svn commit: r284622 - head/sys/cam/ctl

[Alexander Motin]

Author: mav
Date: Sat Jun 20 03:40:19 2015
New Revision: 284622
URL: https://svnweb.freebsd.org/changeset/base/284622

Log:
  Remove device queue freeze handling and replace it with dummy.
  
  At this point CTL has no known use case for device queue freezes.
  Same time existing (considered to be broken) code was found to cause
  modify-after-free issues.
  
  Discussed with:	ken
  MFC after:	1 week

Modified:
  head/sys/cam/ctl/scsi_ctl.c

Modified: head/sys/cam/ctl/scsi_ctl.c
==============================================================================
--- head/sys/cam/ctl/scsi_ctl.c	Sat Jun 20 00:58:46 2015	(r284621)
+++ head/sys/cam/ctl/scsi_ctl.c	Sat Jun 20 03:40:19 2015	(r284622)
@@ -848,15 +848,6 @@ ctlfestart(struct cam_periph *periph, un
 				atio->ccb_h.target_lun = CAM_LUN_WILDCARD;
 			}
 
-			if ((atio->ccb_h.status & CAM_DEV_QFRZN) != 0) {
-				cam_release_devq(periph->path,
-						 /*relsim_flags*/0,
-						 /*reduction*/0,
-						 /*timeout*/0,
-						 /*getcount_only*/0);
-				atio->ccb_h.status &= ~CAM_DEV_QFRZN;
-			}
-
 			if (atio->ccb_h.func_code != XPT_ACCEPT_TARGET_IO) {
 				xpt_print(periph->path, "%s: func_code "
 					  "is %#x\n", __func__,
@@ -966,15 +957,6 @@ ctlfestart(struct cam_periph *periph, un
 	xpt_action(start_ccb);
 	cam_periph_lock(periph);
 
-	if ((atio->ccb_h.status & CAM_DEV_QFRZN) != 0) {
-		cam_release_devq(periph->path,
-				 /*relsim_flags*/0,
-				 /*reduction*/0,
-				 /*timeout*/0,
-				 /*getcount_only*/0);
-		atio->ccb_h.status &= ~CAM_DEV_QFRZN;
-	}
-
 	/*
 	 * If we still have work to do, ask for another CCB.
 	 */
@@ -1107,6 +1089,19 @@ ctlfedone(struct cam_periph *periph, uni
 	       done_ccb->ccb_h.func_code);
 #endif
 
+	/*
+	 * At this point CTL has no known use case for device queue freezes.
+	 * In case some SIM think different -- drop its freeze right here.
+	 */
+	if ((done_ccb->ccb_h.status & CAM_DEV_QFRZN) != 0) {
+		cam_release_devq(periph->path,
+				 /*relsim_flags*/0,
+				 /*reduction*/0,
+				 /*timeout*/0,
+				 /*getcount_only*/0);
+		done_ccb->ccb_h.status &= ~CAM_DEV_QFRZN;
+	}
+
 	softc = (struct ctlfe_lun_softc *)periph->softc;
 	bus_softc = softc->parent_softc;
 	mtx = cam_periph_mtx(periph);
@@ -1417,12 +1412,9 @@ ctlfedone(struct cam_periph *periph, uni
 		union ctl_io *io;
 		struct ccb_immediate_notify *inot;
 		cam_status status;
-		int frozen, send_ctl_io;
+		int send_ctl_io;
 
 		inot = &done_ccb->cin1;
-
-		frozen = (done_ccb->ccb_h.status & CAM_DEV_QFRZN) != 0;
-
 		printf("%s: got XPT_IMMEDIATE_NOTIFY status %#x tag %#x "
 		       "seq %#x\n", __func__, inot->ccb_h.status,
 		       inot->tag_id, inot->seq_id);
@@ -1524,14 +1516,6 @@ ctlfedone(struct cam_periph *periph, uni
 			done_ccb->ccb_h.func_code = XPT_NOTIFY_ACKNOWLEDGE;
 			xpt_action(done_ccb);
 		}
-
-		if (frozen != 0) {
-			cam_release_devq(periph->path,
-					 /*relsim_flags*/ 0,
-					 /*opening reduction*/ 0,
-					 /*timeout*/ 0,
-					 /*getcount_only*/ 0);
-		}
 		break;
 	}
 	case XPT_NOTIFY_ACKNOWLEDGE: