Blame SOURCES/kvm-ahci-fix-PxCI-register-race.patch

357786
From 41f2bce1d8d55b1a35bd7456b4b13b5bc098745f Mon Sep 17 00:00:00 2001
357786
From: John Snow <jsnow@redhat.com>
357786
Date: Tue, 10 Jul 2018 23:06:15 +0200
357786
Subject: [PATCH 32/89] ahci: fix PxCI register race
357786
MIME-Version: 1.0
357786
Content-Type: text/plain; charset=UTF-8
357786
Content-Transfer-Encoding: 8bit
357786
357786
RH-Author: John Snow <jsnow@redhat.com>
357786
Message-id: <20180710230616.11000-3-jsnow@redhat.com>
357786
Patchwork-id: 81293
357786
O-Subject: [RHEL-7.6 qemu-kvm-rhev PATCH 2/3] ahci: fix PxCI register race
357786
Bugzilla: 1584914
357786
RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
357786
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
357786
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
357786
357786
Fixes: https://bugs.launchpad.net/qemu/+bug/1769189
357786
357786
AHCI presently signals completion prior to the PxCI register being
357786
cleared to indicate completion. If a guest driver attempts to issue
357786
a new command in its IRQ handler, it might be surprised to learn there
357786
is still a command pending.
357786
357786
In the case of Windows 10's boot driver, it will actually poll the IRQ
357786
register hoping to find out when the command is done running -- which
357786
will never happen, as there isn't a command running.
357786
357786
Fix this: clear PxCI in ahci_cmd_done and not in the asynchronous BH.
357786
Because it now runs synchronously, we don't need to check if the command
357786
is actually done by spying on the ATA registers. We know it's done.
357786
357786
CC: qemu-stable <qemu-stable@nongnu.org>
357786
Reported-by: François Guerraz <kubrick@fgv6.net>
357786
Tested-by: Bruce Rogers <brogers@suse.com>
357786
Signed-off-by: John Snow <jsnow@redhat.com>
357786
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
357786
Reviewed-by: Jeff Cody <jcody@redhat.com>
357786
Message-id: 20180531004323.4611-3-jsnow@redhat.com
357786
Signed-off-by: John Snow <jsnow@redhat.com>
357786
(cherry picked from commit 5694c7eacce6b263ad7497cc1bb76aad746cfd4e)
357786
Signed-off-by: John Snow <jsnow@redhat.com>
357786
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
357786
---
357786
 hw/ide/ahci.c | 13 ++++++-------
357786
 1 file changed, 6 insertions(+), 7 deletions(-)
357786
357786
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
357786
index b7a6f68..a9558e4 100644
357786
--- a/hw/ide/ahci.c
357786
+++ b/hw/ide/ahci.c
357786
@@ -532,13 +532,6 @@ static void ahci_check_cmd_bh(void *opaque)
357786
     qemu_bh_delete(ad->check_bh);
357786
     ad->check_bh = NULL;
357786
 
357786
-    if ((ad->busy_slot != -1) &&
357786
-        !(ad->port.ifs[0].status & (BUSY_STAT|DRQ_STAT))) {
357786
-        /* no longer busy */
357786
-        ad->port_regs.cmd_issue &= ~(1 << ad->busy_slot);
357786
-        ad->busy_slot = -1;
357786
-    }
357786
-
357786
     check_cmd(ad->hba, ad->port_no);
357786
 }
357786
 
357786
@@ -1425,6 +1418,12 @@ static void ahci_cmd_done(IDEDMA *dma)
357786
 
357786
     trace_ahci_cmd_done(ad->hba, ad->port_no);
357786
 
357786
+    /* no longer busy */
357786
+    if (ad->busy_slot != -1) {
357786
+        ad->port_regs.cmd_issue &= ~(1 << ad->busy_slot);
357786
+        ad->busy_slot = -1;
357786
+    }
357786
+
357786
     /* update d2h status */
357786
     ahci_write_fis_d2h(ad);
357786
 
357786
-- 
357786
1.8.3.1
357786