From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazon11021136.outbound.protection.outlook.com [52.101.70.136]) by lore.virtuozzo.com (Postfix) with ESMTPS id E4874810A0 for ; Mon, 2 Nov 2026 10:36:38 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=s/IKIYG187JoOHzNqEKjaEZPUzQsZBwP7GedzAKcSVtl3MesGzr0yY1V/T0CM565fVVIfNHKhK+Jhla0Gs9yLUGwG4GZfH6OUGwBAhBVz2lQH5UKORwbzCpChposPq/4gYhae8OjBC9w/WQ+9VxAoBxruVn+wvI1/6Cbu/woX0hWarYGvEb2sOvnkSEFtNYJ2zKPB18s/H/ZXKHVcodg9jL56OO5HKCiE/84UGso94ICR8L3HdzQ/bARBFKh1mlL4PGfy0fUjq0BpU9ktTTweQGNq4TEIbUwRNtCosQG49///2U/Rvbw/E2QNwYcpGAHdBQnHtAbThjt51+HZ95uhA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=kNP9/NATiFYrjeAMP5KgSxysv89ttm0Zo1jTTf7JgqU=; b=ZWljyIA5KVtPDy+2bKW/y53p+zG/YRpqMg7I5ofaCWEnlsmJ3MJcPcxYyP5GfO6ZCcK7hVlhcsBRZaX2D2bHk+T6x43vBrMKZfebPNndKcle9JzWDKNwby515TCRExmjRM6Nj5ycm2J8f+NWPSFnR2griYzdyO0jU+wszHxTuP0CisOxAbb30D1kcPIIgAv3UK18JW/jGPnjhiXkj9FPqaeaXgWKKgL9jdat9hom679rKOiCac1cxy7aPgqnQzRymQy3wlXyjYSCQbNiVxuu73ncGhqszNeLbUNm5kcX5aCuC0vR/8/ekhILaz4UBCm34XOidl3tJxgshTa1hcxcLQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=kNP9/NATiFYrjeAMP5KgSxysv89ttm0Zo1jTTf7JgqU=; b=cTuLmwStWRfPRApoUx3yHMniGxQvBtAPeRu4dc1MvlyydpaJaxa1shG7ZRmGfnD7yY4dv21wBOYWaMQL5vfEw3p/KMjy4GIr07xfBG+NkfLSrm7GfG+iMgkVEIg1aFyVXFY2wpgO0KacP05prPByciR7g77Ravde2lp3M6VzSPS0BQdx+IUxvCjL+6NQuEiAh+Xr3c2Wa14kf6Riw2zPOApeUR+50IcKDqQxVCeHeDNBS8J+drxqHfsn6DWCE+hrkndX2Xy0BHWlyS5uMJ8OPBLHX638NhhLtw8AvCmShgrz3sPCABPKvQjZQvcfaAmwllrOmBlLpQxJt6Mqhy2AqA== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DB4PR08MB8199.eurprd08.prod.outlook.com (2603:10a6:10:381::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Mon, 2 Nov 2026 10:36:37 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.011; Mon, 2 Nov 2026 10:36:37 +0000 From: Andrey Drobyshev Date: Mon, 02 Nov 2026 12:36:38 +0200 Subject: [PATCH QEMU HCI-8.1 v6 23/34] kvm: fix coalesced MMIO flush racing with kvm_close() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261102-vfio_v1-v6-23-9bc7cabc850d@virtuozzo.com> References: <20261102-vfio_v1-v6-0-9bc7cabc850d@virtuozzo.com> In-Reply-To: <20261102-vfio_v1-v6-0-9bc7cabc850d@virtuozzo.com> To: svt-core@virtuozzo.com Cc: Andrey Drobyshev X-Mailer: b4 0.16.0 X-ClientProxiedBy: VIVP296CA0048.AUTP296.PROD.OUTLOOK.COM (2603:10a6:800:353::18) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DB4PR08MB8199:EE_ X-MS-Office365-Filtering-Correlation-Id: c5deedc8-f7ef-46fd-b73d-08df38cd2835 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|23010399003|52116014|376014|38350700014|5023799004|56012099006|261009223027099003|261028144727099003|261026121527099003|261021121427099003|261026140227099003|261022105027099003|261022075727099003|10067099003|18002099003|22082099003|5113699003; X-Microsoft-Antispam-Message-Info: Ew3R+wZ0vpO69j961bRMc3W0KyVxu7Oi7tDG3ipoqqWIxV5eGhoOwdRR6Gh5UlrPPgfi7El6Vu9P07ndCaGE8AGBcpmAyF1yrps2/tPZ5xg9yXWkXS67mE8xsh8DwxMgwzcDy47BhsxPTw8YkQNMakUNqTIR7L9leWsWXaVAi3IfNjyZXi51HzLrQotv3bkZ6wvtTdaSNsvK94CSB8uz5HdcAys+PTeOJinxP92sDaH5/masDR2bKcyLFs0JXIZG972CUS+lk5Db6//BGEa9deT+GYh5c4nYkcNcir+gThpJaFTlEM5uEyQZwoHjCJ2REhiUlhnJhZDWdrke5NEoJR4xAyoadehQnY5UY7wf/gF7YHNpgBHYkEm5b3Y9hc7MsmibCOPw0xuk9ysBGHkSj0VGyHybr1r8MKNPKKJ4c8eQA5S3b48dTvnv9hTm7jfoPQED7KiCv+W4o6zskUORW42avJS0H/MRPajis4z6iK/Qr8ek2tlH2QwDqtAX0JjkOA/q2SJ+v2+5sUdzcEM7PytD+cxmhNfxFOVZVO6NzJR4EQKMzROz1yyoafbVCO06NYG04V/Cgkn6fUgaL3SCepk8/WBOpz9nMYz0u+iaZ7Q/dpotqW2T/qbgQLEcd9K4WtG0AjkXbc/gbu6kT7eozqfeEpPCsCjA+ay+h1Nfynoj6qRLWRXfR39jsvMX9heXjxwto+FSaE9VW2ioeTOxsXUH4nhpynV5ir+qxsHnpp8= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(23010399003)(52116014)(376014)(38350700014)(5023799004)(56012099006)(261009223027099003)(261028144727099003)(261026121527099003)(261021121427099003)(261026140227099003)(261022105027099003)(261022075727099003)(10067099003)(18002099003)(22082099003)(5113699003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?WE9rLzlTU2hoSUFtbjRGNHR6MkIyTWdRTGVGcTlVS0cyMlJaUmpTc2tDQWdv?= =?utf-8?B?RFo2RlZrVUN1dlZQVkZqRzZSMXVKZ2ZMZzhZWTFUcTBYTzd5dWlrUS85cGN2?= =?utf-8?B?dTc0eWc0T3haNlZzN2JLeTg1RGZxT1JweisxdWNnclh3dStPRStqSGplRWhW?= =?utf-8?B?VGpQblVuYjdvZHVDblMycER5ckM3V3ZCV0g1Zkd0VUREUm1DUzVWVi9FZmc1?= =?utf-8?B?MzIzK0ttYXBUaUVSU3pNaFU5T0c3bEVucGpoMlM0WkU3S2p5bHoyS3doVFlK?= =?utf-8?B?eHhDRUJoZ241d1RSVzc5VEMrWVUyY1NqSWtXNEZQMXdQSHhMa3JYSzN4ZjN6?= =?utf-8?B?MUZua2t4L1dlelBYQlN2cytJSDN3S0l3NzVIblY4OXp5MDJLUEpubndQcjdE?= =?utf-8?B?Mm84QnpNVSs2U2lrZ1lPeklqekRBZVFjMTVnQ2lzbkN3cG9JY25yOFlGTEpR?= =?utf-8?B?TEgwYUlPVjBuY2FtMnM3aUFrM1ArL2VMYmZIa3RlbEZiSnVIeitlL21tWElm?= =?utf-8?B?QkRCZkNHMEZmTEhWVTRLKzlGbFgvNldEU3owT2h1Zkp4Z0Rjc01PZ01DRXo4?= =?utf-8?B?YUJncXUvRlc0NkpFanRTVEpzMnBYLzU2YitPbjNWaTlZVWhONFZBZTBXMVps?= =?utf-8?B?OVNhamQxMkVtWm1MN3pkUGVjczAvOGNUc1dBMXkzc01UazhBY2FTdWR6aGZX?= =?utf-8?B?N0RjRk9ldE1GL0Q4NWpzcUxUWUUwaXVtaGVVS3FKTFRjL0g3eVRZMFAxOGdS?= =?utf-8?B?WlFNUXB5R2srcUJZaVFnMzlkRmw4ZkJjVFg5bnJGYkpybDg4QmFRQVdQdHcz?= =?utf-8?B?azJrd01tUndhVWZEU1NYWnV5UWVCQXg0SU9NMlhCak1WUzc0dmlYNmNzUi9X?= =?utf-8?B?OVdrcjNnMU9YZlNQaUx3L21XY3RIbmpRUlZPL0Q0cDVOSjVnOGFNN0Rsa2ZV?= =?utf-8?B?ZUcwZVNsWGdFRFpmblVVRHVudnJLUjB1QUNBLzl5azcyNUJyemxyRGZBOUxs?= =?utf-8?B?WUxPWGp2TXp1Mm1pMU1iSW9zUGRKcysyQjc3WnUrQ3NOY0FtYU5GUDdpL2c1?= =?utf-8?B?NGltYnBScytwaWIvQTEzVFd1anBxQmtyZkRxaUhWVGp4WFk5NDc1NXp5SXZh?= =?utf-8?B?SUpWSmpRTm5EQ1pyU1l3WU1sdnhrYkJiejZNV3pZaW5EbzRLWFRkL0V6U2V1?= =?utf-8?B?TEVaaDNLTG1EQ3cvZTRMQTByMDFUQTN2cm5ZTTJDeXJHU3NiUCtWK2xQNEh4?= =?utf-8?B?TjNXRDEwVVYvT3MwRGFiMWt2N2VqTE5WQnMrR0RVeGtPb3JsVkgxWGxUS01l?= =?utf-8?B?ZSthbXgrNUwxbEFmRmpRaUlhQWtrSCtkUmNyUG54Qy9WaG9IQlZLRS9vc0Za?= =?utf-8?B?R3ZMS1pKU3dENVNSTFRLUFFLVWRBMnE2ZjhwaElPdnNZanh1MU02TXhDNW1j?= =?utf-8?B?WHhiamJEVkU3VkJZRDV5ZXdYTUd4RU56akV6OVJsQ1VUQ2VJcDdCeS91L2t6?= =?utf-8?B?K1QyVXBEVWtMYkEwYk1iNnlRL1V2cDdSdXBkeHBBTlcvUWtWN2JYSjNFdjRs?= =?utf-8?B?aTUwcFRjM3ZySllwSEc2LzB1VUluK0hudGpKY1pLcWtMSWlsaVZqeVlQZFR0?= =?utf-8?B?WisrL0Z0Q01GV0o5RW9yWGhCMzdiSmJTWW1iWVp5VkNIUUpqYWhiZFlNaW9h?= =?utf-8?B?bSt2T0hUQU03cHRGN3M1TkI4VXhNM3REbVRQUlkwdHdKRVNxQ3RTcCtXS0Jo?= =?utf-8?B?dHhCbEMyL3hXcDFEak44S2ZxQ2l1REcwQm05VkNWbFYwQjFDMVlSNmtzbzY1?= =?utf-8?B?eG03NkJpS1UyZ1AvN0dKeVNOM3VLK2Q1R2pRMG1UQ1VLNGRGVEFHaEtUN0xW?= =?utf-8?B?aXFOS0YzN2ljN2JvcFNVZCt6c1Y0OFVNVVhMam1sK25PUllJNzdmZUtUcS94?= =?utf-8?B?SXpXY01yT1BNUFVUd081cmxqVUU0dC9DSTBDNkk5dVo5UlEyN0tUb0FHaFpz?= =?utf-8?B?RkdYcjVaU056c2dCTkFnOVh3dEY1ZkcxcUxYNEZCb29zYkMvQlVyRThiemQr?= =?utf-8?B?ZnJYbllQSjlWcXNUdUh1azNoZHQrUE5CWHIvbGY3WEd1bk9TZG00c1U2V1pE?= =?utf-8?B?dGM4ZTlxUERReXMydWNFa05JR1NldWRwTmw0R3g0dXk0OGpiWnRKUHdwbFZM?= =?utf-8?B?UURremNPb2RyRFVoeWY2UXo1SGF4bFZNTmFEcjBnWGxhL0hmMVJOSmhGNFh0?= =?utf-8?B?RUw0VXdTbHFpYU16QWs2T2pkcVQwUG5MK0NOWlUwNm9ad1FHTkFrOHhhd0dk?= =?utf-8?B?MHh5cnc4T0xIN0w5bzFweWMwU1lQRVUvMXB2Zk10YnBkTDR0VC9hRVQ2N1RV?= =?utf-8?Q?nNhzf1fFTsVmjV44=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: c5deedc8-f7ef-46fd-b73d-08df38cd2835 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2026 10:36:30.5143 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: BExP3z2nvKpksmb3hzOpSKYOGkrq8LoQ2xxWaxvbfVNE9j2lfYHPz50QbCrBS0hSIYk3Rv8n8/Aqx7MvbMwoaBfWHSKGe8JKtyrjHQ82xRk= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB4PR08MB8199 kvm_close() destroys the vCPUs, which unmaps their kvm_run areas, and the coalesced MMIO ring lives in the kvm_run area of the first vCPU. Nothing stops the RCU thread from flushing that ring at the same time: finalizing a memory region of a freed flatview calls memory_region_transaction_begin() and thus kvm_flush_coalesced_mmio_buffer(). kvm_state is still set at that point, so the flush reads the ring after it has been unmapped: #0 kvm_flush_coalesced_mmio_buffer accel/kvm/kvm-all.c #1 qemu_flush_coalesced_mmio_buffer #2 memory_region_transaction_begin #3 memory_region_finalize ... #10 flatview_destroy #11 call_rcu_thread while the main thread is in: kvm_close -> cpu_remove_sync vfio_kvm_device_close vfio_cpr_kvm_close_notifier (MIG_EVENT_PRECOPY_DONE) Seen as a SIGSEGV of the old QEMU during repeated cpr-exec of a VM with a VFIO device. Clear the ring pointer first, so that new flushes skip it, and wait for the pending RCU callbacks before destroying the vCPUs. Fixes: 7ed0919119b0 ("migration: close kvm after cpr") Signed-off-by: Andrey Drobyshev --- accel/kvm/kvm-all.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index 8b5d342af52..294a87043ef 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -630,6 +630,14 @@ void kvm_close(void) return; } + /* + * Destroying vCPUs unmaps the coalesced MMIO ring, while the RCU thread + * may be flushing it from a memory region finalizer. Stop new flushes + * and wait for the pending RCU callbacks first. + */ + kvm_state->coalesced_mmio_ring = NULL; + drain_call_rcu(); + CPU_FOREACH(cpu) { cpu_remove_sync(cpu); close(cpu->kvm_fd); -- 2.47.1