On 27.08.2018 13:07, Igor Mammedov wrote:
> The first cpu unplug wasn't ever supported and corresponding
> monitor/qmp commands refuse to unplug it. However guest is able
> to issue eject request either using following command:
> # echo 1 >/sys/devices/system/cpu/cpu0/firmware_node/eject
> or directly writing to cpu hotplug registers, which makes
> qemu crash with SIGSEGV following back trace:
>
> kvm_flush_coalesced_mmio_buffer ()
> while (ring->first != ring->last)
> ...
> qemu_flush_coalesced_mmio_buffer
> prepare_mmio_access
> flatview_read_continue
> flatview_read
> address_space_read_full
> address_space_rw
> kvm_cpu_exec(cpu!0)
> qemu_kvm_cpu_thread_fn
>
> the reason for which is that ring == KVMState::coalesced_mmio_ring
> happens to be a part of 1st CPU that was uplugged by guest.
>
> Fix it by forbidding 1st cpu unplug from guest side and in addition
> remove CPU0._EJ0 ACPI method to make clear that unplug of the first
> CPU is not supported.
>
> Signed-off-by: Igor Mammedov <imamm...@redhat.com>
> ---
> CCing spapr and s390x folks in case targets need to prevent 1st CPU unplug as
> well
No unplug on s390x, so we're fine.
>
> CC: m...@redhat.com
> CC: pbonz...@redhat.com
> CC: da...@gibson.dropbear.id.au
> CC: gr...@kaod.org
> CC: da...@redhat.com
> CC: coh...@redhat.com
> ---
> hw/acpi/cpu.c | 10 ++++++----
> 1 file changed, 6 insertions(+), 4 deletions(-)
>
> diff --git a/hw/acpi/cpu.c b/hw/acpi/cpu.c
> index 5ae595e..4bb8371 100644
> --- a/hw/acpi/cpu.c
> +++ b/hw/acpi/cpu.c
> @@ -117,7 +117,7 @@ static void cpu_hotplug_wr(void *opaque, hwaddr addr,
> uint64_t data,
> DeviceState *dev = NULL;
> HotplugHandler *hotplug_ctrl = NULL;
>
> - if (!cdev->cpu) {
> + if (!cdev->cpu || cdev->cpu == first_cpu) {
> trace_cpuhp_acpi_ejecting_invalid_cpu(cpu_st->selector);
> break;
> }
> @@ -541,9 +541,11 @@ void build_cpus_aml(Aml *table, MachineState *machine,
> CPUHotplugFeatures opts,
> aml_buffer(madt_buf->len, (uint8_t *)madt_buf->data)));
> g_array_free(madt_buf, true);
>
> - method = aml_method("_EJ0", 1, AML_NOTSERIALIZED);
> - aml_append(method, aml_call1(CPU_EJECT_METHOD, uid));
> - aml_append(dev, method);
> + if (CPU(arch_ids->cpus[i].cpu) != first_cpu) {
> + method = aml_method("_EJ0", 1, AML_NOTSERIALIZED);
> + aml_append(method, aml_call1(CPU_EJECT_METHOD, uid));
> + aml_append(dev, method);
> + }
>
> method = aml_method("_OST", 3, AML_SERIALIZED);
> aml_append(method,
>
--
Thanks,
David / dhildenb
