From owner-cvs-src@FreeBSD.ORG Tue Nov 9 20:51:33 2004 Return-Path: Delivered-To: cvs-src@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0487016A4CE; Tue, 9 Nov 2004 20:51:33 +0000 (GMT) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id E732443D1D; Tue, 9 Nov 2004 20:51:32 +0000 (GMT) (envelope-from iedowse@FreeBSD.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.11/8.12.11) with ESMTP id iA9KpWPK049860; Tue, 9 Nov 2004 20:51:32 GMT (envelope-from iedowse@repoman.freebsd.org) Received: (from iedowse@localhost) by repoman.freebsd.org (8.12.11/8.12.11/Submit) id iA9KpW0H049859; Tue, 9 Nov 2004 20:51:32 GMT (envelope-from iedowse) Message-Id: <200411092051.iA9KpW0H049859@repoman.freebsd.org> From: Ian Dowse Date: Tue, 9 Nov 2004 20:51:32 +0000 (UTC) To: src-committers@FreeBSD.org, cvs-src@FreeBSD.org, cvs-all@FreeBSD.org X-FreeBSD-CVS-Branch: HEAD Subject: cvs commit: src/sys/dev/usb ehci.c ohci.c uhci.c usb_port.h X-BeenThere: cvs-src@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: CVS commit messages for the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 09 Nov 2004 20:51:33 -0000 iedowse 2004-11-09 20:51:32 UTC FreeBSD src repository Modified files: sys/dev/usb ehci.c ohci.c uhci.c usb_port.h Log: Attempt to fix a number of race conditions in the handling of transfer timeouts that typically cause a transfer to be completed twice, resulting in panics and page faults: o A transfer completion interrupt could arrive while an abort_task event was set up, so the transfer would be aborted after it had completed. This is very easy to reproduce. Fix this by setting the transfer status to USBD_TIMEOUT before scheduling the abort_task so that the transfer completion code will ignore it. o The transfer completion code could execute concurrently with the timeout callout, leaving the callout blocked (e.g. waiting for Giant) while the transfer completion code runs. In this case, callout_stop() does not prevent the callout from running, so again the timeout code would run after the transfer was complete. Handle this case by checking the return value from callout_stop(), and ignoring the transfer if the callout could not be removed. o Finally, protect against a timeout callout occurring while a transfer is being aborted by another process. Here we arrange for the timeout processing to ignore the transfer, and use callout_drain() to ensure that the callout has really gone before completing the transfer. This was tested by repeatedly performing USB transfers with a timeout set to approximately the same as the normal transfer completion time. In the PR below, apparently this occurred by accident with a particular printer and the default timeout. PR: kern/71491 Revision Changes Path 1.18 +45 -19 src/sys/dev/usb/ehci.c 1.145 +39 -14 src/sys/dev/usb/ohci.c 1.157 +40 -16 src/sys/dev/usb/uhci.c 1.70 +1 -0 src/sys/dev/usb/usb_port.h