This avoids the chance of reading a corrupted list of CPUs in usermode.
Note: this breaks hw/ppc/spapr due to the removal of CPU_FOREACH_REVERSE.
Signed-off-by: Emilio G. Cota <c...@braap.org>
---
exec.c | 16 ++++++++++++++--
include/qom/cpu.h | 15 +++++++--------
linux-user/main.c | 2 +-
linux-user/syscall.c | 2 +-
4 files changed, 23 insertions(+), 12 deletions(-)
diff --git a/exec.c b/exec.c
index ae6f416..58cd096 100644
--- a/exec.c
+++ b/exec.c
@@ -87,7 +87,7 @@ static MemoryRegion io_mem_unassigned;
#endif
-struct CPUTailQ cpus = QTAILQ_HEAD_INITIALIZER(cpus);
+struct CPUTailQ cpus = QLIST_HEAD_INITIALIZER(cpus);
/* current CPU in the current thread. It is only valid inside
cpu_exec() */
__thread CPUState *current_cpu;
@@ -596,7 +596,19 @@ void cpu_exec_init(CPUState *cpu, Error **errp)
#endif
return;
}
- QTAILQ_INSERT_TAIL(&cpus, cpu, node);
+ /* poor man's QLIST_INSERT_TAIL_RCU */
+ if (QLIST_EMPTY_RCU(&cpus)) {
+ QLIST_INSERT_HEAD_RCU(&cpus, cpu, node);
+ } else {
+ CPUState *some_cpu;
+
+ CPU_FOREACH(some_cpu) {
+ if (QLIST_NEXT_RCU(some_cpu, node) == NULL) {
+ QLIST_INSERT_AFTER_RCU(some_cpu, cpu, node);
+ break;
+ }
+ }
+ }
#if defined(CONFIG_USER_ONLY)
cpu_list_unlock();
#endif
diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index f383c24..ab484be 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -30,6 +30,7 @@
#include "qemu/seqlock.h"
#include "qemu/thread.h"
#include "qemu/typedefs.h"
+#include "qemu/rcu_queue.h"
typedef int (*WriteCoreDumpFunction)(const void *buf, size_t size,
void *opaque);
@@ -300,7 +301,7 @@ struct CPUState {
struct GDBRegisterState *gdb_regs;
int gdb_num_regs;
int gdb_num_g_regs;
- QTAILQ_ENTRY(CPUState) node;
+ QLIST_ENTRY(CPUState) node;
/* ice debug support */
QTAILQ_HEAD(breakpoints_head, CPUBreakpoint) breakpoints;
@@ -338,15 +339,13 @@ struct CPUState {
volatile sig_atomic_t tcg_exit_req;
};
-QTAILQ_HEAD(CPUTailQ, CPUState);
+QLIST_HEAD(CPUTailQ, CPUState);
extern struct CPUTailQ cpus;
-#define CPU_NEXT(cpu) QTAILQ_NEXT(cpu, node)
-#define CPU_FOREACH(cpu) QTAILQ_FOREACH(cpu, &cpus, node)
+#define CPU_NEXT(cpu) QLIST_NEXT_RCU(cpu, node)
+#define CPU_FOREACH(cpu) QLIST_FOREACH_RCU(cpu, &cpus, node)
#define CPU_FOREACH_SAFE(cpu, next_cpu) \
- QTAILQ_FOREACH_SAFE(cpu, &cpus, node, next_cpu)
-#define CPU_FOREACH_REVERSE(cpu) \
- QTAILQ_FOREACH_REVERSE(cpu, &cpus, CPUTailQ, node)
-#define first_cpu QTAILQ_FIRST(&cpus)
+ QLIST_FOREACH_SAFE_RCU(cpu, &cpus, node, next_cpu)
+#define first_cpu QLIST_FIRST_RCU(&cpus)
extern __thread CPUState *current_cpu;
diff --git a/linux-user/main.c b/linux-user/main.c
index 98ebe19..3e10bd8 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -121,7 +121,7 @@ void fork_end(int child)
Discard information about the parent threads. */
CPU_FOREACH_SAFE(cpu, next_cpu) {
if (cpu != thread_cpu) {
- QTAILQ_REMOVE(&cpus, thread_cpu, node);
+ QLIST_REMOVE_RCU(thread_cpu, node);
}
}
pending_cpus = 0;
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 732936f..e166313 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -5604,7 +5604,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1,
cpu_list_lock();
/* Remove the CPU from the list. */
- QTAILQ_REMOVE(&cpus, cpu, node);
+ QLIST_REMOVE(cpu, node);
cpu_list_unlock();
ts = cpu->opaque;
if (ts->child_tidptr) {
--
1.9.1
