From 25c9780d38d4494f8610371d883865cf40b35dd6 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Tue, 13 Aug 2019 15:59:18 +1000 Subject: [PATCH 1/2] spapr: Reset CAS & IRQ subsystem after devices MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This fixes a nasty regression in qemu-4.1 for the 'pseries' machine, caused by the new "dual" interrupt controller model. Specifically, qemu can crash when used with KVM if a 'system_reset' is requested while there's active I/O in the guest. The problem is that in spapr_machine_reset() we: 1. Reset the CAS vector state spapr_ovec_cleanup(spapr->ov5_cas); 2. Reset all devices qemu_devices_reset() 3. Reset the irq subsystem spapr_irq_reset(); However (1) implicitly changes the interrupt delivery mode, because whether we're using XICS or XIVE depends on the CAS state. We don't properly initialize the new irq mode until (3) though - in particular setting up the KVM devices. During (2), we can temporarily drop the BQL allowing some irqs to be delivered which will go to an irq system that's not properly set up. Specifically, if the previous guest was in (KVM) XIVE mode, the CAS reset will put us back in XICS mode. kvm_kernel_irqchip() still returns true, because XIVE was using KVM, however XICs doesn't have its KVM components intialized and kernel_xics_fd == -1. When the irq is delivered it goes via ics_kvm_set_irq() which assert()s that kernel_xics_fd != -1. This change addresses the problem by delaying the CAS reset until after the devices reset. The device reset should quiesce all the devices so we won't get irqs delivered while we mess around with the IRQ. The CAS reset and irq re-initialize should also now be under the same BQL critical section so nothing else should be able to interrupt it either. We also move the spapr_irq_msi_reset() used in one of the legacy irq modes, since it logically makes sense at the same point as the spapr_irq_reset() (it's essentially an equivalent operation for older machine types). Since we don't need to switch between different interrupt controllers for those old machine types it shouldn't actually be broken in those cases though. Cc: Cédric Le Goater Fixes: b2e22477 "spapr: add a 'reset' method to the sPAPR IRQ backend" Fixes: 13db0cd9 "spapr: introduce a new sPAPR IRQ backend supporting XIVE and XICS" Signed-off-by: David Gibson --- hw/ppc/spapr.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c index 821f0d4a49..12ed4b065c 100644 --- a/hw/ppc/spapr.c +++ b/hw/ppc/spapr.c @@ -1726,6 +1726,18 @@ static void spapr_machine_reset(MachineState *machine) spapr_setup_hpt_and_vrma(spapr); } + /* + * NVLink2-connected GPU RAM needs to be placed on a separate NUMA node. + * We assign a new numa ID per GPU in spapr_pci_collect_nvgpu() which is + * called from vPHB reset handler so we initialize the counter here. + * If no NUMA is configured from the QEMU side, we start from 1 as GPU RAM + * must be equally distant from any other node. + * The final value of spapr->gpu_numa_id is going to be written to + * max-associativity-domains in spapr_build_fdt(). + */ + spapr->gpu_numa_id = MAX(1, nb_numa_nodes); + qemu_devices_reset(); + /* * If this reset wasn't generated by CAS, we should reset our * negotiated options and start from scratch @@ -1741,18 +1753,6 @@ static void spapr_machine_reset(MachineState *machine) spapr_irq_msi_reset(spapr); } - /* - * NVLink2-connected GPU RAM needs to be placed on a separate NUMA node. - * We assign a new numa ID per GPU in spapr_pci_collect_nvgpu() which is - * called from vPHB reset handler so we initialize the counter here. - * If no NUMA is configured from the QEMU side, we start from 1 as GPU RAM - * must be equally distant from any other node. - * The final value of spapr->gpu_numa_id is going to be written to - * max-associativity-domains in spapr_build_fdt(). - */ - spapr->gpu_numa_id = MAX(1, nb_numa_nodes); - qemu_devices_reset(); - /* * This is fixing some of the default configuration of the XIVE * devices. To be called after the reset of the machine devices. From 310cda5b5e9df642b19a0e9c504368ffba3b3ab9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= Date: Tue, 13 Aug 2019 08:48:53 +0200 Subject: [PATCH 2/2] spapr/xive: Fix migration of hot-plugged CPUs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The migration sequence of a guest using the XIVE exploitation mode relies on the fact that the states of all devices are restored before the machine is. This is not true for hot-plug devices such as CPUs which state come after the machine. This breaks migration because the thread interrupt context registers are not correctly set. Fix migration of hotplugged CPUs by restoring their context in the 'post_load' handler of the XiveTCTX model. Fixes: 277dd3d7712a ("spapr/xive: add migration support for KVM") Signed-off-by: Cédric Le Goater Message-Id: <20190813064853.29310-1-clg@kaod.org> Signed-off-by: David Gibson --- hw/intc/spapr_xive_kvm.c | 19 +++++++++++++++++-- hw/intc/xive.c | 21 ++++++++++++++++++++- include/hw/ppc/xive.h | 1 + 3 files changed, 38 insertions(+), 3 deletions(-) diff --git a/hw/intc/spapr_xive_kvm.c b/hw/intc/spapr_xive_kvm.c index 3bf8e7a20e..8898615c69 100644 --- a/hw/intc/spapr_xive_kvm.c +++ b/hw/intc/spapr_xive_kvm.c @@ -72,11 +72,17 @@ static void kvm_cpu_disable_all(void) * XIVE Thread Interrupt Management context (KVM) */ -static void kvmppc_xive_cpu_set_state(XiveTCTX *tctx, Error **errp) +void kvmppc_xive_cpu_set_state(XiveTCTX *tctx, Error **errp) { + SpaprXive *xive = SPAPR_MACHINE(qdev_get_machine())->xive; uint64_t state[2]; int ret; + /* The KVM XIVE device is not in use yet */ + if (xive->fd == -1) { + return; + } + /* word0 and word1 of the OS ring. */ state[0] = *((uint64_t *) &tctx->regs[TM_QW1_OS]); @@ -655,7 +661,16 @@ int kvmppc_xive_post_load(SpaprXive *xive, int version_id) } } - /* Restore the thread interrupt contexts */ + /* + * Restore the thread interrupt contexts of initial CPUs. + * + * The context of hotplugged CPUs is restored later, by the + * 'post_load' handler of the XiveTCTX model because they are not + * available at the time the SpaprXive 'post_load' method is + * called. We can not restore the context of all CPUs in the + * 'post_load' handler of XiveTCTX because the machine is not + * necessarily connected to the KVM device at that time. + */ CPU_FOREACH(cs) { PowerPCCPU *cpu = POWERPC_CPU(cs); diff --git a/hw/intc/xive.c b/hw/intc/xive.c index cf77bdb7d3..da148e9f6f 100644 --- a/hw/intc/xive.c +++ b/hw/intc/xive.c @@ -615,12 +615,31 @@ static int vmstate_xive_tctx_pre_save(void *opaque) return 0; } +static int vmstate_xive_tctx_post_load(void *opaque, int version_id) +{ + Error *local_err = NULL; + + if (kvm_irqchip_in_kernel()) { + /* + * Required for hotplugged CPU, for which the state comes + * after all states of the machine. + */ + kvmppc_xive_cpu_set_state(XIVE_TCTX(opaque), &local_err); + if (local_err) { + error_report_err(local_err); + return -1; + } + } + + return 0; +} + static const VMStateDescription vmstate_xive_tctx = { .name = TYPE_XIVE_TCTX, .version_id = 1, .minimum_version_id = 1, .pre_save = vmstate_xive_tctx_pre_save, - .post_load = NULL, /* handled by the sPAPRxive model */ + .post_load = vmstate_xive_tctx_post_load, .fields = (VMStateField[]) { VMSTATE_BUFFER(regs, XiveTCTX), VMSTATE_END_OF_LIST() diff --git a/include/hw/ppc/xive.h b/include/hw/ppc/xive.h index 55c53c7417..736335174a 100644 --- a/include/hw/ppc/xive.h +++ b/include/hw/ppc/xive.h @@ -438,5 +438,6 @@ void kvmppc_xive_source_set_irq(void *opaque, int srcno, int val); void kvmppc_xive_cpu_connect(XiveTCTX *tctx, Error **errp); void kvmppc_xive_cpu_synchronize_state(XiveTCTX *tctx, Error **errp); void kvmppc_xive_cpu_get_state(XiveTCTX *tctx, Error **errp); +void kvmppc_xive_cpu_set_state(XiveTCTX *tctx, Error **errp); #endif /* PPC_XIVE_H */