From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <010701a15a3caa66-c90ce4d3-485b-4681-9b81-c761777b4e14-000000@eu-central-1.amazonses.com> Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022085.outbound.protection.outlook.com [52.101.66.85]) by lore.virtuozzo.com (Postfix) with ESMTPS id A8A72802A5 for ; Tue, 20 Oct 2026 16:54:51 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=tfowXSMxK3wwN+icaABsiFIo+UAq7dzTs/L4nnKyyZw2OdmrpPwjsWI/5qryrFufKFbf/Q3j5OA/32kJj+LorddfOSviWUr3MEe/pUxaN95hICASgoNKuzikSRRcG2Ot6h4j1yyNfeKFu/rAMbYSKPeMut8cwKwMReKPU5pZdt6ggYeSgmT1eD5LKP4Gio6t4ZTs+hFKTFGvJBchIK4+CvyAmMYkXsrCLG9Rjj4WjQ+cXKnALqeDrkPK/cl/9ypxjIc7Zz0fjzfwVw0RxKznCtF00eqmuVUKzE6eqDayHstpC6YimxSwZLg1d8wFD9T+K/NN+PLydlkwknFFjCDhcg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=28J95L8dd8qdUAcugsOdaHp/Bi0w8EI8wusLR+ivVKo=; b=bDwuoBmgViY+xIa7BVCLDcKGzpBWJ9uCPYNcuSst0HXYmcKTZSoEjcv+NL/UZ3wGf3hxTHurdYmFN1GYxzIQrT1smNOJ2h2RlLllZLCbLiRcaKg84sOWSinS1uWIPtTxoc1zxSMsBE1aegl26tPeOWTIwr0TP1OgmdMvSVVO9PMTrt1vTS10TQKsr8alhQKKAzC2vkBcE1f7n7wxjFV3jS8BGnfQImdV3WtbNa44tzjeSWAHTvJwO/Gz/BSLyEowQdltsKd4ZDIG4tuuIdwZ4nIwyAxg5ZrlMYjxGQQiUYsgK8V/M1zlz1iKM4shcFPgu7lg/MEwjRsingovT/lltg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.6) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=28J95L8dd8qdUAcugsOdaHp/Bi0w8EI8wusLR+ivVKo=; b=g9wyMtmbxsGqcz46lrwCsgH6rbLNbv8kMPKoH+jqtFnqp8qK12EbSw5mfCdlR+gYXLsTxniyte/l6wjR5xME9y07cGDmv1bqWqH5izTmLGTtRpYbMNIbT98oDLJM/LvPf34G4MK2RYcZ/op3sVsmr9rQA1esbypjR1BYqU5FOog= Received: from MA3P292CA0066.ESPP292.PROD.OUTLOOK.COM (2603:10a6:250:49::11) by AS8PR08MB7862.eurprd08.prod.outlook.com (2603:10a6:20b:52a::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Tue, 20 Oct 2026 16:54:48 +0000 Received: from MAD0EPF000008C5.eurprd05.prod.outlook.com (2603:10a6:250:49:cafe::7b) by MA3P292CA0066.outlook.office365.com (2603:10a6:250:49::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.522.20 via Frontend Transport; Tue, 20 Oct 2026 16:54:48 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.6) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.6 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.6; helo=b224-6.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-6.smtp-out.eu-central-1.amazonses.com (69.169.224.6) by MAD0EPF000008C5.mail.protection.outlook.com (10.167.241.201) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.15 via Frontend Transport; Tue, 20 Oct 2026 16:54:48 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1792515287; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=Lpjn3a1XGzAxA8SZAdpogWrYEZg6BAHbEc6ZJR30lGM=; b=SUlNUdMTWG4J+I57Q90ez2GmVEJqSzwV1tCmyXMxJ2xfbnTQgXWdnbifYYMP4KuM JZNKTgYhNOBFdedGwLax4LLmNke3E7+xZnhpAR7ejk6zniJ+YPabQHHeyHCZheegkr1 LX++fQKB7NQXLC/bujk3rlirpa2ju3IHXeyEzhE5KUjTLeTVor4iAjQlogUpgMTuzrW 46QS0/Elsd/Yf5Ye0tX0SexJ8TgblrKRL7lh+SVoedjJNh8XXcTDatsTaQ7G2osGKGQ /KKTdkRHFix5qlc7YU0gNPTZUptoq40mH5Ww+mYyqCQqp6QevbhO3arul5hz8C9jSQr gHNCyrgvKA== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1792515287; h=Message-ID:From:Subject:To:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=Lpjn3a1XGzAxA8SZAdpogWrYEZg6BAHbEc6ZJR30lGM=; b=AgTtdgK5SHmZOiMXwHa2I97j8D6eQmdvhYs+NRCb/05qOmYCmcthEBUlxW7HDlOc W5l756bu/9B4RPPom6n3Y98Q+XpUHvabkK4jvWOzvqQ1vqPBNSccEl2hpPB5yPYVahk /jvg5iA3563/DcNgcQLeV0zj1N2vmIklIsNEYzx0= Message-ID: <010701a15a3caa66-c90ce4d3-485b-4681-9b81-c761777b4e14-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH QEMU HCI-8.1 v4 21/31] kvm: fix coalesced MMIO flush racing with kvm_close() To: svt-core@virtuozzo.com, Andrey Drobyshev In-Reply-To: <20261020-vfio_v1-v4-21-83a5668230e5@virtuozzo.com> References: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> <20261020-vfio_v1-v4-21-83a5668230e5@virtuozzo.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 20 Oct 2026 16:54:47 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.20-69.169.224.6 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MAD0EPF000008C5:EE_|AS8PR08MB7862:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 24256d9a-dda1-417b-a947-08df2ecad9d5 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|704161411799003|376014|48200799018|61400799027|9140799003|32142699015|5063699009|56012099006|4143699003|261009223027099003|10067099003|18002099003|22082099003|16102099003|55112099003|5113699003|4113699003|13003099007; X-Microsoft-Antispam-Message-Info: rOwJIfXrskr10PKJmmmrGkHJLdUbJkPZBlHTPOSn3HWYxJKYRuje61JhMQ+Dd1oBYr6UrAtCZDXMdTAEs1NIqxTBEqxEuX+SSskiPVn0K2kdkEeod89e4uPuKRbzVkr2Bj+G72dt+8vNz9PBuW71zrd972i/QgiO+onMyIHwHk4RQ1AaUbEEnS0hpGS1p8HCrBKTVPaHvzbpKISRhmyXd7ANUVU3Lf3aQpVtfZa8d1ffQV2AzXrCbx0tRyAfgqgjRso1dvPoriDHB44TOYgLphkwMnLyFvKCwj8ORie9C/ThBOTW+jB5aObXaAro8mGuYkr3Fed4Z8fCPqY/IDFy+j0tuRwcIQzAa4TauAyxa1RqlHtLuFIVr0hCc1cDnEdmwg1nbLjbHdGhLVrmLwYdMZRplcwVGEkkmE58N5mjz06+0Y5DmpbC9E9OYGndr3tnVO40JO8KlMBWdmF3AcDXTH1ANpwLLKitSDhpJtTNdFdwh/A2Q9oSY8ASABZFtxCx7L3nlFud5AEbm7bdTuQAzlstcncNUUbOT4ATFm5Jh/zZusU2aJdTG9v3V4fpz8uzQbbY3rZoJbh47ep5xbAsWUciT19uWIdNsmf99ak42I3vUjctMjgzvvX2/3d4vu6iS7adUI46f1LPIs+Yixd9vu90+KhSkv9GQiexVO0OxkFthVOkloHPWGATjKrSkIPwu5D2Z3Z/tdkb0+Nl5bNjTVl6oK4xoDXfJMftcL0s3OtjDCCODc80p7sXC/iI1cLHYFH78mhaOaN7hiv6rbZat4TxiGrcs2FRBMa9rAFRrY2zBullV2iYwVGSJ8URnrb6ILb1qZnQRyMCGiMvZIMfnjLBmjIJX64wnl+oBRyD8NY529pd/mxPoXKXtOm4LfkJ X-Forefront-Antispam-Report: CIP:69.169.224.6;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-6.smtp-out.eu-central-1.amazonses.com;PTR:b224-6.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(704161411799003)(376014)(48200799018)(61400799027)(9140799003)(32142699015)(5063699009)(56012099006)(4143699003)(261009223027099003)(10067099003)(18002099003)(22082099003)(16102099003)(55112099003)(5113699003)(4113699003)(13003099007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: zi1wjOORfIU5qmqysKK/d2uvfBQmc3EER1BtyNqCSo9oXq2Lh12YsQbydIj5n+3flI9fpfzjTnUOXyCBqChzwM0UrssVeVoq8G6au7mBVvj3aYzQg6dKGCmLHkgEur3uDoQWsRdkhgx3kmuMRMyhq6b2er+/HMtTrRcthMJNaEV0xuql4MsaV5OOv31PhaZ4/Rk2ZqLG4wW80evhu9ZHJJzFY7ngTaHvpxFg1YlOrRyOTMM/IGZrBwdQToJpTcbovhI0uLL63rSmtGcTMS38XEWDMeihIA7DCVQa/vK2OQeQHJwXvlqWXwyl10SEv0z3Kcx1z2+2KZX4R+w+enjuUn7ztuZVPQHjcQD5WtY0y31xV5Ei4s1Cgdymbt1iv6L7A1qlwkZACXSYzLU5gED5MV0cEOJyTH8MQP+x6x5l7Os2kP6a10D3f5tLCvCl6JFQ X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Oct 2026 16:54:48.1842 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 24256d9a-dda1-417b-a947-08df2ecad9d5 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: MAD0EPF000008C5.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB7862 Thank you for your contribution! Sashiko AI review found 1 potential issue(= s) to consider: - [Low] kvm: coalesced_mmio_ring cleared with plain store, read twice witho= ut READ_ONCE -- commit 3b43e13d8cef028cfae52bf9fd0d5ec297cf51f8 Author: Andrey Drobyshev kvm: fix coalesced MMIO flush racing with kvm_close() This patch clears kvm_state->coalesced_mmio_ring and calls drain_call_rcu()= at the start of kvm_close(). The aim is to stop the RCU thread from flushi= ng the coalesced MMIO ring after cpu_remove_sync() has unmapped it. > diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c > --- a/accel/kvm/kvm-all.c > +++ b/accel/kvm/kvm-all.c [ ... ] > @@ -630,6 +630,14 @@ void kvm_close(void) > return; > } > =20 > + /* > + * Destroying vCPUs unmaps the coalesced MMIO ring, while the RCU th= read > + * may be flushing it from a memory region finalizer. Stop new flus= hes > + * and wait for the pending RCU callbacks first. > + */ > + kvm_state->coalesced_mmio_ring =3D NULL; [Severity: Low] Is this plain store safe against the lockless reader in the RCU thread? The= reader, kvm_flush_coalesced_mmio_buffer(), loads the same pointer twice wi= th plain loads: if (s->coalesced_mmio_ring) { struct kvm_coalesced_mmio_ring *ring =3D s->coalesced_mmio_ring; while (ring->first !=3D ring->last) { The RCU thread runs flatview_destroy() -> memory_region_finalize() -> memor= y_region_transaction_begin() -> kvm_flush_coalesced_mmio_buffer() with no l= ock shared with kvm_close(). If the NULL store lands between the check and the reload, or if the compile= r reloads the field, ring becomes NULL and ring->first faults. That is the = same SIGSEGV this patch is meant to fix. In practice no call or barrier sits between the two loads, so the compiler = will most likely merge them. That makes the window small, but it is still a= data race under the C memory model. Would it be better to use qatomic_set() here in kvm_close(), and a single q= atomic_read() into a local variable in kvm_flush_coalesced_mmio_buffer()? drain_call_rcu() below closes the larger window, where a flush is already p= ast the load. It queues its callback behind any in-flight flatview_destroy(= ), so that flush finishes before cpu_remove_sync() unmaps the ring. It does= not close the double-load window described above. > + drain_call_rcu(); > + > CPU_FOREACH(cpu) { > cpu_remove_sync(cpu); > close(cpu->kvm_fd); --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/20261020-vfio= _v1-v4-0-83a5668230e5@virtuozzo.com?part=3D21