From nobody Fri May 3 12:41:58 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1507223208532759.7294085161795; Thu, 5 Oct 2017 10:06:48 -0700 (PDT) Received: from localhost ([::1]:41015 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e09bg-0004XE-O8 for importer@patchew.org; Thu, 05 Oct 2017 13:06:44 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34130) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e09M4-0008Hm-EB for qemu-devel@nongnu.org; Thu, 05 Oct 2017 12:50:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e09M0-0003Km-1I for qemu-devel@nongnu.org; Thu, 05 Oct 2017 12:50:36 -0400 Received: from 15.mo7.mail-out.ovh.net ([87.98.180.21]:40243) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e09Lz-0003Ck-S0 for qemu-devel@nongnu.org; Thu, 05 Oct 2017 12:50:31 -0400 Received: from player697.ha.ovh.net (b9.ovh.net [213.186.33.59]) by mo7.mail-out.ovh.net (Postfix) with ESMTP id 71ED96E786 for ; Thu, 5 Oct 2017 18:50:24 +0200 (CEST) Received: from zorba.kaod.org.com (LFbn-1-2231-173.w90-76.abo.wanadoo.fr [90.76.52.173]) (Authenticated sender: clg@kaod.org) by player697.ha.ovh.net (Postfix) with ESMTPSA id 3D44D480087; Thu, 5 Oct 2017 18:50:17 +0200 (CEST) From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= To: qemu-ppc@nongnu.org, qemu-devel@nongnu.org, David Gibson , Nikunj A Dadhania , Benjamin Herrenschmidt , Alexey Kardashevskiy Date: Thu, 5 Oct 2017 18:49:58 +0200 Message-Id: <20171005164959.26024-2-clg@kaod.org> X-Mailer: git-send-email 2.13.6 In-Reply-To: <20171005164959.26024-1-clg@kaod.org> References: <20171005164959.26024-1-clg@kaod.org> MIME-Version: 1.0 X-Ovh-Tracer-Id: 7120191012425730899 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeelledrledugddutdduucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuqfggjfdpvefjgfevmfevgfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddm Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 87.98.180.21 Subject: [Qemu-devel] [PATCH 1/2] spapr/rtas: disable the decrementer interrupt when a CPU is unplugged X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" When a CPU is stopped with the 'stop-self' RTAS call, its state 'halted' is switched to 1 and, in this case, the MSR is not taken into account anymore in the cpu_has_work() routine. Only the pending hardware interrupts are checked with their LPCR:PECE* enablement bit. If the DECR timer fires after 'stop-self' is called and before the CPU 'stop' state is reached, the nearly-dead CPU will have some work to do and the guest will crash. This case happens very frequently with the not yet upstream P9 XIVE exploitation mode. In XICS mode, the DECR is occasionally fired but after 'stop' state, so no work is to be done and the guest survives. I suspect there is a race between the QEMU mainloop triggering the timers and the TCG CPU thread but I could not quite identify the root cause. To be safe, let's disable the decrementer interrupt in the LPCR when the CPU is halted and reenable it when the CPU is restarted. Signed-off-by: C=C3=A9dric Le Goater --- hw/ppc/spapr_rtas.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c index cdf0b607a0a0..2389220c9738 100644 --- a/hw/ppc/spapr_rtas.c +++ b/hw/ppc/spapr_rtas.c @@ -174,6 +174,15 @@ static void rtas_start_cpu(PowerPCCPU *cpu_, sPAPRMach= ineState *spapr, kvm_cpu_synchronize_state(cs); =20 env->msr =3D (1ULL << MSR_SF) | (1ULL << MSR_ME); + + /* Enable DECR interrupt */ + if (env->mmu_model =3D=3D POWERPC_MMU_3_00) { + env->spr[SPR_LPCR] |=3D LPCR_DEE; + } else { + /* P7 and P8 both have same bit for DECR */ + env->spr[SPR_LPCR] |=3D LPCR_P8_PECE3; + } + env->nip =3D start; env->gpr[3] =3D r3; cs->halted =3D 0; @@ -210,6 +219,13 @@ static void rtas_stop_self(PowerPCCPU *cpu, sPAPRMachi= neState *spapr, * no need to bother with specific bits, we just clear it. */ env->msr =3D 0; + + if (env->mmu_model =3D=3D POWERPC_MMU_3_00) { + env->spr[SPR_LPCR] &=3D ~LPCR_DEE; + } else { + /* P7 and P8 both have same bit for DECR */ + env->spr[SPR_LPCR] &=3D ~LPCR_P8_PECE3; + } } =20 static inline int sysparm_st(target_ulong addr, target_ulong len, --=20 2.13.6 From nobody Fri May 3 12:41:58 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1507222799521792.2189310776215; Thu, 5 Oct 2017 09:59:59 -0700 (PDT) Received: from localhost ([::1]:40966 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e09Ux-0007Oc-HP for importer@patchew.org; Thu, 05 Oct 2017 12:59:47 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34158) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1e09M5-0008Ir-LY for qemu-devel@nongnu.org; Thu, 05 Oct 2017 12:50:42 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1e09M1-0003MW-7n for qemu-devel@nongnu.org; Thu, 05 Oct 2017 12:50:37 -0400 Received: from 12.mo7.mail-out.ovh.net ([178.33.107.167]:48030) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1e09M1-0003Ks-1D for qemu-devel@nongnu.org; Thu, 05 Oct 2017 12:50:33 -0400 Received: from player697.ha.ovh.net (b9.ovh.net [213.186.33.59]) by mo7.mail-out.ovh.net (Postfix) with ESMTP id A37866F5C0 for ; Thu, 5 Oct 2017 18:50:31 +0200 (CEST) Received: from zorba.kaod.org.com (LFbn-1-2231-173.w90-76.abo.wanadoo.fr [90.76.52.173]) (Authenticated sender: clg@kaod.org) by player697.ha.ovh.net (Postfix) with ESMTPSA id 6D7DA480087; Thu, 5 Oct 2017 18:50:24 +0200 (CEST) From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= To: qemu-ppc@nongnu.org, qemu-devel@nongnu.org, David Gibson , Nikunj A Dadhania , Benjamin Herrenschmidt , Alexey Kardashevskiy Date: Thu, 5 Oct 2017 18:49:59 +0200 Message-Id: <20171005164959.26024-3-clg@kaod.org> X-Mailer: git-send-email 2.13.6 In-Reply-To: <20171005164959.26024-1-clg@kaod.org> References: <20171005164959.26024-1-clg@kaod.org> MIME-Version: 1.0 X-Ovh-Tracer-Id: 7122161337206082387 X-VR-SPAMSTATE: OK X-VR-SPAMSCORE: -100 X-VR-SPAMCAUSE: gggruggvucftvghtrhhoucdtuddrfeelledrledugddutdduucetufdoteggodetrfdotffvucfrrhhofhhilhgvmecuqfggjfdpvefjgfevmfevgfenuceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddm Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 178.33.107.167 Subject: [Qemu-devel] [PATCH 2/2] spapr/rtas: do not reset the MSR in stop-self command X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" When a CPU is stopped with the 'stop-self' RTAS call, its state 'halted' is switched to 1 and, in this case, the MSR is not taken into account anymore in the cpu_has_work() routine. Only the pending hardware interrupts are checked with their LPCR:PECE* enablement bit. The CPU is now also protected from the decrementer interrupt by the LPCR:PECE* bits which are disabled in the 'stop-self' RTAS call. Reseting the MSR is pointless. Signed-off-by: C=C3=A9dric Le Goater Reviewed-by: David Gibson --- hw/ppc/spapr_rtas.c | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c index 2389220c9738..7f5ddce89ef2 100644 --- a/hw/ppc/spapr_rtas.c +++ b/hw/ppc/spapr_rtas.c @@ -209,16 +209,6 @@ static void rtas_stop_self(PowerPCCPU *cpu, sPAPRMachi= neState *spapr, =20 cs->halted =3D 1; qemu_cpu_kick(cs); - /* - * While stopping a CPU, the guest calls H_CPPR which - * effectively disables interrupts on XICS level. - * However decrementer interrupts in TCG can still - * wake the CPU up so here we disable interrupts in MSR - * as well. - * As rtas_start_cpu() resets the whole MSR anyway, there is - * no need to bother with specific bits, we just clear it. - */ - env->msr =3D 0; =20 if (env->mmu_model =3D=3D POWERPC_MMU_3_00) { env->spr[SPR_LPCR] &=3D ~LPCR_DEE; --=20 2.13.6