quoted

So we have 4 actual exceptions:
* CriticalInput (some external device signaled this.  There are two
concepts of critical.  One is error the other is high priority)
However this would have the same caveats as any ExternalInput  
handler.

No, it's worse. It can interrupt code that normally has
local_irq_disabled() and thus doesn't expect to be interrupted. That
means that everything becomes unsafe including locks etc....

Fair.  Should local_irq_disable() clear MSR_SE & MSR_BE on classic  
parts?

Note that driver that want to make active use of that probably want  
some
explicit local_crit_irq_disable/enable functions to be able to  
implement
some sort of synchronization.

Or we could just have local_irq_disable -- clear MSR_EE and MSR_CE

quoted

* Watchdog - pretty severe if this fires.

* Debug - user space debug is pretty straight forward.  However we
have features like kprobes that require kernel level support.

Which means we have to be extra careful, in fact, I consider it a  
design
bug of BookE to have made debug be a critical interrupt...

I consider the whole BookE debug arch a design bug :)

- k