Re: Multiple outstanding transfer vs xhci / ehci (Re: CVS commit: src/sys/dev/usb)

[Rin Okuyama <rokuyama.rk%gmail.com@localhost>]

Hi,

On 2019/02/13 3:54, Nick Hudson wrote:
> On 12/02/2019 16:02, Rin Okuyama wrote:
> > Hi,
> >
> > The system freezes indefinitely with xhci(4) or ehci(4), when NIC with
> > multiple outstanding transfers [axen(4), mue(4), and ure(4)] is stopped
> > by "ifconfig down" or detached.
> >
> > As discussed in the previous message, this is due to infinite loop in
> > usbd_ar_pipe(); xfers with USBD_NOT_STARTED remain in a queue forever
> > because upm_abort [= xhci_device_bulk_abort() etc.] cannot remove them.
>
>
> Why not the attached patch instead?
>
> Nick

Thank you so much for your prompt reply!

It works if s/ux_state/ux_status/ here:

+		if (xfer->ux_state == USBD_NOT_STARTED) {

Can I commit the revised patch?

Thanks,
rin
----
Index: usbdi.c
===================================================================
RCS file: /home/netbsd/src/sys/dev/usb/usbdi.c,v
retrieving revision 1.181
diff -p -u -r1.181 usbdi.c
--- sys/dev/usb/usbdi.c	10 Jan 2019 22:13:07 -0000	1.181
+++ sys/dev/usb/usbdi.c	13 Feb 2019 09:32:00 -0000
@@ -884,9 +884,13 @@ usbd_ar_pipe(struct usbd_pipe *pipe)
 		USBHIST_LOG(usbdebug, "pipe = %#jx xfer = %#jx "
 		    "(methods = %#jx)", (uintptr_t)pipe, (uintptr_t)xfer,
 		    (uintptr_t)pipe->up_methods, 0);
-		/* Make the HC abort it (and invoke the callback). */
-		pipe->up_methods->upm_abort(xfer);
-		/* XXX only for non-0 usbd_clear_endpoint_stall(pipe); */
+		if (xfer->ux_status == USBD_NOT_STARTED) {
+			SIMPLEQ_REMOVE_HEAD(&pipe->up_queue, ux_next);
+		} else {
+			/* Make the HC abort it (and invoke the callback). */
+			pipe->up_methods->upm_abort(xfer);
+			/* XXX only for non-0 usbd_clear_endpoint_stall(pipe); */
+		}
 	}
 	pipe->up_aborting = 0;
 	return USBD_NORMAL_COMPLETION;