[PATCH] user-exec: abort if interrupt_request is used

[PATCH] user-exec: abort if interrupt_request is used

[Paolo Bonzini]

cpu_interrupt() is only called by a few user-mode emulation targets:
i386, ppc, sparc, arm.  For all of them it is dead code:

- i386 uses it for the A20 line

- ppc uses it in cpu_interrupt_exittb(), whose uses (but not the definition)
  are guarded by CONFIG_USER_ONLY

- likewise for sparc's cpu_check_irqs()

Arm has various uses in arm_cpu_update_v* and omap_wfi_write, but they are
also dead; disentangling the various cpregs accessors from user-mode
emulation is a work in progress.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
        A quick and dirty patch that I'd like to place before Igor's
        https://patchew.org/QEMU/20250814160600.2327672-1-imammedo@redhat.com/,
        to document that interrupt_request is dead for user-mode emulation.

        v2 of https://patchew.org/QEMU/20250808185905.62776-1-pbonzini@redhat.com/
        will also remove callers of cpu_interrupt() treewide.

 include/hw/core/cpu.h | 1 +
 accel/tcg/cpu-exec.c  | 6 ++++--
 accel/tcg/user-exec.c | 4 +---
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 5eaf41a566f..f73b4357c7b 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -423,6 +423,7 @@ struct qemu_work_item;
  * @created: Indicates whether the CPU thread has been successfully created.
  * @halt_cond: condition variable sleeping threads can wait on.
  * @interrupt_request: Indicates a pending interrupt request.
+ *   Only used by system emulation.
  * @halted: Nonzero if the CPU is in suspended state.
  * @stop: Indicates a pending stop request.
  * @stopped: Indicates the CPU has been artificially stopped.
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 713bdb20564..b44dd1e8205 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -778,6 +778,9 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
      */
     qatomic_set_mb(&cpu->neg.icount_decr.u16.high, 0);
 
+#ifdef CONFIG_USER_ONLY
+    g_assert(!qatomic_read(&cpu->interrupt_request));
+#else
     if (unlikely(qatomic_read(&cpu->interrupt_request))) {
         int interrupt_request;
         bql_lock();
@@ -792,7 +795,6 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
             bql_unlock();
             return true;
         }
-#if !defined(CONFIG_USER_ONLY)
         if (replay_mode == REPLAY_MODE_PLAY && !replay_has_interrupt()) {
             /* Do nothing */
         } else if (interrupt_request & CPU_INTERRUPT_HALT) {
@@ -840,7 +842,6 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
              * reload the 'interrupt_request' value */
             interrupt_request = cpu->interrupt_request;
         }
-#endif /* !CONFIG_USER_ONLY */
         if (interrupt_request & CPU_INTERRUPT_EXITTB) {
             cpu->interrupt_request &= ~CPU_INTERRUPT_EXITTB;
             /* ensure that no TB jump will be modified as
@@ -851,6 +852,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
         /* If we exit via cpu_loop_exit/longjmp it is reset in cpu_exec */
         bql_unlock();
     }
+#endif /* !CONFIG_USER_ONLY */
 
     /* Finally, check if we need to exit to the main loop.  */
     if (unlikely(qatomic_read(&cpu->exit_request)) || icount_exit_request(cpu)) {
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index f25d80e2dc2..748bfab04a7 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -48,9 +48,7 @@ __thread uintptr_t helper_retaddr;
 
 void cpu_interrupt(CPUState *cpu, int mask)
 {
-    g_assert(bql_locked());
-    cpu->interrupt_request |= mask;
-    qatomic_set(&cpu->neg.icount_decr.u16.high, -1);
+    g_assert_not_reached();
 }
 
 /*
-- 
2.51.0

Re: [PATCH] user-exec: abort if interrupt_request is used

[Richard Henderson]

On 8/29/25 21:11, Paolo Bonzini wrote:
> cpu_interrupt() is only called by a few user-mode emulation targets:
> i386, ppc, sparc, arm.  For all of them it is dead code:
> 
> - i386 uses it for the A20 line
> 
> - ppc uses it in cpu_interrupt_exittb(), whose uses (but not the definition)
>    are guarded by CONFIG_USER_ONLY
> 
> - likewise for sparc's cpu_check_irqs()
> 
> Arm has various uses in arm_cpu_update_v* and omap_wfi_write, but they are
> also dead; disentangling the various cpregs accessors from user-mode
> emulation is a work in progress.
> 
> Signed-off-by: Paolo Bonzini<pbonzini@redhat.com>
> ---
>          A quick and dirty patch that I'd like to place before Igor's
>          https://patchew.org/QEMU/20250814160600.2327672-1-imammedo@redhat.com/,
>          to document that interrupt_request is dead for user-mode emulation.
> 
>          v2 ofhttps://patchew.org/QEMU/20250808185905.62776-1-pbonzini@redhat.com/
>          will also remove callers of cpu_interrupt() treewide.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~