chunk_size();
> @@ -1873,7 +1912,6 @@ static int qemu_rdma_write_one(RDMAContext *rdma,
>                                 .repeat = 1,
>                               };
>
> -retry:
>      sge.addr = (uintptr_t)(block->local_host_addr +
>                              (current_addr - block->offset));
>      sge.length = length;
> @@ -2026,26 +2064,7 @@ retry:
>      trace_qemu_rdma_write_one_post(chunk, sge.addr, send_wr.wr.rdma.remote_addr,
>                                     sge.length);
>
> -    /*
> -     * ibv_post_send() does not return negative error numbers,
> -     * per the specification they are positive - no idea why.
> -     */
> -    ret = ibv_post_send(rdma->qp, &send_wr, &bad_wr);
> -
> -    if (ret == ENOMEM) {
> -        trace_qemu_rdma_write_one_queue_full();
> -        ret = qemu_rdma_block_for_wrid(rdma, RDMA_WRID_RDMA_WRITE, NULL);
> -        if (ret < 0) {
> -            error_setg(errp, "rdma migration: failed to make "
> -                         "room in full send queue!");
> -            return -1;
> -        }
> -
> -        goto retry;
> -
> -    } else if (ret > 0) {
> -        error_setg_errno(errp, ret,
> -                         "rdma migration: post rdma write failed");
> +    if (!qemu_rdma_post_send(rdma, &send_wr, errp)) {
>          return -1;
>      }
>
> diff --git a/migration/trace-events b/migration/trace-events
> index bcc102e323..7197c9dc6d 100644
> --- a/migration/trace-events
> +++ b/migration/trace-events
> @@ -250,7 +250,7 @@ qemu_rdma_unregister_waiting_send(uint64_t chunk) "Sending unregister for chunk:
>  qemu_rdma_unregister_waiting_complete(uint64_t chunk) "Unregister for chunk: %" PRIu64 " complete."
>  qemu_rdma_write_flush(int sent) "sent total: %d"
>  qemu_rdma_write_one_post(uint64_t chunk, long addr, long remote, uint32_t len) "Posting chunk: %" PRIu64 ", addr: 0x%lx remote: 0x%lx, bytes %" PRIu32
> -qemu_rdma_write_one_queue_full(void) ""
> +qemu_rdma_post_send_queue_full(uint64_t wr_id, int sent) "send queue full, wr_id=%" PRIu64 ", outstanding writes=%d"
>  qemu_rdma_write_one_recvregres(int mykey, int theirkey, uint64_t chunk) "Received registration result: my key: 0x%x their key 0x%x, chunk %" PRIu64
>  qemu_rdma_write_one_sendreg(uint64_t chunk, int len, int index, int64_t offset) "Sending registration request chunk %" PRIu64 " for %d bytes, index: %d, offset: %" PRId64
>  qemu_rdma_write_one_top(uint64_t chunks, uint64_t size) "Writing %" PRIu64 " chunks, (%" PRIu64 " MB)"
> --
> 2.20.1

Re: [PATCH v3 0/3] migration/rdma: Misc RDMA migration fixes

[Fabiano Rosas]

"Yanfei Xu" <yanfei.xu@bytedance.com> writes:

> This series fixes three RDMA migration issues.
>
> v2->v3:
>   - patch3: Change the type of return value to bool. And add an assert
>             check to unexpected WR type. (Peter)
>
> v1->v2:
>   - patch1/2: Collect Reviewed-by
>   - patch2: Add reproducation step and error logs in commit message
>   - patch3: Wrap the post-send op and retry logic into a helper, and
>             retry only once after draining a completion when the queue
>             is full. (I believe ENOMEM is only recoverable in the
>             queue-full case, so we retry once; it should succeed after
>             a completion is drained. Any further ENOMEM is treated as
>             non-recoverable.)
>
> Yanfei Xu (3):
>   migration/rdma: Fix write-side shutdown
>   migration/rdma: Post initial receive before accepting
>   migration/rdma: Retry control sends on full queue
>
>  migration/rdma.c       | 89 +++++++++++++++++++++++++-----------------
>  migration/trace-events |  2 +-
>  2 files changed, 55 insertions(+), 36 deletions(-)

Queued, thanks.