From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazon11023121.outbound.protection.outlook.com [40.107.159.121]) by lore.virtuozzo.com (Postfix) with ESMTPS id 9800F8105F for ; Fri, 30 Oct 2026 14:45:53 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=tPRGE2XJBFbsGw7VmjUtVpvulcrGJJrcgk9aqEeyT+2GCrZ/F9+YH0EHqLI+TnQ9pCAW6+B3WazXQ07Zq9tq6YAgD4bqxwcj098Sdq8g5T9R/lz1AaKhx2y3NjpJtbajeh+V8CwjUQM3G+3VkWZRalkAQHKmgA5fMU5Jlh5YO+Or656bt9lni0ckz8p0Fj8Af43FFnjcnj0un3kV9tP287LNc53VYngD6sODMn6oagQDx9ppDElCe1HgSGi6PQlfPVXECkO+vEc+yG72C9d9ya5SJmCMgJTYJgQx8cm/N9q6yBkLnyS2Xjqu6qGTNzKpwHJLiLDfL2f6WSj4QXyg9g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=kNP9/NATiFYrjeAMP5KgSxysv89ttm0Zo1jTTf7JgqU=; b=qCMZ/hOi0ju27vEA4xXrlEikRFXDuqnLHc/3XPg59Wz94dA4wxJaWeO2NwbnZaEtkZchDaCyslmQEAVVuW2NrCJX07LbnJPZ6RcGDzAkbURuFGSHB+G2o8wUVXHGYjgncXRPRilF+MWJv+0rGmDGKWvLcrrT+S0E4gC4V3prxmx3VWnsQbbYtgotyEKobyAL2oHnEydhFDWlw5RoxhalmR+Z/HVsuLVMqgllLYYtFgCaYKTBS0tUKTfEt8IUs13eKnDrAOeaARr8P/MtKi9F6E8QXxS+JpwVZ+oGY5f9rAR+k05xN1PhkAc79p3EJbkyr7tDvjt0t/TcHgGvdA+0+w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=kNP9/NATiFYrjeAMP5KgSxysv89ttm0Zo1jTTf7JgqU=; b=OgIYnxc1gT6YIYBaTtp2be/9WhII1Mw62C0lVE3MFMjHysrZdhrDM5IV2Y8JVi8xNpc9+oSeigTwTHmJQgLWXG43lSN+6Xfv3bSdns3gFwHcZgrw5uPDPgv/IXE56GNED8AivBjK94qMmsUaQ6CX8Yc4VJGUyMTDjvhzulVw0WJPQeTWKxnD0pMNEwyPmalUlfEiMUP01jmggxDEo/k5ZGFFTC0EvZVcgH+3mY8Z60pdH5T9ExYntYGaYfboZCw91oXedffuxgxRBs9KIOKlUrkFyavU81dbkdDAwczgWu+1vO+F8MWlOBOiSC+GJX2kElT34gmL+538HolVRy2Ipw== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by AS1PR08MB7451.eurprd08.prod.outlook.com (2603:10a6:20b:4dd::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.9; Fri, 30 Oct 2026 14:45:52 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.008; Fri, 30 Oct 2026 14:45:52 +0000 From: Andrey Drobyshev Date: Fri, 30 Oct 2026 16:45:54 +0200 Subject: [PATCH QEMU HCI-8.1 v6 23/34] kvm: fix coalesced MMIO flush racing with kvm_close() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261030-vfio_v1-v6-23-45de246bc92e@virtuozzo.com> References: <20261030-vfio_v1-v6-0-45de246bc92e@virtuozzo.com> In-Reply-To: <20261030-vfio_v1-v6-0-45de246bc92e@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI1PR0502CA0031.eurprd05.prod.outlook.com (2603:10a6:803:1::44) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|AS1PR08MB7451:EE_ X-MS-Office365-Filtering-Correlation-Id: 0e1a3b7b-bde3-4faf-b13c-08df36947d5b X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|52116014|376014|23010399003|1800799024|5113699003|22082099003|18002099003|38350700014|56012099006|5023799004|261022075727099003|10067099003|261028144727099003|261021121427099003|261022105027099003|261009223027099003|261026121527099003|261026140227099003; X-Microsoft-Antispam-Message-Info: N579Ya6FsOXNJd0CSZp13zu6dC93JeqAdOaFo7a1nDjVlZvJAoIM6c+nyRAPc62dgsbelzXK4ag3d0fBd4azNDnxqh2cctVj+qRyWqG4JJDX9yWTSnEfx7QXGvXDVk/u4e4u7TnYrL3lWW+3NAn9w+LCiQyNzl3IHuAH64T0Ifn6nxCVJMgrtml+wl4y4oL/DjNOLPFFKob1EH02G/q+iX5QAeZyBQxypDCI9QVUUKGK8gkAKjDI2tIIT1UptMaZE36SyoxReg19vjqxpqwv1aga1tOAvid1+NfZv7NHEmkbefPgebJXXAYC0+nanHYWbKzGGgrbyn0cDPx96kYlO842JoxpTNRLiPNS5oqTYNz9Wjd603rQtX886ZguIItD6hcX3WMtg7MVsRlY+URlLZPronsLom9kXrqKptyCCA4/+wk+s0CK1GTQ3Mj6/nd12KClrOlqVccos4R4ZEZe9lW6n+CrxT9cuefTN/pKXy99HXRd7JfQrDpynOTxNsq8rVWnwQxeXiDlUce0A9lunKtocB7P29TsXppbQgUsv/LMEipWf0B2Z4OlJA7CglK4JPDxefeJ1Z4JS3JEBuf8QHtXarEaWJ+tK5p1L7m/vek6p6v6MA3l3Me/O5aw/sU00v9WwQf8l5t4f8mbl4dgVp2fRbXhGgz0pQxwIdkm4nEyq9yPLeqhmbvzsvt7w/UadSXEojJ/IXWptqxbQc+mu+uxyM5uPjeEimcnBxwq3vk= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(52116014)(376014)(23010399003)(1800799024)(5113699003)(22082099003)(18002099003)(38350700014)(56012099006)(5023799004)(261022075727099003)(10067099003)(261028144727099003)(261021121427099003)(261022105027099003)(261009223027099003)(261026121527099003)(261026140227099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?QTFrSWRUSXBseHZhMmVXMWk2ZWxhVjRXMlZYaTY0Tkd0d1BNYkhFZVc3Ri96?= =?utf-8?B?VkFOVUpJSzl3RndVL3ZRb3lUdzVHcy9mMFFNaGhZY0dEa0cwdm4rOStRTEpV?= =?utf-8?B?VXViQldUWUNlYWpsdGxMZ092dDNsSGpUMkF5QSszR1FMT05Ia0RFZTBDK1l0?= =?utf-8?B?TEZzVXRCRlM2eE0vK2EweXQyeTk0MmZWYlRMbStKOWt3ZTRleUhzUGc2L0ZU?= =?utf-8?B?WnRZbDc3ZTJDdWRlL1k1T2RHNjIxTUNWcGhadHRjN2lKVUhrYVdYcElpK3R5?= =?utf-8?B?SnNtZHhLcjN4SDZJUjdOdzhkcDczbXd0YkhmcXpZT01QSGxveVJWNUg1WXpm?= =?utf-8?B?TnNwb0c1YXhuMTRuMlVpd092VXdhVm9YaTU3ZXhOTDdUNE5JNFZOSmt4ZlFX?= =?utf-8?B?N0JVNmtHUU0vVzlDSGZnQWRoWS9KMjFMWFJPSjJRYlRyeXhnRXpscExBYytk?= =?utf-8?B?dkZFTVNJRUduTUp2b0oxOUlVNGlBQzBNMUNocDYzWW1jaWV4bUFGbzVscUJH?= =?utf-8?B?NTdmbXhNTHNrUXZCR2RHUHpRbXhVcUcvT0NPbm5KNGxOOE1NMDVRRlI1ejIv?= =?utf-8?B?NWtPU1FncEVNZDNPREQwVXdzTHFod0tlSm81WmZ0cVdCb2x6ZmZXT1hEZDUz?= =?utf-8?B?bUtwbDhGRERibld2NUFMeG5wY1l1dHlPcS9IeUlYVU1DejV4THFwV3FPeTNa?= =?utf-8?B?Q1RFNzZ2NElLZlBBRXBLdFZWdXNYd28rQlVZcFlnVW1GQ0FhQzFMUlRnL0hO?= =?utf-8?B?RThuRFlkajhhd3VaczNwMUlLczBZN1FXSlVCUFB5RTFFU2ZtZUJhMGhlTith?= =?utf-8?B?U0Y3ZTF0bjc5cXZxZTVNbklnVkcrRStNRHpheHhwU2lwWENuSmhIa2Z6aXk5?= =?utf-8?B?YzRuYVYvTDRtZDNxWWZvUUk2Unh5ZkE2QklUa0RjRWoyQ0JLcHJsZ3lDNzI4?= =?utf-8?B?L29QQlpQUDkzTysrNGRodTJTdVY2U202WHhQZ3hPaThFbFlOamYvWGlCTGdI?= =?utf-8?B?REpFQmQ4eU9VSFdBZUdUQ1ByZXZPNWhYc01DOEdFcXFMekFCRjdaSU9QWm1v?= =?utf-8?B?cWlycjZFb2RLUU9udVBPQmlNZGdmc3JyeEVGa0tMaDRNdmw3NEUwZ2hFQzhJ?= =?utf-8?B?elNSMmNZMzc4ckNFT0drdUhQNDAwS3RuUjUwMzM5YVdyaDRNbXpjQW1FU0c0?= =?utf-8?B?bnFuQzRpNHJ2a3VTQmUvQXl2amFhVzkzcXBGSEN6Q00vb3RBdzlyMkErWVIz?= =?utf-8?B?OUx3aHp4SzNBNTZNYk5zYjlsRVhqU2t5cmxmRWpvQnd5VERKNk1ZMXBUWUNq?= =?utf-8?B?b2p2dzBaTUVBOVpwVy9vZTJKNzEreVAxMCtmQ3FiRm9wdllEbncrYnQvSTlO?= =?utf-8?B?WStQdE9jRmE4U0dYLzk4R3dNZkk0eDV3amFtRklwV00vQmxZQlAxSmpiN1BH?= =?utf-8?B?UUMxLzZUTHFoQXZQYmRlWE1FSnJJQUVsMkNXcTJGZzVMaVhYV0RQVEF2TjFO?= =?utf-8?B?QWtvdHRSK0ZFaXgzRWRqWmNXbnFmTW9zSnNMZWhadmt6MDJCNVFFUWpnSHpM?= =?utf-8?B?MVdpaDRqUFZCV0FqZTJJUFpMQkxWSzNqVklvNXRpVmlid3NsSWQ0Z1RYZjNz?= =?utf-8?B?S1dqekcwdWpDbXIvUExrVkIxalJERUxyUncrUUZ5VDZZYStTcVQ4V2VtQm9s?= =?utf-8?B?eWZHTjVYUk5WZWJ1bXdHdlMxYTZxODh1Zkg1Ky9OZzZsMWFoOTBTbHEvOWFB?= =?utf-8?B?TWxBQm9Weko5WE9EZUNpN1VZRXJsYklEUFlKb2dLYVNVZ3ZtbERmUDRjY1Br?= =?utf-8?B?anhLUFVFelJDN2YwSy82dlNVNkYwaDZ0YmlzOHJtclVWZUFhVHR1K1NYZjZq?= =?utf-8?B?NnhMMksxSVpnTEdjMmlGTDZ1VlJqNG1NcEoyeERrTWdFSE8ybDdPWHB2L0VM?= =?utf-8?B?UlRubDhyZTFyN29lT2JVVFFkRWlpMVpGVEtDZXVkUXd5SG45SEtHVmlydWI5?= =?utf-8?B?QWRTT080dHJSditMQ09mT0pYMUtWNXBEWTFIbEF2bm85bmpkb2o1NmlMVFBj?= =?utf-8?B?TzIxdHV5bGJETDdhSHd5K3Z4Y0NJQ0ZkRzU1U1BRc1d2ZG44WlU5MmVVMmU4?= =?utf-8?B?Vkk5OVpTWmRNbWhrV2syVElQWGw5b2V5QzBPWjhmNDVZVU5XN3dOYVdHN3BJ?= =?utf-8?B?Z3JRSXZIdmE1dFNBNTVDbDlhcW5tSzNnSkhxKy91a2VDcE5vM0N1STFyY0d0?= =?utf-8?B?U0pHVnM3QnB5WUdESDQ2cGs3aEcveldic1QxNWFwR1ZEQ3A1VU1rVGplTmxR?= =?utf-8?B?VW1OUHdCL2p4WXNSUlNoWW1XWmxUcHE2YVZtRmpuVThjV1dCTGkyOTJYTCtS?= =?utf-8?Q?AiS6N289S6eTIfWQ=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 0e1a3b7b-bde3-4faf-b13c-08df36947d5b X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Oct 2026 14:45:49.7389 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 36PCUpAXIlHB5WfvCegzwUA+mce1QQoYVLhTy3dfgNSD0oC80fMTPRzEe20IBba+gA435vHkd4GyrnKqxT9pFwH3xh8lUUpJ5vGvW2OCjzE= X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS1PR08MB7451 kvm_close() destroys the vCPUs, which unmaps their kvm_run areas, and the coalesced MMIO ring lives in the kvm_run area of the first vCPU. Nothing stops the RCU thread from flushing that ring at the same time: finalizing a memory region of a freed flatview calls memory_region_transaction_begin() and thus kvm_flush_coalesced_mmio_buffer(). kvm_state is still set at that point, so the flush reads the ring after it has been unmapped: #0 kvm_flush_coalesced_mmio_buffer accel/kvm/kvm-all.c #1 qemu_flush_coalesced_mmio_buffer #2 memory_region_transaction_begin #3 memory_region_finalize ... #10 flatview_destroy #11 call_rcu_thread while the main thread is in: kvm_close -> cpu_remove_sync vfio_kvm_device_close vfio_cpr_kvm_close_notifier (MIG_EVENT_PRECOPY_DONE) Seen as a SIGSEGV of the old QEMU during repeated cpr-exec of a VM with a VFIO device. Clear the ring pointer first, so that new flushes skip it, and wait for the pending RCU callbacks before destroying the vCPUs. Fixes: 7ed0919119b0 ("migration: close kvm after cpr") Signed-off-by: Andrey Drobyshev --- accel/kvm/kvm-all.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index 8b5d342af52..294a87043ef 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -630,6 +630,14 @@ void kvm_close(void) return; } + /* + * Destroying vCPUs unmaps the coalesced MMIO ring, while the RCU thread + * may be flushing it from a memory region finalizer. Stop new flushes + * and wait for the pending RCU callbacks first. + */ + kvm_state->coalesced_mmio_ring = NULL; + drain_call_rcu(); + CPU_FOREACH(cpu) { cpu_remove_sync(cpu); close(cpu->kvm_fd); -- 2.47.1