[PATCH v2 hci-7.4] hostmem: fix live update crash of VMs with bound guest memory #VSTOR-147016

[PATCH v2 hci-7.4] hostmem: fix live update crash of VMs with bound guest memory #VSTOR-147016

[Denis V. Lunev]

From: Denis V. Lunev <den@openvz.org>

A live QEMU update kills a VM whose memory backend has host-nodes when
the emulator cgroup no longer allows those nodes. The old QEMU saves its
state, the new one exits during startup with

  qemu-kvm: cannot bind memory to host NUMA nodes: Invalid argument

and the guest is lost.

Guest RAM survives vz-cprsave restart as the same anonymous mapping,
carrying its pages and its memory policy.
host_memory_backend_memory_complete() does not know that and treats it
as fresh memory: it calls mbind() with MPOL_MF_STRICT | MPOL_MF_MOVE and
preallocates again. The exec keeps the PID and the cgroup, so if
cpuset.mems has been changed to nodes outside host-nodes since the VM
started, mbind() returns EINVAL and QEMU exits. Where it succeeds, it
only walks or migrates pages that are already in place, while the guest
is stopped.

Skip the NUMA binding and preallocation for an anonymous backend while
the new process is being restored. Test CPR_RESTART_POSTEXEC rather than
cpr_restart_in_progress(): the latter also covers CPR_RESTART_PREEXEC,
which a failed vz-cprsave leaves set in the old process, and memory
hotplugged there afterwards would lose its binding. Backends with an fd
get a new mapping after the exec and keep mbind().

Suggested-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Signed-off-by: Denis V. Lunev <den@openvz.org>
---
 backends/hostmem.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/backends/hostmem.c b/backends/hostmem.c
index 747e7838c03..5f36d7aa938 100644
--- a/backends/hostmem.c
+++ b/backends/hostmem.c
@@ -20,6 +20,7 @@
 #include "qom/object_interfaces.h"
 #include "qemu/mmap-alloc.h"
 #include "qemu/madvise.h"
+#include "qemu/cpr-env.h"
 
 #ifdef CONFIG_NUMA
 #include <numaif.h>
@@ -343,6 +344,11 @@ host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
         if (!backend->dump) {
             qemu_madvise(ptr, sz, QEMU_MADV_DONTDUMP);
         }
+        /* Anonymous memory is inherited on restart with its policy and pages */
+        if (cpr_getenv_bool("CPR_RESTART_POSTEXEC") &&
+            memory_region_get_fd(&backend->mr) < 0) {
+            goto out;
+        }
 #ifdef CONFIG_NUMA
         unsigned long lastbit = find_last_bit(backend->host_nodes, MAX_NODES);
         /* lastbit == MAX_NODES means maxnode = 0 */

base-commit: c57b00198350b12ab35649707528304a2d34c0e9
-- 
2.53.0

Re: [PATCH v2 hci-7.4] hostmem: fix live update crash of VMs with bound guest memory #VSTOR-147016

[Andrey Drobyshev]

LGTM
Ack

On 9/23/26 8:31 PM, Denis V. Lunev wrote:
> From: Denis V. Lunev <den@openvz.org>
> 
> A live QEMU update kills a VM whose memory backend has host-nodes when
> the emulator cgroup no longer allows those nodes. The old QEMU saves its
> state, the new one exits during startup with
> 
>   qemu-kvm: cannot bind memory to host NUMA nodes: Invalid argument
> 
> and the guest is lost.
> 
> Guest RAM survives vz-cprsave restart as the same anonymous mapping,
> carrying its pages and its memory policy.
> host_memory_backend_memory_complete() does not know that and treats it
> as fresh memory: it calls mbind() with MPOL_MF_STRICT | MPOL_MF_MOVE and
> preallocates again. The exec keeps the PID and the cgroup, so if
> cpuset.mems has been changed to nodes outside host-nodes since the VM
> started, mbind() returns EINVAL and QEMU exits. Where it succeeds, it
> only walks or migrates pages that are already in place, while the guest
> is stopped.
> 
> Skip the NUMA binding and preallocation for an anonymous backend while
> the new process is being restored. Test CPR_RESTART_POSTEXEC rather than
> cpr_restart_in_progress(): the latter also covers CPR_RESTART_PREEXEC,
> which a failed vz-cprsave leaves set in the old process, and memory
> hotplugged there afterwards would lose its binding. Backends with an fd
> get a new mapping after the exec and keep mbind().
> 
> Suggested-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
> Signed-off-by: Denis V. Lunev <den@openvz.org>
> ---
>  backends/hostmem.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/backends/hostmem.c b/backends/hostmem.c
> index 747e7838c03..5f36d7aa938 100644
> --- a/backends/hostmem.c
> +++ b/backends/hostmem.c
> @@ -20,6 +20,7 @@
>  #include "qom/object_interfaces.h"
>  #include "qemu/mmap-alloc.h"
>  #include "qemu/madvise.h"
> +#include "qemu/cpr-env.h"
>  
>  #ifdef CONFIG_NUMA
>  #include <numaif.h>
> @@ -343,6 +344,11 @@ host_memory_backend_memory_complete(UserCreatable *uc, Error **errp)
>          if (!backend->dump) {
>              qemu_madvise(ptr, sz, QEMU_MADV_DONTDUMP);
>          }
> +        /* Anonymous memory is inherited on restart with its policy and pages */
> +        if (cpr_getenv_bool("CPR_RESTART_POSTEXEC") &&
> +            memory_region_get_fd(&backend->mr) < 0) {
> +            goto out;
> +        }
>  #ifdef CONFIG_NUMA
>          unsigned long lastbit = find_last_bit(backend->host_nodes, MAX_NODES);
>          /* lastbit == MAX_NODES means maxnode = 0 */
> 
> base-commit: c57b00198350b12ab35649707528304a2d34c0e9