debian/patches/extra/0012-hw-ide-reset-cancel-async-DMA-operation-before-reset.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Fiona Ebner <f.ebner@proxmox.com>
   3 Date: Thu, 24 Aug 2023 11:22:21 +0200
   4 Subject: [PATCH] hw/ide: reset: cancel async DMA operation before reseting
   5  state
   6
   7 If there is a pending DMA operation during ide_bus_reset(), the fact
   8 that the IDEstate is already reset before the operation is canceled
   9 can be problematic. In particular, ide_dma_cb() might be called and
  10 then use the reset IDEstate which contains the signature after the
  11 reset. When used to construct the IO operation this leads to
  12 ide_get_sector() returning 0 and nsector being 1. This is particularly
  13 bad, because a write command will thus destroy the first sector which
  14 often contains a partition table or similar.
  15
  16 Traces showing the unsolicited write happening with IDEstate
  17 0x5595af6949d0 being used after reset:
  18
  19 > ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @ 0x2c: 0x00000300
  20 > ahci_reset_port ahci(0x5595af6923f0)[0]: reset port
  21 > ide_reset IDEstate 0x5595af6949d0
  22 > ide_reset IDEstate 0x5595af694da8
  23 > ide_bus_reset_aio aio_cancel
  24 > dma_aio_cancel dbs=0x7f64600089a0
  25 > dma_blk_cb dbs=0x7f64600089a0 ret=0
  26 > dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30
  27 > ahci_populate_sglist ahci(0x5595af6923f0)[0]
  28 > ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512 prepared=512
  29 > ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE
  30 > dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1
  31 > dma_blk_cb dbs=0x7f6420802010 ret=0
  32
  33 > (gdb) p *qiov
  34 > $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov = {iov_base = 0x0,
  35 >       iov_len = 512}}, {__pad = "\001\000\000\000\000\000\000\000\000\000\000",
  36 >       size = 512}}}
  37 > (gdb) bt
  38 > #0  blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0, qiov=0x7f6420802070, flags=0,
  39 >     cb=0x5595ace6f0b0 <dma_blk_cb>, opaque=0x7f6420802010)
  40 >     at ../block/block-backend.c:1682
  41 > #1  0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010, ret=<optimized out>)
  42 >     at ../softmmu/dma-helpers.c:179
  43 > #2  0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0,
  44 >     sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
  45 >     io_func=io_func@entry=0x5595ace6ee30 <dma_blk_write_io_func>,
  46 >     io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30,
  47 >     cb=0x5595acd40b30 <ide_dma_cb>, opaque=0x5595af6949d0,
  48 >     dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244
  49 > #3  0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30,
  50 >     sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512,
  51 >     cb=cb@entry=0x5595acd40b30 <ide_dma_cb>, opaque=opaque@entry=0x5595af6949d0)
  52 >     at ../softmmu/dma-helpers.c:280
  53 > #4  0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0, ret=<optimized out>)
  54 >     at ../hw/ide/core.c:953
  55 > #5  0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0)
  56 >     at ../softmmu/dma-helpers.c:107
  57 > #6  dma_blk_cb (opaque=0x7f64600089a0, ret=0) at ../softmmu/dma-helpers.c:127
  58 > #7  0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10)
  59 >     at ../block/block-backend.c:1527
  60 > #8  blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1524
  61 > #9  blk_aio_write_entry (opaque=0x7f6460005b10) at ../block/block-backend.c:1594
  62 > #10 0x00005595ad258cfb in coroutine_trampoline (i0=<optimized out>,
  63 >     i1=<optimized out>) at ../util/coroutine-ucontext.c:177
  64
  65 Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
  66 ---
  67  hw/ide/core.c | 14 +++++++-------
  68  1 file changed, 7 insertions(+), 7 deletions(-)
  69
  70 diff --git a/hw/ide/core.c b/hw/ide/core.c
  71 index 08e1f0c3d7..148fccdef2 100644
  72 --- a/hw/ide/core.c
  73 +++ b/hw/ide/core.c
  74 @@ -2513,19 +2513,19 @@ static void ide_dummy_transfer_stop(IDEState *s)
  75
  76  void ide_bus_reset(IDEBus *bus)
  77  {
  78 -    bus->unit = 0;
  79 -    bus->cmd = 0;
  80 -    ide_reset(&bus->ifs[0]);
  81 -    ide_reset(&bus->ifs[1]);
  82 -    ide_clear_hob(bus);
  83 -
  84 -    /* pending async DMA */
  85 +    /* pending async DMA - needs the IDEState before it is reset */
  86      if (bus->dma->aiocb) {
  87          trace_ide_bus_reset_aio();
  88          blk_aio_cancel(bus->dma->aiocb);
  89          bus->dma->aiocb = NULL;
  90      }
  91
  92 +    bus->unit = 0;
  93 +    bus->cmd = 0;
  94 +    ide_reset(&bus->ifs[0]);
  95 +    ide_reset(&bus->ifs[1]);
  96 +    ide_clear_hob(bus);
  97 +
  98      /* reset dma provider too */
  99      if (bus->dma->ops->reset) {
 100          bus->dma->ops->reset(bus->dma);