[PATCH 0/5] VFIO: cpr-transfer fixes

[PATCH 0/5] VFIO: cpr-transfer fixes

[Zhenzhong Duan]

Hi,

Patch1: fixed an error restore path when virtio-mem is configured.
Patch2: fixed assert failure on error restore path, this issue happens
no matter if virtio-mem is configured.
Some trick is played to trigger the error path,
see https://github.com/yiliu1765/qemu/commit/494d19e7f7242dbc47d7f236937cde0c396a4a7c

Patch3-4: issue only happens with two or more VFIO devices, no issue
if only one VFIO device.

Patch5: SIGSEGV if I send "query-balloon" to source qmp monitor,
I'm not quite sure if it's deserved to be fixed, as guest has been
migrated to destination, it's not a big issue for source qemu to
SIGSEGV?

Thanks
Zhenzhong


Zhenzhong Duan (5):
  vfio/container: Remap only populated parts in a section
  vfio/cpr-legacy: drop an erroneous assert
  vfio/iommufd: Save cpr.ioas_id on source side for CPR transfer
  vfio/iommufd: Restore vbasedev's reference to hwpt after CPR transfer
  accel/kvm: Fix SIGSEGV when execute "query-balloon" after CPR transfer

 include/hw/vfio/vfio-cpr.h |  2 +-
 accel/kvm/kvm-all.c        |  2 +-
 hw/vfio/cpr-legacy.c       | 22 +++++++++++++++-------
 hw/vfio/iommufd.c          |  8 ++++----
 hw/vfio/listener.c         |  4 ++--
 5 files changed, 23 insertions(+), 15 deletions(-)

-- 
2.47.1

[PATCH 1/5] vfio/container: Remap only populated parts in a section

[Zhenzhong Duan]

If there are multiple containers and unmap-all fails for some of them, we
need to remap vaddr for the other containers for which unmap-all succeeded.
When ram discard is enabled, we should only remap populated parts in a
section instead of the whole section.

Fixes: eba1f657cbb1 ("vfio/container: recover from unmap-all-vaddr failure")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steven Sistare <steven.sistare@oracle.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
---
 include/hw/vfio/vfio-cpr.h |  2 +-
 hw/vfio/cpr-legacy.c       | 20 +++++++++++++++-----
 hw/vfio/listener.c         |  4 ++--
 3 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index d37daffbc5..fb32a5f873 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -67,7 +67,7 @@ bool vfio_cpr_container_match(struct VFIOContainer *container,
 void vfio_cpr_giommu_remap(struct VFIOContainerBase *bcontainer,
                            MemoryRegionSection *section);
 
-bool vfio_cpr_ram_discard_register_listener(
+bool vfio_cpr_ram_discard_replay_populated(
     struct VFIOContainerBase *bcontainer, MemoryRegionSection *section);
 
 void vfio_cpr_save_vector_fd(struct VFIOPCIDevice *vdev, const char *name,
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 8f437194fa..3ea24d60de 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -224,22 +224,32 @@ void vfio_cpr_giommu_remap(VFIOContainerBase *bcontainer,
     memory_region_iommu_replay(giommu->iommu_mr, &giommu->n);
 }
 
+static int vfio_cpr_rdm_remap(MemoryRegionSection *section, void *opaque)
+{
+    RamDiscardListener *rdl = opaque;
+
+    return rdl->notify_populate(rdl, section);
+}
+
 /*
  * In old QEMU, VFIO_DMA_UNMAP_FLAG_VADDR may fail on some mapping after
  * succeeding for others, so the latter have lost their vaddr.  Call this
- * to restore vaddr for a section with a RamDiscardManager.
+ * to restore vaddr for populated parts in a section with a RamDiscardManager.
  *
- * The ram discard listener already exists.  Call its populate function
+ * The ram discard listener already exists.  Call its replay_populated function
  * directly, which calls vfio_legacy_cpr_dma_map.
  */
-bool vfio_cpr_ram_discard_register_listener(VFIOContainerBase *bcontainer,
-                                            MemoryRegionSection *section)
+bool vfio_cpr_ram_discard_replay_populated(VFIOContainerBase *bcontainer,
+                                           MemoryRegionSection *section)
 {
+    RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
     VFIORamDiscardListener *vrdl =
         vfio_find_ram_discard_listener(bcontainer, section);
 
     g_assert(vrdl);
-    return vrdl->listener.notify_populate(&vrdl->listener, section) == 0;
+    return ram_discard_manager_replay_populated(rdm, section,
+                                                vfio_cpr_rdm_remap,
+                                                &vrdl->listener) == 0;
 }
 
 int vfio_cpr_group_get_device_fd(int d, const char *name)
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index e093833165..799552781f 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -577,8 +577,8 @@ void vfio_container_region_add(VFIOContainerBase *bcontainer,
             if (!vfio_ram_discard_register_listener(bcontainer, section, &err)) {
                 goto fail;
             }
-        } else if (!vfio_cpr_ram_discard_register_listener(bcontainer,
-                                                           section)) {
+        } else if (!vfio_cpr_ram_discard_replay_populated(bcontainer,
+                                                          section)) {
             error_setg(&err,
                        "vfio_cpr_ram_discard_register_listener for %s failed",
                        memory_region_name(section->mr));
-- 
2.47.1

Re: [PATCH 1/5] vfio/container: Remap only populated parts in a section

[Steven Sistare]

On 9/25/2025 10:23 PM, Zhenzhong Duan wrote:
> If there are multiple containers and unmap-all fails for some of them, we
> need to remap vaddr for the other containers for which unmap-all succeeded.
> When ram discard is enabled, we should only remap populated parts in a
> section instead of the whole section.
> 
> Fixes: eba1f657cbb1 ("vfio/container: recover from unmap-all-vaddr failure")
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
> Reviewed-by: Steven Sistare <steven.sistare@oracle.com>
> Reviewed-by: David Hildenbrand <david@redhat.com>

This is a nice simplification of the previous fix - steve

> ---
>   include/hw/vfio/vfio-cpr.h |  2 +-
>   hw/vfio/cpr-legacy.c       | 20 +++++++++++++++-----
>   hw/vfio/listener.c         |  4 ++--
>   3 files changed, 18 insertions(+), 8 deletions(-)
> 
> diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
> index d37daffbc5..fb32a5f873 100644
> --- a/include/hw/vfio/vfio-cpr.h
> +++ b/include/hw/vfio/vfio-cpr.h
> @@ -67,7 +67,7 @@ bool vfio_cpr_container_match(struct VFIOContainer *container,
>   void vfio_cpr_giommu_remap(struct VFIOContainerBase *bcontainer,
>                              MemoryRegionSection *section);
>   
> -bool vfio_cpr_ram_discard_register_listener(
> +bool vfio_cpr_ram_discard_replay_populated(
>       struct VFIOContainerBase *bcontainer, MemoryRegionSection *section);
>   
>   void vfio_cpr_save_vector_fd(struct VFIOPCIDevice *vdev, const char *name,
> diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
> index 8f437194fa..3ea24d60de 100644
> --- a/hw/vfio/cpr-legacy.c
> +++ b/hw/vfio/cpr-legacy.c
> @@ -224,22 +224,32 @@ void vfio_cpr_giommu_remap(VFIOContainerBase *bcontainer,
>       memory_region_iommu_replay(giommu->iommu_mr, &giommu->n);
>   }
>   
> +static int vfio_cpr_rdm_remap(MemoryRegionSection *section, void *opaque)
> +{
> +    RamDiscardListener *rdl = opaque;
> +
> +    return rdl->notify_populate(rdl, section);
> +}
> +
>   /*
>    * In old QEMU, VFIO_DMA_UNMAP_FLAG_VADDR may fail on some mapping after
>    * succeeding for others, so the latter have lost their vaddr.  Call this
> - * to restore vaddr for a section with a RamDiscardManager.
> + * to restore vaddr for populated parts in a section with a RamDiscardManager.
>    *
> - * The ram discard listener already exists.  Call its populate function
> + * The ram discard listener already exists.  Call its replay_populated function
>    * directly, which calls vfio_legacy_cpr_dma_map.
>    */
> -bool vfio_cpr_ram_discard_register_listener(VFIOContainerBase *bcontainer,
> -                                            MemoryRegionSection *section)
> +bool vfio_cpr_ram_discard_replay_populated(VFIOContainerBase *bcontainer,
> +                                           MemoryRegionSection *section)
>   {
> +    RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
>       VFIORamDiscardListener *vrdl =
>           vfio_find_ram_discard_listener(bcontainer, section);
>   
>       g_assert(vrdl);
> -    return vrdl->listener.notify_populate(&vrdl->listener, section) == 0;
> +    return ram_discard_manager_replay_populated(rdm, section,
> +                                                vfio_cpr_rdm_remap,
> +                                                &vrdl->listener) == 0;
>   }
>   
>   int vfio_cpr_group_get_device_fd(int d, const char *name)
> diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
> index e093833165..799552781f 100644
> --- a/hw/vfio/listener.c
> +++ b/hw/vfio/listener.c
> @@ -577,8 +577,8 @@ void vfio_container_region_add(VFIOContainerBase *bcontainer,
>               if (!vfio_ram_discard_register_listener(bcontainer, section, &err)) {
>                   goto fail;
>               }
> -        } else if (!vfio_cpr_ram_discard_register_listener(bcontainer,
> -                                                           section)) {
> +        } else if (!vfio_cpr_ram_discard_replay_populated(bcontainer,
> +                                                          section)) {
>               error_setg(&err,
>                          "vfio_cpr_ram_discard_register_listener for %s failed",
>                          memory_region_name(section->mr));

[PATCH 2/5] vfio/cpr-legacy: drop an erroneous assert

[Zhenzhong Duan]

vfio_legacy_cpr_dma_map() is not only used in post_load on destination
but also error recovery path on source side. Assert it for destination
is wrong.

Fixes: 7e9f21411302 ("vfio/container: restore DMA vaddr")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
---
 hw/vfio/cpr-legacy.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 3ea24d60de..19fd8b60d3 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -51,8 +51,6 @@ static int vfio_legacy_cpr_dma_map(const VFIOContainerBase *bcontainer,
         .size = size,
     };
 
-    g_assert(cpr_is_incoming());
-
     if (ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map)) {
         return -errno;
     }
-- 
2.47.1

Re: [PATCH 2/5] vfio/cpr-legacy: drop an erroneous assert

[Steven Sistare]

On 9/25/2025 10:23 PM, Zhenzhong Duan wrote:
> vfio_legacy_cpr_dma_map() is not only used in post_load on destination
> but also error recovery path on source side. Assert it for destination
> is wrong.
> 
> Fixes: 7e9f21411302 ("vfio/container: restore DMA vaddr")
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>

Reviewed-by: Steve Sistare <steven.sistare@oracle.com>

> ---
>   hw/vfio/cpr-legacy.c | 2 --
>   1 file changed, 2 deletions(-)
> 
> diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
> index 3ea24d60de..19fd8b60d3 100644
> --- a/hw/vfio/cpr-legacy.c
> +++ b/hw/vfio/cpr-legacy.c
> @@ -51,8 +51,6 @@ static int vfio_legacy_cpr_dma_map(const VFIOContainerBase *bcontainer,
>           .size = size,
>       };
>   
> -    g_assert(cpr_is_incoming());
> -
>       if (ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map)) {
>           return -errno;
>       }

[PATCH 3/5] vfio/iommufd: Save cpr.ioas_id on source side for CPR transfer

[Zhenzhong Duan]

On source side, if there are more than one VFIO devices and they
attach to same container, only the first device saves cpr.ioas_id,
the others are bypassed. We should same it for each device, or
else only first device works.

Fixes: 4296ee07455e ("vfio/iommufd: reconstruct device")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
---
 hw/vfio/iommufd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 8c27222f75..103ff43426 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -607,7 +607,6 @@ skip_ioas_alloc:
     container->be = vbasedev->iommufd;
     container->ioas_id = ioas_id;
     QLIST_INIT(&container->hwpt_list);
-    vbasedev->cpr.ioas_id = ioas_id;
 
     bcontainer = &container->bcontainer;
     vfio_address_space_insert(space, bcontainer);
@@ -641,6 +640,8 @@ skip_ioas_alloc:
     bcontainer->initialized = true;
 
 found_container:
+    vbasedev->cpr.ioas_id = container->ioas_id;
+
     ret = ioctl(devfd, VFIO_DEVICE_GET_INFO, &dev_info);
     if (ret) {
         error_setg_errno(errp, errno, "error getting device info");
-- 
2.47.1

Re: [PATCH 3/5] vfio/iommufd: Save cpr.ioas_id on source side for CPR transfer

[Steven Sistare]

On 9/25/2025 10:23 PM, Zhenzhong Duan wrote:
> On source side, if there are more than one VFIO devices and they
> attach to same container, only the first device saves cpr.ioas_id,
                                              nit: sets cpr.ioas_id

> the others are bypassed. We should same it for each device, or
                                 nit: set it> else only first device works.
> 
> Fixes: 4296ee07455e ("vfio/iommufd: reconstruct device")
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>

Reviewed-by: Steve Sistare <steven.sistare@oracle.com>

Thanks for fixing this!

- Steve

> ---
>   hw/vfio/iommufd.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
> index 8c27222f75..103ff43426 100644
> --- a/hw/vfio/iommufd.c
> +++ b/hw/vfio/iommufd.c
> @@ -607,7 +607,6 @@ skip_ioas_alloc:
>       container->be = vbasedev->iommufd;
>       container->ioas_id = ioas_id;
>       QLIST_INIT(&container->hwpt_list);
> -    vbasedev->cpr.ioas_id = ioas_id;
>   
>       bcontainer = &container->bcontainer;
>       vfio_address_space_insert(space, bcontainer);
> @@ -641,6 +640,8 @@ skip_ioas_alloc:
>       bcontainer->initialized = true;
>   
>   found_container:
> +    vbasedev->cpr.ioas_id = container->ioas_id;
> +
>       ret = ioctl(devfd, VFIO_DEVICE_GET_INFO, &dev_info);
>       if (ret) {
>           error_setg_errno(errp, errno, "error getting device info");

[PATCH 4/5] vfio/iommufd: Restore vbasedev's reference to hwpt after CPR transfer

[Zhenzhong Duan]

After CPR transfer, if there are more than one VFIO devices, the second
device's reference to hwpt isn't restored on destination. We still need
to call iommufd_cdev_attach_container() to restore it after a matching
container is found, or else SIGSEV triggers.

Fixes: 4296ee07455e ("vfio/iommufd: reconstruct device")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
---
 hw/vfio/iommufd.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 103ff43426..6df99d3aa6 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -565,10 +565,9 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
             continue;
         }
 
-        if (!cpr_is_incoming()) {
+        if (!cpr_is_incoming() ||
+            (vbasedev->cpr.ioas_id == container->ioas_id)) {
             res = iommufd_cdev_attach_container(vbasedev, container, &err);
-        } else if (vbasedev->cpr.ioas_id == container->ioas_id) {
-            res = true;
         } else {
             continue;
         }
-- 
2.47.1

Re: [PATCH 4/5] vfio/iommufd: Restore vbasedev's reference to hwpt after CPR transfer

[Steven Sistare]

On 9/25/2025 10:23 PM, Zhenzhong Duan wrote:
> After CPR transfer, if there are more than one VFIO devices, the second
> device's reference to hwpt isn't restored on destination. 

More specifically, the device is not added to hwpt->device_list.

> We still need
> to call iommufd_cdev_attach_container() to restore it after a matching
> container is found, or else SIGSEV triggers.
> 
> Fixes: 4296ee07455e ("vfio/iommufd: reconstruct device")
> Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>

Thanks again.

Reviewed-by: Steve Sistare <steven.sistare@oracle.com>

> ---
>   hw/vfio/iommufd.c | 5 ++---
>   1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
> index 103ff43426..6df99d3aa6 100644
> --- a/hw/vfio/iommufd.c
> +++ b/hw/vfio/iommufd.c
> @@ -565,10 +565,9 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
>               continue;
>           }
>   
> -        if (!cpr_is_incoming()) {
> +        if (!cpr_is_incoming() ||
> +            (vbasedev->cpr.ioas_id == container->ioas_id)) {
>               res = iommufd_cdev_attach_container(vbasedev, container, &err);
> -        } else if (vbasedev->cpr.ioas_id == container->ioas_id) {
> -            res = true;
>           } else {
>               continue;
>           }

Re: [PATCH 0/5] VFIO: cpr-transfer fixes

[Cédric Le Goater]

Hello Zhenzhong

On 9/26/25 04:23, Zhenzhong Duan wrote:
> Hi,
> 
> Patch1: fixed an error restore path when virtio-mem is configured.
> Patch2: fixed assert failure on error restore path, this issue happens
> no matter if virtio-mem is configured.
> Some trick is played to trigger the error path,
> see https://github.com/yiliu1765/qemu/commit/494d19e7f7242dbc47d7f236937cde0c396a4a7c
> 
> Patch3-4: issue only happens with two or more VFIO devices, no issue
> if only one VFIO device.
> 
> Patch5: SIGSEGV if I send "query-balloon" to source qmp monitor,
> I'm not quite sure if it's deserved to be fixed, as guest has been
> migrated to destination, it's not a big issue for source qemu to
> SIGSEGV?

A large series renaming files, structs, etc. from Mark has just been
merged. Could you please rebase and resend ? Sorry about that, I wanted
to get Mark's changes in asap.

Also patch 5/5 seems disconnected from the email thread.

Thanks,

C.

RE: [PATCH 0/5] VFIO: cpr-transfer fixes

[Duan, Zhenzhong]

>-----Original Message-----
>From: Cédric Le Goater <clg@redhat.com>
>Subject: Re: [PATCH 0/5] VFIO: cpr-transfer fixes
>
>Hello Zhenzhong
>
>On 9/26/25 04:23, Zhenzhong Duan wrote:
>> Hi,
>>
>> Patch1: fixed an error restore path when virtio-mem is configured.
>> Patch2: fixed assert failure on error restore path, this issue happens
>> no matter if virtio-mem is configured.
>> Some trick is played to trigger the error path,
>> see
>https://github.com/yiliu1765/qemu/commit/494d19e7f7242dbc47d7f236937
>cde0c396a4a7c
>>
>> Patch3-4: issue only happens with two or more VFIO devices, no issue
>> if only one VFIO device.
>>
>> Patch5: SIGSEGV if I send "query-balloon" to source qmp monitor,
>> I'm not quite sure if it's deserved to be fixed, as guest has been
>> migrated to destination, it's not a big issue for source qemu to
>> SIGSEGV?
>
>A large series renaming files, structs, etc. from Mark has just been
>merged. Could you please rebase and resend ? Sorry about that, I wanted
>to get Mark's changes in asap.

Sure, will do.

>
>Also patch 5/5 seems disconnected from the email thread.

Oh, maybe an occasional failure with my mailbox.

Thanks
Zhenzhong