6418563 pcie_pci(7d): cannot reference statep after it is freed

6418727 Bge driver failed to attach on pcie x86 system
6419439 calling pci_mech1_* holding a spinlock causes systems to hang

3 files changed, 16 insertions, 9 deletions

diff --git a/usr/src/uts/i86pc/io/pciex/pcie_pci.c b/usr/src/uts/i86pc/io/pciex/pcie_pci.c
index d05ee283c3..39a6a3c0a4 100644
--- a/usr/src/uts/i86pc/io/pciex/pcie_pci.c
+++ b/usr/src/uts/i86pc/io/pciex/pcie_pci.c
@@ -471,10 +471,6 @@ pepb_detach(dev_info_t *devi, ddi_detach_cmd_t cmd)
 	/* uninitialize inband PCI-E HPC if present */
 	if (pepb->inband_hpc == INBAND_HPC_PCIE)
 		(void) pciehpc_uninit(devi);
-	/*
-	 * And finally free the per-pci soft state.
-	 */
-	ddi_soft_state_free(pepb_state, ddi_get_instance(devi));
 
 	/*
 	 * Uninitialize hotplug support on this bus.
@@ -489,6 +485,12 @@ pepb_detach(dev_info_t *devi, ddi_detach_cmd_t cmd)
 	mutex_destroy(&pepb->pepb_err_mutex);
 	mutex_destroy(&pepb->pepb_peek_poke_mutex);
 	ddi_fm_fini(devi);
+
+	/*
+	 * And finally free the per-pci soft state.
+	 */
+	ddi_soft_state_free(pepb_state, ddi_get_instance(devi));
+
 	return (DDI_SUCCESS);
 }
 
diff --git a/usr/src/uts/i86pc/os/ddi_impl.c b/usr/src/uts/i86pc/os/ddi_impl.c
index d6490e4d59..14703e7dfc 100644
--- a/usr/src/uts/i86pc/os/ddi_impl.c
+++ b/usr/src/uts/i86pc/os/ddi_impl.c
@@ -2299,6 +2299,10 @@ pci_peekpoke_check_fma(dev_info_t *dip, void *arg, ddi_ctl_enum_t ctlop)
 	int check_err = 0;
 	int repcount = in_args->repcount;
 
+	if (ctlop == DDI_CTLOPS_POKE &&
+	    hdlp->ah_acc.devacc_attr_access != DDI_CAUTIOUS_ACC)
+		return (DDI_SUCCESS);
+
 	if (ctlop == DDI_CTLOPS_PEEK &&
 	    hdlp->ah_acc.devacc_attr_access != DDI_CAUTIOUS_ACC) {
 		for (; repcount; repcount--) {
@@ -2332,7 +2336,6 @@ pci_peekpoke_check_fma(dev_info_t *dip, void *arg, ddi_ctl_enum_t ctlop)
 	 */
 	bzero(&de, sizeof (ddi_fm_error_t));
 	de.fme_ena = fm_ena_generate(0, FM_ENA_FMT1);
-	de.fme_bus_specific = (void *)in_args->dev_addr;
 	if (hdlp->ah_acc.devacc_attr_access == DDI_CAUTIOUS_ACC) {
 		de.fme_flag = DDI_FM_ERR_EXPECTED;
 		de.fme_acc_handle = in_args->handle;
@@ -2426,7 +2429,7 @@ pci_peekpoke_check(dev_info_t *dip, dev_info_t *rdip,
 	ddi_acc_impl_t *hp = (ddi_acc_impl_t *)in_args->handle;
 
 	if (hp->ahi_acc_attr & DDI_ACCATTR_CONFIG_SPACE) {
-	    if (!mutex_tryenter(err_mutexp)) {
+		if (!mutex_tryenter(err_mutexp)) {
 			/*
 			 * As this may be a recursive call from within
 			 * pci_ereport_post() we can't wait for the mutexes.
diff --git a/usr/src/uts/i86pc/os/pci_cfgspace.c b/usr/src/uts/i86pc/os/pci_cfgspace.c
index cc811bbc63..07469a1b9b 100644
--- a/usr/src/uts/i86pc/os/pci_cfgspace.c
+++ b/usr/src/uts/i86pc/os/pci_cfgspace.c
@@ -20,7 +20,7 @@
  */
 
 /*
- * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
+ * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
  * Use is subject to license terms.
  */
 
@@ -79,8 +79,10 @@ kmutex_t pcicfg_chipset_mutex;
 void
 pci_cfgspace_init(void)
 {
-	mutex_init(&pcicfg_mutex, NULL, MUTEX_DEFAULT, 0);
-	mutex_init(&pcicfg_chipset_mutex, NULL, MUTEX_DEFAULT, 0);
+	mutex_init(&pcicfg_mutex, NULL, MUTEX_SPIN,
+	    (ddi_iblock_cookie_t)ipltospl(15));
+	mutex_init(&pcicfg_chipset_mutex, NULL, MUTEX_SPIN,
+	    (ddi_iblock_cookie_t)ipltospl(15));
 	if (!pci_check()) {
 		mutex_destroy(&pcicfg_mutex);
 		mutex_destroy(&pcicfg_chipset_mutex);