Re: Multiple outstanding transfer vs xhci / ehci (Re: CVS commit: src/sys/dev/usb)

[Nick Hudson <nick.hudson%gmx.co.uk@localhost>]

On 12/02/2019 16:02, Rin Okuyama wrote:
> Hi,
>
> The system freezes indefinitely with xhci(4) or ehci(4), when NIC with
> multiple outstanding transfers [axen(4), mue(4), and ure(4)] is stopped
> by "ifconfig down" or detached.
>
> As discussed in the previous message, this is due to infinite loop in
> usbd_ar_pipe(); xfers with USBD_NOT_STARTED remain in a queue forever
> because upm_abort [= xhci_device_bulk_abort() etc.] cannot remove them.


Why not the attached patch instead?

Nick

? sys/dev/usb/cscope.out
Index: sys/dev/usb/usbdi.c
===================================================================
RCS file: /cvsroot/src/sys/dev/usb/usbdi.c,v
retrieving revision 1.181
diff -u -p -r1.181 usbdi.c
--- sys/dev/usb/usbdi.c	10 Jan 2019 22:13:07 -0000	1.181
+++ sys/dev/usb/usbdi.c	12 Feb 2019 18:51:28 -0000
@@ -884,9 +884,13 @@ usbd_ar_pipe(struct usbd_pipe *pipe)
 		USBHIST_LOG(usbdebug, "pipe = %#jx xfer = %#jx "
 		    "(methods = %#jx)", (uintptr_t)pipe, (uintptr_t)xfer,
 		    (uintptr_t)pipe->up_methods, 0);
-		/* Make the HC abort it (and invoke the callback). */
-		pipe->up_methods->upm_abort(xfer);
-		/* XXX only for non-0 usbd_clear_endpoint_stall(pipe); */
+		if (xfer->ux_state == USBD_NOT_STARTED) {
+			SIMPLEQ_REMOVE_HEAD(&pipe->up_queue, ux_next);
+		} else {
+			/* Make the HC abort it (and invoke the callback). */
+			pipe->up_methods->upm_abort(xfer);
+			/* XXX only for non-0 usbd_clear_endpoint_stall(pipe); */
+		}
 	}
 	pipe->up_aborting = 0;
 	return USBD_NORMAL_COMPLETION;