On Fri, Dec 02, 2011 at 01:52:43PM -0800, Greg Kroah-Hartman wrote:
> From: Andiry Xu <andiry.xu@xxxxxxx>
>
> When system enters suspend, xHCI driver clears command ring by writing zero
> to all the TRBs. However, this also writes zero to the Link TRB, and the ring
> is mangled. This may cause driver accesses wrong memory address and the
> result is unpredicted.
>
> When clear the command ring, keep the last Link TRB intact, only clear its
> cycle bit. This should fix the "command ring full" issue reported by Oliver
> Neukum.
>
> This should be backported to stable kernels as old as 2.6.37, since the
> commit 89821320 "xhci: Fix command ring replay after resume" is merged.
>
> Signed-off-by: Andiry Xu <andiry.xu@xxxxxxx>
> Signed-off-by: Sarah Sharp <sarah.a.sharp@xxxxxxxxxxxxxxx>
> Reported-by: Oliver Neukum <oneukum@xxxxxxx>
I also forgot to Cc stable for this patch. Where is my head this week?
Sarah Sharp
> ---
> drivers/usb/host/xhci.c | 5 ++++-
> 1 files changed, 4 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
> index aa94c01..a1afb7c 100644
> --- a/drivers/usb/host/xhci.c
> +++ b/drivers/usb/host/xhci.c
> @@ -711,7 +711,10 @@ static void xhci_clear_command_ring(struct xhci_hcd *xhci)
> ring = xhci->cmd_ring;
> seg = ring->deq_seg;
> do {
> - memset(seg->trbs, 0, SEGMENT_SIZE);
> + memset(seg->trbs, 0,
> + sizeof(union xhci_trb) * (TRBS_PER_SEGMENT - 1));
> + seg->trbs[TRBS_PER_SEGMENT - 1].link.control &=
> + cpu_to_le32(~TRB_CYCLE);
> seg = seg->next;
> } while (seg != ring->deq_seg);
>
> --
> 1.7.7.3
>
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
