From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AM0PR83CU005.outbound.protection.outlook.com (mail-westeuropeazon11020124.outbound.protection.outlook.com [52.101.69.124]) by lore.virtuozzo.com (Postfix) with ESMTPS id 2F52080A97 for ; Tue, 13 Oct 2026 15:28:17 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=qctxSs5mlQcj2xts3p0fnR3WguvE+P5CZKLgHk2wQ0eqiLDKBTtvX4By/qbXGftAfgKjpkR4+ksXacTLYClYUgWV5W3t07iAeax/NC/rVMEUEesMvkAQ0Z/2XcahJ02bPEDSEUizaUiRbwxNtSJwL0tvhWnGPcz2fcDe0OC0LsNlXA68NW7ZeiPMxycNseq0Fv7HKI9K0vzE6GWcqo1qeUSLpS42Yh+V3U54AjZezDPc6HihNcX04MKBGMPxec5WHG6+QCs5m9uTy/Bv4fnchOY4CYUjPr0UlfT8D6mRl4aWOhDFZcoWYH1Y7ZCaR0MZwC/CCnbJdzHdAsqG2UK8Rg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=RqGmpP8aPhtTLxp5I5vyaeTDe0jqWWPJO/YulCZ/lZY=; b=f37A/smujqH7hcso1AWG5ddCSsupl/jlHts/NTAWBeLf50t5BsdRmPGFPiMD6Jf9JK1H9xjPn7aek0VDVGpyfPIBsnGaJk1fyMoipy1BEjXaSd4E6CZTUFDS5MTWlsqDBh367l9beans2mO4TcmY2xUuWF/qwJHrvm3GZaHNKN/pbOSDWO4OCosc0bNPRSUwQ7Ja06jkScXIual+ZT0sECQ/s/Tt2KJatlxqO+puLePtX3kqoggNlW1ygw9fmwDQLYvOlvcoX/0NtHeQsuMnIIbpaCXHLr8QJzWB2MWPIW8M4vucfYDLFLCcU4svtfi7waiwGvhJREijAU4JLtmp+Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RqGmpP8aPhtTLxp5I5vyaeTDe0jqWWPJO/YulCZ/lZY=; b=r7DS4ibGFybhAEEoNCQCfcLE99ltYNQefxwKcARZ1nP3830Y/SpD59GgoP4JDw2UQeVFpFo67FfXBeXiDMo9SNN5f37eTI79K64KAOdZXysvT5K9KPNNPtfCM0eoPjQltpkgEjkB4EZL+Lgmi/i8VXh7Gtrcy/eVEXDBcwL2g8QUdRSRnZh3Vhpb2G7KDgxK4gFrussygLGdg3aKbGxfBsNSFqOV0TwXxBWdVMCCGBOl7+ZgvEVLibu551Ich7Df3UkiRDuJuIRwqd6ZgtW4qHQn4cuDhFaMxt7GUfVziROHbvn8fS0MCfH4sw7EbDhiUvqvMyTv6bmC4USd57srXg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by WA4PR08MB366192.eurprd08.prod.outlook.com (2603:10a6:1d0:30::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.522.12; Tue, 13 Oct 2026 15:28:16 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0522.008; Tue, 13 Oct 2026 15:28:16 +0000 From: Andrey Drobyshev Date: Tue, 13 Oct 2026 18:28:20 +0300 Subject: [PATCH QEMU HCI-8.1 v2 16/24] kvm: fix coalesced MMIO flush racing with kvm_close() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261013-vfio_v1-v2-16-433455c0a294@virtuozzo.com> References: <20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com> In-Reply-To: <20261013-vfio_v1-v2-0-433455c0a294@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI5PEPF00000939.AUTP296.PROD.OUTLOOK.COM (2603:10a6:808:1::833) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|WA4PR08MB366192:EE_ X-MS-Office365-Filtering-Correlation-Id: e88cf187-ec11-48ba-2046-08df293e9982 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|1800799024|366016|52116014|5113699003|18002099003|22082099003|10067099003|5023799004|261009223027099003|56012099006|38350700014; X-Microsoft-Antispam-Message-Info: VT6p1jQYplsaigk2ifQ42WTXyrobUGaRxHXaz1BDYqOpnkHGQmy/REFpa3jIBiT57nvg5BzOtOaHjqcuNDhzQzHwZvemuEcnuOd7onKgVs03HI18eb86+UPziYfduLl+oGZlw+YxCPflPsDFPYE+imNLY/8vOarII+HYPpFXO3O4HvYI8zjhPdX5/s7+MtL1i5mgsWdYe05XjujC6po8AuFdM1Na6Mw1KG4Py+xpwPySzG4SGG0xvOqgezX/j4rMA9PsQinl+PggDC8SG01/PBjP3q4zZCOyM1fbse0xbUKIijFdxnMUmS0HdN7QeNVia0ktYj/7O0vlxOMyO+7nJVKK6AcK1hU8H0laFKEHwjlBfpQAFIp9RR2jSMNDIw7uU+Mol0Hh5xLANWg9lukdRsC/clZokMpA6M1YrjzhVD1esXNuxE3H3C5VEQgCbiAQk7HWJNG7i1uksMDXHQy5UgvsLtlnrjVVrxQsfA9mA6a0n4NoSZmPWP/Xx7LQqzPCm+xtP2plswmcKLLAU/i4d12II9auaZ/gDsKNa6dlVC3b/rYhmEVppa2f5QYKKlmKsdHci3ddzSBz0w0FKlVv857b32OyNpQOlxkw+H4C9+26xzkR0xpb0mZ6JfOL2ZeRfVvdDI7xYi9F7Sy3EcvBM9xZkAJaKIpSdKcPgXNBG761GGG1cZmfTBY3/Z0OVHg6ODbCLB9LnXH0q0/D6HXiJvHp6a+AWbsSt+rfBTYxwV0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(1800799024)(366016)(52116014)(5113699003)(18002099003)(22082099003)(10067099003)(5023799004)(261009223027099003)(56012099006)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?WDRwcmVmeldhYzkyR1hDLy9qaTQwcVVEdkRXVGNLL0RLTXh3aEpFT01iZmZZ?= =?utf-8?B?dVYzZVRwdDFoY1E1bnF5a0x5bXIrbmJwSzU4d2dqK3UybUNmUnZqLzd0QjNy?= =?utf-8?B?RWcvZkpJNTFSanZzUlVUZHZ0MTJ1LzlaUldka2hsbWRlRUd6WVdPbGwxOFRt?= =?utf-8?B?eDhJR09qQ1E3SExCMU42eHhHb0JhWmtiMkhSa3BVL0pZK3phK3o3MGpNUy9R?= =?utf-8?B?UWRvdlArQWN3dG56QWl6NWRkK214RjZPbE5lelk0Wis3bkVVYXkzdXdrMCto?= =?utf-8?B?aW5UQ0JiaVQ3MjJzS0dIQTRCL1FrYjQ0Szh3RmpQMDQvTHgxSVhvdXc2L0Zp?= =?utf-8?B?dkk2MGh2M3E3Y3BtOTJ0ZkUyN0crWUFOK3B4Y2NJampVeWpQUFBYQlgySURu?= =?utf-8?B?Q2JOQm1MOUowWlMwY1hyZm1HWXptT0g5Sm1sR0VLaXNFQW5IVGdRTjY2c2Ji?= =?utf-8?B?SjFSbEFLRDM5bnNTaktlU2UwKzFEdWtZOVpOWjVhRnBVREVvbUhMSzFXWUE5?= =?utf-8?B?NjFGZmdHdGZrTmtTY0RVaHNnWXFWc252RTNlQnBQaWJONEhFZVcwNXY0MnMr?= =?utf-8?B?c05sQlhzYlE4RGZheFRyd1RScXJIdkk4Nkk2QzRQRkZlUnhBVG8rMlY5NHB1?= =?utf-8?B?NmcxWTVEaDl2MElCd0Q0Y05GWVlvcDU0SmRjWnN2WXZvUm94YlpnK3c4MldY?= =?utf-8?B?MWF1TUJGWjRGVzB3QzlBeEpNQk5HOVlWeDloRk5IZ05xY1NZeXRRVzJqdTZk?= =?utf-8?B?YTEyQWRBYlFYM0g1WUhrWWdhNlpnd29yRTNvTjR6RzlRbFNtWDJWT1ljaGsy?= =?utf-8?B?ZTZUcnZEamgrZCthMGZTUlJ5OVEwUzlEeUlQQkRNU0J1UHdWUXFQQWwxdXNh?= =?utf-8?B?aS83Y1JmdFRNRVZ4MUZCQnJPNEtaVGhGZVlWcmFaQlpvTXoyUWVZRHBTNE5o?= =?utf-8?B?NVVHR0swVnJlb00rV3BmdEt3ZVNjbFJNRE94RU42RUY2dWJMRURzOCt6bGpP?= =?utf-8?B?WHdtU01kUllXRFVOTnJyTlpPS2k3bHRZbFRMZVA0TFh5VzkvdmlGK3UzRnli?= =?utf-8?B?WForNVEvbnlzdzJBUDdIbEI3RlpNWUdNeGIwSW5oTE56NjAvYmI0OUgramdX?= =?utf-8?B?c3RzMDdaNWUwcC9KZHFRYWJuWTZGNU5DakZPb28yZ1AxS0F4M21iRkdNdEZn?= =?utf-8?B?bkZ2cjZmQkVQT24ySUlvNlRpYkdwOVV2VWFaaHpRa3FlUkJhMjVtWFlJRmxP?= =?utf-8?B?b1lCMFFkUjlSMVFMaFlGb2QwWjFXamU3cWpjYm9xcVBMQld3MUVRaG1FR0FS?= =?utf-8?B?ZmNLdUlxdG1xZWZ4RktiVFF3cEQwRlFKKzBoRTVOejJHYnVyOGd1QXdwNi9G?= =?utf-8?B?ZHRZY3dLZFRVT0JSOCtSdzREMVNXMU1NU1RQbnFmSGZ1S3NuQy9UdTQ4M3Mw?= =?utf-8?B?aXp2cTdBNFhEcW9tZ1B2a3dqdlhHc2YwTW1zbW5XT3VWSnBXVWNxaHVCbUNi?= =?utf-8?B?a0Q2Z0ZqRkNrdVpHeHpzYzgyT2RPYlRFU0ZkTjZEQmtzMVFSQkFyQVNHd3Zm?= =?utf-8?B?eTcxbGJiU0ZBU3dDZExJVkpoNE5xOWtsMUt1MitOTDlURmMyR1F4MU8rbTNC?= =?utf-8?B?MFBqQTFtc3MvbmVZNElsTWVtZ0d3YVhYZlR3aUkrUGtRbkFHSmZXVS9vVXhX?= =?utf-8?B?S2pBYnh4cWsvUE9zNm0xT2RVQkVBUXRNMVpkdUlWMXlWWjd5dTF6cEhmSzZt?= =?utf-8?B?b29pZjkxcEhNZkk3SkVIU2ROSTdIM3NUYVZjNDlocnU2a2RCNWNlZWd2OVgx?= =?utf-8?B?L3NrZnJSaUpjdlkvTmhKOVVTbnlWbVNKSzRPM3VSL3h5Yi9vb2IwSk9TRlU1?= =?utf-8?B?SFFYcVhiUWNLSUlXWHdWdFZuTW9MbFdEVE9FY3NiRTMvWjZFS2N6TUZybUZD?= =?utf-8?B?bCtWbmhvM0JObUVGOGY5TFg2bHp6K05xQUR5emhYUjdybFFhN0RzTFhmekxF?= =?utf-8?B?ejZqeGEvQVRHakRuVkpGd2lxdVhlOHljNklmdDM4dHpmZFFmSitHNDdsY015?= =?utf-8?B?a1NNNDlUQmw3TE45QUxoaVNjU1BMdzUyTFRPOHl0TGdHd1B4R1ZvTzlZeDc4?= =?utf-8?B?bXBSN2t4czBoMmFaSy85ZEtLWmR4T3ZncEQvVVdkdHpUTjdwTDFJaU5BQ2RL?= =?utf-8?B?NUhEY2xCZW5DRU04SFFWNEZiMGRXaHlvUXhRTG9RYVBZdGtPVi9xdUh1Tllw?= =?utf-8?B?SVVIR2gxb0JpME4yWDViYnRxcFJVaDJRWHNjdDhyMHFOV3VQdGNiUFYwTDRJ?= =?utf-8?B?bWRXZXlueVBOalRBelVndGVraVlsR01HUDFab3FxUWlLS1plUnZlOHhUdTlD?= =?utf-8?Q?hPnpRAYwDUYDe6zI=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: e88cf187-ec11-48ba-2046-08df293e9982 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Oct 2026 15:28:15.0946 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: fo1LpmPbUDVD9tbX7ScujfYRqgO76jTh1bTiSVRD/NHakx2XL5ylwh3D6OYmqUHd9hM7ka9qfyLANd7OJperogD5ATyXtGp/t9f4TwS79Qk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: WA4PR08MB366192 kvm_close() destroys the vCPUs, which unmaps their kvm_run areas, and the coalesced MMIO ring lives in the kvm_run area of the first vCPU. Nothing stops the RCU thread from flushing that ring at the same time: finalizing a memory region of a freed flatview calls memory_region_transaction_begin() and thus kvm_flush_coalesced_mmio_buffer(). kvm_state is still set at that point, so the flush reads the ring after it has been unmapped: #0 kvm_flush_coalesced_mmio_buffer accel/kvm/kvm-all.c #1 qemu_flush_coalesced_mmio_buffer #2 memory_region_transaction_begin #3 memory_region_finalize ... #10 flatview_destroy #11 call_rcu_thread while the main thread is in: kvm_close -> cpu_remove_sync vfio_kvm_device_close vfio_cpr_kvm_close_notifier (MIG_EVENT_PRECOPY_DONE) Seen as a SIGSEGV of the old QEMU during repeated cpr-exec of a VM with a VFIO device. Clear the ring pointer first, so that new flushes skip it, and wait for the pending RCU callbacks before destroying the vCPUs. Fixes: 7ed0919119b0 ("migration: close kvm after cpr") Signed-off-by: Andrey Drobyshev --- accel/kvm/kvm-all.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index ea027c37829..c29d467f9f5 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -630,6 +630,14 @@ void kvm_close(void) return; } + /* + * Destroying vCPUs unmaps the coalesced MMIO ring, while the RCU thread + * may be flushing it from a memory region finalizer. Stop new flushes + * and wait for the pending RCU callbacks first. + */ + kvm_state->coalesced_mmio_ring = NULL; + drain_call_rcu(); + CPU_FOREACH(cpu) { cpu_remove_sync(cpu); close(cpu->kvm_fd); -- 2.47.1