Re: [PATCH v2 1/2] hw/ide: reset: cancel async DMA operation before resetting state

[Fiona Ebner]

Am 26.10.23 um 08:17 schrieb Michael Tokarev:
> 06.09.2023 16:09, Fiona Ebner wrote:
>> If there is a pending DMA operation during ide_bus_reset(), the fact
>> that the IDEState is already reset before the operation is canceled
>> can be problematic. In particular, ide_dma_cb() might be called and
>> then use the reset IDEState which contains the signature after the
>> reset. When used to construct the IO operation this leads to
>> ide_get_sector() returning 0 and nsector being 1. This is particularly
>> bad, because a write command will thus destroy the first sector which
>> often contains a partition table or similar.
>>
>> Traces showing the unsolicited write happening with IDEState
>> 0x5595af6949d0 being used after reset:
>>
>>> ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @
>>> 0x2c: 0x00000300
>>> ahci_reset_port ahci(0x5595af6923f0)[0]: reset port
>>> ide_reset IDEstate 0x5595af6949d0
>>> ide_reset IDEstate 0x5595af694da8
>>> ide_bus_reset_aio aio_cancel
>>> dma_aio_cancel dbs=0x7f64600089a0
>>> dma_blk_cb dbs=0x7f64600089a0 ret=0
>>> dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30
>>> ahci_populate_sglist ahci(0x5595af6923f0)[0]
>>> ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512
>>> prepared=512
>>> ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE
>>> dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1
>>> dma_blk_cb dbs=0x7f6420802010 ret=0
>>
>>> (gdb) p *qiov
>>> $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov =
>>> {iov_base = 0x0,
>>>        iov_len = 512}}, {__pad =
>>> "\001\000\000\000\000\000\000\000\000\000\000",
>>>        size = 512}}}
>>> (gdb) bt
>>> #0  blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0,
>>> qiov=0x7f6420802070, flags=0,
>>>      cb=0x5595ace6f0b0 <dma_blk_cb>, opaque=0x7f6420802010)
>>>      at ../block/block-backend.c:1682
>>> #1  0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010,
>>> ret=<optimized out>)
>>>      at ../softmmu/dma-helpers.c:179
>>> #2  0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0,
>>>      sg=sg@entry=0x5595af694d00, offset=offset@entry=0,
>>> align=align@entry=512,
>>>      io_func=io_func@entry=0x5595ace6ee30 <dma_blk_write_io_func>,
>>>      io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30,
>>>      cb=0x5595acd40b30 <ide_dma_cb>, opaque=0x5595af6949d0,
>>>      dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244
>>> #3  0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30,
>>>      sg=sg@entry=0x5595af694d00, offset=offset@entry=0,
>>> align=align@entry=512,
>>>      cb=cb@entry=0x5595acd40b30 <ide_dma_cb>,
>>> opaque=opaque@entry=0x5595af6949d0)
>>>      at ../softmmu/dma-helpers.c:280
>>> #4  0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0,
>>> ret=<optimized out>)
>>>      at ../hw/ide/core.c:953
>>> #5  0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0)
>>>      at ../softmmu/dma-helpers.c:107
>>> #6  dma_blk_cb (opaque=0x7f64600089a0, ret=0) at
>>> ../softmmu/dma-helpers.c:127
>>> #7  0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10)
>>>      at ../block/block-backend.c:1527
>>> #8  blk_aio_complete (acb=0x7f6460005b10) at
>>> ../block/block-backend.c:1524
>>> #9  blk_aio_write_entry (opaque=0x7f6460005b10) at
>>> ../block/block-backend.c:1594
>>> #10 0x00005595ad258cfb in coroutine_trampoline (i0=<optimized out>,
>>>      i1=<optimized out>) at ../util/coroutine-ucontext.c:177
>>
>> Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
>> Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> 
> Ping?  Has this bugfix been lost somehow?
> 

I sent a ping 2 days ago and it'll be picked up by Philippe :)
https://lists.nongnu.org/archive/html/qemu-devel/2023-10/msg08296.html

And CC-ing stable. Sorry, didn't think about that before.

Best Regards,
Fiona