From owner-freebsd-bugs  Mon Jun  1 13:10:45 1998
Return-Path: <owner-freebsd-bugs@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id NAA20911
          for freebsd-bugs-outgoing; Mon, 1 Jun 1998 13:10:45 -0700 (PDT)
          (envelope-from owner-freebsd-bugs@FreeBSD.ORG)
Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA20851
          for <freebsd-bugs@FreeBSD.org>; Mon, 1 Jun 1998 13:10:30 -0700 (PDT)
          (envelope-from gnats@FreeBSD.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.8.8/8.8.5) id NAA12315;
	Mon, 1 Jun 1998 13:10:01 -0700 (PDT)
Received: (from nobody@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id NAA20243;
          Mon, 1 Jun 1998 13:07:25 -0700 (PDT)
          (envelope-from nobody)
Message-Id: <199806012007.NAA20243@hub.freebsd.org>
Date: Mon, 1 Jun 1998 13:07:25 -0700 (PDT)
From: nick.hibma@jrc.it
To: freebsd-gnats-submit@FreeBSD.ORG
X-Send-Pr-Version: www-1.0
Subject: kern/6819: pci_unmap_int (pci/pci.c) does not properly unmask an interrupt
Sender: owner-freebsd-bugs@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.org


>Number:         6819
>Category:       kern
>Synopsis:       pci_unmap_int (pci/pci.c) does not properly unmask an interrupt
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:
>Keywords:
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Jun  1 13:10:00 PDT 1998
>Last-Modified:
>Originator:     Nick Hibma
>Organization:
None
>Release:        2.2.1
>Environment:
FreeBSD heidi.plazza.it 2.2.1-RELEASE FreeBSD 2.2.1-RELEASE #48: Mon Jun  1 20:37:12 CEST 1998     toor@heidi.plazza.it:/usr/src/sys/compile/HEIDI  i386
>Description:
Unmapping an interrupt used by a PCI device is incorrectly done. Mapping
it, unmapping it and then mapping it again results it a failing mapping.

Unmapping is done, but somehow the unmapping is not done completely in
pci_unmap_int. After the failed attempt the to map the interrupt another 
try is succesfull:

pci_map_int (succesfull)
pci_unmap_int (succesfull)
pci_map_int (fails)
pci_map_int (succesfull) <<<<<<<<<<<<<<<<<<<<
pci_unmap_int (succesfull)
pci_map_int (fails)
pci_map_int (succesfull) <<<<<<<<<<<<<<<<<<<<
etc.
>How-To-Repeat:
Load an LKM module that registers a PCI interrupt with pci_map_int and can be unloaded unmapping the interrupt with pci_unmap_int.

Load the LKM, unload it and load it again. The LKM should complain about
not being able to map the interrupt. Loading it a second time should be
succesfull.

Possible LKM to be used: USB stack http://www.etla.net/~n_hibma/usb/usb.pl

This LKM maps the interrupt as bio_imask.
>Fix:
Moved the exclusion of the interrupt mask below the part detaching the
irq.

Reason for this is that in pci_imask_exclude the interrupt is masked out
but after calling update_intr_masks the bit is set again in *maskptr,
because the interrupt has not yet been detached.

This fix should be checked by someone who knows what he is doing, when
interrupts are concerned, because I am a nono in that field (any field
actually, but don't tell anyone :-).

diff -C3 pci.c.orig pci.c

*** pci.c.orig  Mon Jun  1 21:59:24 1998
--- pci.c       Mon Jun  1 21:55:35 1998
***************
*** 1392,1397 ****
--- 1392,1399 ----
        if (irq == 0xff)
                return (0);
  
+       oldspl = splq (1ul << irq);
+ 
        /*
        **      Search and unlink interrupt descriptor.
        */
***************
*** 1415,1423 ****
                irq, this->pcid_handler, this->pcid_argument,
                this->pcid_tag.tag, this->pcid_tally);
  
-       if (!getintdescbymptr (irq, this->pcid_maskptr))
-               (void) pcibus->pb_imaskexc (irq, this->pcid_maskptr);
- 
        /*
        **      If this irq no longer included in the mask, remove it.
        */
--- 1417,1422 ----
***************
*** 1437,1444 ****
  
        } else if (tail->pcid_next == NULL) {
  
-               oldspl = splq (1ul << irq);
- 
                /*
                **      Remove the shared int handler.
                **      Install the last remaining handler.
--- 1436,1441 ----
***************
*** 1455,1465 ****
  
                if (result)
                        printf ("\tirq %d: cannot install handler.\n", irq);
- 
-               splx (oldspl);
        };
  
        free (this, M_DEVBUF);
        return (1);
  }
  
--- 1452,1464 ----
  
                if (result)
                        printf ("\tirq %d: cannot install handler.\n", irq);
        };
  
+       if (!getintdescbymptr (irq, this->pcid_maskptr))
+               (void) pcibus->pb_imaskexc (irq, this->pcid_maskptr);
+ 
        free (this, M_DEVBUF);
+       splx (oldspl);
        return (1);
  }

>Audit-Trail:
>Unformatted:

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-bugs" in the body of the message