From owner-p4-projects@FreeBSD.ORG Sat Oct 31 15:40:45 2009 Return-Path: Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id EF752106568D; Sat, 31 Oct 2009 15:40:44 +0000 (UTC) Delivered-To: perforce@FreeBSD.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A9D52106568F for ; Sat, 31 Oct 2009 15:40:44 +0000 (UTC) (envelope-from hselasky@FreeBSD.org) Received: from repoman.freebsd.org (repoman.freebsd.org [IPv6:2001:4f8:fff6::29]) by mx1.freebsd.org (Postfix) with ESMTP id 7DBB48FC12 for ; Sat, 31 Oct 2009 15:40:44 +0000 (UTC) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.14.3/8.14.3) with ESMTP id n9VFei6x081941 for ; Sat, 31 Oct 2009 15:40:44 GMT (envelope-from hselasky@FreeBSD.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.14.3/8.14.3/Submit) id n9VFei6o081939 for perforce@freebsd.org; Sat, 31 Oct 2009 15:40:44 GMT (envelope-from hselasky@FreeBSD.org) Date: Sat, 31 Oct 2009 15:40:44 GMT Message-Id: <200910311540.n9VFei6o081939@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to hselasky@FreeBSD.org using -f From: Hans Petter Selasky To: Perforce Change Reviews Precedence: bulk Cc: Subject: PERFORCE change 170001 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.5 List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 31 Oct 2009 15:40:45 -0000 http://p4web.freebsd.org/chv.cgi?CH=170001 Change 170001 by hselasky@hselasky_laptop001 on 2009/10/31 15:39:49 USB CORE: - Fix a corner case where usbd_transfer_drain() can return too early. This fixes some rare panics at USB device detach. Affected files ... .. //depot/projects/usb/src/sys/dev/usb/usb_core.h#28 edit .. //depot/projects/usb/src/sys/dev/usb/usb_transfer.c#170 edit Differences ... ==== //depot/projects/usb/src/sys/dev/usb/usb_core.h#28 (text+ko) ==== @@ -112,6 +112,7 @@ uint8_t curr_dma_set:1; /* used by USB HC/DC driver */ uint8_t can_cancel_immed:1; /* set if USB transfer can be * cancelled immediately */ + uint8_t doing_callback:1; /* set if executing the callback */ }; /* ==== //depot/projects/usb/src/sys/dev/usb/usb_transfer.c#170 (text+ko) ==== @@ -1797,8 +1797,18 @@ usbd_transfer_stop(xfer); - while (usbd_transfer_pending(xfer)) { + while (usbd_transfer_pending(xfer) || + xfer->flags_int.doing_callback) { + + /* + * It is allowed that the callback can drop its + * transfer mutex. In that case checking only + * "usbd_transfer_pending()" is not enough to tell if + * the USB transfer is fully drained. We also need to + * check the internal "doing_callback" flag. + */ xfer->flags_int.draining = 1; + /* * Wait until the current outstanding USB * transfer is complete ! @@ -2043,6 +2053,9 @@ /* get next USB transfer in the queue */ info->done_q.curr = NULL; + /* set flag in case of drain */ + xfer->flags_int.doing_callback = 1; + USB_BUS_UNLOCK(info->bus); USB_BUS_LOCK_ASSERT(info->bus, MA_NOTOWNED); @@ -2095,12 +2108,17 @@ if ((!xfer->flags_int.open) && (xfer->flags_int.started) && (xfer->usb_state == USB_ST_ERROR)) { + /* clear flag in case of drain */ + xfer->flags_int.doing_callback = 0; /* try to loop, but not recursivly */ usb_command_wrapper(&info->done_q, xfer); return; } done: + /* clear flag in case of drain */ + xfer->flags_int.doing_callback = 0; + /* * Check if we are draining. */