[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-ppc] [PULL 24/28] spapr_cpu_core: add missing rollback on realizat
From: |
David Gibson |
Subject: |
[Qemu-ppc] [PULL 24/28] spapr_cpu_core: add missing rollback on realization path |
Date: |
Mon, 18 Jun 2018 13:53:20 +1000 |
From: Greg Kurz <address@hidden>
The spapr_realize_vcpu() function doesn't rollback in case of error.
This isn't a problem with coldplugged CPUs because the machine won't
start and QEMU will exit. Hotplug is a different story though: the
CPU thread is started under object_property_set_bool() and it assumes
it can access the CPU object.
If icp_create() fails, we return an error without unregistering the
reset handler for this CPU, and we let the underlying QEMU thread for
this CPU alive. Since spapr_cpu_core_realize() doesn't care to unrealize
already realized CPUs either, but happily frees all of them anyway, the
CPU thread crashes instantly:
(qemu) device_add host-spapr-cpu-core,core-id=1,id=gku
GKU: failing icp_create (cpu 0x11497fd0)
^^^^^^^^^^
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffee3feaa0 (LWP 24725)]
0x00000000104c8374 in object_dynamic_cast_assert (obj=0x11497fd0,
^^^^^^^^^^^^^^
pointer to the CPU object
623 trace_object_dynamic_cast_assert(obj ? obj->class->type->name
(gdb) p obj->class->type
$1 = (Type) 0x0
(gdb) p * obj
$2 = {class = 0x10ea9c10, free = 0x11244620,
^^^^^^^^^^
should be g_free
(gdb) p g_free
$3 = {<text variable, no debug info>} 0x7ffff282bef0 <g_free>
obj is a dangling pointer to the CPU that was just destroyed in
spapr_cpu_core_realize().
This patch adds proper rollback to both spapr_realize_vcpu() and
spapr_cpu_core_realize().
Signed-off-by: Greg Kurz <address@hidden>
[dwg: Fixed a conflict due to a change in my tree]
Signed-off-by: David Gibson <address@hidden>
---
hw/ppc/spapr_cpu_core.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/hw/ppc/spapr_cpu_core.c b/hw/ppc/spapr_cpu_core.c
index a9bb2d61e8..30a7cf9e03 100644
--- a/hw/ppc/spapr_cpu_core.c
+++ b/hw/ppc/spapr_cpu_core.c
@@ -145,11 +145,14 @@ static void spapr_realize_vcpu(PowerPCCPU *cpu,
sPAPRMachineState *spapr,
cpu->intc = icp_create(OBJECT(cpu), spapr->icp_type, XICS_FABRIC(spapr),
&local_err);
if (local_err) {
- goto error;
+ goto error_unregister;
}
return;
+error_unregister:
+ qemu_unregister_reset(spapr_cpu_reset, cpu);
+ cpu_remove_sync(CPU(cpu));
error:
error_propagate(errp, local_err);
}
@@ -208,11 +211,15 @@ static void spapr_cpu_core_realize(DeviceState *dev,
Error **errp)
for (j = 0; j < cc->nr_threads; j++) {
spapr_realize_vcpu(sc->threads[j], spapr, &local_err);
if (local_err) {
- goto err;
+ goto err_unrealize;
}
}
return;
+err_unrealize:
+ while (--j >= 0) {
+ spapr_unrealize_vcpu(sc->threads[j]);
+ }
err:
while (--i >= 0) {
obj = OBJECT(sc->threads[i]);
--
2.17.1
- [Qemu-ppc] [PULL 20/28] pnv: Clean up cpu realize path, (continued)
- [Qemu-ppc] [PULL 20/28] pnv: Clean up cpu realize path, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 15/28] mos6522: expose mos6522_update_irq() through MOS6522DeviceClass, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 16/28] sm501: Do not clear read only bits when writing registers, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 18/28] pnv: Fix some error handling cpu realize(), David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 19/28] pnv_core: Allocate cpu thread objects individually, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 10/28] adb: add property to disable direct reg 3 writes, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 05/28] ppc: introduce Core99MachinesState for the mac99 machine, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 22/28] spapr_cpu_core: convert last snprintf() to g_strdup_printf(), David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 27/28] target/ppc, spapr: Move VPA information to machine_data, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 06/28] mac_newworld: add via machine option to control mac99 VIA/ADB configuration, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 24/28] spapr_cpu_core: add missing rollback on realization path,
David Gibson <=
- [Qemu-ppc] [PULL 12/28] xics_kvm: fix a build break, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 23/28] spapr_cpu_core: fix potential leak in spapr_cpu_core_realize(), David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 21/28] pnv: Add cpu unrealize path, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 17/28] spapr: Clean up cpu realize/unrealize paths, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 07/28] mac_newworld: add gpios to macio devices with PMU enabled, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 28/28] spapr: fix xics_system_init() error path, David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 25/28] spapr_cpu_core: introduce spapr_create_vcpu(), David Gibson, 2018/06/17
- [Qemu-ppc] [PULL 11/28] mac_newworld: add PMU device, David Gibson, 2018/06/17
- Re: [Qemu-ppc] [PULL 00/28] ppc-for-3.0 queue 20180618, Peter Maydell, 2018/06/19