From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazon11021099.outbound.protection.outlook.com [52.101.70.99]) by lore.virtuozzo.com (Postfix) with ESMTPS id 29D8C80B10 for ; Fri, 16 Oct 2026 15:26:20 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=VSPERiHUkW/wIuO9iho7t4BvuJ+mszEvTEPyJSosUaqvt+xJlm+a8aoJWpzlDVopnAVjqiP8amJxOn4aB6cdI6JPZnAkmqy+67CR9U5jqI/5Y5FNG4LyonwUli7rtjoO2P8d56yq1PLYneqzpXuWxahjZY2+jbB0NPBwGWOr8a1asEne067GyMlfx846OV+X1pWvsCVv85tgpWbnuG+UDcGrBlQXyWWmlaAxmIAa9cI0JeUFDbi0+zPZAGYL11Na34SawpfNUVE5DCmdx+XXDpSK2SYPd15Qr74z7RlqOYCRo+lNknuAAWibFA1tJEtbNyAhxE8M9DCH1Ov5jxNCTQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=RqGmpP8aPhtTLxp5I5vyaeTDe0jqWWPJO/YulCZ/lZY=; b=tgOpr04XsOgctdX26vVCJUAi6ST5hFajHxFcc9LvRRJAZb1aINJObYff1kJ4irL8+2wbNlZBSjckCoFy/jv8XO7mpguhjKMvJ2QOPOm8GVZFuNgf2Nzih3SuHf27dJ2al1ji4Rlk+rQRgoaSHQ76MhcTr1LhsxReU59vInbeAtMdg15z/6HgEH3r5gDnxFOkmwcsFq7jlqzpi1IinoYFHc2o82Ya5m7PP8o9t6gf2AR5vC0EsxRt0JI33uyZszlt/8yvO1wHiWqZyCk3eSXtKeTNGGZcF/zT/48wIM13xMwRLfpQLfyMUnc8jqJ6zKKEj+/WpjKhyKj/Mj/t+hM4iw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=RqGmpP8aPhtTLxp5I5vyaeTDe0jqWWPJO/YulCZ/lZY=; b=CTiFHiw4anwjO6PiXITOoUQSAive6nseHznH72rhC/XnkLswOqTg6vXogcMx2vxVA/EifcQ3r1MpEEIxq7/goZmMCEt9P213wYluzv67Iiknc9g9Q9IBDVXoTa+Hwb043c8CCH/o150wzUeXubt8gHszH8jLeTmvO1GIMfvKplte/xaNkEW2UJXUKovFQoDolIB7I+lsS4dIpWw5TxQmvxuFRV4B8rDkdt+oGekMbQ+pe0OFm0Z74Pj/GJ3RhEGKCqd8IG+mBejp9ERduNvSKUzBkkcTQxTsVsKEKqb64Cn+MnxG1ug0kiw49CEwpo5m26BQ5/Y8vb1l+vLbpbP4Cw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by VI0PR08MB10941.eurprd08.prod.outlook.com (2603:10a6:800:250::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.7; Fri, 16 Oct 2026 15:26:18 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.006; Fri, 16 Oct 2026 15:26:18 +0000 From: Andrey Drobyshev Date: Fri, 16 Oct 2026 18:26:17 +0300 Subject: [PATCH QEMU HCI-8.1 v3 19/28] kvm: fix coalesced MMIO flush racing with kvm_close() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261016-vfio_v1-v3-19-47487cb5a8e5@virtuozzo.com> References: <20261016-vfio_v1-v3-0-47487cb5a8e5@virtuozzo.com> In-Reply-To: <20261016-vfio_v1-v3-0-47487cb5a8e5@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI1PR10CA0088.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:803:28::17) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|VI0PR08MB10941:EE_ X-MS-Office365-Filtering-Correlation-Id: fa5520bf-3d5c-4ac9-b177-08df2b99d07e X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|52116014|366016|376014|5113699003|10067099003|22082099003|18002099003|5023799004|261009223027099003|38350700014|56012099006; X-Microsoft-Antispam-Message-Info: +mWCqRTZa3ooEyox6+ZBRhxLIkODEdiY0SjqOz0eA6Y/wgaRgqjnZRJQNtpqV+ChIkvB9e/vM90hNLUreRPBMkOsIXQ0nWB9IDmDkpu5/8pMCrlwy2BBiZ1rvh/QI39cVpBGANr4Hw70Q0F55D5LhvcAABuJtQ5Sx72fIl+ucFrczjGbMywuuDfol3DXSgoBieiFeawfnvKQ2wb4uKck4FILO8I5dwlWvi6rYj0U2w6C+CAt8bSpGYHgxgwOvSj7tyhusT1s81UygU2DxAQx6L1YBZwZm2eZ92Z5hoDLpd7YMwTcoxmfuHnWXJR7M1Db5slu4AajfhXmGy0BntiGUQkYdtRKkBJRSfR78ooujkc6YGphxqlJqZdHc6x99YxHg9Bctk3O/M3nyYq5yoJ5NgJ1wzyPe4alpAkD7izNo8VcYnqSOwRaV9C/fLoQf/u9s1qezattQIeKzLTcSCUFEHVi3gF43qLq+07vf0J1YX7GjRz1uDnFjSRXQJLLO+PvizdxsQCPmdbi8z9KDw+8De+RIVQLlRLqvmkvNKMiGkLGJX9DWm0aexW0uypoPRkX2tQkGNnDgjKTDfao4tuswQWpF0j754aQBZF+O/ReDxSD6wGrn6Y5SyeiLFgVQcKfnRAw4nV5D0KgA7z7IdKRoSpDL4lcyVNNAJe57y3jHuBPw6JC319/naTJ15buCX8EfrRr/pcpgz9Di1MtUBnD0CbDAfDKpNQetErGAxQuL2w= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(52116014)(366016)(376014)(5113699003)(10067099003)(22082099003)(18002099003)(5023799004)(261009223027099003)(38350700014)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?VlZ5VGtiWE9ObmhVYjBVK3I5SUUzMGZVYllPZW43czZOWDNxZHdIWnVjQU5p?= =?utf-8?B?NnBlRCtGRXBUSUF6VkRSRUhjNHZvTzJiVVZTb1dibVlLOEV6eEtCNHh1dUdw?= =?utf-8?B?TzdvUHl4RHA5MkJDZjNVZ1doY3JJNnM0MHI5cVhkb3c1WnUzSVBhaWVhZWgz?= =?utf-8?B?ekdVR21iRGU2ZTdTRHkrODRlYzZIVHptS0thVGg2VnN1ZG5MNWFvM2J5VVNr?= =?utf-8?B?RnFVZUQxbjRWYzlYU3lISzE4b0JHVE9mZjlWM1pYSUJmMFl0UzJIcVVSTXFY?= =?utf-8?B?Wi8veDZQQjNTUGdRWG9nTTNvWXhTZkY0VU45NXJISGxxOU14NThMRmJnd2lq?= =?utf-8?B?QTg4THJ0aXlIb1B4OWZQRWhjbnVhVEsxa0tmMDZlVWxtdW9NajRYb3RkZjZM?= =?utf-8?B?OFRoVjhWdUI2Vm8vaXhrQzM4L0JPRnozSHRlUm91Y3BPNk1sTUh1b29mUFhC?= =?utf-8?B?OTMwM0ZmVDlLSEVybGE1aDhIOC9XRFlCQzdSL3c0emEyOWxXOHV1Vk5LUjJx?= =?utf-8?B?dnJKUStoQzJ4VVNvWTk3SjY5YUc1cVJHcjV2WDh2UUt0bTBXVnJKQkpFRVpN?= =?utf-8?B?VTM5MjlKNFJKRkM3QmVPRVBnZ0g3LzVjZTVPdVR4N1NTMTNnS1VsWEQ3N2dO?= =?utf-8?B?S2JXSjAvTnZlaXVZQjF1NjBsaFEvdHZ5QjgyRmRDd2dSeU5nVjVHQUJBQmI5?= =?utf-8?B?WFFxeml3N0kwS2lJQ3hzQkFDZHRPdkdwR2IyaE5PZWJ2YnZ1WWNBUm5BVFdS?= =?utf-8?B?cGF1TnJFVGt5RTBVOE1DbTlnbFJiSHJhdUpvdlVIMXorQzhEUjM1OCtDUGdv?= =?utf-8?B?bEhxbnJtUzUyZGo1UkU1RmJYdXU2dlBkZmxIdjJmL3hLME8wWnNXK2lOM040?= =?utf-8?B?Y0wxSFBpcXVpMjlqOFFFUDJ6R3VVaFNhdWUrZzgwUU92R0dYYlVZeTl2S1Fy?= =?utf-8?B?Mnp3azRVTnJtNDRJRXJMa2NNSGFiNkI2TTg2bkJYWllnbnpXZHBjcWZ5UGVl?= =?utf-8?B?SS8xYytRSkRiSms5empzLzFtQk9OekJIN0pQNTZHVlB3c3FMMEVsblN5eWwx?= =?utf-8?B?V25INlhWSkkvUXZJMUFVcGwvbzQwQkhOc3p1c3dnRkRVVVYrZTc0ZnQ5RUha?= =?utf-8?B?NDk5NzdxT0FHTXNCS25LM0MrY0xEaWhXNmlZb1hEZWQ1T1VqRHZaeUlkUmd1?= =?utf-8?B?c0k5OTliVDQzQTN3ZDltczl3OFJaOVVqUGNHWWZUZGlJZjdBaW5RbHYySGt2?= =?utf-8?B?SUFjcXBXbEpWcHUraTJmRTN5cFkrRDVVZEU0N2tOSmkrcWVBUHUyRW4rTnAw?= =?utf-8?B?c3dvNFZUOWFOMTQ4eDJJNE9SS240Znkrb09yTjhHL0RQTEVOQU9GZVNBRysr?= =?utf-8?B?RTlGc3pqbWJ3OEtYVndFQlMvL1ladmI0UHozaThpWWdWRE10ZnBDRjc0ZXg1?= =?utf-8?B?SzdoVTVxa1p5Z1lkZ2k2eGRsczhwVE5Gc014K2dQM3psTkxReFVlakFtSUU4?= =?utf-8?B?dy9tVnJBNExqWFMrT1hmV3BCdjFqVHZ2aEtEMEg4Wm5lWjVtR3h1QUtkTDll?= =?utf-8?B?QlpmMVVMZ1J3MXVaWTlXZ0xkV2lKR21WdnEvL2xDTzd0S2dYbWltRTkyMVFK?= =?utf-8?B?K1Qzb0Z1dlN1SlBTdGk3b05YQXZreHl3SWIrVC9aSUV5bkh3V3lTWXJxU01M?= =?utf-8?B?M1gzT2p3Q2EyeDNidmliZ1NUZlhGdGFQNWdVMFlWSGlQUURyQ3orSndpZnpB?= =?utf-8?B?M2ovS3RwNi93aXJmaHk4L1NEOThxbkc0Y0FFS2M1ZGN2Ri9FNnZnbGdiRTh6?= =?utf-8?B?SkMyUkFjOVZZeW5zRWZGbW1Lc1lycC9OekYzV3VNS285KzFQMnFmd2hLRFB3?= =?utf-8?B?WGRVRnI5aFpRZmRmZlFSZFd4NHM3clJsWGNZNm53VWVMTW5oK1FrRjl1K28y?= =?utf-8?B?bDN6NHRNZDZ0QlU3QzNnam9nalVZb2pmSHNxTHZVaGVQeXl2V0M4eEVmY2wr?= =?utf-8?B?UGlmYmRLeXY0d29YVjN3YjlldU4rbEpxRzFtUW1RaTlnNExMOFRyQTNBdGl5?= =?utf-8?B?MUZzcmJDRkxDYnh5ZzNEbHFqOFBibktkUmlDVVJwVXhGd2xxSzhCVjFLNWdX?= =?utf-8?B?L1hwbWZSUnlDZzVIMEd0aXU1YTRud1NaNkp1SGVNZ1pkNzYwTHQ1L3lvVGVj?= =?utf-8?B?TStSTDVCYTZWOUovUHY1L1NKc3NzQUs2bnZsNUF0akl3Ly8vYmd5cHBWOUFE?= =?utf-8?B?T2VDZnNKSWpNMnVnYnI3VjhWWG44WENmZE9EK3U2K2NramlhZjNUWWRsNXhH?= =?utf-8?B?UnNFdzFKN2lHRG0yU1ptTUVEN3kvcU1XRFZtR3NrSkIycE80c1ZhK3VJbnZ4?= =?utf-8?Q?9ooY0TjHFzfbhZGg=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: fa5520bf-3d5c-4ac9-b177-08df2b99d07e X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Oct 2026 15:26:13.9536 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: kAGuSFsf48GLXmC9TzoU607R5SVJRH1Gsk86krXq46Jk2EnSWSImDOYf1N89b/Ih8NL706laD6Bm2VPkO4aOD+wTQnYplNRrZhNhXi4cVL8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR08MB10941 kvm_close() destroys the vCPUs, which unmaps their kvm_run areas, and the coalesced MMIO ring lives in the kvm_run area of the first vCPU. Nothing stops the RCU thread from flushing that ring at the same time: finalizing a memory region of a freed flatview calls memory_region_transaction_begin() and thus kvm_flush_coalesced_mmio_buffer(). kvm_state is still set at that point, so the flush reads the ring after it has been unmapped: #0 kvm_flush_coalesced_mmio_buffer accel/kvm/kvm-all.c #1 qemu_flush_coalesced_mmio_buffer #2 memory_region_transaction_begin #3 memory_region_finalize ... #10 flatview_destroy #11 call_rcu_thread while the main thread is in: kvm_close -> cpu_remove_sync vfio_kvm_device_close vfio_cpr_kvm_close_notifier (MIG_EVENT_PRECOPY_DONE) Seen as a SIGSEGV of the old QEMU during repeated cpr-exec of a VM with a VFIO device. Clear the ring pointer first, so that new flushes skip it, and wait for the pending RCU callbacks before destroying the vCPUs. Fixes: 7ed0919119b0 ("migration: close kvm after cpr") Signed-off-by: Andrey Drobyshev --- accel/kvm/kvm-all.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index ea027c37829..c29d467f9f5 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -630,6 +630,14 @@ void kvm_close(void) return; } + /* + * Destroying vCPUs unmaps the coalesced MMIO ring, while the RCU thread + * may be flushing it from a memory region finalizer. Stop new flushes + * and wait for the pending RCU callbacks first. + */ + kvm_state->coalesced_mmio_ring = NULL; + drain_call_rcu(); + CPU_FOREACH(cpu) { cpu_remove_sync(cpu); close(cpu->kvm_fd); -- 2.47.1