[S390] cio: Fix reference counting for online/offline.

The current code attempts to get an extra reference count
for online devices by doing a get_device() in ccw_device_online()
and a put_device() in ccw_device_done(). However, this
- incorrectly obtains an extra reference for disconnected
  devices becoming available again (since they are already
  online)
- needs special checks for css_init_done in order to handle
  the console device
- is not obvious and
- may incorretly drop a reference count in ccw_device_done() if
  that function is called after path verification for a device
  that just became not operational.

So let's just get the reference in ccw_device_set_online() and
drop it in ccw_device_set_offline(). (Unfortunately, we still
need the special case in io_subchannel_probe().)

Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

2 files changed, 22 insertions, 12 deletions

diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 647cbaca298e..039ef03cf217 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -376,19 +376,23 @@ int ccw_device_set_offline(struct ccw_device *cdev)
                         dev_fsm_event(cdev, DEV_EVENT_NOTOPER);
                 }
                 spin_unlock_irq(cdev->ccwlock);
+                /* Give up reference from ccw_device_set_online(). */
+                put_device(&cdev->dev);
                 return ret;
         }
         spin_unlock_irq(cdev->ccwlock);
-        if (ret == 0)
+        if (ret == 0) {
                 wait_event(cdev->private->wait_q, dev_fsm_final_state(cdev));
-        else {
+                /* Give up reference from ccw_device_set_online(). */
+                put_device(&cdev->dev);
+        } else {
                 CIO_MSG_EVENT(0, "ccw_device_offline returned %d, "
                               "device 0.%x.%04x\n",
                               ret, cdev->private->dev_id.ssid,
                               cdev->private->dev_id.devno);
                 cdev->online = 1;
         }
-        return ret;
+        return ret;
 }
 
 /**
@@ -411,6 +415,9 @@ int ccw_device_set_online(struct ccw_device *cdev)
                 return -ENODEV;
         if (cdev->online || !cdev->drv)
                 return -EINVAL;
+        /* Hold on to an extra reference while device is online. */
+        if (!get_device(&cdev->dev))
+                return -ENODEV;
 
         spin_lock_irq(cdev->ccwlock);
         ret = ccw_device_online(cdev);
@@ -422,10 +429,15 @@ int ccw_device_set_online(struct ccw_device *cdev)
                               "device 0.%x.%04x\n",
                               ret, cdev->private->dev_id.ssid,
                               cdev->private->dev_id.devno);
+                /* Give up online reference since onlining failed. */
+                put_device(&cdev->dev);
                 return ret;
         }
-        if (cdev->private->state != DEV_STATE_ONLINE)
+        if (cdev->private->state != DEV_STATE_ONLINE) {
+                /* Give up online reference since onlining failed. */
+                put_device(&cdev->dev);
                 return -ENODEV;
+        }
         if (!cdev->drv->set_online || cdev->drv->set_online(cdev) == 0) {
                 cdev->online = 1;
                 return 0;
@@ -440,6 +452,8 @@ int ccw_device_set_online(struct ccw_device *cdev)
                               "device 0.%x.%04x\n",
                               ret, cdev->private->dev_id.ssid,
                               cdev->private->dev_id.devno);
+        /* Give up online reference since onlining failed. */
+        put_device(&cdev->dev);
         return (ret == 0) ? -ENODEV : ret;
 }
 
@@ -1168,9 +1182,8 @@ static int io_subchannel_probe(struct subchannel *sch)
                 ccw_device_register(cdev);
                 /*
                  * Check if the device is already online. If it is
-                 * the reference count needs to be corrected
-                 * (see ccw_device_online and css_init_done for the
-                 * ugly details).
+                 * the reference count needs to be corrected since we
+                 * didn't obtain a reference in ccw_device_set_online.
                  */
                 if (cdev->private->state != DEV_STATE_NOT_OPER &&
                     cdev->private->state != DEV_STATE_OFFLINE &&
@@ -1806,6 +1819,8 @@ ccw_device_remove (struct device *dev)
                                       "device 0.%x.%04x\n",
                                       ret, cdev->private->dev_id.ssid,
                                       cdev->private->dev_id.devno);
+                /* Give up reference obtained in ccw_device_set_online(). */
+                put_device(&cdev->dev);
         }
         ccw_device_set_timeout(cdev, 0);
         cdev->drv = NULL;
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index 10bc03940fb3..01330cf5ae5e 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -399,9 +399,6 @@ ccw_device_done(struct ccw_device *cdev, int state)
                 ccw_device_oper_notify(cdev);
         }
         wake_up(&cdev->private->wait_q);
-
-        if (css_init_done && state != DEV_STATE_ONLINE)
-                put_device (&cdev->dev);
 }
 
 static int cmp_pgid(struct pgid *p1, struct pgid *p2)
@@ -611,8 +608,6 @@ ccw_device_online(struct ccw_device *cdev)
             (cdev->private->state != DEV_STATE_BOXED))
                 return -EINVAL;
         sch = to_subchannel(cdev->dev.parent);
-        if (css_init_done && !get_device(&cdev->dev))
-                return -ENODEV;
         ret = cio_enable_subchannel(sch, (u32)(addr_t)sch);
         if (ret != 0) {
                 /* Couldn't enable the subchannel for i/o. Sick device. */