From patchwork Mon Nov 6 11:03:19 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= X-Patchwork-Id: 741360 Delivered-To: patch@linaro.org Received: by 2002:adf:fd90:0:b0:32d:baff:b0ca with SMTP id d16csp1032418wrr; Mon, 6 Nov 2023 03:31:57 -0800 (PST) X-Google-Smtp-Source: AGHT+IFssSroWM0VwshbWwq6O9qr+q7b2A+A/89OKAhx9pzxX1PFoel/4ozilZOhN8KYsRwoHEIx X-Received: by 2002:ac8:5f4d:0:b0:418:fab:2d31 with SMTP id y13-20020ac85f4d000000b004180fab2d31mr36529201qta.4.1699270317559; Mon, 06 Nov 2023 03:31:57 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1699270317; cv=none; d=google.com; s=arc-20160816; b=kWlGqw7NAJAweoh9aZZXAGJlUv1TwiNt774a5IMBg0nHLXR/j0tGJzudAyzokeYmmi inNor79+afqs89CBAYvhyTTJu9+C0wQ/PwWnWjeYq8IL6+Lv6SYycp7M1stX9d77PGJy /OL/5YPnU+NZCabCi8PFmSy7lIsz4eluG0uqJm5PJWt5hN2wfttynelcAUBIh1RyomQh XUqTmDMKnO5f7ENl/mZ8cRCnDd2Xlb64vVMOCVa6nhrPpT8+bUlSbnvIx2hC7YHzwd0i 8bPZQIjj9h9EIomvKFZV8zLYa13GWnQmOQ1WEMCH//9bb1Q7SERzK1IwJz48FY20KHVp StHw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:list-subscribe:list-help:list-post:list-archive :list-unsubscribe:list-id:precedence:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=l0/vWnFHt+cyNHMvzu2dssx7xYyn6IEpyeIo7MQjzWQ=; fh=BVgvOOujLHbkB3i/tRO+FYFnqKZbE5hgS/5eNKJti18=; b=0p1I3f6r8i9kClRMvwJ+VXB/48DwRSJK7q6QtQ4EyHvDdsmHAJcSKrl5tRtMZqHAU5 K7/c9C5P1Gvu57YW0dWKrokvzeSwjLNSosW2fgF31pE55w7UJURgo0aAw/YZQwy9ULR8 ESEj93pVgh4JT3kJxilQsOQOS0pxx0R+IVt0RPVZLeNTWagMCEhH0PsTjzenwapoC9fI g0bbuAfowDfA/C6fmVKyWgpL8J2oTTCnguDcxBYn08UJUFrsqCwqvQ8Uf0vKv4GLbtEH t7RBRobYiF+5Qkzr8cBBkdlsBDRSBLYj86Xx4dWvlngm2UHYwTxjHKCx54rM4FbwjROE 6HVg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=ATOHgHNs; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from lists.gnu.org (lists.gnu.org. [209.51.188.17]) by mx.google.com with ESMTPS id z12-20020a05622a028c00b00419629d080fsi5677942qtw.386.2023.11.06.03.31.57 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 06 Nov 2023 03:31:57 -0800 (PST) Received-SPF: pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=ATOHgHNs; spf=pass (google.com: domain of qemu-devel-bounces+patch=linaro.org@nongnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom="qemu-devel-bounces+patch=linaro.org@nongnu.org"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1qzxTe-0007Yr-It; Mon, 06 Nov 2023 06:09:06 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1qzxTd-0007Wq-2y for qemu-devel@nongnu.org; Mon, 06 Nov 2023 06:09:05 -0500 Received: from mail-wr1-x42e.google.com ([2a00:1450:4864:20::42e]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1qzxTZ-0005JB-Rm for qemu-devel@nongnu.org; Mon, 06 Nov 2023 06:09:04 -0500 Received: by mail-wr1-x42e.google.com with SMTP id ffacd0b85a97d-32d849cc152so3001776f8f.1 for ; Mon, 06 Nov 2023 03:09:01 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1699268940; x=1699873740; darn=nongnu.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=l0/vWnFHt+cyNHMvzu2dssx7xYyn6IEpyeIo7MQjzWQ=; b=ATOHgHNsCkKb89JaOnwl8QH72EF8YZw+TFI1xlV8vgO5T92YyWphdlcIsoMHqk8+TU Vc8e/AXE44m4xrOGH8R0XBa4X29NorWbvjte/FwV44YiBOH26UxPjIl3yr+E8fvbhl5T 4TdP6raxusiQSOxyVH4A+XuZgoMWD2bqPV0o0W1KTCAn/bhZX7v6O9rXyB7xkjFlDRt8 iMP5QdazlChzlSDHosx9ur1yL3CVSXshPF/tPiFjLneC3UAax7BGhijhlzeiPx/w8Vmy TtAF6/94PMk1ZnD63cDtm9CLAtAB6p6QaUHEBgmZifi//6pe/lMdnWN0AnO7gJoCMLJi Bhyg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1699268940; x=1699873740; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=l0/vWnFHt+cyNHMvzu2dssx7xYyn6IEpyeIo7MQjzWQ=; b=UTqFyT71i4IJofVvsltHWMsi4PCYPele0UkW8bi8VmR9hkA4k/5pzYIQND/qLSfJQ7 rlYOZEGqsrnM+MUsyrND5aE8UxIAwyA4ZoizGmG4v+Zoc6MHCABZOPIDG28VqnEzjMW7 EYjTW/KwX6AG8Fmdu9mSzuRlWXe6ByFn0rw+gTBQDbTkDaIvQ+U3Xr2PHO71loY4phjL UMKuqBrKRp5mpM24gXUqSuzLth36mUAJLcA1Jq0yBuNUiDS8fJkK/11VBj9r2Ff6SWno vMoLrbSgwe7tYkol1NQ+YXsksGnaJg3KFftYJgiwiVsQ0FCPJ67iHiTXXOMRTNs19eZg Uxkw== X-Gm-Message-State: AOJu0YwLGSbqsl0NSZiAeKpTitj7W6WyJ0qMdPj16dwGcQToJuqMsUd5 c0cnry6cNbzNjA2vQHgd00MPIeEBJgIfhQtBG2A= X-Received: by 2002:a05:6000:1361:b0:32d:9b80:e2c6 with SMTP id q1-20020a056000136100b0032d9b80e2c6mr22417154wrz.26.1699268940275; Mon, 06 Nov 2023 03:09:00 -0800 (PST) Received: from m1x-phil.lan (176-131-220-199.abo.bbox.fr. [176.131.220.199]) by smtp.gmail.com with ESMTPSA id z18-20020adfec92000000b0032da8fb0d05sm9132494wrn.110.2023.11.06.03.08.58 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Mon, 06 Nov 2023 03:08:59 -0800 (PST) From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= To: qemu-devel@nongnu.org Cc: kvm@vger.kernel.org, qemu-s390x@nongnu.org, qemu-block@nongnu.org, qemu-riscv@nongnu.org, qemu-ppc@nongnu.org, qemu-arm@nongnu.org, Fiona Ebner , =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= , simon.rowe@nutanix.com, John Snow Subject: [PULL 47/60] hw/ide: reset: cancel async DMA operation before resetting state Date: Mon, 6 Nov 2023 12:03:19 +0100 Message-ID: <20231106110336.358-48-philmd@linaro.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20231106110336.358-1-philmd@linaro.org> References: <20231106110336.358-1-philmd@linaro.org> MIME-Version: 1.0 Received-SPF: pass client-ip=2a00:1450:4864:20::42e; envelope-from=philmd@linaro.org; helo=mail-wr1-x42e.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+patch=linaro.org@nongnu.org Sender: qemu-devel-bounces+patch=linaro.org@nongnu.org From: Fiona Ebner If there is a pending DMA operation during ide_bus_reset(), the fact that the IDEState is already reset before the operation is canceled can be problematic. In particular, ide_dma_cb() might be called and then use the reset IDEState which contains the signature after the reset. When used to construct the IO operation this leads to ide_get_sector() returning 0 and nsector being 1. This is particularly bad, because a write command will thus destroy the first sector which often contains a partition table or similar. Traces showing the unsolicited write happening with IDEState 0x5595af6949d0 being used after reset: > ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @ 0x2c: 0x00000300 > ahci_reset_port ahci(0x5595af6923f0)[0]: reset port > ide_reset IDEstate 0x5595af6949d0 > ide_reset IDEstate 0x5595af694da8 > ide_bus_reset_aio aio_cancel > dma_aio_cancel dbs=0x7f64600089a0 > dma_blk_cb dbs=0x7f64600089a0 ret=0 > dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30 > ahci_populate_sglist ahci(0x5595af6923f0)[0] > ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512 prepared=512 > ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE > dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1 > dma_blk_cb dbs=0x7f6420802010 ret=0 > (gdb) p *qiov > $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov = {iov_base = 0x0, > iov_len = 512}}, {__pad = "\001\000\000\000\000\000\000\000\000\000\000", > size = 512}}} > (gdb) bt > #0 blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0, qiov=0x7f6420802070, flags=0, > cb=0x5595ace6f0b0 , opaque=0x7f6420802010) > at ../block/block-backend.c:1682 > #1 0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010, ret=) > at ../softmmu/dma-helpers.c:179 > #2 0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0, > sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512, > io_func=io_func@entry=0x5595ace6ee30 , > io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30, > cb=0x5595acd40b30 , opaque=0x5595af6949d0, > dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244 > #3 0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30, > sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512, > cb=cb@entry=0x5595acd40b30 , opaque=opaque@entry=0x5595af6949d0) > at ../softmmu/dma-helpers.c:280 > #4 0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0, ret=) > at ../hw/ide/core.c:953 > #5 0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0) > at ../softmmu/dma-helpers.c:107 > #6 dma_blk_cb (opaque=0x7f64600089a0, ret=0) at ../softmmu/dma-helpers.c:127 > #7 0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10) > at ../block/block-backend.c:1527 > #8 blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1524 > #9 blk_aio_write_entry (opaque=0x7f6460005b10) at ../block/block-backend.c:1594 > #10 0x00005595ad258cfb in coroutine_trampoline (i0=, > i1=) at ../util/coroutine-ucontext.c:177 Signed-off-by: Fiona Ebner Reviewed-by: Philippe Mathieu-Daudé Tested-by: simon.rowe@nutanix.com Message-ID: <20230906130922.142845-1-f.ebner@proxmox.com> Signed-off-by: Philippe Mathieu-Daudé --- hw/ide/core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/hw/ide/core.c b/hw/ide/core.c index b5e0dcd29b..63ba665f3d 100644 --- a/hw/ide/core.c +++ b/hw/ide/core.c @@ -2515,19 +2515,19 @@ static void ide_dummy_transfer_stop(IDEState *s) void ide_bus_reset(IDEBus *bus) { - bus->unit = 0; - bus->cmd = 0; - ide_reset(&bus->ifs[0]); - ide_reset(&bus->ifs[1]); - ide_clear_hob(bus); - - /* pending async DMA */ + /* pending async DMA - needs the IDEState before it is reset */ if (bus->dma->aiocb) { trace_ide_bus_reset_aio(); blk_aio_cancel(bus->dma->aiocb); bus->dma->aiocb = NULL; } + bus->unit = 0; + bus->cmd = 0; + ide_reset(&bus->ifs[0]); + ide_reset(&bus->ifs[1]); + ide_clear_hob(bus); + /* reset dma provider too */ if (bus->dma->ops->reset) { bus->dma->ops->reset(bus->dma);