Re: [Qemu-devel] [PATCH] pc: make sure that guest isn't able to unplug the first cpu

[Greg Kurz <groug@kaod.org>]

On Mon, 27 Aug 2018 13:07:10 +0200
Igor Mammedov <imammedo@redhat.com> wrote:

> The first cpu unplug wasn't ever supported and corresponding
> monitor/qmp commands refuse to unplug it. However guest is able
> to issue eject request either using following command:
>   # echo 1 >/sys/devices/system/cpu/cpu0/firmware_node/eject

I can't reproduce the issue with a pc guest and current master...

All I seem to get is an error in dmesg:

[   97.435446] processor cpu0: Offline failed.

> or directly writing to cpu hotplug registers, which makes
> qemu crash with SIGSEGV following back trace:
> 
>    kvm_flush_coalesced_mmio_buffer ()
>        while (ring->first != ring->last)
>    ...
>    qemu_flush_coalesced_mmio_buffer
>    prepare_mmio_access
>    flatview_read_continue
>    flatview_read
>    address_space_read_full
>    address_space_rw
>    kvm_cpu_exec(cpu!0)
>    qemu_kvm_cpu_thread_fn
> 
> the reason for which is that ring == KVMState::coalesced_mmio_ring
> happens to be a part of 1st CPU that was uplugged by guest.
> 
> Fix it by forbidding 1st cpu unplug from guest side and in addition
> remove CPU0._EJ0 ACPI method to make clear that unplug of the first
> CPU is not supported.
> 
> Signed-off-by: Igor Mammedov <imammedo@redhat.com>
> ---
> CCing spapr and s390x folks in case targets need to prevent 1st CPU unplug as well
> 

A spapr guest can _release_ the first cpu by doing something like:

# echo -n "/cpus/PowerPC,POWER8@0" > /sys/devices/system/cpu/release

But AFAIK, this doesn't unplug the cpu from a QEMU standpoint.

> CC: mst@redhat.com
> CC: pbonzini@redhat.com
> CC: david@gibson.dropbear.id.au
> CC: groug@kaod.org
> CC: david@redhat.com
> CC: cohuck@redhat.com
> ---
>  hw/acpi/cpu.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/hw/acpi/cpu.c b/hw/acpi/cpu.c
> index 5ae595e..4bb8371 100644
> --- a/hw/acpi/cpu.c
> +++ b/hw/acpi/cpu.c
> @@ -117,7 +117,7 @@ static void cpu_hotplug_wr(void *opaque, hwaddr addr, uint64_t data,
>              DeviceState *dev = NULL;
>              HotplugHandler *hotplug_ctrl = NULL;
>  
> -            if (!cdev->cpu) {
> +            if (!cdev->cpu || cdev->cpu == first_cpu) {
>                  trace_cpuhp_acpi_ejecting_invalid_cpu(cpu_st->selector);
>                  break;
>              }
> @@ -541,9 +541,11 @@ void build_cpus_aml(Aml *table, MachineState *machine, CPUHotplugFeatures opts,
>                  aml_buffer(madt_buf->len, (uint8_t *)madt_buf->data)));
>              g_array_free(madt_buf, true);
>  
> -            method = aml_method("_EJ0", 1, AML_NOTSERIALIZED);
> -            aml_append(method, aml_call1(CPU_EJECT_METHOD, uid));
> -            aml_append(dev, method);
> +            if (CPU(arch_ids->cpus[i].cpu) != first_cpu) {
> +                method = aml_method("_EJ0", 1, AML_NOTSERIALIZED);
> +                aml_append(method, aml_call1(CPU_EJECT_METHOD, uid));
> +                aml_append(dev, method);
> +            }
>  
>              method = aml_method("_OST", 3, AML_SERIALIZED);
>              aml_append(method,