d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
a80b6c725e
freebsd-dev/sys/dev
History
Ian Dowse d63700b023 The ohci driver's processing of completed transfer descriptors (TDs) 
appeared to rely on all kinds of non-guaranteed behaviours: the
transfer abort code assumed that TDs with no interrupt timeout
configured would end up on the done queue within 20ms, the done
queue processing assumed that all TDs from a transfer would appear
at the same time, and there were access-after-free bugs triggered
on failed transfers.

Attempt to fix these problems by the following changes:
 - Use a maximum (6-frame) interrupt delay instead of no interrupt
   delay to ensure that the 20ms wait in ohci_abort_xfer() is enough
   for the TDs to have been taken off the hardware done queue.
 - Defer cancellation of timeouts and freeing of TDs until we either
   hit an error or reach the final TD.
 - Remove TDs from the done queue before freeing them so that it
   is safe to continue traversing the done queue.

This appears to fix a hang that was reproducable with revision 1.67
or 1.68 of ulpt.c (earlier revisions had a different transfer
pattern). With certain HP printers, the command "true > /dev/ulpt0"
would cause ohci_add_done() to spin because the done queue had a
loop. The list corruption was caused by a 3-TD transfer where the
first TD completed but remained on the internal host controller
done queue because it had no interrupt timeout. When the transfer
timed out, the TD got freed and reused, so it caused a loop in the
done queue when it was inserted a second time from a different
transfer.

Reported by:	Alex Pivovarov
MFC after:	1 week
2005-11-27 09:05:37 +00:00
..
aac Remove the unused AAC_DRIVER_BUILD_DATE macro. 2005-11-13 17:26:36 +00:00
acpi_support
acpica Add a locking stub to call acpi_cmbat_get_bif() now that it is directly 2005-11-26 07:36:53 +00:00
adlink
advansys
agp 0xb1881106 seems to be an AGP bridge and some BIOSes incorrectly handle 2005-11-14 21:54:20 +00:00
aha
ahb
aic
aic7xxx Fix mysterious build failures (with parallel make) early in 2005-11-21 14:41:10 +00:00
amd
amr The CAM interface is broken and seems to be causing lockups on boot. It 2005-11-26 07:30:09 +00:00
an - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
ar
arcmsr
arl - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
asr
ata When IOCATAGPARM is called, update the capabilities page that is stored 2005-11-25 09:00:56 +00:00
ath nuke special handling to extend cts when bursting; it was race prone 2005-11-15 05:49:02 +00:00
atkbdc
auxio
awi
bfe - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
bge Recognize Broadcom BCM5752 chip, that can be found in HP DC7600. 2005-11-15 14:43:22 +00:00
bktr Add some cards: 2005-11-13 13:26:37 +00:00
buslogic
cardbus Cardbus has only 1 slot, so simplify a little. 2005-10-28 06:03:53 +00:00
ciss Update PCI ids to add the E200, E200i, P400, and P400i storage 2005-11-11 16:45:33 +00:00
cm
cnw
cp
cpufreq
cs
ct
ctau
cx - Use swi_remove() to teardown swi handlers rather than 2005-10-26 15:52:16 +00:00
cy Catch up with new interrupt handling code. 2005-10-26 06:44:59 +00:00
dc Resolve misalignment traps caused by changes to IF_LLADDR(). 2005-11-22 01:51:57 +00:00
dcons Make ttyconsolemode() call ttsetwater() so that drivers don't have to. 2005-10-16 20:58:22 +00:00
de Various fixes to make de(4) not panic after ru@'s IF_LLADDR() changes: 2005-11-21 21:50:07 +00:00
dec
digi Eliminate two unused arguments to ttycreate(). 2005-10-16 20:22:56 +00:00
dpt
drm
ed - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
eisa
em Remember the bus_dmamap_t where we loaded the mbuf, and sync this map instead 2005-11-24 15:13:47 +00:00
en Drop the driver lock around atm_input() analogous to all the ethernet 2005-10-27 21:08:12 +00:00
ep - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
esp
ex - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
exca Set the name of the chipset found 2005-10-19 00:25:39 +00:00
fatm
fb Remove unecessary include file. machine/rpb.h is very alpha specific 2005-11-07 07:41:17 +00:00
fdc
fe Return 0 if we are a network card and do match. Previously, we'd bogusly 2005-11-19 23:26:57 +00:00
firewire Fix panic when we cannot find self-id of probing nodes. 2005-11-25 14:29:24 +00:00
fxp - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
gem - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
gfb
harp
hatm
hfa
hifn
hme - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
hptmv Don't augment the DRIVER_VERSION "v1.12" with __DATE__ and __TIME__. 2005-11-13 10:13:31 +00:00
hwpmc Add support for a new/unreleased Pentium-M. 2005-11-18 16:47:24 +00:00
ic Typo. 2005-10-23 09:05:51 +00:00
ichsmb
ichwd
ida
idt
ie - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
ieee488
if_ndis The latest version of the Intel 2200BG/2915ABG driver (9.0.0.3-9) from 2005-11-06 19:38:34 +00:00
iicbus
iir
io
ips
ipw Use memcpy/memset consistently accross ipw and iwi instead of bcopy/bzero. 2005-11-20 16:13:00 +00:00
isp Add an ioctl framework for doing FC task management functions from 2005-10-29 02:46:59 +00:00
ispfw
iwi Don't use /etc/firmware. /etc is for configuration files only. 2005-11-20 16:02:04 +00:00
ixgb - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
joy Unbreak second joystick (joy1) support. 2005-11-09 20:26:00 +00:00
kbd
kbdmux Spotted a call to a cdev-related function not wrapped 2005-10-18 06:38:14 +00:00
led
lge Add locking and mark MPSAFE: 2005-11-23 18:51:34 +00:00
lmc - Don't include opt_global.h, it is always included implicitly. 2005-10-05 10:07:27 +00:00
lnc Really fix it this time. 2005-11-12 19:14:21 +00:00
mc146818
mca
mcd
md Normalize a significant number of kernel malloc type names: 2005-10-31 15:41:29 +00:00
mem
mii Remove dc-only pseudo phy devices after repo copy to dev/dc 2005-10-18 06:10:46 +00:00
mk48txx
mlx
mly
mpt Keep track of volumes in non-optimal state and expose a simple count 2005-11-15 02:38:35 +00:00
mse
my - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
ncv
nge - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
nmdm
nsp
null
nve Overhaul nve(4) locking to make it more like other ethernet drivers in 2005-11-21 22:14:49 +00:00
ofw - Add a new method ofw_bus_default_get_devinfo() that allows to retrieve 2005-11-22 16:37:45 +00:00
patm
pbio
pccard Add Global Village lan modem. 2005-10-29 03:48:24 +00:00
pccbb Mollify the whitespace police 2005-11-08 15:42:12 +00:00
pcf
pci Improve diagnostic message. 2005-11-09 03:37:52 +00:00
pdq - Make IFP2ENADDR() a pointer to IF_LLADDR() rather than another 2005-11-11 07:36:14 +00:00
ppbus
ppc
pst
puc Don't enable PUC_FASTINTR by default in the source. Instead, enable it 2005-11-21 20:22:35 +00:00
ral Optimize PLCP length field computation for 802.11b rates. 2005-11-23 17:32:57 +00:00
random
ray - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
rc - Use swi_remove() to teardown swi handlers rather than 2005-10-26 15:52:16 +00:00
re Check IFF_DRV_RUNNING in the re_intr() loop. It can disappear, 2005-11-22 12:46:15 +00:00
rndtest
rp Fix support for multiple RocketPort cards in the same machine by including 2005-11-08 15:33:39 +00:00
sab - Use swi_remove() to teardown swi handlers rather than 2005-10-26 15:52:16 +00:00
safe
sbni - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
sbsh
scd
sf - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
si Add #nclude <dev/pci/pcireg.h> to pick up definitions for PCIR_BAR and 2005-11-08 04:11:50 +00:00
sio Reorganize the interrupt handling code a bit to make a few things cleaner 2005-10-25 19:48:48 +00:00
sk - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
smbus
sn
snc - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
snp
sound Support for ATI IXP 200 / 300 / 400 series audio controllers. 2005-11-27 03:29:59 +00:00
speaker Add /dev/speaker support to amd64. 2005-11-11 09:57:32 +00:00
sr
stg
streams
sym
syscons Add a font width argument to vi_load_font_t, vi_save_font_t and vi_putm_t 2005-09-28 14:54:07 +00:00
tdfx Normalize a significant number of kernel malloc type names: 2005-10-31 15:41:29 +00:00
tga
ti - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
trm
twa twa corresponding to the 9.3.0.1 release on the 3ware website. This driver has 2005-11-08 22:51:43 +00:00
twe Normalize a significant number of kernel malloc type names: 2005-10-31 15:41:29 +00:00
tx - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
txp - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
uart In uart_bus_probe() return BUS_PROBE_DEFAULT when the probe is 2005-10-28 06:30:39 +00:00
ubsec
usb The ohci driver's processing of completed transfer descriptors (TDs) 2005-11-27 09:05:37 +00:00
utopia
vge - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
vkbd
vr - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
vx - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
watchdog Return zero when disabling watchdog, unless any of the drivers complain. 2005-09-29 12:31:44 +00:00
wds
wi - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
wl - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
xe - Store pointer to the link-level address right in "struct ifnet" 2005-11-11 16:04:59 +00:00
zs - Use swi_remove() to teardown swi handlers rather than 2005-10-26 15:52:16 +00:00