svn commit: r333651 - in head/sys/cam: ata mmc nvme

[Warner Losh]

Author: imp
Date: Tue May 15 22:22:10 2018
New Revision: 333651
URL: https://svnweb.freebsd.org/changeset/base/333651

Log:
  Hold the reference count until the CCB is released
  
  When a disk disappears and the periph is invalidated, any I/Os that
  are pending with the controller can cause a crash when they
  complete. Move to holding the softc reference count taken in dastart()
  until the I/O is complete rather than only until xpt_action()
  returns. (This approach was suggested by Ken Merry.) This extends
  the method used in da to ada, nda, and mda.
  
  Sponsored by: Netflix
  Submitted by: Chuck Silvers

Modified:
  head/sys/cam/ata/ata_da.c
  head/sys/cam/mmc/mmc_da.c
  head/sys/cam/nvme/nvme_da.c

Modified: head/sys/cam/ata/ata_da.c
==============================================================================
--- head/sys/cam/ata/ata_da.c	Tue May 15 21:54:59 2018	(r333650)
+++ head/sys/cam/ata/ata_da.c	Tue May 15 22:22:10 2018	(r333651)
@@ -2458,7 +2458,6 @@ out:
 		cam_periph_unlock(periph);
 		xpt_action(start_ccb);
 		cam_periph_lock(periph);
-		softc->refcount--;
 
 		/* May have more work to do, so ensure we stay scheduled */
 		adaschedule(periph);
@@ -2856,10 +2855,13 @@ adadone(struct cam_periph *periph, union ccb *done_ccb
 		 * We need to call cam_iosched before we call biodone so that we
 		 * don't measure any activity that happens in the completion
 		 * routine, which in the case of sendfile can be quite
-		 * extensive.
+		 * extensive.  Release the periph refcount taken in adastart()
+		 * for each CCB.
 		 */
 		cam_iosched_bio_complete(softc->cam_iosched, bp, done_ccb);
 		xpt_release_ccb(done_ccb);
+		KASSERT(softc->refcount >= 1, ("adadone softc %p refcount %d", softc, softc->refcount));
+		softc->refcount--;
 		if (state == ADA_CCB_TRIM) {
 			TAILQ_HEAD(, bio) queue;
 			struct bio *bp1;

Modified: head/sys/cam/mmc/mmc_da.c
==============================================================================
--- head/sys/cam/mmc/mmc_da.c	Tue May 15 21:54:59 2018	(r333650)
+++ head/sys/cam/mmc/mmc_da.c	Tue May 15 22:22:10 2018	(r333651)
@@ -1357,7 +1357,6 @@ sddastart(struct cam_periph *periph, union ccb *start_
 	cam_periph_unlock(periph);
 	xpt_action(start_ccb);
 	cam_periph_lock(periph);
-	softc->refcount--;
 
 	/* May have more work to do, so ensure we stay scheduled */
 	sddaschedule(periph);
@@ -1418,6 +1417,11 @@ sddadone(struct cam_periph *periph, union ccb *done_cc
 
 	softc->outstanding_cmds--;
 	xpt_release_ccb(done_ccb);
+	/*
+	 * Release the periph refcount taken in mdastart() for each CCB.
+	 */
+	KASSERT(softc->refcount >= 1, ("mdadone softc %p refcount %d", softc, softc->refcount));
+	softc->refcount--;
 	biodone(bp);
 }
 

Modified: head/sys/cam/nvme/nvme_da.c
==============================================================================
--- head/sys/cam/nvme/nvme_da.c	Tue May 15 21:54:59 2018	(r333650)
+++ head/sys/cam/nvme/nvme_da.c	Tue May 15 22:22:10 2018	(r333651)
@@ -990,7 +990,6 @@ out:
 		cam_periph_unlock(periph);
 		xpt_action(start_ccb);
 		cam_periph_lock(periph);
-		softc->refcount--;
 
 		/* May have more work to do, so ensure we stay scheduled */
 		ndaschedule(periph);
@@ -1101,6 +1100,11 @@ ndadone(struct cam_periph *periph, union ccb *done_ccb
 				biodone(bp2);
 			}
 		}
+		/*
+		 * Release the periph refcount taken in mdastart() for each CCB.
+		 */
+		KASSERT(softc->refcount >= 1, ("ndadone softc %p refcount %d", softc, softc->refcount));
+		softc->refcount--;
 		return;
 	}
 	case NDA_CCB_DUMP: