cvs commit: src/sys/dev/usb ehci.c ohci.c uhci.c usb_port.h

[Ian Dowse]

iedowse     2004-11-09 20:51:32 UTC

  FreeBSD src repository

  Modified files:
    sys/dev/usb          ehci.c ohci.c uhci.c usb_port.h 
  Log:
  Attempt to fix a number of race conditions in the handling of
  transfer timeouts that typically cause a transfer to be completed
  twice, resulting in panics and page faults:
  
   o A transfer completion interrupt could arrive while an abort_task
     event was set up, so the transfer would be aborted after it had
     completed. This is very easy to reproduce. Fix this by setting
     the transfer status to USBD_TIMEOUT before scheduling the
     abort_task so that the transfer completion code will ignore it.
  
   o The transfer completion code could execute concurrently with the
     timeout callout, leaving the callout blocked (e.g. waiting for
     Giant) while the transfer completion code runs. In this case,
     callout_stop() does not prevent the callout from running, so
     again the timeout code would run after the transfer was complete.
     Handle this case by checking the return value from callout_stop(),
     and ignoring the transfer if the callout could not be removed.
  
   o Finally, protect against a timeout callout occurring while a
     transfer is being aborted by another process. Here we arrange
     for the timeout processing to ignore the transfer, and use
     callout_drain() to ensure that the callout has really gone before
     completing the transfer.
  
  This was tested by repeatedly performing USB transfers with a timeout
  set to approximately the same as the normal transfer completion
  time. In the PR below, apparently this occurred by accident with a
  particular printer and the default timeout.
  
  PR:             kern/71491
  
  Revision  Changes    Path
  1.18      +45 -19    src/sys/dev/usb/ehci.c
  1.145     +39 -14    src/sys/dev/usb/ohci.c
  1.157     +40 -16    src/sys/dev/usb/uhci.c
  1.70      +1 -0      src/sys/dev/usb/usb_port.h