On Mon, 16 Oct 2017 10:07:18 +0200
Igor Mammedov <imamm...@redhat.com> wrote:
> On Fri, 13 Oct 2017 12:05:46 +0200
> Greg Kurz <gr...@kaod.org> wrote:
>
> > On Fri, 13 Oct 2017 11:24:59 +0200
> > Igor Mammedov <imamm...@redhat.com> wrote:
> >
> > > On Fri, 13 Oct 2017 10:35:31 +0200
> > > Greg Kurz <gr...@kaod.org> wrote:
> > >
> > > > If a CPU selected with the "cpu" command is hot-unplugged then "info
> > > > cpus"
> > > > causes QEMU to exit:
> > > >
> > > > (qemu) device_del cpu1
> > > > (qemu) info cpus
> > > > qemu:qemu_cpu_kick_thread: No such process
> > > >
> > > > This happens because "cpu" stores the pointer to the selected CPU into
> > > > the monitor structure. When the CPU is hot-unplugged, we end up with a
> > > > dangling pointer. The "info cpus" command then does:
> > > >
> > > > hmp_info_cpus()
> > > > monitor_get_cpu_index()
> > > > mon_get_cpu()
> > > > cpu_synchronize_state() <--- called with dangling pointer
> > > >
> > > > This could cause a QEMU crash as well.
> > > >
> > > > This patch switches the monitor to use object_ref() to ensure the
> > > > CPU object doesn't vanish unexpectedly. The reference is dropped
> > > > either when "cpu" is used to switch to another CPU, or when the
> > > > selected CPU is unrealized and cpu_list_remove() sets its cpu_index
> > > > back to UNASSIGNED_CPU_INDEX.
> > > I don't really like an idea of leaving dangling cpu around.
> > > Is it possible to store QOM path on set_cpu in monitor and
> > > resolving it each to instance each time it's needed?
> > >
> >
> > It sounds workable. Also it would allow the fix to not depend on patch 1
> > for ppc.
> yep,
> also if you'd touch these cpu_index based monitor commands,
> it might make sense to convert them to use qmo path directly
> instead if cpu_index (with command completion it would be
> easy to use)
>
Ok, I'll look into that but I'm not sure I can work something out
before soft freeze (2017-10-31 AFAIK).
>
> >
> > Thanks for the suggestion!
> >
> > >
> > > > Signed-off-by: Greg Kurz <gr...@kaod.org>
> > > > ---
> > > > monitor.c | 12 ++++++++++++
> > > > 1 file changed, 12 insertions(+)
> > > >
> > > > diff --git a/monitor.c b/monitor.c
> > > > index fe0d1bdbb461..1c0b9a2c3ad3 100644
> > > > --- a/monitor.c
> > > > +++ b/monitor.c
> > > > @@ -579,6 +579,9 @@ static void monitor_data_init(Monitor *mon)
> > > >
> > > > static void monitor_data_destroy(Monitor *mon)
> > > > {
> > > > + if (mon->mon_cpu) {
> > > > + object_unref((Object *) mon->mon_cpu);
> > > > + }
> > > > qemu_chr_fe_deinit(&mon->chr, false);
> > > > if (monitor_is_qmp(mon)) {
> > > > json_message_parser_destroy(&mon->qmp.parser);
> > > > @@ -1047,12 +1050,21 @@ int monitor_set_cpu(int cpu_index)
> > > > if (cpu == NULL) {
> > > > return -1;
> > > > }
> > > > + if (cur_mon->mon_cpu) {
> > > > + object_unref((Object *) cur_mon->mon_cpu);
> > > > + }
> > > > cur_mon->mon_cpu = cpu;
> > > > + object_ref((Object *) cpu);
> > > > return 0;
> > > > }
> > > >
> > > > CPUState *mon_get_cpu(void)
> > > > {
> > > > + if (cur_mon->mon_cpu &&
> > > > + cur_mon->mon_cpu->cpu_index == UNASSIGNED_CPU_INDEX) {
> > > > + object_unref((Object *) cur_mon->mon_cpu);
> > > > + cur_mon->mon_cpu = NULL;
> > > > + }
> > > > if (!cur_mon->mon_cpu) {
> > > > if (!first_cpu) {
> > > > return NULL;
> > > >
> > > >
> > >
> >
>
