A CPR target that has taken the device ownership in post_load() doesn't always reach vhost_dev_cleanup(): a target which has loaded the state but hasn't been started yet, e.g. one started with -S, may be quit normally, with the source being resumed instead. Devices aren't unrealized on quit, so the ownership stays with the dead process. The source still holds the FD, so the kernel never releases the device, and the source can't take it back after being resumed -> SET_OWNER fails with EBUSY.
Add an exit notifier to each vhost_dev, registered for its lifetime, that releases the ownership if still held. This covers every orderly exit. A target killed with SIGKILL or crashing still leaves the device unrecoverable. Reported-by: Akihiko Odaki <[email protected]> Signed-off-by: Andrey Drobyshev <[email protected]> --- hw/virtio/vhost.c | 22 ++++++++++++++++++++++ include/hw/virtio/vhost.h | 2 ++ 2 files changed, 24 insertions(+) diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c index 86e9a234638..35eaafa0f92 100644 --- a/hw/virtio/vhost.c +++ b/hw/virtio/vhost.c @@ -31,6 +31,7 @@ #include "system/dma.h" #include "system/memory.h" #include "system/ramblock.h" +#include "system/system.h" #include "trace.h" /* enabled until disconnected backend stabilizes */ @@ -70,6 +71,21 @@ static void vhost_incoming_failure_notify(Notifier *notifier, void *data) } } +/* + * Release the ownership of the vhost devices still held at exit(), so that + * another process sharing the backend FDs (e.g. the CPR source) can take + * them over. + */ +static void vhost_exit_notify(Notifier *notifier, void *data) +{ + struct vhost_dev *hdev = container_of(notifier, struct vhost_dev, + exit_notifier); + + if (hdev->owner) { + vhost_dev_reset_owner(hdev); + } +} + unsigned int vhost_get_max_memslots(void) { unsigned int max = UINT_MAX; @@ -1840,6 +1856,8 @@ int vhost_dev_init(struct vhost_dev *hdev, void *opaque, hdev->log_enabled = false; hdev->started = false; memory_listener_register(&hdev->memory_listener, &address_space_memory); + hdev->exit_notifier.notify = vhost_exit_notify; + qemu_add_exit_notifier(&hdev->exit_notifier); hdev->incoming_failure_notifier.notify = vhost_incoming_failure_notify; migration_incoming_add_failure_notifier(&hdev->incoming_failure_notifier); QLIST_INSERT_HEAD(&vhost_devices, hdev, entry); @@ -1891,6 +1909,10 @@ void vhost_dev_cleanup(struct vhost_dev *hdev) memory_listener_unregister(&hdev->memory_listener); QLIST_REMOVE(hdev, entry); } + if (hdev->exit_notifier.notify) { + qemu_remove_exit_notifier(&hdev->exit_notifier); + hdev->exit_notifier.notify = NULL; + } if (hdev->incoming_failure_notifier.notify) { migration_incoming_remove_failure_notifier( &hdev->incoming_failure_notifier); diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h index 6df012859a6..3f2b0635753 100644 --- a/include/hw/virtio/vhost.h +++ b/include/hw/virtio/vhost.h @@ -117,6 +117,8 @@ struct vhost_dev { * Updated only by vhost_dev_set_owner()/vhost_dev_reset_owner() */ bool owner; + /* @exit_notifier: releases the ownership at exit, vhost_exit_notify() */ + Notifier exit_notifier; /* * @incoming_failure_notifier: releases the ownership when an incoming * migration fails, vhost_incoming_failure_notify() -- 2.47.1
