From c2d2a81b4196984fb74276826892838b5b69d92c Mon Sep 17 00:00:00 2001 From: Igor Mammedov Date: Mon, 27 Aug 2018 13:07:10 +0200 Subject: [PATCH] pc: make sure that guest isn't able to unplug the first cpu The first cpu unplug wasn't ever supported and corresponding monitor/qmp commands refuse to unplug it. However guest is able to issue eject request either using following command: # echo 1 >/sys/devices/system/cpu/cpu0/firmware_node/eject or directly writing to cpu hotplug registers, which makes qemu crash with SIGSEGV following back trace: kvm_flush_coalesced_mmio_buffer () while (ring->first != ring->last) ... qemu_flush_coalesced_mmio_buffer prepare_mmio_access flatview_read_continue flatview_read address_space_read_full address_space_rw kvm_cpu_exec(cpu!0) qemu_kvm_cpu_thread_fn the reason for which is that ring == KVMState::coalesced_mmio_ring happens to be a part of 1st CPU that was uplugged by guest. Fix it by forbidding 1st cpu unplug from guest side and in addition remove CPU0._EJ0 ACPI method to make clear that unplug of the first CPU is not supported. Signed-off-by: Igor Mammedov Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin --- hw/acpi/cpu.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/hw/acpi/cpu.c b/hw/acpi/cpu.c index 5ae595ecbe..4bb83713c5 100644 --- a/hw/acpi/cpu.c +++ b/hw/acpi/cpu.c @@ -117,7 +117,7 @@ static void cpu_hotplug_wr(void *opaque, hwaddr addr, uint64_t data, DeviceState *dev = NULL; HotplugHandler *hotplug_ctrl = NULL; - if (!cdev->cpu) { + if (!cdev->cpu || cdev->cpu == first_cpu) { trace_cpuhp_acpi_ejecting_invalid_cpu(cpu_st->selector); break; } @@ -541,9 +541,11 @@ void build_cpus_aml(Aml *table, MachineState *machine, CPUHotplugFeatures opts, aml_buffer(madt_buf->len, (uint8_t *)madt_buf->data))); g_array_free(madt_buf, true); - method = aml_method("_EJ0", 1, AML_NOTSERIALIZED); - aml_append(method, aml_call1(CPU_EJECT_METHOD, uid)); - aml_append(dev, method); + if (CPU(arch_ids->cpus[i].cpu) != first_cpu) { + method = aml_method("_EJ0", 1, AML_NOTSERIALIZED); + aml_append(method, aml_call1(CPU_EJECT_METHOD, uid)); + aml_append(dev, method); + } method = aml_method("_OST", 3, AML_SERIALIZED); aml_append(method, -- 2.11.0