From nobody Mon Feb 9 23:01:31 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (208.118.235.17 [208.118.235.17]) by mx.zohomail.com with SMTPS id 15133179206751.1149317815953736; Thu, 14 Dec 2017 22:05:20 -0800 (PST) Received: from localhost ([::1]:44630 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ePj7L-0004LC-1I for importer@patchew.org; Fri, 15 Dec 2017 01:05:07 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53201) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ePixM-0003dO-Hx for qemu-devel@nongnu.org; Fri, 15 Dec 2017 00:54:49 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ePixL-0004f5-3p for qemu-devel@nongnu.org; Fri, 15 Dec 2017 00:54:48 -0500 Received: from ozlabs.org ([2401:3900:2:1::2]:59103) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1ePixK-0004bF-P1; Fri, 15 Dec 2017 00:54:47 -0500 Received: by ozlabs.org (Postfix, from userid 1007) id 3yyflN6TZCz9tBC; Fri, 15 Dec 2017 16:54:40 +1100 (AEDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=gibson.dropbear.id.au; s=201602; t=1513317280; bh=ltY9xQA+/JqHX1Uu0eVNvp2FJ3D4FSr6dpSARvVOIdU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jrJbEcP+E9mdn/9V/ajNi8iGnZHI0Uc5Pzl20TkTgHThcdy9Djea3uwJzoekocXSD sAPe+Os4oiQY1CB5nP/s3hp0TxwEmo8EfDr0ZNXkaZeCwgiJIRqsgRVF9AtqJrO1mD OwF7HyD7x7WOHGafZMn3847O+JeSlKRnOHPv9ZJ4= From: David Gibson To: peter.maydell@linaro.org Date: Fri, 15 Dec 2017 16:54:21 +1100 Message-Id: <20171215055435.24204-11-david@gibson.dropbear.id.au> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20171215055435.24204-1-david@gibson.dropbear.id.au> References: <20171215055435.24204-1-david@gibson.dropbear.id.au> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 2401:3900:2:1::2 Subject: [Qemu-devel] [PULL 10/24] spapr/rtas: disable the decrementer interrupt when a CPU is unplugged X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: lvivier@redhat.com, agraf@suse.de, mdroth@linux.vnet.ibm.com, qemu-devel@nongnu.org, groug@kaod.org, qemu-ppc@nongnu.org, =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= , David Gibson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZohoMail: RDKM_2 RSF_0 Z_629925259 SPT_0 Content-Type: text/plain; charset="utf-8" From: C=C3=A9dric Le Goater When a CPU is stopped with the 'stop-self' RTAS call, its state 'halted' is switched to 1 and, in this case, the MSR is not taken into account anymore in the cpu_has_work() routine. Only the pending hardware interrupts are checked with their LPCR:PECE* enablement bit. If the DECR timer fires after 'stop-self' is called and before the CPU 'stop' state is reached, the nearly-dead CPU will have some work to do and the guest will crash. This case happens very frequently with the not yet upstream P9 XIVE exploitation mode. In XICS mode, the DECR is occasionally fired but after 'stop' state, so no work is to be done and the guest survives. I suspect there is a race between the QEMU mainloop triggering the timers and the TCG CPU thread but I could not quite identify the root cause. To be safe, let's disable in the LPCR all the exceptions which can cause an exit while the CPU is in power-saving mode and reenable them when the CPU is started. Signed-off-by: C=C3=A9dric Le Goater Signed-off-by: David Gibson --- hw/ppc/spapr_rtas.c | 11 +++++++++++ target/ppc/translate_init.c | 9 ++++++--- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c index cdf0b607a0..858adb1bf3 100644 --- a/hw/ppc/spapr_rtas.c +++ b/hw/ppc/spapr_rtas.c @@ -162,6 +162,7 @@ static void rtas_start_cpu(PowerPCCPU *cpu_, sPAPRMachi= neState *spapr, if (cpu !=3D NULL) { CPUState *cs =3D CPU(cpu); CPUPPCState *env =3D &cpu->env; + PowerPCCPUClass *pcc =3D POWERPC_CPU_GET_CLASS(cpu); =20 if (!cs->halted) { rtas_st(rets, 0, RTAS_OUT_HW_ERROR); @@ -174,6 +175,10 @@ static void rtas_start_cpu(PowerPCCPU *cpu_, sPAPRMach= ineState *spapr, kvm_cpu_synchronize_state(cs); =20 env->msr =3D (1ULL << MSR_SF) | (1ULL << MSR_ME); + + /* Enable Power-saving mode Exit Cause exceptions for the new CPU = */ + env->spr[SPR_LPCR] |=3D pcc->lpcr_pm; + env->nip =3D start; env->gpr[3] =3D r3; cs->halted =3D 0; @@ -197,6 +202,7 @@ static void rtas_stop_self(PowerPCCPU *cpu, sPAPRMachin= eState *spapr, { CPUState *cs =3D CPU(cpu); CPUPPCState *env =3D &cpu->env; + PowerPCCPUClass *pcc =3D POWERPC_CPU_GET_CLASS(cpu); =20 cs->halted =3D 1; qemu_cpu_kick(cs); @@ -210,6 +216,11 @@ static void rtas_stop_self(PowerPCCPU *cpu, sPAPRMachi= neState *spapr, * no need to bother with specific bits, we just clear it. */ env->msr =3D 0; + + /* Disable Power-saving mode Exit Cause exceptions for the CPU. + * This could deliver an interrupt on a dying CPU and crash the + * guest */ + env->spr[SPR_LPCR] &=3D ~pcc->lpcr_pm; } =20 static inline int sysparm_st(target_ulong addr, target_ulong len, diff --git a/target/ppc/translate_init.c b/target/ppc/translate_init.c index 074c3a1d45..70ff15a51a 100644 --- a/target/ppc/translate_init.c +++ b/target/ppc/translate_init.c @@ -8911,6 +8911,7 @@ void cpu_ppc_set_papr(PowerPCCPU *cpu, PPCVirtualHype= rvisor *vhyp) CPUPPCState *env =3D &cpu->env; ppc_spr_t *lpcr =3D &env->spr_cb[SPR_LPCR]; ppc_spr_t *amor =3D &env->spr_cb[SPR_AMOR]; + CPUState *cs =3D CPU(cpu); =20 cpu->vhyp =3D vhyp; =20 @@ -8953,10 +8954,12 @@ void cpu_ppc_set_papr(PowerPCCPU *cpu, PPCVirtualHy= pervisor *vhyp) } } =20 - /* Also set the power-saving mode bits which depend on the CPU - * family + /* Only enable Power-saving mode Exit Cause exceptions on the boot + * CPU. The RTAS command start-cpu will enable them on secondaries. */ - lpcr->default_value |=3D pcc->lpcr_pm; + if (cs =3D=3D first_cpu) { + lpcr->default_value |=3D pcc->lpcr_pm; + } =20 /* We should be followed by a CPU reset but update the active value * just in case... --=20 2.14.3