From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022103.outbound.protection.outlook.com [52.101.66.103]) by lore.virtuozzo.com (Postfix) with ESMTPS id E0F4B8122C for ; Tue, 3 Nov 2026 13:57:51 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=b1N0OYfOWljQay7V6vkmgy1dXmh76r5iLtAhy3RzF4mfPN4jfVEqKJhQlhjd3FhEqtX43DDFjxhk+yrTA7PADOA3LzhtPvABjuB/tvxcxq/DGXYXcrdhvq1pNvaF4JVQUufYQyQH+7485tQ4c+eT6C182CG7T7+bqXTGghGkV3GeWkfyB5twZZf7efTuzF1eyTrrzu00r4YZFQ9Fnl/prMpMVdYm/oL3Gayiv//V3Pft+63L0fQagmJ/YZwsK7m28dux4IqAGwZ3ynlTG4YBI1KG5fl917tClz30d+4sEaTA6q4d2ovdPt2O+SotQy9HfD7Fk5S+BftB4IBtR29ujA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=GDMNOnkIWqPohIFIxF0ts6ptV/2cEyJ9++XvRaSNPTU=; b=Kjx9JWIVMgSQTaLdUgKQli2xe8jtU3CJaOri/+HP1eDrwPRTkvjyBadJjTujGz+OKK/7qYyEyx0wZeNHgF4056g4xKrLcvK6T8PYSUyNm0mDXqW1qoWJOMHEphBHYO5+5R4lVZfL6uYPrmL6X/LEoKRCffAvauZ2WkBp63Fdlw/Kw+wLDfIscOlQQk/Lytb8c7Rj02P/8gIBvUC3CI6hTUTMFj9RUo1eexnl9g6XTAsKkmLKZpvxzIUNi9AkoRkaIBQZKva2lfCBX0706zk/zzijyAoU8IiLsAGp3vAlJj5QCfGL3dAqjRxyFFRGHBUYEMkT+CxTQEHKSg0wd4/g0w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=GDMNOnkIWqPohIFIxF0ts6ptV/2cEyJ9++XvRaSNPTU=; b=KnTk+ZIm7+R/aBJrgaZHM2CpyaC1P8o2/XWfAw3HJl14NvyfjjWvZ5ulhcA9L/3MbnfuJ0rqrOSPZXcNTiJwfr1K+Esv5IIpTHqwFS9FzZ2C3zemYlOZPRVV6AOjoniHv7KRncrXNnV/LoQGcH4y5SDgNhCbNx6Svv76/7Mi1KkgqgOjGYkJKlt9ssvUkN2cllHouosAWWsMgNbU2WanMXKmwxjGqwE8h4OoRU6LsNIcutwGLt7Tkmx/24VH3idVmwnMpp4Mn3xMxMxyqdu/8b5ejuAaO72dGUKR7iMFeLw1sboB+lyQGY+tjSoRekZmzuBRImzEUmLflVNZOHNOww== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DB9PR08MB7423.eurprd08.prod.outlook.com (2603:10a6:10:370::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Tue, 3 Nov 2026 13:57:50 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.011; Tue, 3 Nov 2026 13:57:50 +0000 From: Andrey Drobyshev Date: Tue, 03 Nov 2026 15:57:38 +0200 Subject: [PATCH QEMU HCI-8.1 v7 23/35] kvm: tolerate ioctls after kvm_close() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261103-vfio_v1-v7-23-4467fdccbbe6@virtuozzo.com> References: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> In-Reply-To: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI4PEPF00000153.AUTP296.PROD.OUTLOOK.COM (2603:10a6:808:1::86f) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DB9PR08MB7423:EE_ X-MS-Office365-Filtering-Correlation-Id: d68bbb04-7c47-4a0f-e33b-08df39b268cf X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|1800799024|376014|52116014|23010399003|18002099003|22082099003|38350700014|56012099006|5023799004|261009223027099003|261102123227099003|261009221227099003|261022075727099003|261028144727099003|261021123027099003|261026140227099003|261021121427099003|261021135927099003|261022105027099003|261026121527099003|10067099003|5113699003|6133799003; X-Microsoft-Antispam-Message-Info: Nx7Ig/yr52jTgJ0R0Ln8DouqCgKzoYvRLgQfLkcJyD5Sti4G/SWzUicLh4g63ItACRrZpfv7F8REL+VQ82OSreNDW4aqQzpLHw1vIxtRlTKWZfkgd9UrcRDD68PU73+aZj7Za7exBKJYvn9elJi1c6eBw90jVUDhxThs4tkaD+CSLbzXm9Vrid8PL1qAa6Y1oeikZMV1ycP5Z/TGdh2xsy90UmzjJ2yH1OlgJQ4hE98FbriRlDJVH6w9wnY2R3MtTGSqO1BWDrif6V1JHCVq7rU8SawoO6Q8TTNOgfx9czmPaqpxjrDEPdz8ghnQ1UhLpe0VUSYoX3+nrgy0GoUnYzukPtRVHZaUOrKZkLCkkhnkotDLDSfEVY+V8WXIcRWZ0WSC15vYFhuS4dPdjj7JsykmDb7BuF7sEBLnrBOVRUPdfrgczSytdzJjXl9/1z7gvJzd1pG+E9yDY3t8X86zkNUN6HxNO1gXXjtYRgVj+I52m4CZiXC308tuEZy2E69wB5y1UkW0qdS6YcZFOgwfsYx+7bQHk/STYil2x7zW200IuIJJmCQBBQfVu78BgHoDO1GpDHLVmp8n/M0Y6O4UJYgqlw3C+DRcEwctFxK6VEiFHWXkQR9e+mBQH/a+GWRe4JHTJ1C1urO+slKuRhU1C5sWyjXLXJlY1cIz3El6cPLfEdd9F0pAWPSnwLp+EhmQE2b1dnn69qONRQ/U9+cedIeNO/lM87GuIIC97EaUD0Y= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(376014)(52116014)(23010399003)(18002099003)(22082099003)(38350700014)(56012099006)(5023799004)(261009223027099003)(261102123227099003)(261009221227099003)(261022075727099003)(261028144727099003)(261021123027099003)(261026140227099003)(261021121427099003)(261021135927099003)(261022105027099003)(261026121527099003)(10067099003)(5113699003)(6133799003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Q2ljSDhrdnBVMmV1cHdPNnk1Uk1mQ0d1aXh5bGU1Ty9iU0ZFMXRrREZZdVZG?= =?utf-8?B?RFZML0Q4ZFBPbjdWZllJV0s3NGtqeHl2cUNaVDFLRVREeXYyNVRUcHZHdkh6?= =?utf-8?B?MnVzSGF0ZEdFcG44dGRvU3JHTTViZ2V0RXNEZGlDQTRnWnkzckMyZXlySUFh?= =?utf-8?B?Z1JjenlGeFdVa05GbFNud1NuWm1tS3g1dlhwdkxBaDdrWFJHVnp3OHFtb0ls?= =?utf-8?B?T1cwVDNrMjhvT3l5eDg0eU5uemNMc05kWUE4TGZFVnpOckRMMVNlYmNOUDBR?= =?utf-8?B?SDJ5Nlc0OE5XQ2ZaME1wa1VwM1FyWFEwT2oxSTM3NzdQaEFsQWthVjlCMnRD?= =?utf-8?B?VXhrc1N6eTRGbStkR0lQN3lGZWxYemFIN3FraUNoZy8vV3pZcEU0ZWhYMHZN?= =?utf-8?B?dE9oSGM2R1BaOWFZNWE4bHNzRVlRaU9IWDFKbDdzSWFpVXJEWDFGNmw0aWdG?= =?utf-8?B?RzFQeUszYm1WWjdoeTY1OUFvZStJVEJvaStWbGFwb2NDOUwzVUl6NjJ6M21a?= =?utf-8?B?N2RMa29MaStrYTNNNitibUV6bHNNTHhmNTdXdjMwR2s2dU9wUXRHR0drWGQz?= =?utf-8?B?bkhCYXhhOXR4NEhudFFkbUNvelVobFhXbnAzZFZHWjVuV3dtUGZlVHdHbXBz?= =?utf-8?B?WndNQjNlS0FSQXpvaFFvU2RDbkVGWGJKNDRndGFUREJvWnZKU3d2MDRBK256?= =?utf-8?B?ek5mRytKVnlEalBWaURobVJkVzdpSmZRQnQ4cmlqam1abHJLbHlXS3dIbXdG?= =?utf-8?B?Yk5abnlzVVNsUU1nL0s3UUtaQnllREpWTStBYVJzWU1FSi82SzI3MktRbEtU?= =?utf-8?B?T2JFOTAzYUxMSzdkK1NlYmllRGdxdkw1WWlmVUlsTE1TVEZiL0NaMkFuQTNz?= =?utf-8?B?aklMejM0allRTkQ5WWpnbkhCbFpsNXlaUjVLV28xZldLTkpTZ3NxZlFjYlRN?= =?utf-8?B?QU4rOHVpMS9Kb3NZcTZuaTEvL01lV2JyZ1NzUVZLdHRWdzY1d0JxNlcyTTJF?= =?utf-8?B?WjRta1pNK3IzUVZCWXMvNUtzOVRyRitWZDE5ekdZakdQcVh1RVIvaS8rNnNn?= =?utf-8?B?Uk82SXZpYS8wWG5jenFocWxtWElKMHA4OWlPUGhCTk5RZ3hGODVYbks2elpt?= =?utf-8?B?eDVoaVR5RDRKRUI4R1BudjRwM2JQWENCSlVFaUdVZFV2VU9jOTZnc3RFMGZF?= =?utf-8?B?NWxJd0YrWHVjZzlZM3NJdzBlUnRhejdzZ293OFdEbHNjYTFSdVVQczl0cFlC?= =?utf-8?B?YjFlc3YrODRqOFpNSG9ubnFUeHR6Z2NERDYxZll2ZFZiOFJzYTNBZTRKR0Jl?= =?utf-8?B?VStjQ0ttbEtYYzdsdHJmMXBvUHVVK1MzNWE2N1ZIa0RaalVFS0t1NnVrQVFq?= =?utf-8?B?SmtoSHpTSzdzQzRSQ25MUGlqeFJvYWNrcGhleTNOTjcwOXVVQ2doMFRLTmRW?= =?utf-8?B?Wm13eWYwK20xTEl0Rk5YREw3RFBTRUU2dDhLNEUwZzVsbG42VTMvRG9Yb0Ri?= =?utf-8?B?amVnRGZkMmRoNFlyVG41ampZK0QyM1Bxd1U5d3JvUFVwazVGUDVhOTdnUXBH?= =?utf-8?B?WUdFSHFEZHU3b09SMXR6WkFKMnZHVngrcG1iREhhMTF6aDVlM3FhYnpmeFpy?= =?utf-8?B?MWVsem9raTJLdWZVOHhLcFY0OVZ0T3BWZWNYRnNsMGdjNWV6c0gzNlNIUnlO?= =?utf-8?B?eVd5NktCcU51RkpLdXpkNW1MamlXa0hEbmFXNmk2b2Z5elBtSitsZWp5elFV?= =?utf-8?B?YmdPQkpFQ2FKcHdWVVNzZ1EzeGxndERaTnlmWlQ5VDI4cCszOWRqbFYzUFlN?= =?utf-8?B?cUx5K25JUHIzNVNIZWR4V1dUaUtpQWM4U0VZSG4xTmlMQmd1TzVhQVlNem9J?= =?utf-8?B?SmtHSSsrU041alN1NmZLSUZrd2Z1ZHBmeGMrTkhuT2ZZdFRFVnVrMHd6UVpp?= =?utf-8?B?aDNOSUg5MVcvdEJSOFJHdEs1NG1zTFdORUs3aEFZc3lobWdKWHpOcVdWVWJB?= =?utf-8?B?aHBpWXdBVnlkdlBrU2liRmVMMHgySlpGVG5zSlhtRXFsdjhGMVcrSDZZZ1F6?= =?utf-8?B?R3VTQzN6Z0JJYlVUNzlXOW9Ja1pIY25STkwyRWtaU3VHZXBCS1NaeHZjeW5a?= =?utf-8?B?TDRBby9icHAxQnJKL0JEMko3RWw2KzVpSmlsZCtIUVBDb1gzT0xIdDludTJt?= =?utf-8?B?Mm9kdDhiYXk0UjZMNDlxRzVneWdJZ0xoL2R4S3dIeE0vaWFiM0R0TkZkYXFZ?= =?utf-8?B?ZFUzaUZ4ckZ4VmVkdkwxNWlWRlNjTnBaVnJObVI4T1lKZUo5aEdyZWFmcFR5?= =?utf-8?B?b0MxLzhiZ3J4cndtbm00SUpwRDA2eHJHcHkrQ0xzNjRMaGNHcThLZmlKRlBo?= =?utf-8?Q?v1By+3iDKTUFz85Q=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: d68bbb04-7c47-4a0f-e33b-08df39b268cf X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2026 13:57:33.6815 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: rBWg3rc0FKyJrUv/6N5Df6awqd7lL841DP03a/eyKd1F3e0U8Dz5n2W/KRoOkymMZF/eshAV1tpi7ahK0QTNCjeIhmtGMKTplFBJpCzgBjo= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB7423 Since commit 7ed0919119b0 ("migration: close kvm after cpr") a source QEMU that has handed its VFIO devices over via cpr-transfer (or cpr-exec) calls kvm_close() once the migration completes, so that the destination can register its irq bypass consumers. kvm_close() closes the VM and vCPU descriptors and sets kvm_state to NULL, but the source process keeps living with all its device models intact until the management layer terminates it. Nothing prevents those device models from raising interrupts in the meantime, and the regular exit path even guarantees one: net_cleanup() deletes the netdev behind an emulated virtio-net, the NIC sees the link go down and calls virtio_notify_config(), MSI-X delivers through the in-kernel APIC, and kvm_irqchip_send_msi() dereferences the NULL kvm_state: #0 kvm_vm_ioctl (s=0x0, type=KVM_SIGNAL_MSI) accel/kvm/kvm-all.c #1 kvm_irqchip_send_msi (s=0x0) #2 kvm_send_msi hw/i386/kvm/apic.c #3 kvm_apic_mem_write ... #9 pci_msi_trigger #11 msix_notify #12 virtio_pci_notify #14 virtio_notify_config #15 virtio_net_set_link_status #16 qemu_del_net_client #17 net_cleanup #18 qemu_cleanup Every retired cpr-transfer source with a VFIO device thus dies with SIGSEGV on SIGTERM/quit and leaves a core dump behind. Without a VFIO device kvm_close() never runs and the same exit is harmless. Make the ioctl wrappers honour the closed state instead of assuming a live KVMState: keep kvm_state allocated, with its closed descriptors as the mark, and let kvm_ioctl(), kvm_vm_ioctl() and kvm_vcpu_ioctl() return 0 once kvm_close() has been called, so any late interrupt or query on the retired source is a no-op. Returning an error instead would still kill it: kvm_set_irq() aborts and kvm_irqchip_commit_routes() asserts on any failure, and the ioeventfd callers abort on a stale errno. Fixes: 7ed0919119b0 ("migration: close kvm after cpr") Signed-off-by: Andrey Drobyshev --- accel/kvm/kvm-all.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index a39c1ba260a..8b5d342af52 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -644,7 +644,6 @@ void kvm_close(void) close(kvm_state->fd); kvm_state->fd = -1; } - kvm_state = NULL; } /* @@ -3371,6 +3370,11 @@ int kvm_ioctl(KVMState *s, unsigned long type, ...) arg = va_arg(ap, void *); va_end(ap); + /* kvm_close() has been called: there is no KVM to talk to any more */ + if (s->fd == -1) { + return 0; + } + trace_kvm_ioctl(type, arg); ret = ioctl(s->fd, type, arg); if (ret == -1) { @@ -3389,6 +3393,11 @@ int kvm_vm_ioctl(KVMState *s, unsigned long type, ...) arg = va_arg(ap, void *); va_end(ap); + /* kvm_close() has been called: there is no VM to talk to any more */ + if (s->vmfd == -1) { + return 0; + } + trace_kvm_vm_ioctl(type, arg); accel_ioctl_begin(); ret = ioctl(s->vmfd, type, arg); @@ -3409,6 +3418,11 @@ int kvm_vcpu_ioctl(CPUState *cpu, unsigned long type, ...) arg = va_arg(ap, void *); va_end(ap); + /* kvm_close() has been called: the vCPU fds are gone */ + if (cpu->kvm_fd == -1) { + return 0; + } + trace_kvm_vcpu_ioctl(cpu->cpu_index, type, arg); accel_cpu_ioctl_begin(cpu); ret = ioctl(cpu->kvm_fd, type, arg); -- 2.47.1