On Wed, Mar 29, 2017 at 03:36:59PM +0200, Laszlo Ersek wrote: > On 03/29/17 14:51, Michael S. Tsirkin wrote: > > On Wed, Mar 29, 2017 at 01:58:29PM +0200, Laszlo Ersek wrote: > >> (8) When QEMU gets SIGBUS from the kernel -- I hope that's going to come > >> through a signalfd -- QEMU can format the CPER right into guest memory, > >> and then inject whatever interrupt (or assert whatever GPIO line) is > >> necessary for notifying the guest. > > > > I think I see a race condition potential - what if guest accesses > > CPER in guest memory while it's being written? > > I'm not entirely sure about the data flow here (these parts of the ACPI > spec are particularly hard to read...), but I thought the OS wouldn't > look until it got a notification. There could be multiple notifications, OS might be looking there because of them. > Or, are you concerned about the next CPER write by QEMU, while the OS is > reading the last one (and maybe the CPER area could wrap around?) > > > > > We can probably use another level of indirection to fix this: > > > > allocate twice the space, add a pointer to where the valid > > table is located and update that after writing CPER completely. > > The pointer can be written atomically but also needs to > > be read atomically, so I suspect it should be a single byte > > as we don't know how are OSPMs implementing this. > > > > A-B-A problem? (Is that usually solved with a cookie or a wider > generation counter? But that would again require wider atomics.) > > I do wonder though how this is handled on physical hardware. Assuming > the hardware error traps to the firmware first (which, on phys hw, is > responsible for depositing the CPER), in that scenario the phys firmware > would face the same issue (i.e., asynchronously interrupting the OS, > which could be reading the previously stored CPER). > > Thanks, > Laszlo ACPI spec seems to specify a set of serialization actions. I'm guessing this is what you need to use to avoid changing guest state while it's reading entries. -- MST
