[PATCH v2 1/1] spapr.c: always pulse guest IRQ in spapr_core_unplug_request()

[Daniel Henrique Barboza <danielhb413@gmail.com>]

Commit 47c8c915b162 fixed a problem where multiple spapr_drc_detach()
requests were breaking QEMU. The solution was to just spapr_drc_detach()
once, and use spapr_drc_unplug_requested() to filter whether we
already detached it or not. The commit also tied the hotplug request
to the guest in the same condition.

Turns out that there is a reliable way for a CPU hotunplug to fail. If
a guest with one CPU hotplugs a CPU1, then offline CPU0s via
'echo 0 > /sys/devices/system/cpu/cpu0/online', then attempts to
hotunplug CPU1, the kernel will refuse it because it's the last online
CPU of the system. Given that we're pulsing the IRQ only in the first try,
in a failed attempt, all other CPU1 hotunplug attempts will fail, regardless
of the online state of CPU1 in the kernel, because we're simply not letting
the guest know that we want to hotunplug the device.

Let's move spapr_hotplug_req_remove_by_index() back out of the
"if (!spapr_drc_unplug_requested(drc))" conditional, allowing for multiple
'device_del' requests to the same CPU core to reach the guest, in case
the CPU core didn't fully hotunplugged previously. Granted, this is not
optimal because this can allow for multiple hotplug events queueing in the
guest, like it was already possible before 47c8c915b162.

Other possible alternatives would be:

- check if the given CPU is the last online CPU in the guest before attempting
to hotunplug. This can be done by checking 'cs->halted' and msr states of
the core. Problem is, this approach will fail if the guest offlines/onlines
a CPU while we're in the middle of the unplug request, given that we can't
control whether the CPU core states will change in the kernel. This option
sure makes it harder to allow a hotunplug failure to happen, but will never
be enough to fully avoid it;

- let the user handled it. In this case, we would advise the user to reboot the
guest and the CPU will be removed during machine reset.

None of the alternatives are clear winnners, so this patch goes for the approach
makes the IRQ queue of the guest prone to multiple hotunplug requests for the
same CPU, but at least the user can successfully hotunplug the CPU after a failed
attempt, without the need of guest reboot.

Reported-by: Xujun Ma <xuma@redhat.com>
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1911414
Signed-off-by: Daniel Henrique Barboza <danielhb413@gmail.com>
---
 hw/ppc/spapr.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index e9e3816cd3..e2f12ce413 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -3737,8 +3737,17 @@ void spapr_core_unplug_request(HotplugHandler *hotplug_dev, DeviceState *dev,
 
     if (!spapr_drc_unplug_requested(drc)) {
         spapr_drc_detach(drc);
-        spapr_hotplug_req_remove_by_index(drc);
     }
+
+    /*
+     * spapr_hotplug_req_remove_by_index is left unguarded, out of the
+     * "!spapr_drc_unplug_requested" check, to allow for multiple IRQ
+     * pulses removing the same CPU core. Otherwise, in an failed hotunplug
+     * attempt (e.g. the kernel will refuse to remove the last online CPU
+     * core), we will never attempt it again because unplug_requested will
+     * still be 'true' in that case.
+     */
+    spapr_hotplug_req_remove_by_index(drc);
 }
 
 int spapr_core_dt_populate(SpaprDrc *drc, SpaprMachineState *spapr,
-- 
2.26.2