|
From: | Philippe Mathieu-Daudé |
Subject: | Re: [PATCH 1/2] hw/ide: reset: cancel async DMA operation before reseting state |
Date: | Thu, 24 Aug 2023 17:07:12 +0200 |
User-agent: | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Thunderbird/102.14.0 |
On 24/8/23 15:38, Fiona Ebner wrote:
If there is a pending DMA operation during ide_bus_reset(), the fact that the IDEState is already reset before the operation is canceled can be problematic. In particular, ide_dma_cb() might be called and then use the reset IDEState which contains the signature after the reset. When used to construct the IO operation this leads to ide_get_sector() returning 0 and nsector being 1. This is particularly bad, because a write command will thus destroy the first sector which often contains a partition table or similar. Traces showing the unsolicited write happening with IDEState 0x5595af6949d0 being used after reset:ahci_port_write ahci(0x5595af6923f0)[0]: port write [reg:PxSCTL] @ 0x2c: 0x00000300 ahci_reset_port ahci(0x5595af6923f0)[0]: reset port ide_reset IDEstate 0x5595af6949d0 ide_reset IDEstate 0x5595af694da8 ide_bus_reset_aio aio_cancel dma_aio_cancel dbs=0x7f64600089a0 dma_blk_cb dbs=0x7f64600089a0 ret=0 dma_complete dbs=0x7f64600089a0 ret=0 cb=0x5595acd40b30 ahci_populate_sglist ahci(0x5595af6923f0)[0] ahci_dma_prepare_buf ahci(0x5595af6923f0)[0]: prepare buf limit=512 prepared=512 ide_dma_cb IDEState 0x5595af6949d0; sector_num=0 n=1 cmd=DMA WRITE dma_blk_io dbs=0x7f6420802010 bs=0x5595ae2c6c30 offset=0 to_dev=1 dma_blk_cb dbs=0x7f6420802010 ret=0(gdb) p *qiov $11 = {iov = 0x7f647c76d840, niov = 1, {{nalloc = 1, local_iov = {iov_base = 0x0, iov_len = 512}}, {__pad = "\001\000\000\000\000\000\000\000\000\000\000", size = 512}}} (gdb) bt #0 blk_aio_pwritev (blk=0x5595ae2c6c30, offset=0, qiov=0x7f6420802070, flags=0, cb=0x5595ace6f0b0 <dma_blk_cb>, opaque=0x7f6420802010) at ../block/block-backend.c:1682 #1 0x00005595ace6f185 in dma_blk_cb (opaque=0x7f6420802010, ret=<optimized out>) at ../softmmu/dma-helpers.c:179 #2 0x00005595ace6f778 in dma_blk_io (ctx=0x5595ae0609f0, sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512, io_func=io_func@entry=0x5595ace6ee30 <dma_blk_write_io_func>, io_func_opaque=io_func_opaque@entry=0x5595ae2c6c30, cb=0x5595acd40b30 <ide_dma_cb>, opaque=0x5595af6949d0, dir=DMA_DIRECTION_TO_DEVICE) at ../softmmu/dma-helpers.c:244 #3 0x00005595ace6f90a in dma_blk_write (blk=0x5595ae2c6c30, sg=sg@entry=0x5595af694d00, offset=offset@entry=0, align=align@entry=512, cb=cb@entry=0x5595acd40b30 <ide_dma_cb>, opaque=opaque@entry=0x5595af6949d0) at ../softmmu/dma-helpers.c:280 #4 0x00005595acd40e18 in ide_dma_cb (opaque=0x5595af6949d0, ret=<optimized out>) at ../hw/ide/core.c:953 #5 0x00005595ace6f319 in dma_complete (ret=0, dbs=0x7f64600089a0) at ../softmmu/dma-helpers.c:107 #6 dma_blk_cb (opaque=0x7f64600089a0, ret=0) at ../softmmu/dma-helpers.c:127 #7 0x00005595ad12227d in blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1527 #8 blk_aio_complete (acb=0x7f6460005b10) at ../block/block-backend.c:1524 #9 blk_aio_write_entry (opaque=0x7f6460005b10) at ../block/block-backend.c:1594 #10 0x00005595ad258cfb in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>) at ../util/coroutine-ucontext.c:177Signed-off-by: Fiona Ebner <f.ebner@proxmox.com> --- hw/ide/core.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[Prev in Thread] | Current Thread | [Next in Thread] |