From patchwork Fri Oct 1 12:19:17 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pavan Kondeti X-Patchwork-Id: 12530499 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AFAB1C433EF for ; Fri, 1 Oct 2021 12:19:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 83EF561A85 for ; Fri, 1 Oct 2021 12:19:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1354347AbhJAMVc (ORCPT ); Fri, 1 Oct 2021 08:21:32 -0400 Received: from so254-9.mailgun.net ([198.61.254.9]:11072 "EHLO so254-9.mailgun.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231313AbhJAMVc (ORCPT ); Fri, 1 Oct 2021 08:21:32 -0400 DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mg.codeaurora.org; q=dns/txt; s=smtp; t=1633090788; h=References: In-Reply-To: Message-Id: Date: Subject: Cc: To: From: Sender; bh=RDZYWJryjXt5KGjlspKeJRXLslVEDR1EqDnYjI6acwk=; b=HhOWKfVoHpWCZHemmHRTz8J/O7E5xHm6QN/+BgahMuXf9D964zYE21zadiuMDyRiOOHo6Nmi WKtdPaIQlhjHaDiQKZo1aV4FwaclQGfkZVxr1ZsAmSMu3IHh5XnXtBxz4Z4WpJ5b7NHzLpG4 AKpMEp6tAoW2+anQLO6HOP7aDvw= X-Mailgun-Sending-Ip: 198.61.254.9 X-Mailgun-Sid: WyIxZTE2YSIsICJsaW51eC11c2JAdmdlci5rZXJuZWwub3JnIiwgImJlOWU0YSJd Received: from smtp.codeaurora.org (ec2-35-166-182-171.us-west-2.compute.amazonaws.com [35.166.182.171]) by smtp-out-n02.prod.us-east-1.postgun.com with SMTP id 6156fccd8578ef11ed6f9cc2 (version=TLS1.2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256); Fri, 01 Oct 2021 12:19:25 GMT Sender: pkondeti=codeaurora.org@mg.codeaurora.org Received: by smtp.codeaurora.org (Postfix, from userid 1001) id 88728C4338F; Fri, 1 Oct 2021 12:19:24 +0000 (UTC) Received: from codeaurora.org (unknown [202.46.22.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: pkondeti) by smtp.codeaurora.org (Postfix) with ESMTPSA id B81E6C4360C; Fri, 1 Oct 2021 12:19:21 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 smtp.codeaurora.org B81E6C4360C Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; spf=fail smtp.mailfrom=codeaurora.org From: Pavankumar Kondeti To: Greg Kroah-Hartman , Mathias Nyman Cc: Jack Pham , linux-usb@vger.kernel.org, stable@vger.kernel.org, Pavankumar Kondeti Subject: [PATCH] xhci: Fix command ring pointer corruption while aborting a command Date: Fri, 1 Oct 2021 17:49:17 +0530 Message-Id: <1633090757-8473-1-git-send-email-pkondeti@codeaurora.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1633072946-16826-1-git-send-email-pkondeti@codeaurora.org> References: <1633072946-16826-1-git-send-email-pkondeti@codeaurora.org> Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The command ring pointer is located at [6:63] bits of the command ring control register (CRCR). All the control bits like command stop, abort are located at [0:3] bits. While aborting a command, we read the CRCR and set the abort bit and write to the CRCR. The read will always give command ring pointer as all zeros. So we essentially write only the control bits. Since we split the 64 bit write into two 32 bit writes, there is a possibility of xHC command ring stopped before the upper dword (all zeros) is written. If that happens, xHC updates the upper dword of its internal command ring pointer with all zeros. Next time, when the command ring is restarted, we see xHC memory access failures. Fix this issue by only writing to the lower dword of CRCR where all control bits are located. Signed-off-by: Pavankumar Kondeti --- v2: %s/u64/u32 for a variable in xhci_abort_cmd_ring() drivers/usb/host/xhci-ring.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index e676749..d7fe6d4 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -366,16 +366,22 @@ static void xhci_handle_stopped_cmd_ring(struct xhci_hcd *xhci, /* Must be called with xhci->lock held, releases and aquires lock back */ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci, unsigned long flags) { - u64 temp_64; + u32 temp_32; int ret; xhci_dbg(xhci, "Abort command ring\n"); reinit_completion(&xhci->cmd_ring_stop_completion); - temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring); - xhci_write_64(xhci, temp_64 | CMD_RING_ABORT, - &xhci->op_regs->cmd_ring); + /* + * The control bits like command stop, abort are located in lower + * dword of the command ring control register. Limit the write + * to the lower dword to avoid corrupting the command ring pointer + * in case if the command ring is stopped by the time upper dword + * is written. + */ + temp_32 = readl(&xhci->op_regs->cmd_ring); + writel(temp_32 | CMD_RING_ABORT, &xhci->op_regs->cmd_ring); /* Section 4.6.1.2 of xHCI 1.0 spec says software should also time the * completion of the Command Abort operation. If CRR is not negated in 5