The vq->inuse field is not migrated. Many devices don't hold VirtQueueElements across migration so it doesn't matter that vq->inuse starts at 0 on the destination QEMU.
At least virtio-serial, virtio-blk, and virtio-balloon migrate while holding VirtQueueElements. For these devices we need to recalculate vq->inuse upon load so the value is correct. Signed-off-by: Stefan Hajnoczi <stefa...@redhat.com> --- hw/virtio/virtio.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index 15ee3a7..4df8274 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -1648,6 +1648,20 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id) } vdev->vq[i].used_idx = vring_used_idx(&vdev->vq[i]); vdev->vq[i].shadow_avail_idx = vring_avail_idx(&vdev->vq[i]); + + /* Some devices migrate VirtQueueElements that have been popped + * from the avail ring but not yet returned to the used ring. + */ + vdev->vq[i].inuse = vdev->vq[i].last_avail_idx - + vdev->vq[i].used_idx; + if (vdev->vq[i].inuse > vdev->vq[i].vring.num) { + error_report("VQ %d size 0x%x < last_avail_idx 0x%x - " + "used_idx 0x%x" + i, vdev->vq[i].vring.num, + vdev->vq[i].last_avail_idx, + vdev->vq[i].used_idx); + return -1; + } } } -- 2.7.4