From owner-freebsd-usb@freebsd.org  Mon Sep  5 07:48:29 2016
Return-Path: <owner-freebsd-usb@freebsd.org>
Delivered-To: freebsd-usb@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 7DE76B718C7;
 Mon,  5 Sep 2016 07:48:29 +0000 (UTC) (envelope-from hps@selasky.org)
Received: from mail.turbocat.net (heidi.turbocat.net [88.198.202.214])
 (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id 3F9605E2;
 Mon,  5 Sep 2016 07:48:29 +0000 (UTC) (envelope-from hps@selasky.org)
Received: from laptop015.home.selasky.org (unknown [62.141.129.119])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (No client certificate requested)
 by mail.turbocat.net (Postfix) with ESMTPSA id 5DCC91FE022;
 Mon,  5 Sep 2016 09:48:21 +0200 (CEST)
Subject: Re: Deadlock between device_detach() and usbd_do_request_flags()
To: Andriy Voskoboinyk <avos@freebsd.org>, Adrian Chadd <adrian@freebsd.org>, 
 Hans Petter Selasky <hps@freebsd.org>
References: <op.ynaawb2n4dikkl@localhost>
Cc: "freebsd-wireless@freebsd.org" <freebsd-wireless@freebsd.org>,
 "freebsd-usb@freebsd.org" <freebsd-usb@freebsd.org>
From: Hans Petter Selasky <hps@selasky.org>
Message-ID: <4cf378ff-63e1-7cdc-6120-9578fceec20d@selasky.org>
Date: Mon, 5 Sep 2016 09:53:03 +0200
User-Agent: Mozilla/5.0 (X11; FreeBSD amd64; rv:45.0) Gecko/20100101
 Thunderbird/45.0
MIME-Version: 1.0
In-Reply-To: <op.ynaawb2n4dikkl@localhost>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-usb@freebsd.org
X-Mailman-Version: 2.1.23
Precedence: list
List-Id: FreeBSD support for USB <freebsd-usb.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-usb>,
 <mailto:freebsd-usb-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-usb/>
List-Post: <mailto:freebsd-usb@freebsd.org>
List-Help: <mailto:freebsd-usb-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-usb>,
 <mailto:freebsd-usb-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 05 Sep 2016 07:48:29 -0000

On 09/04/16 23:20, Andriy Voskoboinyk wrote:
> There is a rare, but reproducible deadlock for wlan(4) drivers:
>
> Thread 1:
>  * uhub_explore_handle_re_enumerate() (obtains enum_sx lock)
>  * usbd_set_config_index()
>  * usb_unconfigure()
>  * usb_detach_device()
>  * usb_detach_device_sub()
>  * <device_detach()>
>    typically <device_stop()> is executed here (prevents
>     another possible deadlock?)
>  * ieee80211_ifdetach()
>  * ieee80211_vap_destroy()
>  * <ic->ic_vap_delete>
>  * ieee80211_vap_detach()
>    here it calls ieee80211_stop() and waits for <any> -> INIT state
>    transition
>
> Thread 2 (started from thread 1):
>  * ieee80211_newstate_cb()
>  * vap->iv_newstate()
>    here: if the driver will try to call usbd_do_request_flags()
>    (typically via <drv_write_reg> / <drv_read_reg>) it will hang
>    (because enum_sx lock is already held by thread 1).
>
>
> Another way: execute some periodical task that will try to access
> some registers (urtwn_temp_calib(), rum_ratectl_task(),
> run_ratectl_cb()) while thread 1 is running - deadlock is
> here too, since <device_detach> will wait for them indefinitely
> (via ieee80211_draintask())
>
> Right now the most obvious (and, probably, wrong) way is to just
> detect & release all locks (usbd_enum_unlock()) for
> ieee80211_ifdetach() / ieee80211_draintask() and re-acquire them
> later (not tested yet).
>

Hi,

I think the right solution is to let usbd_do_request_flags() use its own 
SX lock for synchronization, instead of re-using the enumeration SX 
lock. What do you think about that?

--HPS