From nobody Tue Oct 06 07:51:06 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hzT2z3B7nz6cW8h for ; Tue, 06 Oct 2026 07:51:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR2" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hzT2y74kfz4GPR for ; Tue, 06 Oct 2026 07:51:06 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791273067; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=06UZxJpLquIrFFfQJSEzpzjg9G2SKWoOFtwGAMmJjp0=; b=WvATHx2nkOi0vMK1kuP3Gts/ExshhgcEl910qLBYeWvt/vKMIgqZDz+vmZNF8if2RQU3hS Vw3pCO/so3hhrbcXr0Lxl+LUFiWG+efOtB391CiGkwSKGGSL+FSFbNo7n/dpUFbDWKpaqi BYB8DKW4PWbACAIzo3tx5GJ5H/xY/Jq6eZAvZkqKiGTnMdKG+x/R/KVdpSshIWJp4E8VWB JT+v37GQQVGTU69Pj4Mof7C86VdmtwEwcakjp4wRB9+ok/VkYYp8vPfEixff9dBdJpYnaM vJEfyI0MW9BQ8yBuhwUThiG+MThXqoMgRnrRNmhCdkrno/+Zjbm2+4dkVy2chw== ARC-Seal: i=1; a=rsa-sha256; d=freebsd.org; s=dkim; cv=none; t=1791273067; b=qQ35bk9ElZatJ80lDbXxWSCauNy1zYMInQPJBhMvLG/xShoFh6CFKrdkvgdyn32Xyxq4gi f6w20sAGS23+GcAlUAG6TWSZSKZf35ZG/J3CBTH2cREXLdUNgnTE5p8K694nnvvN6xozSj zQ6SEyP0x7lecrpPrrCYcP6hcOaWlXtA18SapI5USar2QOy4rz4h42T6I7Acmx3Nd3jUQY 1omiTq3B6uXthayNdKT19HcybCGuiTN0PsGz0vUWbfSacob8Xu5iRQMxe/zp/FxhbxJZju dn7l2E2XnFNfNbL07/M8kFtvV6WfVQ1AKJ6oKpk/xMusYkRn0c+5RJrva7AD6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1791273067; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=06UZxJpLquIrFFfQJSEzpzjg9G2SKWoOFtwGAMmJjp0=; b=ao2e8D9l2cNjHVTeQvytsKw6MLYAUokeWjUEplXVGzeOO61wJ/Knfn9CZanLOKgDl89csp jbwwbBvTXH+H4XVJPhsqtbeusUQS4pBkDdET7iuEs1qxTBfqVSDzpcJm0l41UVfb9Tx17w NGCFIECQE/NpeiBVRjXs3aIdantFzTeNcVTXOtVk7yYnqSTG59QyUa8Sg8vtpEzgqMSMre QQbQQbiPloOLQMYdBo57kONE0L39AU7/k40bYzUMenFOyzUkvEJNyDM4izr7HyRRPbq1y/ w1kA92gQBeR/YhldC4bB301AItvVAT/6fHKXzG3RAk2PbqkFMknbcjbrw6uURg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hzT2y63wtzxKS for ; Tue, 06 Oct 2026 07:51:06 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 477ec by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 06 Oct 2026 07:51:06 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Jaeyoon Choi Subject: git: c8852e0ac0c1 - stable/15 - ufshci: fix WLUN periph reference counting List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: jaeyoon X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: c8852e0ac0c1b6ce9947e412307fbc7d7659b5c8 Auto-Submitted: auto-generated Date: Tue, 06 Oct 2026 07:51:06 +0000 Message-Id: <6ac4a86a.477ec.25fe14ca@gitrepo.freebsd.org> The branch stable/15 has been updated by jaeyoon: URL: https://cgit.FreeBSD.org/src/commit/?id=c8852e0ac0c1b6ce9947e412307fbc7d7659b5c8 commit c8852e0ac0c1b6ce9947e412307fbc7d7659b5c8 Author: Jaeyoon Choi AuthorDate: 2026-08-10 01:39:12 +0000 Commit: Jaeyoon Choi CommitDate: 2026-10-06 06:27:56 +0000 ufshci: fix WLUN periph reference counting The driver stored the WLUN periph pointer without holding a reference, so the pointer went stale when the pass(4) device went away. In addition, ufshci_sim_send_ssu() released a reference that it had never acquired. Define a simple ownership rule. ufshci_sim_find_periph() acquires the periph and returns it. The cache owns one reference. The controller destructor drops it with cam_periph_release() before taking the SIM lock, since the release takes the CAM device lock by itself. ufshci_sim_send_ssu() acquires its own reference and releases it when done. Reuse the cached periph instead of searching again, so the old reference is not leaked. Sponsored by: Samsung Electronics Reviewed by: imp (mentor) Differential Revision: https://reviews.freebsd.org/D58658 (cherry picked from commit c84c2bf78b39058a339551117323668c933f6162) --- sys/dev/ufshci/ufshci_ctrlr.c | 2 ++ sys/dev/ufshci/ufshci_dev.c | 13 ++++++++----- sys/dev/ufshci/ufshci_private.h | 1 + sys/dev/ufshci/ufshci_sim.c | 36 +++++++++++++++++++++++++++++++----- 4 files changed, 42 insertions(+), 10 deletions(-) diff --git a/sys/dev/ufshci/ufshci_ctrlr.c b/sys/dev/ufshci/ufshci_ctrlr.c index cb5549f8e7c9..421aa1e28124 100644 --- a/sys/dev/ufshci/ufshci_ctrlr.c +++ b/sys/dev/ufshci/ufshci_ctrlr.c @@ -448,6 +448,8 @@ ufshci_ctrlr_destruct(struct ufshci_controller *ctrlr, device_t dev) bus_release_resource(ctrlr->dev, SYS_RES_IRQ, rman_get_rid(ctrlr->res), ctrlr->res); + ufshci_sim_release_wlun_periph(ctrlr); + mtx_lock(&ctrlr->sc_mtx); ufshci_sim_detach(ctrlr); diff --git a/sys/dev/ufshci/ufshci_dev.c b/sys/dev/ufshci/ufshci_dev.c index c53d9b71ba2c..7113834db13a 100644 --- a/sys/dev/ufshci/ufshci_dev.c +++ b/sys/dev/ufshci/ufshci_dev.c @@ -508,12 +508,15 @@ ufshci_dev_init_ufs_power_mode(struct ufshci_controller *ctrlr) if (ctrlr->quirks & UFSHCI_QUIRK_SKIP_WELL_KNOWN_LUNS) return (0); - ctrlr->ufs_device_wlun_periph = ufshci_sim_find_periph(ctrlr, - UFSHCI_WLUN_UFS_DEVICE); if (ctrlr->ufs_device_wlun_periph == NULL) { - ufshci_printf(ctrlr, - "Well-known LUN `UFS Device (0x50)` not found\n"); - return (0); + /* The returned reference is kept by the cached pointer. */ + ctrlr->ufs_device_wlun_periph = ufshci_sim_find_periph(ctrlr, + UFSHCI_WLUN_UFS_DEVICE); + if (ctrlr->ufs_device_wlun_periph == NULL) { + ufshci_printf(ctrlr, + "Well-known LUN `UFS Device (0x50)` not found\n"); + return (0); + } } ctrlr->ufs_dev.power_mode_supported = true; diff --git a/sys/dev/ufshci/ufshci_private.h b/sys/dev/ufshci/ufshci_private.h index e7345fc5a410..c738e246e96c 100644 --- a/sys/dev/ufshci/ufshci_private.h +++ b/sys/dev/ufshci/ufshci_private.h @@ -448,6 +448,7 @@ uint8_t ufshci_sim_translate_scsi_to_ufs_lun(lun_id_t scsi_lun); uint64_t ufshci_sim_translate_ufs_to_scsi_lun(uint8_t ufs_lun); int ufshci_sim_attach(struct ufshci_controller *ctrlr); void ufshci_sim_detach(struct ufshci_controller *ctrlr); +void ufshci_sim_release_wlun_periph(struct ufshci_controller *ctrlr); struct cam_periph *ufshci_sim_find_periph(struct ufshci_controller *ctrlr, uint8_t wlun); int ufshci_sim_send_ssu(struct ufshci_controller *ctrlr, bool start, diff --git a/sys/dev/ufshci/ufshci_sim.c b/sys/dev/ufshci/ufshci_sim.c index 148840123d13..9d80dd195ad9 100644 --- a/sys/dev/ufshci/ufshci_sim.c +++ b/sys/dev/ufshci/ufshci_sim.c @@ -393,6 +393,20 @@ ufshci_sim_attach(struct ufshci_controller *ctrlr) return (0); } +/* + * Drop the cached WLUN periph reference. cam_periph_release() takes the + * CAM device lock itself, so call this without sc_mtx held: CAM takes + * the device lock before the SIM lock, not the other way around. + */ +void +ufshci_sim_release_wlun_periph(struct ufshci_controller *ctrlr) +{ + if (ctrlr->ufs_device_wlun_periph != NULL) { + cam_periph_release(ctrlr->ufs_device_wlun_periph); + ctrlr->ufs_device_wlun_periph = NULL; + } +} + void ufshci_sim_detach(struct ufshci_controller *ctrlr) { @@ -425,6 +439,10 @@ ufshci_sim_detach(struct ufshci_controller *ctrlr) } } +/* + * On success this returns a referenced periph; the caller is responsible + * for dropping the reference with cam_periph_release(). + */ struct cam_periph * ufshci_sim_find_periph(struct ufshci_controller *ctrlr, uint8_t wlun) { @@ -446,6 +464,8 @@ ufshci_sim_find_periph(struct ufshci_controller *ctrlr, uint8_t wlun) while (1) { xpt_path_lock(path); periph = cam_periph_find(path, "pass"); + if (periph != NULL && cam_periph_acquire(periph) != 0) + periph = NULL; xpt_path_unlock(path); if (periph) @@ -474,17 +494,23 @@ ufshci_sim_send_ssu(struct ufshci_controller *ctrlr, bool start, union ccb *ccb; int err; - /* Acquire periph reference */ - if (periph && cam_periph_acquire(periph) != 0) { + /* Acquire a periph reference for the duration of this call. */ + if (periph != NULL && cam_periph_acquire(periph) != 0) { + /* The cached periph is going away; drop its reference. */ + cam_periph_release(periph); + ctrlr->ufs_device_wlun_periph = NULL; periph = NULL; } if (periph == NULL) { - /* If the periph device does not exist, it will try to find it - * again */ + /* + * If the periph device does not exist, try to find it again. + * The reference returned by ufshci_sim_find_periph() is used + * for this call; take an extra one for the cached pointer. + */ periph = ufshci_sim_find_periph(ctrlr, (uint8_t)UFSHCI_WLUN_UFS_DEVICE); - if (periph) + if (periph != NULL && cam_periph_acquire(periph) == 0) ctrlr->ufs_device_wlun_periph = periph; }