Changeset 106281 in vbox

Timestamp:

Oct 10, 2024 9:16:39 AM (3 months ago)

Author:

vboxsync

Message:

DevOHCI: Quick fix for deadlock when pfnAbortEpByAddr is called. Ran into it while windows 2000 was shutting down (almost finished, screen all blue, but never powering off). There is a question whether we should re-reade the endpoint descriptor after regaining the lock, but the guest is free to change it regardless of whether we're holding the lock or not, so I guess it makes little difference.

File:

• trunk/src/VBox/Devices/USB/DevOHCI.cpp (modified) (4 diffs)

trunk/src/VBox/Devices/USB/DevOHCI.cpp

@@ -3888 +3888 @@
                 if (enmDir != VUSBDIRECTION_INVALID)
                 {
+                    /* Must leave the lock here, see ohciR3ServicePeriodicList for details. */
+                    ohciR3Unlock(pThisCC);
                     pThisCC->RootHub.pIRhConn->pfnAbortEpByAddr(pThisCC->RootHub.pIRhConn, uAddr, uEndPt, enmDir);
+                    ohciR3Lock(pThisCC);
+                    /** @todo should we re-read Ed here? */
                 }
             }
@@ -3948 +3952 @@
                if (enmDir != VUSBDIRECTION_INVALID)
                {
+                   /* Must leave the lock here, see ohciR3ServicePeriodicList for details. */
+                   ohciR3Unlock(pThisCC);
                    pThisCC->RootHub.pIRhConn->pfnAbortEpByAddr(pThisCC->RootHub.pIRhConn, uAddr, uEndPt, enmDir);
+                   ohciR3Lock(pThisCC);
+                   /** @todo should we re-read Ed here? */
                }
             }
@@ -4112 +4120 @@
                  * cancel outstanding URBs, if any.
                  * First we need to determine the transfer direction, which may fail(!).
+                 *
+                 * Note! We *must* leave the critsect before calling the abort function as
+                 *       it typically wants to send synchronous requests to the URB IO thread
+                 *       which will enter the critsect when responding.  ohciR3StartFrame
+                 *       entered the critsect and I (bird) can't immediately spot any cached
+                 *       state info that could get obsoleted while we're doing this (except
+                 *       some logging stuff).
                  */
                 uint8_t uAddr  = Ed.hwinfo & ED_HWINFO_FUNCTION;
@@ -4118 +4133 @@
                 if (enmDir != VUSBDIRECTION_INVALID)
                 {
+                    ohciR3Unlock(pThisCC);
                     pThisCC->RootHub.pIRhConn->pfnAbortEpByAddr(pThisCC->RootHub.pIRhConn, uAddr, uEndPt, enmDir);
+                    ohciR3Lock(pThisCC);
+                    /** @todo should we re-read Ed here? */
                 }
             }