From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022094.outbound.protection.outlook.com [52.101.66.94]) by lore.virtuozzo.com (Postfix) with ESMTPS id E3D9480BAC for ; Tue, 20 Oct 2026 16:31:01 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=cZ8e7adJywMHeBjaWbYjz7Y4b/YBSGFBTy4smfBZZ+gOU9Eh0r00lhqWuwy2xI91np7jB7j0Ao6Hm9kDZ0W9kvJZ0nvKQIYk/WF75cs+/XR2Tbh8nYF7kv/3WdBGw46q71V8yR5JSgUx9rVvk5ntVqh1222l3BeaSsgvtRJzkrsmQJsduUftpwXUDhANi+0DO8uQ+NeI1NXij9J1Bq14KQYUbjpn7zn7C1w+EUkPrOjCsl9okgcqdtl51rFQNSOFMu7tFvjLLEBcz0BoY6Jvx0VmMPgjO4FJNFe4dZvMrV+VG9jshV6E8ZZmoQ7Cwh7t/VWff9sZt5fetSOj3UYroQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GDMNOnkIWqPohIFIxF0ts6ptV/2cEyJ9++XvRaSNPTU=; b=OS1jJ9JK00ERTqR3CVeZE31eGNU430Z/dXN/Rek2oNAnNpZ5thUKs32t57zbKKD4yon5BRhei99hT8tg/l/M5h0thaMkDcqNlSVHxII5uGa+z/8PlpuO3hYb3mk3o8TJGhamRH70pG5pkyKNThbF3F0Nx/sFNvOkrNHFBucc6QoTGcmdZcBdHqNPfV9V1raAmpZJNjvoIXRq6q3jSFOWELJ6n+pYw+z5rh/TqDXp0CxxrONAjrkoyoRmpo4vGIqx65+DyH8Jxa+Tt1OPCjF4LXFSkLfp+LsdlBWYzhUqnaOA5UsKP4V8o8/6kqTulRJKDAtGswV3/wi/NoG4ZmQ0Fg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GDMNOnkIWqPohIFIxF0ts6ptV/2cEyJ9++XvRaSNPTU=; b=fCvwxYt+y78GJaVukAsQoyppIIbt9fQWREzZRtx8Der6zDgjRk7xUkgxaGIu9ih4171U1OOHwtoqq8jaMxLismgZaFGM0i+64WDj2reUSr1OxraP6zgvL6C75CNBnAVn6cN0JX6oDza4EwKwPfHyhlvMdL+SLwqpPRQQwXKR6Rqq3F7jc0EuDaN3p29mdOCFEV8brMeiiK6+yOJW9NuV8/4RESzoYiSvQTgjFWfbL94uw1+PkPT8XXicD+MDREJQtaEzR73gfzXaUUpXj3vOaoIl5n8AIhQlTpKFnfTW5OJTpYDCyleX+CxCXbEDQtju6Ovuuptf5VYig0fEb3/MuA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by AS4PR08MB7553.eurprd08.prod.outlook.com (2603:10a6:20b:4fb::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Tue, 20 Oct 2026 16:30:59 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.012; Tue, 20 Oct 2026 16:30:59 +0000 From: Andrey Drobyshev Date: Tue, 20 Oct 2026 19:31:00 +0300 Subject: [PATCH QEMU HCI-8.1 v4 20/31] kvm: tolerate ioctls after kvm_close() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261020-vfio_v1-v4-20-83a5668230e5@virtuozzo.com> References: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> In-Reply-To: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIUP296CA0056.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::14) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|AS4PR08MB7553:EE_ X-MS-Office365-Filtering-Correlation-Id: 097fef98-6de9-45c8-650f-08df2ec78509 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|376014|52116014|366016|6133799003|5113699003|10067099003|22082099003|18002099003|5023799004|261009223027099003|261009221227099003|56012099006|38350700014; X-Microsoft-Antispam-Message-Info: YUV+v6aranGipo2bx20uBoGoOdwy06DLiXlE/tRU1dtVU3O+ur7bioPxtpBVqFaT/4RQLi7XE6fplXclWqP/m5j7dKAOzRRtgGH179e7pRHDBpbREl9UA3A/zRUO72bj2l5+Ik+ob6LQ8OMKVlb+WtltCm7gmfYtsRy6OfoFZ/oOlG/jq7/3+B7h+gJR1DeQnBOuYwcDV9yP5E5+U/t0BtFNfiWGnzaR6qEAC+sYGJsS23xjaVxCmMe7tcEma3J5NZCjn57jwopKzYKmeKy3u2UYPA/BzZa7+7A0XVbz7+Ym39pUod9YQHWbDZmHizy48G+mcw3J+W9bOwzfBvBFoq0CKivGVx6CZBhdQLl0hHgqGTZoZY34uPN96nomMGNee6mMY8rf2Nkva5DwCLwu9bNJs324zuQvO8D8SAjn7bfXJ1PKAIZyxzi0ov9FBk5bVuYK2/i0NjMqwt9CThcQ+E3pxGK7Nmx/FZiYqGvD8pcdTPGi+LNSo4g8REIzUkBGpCIc6xJD7SDunkdH1PvkAZuRfSsKRcaDU/Gf0GtnIvtP+VdKP8DPaTgq3eL1m3YbeF3KkE0g1S06Kx2sTfgB6lHR07J4w9hCpwsrbhtmZb9Y5qIbjIhzfSBLiVFROFUxfFYAUrbaUAbXCbNNA7Zv0YIuoc82SVxY8/KJd2cYjI2PkMoMe7OuBrjCVu6E62qLh1F2bRpcXO6D7M2fYvIWla3AT8jitEx/LXljsxzN0n4= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(376014)(52116014)(366016)(6133799003)(5113699003)(10067099003)(22082099003)(18002099003)(5023799004)(261009223027099003)(261009221227099003)(56012099006)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?ZDdkVUxsVUZHN0dwK2hTVnVPRExYMnhZZDBuR2pEeEdLOHhFRCtsdCtUalFU?= =?utf-8?B?ZkNjSUVrSzZlQ3grd01uOW1OQlFGRWI2aXA4YXVHNW1ZaUt3Wkx6T0NyYTY5?= =?utf-8?B?c3hPWHRVR1JreGU4djhZMFl2SUxHeFRLSzRka1ZuNlB0WDdvNkVzUnBiMFQy?= =?utf-8?B?WnowL3NTd1c5ZHhwSjF0Y0l1cTFKMnhFZmdqYy9KZ3Nlb1E5K2lCbDFYa0c5?= =?utf-8?B?bWZmS3pPK05xSHd4V3ViNkMzTWNHMmhrVXMya0IwQnBROEpVVE9ReTl1UVdj?= =?utf-8?B?NFlZNzdsM3VlUE9qNUg1STJVNmlKWXdMWFN6TlRXV1dTNmFjTWsrMlpwMmNP?= =?utf-8?B?RFo5YTJpN1UrZFZXdzYzS0VWUnZJdG9wVFpTNVJ5Q0srcFBYamtYdEJVQTFG?= =?utf-8?B?Vm9JMHRVZHpmdmQrc1VkOENmbE1WaSs2aHFrRFV4UkJEQU9uV1FkM2ZvOVY3?= =?utf-8?B?dzVYS3A2TVZPNjZDdGtrK2VZM0RjSkdwUzNIaGdLMFpNMVRjc3BqcDJmUi9U?= =?utf-8?B?eGdsNWRXQXF0eE9YdWJoOUdiWmlHZGFuOHNKSjRRL2FVSkZNRFhjVkREUmQ3?= =?utf-8?B?YkJMam8xMnZzWUJUb0Nha3BzVzRDL0tzU21OTmNrTEEzV2g5Tno5OVpEMGZw?= =?utf-8?B?ZTdmMnJCOXB5WW1aWDE5WnBsSDh6SVFORCtqS1IzdDY5QVZKWnNXcWd2U2hi?= =?utf-8?B?cTRPQ21Bb0JIQWI5SHc3RnlhL01ZVHpqU3NFL0lKakJJNENPSnBvVDFXMkVT?= =?utf-8?B?MGNzZG5sY1EwR1JhQ2czbzl6MHIwN1hEWGdWaE8yT3Izby9HcDlldEsvSFNr?= =?utf-8?B?Nkc3d0VsUHdNeUFUSVdWOE5uYk9PLzYrQW9PTm5qMEZpSGNCaENXK2hXQ3I2?= =?utf-8?B?NnpkT3JWVGJWNHc1QkZxRk5QdXhTVUxFOEhhZDJoS2tGcE93V2lFZkppYk9a?= =?utf-8?B?Y3JOYjNPd1lVeVUra3hacGFMTXVwTTNNVXlaSFNsSjAva0RqVnp3c0JVSEFM?= =?utf-8?B?QzllWXNvdG1RTGdLWG5zTWRnNG41ZzBUbGF5K1AybXhFUTJ2YndhUVZUR0Uz?= =?utf-8?B?d29JSHhFenJudm1ocXhObDZTeDNYSlhJTXBENVRUZGJOWnlUNm4wZHVzOStC?= =?utf-8?B?eHJhaHlqVS9JeHRubjRsc0RVOGVQSFRQdHFXQU4rUlA4MEs0aFc2NmZtZHZ3?= =?utf-8?B?eWdCZkFMVzY2RUUvSEsyTmxyVTFPSFJLZGpvMFBFcVdHRW5Gc1V4dkhJMmRN?= =?utf-8?B?R0ovQnZhSzBzM3F3blBlMnNIeDQrclc1TFk2azJVcXZJRmRKRlZZSXUxdWNy?= =?utf-8?B?T3VLN1dmZnQ4Ykd5VTBUSTlucktYaEVjeGo3aTJhdS9kMjY1V0Fabnp5R2Jy?= =?utf-8?B?TFBFcllQZjNlVy9jRHVuelcxN25wRVN4UnhXT1ZCb1RJbE5kMFVMQUNrUWxt?= =?utf-8?B?dzU5UGxiS093SFVWVlh0VGxYeE1ZazN6Nk1jYkh3QW9JNEtVNGU0WTR5OGUx?= =?utf-8?B?clFrUkt2UHNQWjRObzNQa2t5bkJnWTFpSlBNaDFMSVYzSmVIVzd0UERXMDNQ?= =?utf-8?B?NGZsMWQ3MEJTSzlCVndFMUNsSzhPc2hPZXdsbmg2Rlk1bFVESkdVMURBOU80?= =?utf-8?B?S01HV1MwK013RktRTy9McWw1UGhpN2IzeTZ4ZXdiZTg2TU9NYWcvRkNvTkZv?= =?utf-8?B?RzlBMnpUTWEzLzJLOFV6d01NOHV6MlNqRjhzYldtODI5WnlNSXh1Q3RvRWNr?= =?utf-8?B?c3N3bC9QMFNVS1dMQmN4Wnpsd3dnZ2pkWVEyTzYrVFFJVUZqaCs0WWxmQlBG?= =?utf-8?B?YUZYN3FKNWdGbGc2aXozSTNsdVpyMnIvMFFLbmxqY0xRZGttcnpVTkxMZ093?= =?utf-8?B?cjNOY1QwRGNKNEc5WWQ3V0hlTWo1cDBDSEJWa2ZtTytkTXBKeTVIa1RQeW1I?= =?utf-8?B?bFdKQjhSTWdycEpnQ0EydTk1NWhmZmtBMDI0bnJiMksyOHIxTE45bHhkNVpv?= =?utf-8?B?LyszVlRKbWowNWhRYU9BWG5VZnloSkZXcDBaaVBkK1VXWW1GVXVQeG05UUpU?= =?utf-8?B?K1lDVTVlYi9lSVNzL2x3eW41QnBCZWlzNklNdlpMZm02R1lGaFBJZzFXeEw3?= =?utf-8?B?cWl0VEYzcUZHL1h3TTZCSVpJc054K2dyellXei94YnF2ZDY5cGxiNVp5ZFNU?= =?utf-8?B?bWFyNGxKcmVpdmUxRFhEbTlRS1k4OXMzRFIycXgwY3hPZExEd1p0RnQ0OC9N?= =?utf-8?B?dHhVbnRGbHB5YmttTlBQUkVjRlBMUXNFcy9VcXpEY21Ga1JuWmVHa0VmU2Rj?= =?utf-8?B?TEpCeUR2c3RSb0lCSDFtYkRkNCswRTB3Qys3Q1pTcEFVQWlPT3BqekY5TWY4?= =?utf-8?Q?4A7T+88ri5eUZkIY=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 097fef98-6de9-45c8-650f-08df2ec78509 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Oct 2026 16:30:57.6332 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: iVqxSw/Rdc8lUyOxFy7YCRJP0w++3lUHKhSTFE6VyOplxZ/xgukkS7givR+t452xLJJrgmHYxb5nASqPIleoujoYQUK3F02CpyWQKZCa8wM= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS4PR08MB7553 Since commit 7ed0919119b0 ("migration: close kvm after cpr") a source QEMU that has handed its VFIO devices over via cpr-transfer (or cpr-exec) calls kvm_close() once the migration completes, so that the destination can register its irq bypass consumers. kvm_close() closes the VM and vCPU descriptors and sets kvm_state to NULL, but the source process keeps living with all its device models intact until the management layer terminates it. Nothing prevents those device models from raising interrupts in the meantime, and the regular exit path even guarantees one: net_cleanup() deletes the netdev behind an emulated virtio-net, the NIC sees the link go down and calls virtio_notify_config(), MSI-X delivers through the in-kernel APIC, and kvm_irqchip_send_msi() dereferences the NULL kvm_state: #0 kvm_vm_ioctl (s=0x0, type=KVM_SIGNAL_MSI) accel/kvm/kvm-all.c #1 kvm_irqchip_send_msi (s=0x0) #2 kvm_send_msi hw/i386/kvm/apic.c #3 kvm_apic_mem_write ... #9 pci_msi_trigger #11 msix_notify #12 virtio_pci_notify #14 virtio_notify_config #15 virtio_net_set_link_status #16 qemu_del_net_client #17 net_cleanup #18 qemu_cleanup Every retired cpr-transfer source with a VFIO device thus dies with SIGSEGV on SIGTERM/quit and leaves a core dump behind. Without a VFIO device kvm_close() never runs and the same exit is harmless. Make the ioctl wrappers honour the closed state instead of assuming a live KVMState: keep kvm_state allocated, with its closed descriptors as the mark, and let kvm_ioctl(), kvm_vm_ioctl() and kvm_vcpu_ioctl() return 0 once kvm_close() has been called, so any late interrupt or query on the retired source is a no-op. Returning an error instead would still kill it: kvm_set_irq() aborts and kvm_irqchip_commit_routes() asserts on any failure, and the ioeventfd callers abort on a stale errno. Fixes: 7ed0919119b0 ("migration: close kvm after cpr") Signed-off-by: Andrey Drobyshev --- accel/kvm/kvm-all.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index a39c1ba260a..8b5d342af52 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -644,7 +644,6 @@ void kvm_close(void) close(kvm_state->fd); kvm_state->fd = -1; } - kvm_state = NULL; } /* @@ -3371,6 +3370,11 @@ int kvm_ioctl(KVMState *s, unsigned long type, ...) arg = va_arg(ap, void *); va_end(ap); + /* kvm_close() has been called: there is no KVM to talk to any more */ + if (s->fd == -1) { + return 0; + } + trace_kvm_ioctl(type, arg); ret = ioctl(s->fd, type, arg); if (ret == -1) { @@ -3389,6 +3393,11 @@ int kvm_vm_ioctl(KVMState *s, unsigned long type, ...) arg = va_arg(ap, void *); va_end(ap); + /* kvm_close() has been called: there is no VM to talk to any more */ + if (s->vmfd == -1) { + return 0; + } + trace_kvm_vm_ioctl(type, arg); accel_ioctl_begin(); ret = ioctl(s->vmfd, type, arg); @@ -3409,6 +3418,11 @@ int kvm_vcpu_ioctl(CPUState *cpu, unsigned long type, ...) arg = va_arg(ap, void *); va_end(ap); + /* kvm_close() has been called: the vCPU fds are gone */ + if (cpu->kvm_fd == -1) { + return 0; + } + trace_kvm_vcpu_ioctl(cpu->cpu_index, type, arg); accel_cpu_ioctl_begin(cpu); ret = ioctl(cpu->kvm_fd, type, arg); -- 2.47.1