diff options
| author | Igor Mammedov <imammedo@redhat.com> | 2018-08-27 13:07:10 +0200 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2018-09-07 17:05:18 -0400 |
| commit | c2d2a81b4196984fb74276826892838b5b69d92c (patch) | |
| tree | 5b47b1c92bb73e0dd3d032ca4225a3d31b943939 /hw/acpi/cpu.c | |
| parent | 6755e618d09a81a82ab67a6163ffc9a39e743d0b (diff) | |
| download | qemu-c2d2a81b4196984fb74276826892838b5b69d92c.zip qemu-c2d2a81b4196984fb74276826892838b5b69d92c.tar.gz qemu-c2d2a81b4196984fb74276826892838b5b69d92c.tar.bz2 | |
pc: make sure that guest isn't able to unplug the first cpu
The first cpu unplug wasn't ever supported and corresponding
monitor/qmp commands refuse to unplug it. However guest is able
to issue eject request either using following command:
# echo 1 >/sys/devices/system/cpu/cpu0/firmware_node/eject
or directly writing to cpu hotplug registers, which makes
qemu crash with SIGSEGV following back trace:
kvm_flush_coalesced_mmio_buffer ()
while (ring->first != ring->last)
...
qemu_flush_coalesced_mmio_buffer
prepare_mmio_access
flatview_read_continue
flatview_read
address_space_read_full
address_space_rw
kvm_cpu_exec(cpu!0)
qemu_kvm_cpu_thread_fn
the reason for which is that ring == KVMState::coalesced_mmio_ring
happens to be a part of 1st CPU that was uplugged by guest.
Fix it by forbidding 1st cpu unplug from guest side and in addition
remove CPU0._EJ0 ACPI method to make clear that unplug of the first
CPU is not supported.
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw/acpi/cpu.c')
| -rw-r--r-- | hw/acpi/cpu.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/hw/acpi/cpu.c b/hw/acpi/cpu.c index 5ae595e..4bb8371 100644 --- a/hw/acpi/cpu.c +++ b/hw/acpi/cpu.c @@ -117,7 +117,7 @@ static void cpu_hotplug_wr(void *opaque, hwaddr addr, uint64_t data, DeviceState *dev = NULL; HotplugHandler *hotplug_ctrl = NULL; - if (!cdev->cpu) { + if (!cdev->cpu || cdev->cpu == first_cpu) { trace_cpuhp_acpi_ejecting_invalid_cpu(cpu_st->selector); break; } @@ -541,9 +541,11 @@ void build_cpus_aml(Aml *table, MachineState *machine, CPUHotplugFeatures opts, aml_buffer(madt_buf->len, (uint8_t *)madt_buf->data))); g_array_free(madt_buf, true); - method = aml_method("_EJ0", 1, AML_NOTSERIALIZED); - aml_append(method, aml_call1(CPU_EJECT_METHOD, uid)); - aml_append(dev, method); + if (CPU(arch_ids->cpus[i].cpu) != first_cpu) { + method = aml_method("_EJ0", 1, AML_NOTSERIALIZED); + aml_append(method, aml_call1(CPU_EJECT_METHOD, uid)); + aml_append(dev, method); + } method = aml_method("_OST", 3, AML_SERIALIZED); aml_append(method, |