On 12/02/2019 16:02, Rin Okuyama wrote:
Hi,
The system freezes indefinitely with xhci(4) or ehci(4), when NIC with
multiple outstanding transfers [axen(4), mue(4), and ure(4)] is stopped
by "ifconfig down" or detached.
As discussed in the previous message, this is due to infinite loop in
usbd_ar_pipe(); xfers with USBD_NOT_STARTED remain in a queue forever
because upm_abort [= xhci_device_bulk_abort() etc.] cannot remove them.
Why not the attached patch instead?
Nick
? sys/dev/usb/cscope.out
Index: sys/dev/usb/usbdi.c
===================================================================
RCS file: /cvsroot/src/sys/dev/usb/usbdi.c,v
retrieving revision 1.181
diff -u -p -r1.181 usbdi.c
--- sys/dev/usb/usbdi.c 10 Jan 2019 22:13:07 -0000 1.181
+++ sys/dev/usb/usbdi.c 12 Feb 2019 18:51:28 -0000
@@ -884,9 +884,13 @@ usbd_ar_pipe(struct usbd_pipe *pipe)
USBHIST_LOG(usbdebug, "pipe = %#jx xfer = %#jx "
"(methods = %#jx)", (uintptr_t)pipe, (uintptr_t)xfer,
(uintptr_t)pipe->up_methods, 0);
- /* Make the HC abort it (and invoke the callback). */
- pipe->up_methods->upm_abort(xfer);
- /* XXX only for non-0 usbd_clear_endpoint_stall(pipe); */
+ if (xfer->ux_state == USBD_NOT_STARTED) {
+ SIMPLEQ_REMOVE_HEAD(&pipe->up_queue, ux_next);
+ } else {
+ /* Make the HC abort it (and invoke the callback). */
+ pipe->up_methods->upm_abort(xfer);
+ /* XXX only for non-0 usbd_clear_endpoint_stall(pipe);
*/
+ }
}
pipe->up_aborting = 0;
return USBD_NORMAL_COMPLETION;
