Re: [PATCH] xhci: Fix command ring pointer corruption while aborting a command

[Mathias Nyman <mathias.nyman@linux.intel.com>]

On 4.10.2021 11.22, Mathias Nyman wrote:
> On 1.10.2021 10.22, Pavankumar Kondeti wrote:
>> The command ring pointer is located at [6:63] bits of the command
>> ring control register (CRCR). All the control bits like command stop,
>> abort are located at [0:3] bits. While aborting a command, we read the
>> CRCR and set the abort bit and write to the CRCR. The read will always
>> give command ring pointer as all zeros. So we essentially write only
>> the control bits. Since we split the 64 bit write into two 32 bit writes,
>> there is a possibility of xHC command ring stopped before the upper
>> dword (all zeros) is written. If that happens, xHC updates the upper
>> dword of its internal command ring pointer with all zeros. Next time,
>> when the command ring is restarted, we see xHC memory access failures.
>> Fix this issue by only writing to the lower dword of CRCR where all
>> control bits are located.
>>
>> Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
> 
> 
> Thanks, nice catch.
> 
> Adding to queue

just to clarify, took v2

-Mathias