)]}'
{
  "commit": "678539cfaa090093a9aef185f545f6b17acc445c",
  "tree": "44d5be527d8e9a5bc8facbc1fdd95cf192765996",
  "parents": [
    "0c487206fe925ef370e1fc092003efb74ad57410"
  ],
  "author": {
    "name": "Sarah Sharp",
    "email": "sarah.a.sharp@linux.intel.com",
    "time": "Tue Oct 27 10:55:52 2009 -0700"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@suse.de",
    "time": "Fri Dec 11 11:55:17 2009 -0800"
  },
  "message": "USB: xhci: Handle URB cancel, complete and resubmit race.\n\nIn the old code, there was a race condition between the stop endpoint\ncommand and the URB submission process.  When the stop endpoint command is\nhandled by the event handler, the endpoint ring is assumed to be stopped.\nWhen a stop endpoint command is queued, URB submissions are to not ring\nthe doorbell.  The old code would check the number of pending URBs to be\ncanceled, and would not ring the doorbell if it was non-zero.\n\nHowever, the following race condition could occur with the old code:\n\n1. Cancel an URB, add it to the list of URBs to be canceled, queue the stop\n   endpoint command, and increment ep-\u003ecancels_pending to 1.\n2. The URB finishes on the HW, and an event is enqueued to the event ring\n   (at the same time as 1).\n3. The stop endpoint command finishes, and the endpoint is halted.  An\n   event is queued to the event ring.\n4. The event handler sees the finished URB, notices it was to be\n   canceled, decrements ep-\u003ecancels_pending to 0, and removes it from the to\n   be canceled list.\n5. The event handler drops the lock and gives back the URB.  The\n   completion handler requeues the URB (or a different driver enqueues a new\n   URB).  This causes the endpoint\u0027s doorbell to be rung, since\n   ep-\u003ecancels_pending \u003d\u003d 0.  The endpoint is now running.\n6. A second URB is canceled, and it\u0027s added to the canceled list.\n   Since ep-\u003ecancels_pending \u003d\u003d 0, a new stop endpoint command is queued, and\n   ep-\u003ecancels_pending is incremented to 1.\n7. The event handler then sees the completed stop endpoint command.  The\n   handler assumes the endpoint is stopped, but it isn\u0027t.  It attempts to\n   move the dequeue pointer or change TDs to cancel the second URB, while the\n   hardware is actively accessing the endpoint ring.\n\nTo eliminate this race condition, a new endpoint state bit is introduced,\nEP_HALT_PENDING.  When this bit is set, a stop endpoint command has been\nqueued, and the command handler has not begun to process the URB\ncancellation list yet.  The endpoint doorbell should not be rung when this\nis set.  Set this when a stop endpoint command is queued, clear it when\nthe handler for that command runs, and check if it\u0027s set before ringing a\ndoorbell.  ep-\u003ecancels_pending is eliminated, because it is no longer\nused.\n\nMake sure to ring the doorbell for an endpoint when the stop endpoint\ncommand handler runs, even if the canceled URB list is empty.  All\ncanceled URBs could have completed and new URBs could have been enqueued\nwithout the doorbell being rung before the command was handled.\n\nSigned-off-by: Sarah Sharp \u003csarah.a.sharp@linux.intel.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@suse.de\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "932f9993848175e476244fd23fa90303cc6b7d61",
      "old_mode": 33188,
      "old_path": "drivers/usb/host/xhci-hcd.c",
      "new_id": "3a30db6d6abe0ac0247b18f31d43295debce6d39",
      "new_mode": 33188,
      "new_path": "drivers/usb/host/xhci-hcd.c"
    },
    {
      "type": "modify",
      "old_id": "821b7b4709de6531b28afb78c428ad4f5379ff81",
      "old_mode": 33188,
      "old_path": "drivers/usb/host/xhci-ring.c",
      "new_id": "184e8b6f30b203c465949947644b04c20ee7a9d7",
      "new_mode": 33188,
      "new_path": "drivers/usb/host/xhci-ring.c"
    },
    {
      "type": "modify",
      "old_id": "4b254b6fa2456468731925199a69de85afd84602",
      "old_mode": 33188,
      "old_path": "drivers/usb/host/xhci.h",
      "new_id": "b173fd96dceb890c886cbace5a24e027b9372277",
      "new_mode": 33188,
      "new_path": "drivers/usb/host/xhci.h"
    }
  ]
}