From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazon11021072.outbound.protection.outlook.com [52.101.70.72]) by lore.virtuozzo.com (Postfix) with ESMTPS id 2C7A380726 for ; Fri, 9 Oct 2026 14:56:28 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Z6mu2uHSfVkWtzMNQ5RYM6YEc/RSFKhQKWjgA4+pBaPTulPnwU4nIeV1noz9QPIQkE2QHlIRHPgF1stWSieAgRq8DUaAcXYzXxeJ+dISIuJaC+GCKO7nhypS4jidSTi/lXbja9jV3CtFc9pSc0IEjvGyHcN734CuHm0kEA2j2e+p58sJ7O+uyC7DCzUNn75oQb0PV75uDZv+D16Am8PuMscoN8jpRtfUzkUCd+Yls9SzuMlrmC6/PXzRI+uDVzcsECLOr4iMOa/mTzEJhveJj598YSN4kJhPc7SkZ07QRRCYpIPlBGVcDFvA7Oil/OQqcwMI5zcynZn060wTUJPFCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=RqGmpP8aPhtTLxp5I5vyaeTDe0jqWWPJO/YulCZ/lZY=; b=AJv6X5vAGr4B5rLCZWLw4SqadrBeHuICrAdq97klRTiNyQcviMeOCENzq7c/BmuQq3jIpRWKtHGYC/xE2D0Okc1wKiZleD2SdppPOPK3kvRVr+N/s8NhscKZxa8nCHrP4qGCDix7KhdV6u2l51ZVkUF+wFEuJVlmT5G/tEj6foQtMuWj/iuEZPql4qB8i4uORJEt7gg8BHCP4//VzFbR9KeW+yC6WkNQvntFCglTtWKAr1aiOfylrEdX2JJa6tWctJ57tfqTNQOQI9woLeL9xgJ28HzoK2bHy9d0ss8BM/j6xR1d9+c+E/9MUx5OZF3mvQFxZ/VgXxkkqi9aWOE2Dw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RqGmpP8aPhtTLxp5I5vyaeTDe0jqWWPJO/YulCZ/lZY=; b=d+fE0Nfh+yfEX7KIQuzcBDhLZM0ihYwv+BqeWuGIW/qdd3OqYPBDAjMGYVPgu0wLBhlnKJGiAWpjJipBwe9oKBh5FwpkGsFo3ShZDBNChTyozKbqwgJ8wldyh02UdrgmpIV8hwiitFQDvK3ajNuLuRE63PJ90CuAnksI4gGbJYF+XS/IglmZPxDVL3P/ZzcZtTF/DgWLemzGJQl6oJhawVThLDMwtAUtieli5JaH5O4vCCnZc0YRBY7kIV6UbBkKwj3VsaDCwY6p+ryVjtY6q7djvN2Zc/cl+RQ62/MrQOmAYZYZXLr+iVDbI92b1R8647MNoW9YDEigLxeT8/xIxg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DB3PR08MB9110.eurprd08.prod.outlook.com (2603:10a6:10:428::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.17; Fri, 9 Oct 2026 14:56:25 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0496.010; Fri, 9 Oct 2026 14:56:25 +0000 From: Andrey Drobyshev Date: Fri, 09 Oct 2026 17:56:14 +0300 Subject: [PATCH QEMU HCI-8.1 15/21] kvm: fix coalesced MMIO flush racing with kvm_close() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261009-vfio_v1-v1-15-2ae91d5b8048@virtuozzo.com> References: <20261009-vfio_v1-v1-0-2ae91d5b8048@virtuozzo.com> In-Reply-To: <20261009-vfio_v1-v1-0-2ae91d5b8048@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIUP296CA0132.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34a::14) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DB3PR08MB9110:EE_ X-MS-Office365-Filtering-Correlation-Id: baead1a8-5ba1-4df1-78cf-08df2615754e X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|366016|1800799024|52116014|23010399003|56012099006|38350700014|5023799004|10067099003|22082099003|5113699003|18002099003; X-Microsoft-Antispam-Message-Info: WfgXIu8y03ttODTTJZDZAGDpITOnvQcukQDG9F6qrjsOcxgcq7l3uxLgmJUJT7cnjAGC2RovuoheBZfctfjYHOCsaNF0kcjOWgtkUqwmoudBfmdT6o5nyzgd1LBoaO7OihJJWDiFj/SJ1TNaBG5QJG11avL3BxHoP7PKLMu5gFCURMm6132h995KEAbyiBk29Pv5kyD42Ginap+4WCBPdqrE5/+rzbvJE+uslVl0Q1i3qd/zM4nxpORHaYhPEg3ygJmkUM0iNqnbZd8ptfL5ojcRtH+yI3IIzGd+c1M61n40NhumNVcYAxnoiQON8Xx8XZ16SvmyIndN9sSaE9vncDoKd11kjFzSnjXjR7oe3GjvQ9ONoHKYw5Wz2DzZexrlO6iHprB3Swjnc3v/hkXz9XhQrbyQacw5Y35Lx+M0XK71SCxJw8PmHuwMyR5hNJ2m+CQWsv69pBxTvsR9nzxjVOD4SXCuALNL8Aw2xp1Li31I6m9L4SYFM9j7XdaHsmzDL8AOCX/ff6kCEPCWA2dRfZvwRivh76d2nG5DCM2YRQ8wyAm2Zy/EVdqO5pDGgOfgNGkQBB5OjcxPxk60z5ytsSV3i7MZ1sxpMB+Vjc+40a1J6WnZkAFUdI91fBwvRg5i8ptCxH4REl3jbvlPn2ovfBN6IIcjna0ipu8ux50wZOX9+J4huqifQIRb8/9/0wZSUmqumvMCkJBjXaMXAAb1FSb/F6TDxQyrcUb+2C2fujk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(52116014)(23010399003)(56012099006)(38350700014)(5023799004)(10067099003)(22082099003)(5113699003)(18002099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?QlFxZFBUTDh6dSs3R3ZQVUFBeU1CTHlWSzM5N1Y1NzlnVFd0MWd6dkRFeUdB?= =?utf-8?B?azE5NGdOL2VIQmdqQUhCUS84WVY1OHdyWUNyOXhQakd0Q0VvbFFhaWZMQVVr?= =?utf-8?B?NENYMmE5dENIWklSZ0RmNUVyMDkxaXBBUWFqYVpKdHNIaVZ1TXJ5ZldjaHhL?= =?utf-8?B?TXA5TDA2cnBWWnQ3cW1YQkdJU0I1WW5UdkE1VVNDUnYrRUFkSVBrVURIcE1O?= =?utf-8?B?dElDREZSRGM5aEM4WGxZUU1SNDZBa1V4V2trOGVGbUVybmlDS2tLMmlVZDgy?= =?utf-8?B?ek5WZ09COW45RW5TNTJNL3Jra2NxSzhjelpXVzY5UVp6RVFkRlJXSENkZzhW?= =?utf-8?B?ckRHOXdUVVEwLy8wUWVaRndwZFlOQU1PQXpkMlVMMzNZenBUd1l6VkU1VGtE?= =?utf-8?B?R3ZnbTdGYnhLSkNucndRWVR6VUgwUHl5dGRVd0pQVWMzMmNDek5zYkRESHJv?= =?utf-8?B?L2JvN296b0dWT2taVG1uVUdjc2k1aU4xOWZBOFpJZjVWWmMxTkhwaEtDVkZ3?= =?utf-8?B?WU55Y2dYNGpjUHdpWHlMMDl6aHJiVjBoNnVjNWRUOFlUcXJXYkpYM2pmRkZG?= =?utf-8?B?MmVwY0JuUnBoSG14aEkzdWQ1SW8za21MNzVldEZDUjF5VWN2eEJub0hQOHZS?= =?utf-8?B?NkJNaGlRVXR1Tkd2MDBtdm9nUXNTU2pqaHZIckkzSTNpNFh3K1ZTSVlJMEtX?= =?utf-8?B?Zm5JV1dmdTAwanJGc29TK0ZOMk14N3VvQmRoOUFqYlBzOHQva2N5aVBBYVBz?= =?utf-8?B?MVUraTdSOUNrUFpoOVdYQUp5R0RadjAwajhpUjVGM0VnRExyaUZKWkpJZWFl?= =?utf-8?B?ZHpKVmx0Q1FqbFg0eHBDQmFCTEkvZEVqRHdVOE1LN3VUTE44S0FJWGxpV2gr?= =?utf-8?B?S0pJWElYdFRQQ1FrS09zWldQYkZ6Z1U0VzBhOUZEWTl5cVhLZUwwV3ZxamhZ?= =?utf-8?B?RXZJaGZteXVoWjZlbE5peG9Ram16VFljb2FiVlkzS0kydUkyMDlZUThZOG1a?= =?utf-8?B?UjR1THZTdmVwMFRua2djNWZBQ2NEZXd0aVFlR21xUE1sZlFjNVNSN1E1Y0Nh?= =?utf-8?B?cmZMcEtjeXpNN0pCV2QySk5hUVBJR2I3Yld2ZVVGOXRoeTVVU0RwcFo0QnJt?= =?utf-8?B?SStMUk1TR2pPMXZBYkJHYUpFYnhRR1g0VE5meGdjdkZoNHlNT1VzejRha25S?= =?utf-8?B?QzNBVzNLVXJORFBTWXZubGVtaVhCRmtLcUtKdDVYU0V6VzdMUWNlcHdhbXA0?= =?utf-8?B?NEo2RE9tUU0rL2pZU2Z5TkxIRXNyWmg5QVJuaEd2MDRjRXpVeDQ4dkhmUmhm?= =?utf-8?B?THZuRE1UbUc5YVdZbjUrS3pwOTYwUnVpbXdsSStrWmhVSTJ4R0JWS3B6UTNM?= =?utf-8?B?cU1jM1JGM3M1Q20yZm9WV3VmU2pYaEwvS3NGeU1pSGNzTy9ablNmalBmUm5N?= =?utf-8?B?MDlPNGFURUVROFF6UVVZdkgzUG5HcjIwTlh1RS9ZK3Q3YTVDQjVnQnBBN2hN?= =?utf-8?B?WWxWNm1HU2JYeVh2cHZBUEIxbFZKSjdnaGx5Z2E2NFpML2ViZEFMemZvaWZx?= =?utf-8?B?WENEajd0V0lUOHlqNHNQNCtLdXBCUlBmOU10VTRCR21XTFkwUWVBUFVLRDkr?= =?utf-8?B?dGlDTUc0Y0EvZ3RuT1REV25Oc2xMWE52dW1SVG1jTlNNdUVNVTRFQ3kzSGZT?= =?utf-8?B?d2QxUkRWNTR0NC82WCtra0hmN0RRb3hXOG5KRjR4QUZSVUo3WmhDVUdISTQr?= =?utf-8?B?R0hEdzNzd3dzWXBjUDViNmx3bnR5OStERFRoT0NwUWdQVzNQQXBnb3lJSGFK?= =?utf-8?B?N251ZVFadWx1VzhjbW0wb0ZEZkkxZjZQcU5CV2JiZXpXRlVCRG13NzZCbGth?= =?utf-8?B?U2FkYlJJZDRXQlN3dWpwalNVd01wOTNCV3Q5anZFRTZZM28zLzF1aEtZakZ0?= =?utf-8?B?d3pvTDRKU2RackQ4Q2NpeE1hRHdpdVlCczZjMStBYjJWV25PWkZlM20rb0pz?= =?utf-8?B?Z0FhbVQ0RjJibVFzc2k1My9MZGtKL3ltWVB6UGZCRUhTd3ZYQ29oc1ZTN05i?= =?utf-8?B?VGE5Q3BjMWp6Rks1Q3libWd5Mi9DNnFNWUFTbk41RzA4cFhQNjhoYUxRUjdz?= =?utf-8?B?M0oxUGFYOGJldXpLNkh5MlNCZEVDakxBZlFCRUlpWDloNnArRnlWa3F0Z0M4?= =?utf-8?B?dWVueEorQ0FZZEVKaStnVElHSllkeGhEeWVwRUpZTFVBY3BFN0pteW81SEV5?= =?utf-8?B?UHkyU3NQK1FXUjdKZGR2TDNCcWFoUEg1ZlNLcmNINlpMdXBoVFNOWnRiY2FP?= =?utf-8?B?bS9OMSswQTFadytqMDR2dGRUNlMwS0V0S0lsVWhlcTY3KzR3QWFoM3FNRVpF?= =?utf-8?Q?Lbda24dBamAVQGvo=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: baead1a8-5ba1-4df1-78cf-08df2615754e X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 09 Oct 2026 14:56:11.5209 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 3cGEhVnNicLGwnVHNovlbBVsIUkkXO29RC/9uCUVEPFuJ4omOnfCNInNhe96wYld8I3sCz6hACOF00Yz3AUgIZuQXcrgsvflYicBvQFRgXY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB3PR08MB9110 kvm_close() destroys the vCPUs, which unmaps their kvm_run areas, and the coalesced MMIO ring lives in the kvm_run area of the first vCPU. Nothing stops the RCU thread from flushing that ring at the same time: finalizing a memory region of a freed flatview calls memory_region_transaction_begin() and thus kvm_flush_coalesced_mmio_buffer(). kvm_state is still set at that point, so the flush reads the ring after it has been unmapped: #0 kvm_flush_coalesced_mmio_buffer accel/kvm/kvm-all.c #1 qemu_flush_coalesced_mmio_buffer #2 memory_region_transaction_begin #3 memory_region_finalize ... #10 flatview_destroy #11 call_rcu_thread while the main thread is in: kvm_close -> cpu_remove_sync vfio_kvm_device_close vfio_cpr_kvm_close_notifier (MIG_EVENT_PRECOPY_DONE) Seen as a SIGSEGV of the old QEMU during repeated cpr-exec of a VM with a VFIO device. Clear the ring pointer first, so that new flushes skip it, and wait for the pending RCU callbacks before destroying the vCPUs. Fixes: 7ed0919119b0 ("migration: close kvm after cpr") Signed-off-by: Andrey Drobyshev --- accel/kvm/kvm-all.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index ea027c37829..c29d467f9f5 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -630,6 +630,14 @@ void kvm_close(void) return; } + /* + * Destroying vCPUs unmaps the coalesced MMIO ring, while the RCU thread + * may be flushing it from a memory region finalizer. Stop new flushes + * and wait for the pending RCU callbacks first. + */ + kvm_state->coalesced_mmio_ring = NULL; + drain_call_rcu(); + CPU_FOREACH(cpu) { cpu_remove_sync(cpu); close(cpu->kvm_fd); -- 2.47.1