Re: [PATCH] xhci: Fix command ring pointer corruption while aborting a command

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 4.10.2021 11.22, Mathias Nyman wrote:
> On 1.10.2021 10.22, Pavankumar Kondeti wrote:
>> The command ring pointer is located at [6:63] bits of the command
>> ring control register (CRCR). All the control bits like command stop,
>> abort are located at [0:3] bits. While aborting a command, we read the
>> CRCR and set the abort bit and write to the CRCR. The read will always
>> give command ring pointer as all zeros. So we essentially write only
>> the control bits. Since we split the 64 bit write into two 32 bit writes,
>> there is a possibility of xHC command ring stopped before the upper
>> dword (all zeros) is written. If that happens, xHC updates the upper
>> dword of its internal command ring pointer with all zeros. Next time,
>> when the command ring is restarted, we see xHC memory access failures.
>> Fix this issue by only writing to the lower dword of CRCR where all
>> control bits are located.
>>
>> Signed-off-by: Pavankumar Kondeti <pkondeti@xxxxxxxxxxxxxx>
> 
> 
> Thanks, nice catch.
> 
> Adding to queue

just to clarify, took v2

-Mathias




[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux