CPU threads write exit_request as a "note to self" that they need to
go out to a slow path. This write happens out of the BQL and can be
a data race with another threads' cpu_exit(); use atomic accesses
consistently.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
accel/tcg/tcg-accel-ops-mttcg.c | 2 +-
accel/tcg/tcg-accel-ops-rr.c | 4 ++--
hw/ppc/spapr_hcall.c | 6 +++---
target/i386/kvm/kvm.c | 2 +-
target/i386/nvmm/nvmm-accel-ops.c | 2 +-
target/i386/nvmm/nvmm-all.c | 2 +-
target/i386/whpx/whpx-all.c | 6 +++---
7 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
index 337b993d3da..39237421757 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -85,7 +85,7 @@ static void *mttcg_cpu_thread_fn(void *arg)
qemu_guest_random_seed_thread_part2(cpu->random_seed);
/* process any pending work */
- cpu->exit_request = 1;
+ qatomic_set(&cpu->exit_request, 1);
do {
if (cpu_can_run(cpu)) {
diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index 1e551e92d6d..c06f3beef2e 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -212,7 +212,7 @@ static void *rr_cpu_thread_fn(void *arg)
cpu = first_cpu;
/* process any pending work */
- cpu->exit_request = 1;
+ qatomic_set(&cpu->exit_request, 1);
while (1) {
/* Only used for icount_enabled() */
@@ -286,7 +286,7 @@ static void *rr_cpu_thread_fn(void *arg)
/* Does not need a memory barrier because a spurious wakeup is okay. */
qatomic_set(&rr_current_cpu, NULL);
- if (cpu && cpu->exit_request) {
+ if (cpu && qatomic_read(&cpu->exit_request)) {
qatomic_set_mb(&cpu->exit_request, 0);
}
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 1e936f35e44..03a62b047b3 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -509,7 +509,7 @@ static target_ulong h_cede(PowerPCCPU *cpu, SpaprMachineState *spapr,
if (!cpu_has_work(cs)) {
cs->halted = 1;
cs->exception_index = EXCP_HLT;
- cs->exit_request = 1;
+ qatomic_set(&cs->exit_request, 1);
ppc_maybe_interrupt(env);
}
@@ -531,7 +531,7 @@ static target_ulong h_confer_self(PowerPCCPU *cpu)
}
cs->halted = 1;
cs->exception_index = EXCP_HALTED;
- cs->exit_request = 1;
+ qatomic_set(&cs->exit_request, 1);
ppc_maybe_interrupt(&cpu->env);
return H_SUCCESS;
@@ -624,7 +624,7 @@ static target_ulong h_confer(PowerPCCPU *cpu, SpaprMachineState *spapr,
}
cs->exception_index = EXCP_YIELD;
- cs->exit_request = 1;
+ qatomic_set(&cs->exit_request, 1);
cpu_loop_exit(cs);
return H_SUCCESS;
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 306430a0521..867eabc6969 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5604,7 +5604,7 @@ int kvm_arch_process_async_events(CPUState *cs)
if (env->exception_nr == EXCP08_DBLE) {
/* this means triple fault */
qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
- cs->exit_request = 1;
+ qatomic_set(&cs->exit_request, 1);
return 0;
}
kvm_queue_exception(env, EXCP12_MCHK, 0, 0);
diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
index 3799260bbde..3658a583bc8 100644
--- a/target/i386/nvmm/nvmm-accel-ops.c
+++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -77,7 +77,7 @@ static void nvmm_start_vcpu_thread(CPUState *cpu)
*/
static void nvmm_kick_vcpu_thread(CPUState *cpu)
{
- cpu->exit_request = 1;
+ qatomic_set(&cpu->exit_request, 1);
cpus_kick_thread(cpu);
}
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index a5e3485c1f8..d2d90f38976 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -414,7 +414,7 @@ nvmm_vcpu_pre_run(CPUState *cpu)
* or commit pending TPR access.
*/
if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
- cpu->exit_request = 1;
+ qatomic_set(&cpu->exit_request, 1);
}
if (!has_event && cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 9f88e368d4d..9b07716121a 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -1489,10 +1489,10 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT) &&
!(env->hflags & HF_SMM_MASK)) {
- cpu->exit_request = 1;
+ qatomic_set(&cpu->exit_request, 1);
}
if (cpu_test_interrupt(cpu, CPU_INTERRUPT_TPR)) {
- cpu->exit_request = 1;
+ qatomic_set(&cpu->exit_request, 1);
}
}
@@ -1539,7 +1539,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
if (tpr != vcpu->tpr) {
vcpu->tpr = tpr;
reg_values[reg_count].Reg64 = tpr;
- cpu->exit_request = 1;
+ qatomic_set(&cpu->exit_request, 1);
reg_names[reg_count] = WHvX64RegisterCr8;
reg_count += 1;
}
--
2.50.1On Fri, Aug 08, 2025 at 08:59:00PM +0200, Paolo Bonzini wrote: > CPU threads write exit_request as a "note to self" that they need to > go out to a slow path. This write happens out of the BQL and can be > a data race with another threads' cpu_exit(); use atomic accesses > consistently. > > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Reviewed-by: Peter Xu <peterx@redhat.com> -- Peter Xu
Paolo Bonzini <pbonzini@redhat.com> writes: > CPU threads write exit_request as a "note to self" that they need to > go out to a slow path. This write happens out of the BQL and can be > a data race with another threads' cpu_exit(); use atomic accesses > consistently. > > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> > --- > accel/tcg/tcg-accel-ops-mttcg.c | 2 +- > accel/tcg/tcg-accel-ops-rr.c | 4 ++-- > hw/ppc/spapr_hcall.c | 6 +++--- > target/i386/kvm/kvm.c | 2 +- > target/i386/nvmm/nvmm-accel-ops.c | 2 +- > target/i386/nvmm/nvmm-all.c | 2 +- > target/i386/whpx/whpx-all.c | 6 +++--- > 7 files changed, 12 insertions(+), 12 deletions(-) Could you please update include/hw/core/cpu.h with a doc patch to describe exit_request and note it should be read/written with qatomic primitives please. -- Alex Bennée Virtualisation Tech Lead @ Linaro
On 8/9/25 04:59, Paolo Bonzini wrote: > CPU threads write exit_request as a "note to self" that they need to > go out to a slow path. This write happens out of the BQL and can be > a data race with another threads' cpu_exit(); use atomic accesses > consistently. > > Signed-off-by: Paolo Bonzini<pbonzini@redhat.com> > --- > accel/tcg/tcg-accel-ops-mttcg.c | 2 +- > accel/tcg/tcg-accel-ops-rr.c | 4 ++-- > hw/ppc/spapr_hcall.c | 6 +++--- > target/i386/kvm/kvm.c | 2 +- > target/i386/nvmm/nvmm-accel-ops.c | 2 +- > target/i386/nvmm/nvmm-all.c | 2 +- > target/i386/whpx/whpx-all.c | 6 +++--- > 7 files changed, 12 insertions(+), 12 deletions(-) s/1/true/ Reviewed-by: Richard Henderson <richard.henderson@linaro.org> r~
On 8/8/25 20:59, Paolo Bonzini wrote: > CPU threads write exit_request as a "note to self" that they need to > go out to a slow path. This write happens out of the BQL and can be > a data race with another threads' cpu_exit(); use atomic accesses > consistently. > > Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> > --- > accel/tcg/tcg-accel-ops-mttcg.c | 2 +- > accel/tcg/tcg-accel-ops-rr.c | 4 ++-- > hw/ppc/spapr_hcall.c | 6 +++--- > target/i386/kvm/kvm.c | 2 +- > target/i386/nvmm/nvmm-accel-ops.c | 2 +- > target/i386/nvmm/nvmm-all.c | 2 +- > target/i386/whpx/whpx-all.c | 6 +++--- > 7 files changed, 12 insertions(+), 12 deletions(-) Cool, I have the same one locally but was not sure about myself there. Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
© 2016 - 2025 Red Hat, Inc.