Hi, On 2022/05/14 19:44, Taylor R Campbell wrote: > Module Name: src > Committed By: riastradh > Date: Sat May 14 19:44:37 UTC 2022 > > Modified Files: > src/sys/dev/usb: xhci.c > > Log Message: > xhci(4): Handle race between software abort and hardware stall.
xhci_abortx is expected to stop given single xfer, but it actually stops all xfers in pipe. When usbd_ar_pipe stops the first xfer in up_queue of isoc pipe such as uvideo(4), HCI generates multiple Transfer Events (UVIDEO_NXFERS (3) for uvideo) in order xfers are posted. ux_status of first xfer is set to USBD_CANCELLED by usbd_xfer_abort, so usbd_xfer_trycomplete in xhci_event_transfer fails and usb_transfer_complete is not called (xhci_abortx does it instead). However, other two xfers has ux_status = USBD_IN_PROGRESS, depending on how quick events are generated, xhci_event_transfer may call usb_transfer_complete for them before xhci_abortx calls usb_transfer_complete. It may fire KASSERT failure "not start of queue."
