Blame SOURCES/kvm-ahci-fix-PxCI-register-race.patch

383d26
From 41f2bce1d8d55b1a35bd7456b4b13b5bc098745f Mon Sep 17 00:00:00 2001
383d26
From: John Snow <jsnow@redhat.com>
383d26
Date: Tue, 10 Jul 2018 23:06:15 +0200
383d26
Subject: [PATCH 32/89] ahci: fix PxCI register race
383d26
MIME-Version: 1.0
383d26
Content-Type: text/plain; charset=UTF-8
383d26
Content-Transfer-Encoding: 8bit
383d26
383d26
RH-Author: John Snow <jsnow@redhat.com>
383d26
Message-id: <20180710230616.11000-3-jsnow@redhat.com>
383d26
Patchwork-id: 81293
383d26
O-Subject: [RHEL-7.6 qemu-kvm-rhev PATCH 2/3] ahci: fix PxCI register race
383d26
Bugzilla: 1584914
383d26
RH-Acked-by: Laurent Vivier <lvivier@redhat.com>
383d26
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
383d26
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
383d26
383d26
Fixes: https://bugs.launchpad.net/qemu/+bug/1769189
383d26
383d26
AHCI presently signals completion prior to the PxCI register being
383d26
cleared to indicate completion. If a guest driver attempts to issue
383d26
a new command in its IRQ handler, it might be surprised to learn there
383d26
is still a command pending.
383d26
383d26
In the case of Windows 10's boot driver, it will actually poll the IRQ
383d26
register hoping to find out when the command is done running -- which
383d26
will never happen, as there isn't a command running.
383d26
383d26
Fix this: clear PxCI in ahci_cmd_done and not in the asynchronous BH.
383d26
Because it now runs synchronously, we don't need to check if the command
383d26
is actually done by spying on the ATA registers. We know it's done.
383d26
383d26
CC: qemu-stable <qemu-stable@nongnu.org>
383d26
Reported-by: François Guerraz <kubrick@fgv6.net>
383d26
Tested-by: Bruce Rogers <brogers@suse.com>
383d26
Signed-off-by: John Snow <jsnow@redhat.com>
383d26
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
383d26
Reviewed-by: Jeff Cody <jcody@redhat.com>
383d26
Message-id: 20180531004323.4611-3-jsnow@redhat.com
383d26
Signed-off-by: John Snow <jsnow@redhat.com>
383d26
(cherry picked from commit 5694c7eacce6b263ad7497cc1bb76aad746cfd4e)
383d26
Signed-off-by: John Snow <jsnow@redhat.com>
383d26
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
383d26
---
383d26
 hw/ide/ahci.c | 13 ++++++-------
383d26
 1 file changed, 6 insertions(+), 7 deletions(-)
383d26
383d26
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
383d26
index b7a6f68..a9558e4 100644
383d26
--- a/hw/ide/ahci.c
383d26
+++ b/hw/ide/ahci.c
383d26
@@ -532,13 +532,6 @@ static void ahci_check_cmd_bh(void *opaque)
383d26
     qemu_bh_delete(ad->check_bh);
383d26
     ad->check_bh = NULL;
383d26
 
383d26
-    if ((ad->busy_slot != -1) &&
383d26
-        !(ad->port.ifs[0].status & (BUSY_STAT|DRQ_STAT))) {
383d26
-        /* no longer busy */
383d26
-        ad->port_regs.cmd_issue &= ~(1 << ad->busy_slot);
383d26
-        ad->busy_slot = -1;
383d26
-    }
383d26
-
383d26
     check_cmd(ad->hba, ad->port_no);
383d26
 }
383d26
 
383d26
@@ -1425,6 +1418,12 @@ static void ahci_cmd_done(IDEDMA *dma)
383d26
 
383d26
     trace_ahci_cmd_done(ad->hba, ad->port_no);
383d26
 
383d26
+    /* no longer busy */
383d26
+    if (ad->busy_slot != -1) {
383d26
+        ad->port_regs.cmd_issue &= ~(1 << ad->busy_slot);
383d26
+        ad->busy_slot = -1;
383d26
+    }
383d26
+
383d26
     /* update d2h status */
383d26
     ahci_write_fis_d2h(ad);
383d26
 
383d26
-- 
383d26
1.8.3.1
383d26