DF-4693 — sili_pm: pm register accessors recycle the ata_xfer while the chip still owns the slot (deferred-timeout returns ATA_S_ONCHIP)

Build & run

sh build.sh          # cc -O2 -Wall -o trigger_sili_pm trigger_sili_pm.c
sh run.sh            # ./trigger_sili_pm 15  (reset/rescan storm + dd saturation)

Expected output

• On hardware (SiI HBA + PM, other-target I/O in flight): a PM register read/write (e.g. EINFO poll sili.c:530, SERR clear sili_pm.c:589, XPT_RESET_DEV softreset) that times out while other commands are still on-chip takes the deferred-timeout branch (ap->ap_active != ap->ap_expired, sili.c:2507-2510): sili_ata_cmd() returns with xa->state == ATA_S_ONCHIP (sili.c:1357-1359, 2375), sili_pm_read/pm_write treat it as plain failure and call sili_ata_put_xfer() (sili_pm.c:667 / 702) — the CCB returns to the free list while the slot is still programmed and ap_expired processing is pending. Consequences: sili_poll() KKASSERT on slot reuse (sili.c:1321), sili_ata_cmd_done completing a re-issued ccb / unloading the new command's live dmamap when sili_port_reinit() later drains the expired slot (sili.c:403-411 → 2415-2418), and a stale ap_active bit wedging sili_exclusive_access() forever (sili.c:1437-1443).
• On the audit QEMU guest: no sili HBA (env.txt) — path unreachable; hardware gate, not a false positive.

Twin of DF-4503 (ahci_pm.c); sili instance of the DF-4027 mechanism observed from the PM accessor call sites.

VERDICT — DF-4693

Status: inconclusive (hardware-gated) · code-path proven · expected impact: kernel panic (KKASSERT) / cross-command CCB corruption / port wedge

Reproduced?

No — no sili(4) HBA on the audit guest and QEMU has no SiL3726 PM emulation (env.txt). The trigger builds and runs (build.log / run.log) and drives the CAM entry points (XPT_RESET_DEV, rescan) against the only buses present; the defective code is unreachable at runtime here. Full control-flow proof below; same evidence standard as the accepted DF-4503 sibling (ahci).

Why the defect is real (trace)

1. sili_pm_read() / sili_pm_write() / sili_pm_set_feature() issue their FIS via sili_ata_cmd() — sili_pm.c:657 / 698 / 563.
2. Poll path: sili_ata_cmd() → sili_poll(ccb, 1000, sili_ata_cmd_timeout) — sili.c:2374-2375.
3. On timeout with the command on-chip, sili_core_timeout() sets ap->ap_expired |= 1 << slot; if any other command is still active (ap->ap_active != ap->ap_expired) it prints "Deferred timeout until its safe" and returns without reinit — sili.c:2502-2511. The xa state remains ATA_S_ONCHIP.
4. sili_poll() then returns ccb->ccb_xa.state — sili.c:1357-1359 — i.e. ATA_S_ONCHIP.
5. The PM accessors treat every non-ATA_S_COMPLETE return identically: error path → sili_ata_put_xfer(xa) — sili_pm.c:663-668 / 698-703 — which sili_put_ccb()s the ccb back onto ap_ccb_free with state = ATA_S_PUT (sili.c:2020-2030). The chip still owns the slot; ap_active/ap_expired bits remain set.
6. Detonations: - a new command takes the recycled slot → sili_poll()'s KKASSERT((ap->ap_expired & (1 << ccb->ccb_slot)) == 0) fires (sili.c:1321) → panic on INVARIANTS kernels (X86_64_GENERIC:56); - when the remaining commands finish, sili_port_intr() calls sili_port_reinit() (sili.c:1956-1958) which drains the expired slot: ccb->ccb_xa.state = ATA_S_TIMEOUT; ccb->ccb_done(ccb); (sili.c:403-411) → sili_ata_cmd_done() (sili.c:2393-2419) on a ccb that may already be re-issued for an unrelated command → premature completion / stale sili_unload_prb() of the new command's live dmamap (the DF-4027 corruption signature); - if the slot never completes, the stale ap_active bit makes sili_exclusive_access() spin forever (sili.c:1437-1443) — permanent port-thread wedge.

Co-activity precondition

PM register traffic runs outside exclusive access in exactly the paths where other commands are on-chip: the port-thread EINFO poll (sili.c:530) and sili_pm_check_good() (sili.c:580,654 → sili_pm.c:584,589,610). Only sili_pm_hardreset() drains first (sili_pm.c:272). A hung or slow PM target (1 s accessor timeout) while another target streams NCQ is the realistic trigger — device-timing dependent, hence confidence "likely", matching DF-4503's classification for the identical ahci defect.

Impact ceiling

Kernel panic (common, INVARIANTS) with a narrower cross-command corruption window (premature CAM completion / live-dmamap unload). Severity Medium.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.