Re: [PATCH] vhost/migration: Fix incorrect size used in inflight->addr in VMSD

On Wed, Jul 29, 2026 at 04:49:13AM -0400, Michael S. Tsirkin wrote:
> On Wed, Jul 29, 2026 at 12:25:05PM +0500, Alexandr Moshkov wrote:
> > 
> > On 7/28/26 20:39, Peter Xu wrote:
> > > It was overlooked that VMSTATE_VBUFFER_UINT64() won't really work with an
> > > uint64_t, as vmstate core only treats the size as 32bits, and maximum
> > > INT32_MAX (see vmstate_size()).
> > > 
> > > Considering that we do not need real 64bits for the size, stick with the 2G
> > > limit, converting the size field into 32bits.
> > > 
> > > Since we can't touch the wire protocol on migration from an old QEMU, we
> > > can't directly modify the type of size to uint32_t.  Instead, we need to
> > > introduce a temporary variable for this extremely rare issue __size_32bits
> > > to be used only for VMSTATE_VBUFFER_UINT32().  Document it and name it
> > > weird enough so people won't get confused on having two size variables.
> > > 
> > > Remove VMSTATE_VBUFFER_UINT64() altogether, because it was never going to
> > > be used right.  It means QEMU will only support 2G max for VMS_VBUFFER.
> > > 
> > > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3675
> > > Reported-by: 김승중 <[email protected]>
> > > Cc: Alexandr Moshkov <[email protected]>
> > > Cc: Michael S. Tsirkin <[email protected]>
> > > Cc: Fabiano Rosas <[email protected]>
> > > Fixes: 3a80ff0721 ("vhost: add vmstate for inflight region with inner buffer")
> > > Signed-off-by: Peter Xu <[email protected]>
> > > ---
> > > 
> > > PS1: I only did smoke test as I'm not fluent with vhost inflight feature.
> > > Please kindly try it out if possible. In general, migrations from older
> > > QEMU should work even after applied.  One can also treat this as partly-RFC
> > > from that.
> > 
> > It looks like inflight migration is broken:
> > 
> > qemu-system-x86_64: Missing section footer for
> > 0000:00:02.0:00.0:00.0/vhost-user-blk
> > migrate_error error=load of migration failed: Invalid argument: Section
> > footer error, section_id: 53
> > qemu-system-x86_64: load of migration failed: Invalid argument: Section
> > footer error, section_id: 53
> > 
> > As far as I understand this happen because __size_32bits not initialized on
> > source - it's never set. So vmstate_size() reads 0, and zero-lenght buffer
> > is written into migration stream.
> > The destination then allocates the correct buffer but reads 0 bytes from the
> > stream, leaving unconsumed data and causing the section footer check to
> > fail.
> > 
> > It can be fixed with adding pre_save (or pre_save_errp) to
> > vmstate_vhost_inflight_region_buffer that initialize __size_32bits from
> > size:
> > 
> > static int vhost_inflight_buffer_pre_save(void *opaque)
> > {
> >     struct vhost_inflight *inflight = opaque;
> >     /* Only used in VMSTATE_VBUFFER_UINT32() */
> >     inflight->__size_32bits = inflight->size;
> >     return 0;
> > }

Thanks for the testing and report, Alexandr.  Obviously I only kept in mind
of the cross-binary case..  I'll see if I'll respin with the fix or
something different.

> 
> At which point I ask whether open coding all this mess
> is so much better.
> 
> 
> Way I look at it, vmstate machinery had an API of storing size in u64
> that it failed to implement correctly. Why not fix it?

I explained in my reply to Fabiano:

https://lore.kernel.org/qemu-devel/[email protected]/

Thanks,

-- 
Peter Xu