From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022087.outbound.protection.outlook.com [52.101.66.87]) by lore.virtuozzo.com (Postfix) with ESMTPS id 64D3481231 for ; Tue, 3 Nov 2026 13:57:52 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=waET+sQZuwDXPk6lVhQeUdoOEmLQNaymBsOpMjkehiQbz2tm/8owNkc9CRNqwgZvxHI+ggJEDr+C28t6lsHGe9Rw/3qdYGdzanis7YqoWZd6FveZ9pSfUAo/+4KC4gDSaOFuGN3SuvTNy9YFPm/lG6vK2g2zgxVO789RvAOgE769HUrVonC4tJ6kmWGthdF37+pdOgPSD1n3c/RFSbGO25w1PZobI5Yh2eiMgxbZc7ukuXJOzlGTeYa4sp+LanFFxIQGgvsliySe3/QOuigEl8j3KHVtfDP/y0VQpVy4gybYNypgd4zmPTYcreMeHg/PEaH/oQBR17Si6eTZu3OoEg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=kNP9/NATiFYrjeAMP5KgSxysv89ttm0Zo1jTTf7JgqU=; b=ts3h3GhkzQSrrSyqNdyAWsync8cu1iFJLYHzCAXs1C1h3KQDCfsawu1We8y6SOKX204n0iZ1Ra6JfTV2swGU9FItWJgm1yMu3PNbvvbFszEfG79Nm7+jQiblQH8g2/c8N129QdxzD7iQz6itiiFsCAkplhKbKxqL4yhdQmMpvIwnGgXFIJA+0w2eN0hIySmaNk3VkfTdpqQq1l27evS3U8/00Wzl0A8TKvyA5Vfu5O+uaU40idqZvR0ygGuyhBP4MdfVLKCyDAzbjAjkIbzRNozy9N1kU031V9rAQTNZ7Ue2DZR5KWqYHA4/KEct0IHiooZ77NOtsLobnHurBHGJnQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=kNP9/NATiFYrjeAMP5KgSxysv89ttm0Zo1jTTf7JgqU=; b=VzBUnni3aUUuPMM3qjPS+72KSbfxRD0p5spct5P14d0cIpEJemWx9pRuslWK+RImLmBRY44/wMfmKFy/hPNs3AT/TQA730jdPzYHTeFGhpBgZCxoUrgHTBJ6Id9CxJPM1+XwAqXUsXaAJ+8Sioiq2PTBbBNL+kVLMZdxmBoOlmtYiSWXMhsY0C26GSbBi5FBT31I8dldctpUnf7ORrCto1Kp948TXoePcmJY6O0OCMYOIavtd5k7N2ByjeXfUj8W9Pujh8gJ1Y/KhFmip8aOr4rNvKS8QnEorREXiY3t8aefMf8xM1rA0Nl/SOfTOJEodXC5XMdEVwhShXgRUIvhTg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DB9PR08MB7423.eurprd08.prod.outlook.com (2603:10a6:10:370::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.12; Tue, 3 Nov 2026 13:57:51 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0569.011; Tue, 3 Nov 2026 13:57:51 +0000 From: Andrey Drobyshev Date: Tue, 03 Nov 2026 15:57:39 +0200 Subject: [PATCH QEMU HCI-8.1 v7 24/35] kvm: fix coalesced MMIO flush racing with kvm_close() Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20261103-vfio_v1-v7-24-4467fdccbbe6@virtuozzo.com> References: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> In-Reply-To: <20261103-vfio_v1-v7-0-4467fdccbbe6@virtuozzo.com> To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI4PEPF00000153.AUTP296.PROD.OUTLOOK.COM (2603:10a6:808:1::86f) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DB9PR08MB7423:EE_ X-MS-Office365-Filtering-Correlation-Id: e639a46f-1f76-4dd9-7d0a-08df39b2690a X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|1800799024|376014|52116014|23010399003|18002099003|22082099003|38350700014|56012099006|5023799004|261009223027099003|261102123227099003|261022075727099003|261028144727099003|261026140227099003|261021121427099003|261022105027099003|261026121527099003|10067099003|5113699003; X-Microsoft-Antispam-Message-Info: Bd+ypjBs/oSnLOcTjhwkDg6hXdS/NAIez5t34+zuMbSFSSs9k7GVSrJxWtFFLOgj4uQmEHouC99i4IGSCRkQfv+tyPFpVvAQBE3LfV/EmEVLfo5OEIzgkd4wdtrmk6QmJZ4D/lOebJ8ZSfbJShpWW1dvL00jkdRIxWfAvNZzHEPKzQA+jDCH210lW85vQyDzhP8ewdX3RzXgCRYpZzx4VqeM8FSZJTvtaUvkZzpe8Jufr7N32EvIqYKTt9KqcrYAzB4IxqbCU+zIq0cINuNCZAQKNYANQKOKl6jE/rSjVcbSLYjhSsAGjsrDZxMkDGkLmOB2DgyNufIiHVWlYDmIP4zbA3/5WTyGxQNAxw+5W2Zd2cGBnD3bXIIgSX1a2nr+4ovU6UXQDPfTLg6tYXScs5Zpv66zXKR6EBkDKSxn5/QdpFtEksS3m1UVYiyN8UA5zl87CclrX7Ni56R6hAR0BxDqOctjx104KhraRrUVYko6hyJWiMe53H+CAhRxaWSRI/CUMDyF7UP2Nvuekizeyvy3Vn6CLBcYrSllTgeOjrmYkdin9Vtf/ZbRlZ+ax0aya5jqcgoU0KzTa5k5jdUSO3pw2nIZIbLmQxqYvXpBBrmtwxaz1FNK1k3RGEpF2+1WM45L++W6h1/a8qs1KQ3HNLLKS+I1duCetPoahsoi0w7fD/1WXb1UcklCpYko7iVSsLCCIhuI7cl5/+0WKIprMk6Qf2iG9yNZtvwJ6mxycFo= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(366016)(1800799024)(376014)(52116014)(23010399003)(18002099003)(22082099003)(38350700014)(56012099006)(5023799004)(261009223027099003)(261102123227099003)(261022075727099003)(261028144727099003)(261026140227099003)(261021121427099003)(261022105027099003)(261026121527099003)(10067099003)(5113699003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?aXdaMmRuMjJVYU41V2ZWeGJhNkZHem1LVnhLdUxKTktnS2Zubnl1QkZ0WnBT?= =?utf-8?B?aXlRTVRVQVZmQWhFQ09Xc1M0ZnFNM0cyc0ZhMFdaemk3WkZTNXlRbnU5MmpK?= =?utf-8?B?VDkrcHVKZkRUbUJrd1BNQUZCUnlvVTRBN29xTFhSQlZBd0FLM0dPM1NYZmF2?= =?utf-8?B?SzZZWUgrYktiMFFmL2JsZ2hDZ3AwaVNIVGpCOU1kWDViMDkzVUpBbldjS05u?= =?utf-8?B?eThXaE5Uc2dpZjBMbnBGTU52VUJXSTZ2MjVOd2Y3cWh1ZndOUXgyanFkR1cy?= =?utf-8?B?c1NzeStIb3NhdW5TMEhiZGtnUGxMalBPZy9PUHNZeTJ1NEF3WktvRy9TUXMy?= =?utf-8?B?aElwTFZTMHA1ZDMyUHFPNTVoNUZtRXJPYkVsYU5raVByRzB0Z1lRUHNIRHMv?= =?utf-8?B?ZTA3Rksyc1pwQTM5TTJzb3VqTEZsUENoZ3Z3emE1U0d0SWZCc0N1UllsUXZH?= =?utf-8?B?N20xbHpiSHNtTTNicHZFSmM0dnRGaFQxTTJaMzV0Z0VzdWlRSEhqc0FSbG5E?= =?utf-8?B?SGVCRURyZjE2OXk3ZXFXMnV1V0lWSWlMMFp1MDJxNlNPT0dKMW1nOC9uMnNO?= =?utf-8?B?eHN6U2pGT25JV2E1R3didktCR3ZocVFDSDdwbWZBck95ZnpZNmN4ZGpabzc4?= =?utf-8?B?U1ZMZG1QOUxBOXcxbUVtNnFBcUFoNHZTVktsZ1dQSHRrc0llbVIwL1VTK0RN?= =?utf-8?B?dndRNmtTdE1lTEJrczNhWFdjbUFrSVk0VldFWnI3QkEyRW1aSURXUi82bi9s?= =?utf-8?B?bm1YMCtKemtTNGV2dmJXYnllM294L1N4akJwODRzVVJ1UTQ3WWp0L1ZzR0dT?= =?utf-8?B?ejhtcnpGeGNSWWVsbU9NKzNNczVXVndBV0ZpRWdZSDkwL2tVWFdHNnBXcWxW?= =?utf-8?B?Rkw0cTBwSklJUHpLaTZxRzBicXRjTGNTSEI4VjF5NXhQWWNRQXRrUWxPTnlM?= =?utf-8?B?ODBDcEcxYTZvK1g3YzRvZVA3elZVN1o1L2F4STlCUUlTZzlWcUtlVkNqRTQv?= =?utf-8?B?UithTG5SUVdPTkRNbXRMVFFqNnVBd2xYWDYzMUR4YUFjTGFDNm0rcmpYZVNK?= =?utf-8?B?R0FibVhiSUl0SHlSOU9LbTRCanQxYWJOc1VhZEl6ODJ0alNRWkx1VW9OQnJJ?= =?utf-8?B?MzVjTW1ZQ2RteE5mVXRla3JyWTJNMi9IcklJZ3JvSG1pYng1ekppMDUyM0xS?= =?utf-8?B?cmd0N21aNE1lemQrZERzQWNuQ2Z0aEVGQjRYS2R3SEI0Ry82UTAzdWkvN2Ix?= =?utf-8?B?LzVpY1M0TjFVWnJCeURLZ0ZmMFJvUHVkc2hqMVhhVG9vS1BxSHB1VzROS0gy?= =?utf-8?B?S1pKQ3BpOGU2VFZTQWFzTjlrQ2txOURpMHJwVkNmV1NOQU4wMGsrTU04WGhZ?= =?utf-8?B?ZDkxNTNzanF1aytodEtBWU9RZzY2NXJUODVNVDJZejllUnRKYi9RYXVOam8w?= =?utf-8?B?YmlhZk1jVFN5ZlpOSy83RVdBRlpQY1cweHp1MTJ3N1dYVHFlQlUzUlJjMlJz?= =?utf-8?B?RG5qWUJGWkpzQXlRa3NwdGJ5R096ZitHc2J3SDJxR0EwSlZVU0JZQnpKaUxO?= =?utf-8?B?akMzaWhYMkpxU1ZpL0llQ3drcjRoZ1BLbFJUR1QxUDFTUmhveGtyRDJQanRP?= =?utf-8?B?MzFHRnQ3QkhKTjJYazlrVGpIcnZ6S2pHbXB5UHRxbWtCRlAzUkxHTjR6Ylh5?= =?utf-8?B?cG5FMkJUUXhEaEV1R0lUWVMzTkE5cm1yV05EZHdUS3pTL244ejdXVExYNXlX?= =?utf-8?B?d1VJVUVZZ3IvRys3emIxdzFxc0t0OWRablA2SjR6cXNqYTBVVGNiWndQck9x?= =?utf-8?B?dkFZR0Y3M3dVRG5MTStCd3hLcVJTVkM1VzZIdVJncm1SdlYra2J0N2J6djNh?= =?utf-8?B?UDN6UmN4RndySU1UYjVhbTBEZEJ6c1VHYWdBQUdBM21WUm04ekRiNHZleVJE?= =?utf-8?B?blNjVElkSHVoY2ZQbnJvb0J1ZUZDNWpNTzdCNHFWQWxmdmFYSm9Ud0wzem91?= =?utf-8?B?Mkl3cXlVc1pRcHFlVzhpT2EybGJhTC9QM1FweHBhNldFcFNKVm41eENZNXZl?= =?utf-8?B?bmlxM21CdmhTYnpBMzR0ZzhxSmE5cGVMZ0ZxRnlSNDh5dHNwd2dCR1N6WUVJ?= =?utf-8?B?ZWVZRUFnN0lhZEpWTGlLN1Y0U0xWOUZKajdobG05Y3dZdGZWdWZacWgyc0dC?= =?utf-8?B?cEI0L1AwTThXR2c3QTRkMkJ3TXpCS2dmNjVPNURRQlByVEtwL01RcnpJR1JT?= =?utf-8?B?aURCb2hqOEE0M2FwR2xFZy94R1JPZGxjZUY1UDRhVkg4QndEU0gyVTU0dWdK?= =?utf-8?B?bGxkTWptdG5QTXpsSExzak13aFpiZ0czR3dXWlFKTlgxOVpNeXJBcS9YczZ3?= =?utf-8?Q?TGdd32b559m+Vzuc=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: e639a46f-1f76-4dd9-7d0a-08df39b2690a X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 03 Nov 2026 13:57:34.0412 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Mks8Vz/i14EDopUzo6euSBFtIrEXRAzt7lueWe9fzEVB8+x0i+7gERVepgpYEbCo4kBbzY7lnOhwHz9D36V4JYlCb9mj2MZgOSKURORbOSs= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9PR08MB7423 kvm_close() destroys the vCPUs, which unmaps their kvm_run areas, and the coalesced MMIO ring lives in the kvm_run area of the first vCPU. Nothing stops the RCU thread from flushing that ring at the same time: finalizing a memory region of a freed flatview calls memory_region_transaction_begin() and thus kvm_flush_coalesced_mmio_buffer(). kvm_state is still set at that point, so the flush reads the ring after it has been unmapped: #0 kvm_flush_coalesced_mmio_buffer accel/kvm/kvm-all.c #1 qemu_flush_coalesced_mmio_buffer #2 memory_region_transaction_begin #3 memory_region_finalize ... #10 flatview_destroy #11 call_rcu_thread while the main thread is in: kvm_close -> cpu_remove_sync vfio_kvm_device_close vfio_cpr_kvm_close_notifier (MIG_EVENT_PRECOPY_DONE) Seen as a SIGSEGV of the old QEMU during repeated cpr-exec of a VM with a VFIO device. Clear the ring pointer first, so that new flushes skip it, and wait for the pending RCU callbacks before destroying the vCPUs. Fixes: 7ed0919119b0 ("migration: close kvm after cpr") Signed-off-by: Andrey Drobyshev --- accel/kvm/kvm-all.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index 8b5d342af52..294a87043ef 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -630,6 +630,14 @@ void kvm_close(void) return; } + /* + * Destroying vCPUs unmaps the coalesced MMIO ring, while the RCU thread + * may be flushing it from a memory region finalizer. Stop new flushes + * and wait for the pending RCU callbacks first. + */ + kvm_state->coalesced_mmio_ring = NULL; + drain_call_rcu(); + CPU_FOREACH(cpu) { cpu_remove_sync(cpu); close(cpu->kvm_fd); -- 2.47.1