diff options
author | ken <ken@FreeBSD.org> | 2012-01-12 00:41:48 +0000 |
---|---|---|
committer | ken <ken@FreeBSD.org> | 2012-01-12 00:41:48 +0000 |
commit | 8e2b5cb8354e06cb2b207e8e3a55be3b81e2b9d2 (patch) | |
tree | f74588a4c508d787083ec233b815a0d60dec46e5 /sys/cam/cam_periph.h | |
parent | fce645c1536d9a3584347abccad168ea1bca2d53 (diff) | |
download | FreeBSD-src-8e2b5cb8354e06cb2b207e8e3a55be3b81e2b9d2.zip FreeBSD-src-8e2b5cb8354e06cb2b207e8e3a55be3b81e2b9d2.tar.gz |
Fix a race condition in CAM peripheral free handling, locking
in the CAM XPT bus traversal code, and a number of other periph level
issues.
cam_periph.h,
cam_periph.c: Modify cam_periph_acquire() to test the CAM_PERIPH_INVALID
flag prior to allowing a reference count to be gained
on a peripheral. Callers of this function will receive
CAM_REQ_CMP_ERR status in the situation of attempting to
reference an invalidated periph. This guarantees that
a peripheral scheduled for a deferred free will not
be accessed during its wait for destruction.
Panic during attempts to drop a reference count on
a peripheral that already has a zero reference count.
In cam_periph_list(), use a local sbuf with SBUF_FIXEDLEN
set so that mallocs do not occur while the xpt topology
lock is held, regardless of the allocation policy of the
passed in sbuf.
Add a new routine, cam_periph_release_locked_buses(),
that can be called when the caller already holds
the CAM topology lock.
Add some extra debugging for duplicate peripheral
allocations in cam_periph_alloc().
Treat CAM_DEV_NOT_THERE much the same as a selection
timeout (AC_LOST_DEVICE is emitted), but forgo retries.
cam_xpt.c: Revamp the way the EDT traversal code does locking
and reference counting. This was broken, since it
assumed that the EDT would not change during
traversal, but that assumption is no longer valid.
So, to prevent devices from going away while we
traverse the EDT, make sure we properly lock
everything and hold references on devices that
we are using.
The two peripheral driver traversal routines should
be examined. xptpdperiphtraverse() holds the
topology lock for the entire time it runs.
xptperiphtraverse() is now locked properly, but
only holds the topology lock while it is traversing
the list, and not while the traversal function is
running.
The bus locking code in xptbustraverse() should
also be revisited at a later time, since it is
complex and should probably be simplified.
scsi_da.c: Pay attention to the return value from cam_periph_acquire().
Return 0 always from daclose() even if the disk is now gone.
Add some rudimentary error injection support.
scsi_sg.c: Fix reference counting in the sg(4) driver.
The sg driver was calling cam_periph_release() on close,
but never called cam_periph_acquire() (which increments
the reference count) on open.
The periph code correctly complained that the sg(4)
driver was trying to decrement the refcount when it
was already 0.
Sponsored by: Spectra Logic
MFC after: 2 weeks
Diffstat (limited to 'sys/cam/cam_periph.h')
-rw-r--r-- | sys/cam/cam_periph.h | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/sys/cam/cam_periph.h b/sys/cam/cam_periph.h index 58bfd7b..6c232ca 100644 --- a/sys/cam/cam_periph.h +++ b/sys/cam/cam_periph.h @@ -119,6 +119,7 @@ struct cam_periph { #define CAM_PERIPH_NEW_DEV_FOUND 0x10 #define CAM_PERIPH_RECOVERY_INPROG 0x20 #define CAM_PERIPH_SENSE_INPROG 0x40 +#define CAM_PERIPH_FREE 0x80 u_int32_t immediate_priority; u_int32_t refcount; SLIST_HEAD(, ccb_hdr) ccb_list; /* For "immediate" requests */ @@ -146,6 +147,7 @@ int cam_periph_list(struct cam_path *, struct sbuf *); cam_status cam_periph_acquire(struct cam_periph *periph); void cam_periph_release(struct cam_periph *periph); void cam_periph_release_locked(struct cam_periph *periph); +void cam_periph_release_locked_buses(struct cam_periph *periph); int cam_periph_hold(struct cam_periph *periph, int priority); void cam_periph_unhold(struct cam_periph *periph); void cam_periph_invalidate(struct cam_periph *periph); |