[lkml]   [2012]   [Apr]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[ 36/68] xhci: Dont write zeroed pointers to xHC registers.
    3.2-stable review patch.  If anyone has any objections, please let me know.


    From: Sarah Sharp <>

    commit 159e1fcc9a60fc7daba23ee8fcdb99799de3fe84 upstream.

    When xhci_mem_cleanup() is called, we can't be sure if the xHC is
    actually halted. We can ask the xHC to halt by writing to the RUN bit
    in the command register, but that might timeout due to a HW hang.

    If the host controller is still running, we should not write zeroed
    values to the event ring dequeue pointers or base tables, the DCBAA
    pointers, or the command ring pointers. Eric Fu reports his VIA VL800
    host accesses the event ring pointers after a failed register restore on
    resume from suspend. The hypothesis is that the host never actually
    halted before the register write to change the event ring pointer to

    Remove all writes of zeroed values to pointer registers in
    xhci_mem_cleanup(). Instead, make all callers of the function reset the
    host controller first, which will reset those registers to zero.
    xhci_mem_init() is the only caller that doesn't first halt and reset the
    host controller before calling xhci_mem_cleanup().

    This should be backported to kernels as old as 2.6.32.

    Signed-off-by: Sarah Sharp <>
    Tested-by: Elric Fu <>
    Signed-off-by: Greg Kroah-Hartman <>

    drivers/usb/host/xhci-mem.c | 9 ++-------
    1 file changed, 2 insertions(+), 7 deletions(-)

    --- a/drivers/usb/host/xhci-mem.c
    +++ b/drivers/usb/host/xhci-mem.c
    @@ -1704,11 +1704,6 @@ void xhci_mem_cleanup(struct xhci_hcd *x
    int i;

    /* Free the Event Ring Segment Table and the actual Event Ring */
    - if (xhci->ir_set) {
    - xhci_writel(xhci, 0, &xhci->ir_set->erst_size);
    - xhci_write_64(xhci, 0, &xhci->ir_set->erst_base);
    - xhci_write_64(xhci, 0, &xhci->ir_set->erst_dequeue);
    - }
    size = sizeof(struct xhci_erst_entry)*(xhci->erst.num_entries);
    if (xhci->erst.entries)
    dma_free_coherent(&pdev->dev, size,
    @@ -1720,7 +1715,6 @@ void xhci_mem_cleanup(struct xhci_hcd *x
    xhci->event_ring = NULL;
    xhci_dbg(xhci, "Freed event ring\n");

    - xhci_write_64(xhci, 0, &xhci->op_regs->cmd_ring);
    if (xhci->cmd_ring)
    xhci_ring_free(xhci, xhci->cmd_ring);
    xhci->cmd_ring = NULL;
    @@ -1749,7 +1743,6 @@ void xhci_mem_cleanup(struct xhci_hcd *x
    xhci->medium_streams_pool = NULL;
    xhci_dbg(xhci, "Freed medium stream array pool\n");

    - xhci_write_64(xhci, 0, &xhci->op_regs->dcbaa_ptr);
    if (xhci->dcbaa)
    dma_free_coherent(&pdev->dev, sizeof(*xhci->dcbaa),
    xhci->dcbaa, xhci->dcbaa->dma);
    @@ -2358,6 +2351,8 @@ int xhci_mem_init(struct xhci_hcd *xhci,

    xhci_warn(xhci, "Couldn't initialize memory\n");
    + xhci_halt(xhci);
    + xhci_reset(xhci);
    return -ENOMEM;

     \ /
      Last update: 2012-04-19 23:19    [W:0.493 / U:5.084 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site