The cam_sim structure was being deallocated unconditionally by device
authorMatthew Dillon <dillon@dragonflybsd.org>
Mon, 15 Mar 2004 03:05:11 +0000 (03:05 +0000)
committerMatthew Dillon <dillon@dragonflybsd.org>
Mon, 15 Mar 2004 03:05:11 +0000 (03:05 +0000)
driver detach routines.  The problem with this is that part of the CAM
bus structure may still be active (for example, with pending timeout()'s),
and even though the bus, target, and device is freed, since the sim IS
freed any accesses through the sim will hit 0xdeadc0de.  This case most often
occurs with USB UMASS devices.

sys/dev/raid/aac/aac_cam.c
sys/dev/raid/amr/amr_cam.c
sys/dev/raid/asr/asr.c
sys/dev/raid/ciss/ciss.c
sys/dev/raid/dpt/dpt_scsi.c
sys/dev/raid/iir/iir.c
sys/dev/raid/mly/mly_cam.c

index 103d538..b095be0 100644 (file)
@@ -24,7 +24,7 @@
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/sys/dev/aac/aac_cam.c,v 1.2.2.4 2003/04/08 13:22:08 scottl Exp $
- *     $DragonFly: src/sys/dev/raid/aac/aac_cam.c,v 1.3 2003/08/07 21:17:07 dillon Exp $
+ *     $DragonFly: src/sys/dev/raid/aac/aac_cam.c,v 1.4 2004/03/15 03:05:03 dillon Exp $
  */
 
 /*
@@ -143,21 +143,21 @@ aac_cam_attach(device_t dev)
 
        sim = cam_sim_alloc(aac_cam_action, aac_cam_poll, "aacp", camsc,
            device_get_unit(dev), 1, 1, devq);
+       cam_simq_release(devq);
        if (sim == NULL) {
-               cam_simq_free(devq);
                return (EIO);
        }
 
        /* Since every bus has it's own sim, every bus 'appears' as bus 0 */
        if (xpt_bus_register(sim, 0) != CAM_SUCCESS) {
-               cam_sim_free(sim, TRUE);
+               cam_sim_free(sim);
                return (EIO);
        }
 
        if (xpt_create_path(&path, NULL, cam_sim_path(sim),
            CAM_TARGET_WILDCARD, CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
                xpt_bus_deregister(cam_sim_path(sim));
-               cam_sim_free(sim, TRUE);
+               cam_sim_free(sim);
                return (EIO);
        }
 
index c18d9e5..837edd3 100644 (file)
@@ -53,7 +53,7 @@
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/sys/dev/amr/amr_cam.c,v 1.1.2.3 2002/11/11 13:19:10 emoore Exp $
- *     $DragonFly: src/sys/dev/raid/amr/amr_cam.c,v 1.3 2003/08/07 21:17:08 dillon Exp $
+ *     $DragonFly: src/sys/dev/raid/amr/amr_cam.c,v 1.4 2004/03/15 03:05:05 dillon Exp $
  */
 
 #include <sys/param.h>
@@ -159,7 +159,6 @@ amr_cam_attach(struct amr_softc *sc)
                                                  1,
                                                  AMR_MAX_SCSI_CMDS,
                                                  devq)) == NULL) {
-           cam_simq_free(devq);
            device_printf(sc->amr_dev, "CAM SIM attach failed\n");
            return(ENOMEM);
        }
@@ -170,6 +169,7 @@ amr_cam_attach(struct amr_softc *sc)
            return(ENXIO);
        }
     }
+    cam_simq_release(devq);
     /*
      * XXX we should scan the config and work out which devices are actually
      * protected.
@@ -183,17 +183,15 @@ amr_cam_attach(struct amr_softc *sc)
 void
 amr_cam_detach(struct amr_softc *sc)
 {
-    int                chn, first;
+    int                chn;
 
-    for (chn = 0, first = 1; chn < sc->amr_maxchan; chn++) {
-
-       /*
-        * If a sim was allocated for this channel, free it
-        */
+    /*
+     * If a sim was allocated for a channel, free it
+     */
+    for (chn = 0; chn < sc->amr_maxchan; chn++) {
        if (sc->amr_cam_sim[chn] != NULL) {
            xpt_bus_deregister(cam_sim_path(sc->amr_cam_sim[chn]));
-           cam_sim_free(sc->amr_cam_sim[chn], first ? TRUE : FALSE);
-           first = 0;
+           cam_sim_free(sc->amr_cam_sim[chn]);
        }
     }
 }
index 8e43280..811bb30 100644 (file)
@@ -1,5 +1,5 @@
 /* $FreeBSD: src/sys/dev/asr/asr.c,v 1.3.2.2 2001/08/23 05:21:29 scottl Exp $ */
-/* $DragonFly: src/sys/dev/raid/asr/asr.c,v 1.12 2004/02/13 01:33:19 joerg Exp $ */
+/* $DragonFly: src/sys/dev/raid/asr/asr.c,v 1.13 2004/03/15 03:05:08 dillon Exp $ */
 /*
  * Copyright (c) 1996-2000 Distributed Processing Technology Corporation
  * Copyright (c) 2000-2001 Adaptec Corporation
@@ -3139,34 +3139,24 @@ asr_attach (ATTACH_ARGS)
                         ATTACH_RETURN(ENOMEM);
                 }
                 for (bus = 0; bus <= sc->ha_MaxBus; ++bus) {
-                        struct cam_devq   * devq;
                         int                 QueueSize = sc->ha_QueueSize;
 
                         if (QueueSize > MAX_INBOUND) {
                                 QueueSize = MAX_INBOUND;
                         }
 
-                        /*
-                         *      Create the device queue for our SIM(s).
-                         */
-                        if ((devq = cam_simq_alloc(QueueSize)) == NULL) {
-                                continue;
-                        }
-
                         /*
                          *      Construct our first channel SIM entry
                          */
                         sc->ha_sim[bus] = cam_sim_alloc(
                           asr_action, asr_poll, "asr", sc,
-                          unit, 1, QueueSize, devq);
-                        if (sc->ha_sim[bus] == NULL) {
+                          unit, 1, QueueSize, NULL);
+                        if (sc->ha_sim[bus] == NULL)
                                 continue;
-                        }
 
                         if (xpt_bus_register(sc->ha_sim[bus], bus)
                           != CAM_SUCCESS) {
-                                cam_sim_free(sc->ha_sim[bus],
-                                  /*free_devq*/TRUE);
+                                cam_sim_free(sc->ha_sim[bus]);
                                 sc->ha_sim[bus] = NULL;
                                 continue;
                         }
@@ -3176,8 +3166,7 @@ asr_attach (ATTACH_ARGS)
                           CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
                                 xpt_bus_deregister(
                                   cam_sim_path(sc->ha_sim[bus]));
-                                cam_sim_free(sc->ha_sim[bus],
-                                  /*free_devq*/TRUE);
+                                cam_sim_free(sc->ha_sim[bus]);
                                 sc->ha_sim[bus] = NULL;
                                 continue;
                         }
index b86a434..5a47394 100644 (file)
@@ -24,7 +24,7 @@
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/sys/dev/ciss/ciss.c,v 1.2.2.6 2003/02/18 22:27:41 ps Exp $
- *     $DragonFly: src/sys/dev/raid/ciss/ciss.c,v 1.5 2003/11/20 22:07:33 dillon Exp $
+ *     $DragonFly: src/sys/dev/raid/ciss/ciss.c,v 1.6 2004/03/15 03:05:10 dillon Exp $
  */
 
 /*
@@ -1390,10 +1390,10 @@ ciss_free(struct ciss_softc *sc)
     /* disconnect from CAM */
     if (sc->ciss_cam_sim) {
        xpt_bus_deregister(cam_sim_path(sc->ciss_cam_sim));
-       cam_sim_free(sc->ciss_cam_sim, 0);
+       cam_sim_free(sc->ciss_cam_sim);
     }
     if (sc->ciss_cam_devq)
-       cam_simq_free(sc->ciss_cam_devq);
+       cam_simq_release(sc->ciss_cam_devq);
     /* XXX what about ciss_cam_path? */
 }
 
index 3a15fd0..9e7ea79 100644 (file)
@@ -44,7 +44,7 @@
  */
 
 #ident "$FreeBSD: src/sys/dev/dpt/dpt_scsi.c,v 1.28.2.3 2003/01/31 02:47:10 grog Exp $"
-#ident "$DragonFly: src/sys/dev/raid/dpt/dpt_scsi.c,v 1.4 2003/08/07 21:17:08 dillon Exp $"
+#ident "$DragonFly: src/sys/dev/raid/dpt/dpt_scsi.c,v 1.5 2004/03/15 03:05:10 dillon Exp $"
 
 #define _DPT_C_
 
@@ -1504,7 +1504,7 @@ dpt_attach(dpt_softc_t *dpt)
                                             dpt, dpt->unit, /*untagged*/2,
                                             /*tagged*/dpt->max_dccbs, devq);
                if (xpt_bus_register(dpt->sims[i], i) != CAM_SUCCESS) {
-                       cam_sim_free(dpt->sims[i], /*free_devq*/i == 0);
+                       cam_sim_free(dpt->sims[i]);
                        break;
                }
 
@@ -1513,11 +1513,12 @@ dpt_attach(dpt_softc_t *dpt)
                                    CAM_TARGET_WILDCARD,
                                    CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
                        xpt_bus_deregister(cam_sim_path(dpt->sims[i]));
-                       cam_sim_free(dpt->sims[i], /*free_devq*/i == 0);
+                       cam_sim_free(dpt->sims[i]);
                        break;
                }
 
        }
+       cam_simq_release(devq);
        if (i > 0)
                EVENTHANDLER_REGISTER(shutdown_final, dptshutdown,
                                      dpt, SHUTDOWN_PRI_DEFAULT);
index 55a24de..e783085 100644 (file)
@@ -1,5 +1,5 @@
 /* $FreeBSD: src/sys/dev/iir/iir.c,v 1.2.2.3 2002/05/05 08:18:12 asmodai Exp $ */
-/* $DragonFly: src/sys/dev/raid/iir/iir.c,v 1.5 2003/11/09 02:22:35 dillon Exp $ */
+/* $DragonFly: src/sys/dev/raid/iir/iir.c,v 1.6 2004/03/15 03:05:10 dillon Exp $ */
 /*
  *       Copyright (c) 2000-01 Intel Corporation
  *       All Rights Reserved
@@ -488,7 +488,7 @@ iir_attach(struct gdt_softc *gdt)
                                      gdt, gdt->sc_hanum, /*untagged*/2,
                                      /*tagged*/GDT_MAXCMDS, devq);
         if (xpt_bus_register(gdt->sims[i], i) != CAM_SUCCESS) {
-            cam_sim_free(gdt->sims[i], /*free_devq*/i == 0);
+            cam_sim_free(gdt->sims[i]);
             break;
         }
 
@@ -497,10 +497,11 @@ iir_attach(struct gdt_softc *gdt)
                             CAM_TARGET_WILDCARD,
                             CAM_LUN_WILDCARD) != CAM_REQ_CMP) {
             xpt_bus_deregister(cam_sim_path(gdt->sims[i]));
-            cam_sim_free(gdt->sims[i], /*free_devq*/i == 0);
+            cam_sim_free(gdt->sims[i]);
             break;
         }
     }
+    cam_simq_release(devq);
     if (i > 0)
         EVENTHANDLER_REGISTER(shutdown_final, iir_shutdown,
                               gdt, SHUTDOWN_PRI_DEFAULT);
index 7cd7d06..4c12bce 100644 (file)
@@ -25,7 +25,7 @@
  * SUCH DAMAGE.
  *
  *     $FreeBSD: src/sys/dev/mly/mly_cam.c,v 1.1.2.3 2001/04/21 04:09:06 msmith Exp $
- *     $DragonFly: src/sys/dev/raid/mly/Attic/mly_cam.c,v 1.3 2003/08/07 21:17:09 dillon Exp $
+ *     $DragonFly: src/sys/dev/raid/mly/Attic/mly_cam.c,v 1.4 2004/03/15 03:05:11 dillon Exp $
  */
 /*
  * CAM interface for FreeBSD
@@ -157,7 +157,6 @@ mly_cam_attach(struct mly_softc *sc)
                                                  1,
                                                  sc->mly_controllerinfo->maximum_parallel_commands,
                                                  devq)) ==  NULL) {
-           cam_simq_free(devq);
            mly_printf(sc, "CAM SIM attach failed\n");
            return(ENOMEM);
        }
@@ -172,11 +171,11 @@ mly_cam_attach(struct mly_softc *sc)
                                                  sc->mly_controllerinfo->maximum_parallel_commands,
                                                  0,
                                                  devq)) ==  NULL) {
-           cam_simq_free(devq);
            mly_printf(sc, "CAM SIM attach failed\n");
            return(ENOMEM);
        }
     }
+    cam_simq_release(devq);
 
     for (i = 0; i < chn; i++) {
        /* register the bus IDs so we can get them later */
@@ -196,7 +195,7 @@ mly_cam_attach(struct mly_softc *sc)
 void
 mly_cam_detach(struct mly_softc *sc)
 {
-    int                chn, nchn, first;
+    int                chn, nchn;
 
     debug_called(1);
 
@@ -208,7 +207,7 @@ mly_cam_detach(struct mly_softc *sc)
      */
     nchn = sc->mly_controllerinfo->physical_channels_present +
        sc->mly_controllerinfo->virtual_channels_present;
-    for (chn = 0, first = 1; chn < nchn; chn++) {
+    for (chn = 0; chn < nchn; chn++) {
 
        /*
         * If a sim was registered for this channel, free it.
@@ -216,9 +215,8 @@ mly_cam_detach(struct mly_softc *sc)
        if (sc->mly_cam_sim[chn] != NULL) {
            debug(1, "deregister bus %d", chn);
            xpt_bus_deregister(cam_sim_path(sc->mly_cam_sim[chn]));
-           debug(1, "free sim for channel %d (%sfree queue)", chn, first ? "" : "don't ");
-           cam_sim_free(sc->mly_cam_sim[chn], first ? TRUE : FALSE);
-           first = 0;
+           debug(1, "free sim for channel %d", chn);
+           cam_sim_free(sc->mly_cam_sim[chn]);
        }
     }
 }