From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from GVXPR05CU001.outbound.protection.outlook.com (mail-swedencentralazon11023132.outbound.protection.outlook.com [52.101.83.132]) by lore.virtuozzo.com (Postfix) with ESMTPS id 9CD3E80CAF for ; Fri, 23 Oct 2026 16:54:47 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BODQdUA96mPXvWVX4YJ9btztGsy0F/0nsblpqAiG/ojE0ZIaIDPudDJX/2FFCvPZlWGc52OQaWxSD5QMjxZtkWt7g5XbmAXvv1JTbJQse+iY4dxm0g4lG6DblSIpx+5X/7xofqT6Hdkjgh/0SDo0Y3rNjnE96jZscxR7O6VkkZNmpwH+XKvoIDkEvif0wRDZIvW/kjM5hx2eYFEp7EqgMyi8fEpPYHqn4G8leZXNnShZgJNOBWSeKarFXMSSk6/u9qpBQYax7Dc/ZcLcm5VDBX8u380FG69t2m/0yTOXBot0XNFRQpg8AczS4PnsmJn96fzxY9blSBsdspB5V1pj2Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=kNP9/NATiFYrjeAMP5KgSxysv89ttm0Zo1jTTf7JgqU=; b=Xl6GwW9WyhH5Vll/ns6Bvos3Wjv7fIRutBwpB0q8ZF+2YkSf+Si3KobuDmO6JJbLvtmnVj9GrOk1OvDK7rzrP9a0MP4b+RH8fj2jWBhQeaJvLfStzZWDxLZs7cYN0J78rBK3G8LNCvkqOD83D6NjaOmk02M4e3uK4TwUM4Jd5vL2FbAmh6R0XTb7MHkJGuKdbVjj+ynsy3aL7m2o0W+BgH3ibyGIORJxEv8OVTX9U7JlbjHn5JXPjLN+Q7vm0eJ4aDd0SRhsK3C2I6JZLAWYJRy6V28oDNBW++YIwKfWgKICuQSTsMMn3w/wb5f1sLy63xgTQCqUIZxMHDgBLghqQQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=kNP9/NATiFYrjeAMP5KgSxysv89ttm0Zo1jTTf7JgqU=; b=UpiyhtqI8gwJY5bm7YY5HLQUQHndXACJ0aL83Imkwq2UbuRTJHZiqNowSe43vK9SOaEQlok9eqJGJhLnsR2ryK+Y1gsGj7AQ4pSobkPzGjWybPcQlmEg34ZtUHgUxM1teJUC3yiTgwIn32XY0ozBNeSwnyle5s+UJThJLOPMrkrdev8z9e28yIT5lpmH82sH7i+uLL1VC+Qt731U2sZ3Wj1cZ/nUFVOY14f3pmOF3SQUzbacM/4yhsQIH5Q5c31EKMxAdEWlxLe5Oy/lsVxiukuAICRjl6K+2s0JwUdEl9JnRvGcm8nRq0v49WNH066bUelSJu6OZZBghCfqEn7vHw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DU4PR08MB11747.eurprd08.prod.outlook.com (2603:10a6:10:646::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.19; Fri, 23 Oct 2026 16:54:46 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.017; Fri, 23 Oct 2026 16:54:46 +0000 From: Andrey Drobyshev Date: Fri, 23 Oct 2026 19:54:00 +0300 Subject: [PATCH QEMU HCI-8.1 v5 23/36] kvm: fix coalesced MMIO flush racing with kvm_close() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261023-vfio_v1-v5-23-ba0bf3c6d122@virtuozzo.com> References: <20261023-vfio_v1-v5-0-ba0bf3c6d122@virtuozzo.com> In-Reply-To: <20261023-vfio_v1-v5-0-ba0bf3c6d122@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI1PR0902CA0027.eurprd09.prod.outlook.com (2603:10a6:802:1::16) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DU4PR08MB11747:EE_ X-MS-Office365-Filtering-Correlation-Id: 786b0358-bd81-4a7b-8a4c-08df3126535c X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|1800799024|23010399003|376014|52116014|5113699003|22082099003|18002099003|38350700014|10067099003|5023799004|261009223027099003|261022105027099003|261022075727099003|261021121427099003|56012099006; X-Microsoft-Antispam-Message-Info: JMrSAh/YRnFtrAI1xKzSXtUjXuFvNyixipwP7aeUvkCNDR6jQeEsAhNbnwgO9mYj7ldHPUik8OM3CbKfvIE58TSSU0O/hftSH3DhxnQnp8WutcZEsNQaXCuXtoThhAGfrGCPJmSUmI4TcWOcf4XbEu1B6G5UpEgpASGwsQAbW5t5FBLXtfEAXqsLt/swpYQKMDaLyw2RwGpMPulkBg4OlIPP5vkp/f/iVCBP26i4sgBrHx8NtMYOq0paiL7UuEE7sopIlHddQLx8cOtP9WT6OYRDcWt/WdB3vm93s2j3yXEV3/kCvt9Xx4B9xJurkUtaSr3R+o4dEquhg6dRvVfB0Gxptyqh65G8+N4OjRG79YqU/IzYdTW9DeqKoBFE166KHcTuEpSqWA+mgA4JUw1J1Gfw3lD7/uQd/nnptkHv+RPeoytE0Wlhw5qU/KPtookOgeOF3+ahQ1Am3bBZjMNcR97VAFj4iJ8gHxJh9ZT3cdW9TlBLT6Jr9BzRcuVK+0e6kMbtM5yuwR7KYkmwe3jFJjXMnuY988wMtnlBa37HG2vW8S6wzCSFR7tjk0VZzboWvxEvR4REfKaFbYwoESnwND1sKFXksV0H0JOctWe0pQyyHyl0dUCghWmvFW2W9R9lgkn0tIAJCh2a6KfwXICoFW4lNvirSKhvtFu+I2OPn/WW4iMpL8nMzvLvaC39L4P5tSzzjdFdGTCYse6cXMqmS0EGMtGTYl/j+L2R+RcYkxE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(23010399003)(376014)(52116014)(5113699003)(22082099003)(18002099003)(38350700014)(10067099003)(5023799004)(261009223027099003)(261022105027099003)(261022075727099003)(261021121427099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?K053OGJqc0xZTjFsV0plOXJoc3R2aHU0WmUxWE9vUXMxSXY3VkVYUHFYK01J?= =?utf-8?B?OEVOanNoNXRMeTIzc3Y2enc2Q2VDOXk1cnNFcm5kWG0yT3hXOFBQbTJEaDhp?= =?utf-8?B?SFY3S003amE1NUVITmp3bjZGblJPamY4Q3JrdDlkL3FUT2NGeGVNbTVmdGpm?= =?utf-8?B?bVBWcnZFRVZ3aWZqeDJ4TGNCajZUczVvVDNiQU8xcDJjbzNoU01BQmpvNEds?= =?utf-8?B?SmhsS1dGNXBMVHpXYWduUitzbUVTVUVZaUtpK1YyZWpiTTdwZUJTdkY0RDZH?= =?utf-8?B?bEtpdGYyb3JZWHlLVFJzd3Q5ZlBOaG1wa2NFS2xBQS9PczdjRWdia1pRTWlI?= =?utf-8?B?QUl6SWxobmNxRnhWb1BJZnpvSDRyUnYvMzFLRnowbXhONk1IaWhBVHR3Y1RL?= =?utf-8?B?RzJDWjlBWnZqSFpxWk1ZdkNabWxxSFJNUzQwSGZFWCtkcnUxeElIZ2lScFll?= =?utf-8?B?eDlycmZzN3ptTytmMWpSMkZkeEU1T0NadUNXY3RNVzlNVjhQRU1wMktaU0Vp?= =?utf-8?B?azhuV2lPTWNMMTFwejhITmJxK3FJMjB6bitWQTFtU29hYjF0WnhxVFVrOTlm?= =?utf-8?B?L3JvanZWT0Rzb0pzTGd6aFhTaWFyZk56SlE5azhNT0xNMTJYdEY4RHRpR3FK?= =?utf-8?B?VTlqSU1Fdm9ub0piY3hrbkJiMllrSU40OG1LZW9oSHUvUjR5RldNNDBuVXZB?= =?utf-8?B?SFdFZlpYUDBHOGhMQ1h1cHk2cDN1MVhmZGdjMXhaajR6RDFBRStUMmhsWWVD?= =?utf-8?B?dWRsUzlFOWRhbFlKWUtNNHBGMm54WTZkUEVRcEMvTFNnNWhlOTlpODNjVTRD?= =?utf-8?B?cExDL0MvOHlwS0ZjbExIZWZCZ2lUYmdoRFhQR2tIaWJ3YWtNRnJIUFlIcDdK?= =?utf-8?B?SzluVndFRkNPbnlWRzRMYnVLQ0U0VlZ0L25HRXRYNnRRbVR2SEs1OWNTRzVi?= =?utf-8?B?cFF5bzNxMlI2am5UR2dTOUlaNFNuem4yYTlzblU0UjVLTmhMdUpSdS95eXFO?= =?utf-8?B?MGNzTjhzQzBwbGpPVi9ZOFcyRC9QVXNuODA5L28ydHlkUWc0ZktYWnNCYitp?= =?utf-8?B?bFpPRzI4UjIwY2l0U2dSM0dVQXlGWGZuaEhLMUdxY2hyMmd3RmlVTHdLaTI3?= =?utf-8?B?ZmhzbU1Lc3d4c3FIUTlJSmFOd0p1bTRwOVJrYWdXS0pTWnc3enVTZmt4dTJY?= =?utf-8?B?SEIzYmlJOGU3dnNodVpQOGYwN3FwQVJJOEk1bS94cHY2TGVBeWlybDV4cDhH?= =?utf-8?B?TFgzMHRqMlFERFlYbTRBZ2U3cHVKT3AvRkVON0dXSTJCNnAycUw5blBxSWtx?= =?utf-8?B?eWhwTGFpVmIxUU9OcFJJQ3FPSmlEQUJLTmhYU2cwK0NxdnEyaHZ2OVI3M2lk?= =?utf-8?B?U0VNbkIrMnFuNG5QcXJ6NFkyZ2NaQ3VYNHVOMFNHM2I4K2pFM1FyWVlML09X?= =?utf-8?B?LzlsMEptSWpFeGlOTkpuTHJZTzdOL1E5WmpxNE84dG01VkZuTExuRGs2V3px?= =?utf-8?B?THY3Y1MwKzFZYWg4ZG45OEpaa0ZHWWtHN2xYcXBYZVQ2MXpab2toVUdSQmV4?= =?utf-8?B?ZWhDWkpyTHVSRXJuUk1OU04rVmNNTzVEeWhPekV2Wkxna202UnA3MmtXMXNl?= =?utf-8?B?Sm44U2cyRnpWTnpFRHRYOVdHUzZUK2lKSUNkcjBYZW8rYjFIMHZodFhVQWhs?= =?utf-8?B?Tm1aMnJ1VFFLUFVRS2loYXBSR3gzb1VwL3NDVmlVK1o5d3FweU1YMnFzaTF4?= =?utf-8?B?YVJyL0ZiOTM2SEZRN2dnMFM4QzIwaWtrV3N3VCt2Q3lYblVlQmpBU2lObWVx?= =?utf-8?B?bEpyVTA3dFBxVFpxblRrQnpJbGFzakRHbEtXRUFkcVQ2WGp5S3g5ZjZhQjhk?= =?utf-8?B?c0dXeFFORFA0TTFvMlJPRDFOK09mcmx4ejEwRzlPWE5aQ3pKRzgyUDdRUyta?= =?utf-8?B?eU9RM05EM2U5VU5QWjd2ait3VEpkRFdPUi83WTFtZ05ORzZuQXlMSHVIb2JS?= =?utf-8?B?YVhINW5ZUUJCQlJuZ1I0SWFlSW5MbkxxVlJxTENBSUd3SmtxVE5lN3QxWmJL?= =?utf-8?B?UU5rdXZ1aG5nS0JweGlGQk1xODNMdWtHVnhjUWIyYXF0MzVnV0JDYVpPU0Jy?= =?utf-8?B?ZTNXR0dzbHEwdG9hK20zM25lMjR2aGV0bm91YkdFeEZmUm5CdUs3eXp5VHBZ?= =?utf-8?B?UHlYNndEZEtTZE1pSFpEdDVMYUZ5WFZkU2gzVysrZGpOR1hNUDgwZzhoaHpl?= =?utf-8?B?ZjMxQWRvZWdKTUdHT3dEUEFpVU9seTU4UEs1U28xaGt0Y1hWMi9TVWVqVkU2?= =?utf-8?B?QUFuRXQ1SXErQXZYaXEwRjN2SnBWc3dTOVk1dUpKb2UrMU9IN1J3MGg1bnBw?= =?utf-8?Q?dbZzFmSXu6N//5k4=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 786b0358-bd81-4a7b-8a4c-08df3126535c X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Oct 2026 16:54:38.9785 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Jc9tbrJo8RbcVjL/swAb9BPhwdjafX0A8H8+1DJjdOCdKv7CKkRhbcS7MnTt9hVTzFAURR1IhJXQQu2AVTM3aNcAjWRV4+jigMlNdVKd8zw= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU4PR08MB11747 kvm_close() destroys the vCPUs, which unmaps their kvm_run areas, and the coalesced MMIO ring lives in the kvm_run area of the first vCPU. Nothing stops the RCU thread from flushing that ring at the same time: finalizing a memory region of a freed flatview calls memory_region_transaction_begin() and thus kvm_flush_coalesced_mmio_buffer(). kvm_state is still set at that point, so the flush reads the ring after it has been unmapped: #0 kvm_flush_coalesced_mmio_buffer accel/kvm/kvm-all.c #1 qemu_flush_coalesced_mmio_buffer #2 memory_region_transaction_begin #3 memory_region_finalize ... #10 flatview_destroy #11 call_rcu_thread while the main thread is in: kvm_close -> cpu_remove_sync vfio_kvm_device_close vfio_cpr_kvm_close_notifier (MIG_EVENT_PRECOPY_DONE) Seen as a SIGSEGV of the old QEMU during repeated cpr-exec of a VM with a VFIO device. Clear the ring pointer first, so that new flushes skip it, and wait for the pending RCU callbacks before destroying the vCPUs. Fixes: 7ed0919119b0 ("migration: close kvm after cpr") Signed-off-by: Andrey Drobyshev --- accel/kvm/kvm-all.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index 8b5d342af52..294a87043ef 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -630,6 +630,14 @@ void kvm_close(void) return; } + /* + * Destroying vCPUs unmaps the coalesced MMIO ring, while the RCU thread + * may be flushing it from a memory region finalizer. Stop new flushes + * and wait for the pending RCU callbacks first. + */ + kvm_state->coalesced_mmio_ring = NULL; + drain_call_rcu(); + CPU_FOREACH(cpu) { cpu_remove_sync(cpu); close(cpu->kvm_fd); -- 2.47.1