lkml.org 
[lkml]   [2017]   [Mar]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 153/370] usb: xhci: hold lock over xhci_abort_cmd_ring()
    3.16.42-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Lu Baolu <baolu.lu@linux.intel.com>

    commit 4dea70778c0f48b4385c7720c363ec8d37a401b4 upstream.

    In command timer function, xhci_handle_command_timeout(), xhci->lock
    is unlocked before call into xhci_abort_cmd_ring(). This might cause
    race between the timer function and the event handler.

    The xhci_abort_cmd_ring() function sets the CMD_RING_ABORT bit in the
    command register and polling it until the setting takes effect. A stop
    command ring event might be handled between writing the abort bit and
    polling for it. The event handler will restart the command ring, which
    causes the failure of polling, and we ever believed that we failed to
    stop it.

    As a bonus, this also fixes some issues of calling functions without
    locking in xhci_handle_command_timeout().

    Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    [bwh: Backported to 3.16: drop changes to the "failed to restart, or
    host removed" case]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/usb/host/xhci-ring.c | 13 +++++++++----
    1 file changed, 9 insertions(+), 4 deletions(-)

    --- a/drivers/usb/host/xhci-ring.c
    +++ b/drivers/usb/host/xhci-ring.c
    @@ -1311,21 +1311,25 @@ void xhci_handle_command_timeout(unsigne
    hw_ring_state = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
    if ((xhci->cmd_ring_state & CMD_RING_STATE_RUNNING) &&
    (hw_ring_state & CMD_RING_RUNNING)) {
    -
    - spin_unlock_irqrestore(&xhci->lock, flags);
    xhci_dbg(xhci, "Command timeout\n");
    ret = xhci_abort_cmd_ring(xhci);
    if (unlikely(ret == -ESHUTDOWN)) {
    xhci_err(xhci, "Abort command ring failed\n");
    xhci_cleanup_command_queue(xhci);
    + spin_unlock_irqrestore(&xhci->lock, flags);
    usb_hc_died(xhci_to_hcd(xhci)->primary_hcd);
    xhci_dbg(xhci, "xHCI host controller is dead.\n");
    +
    + return;
    }
    - return;
    +
    + goto time_out_completed;
    }
    /* command timeout on stopped ring, ring can't be aborted */
    xhci_dbg(xhci, "Command timeout on stopped ring\n");
    xhci_handle_stopped_cmd_ring(xhci, xhci->current_cmd);
    +
    +time_out_completed:
    spin_unlock_irqrestore(&xhci->lock, flags);
    return;
    }
    \
     
     \ /
      Last update: 2017-03-10 14:50    [W:2.068 / U:0.272 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site