From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazon11023115.outbound.protection.outlook.com [40.107.159.115]) by lore.virtuozzo.com (Postfix) with ESMTPS id 2608D80B95 for ; Tue, 20 Oct 2026 16:31:02 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=UieybGB8rIz0EF6qgR29NGovh8/XspxcN1CkjVVh7D3fla32lQ7zzXpSeBpNOIFpBpDfz9ifdSO+gxV93MPLZ+q/yCU3rj0CBuVdnQ1rk9/B1E/643Z+5w95hWfRj82JAivcvOLlG7BjbAoV3EiFO7SBCIxdZQMamLgWJrO/R3j9DN6ghSRvgr30G/yjIamBX+gyqGZlEpx997Tr/oMuWGhiOs0N4k/lQElHOIrEONakkaDCpaNzY2Zc9Kv4rj0lCKlp9/vdxr/p5cRgax0Lbn6nlnj+mpoVWq21Hl1ZjUELrTPFhNGsiL8K+tGssCL0keEBj3UkqeEcKvKFhPIJ2Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=kNP9/NATiFYrjeAMP5KgSxysv89ttm0Zo1jTTf7JgqU=; b=lu4SPdIWVqFRtRE6mnQBTSDgZzZthKlecsgY4FmpOuH0q2hV+pB5PwA7E/VS7T2MNGgEjhNSEGf/VS++3xpqGPG5liO+1KoqMnGHRne4NlewHvw4KCQva8wOkUa6syVqQpAyYz/CoHKhjTSPRJfU5iLh4XWu8iFbYns7ess4T5N1rOF6Rzhlu0mIh/FW0tzuLgV+RT7gspy9Ux3Ffm+Hj1zKhjINHMvTTKkmUKZHQKq0Z9HlJDswoBQIc1Xi5/RYHaS5SQuIkB5gBmOF6KpaQLnSXcqQgA4JV9cI4dbXgxYatU5O4V2Obig6gJXoqnmJbKkK/vuNhTSgYli27g08DA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=kNP9/NATiFYrjeAMP5KgSxysv89ttm0Zo1jTTf7JgqU=; b=r+ItGWw3nquOskDJoFR9AzH8zFSNO3gtej0DFCeCj3zbAYuZcgOxfe7OqsknBcJWWEXCmCyYbttFz+M+9DVyWKLRftNTFnE6WZeN+cX0Ufju1oYrYr7KNXnu+bDZ7LwySeza8SsML35HKEvkb3KW1TFTSHZGztPnkt6OzUNgC/g7Eytxc2tz+yRMInqhVgnwt5Icep5EhMcnerxO3VEAkWI7VWngm3kFtszSHwwwqgyrBAA5FoQKYVUhCuUqzzC1/flvpU9SjW3dCsGMvnSDfLL8rNIdBAF8qZBbNHYPUxDbh5rABGDwv6808KzkOxJyn0wf3VB6ti1ZxUCEJG2LOg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by AS4PR08MB7553.eurprd08.prod.outlook.com (2603:10a6:20b:4fb::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.15; Tue, 20 Oct 2026 16:31:00 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.012; Tue, 20 Oct 2026 16:31:00 +0000 From: Andrey Drobyshev Date: Tue, 20 Oct 2026 19:31:01 +0300 Subject: [PATCH QEMU HCI-8.1 v4 21/31] kvm: fix coalesced MMIO flush racing with kvm_close() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261020-vfio_v1-v4-21-83a5668230e5@virtuozzo.com> References: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> In-Reply-To: <20261020-vfio_v1-v4-0-83a5668230e5@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIUP296CA0056.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:34b::14) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|AS4PR08MB7553:EE_ X-MS-Office365-Filtering-Correlation-Id: 2e40aa1c-fa3f-49c1-5d38-08df2ec78544 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|1800799024|376014|52116014|366016|5113699003|10067099003|22082099003|18002099003|5023799004|261009223027099003|56012099006|38350700014; X-Microsoft-Antispam-Message-Info: s/RpiHE/feyMmOpms7Orjvp1p0SabbZRmgomhSSCALktSJLyQUdWTjv6TjbdOFfmWczH517zFp2x291LOl7kkEBAqz6otFqxQOioooYYHAYQiIMZdgYp14vDuf0/t4BAH4B9YtVWZZyp08/0+HSlCfpsLbsDAOyPIR6v1yM9DMQVj3RN8Gym1OIuGKvOnWDp87bnFzkSCwUzZT/ktmQE3MZhyCn4xXmfV5DykB5iiqfVnUUdjZUPfYODSLiddLkaC9srY/za2wgf14i1u1St5ROxc93jnrJ1A1cr3nkfs2QhZyZMmSJyGXNnd6pYs0aCit93h9DsfQASZZyzjVTvWzyRg/5y4Ap/WSErfhUB6gfapc2a3E4LoXaZPEQkXy+UNHFDai1wJMov547MaknYyVXhB0xpobDpHQg9xI2hBN9Wr9uLTEFH/Eg4CummI1cpUKdtmZVa0Ejl1cdisvj2qlGqo6N1sGtf79xskECeNl4vb7WlDg38lrKtO2cIvVwVkeRbAV/44BzTuS0NRfyJFTINz7hJrSIjPrAuQkB5NLf6+hJcBV8i641pqfBYFC8vCq3vxkvQikIsvIpk9d7AYKZJAserRqBTHR5eQZshm/46MWlttHqZFuHg81xv4qlED/6RA0yXXWuMQIdzjJmQCeX3prmT73mflDedzkqrHGOiXlBxxkiPh00AUafrizjFBW43Wz4c+BNJhKVyNoQmQcnAwdmehQVqsl/YA5B8SJw= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(1800799024)(376014)(52116014)(366016)(5113699003)(10067099003)(22082099003)(18002099003)(5023799004)(261009223027099003)(56012099006)(38350700014);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?V1k2WTU3YkpoQi9RS3d4YnVDM0w5a05CUHM4aDB5R210NVlqMkJVTmRXaDUw?= =?utf-8?B?LzZ1SzE1bWhYQnY5bHp5WHdhODdOSG1YRWhvU2Z0RlVtMjgxbFN0MzJKSWJ6?= =?utf-8?B?NmJLRDE3Sk5uaTM2RnhPSExjNVhiYUZhU1RWNlBxZTBnQU90UmxKR1VkTm1u?= =?utf-8?B?c1VjTjcxWmlVaVpRS2tkSmtjNjdNanFzTjVhZ1J1ZFUydTI3UXd6V0lubzJH?= =?utf-8?B?MVUyU1ZuY2ZtdkZBR1pJWHg5WUxkdUJPTENFQVAzeGhwUldRTCtsRE56Zmha?= =?utf-8?B?Z3JiSnpBWm1hYkZDR2QydG1rb0hoSEVQbjN6bGRHSEgzNUIyV2lQMVJPTmVN?= =?utf-8?B?YXlOejBGRlBrQjFLNmx0VWQ0ZEVBWFByZDdPdHZwZFJzbmhHMzQ0U2VYN01P?= =?utf-8?B?UFVxNE92VkR2d3k5SHExSy9saENEb3lDT1o0d2V6c3BCTExyMFgxWExyT2JQ?= =?utf-8?B?a3N4LzJYS0lYZ1VvaEZmT2Q2NW14RlozdU1Eb3A2WjlVZjdrOURDVitIL0tv?= =?utf-8?B?U09TdFlLN0JObHlYSjlGd0V6dTVqWjhRVmswcEpKd2hvY1duZjFWckErZm9w?= =?utf-8?B?NExQdkZMS0RXdEZyNmsrSUxua3lwOHhCd0tFbzFpZmRiVlZPYlU1ZFVEbzA2?= =?utf-8?B?dnBFSGlLd2ZkTjVlSXkrazI1amlYakZqMnhNK3Jlb0JSMUVEWUVrRHZad3gw?= =?utf-8?B?MG10eGROd0hMY0Nta2FEZHZXS3hQMHFYdHhlL1l5RlNnUHFnNmdpMkZuUjZq?= =?utf-8?B?Z1ozRFdQTHNjY2dIY2NJdFpRaS83ZE80L3A1cWFFNlo1bUZBY1cyejlxcmRv?= =?utf-8?B?R1BRbE40VzVRZkxBSno4U3lscml3V1dwUFRYdHRtVk03dUgrVTR2Rkp0cW9S?= =?utf-8?B?T1hxRXpPb2YzTFRGZE5iZlZBRi8xc2VyaFB0OWo0Ry9wMVM2MUpJSDFJd2Rn?= =?utf-8?B?SWt3VmQ5bWlwelFNNVJlWGpEckxVN1RTTVNNYUZGWUZYUXF0aWdLZkUzdHRT?= =?utf-8?B?TE1raFhVVGVsSnRTVGRVeCt3SnBhcm1hZWI5RFdHZDBKZVRBS0xTTjllcjZh?= =?utf-8?B?UTM3UFJTOWpEazlhVmQxL2RHTG9NdkVRRlQ3ZFY0MngxM3ZzWE9zc3pZcSsx?= =?utf-8?B?QjNJL0RBWkZPbXdKc3RWeHVPSDl6b1l2ZGxndGFoRVZjSzZpallicTBMbnA5?= =?utf-8?B?SW55KzRnMWZIb1ZYaFZMcVdtbHhuMjV4c2dXZXFzSkI1K1RzV05PTGRmWDlI?= =?utf-8?B?cXZMUy8vUnZtOWZMTnY3TklhS2ZUbGdhbkVVS2E1Mis2bG9pa2JLVlFZbmlS?= =?utf-8?B?NUQ3d0lLWUlYeHhTcGZLTkVTN2QxWTFOVVFMUnpETFUvdmtmWGxCYjBMR041?= =?utf-8?B?SW1OT0NNM0J2a2hub0xBVHN3VkE4eE1NanNXMXFCZDV6bkdhZzBpU0pVWjFM?= =?utf-8?B?cHkwbEFYS3lDcDk0STFhS1FWY0xiSWRrNUNsYjR4QlEyZ1NFZEFTaHdVK0Jz?= =?utf-8?B?WWsrRVZMVkE5UWtKMkQvY3M2aFZmYTdJZjhsdUVIa2ZvUzNxaDIzZ3BWOGVw?= =?utf-8?B?anVQRlRxMzJVWXZ5czhETTlIL0thN2xhWkRkdEJ1cEU4dUVQazl6bW16bnY1?= =?utf-8?B?cHR4bldvS2JuUS9sTE53M3FsWkZRVGV2K3pDUzFaajEwMlFuQW9TRHhySWNK?= =?utf-8?B?SVI1UEdBMVNJbjJBZGtVelRBazBIaWxyVHVTR0FYa3NoYXoxd0xtTmN4eWwx?= =?utf-8?B?OTVYWjIzT1QwSjJ0VkZ1Y2NWYnlEaTdab0JhL0dyQTNLQzNsQnptRVlaSlB1?= =?utf-8?B?SUxZSnZ1ZGVNSjVrdlJWdEx2ak9vUnViR2w3NkVwRi8yZm05R09BN0ZHWlpn?= =?utf-8?B?aFJWbTZzcjUyT1FhdEhrWjk5bmcyd0dkYzFIVzd3MmRVczV5cjVKY25Mdll3?= =?utf-8?B?VUN5TjRIcEw0cUowaVhNTWVkNmttL1lGVDZWSTgxd2RNQVJ3ZVFPdHY3TExS?= =?utf-8?B?cHhLbzlxbU1Xakc3RnhZVW44ckpsZlNTMkVQQ0plUHBFTHBjbWtNbUtjNmVS?= =?utf-8?B?bEpBZWc2TGI0RURSa0hDS1dNSlNJczJUTjhTZk9ycnJaK1l6VEVFa2ZPeUFI?= =?utf-8?B?OGhPODdjMUFSbWFzbnFkYTVueHRkYUVGNlE5bFZxVUcydEVCeXkwUlM3T0RQ?= =?utf-8?B?NGwrVWZLT3NPRlhnVllkYk95M1lkdGppOWQrRkcvSjJBKzJrcFVCRjNnL1BB?= =?utf-8?B?dGxwT2h2c2s3QitnOW9SNlZBdndubE9KaFFMN0hidndmUnZMWWpMQ1dVNE13?= =?utf-8?B?N1pPLzNKTnMzV3ZMOFNMakhBQVQ3NWNjSG5tSzRwR2JyaFdzOER5YTJlSEtT?= =?utf-8?Q?hAozdJgP7wasngeI=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 2e40aa1c-fa3f-49c1-5d38-08df2ec78544 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Oct 2026 16:30:57.9917 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: gL23Iv4wEYF3cYJnv5d/cOzLCACOY0jBs2RCu7XqOUdI+TfUAAYhfNwiutfE2RN11BY1rTFFbVw0qRymh2Kio0IFOEsUcQ0/8YaNEcwwewE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS4PR08MB7553 kvm_close() destroys the vCPUs, which unmaps their kvm_run areas, and the coalesced MMIO ring lives in the kvm_run area of the first vCPU. Nothing stops the RCU thread from flushing that ring at the same time: finalizing a memory region of a freed flatview calls memory_region_transaction_begin() and thus kvm_flush_coalesced_mmio_buffer(). kvm_state is still set at that point, so the flush reads the ring after it has been unmapped: #0 kvm_flush_coalesced_mmio_buffer accel/kvm/kvm-all.c #1 qemu_flush_coalesced_mmio_buffer #2 memory_region_transaction_begin #3 memory_region_finalize ... #10 flatview_destroy #11 call_rcu_thread while the main thread is in: kvm_close -> cpu_remove_sync vfio_kvm_device_close vfio_cpr_kvm_close_notifier (MIG_EVENT_PRECOPY_DONE) Seen as a SIGSEGV of the old QEMU during repeated cpr-exec of a VM with a VFIO device. Clear the ring pointer first, so that new flushes skip it, and wait for the pending RCU callbacks before destroying the vCPUs. Fixes: 7ed0919119b0 ("migration: close kvm after cpr") Signed-off-by: Andrey Drobyshev --- accel/kvm/kvm-all.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index 8b5d342af52..294a87043ef 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -630,6 +630,14 @@ void kvm_close(void) return; } + /* + * Destroying vCPUs unmaps the coalesced MMIO ring, while the RCU thread + * may be flushing it from a memory region finalizer. Stop new flushes + * and wait for the pending RCU callbacks first. + */ + kvm_state->coalesced_mmio_ring = NULL; + drain_call_rcu(); + CPU_FOREACH(cpu) { cpu_remove_sync(cpu); close(cpu->kvm_fd); -- 2.47.1