commit 725ec898039dfed0a669bf78b556529b51e248e8
author Zhenzhong Duan <zhenzhong.duan@intel.com> Sun Sep 28 04:54:31 2025 -0400
committer Cédric Le Goater <clg@redhat.com> Wed Oct 22 08:12:52 2025 +0200
tree 4ef5848bb9aed3ea480c7e501e0e0ada382aaca5
parent 8bf49fff0dfbb065ad65daa48d2e1a63ad2fd552

accel/kvm: Fix an erroneous check on coalesced_mmio_ring

According to KVM uAPI, coalesced mmio page is KVM_COALESCED_MMIO_PAGE_OFFSET
offset from kvm_run pages. For x86 it's 2 pages offset, for arm it's 1 page
offset currently. We shouldn't presume it's hardcoded 1 page or else
coalesced_mmio_ring will not be cleared in do_kvm_destroy_vcpu() in x86.

Fixes: 7ed0919119b0 ("migration: close kvm after cpr")
Cc: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-6-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

accel/kvm/kvm-all.c

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 5603192..f9254ae 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -525,7 +525,8 @@
     }
 
     /* If I am the CPU that created coalesced_mmio_ring, then discard it */
-    if (s->coalesced_mmio_ring == (void *)cpu->kvm_run + PAGE_SIZE) {
+    if (s->coalesced_mmio_ring ==
+           (void *)cpu->kvm_run + s->coalesced_mmio * PAGE_SIZE) {
         s->coalesced_mmio_ring = NULL;
     }