aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* ARM: move memory layout sanity checking before meminfo initializationRussell King2011-07-053-2/+9
| | | | | | | | | | Ensure that the meminfo array is sanity checked before we pass the memory to memblock. This helps to ensure that memblock and meminfo agree on the dimensions of memory, especially when more memory is passed than the kernel can deal with. Acked-by: Nicolas Pitre <nicolas.pitre@linaro.org> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
* ARM: 6990/1: MAINTAINERS: add entry for ARM PMU profiling and debuggingWill Deacon2011-07-051-0/+10
| | | | | | | | | | | | | | | | Following a request from Russell King: http://lists.infradead.org/pipermail/linux-arm-kernel/2011-June/055031.html Add myself as the ARM PMU profiling and debugging maintainer. This covers the ARM implementations of perf, oprofile and hw_breakpoint along with the glue for this to work on different platforms. Cc: Jean Pihet <j-pihet@ti.com> Acked-by: Jamie Iles <jamie@jamieiles.com> Acked-by: Linus Walleij <linus.walleij@linaro.org> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
* ARM: 6989/1: perf: do not start the PMU when no events are presentWill Deacon2011-07-051-2/+4
| | | | | | | | | | | | | | | armpmu_enable can be called in situations where no events are present (for example, from the event rotation tick after a profiled task has exited). In this case, we currently start the PMU anyway which may leave it active inevitably without any events being monitored. This patch adds a simple check to the enabling code so that we avoid starting the PMU when no events are present. Cc: <stable@kernel.org> Reported-by: Ashwin Chaugle <ashwinc@codeaurora.org> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
* ARM: dmabounce: fix map_single() error return valueRussell King2011-07-031-1/+1
| | | | | | | When map_single() is unable to obtain a safe buffer, we must return the dma_addr_t error value, which is ~0 rather than 0. Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
* Merge branch 'drm-fixes' of ↵Linus Torvalds2011-06-291-1/+1
|\ | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6 * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: drm/radeon/kms: increase rom size for atrm method
| * drm/radeon/kms: increase rom size for atrm methodAlex Deucher2011-06-301-1/+1
| | | | | | | | | | | | | | | | | | The vbios rom is >64k on a lot of modern asics. Increase the fetch size for atrm to make sure we don't miss part of a larger rom. Signed-off-by: Alex Deucher <alexdeucher@gmail.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
* | Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6Linus Torvalds2011-06-291-3/+3
|\ \ | |/ |/| | | | | * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: caam - fix operator precedence in shared descriptor allocation
| * crypto: caam - fix operator precedence in shared descriptor allocationKim Phillips2011-06-301-3/+3
| | | | | | | | | | | | | | | | | | | | setkey allocates 16 bytes (CAAM_CMD_SZ * DESC_AEAD_SHARED_TEXT_LEN) shy of what is needed to store the shared descriptor, resulting in memory corruption. Fix this. Signed-off-by: Kim Phillips <kim.phillips@freescale.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
* | Merge branch 'kvm-updates/3.0' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds2011-06-291-5/+7
|\ \ | | | | | | | | | | | | * 'kvm-updates/3.0' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: x86 emulator: fix %rip-relative addressing with immediate source operand
| * | KVM: x86 emulator: fix %rip-relative addressing with immediate source operandAvi Kivity2011-06-291-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | %rip-relative addressing is relative to the first byte of the next instruction, so we need to add %rip only after we've fetched any immediate bytes. Based on original patch by Li Xin <xin.li@intel.com>. Signed-off-by: Avi Kivity <avi@redhat.com> Acked-by: Li Xin <xin.li@intel.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
* | | Merge branch 'i2c-for-linus' of ↵Linus Torvalds2011-06-292-7/+8
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging * 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging: i2c/pca954x: Initialize the mux to disconnected state i2c-taos-evm: Fix log messages
| * | | i2c/pca954x: Initialize the mux to disconnected statePetri Gynther2011-06-291-3/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | pca954x power-on default is channel 0 connected. If multiple pca954x muxes are connected to the same physical I2C bus, the parent bus will see channel 0 devices behind both muxes by default. This is bad. Scenario: -- pca954x @ 0x70 -- ch 0 (I2C-bus-101) -- EEPROM @ 0x50 | I2C-bus-1 --- | -- pca954x @ 0x71 -- ch 0 (I2C-bus-111) -- EEPROM @ 0x50 1. Load I2C bus driver: creates I2C-bus-1 2. Load pca954x driver: creates virtual I2C-bus-101 and I2C-bus-111 3. Load eeprom driver 4. Try to read EEPROM @ 0x50 on I2C-bus-101. The transaction will also bleed onto I2C-bus-111 because pca954x @ 0x71 channel 0 is connected by default. Fix: Initialize pca954x to disconnected state in pca954x_probe() Signed-off-by: Petri Gynther <pgynther@google.com> Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: stable@kernel.org
| * | | i2c-taos-evm: Fix log messagesJean Delvare2011-06-291-4/+4
| |/ / | | | | | | | | | | | | | | | | | | | | | | | | * Print all error and information messages even when debugging is disabled. * Don't use adapter device to log messages before it is ready. Signed-off-by: Jean Delvare <khali@linux-fr.org> Cc: stable@kernel.org
* | | Merge branch 'merge' of ↵Linus Torvalds2011-06-2910-94/+105
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: arch/powerpc: use printk_ratelimited instead of printk_ratelimit powerpc/rtas-rtc: remove sideeffects of printk_ratelimit powerpc/pseries: remove duplicate SCSI_BNX2_ISCSI in pseries_defconfig powerpc/e500: fix breakage with fsl_rio_mcheck_exception powerpc/p1022ds: fix audio-related properties in the device tree powerpc/85xx: fix NAND_CMD_READID read bytes number
| * | | arch/powerpc: use printk_ratelimited instead of printk_ratelimitChristian Dietrich2011-06-295-57/+60
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since printk_ratelimit() shouldn't be used anymore (see comment in include/linux/printk.h), replace it with printk_ratelimited. Signed-off-by: Christian Dietrich <christian.dietrich@informatik.uni-erlangen.de> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
| * | | powerpc/rtas-rtc: remove sideeffects of printk_ratelimitChristian Dietrich2011-06-291-12/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't use printk_ratelimit() as an additional condition for returning on an error. Because when the ratelimit is reached, printk_ratelimit will return 0 and e.g. in rtas_get_boot_time won't check for an error condition. Signed-off-by: Christian Dietrich <christian.dietrich@informatik.uni-erlangen.de> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
| * | | powerpc/pseries: remove duplicate SCSI_BNX2_ISCSI in pseries_defconfigMichael Neuling2011-06-291-1/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove duplicate assignment of SCSI_BNX2_ISCSI in pseries_defconfig introduced by: 37e0c21e powerpc/pseries: Enable iSCSI support for a number of cards causes warning: arch/powerpc/configs/pseries_defconfig:151:warning: override: reassigning to symbol SCSI_BNX2_ISCSI Signed-off-by: Michael Neuling <mikey@neuling.org> Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
| * | | powerpc/e500: fix breakage with fsl_rio_mcheck_exceptionScott Wood2011-06-222-18/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The wrong MCSR bit was being used on e500mc. MCSR_BUS_RBERR only exists on e500v1/v2. Use MCSR_LD on e500mc, and remove all MCSR checking in fsl_rio_mcheck_exception as we now no longer call that function if the appropriate bit in MCSR is not set. If RIO support was enabled at compile-time, but was never probed, just return from fsl_rio_mcheck_exception rather than dereference a NULL pointer. TODO: There is still a remaining, though comparitively minor, issue in that this recovery mechanism will falsely engage if there's an unrelated MCSR_LD event at the same time as a RIO error. Signed-off-by: Scott Wood <scottwood@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
| * | | powerpc/p1022ds: fix audio-related properties in the device treeTimur Tabi2011-06-221-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On the Freescale P1022DS reference board, the SSI audio controller is connected in "asynchronous" mode to the codec's clocks, so the device tree needs an "fsl,ssi-asynchronous" property. Also remove the clock-frequency property from the wm8776 node, because the clock is enabled only if U-Boot enables it, and U-Boot will set the property if the clock is enabled. A future version of the P1022DS audio driver will configure the clock itself, but for now, the driver should not be told that the clock is running when it isn't. Also fix the FIFO depth to 15, instead of 16. Signed-off-by: Timur Tabi <timur@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
| * | | powerpc/85xx: fix NAND_CMD_READID read bytes numberShaohui Xie2011-06-221-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | when nand_get_flash_type() is called, it will read 8 bytes of ID instead of 5, but the driver only read 5 bytes, so kernel will dump error messages like: fsl-lbc ffe124000.localbus: read_byte beyond end of buffer fsl-lbc ffe124000.localbus: read_byte beyond end of buffer fsl-lbc ffe124000.localbus: read_byte beyond end of buffer Signed-off-by: Shaohui Xie <Shaohui.Xie@freescale.com> Acked-by: Scott Wood <scottwood@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
* | | | ahci: change 'masking port_map' printk to KERN_WARNING levelLinus Torvalds2011-06-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It's not so much an error as a warning about normal Marvell crazines. So don't use KERN_ERR that ends up spamming the console even in quiet mode, it's not _that_ critical. Explained by Jeff: "Long explanation, it's a mess: Marvell took standard AHCI, and bastardized it to include a weird mode whereby PATA devices appear inside the AHCI DMA and interrupt infrastructure you're familiar with. So, PATA devices appear via pata_marvell driver, using basic legacy IDE programming interface. But SATA devices, which might also be attached to this chip, either work in under-performing mode or simply don't work at all (e.g. newer 6 Gbps devices or port multiplier attachments, NCQ, ...) On the other hand, 'ahci' driver loads and works with the chip's attached SATA devices quite beautifully, but is completely unable to drive any attached PATA devices, due to the Marvell-specific PATA-under-AHCI interface. The "masking port_map 0x7 -> 0x3" message is the ahci driver "hiding" the PATA port(s) from itself, making sure it will only drive the SATA ports it knows how to drive." Acked-by: Jeff Garzik <jgarzik@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
* | | | Merge branch 'drm-intel-fixes' of ↵Linus Torvalds2011-06-284-85/+230
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux-2.6 * 'drm-intel-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/keithp/linux-2.6: drm/i915: Use chipset-specific irq installers drm/i915: forcewake fix after reset drm/i915: add Ivy Bridge page flip support drm/i915: split page flip queueing into per-chipset functions
| * | | | drm/i915: Use chipset-specific irq installersChris Wilson2011-06-281-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Konstantin Belousov pointed out that 4697995b98417 replaced the generic i915_driver_irq_*install() functions with chipset specific routines accessible only through driver->irq_*install(). So update the sanity check in i915_request_wait() to match. Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Keith Packard <keithp@keithp.com>
| * | | | drm/i915: forcewake fix after resetBen Widawsky2011-06-281-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The failure is as follows: 1. Userspace gets forcewake lock, lock count >=1 2. GPU hang/reset occurs (forcewake bit is reset) 3. count is now incorrect The failure can only occur when using the forcewake userspace lock. This has the unfortunate consequence of messing up the driver as well as userspace, unless userspace closes the debugfs file, the kernel will never end up waking the GT since the refcount will be > 1. The solution is to try to recover the correct forcewake state based on the refcount. There is a period of time where userspace reads/writes may occur after the reset, before the GT has been forcewaked. The interface was never designed to be a perfect solution for userspace reads/writes, and the kernel portion is fixed by this patch. Suggested-by: Chris Wilson <chris@chris-wilson.co.uk> Signed-off-by: Ben Widawsky <ben@bwidawsk.net> Signed-off-by: Keith Packard <keithp@keithp.com>
| * | | | drm/i915: add Ivy Bridge page flip supportJesse Barnes2011-06-261-0/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Use the blit ring for submitting flips since the render ring doesn't generate flip complete interrupts. Fixes bugs: https://bugs.freedesktop.org/show_bug.cgi?id=38362 https://bugs.freedesktop.org/show_bug.cgi?id=38392 https://bugs.freedesktop.org/show_bug.cgi?id=38393 Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch> Reviewed-by: Kenneth Graunke <kenneth@whitecape.org> Reviewed-by: Ben Widawsky <ben@bwidawsk.net> Tested-by: Jian J Zhao <jian.j.zhao@intel.com> Signed-off-by: Keith Packard <keithp@keithp.com>
| * | | | drm/i915: split page flip queueing into per-chipset functionsJesse Barnes2011-06-262-83/+189
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This makes things a little clearer and prevents us from running old code on a new chipset that may not be supported. Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org> Reviewied-by: Ben Widawsky <ben@bwidawsk.net> Signed-off-by: Keith Packard <keithp@keithp.com>
* | | | | Merge branch 'driver-core-linus' of ↵Linus Torvalds2011-06-287-9/+18
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6 * 'driver-core-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6: Connector: Correctly set the error code in case of success when dispatching receive callbacks Connector: Set the CN_NETLINK_USERS correctly pti: PTI semantics fix in pti_tty_cleanup. pti: ENXIO error case memory leak PTI fix. pti: double-free security PTI fix drivers:misc: ti-st: fix skipping of change remote baud drivers/base/platform.c: don't mark platform_device_register_resndata() as __init_or_module st_kim: Handle case of no device found for ID 0 firmware: fix GOOGLE_SMI kconfig dependency warning
| * | | | | Connector: Correctly set the error code in case of success when dispatching ↵K. Y. Srinivasan2011-06-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | receive callbacks The recent changes to the connector code introduced this bug where even when a callback was invoked, we would return an error resulting in double freeing of the skb. This patch fixes this bug. Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Acked-by: Evgeniy Polyakov <zbr@ioremap.net> Cc: stable <stable@kernel.org> [.39] Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | Connector: Set the CN_NETLINK_USERS correctlyK. Y. Srinivasan2011-06-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The CN_NETLINK_USERS must be set to the highest valid index +1. Thanks to Evgeniy for pointing this out. Signed-off-by: K. Y. Srinivasan <kys@microsoft.com> Acked-by: Evgeniy Polyakov <zbr@ioremap.net> Cc: stable <stable@kernel.org> [.39] Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | pti: PTI semantics fix in pti_tty_cleanup.J Freyensee2011-06-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a semantics issue in the pti_tty_cleanup() routine. Signed-off-by: J Freyensee <james_p_freyensee@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | pti: ENXIO error case memory leak PTI fix.J Freyensee2011-06-071-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a memory leak that can occur in the error case ENXIO is returned in the pti_tty_install() routine. Signed-off-by: J Freyensee <james_p_freyensee@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | pti: double-free security PTI fixJ Freyensee2011-06-071-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch fixes a double-free error that will not always be seen unless /dev/pti char interface is stressed. Signed-off-by: J Freyensee <james_p_freyensee@linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | drivers:misc: ti-st: fix skipping of change remote baudShahar Lev2011-06-071-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before the incrementing of ptr in skip_change_remote_baud, it points to cur_action, but the increment is done by the size of nxt_action instead. This could cause ptr to not point to a bts_action structure, which is harmful for the increment of ptr done in download_firmware. Therefore, the skipping is first done for cur_action. Signed-off-by: Shahar Lev <shahar@wizery.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | drivers/base/platform.c: don't mark platform_device_register_resndata() as ↵Andrew Morton2011-06-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | __init_or_module This reverts 737a3bb9416ce2a7c7a4 ("Driver core: move platform device creation helpers to .init.text (if MODULE=n)"). That patch assumed that platform_device_register_resndata() is only ever called from __init code but that isn't true in the case ioctl->drm_ioctl->radeon_cp_init(). Addresses https://bugzilla.kernel.org/show_bug.cgi?id=35192 Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Reported-by: Anthony Basile <blueness@gentoo.org> Cc: Greg KH <gregkh@suse.de> Cc: David Airlie <airlied@linux.ie> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | st_kim: Handle case of no device found for ID 0Steven Rostedt2011-06-072-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Running ktest.pl, I hit this bug: [ 19.780654] BUG: unable to handle kernel NULL pointer dereference at 0000000c [ 19.780660] IP: [<c112efcd>] dev_get_drvdata+0xc/0x46 [ 19.780669] *pdpt = 0000000031daf001 *pde = 0000000000000000 [ 19.780673] Oops: 0000 [#1] SMP [ 19.780680] Dumping ftrace buffer:^M [ 19.780685] (ftrace buffer empty) [ 19.780687] Modules linked in: ide_pci_generic firewire_ohci firewire_core evbug crc_itu_t e1000 ide_core i2c_i801 iTCO_wdt [ 19.780697] [ 19.780700] Pid: 346, comm: v4l_id Not tainted 2.6.39-test-02740-gcaebc16-dirty #4 /DG965MQ [ 19.780706] EIP: 0060:[<c112efcd>] EFLAGS: 00010202 CPU: 0 [ 19.780709] EIP is at dev_get_drvdata+0xc/0x46 [ 19.780712] EAX: 00000008 EBX: f1e37da4 ECX: 00000000 EDX: 00000000 [ 19.780715] ESI: f1c3f200 EDI: c33ec95c EBP: f1e37d80 ESP: f1e37d80 [ 19.780718] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 [ 19.780721] Process v4l_id (pid: 346, ti=f1e36000 task=f2bc2a60 task.ti=f1e36000) [ 19.780723] Stack: [ 19.780725] f1e37d8c c117d395 c33ec93c f1e37db4 c117a0f9 00000002 00000000 c1725e54 [ 19.780732] 00000001 00000007 f2918c90 f1c3f200 c33ec95c f1e37dd4 c1789d3d 22222222 [ 19.780740] 22222222 22222222 f2918c90 f1c3f200 f29194f4 f1e37de8 c178d5c4 c1725e54 [ 19.780747] Call Trace: [ 19.780752] [<c117d395>] st_kim_ref+0x28/0x41 [ 19.780756] [<c117a0f9>] st_register+0x29/0x562 [ 19.780761] [<c1725e54>] ? v4l2_open+0x111/0x1e3 [ 19.780766] [<c1789d3d>] fmc_prepare+0x97/0x424 [ 19.780770] [<c178d5c4>] fm_v4l2_fops_open+0x70/0x106 [ 19.780773] [<c1725e54>] ? v4l2_open+0x111/0x1e3 [ 19.780777] [<c1725e9b>] v4l2_open+0x158/0x1e3 [ 19.780782] [<c065173b>] chrdev_open+0x22c/0x276 [ 19.780787] [<c0647c4e>] __dentry_open+0x35c/0x581 [ 19.780792] [<c06498f9>] nameidata_to_filp+0x7c/0x96 [ 19.780795] [<c065150f>] ? cdev_put+0x57/0x57 [ 19.780800] [<c0660cad>] do_last+0x743/0x9d4 [ 19.780804] [<c065d5fc>] ? path_init+0x1ee/0x596 [ 19.780808] [<c0661481>] path_openat+0x10c/0x597 [ 19.780813] [<c05204a1>] ? trace_hardirqs_off+0x27/0x37 [ 19.780817] [<c0509651>] ? local_clock+0x78/0xc7 [ 19.780821] [<c0661945>] do_filp_open+0x39/0xc2 [ 19.780827] [<c1cabc76>] ? _raw_spin_unlock+0x4c/0x5d^M [ 19.780831] [<c0674ccd>] ? alloc_fd+0x19e/0x1b7 [ 19.780836] [<c06499ca>] do_sys_open+0xb7/0x1bd [ 19.780840] [<c0608eea>] ? sys_munmap+0x78/0x8d [ 19.780844] [<c0649b06>] sys_open+0x36/0x58 [ 19.780849] [<c1cb809f>] sysenter_do_call+0x12/0x38 [ 19.780852] Code: d8 2f 20 c3 01 83 15 dc 2f 20 c3 00 f0 ff 00 83 05 e0 2f 20 c3 01 83 15 e4 2f 20 c3 00 5d c3 55 89 e5 3e 8d 74 26 00 85 c0 74 28 <8b> 40 04 83 05 e8 2f 20 c3 01 83 15 ec 2f 20 c3 00 85 c0 74 13 ^M [ 19.780889] EIP: [<c112efcd>] dev_get_drvdata+0xc/0x46 SS:ESP 0068:f1e37d80 [ 19.780894] CR2: 000000000000000c [ 19.780898] ---[ end trace e7d1d0f6a2d1d390 ]--- The id of 0 passed to st_kim_ref() found no device, keeping pdev null, and causing pdev->dev cause a NULL pointer dereference. After having st_kim_ref() check for NULL, the st_unregister() function needed to be updated to handle the case that st_gdata was not set by the st_kim_ref(). Signed-off-by: Steven Rostedt <rostedt@goodmis.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | firmware: fix GOOGLE_SMI kconfig dependency warningRandy Dunlap2011-06-071-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Is it meaningful/useful to enable EFI_VARS but not EFI? That's what GOOGLE_SMI does. Make it enable EFI also. Fixes this kconfig dependency warning: warning: (GOOGLE_SMI) selects EFI_VARS which has unmet direct dependencies (EFI) Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com> Acked-by: Mike Waychison <mikew@google.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
* | | | | | Merge branch 'usb-linus' of ↵Linus Torvalds2011-06-2821-34/+164
|\ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6 * 'usb-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: MAINTAINERS: add myself as maintainer of USB/IP usb: r8a66597-hcd: fix cannot detect low/full speed device USB: ehci-ath79: fix a NULL pointer dereference USB: Add new FT232H chip to drivers/usb/serial/ftdi_sio.c usb/isp1760: Fix bug preventing the unlinking of control urbs USB: Fix up URB error codes to reflect implementation. xhci: Always set urb->status to zero for isoc endpoints. xhci: Add reset on resume quirk for asrock p67 host xHCI 1.0: Incompatible Device Error USB: don't let errors prevent system sleep USB: don't let the hub driver prevent system sleep USB: change maintainership of ohci-hcd and ehci-hcd xHCI 1.0: Force Stopped Event(FSE) xhci: Don't warn about zeroed bMaxBurst descriptor field. USB: Free bandwidth when usb_disable_device is called. xhci: Reject double add of active endpoints. USB: TI 3410/5052 USB Serial Driver: Fix mem leak when firmware is too big. usb: musb: gadget: clear TXPKTRDY flag when set FLUSHFIFO usb: musb: host: compare status for negative error values
| * | | | | | MAINTAINERS: add myself as maintainer of USB/IPmatt mooney2011-06-271-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: matt mooney <mfm@muteddisk.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | | usb: r8a66597-hcd: fix cannot detect low/full speed deviceYoshihiro Shimoda2011-06-271-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This controller can control "Transaction Translators", but the hcd->has_tt is not set. Since the commit d199c96d41d80a567493e12b8e96ea056a1350c1 ("USB: prevent buggy from crashing the USB stack") has checked it, the driver could not work the low/full speed device. Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | | USB: ehci-ath79: fix a NULL pointer dereferenceGabor Juhos2011-06-271-4/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Loading the ehci-hcd module on the ath79 platform causes a NULL pointer dereference: CPU 0 Unable to handle kernel paging request at virtual address 00000000, epc == c0252928, ra == c00de968 Oops[#1]: Cpu 0 $ 0 : 00000000 00000070 00000001 00000000 $ 4 : 802cf870 0000117e ffffffff 8019c7bc $ 8 : 0000000a 00000002 00000001 fffffffb $12 : 8026ef20 0000000f ffffff80 802dad3c $16 : 8077a2d4 8077a200 c00f3484 8019ed84 $20 : c00f0000 00000003 000000a0 80262c2c $24 : 00000002 80079da0 $28 : 80788000 80789c80 80262b14 c00de968 Hi : 00000000 Lo : b61f0000 epc : c0252928 __mod_vermagic5+0xc260/0xc7e8 [ehci_hcd] Not tainted ra : c00de968 usb_add_hcd+0x2a4/0x858 [usbcore] Status: 1000c003 KERNEL EXL IE Cause : 00800008 BadVA : 00000000 PrId : 00019374 (MIPS 24Kc) Modules linked in: ehci_hcd(+) pppoe pppox ipt_REJECT xt_TCPMSS ipt_LOG xt_comment xt_multiport xt_mac xt_limit iptable_mangle iptable_filte r ip_tables xt_tcpudp x_tables ppp_async ppp_generic slhc ath mac80211 usbcore nls_base input_polldev crc_ccitt cfg80211 compat input_core a rc4 aes_generic crypto_algapi Process insmod (pid: 379, threadinfo=80788000, task=80ca2180, tls=77fe52d0) Stack : c0253184 80c57d80 80789cac 8077a200 00000001 8019edc0 807fa800 8077a200 8077a290 c00f3484 8019ed84 c00f0000 00000003 000000a0 80262c2c c00de968 802d0000 800878cc c0253228 c02528e4 c0253184 80c57d80 80bf6800 80ca2180 8007b75c 00000000 8077a200 802cf830 802d0000 00000003 fffffff4 00000015 00000348 00000124 800b189c c024bb4c c0255000 801a27e8 c0253228 c02528e4 ... Call Trace: [<c0252928>] __mod_vermagic5+0xc260/0xc7e8 [ehci_hcd] It is caused by: commit c430131a02d677aa708f56342c1565edfdacb3c0 Author: Jan Andersson <jan@gaisler.com> Date: Tue May 3 20:11:57 2011 +0200 USB: EHCI: Support controllers with big endian capability regs The two first HC capability registers (CAPLENGTH and HCIVERSION) are defined as one 8-bit and one 16-bit register. Most HC implementations have selected to treat these registers as part of a 32-bit register, giving the same layout for both big and small endian systems. This patch adds a new quirk, big_endian_capbase, to support controllers with big endian register interfaces that treat HCIVERSION and CAPLENGTH as individual registers. Signed-off-by: Jan Andersson <jan@gaisler.com> Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> The reading of the HC capability register has been moved by that commit to a place where the ehci->caps field is not initialized yet. This patch moves the reading of the register back to the original place. Acked-by: Jan Andersson <jan@gaisler.com> Cc: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Gabor Juhos <juhosg@openwrt.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | | USB: Add new FT232H chip to drivers/usb/serial/ftdi_sio.cUwe Bonnes2011-06-273-6/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | appended patch adds support for the new FTDI FT232H chip. This chip is a single channel version of the dual FT2232H/quad FT4232H, coming with it's own default PID 0x6014 (FT2232H uses the same PID 0x6010 like FT2232C, FT4232H has also it's own PID). The patch was checked on an UM232H module and a terminal program with TX/RX shorted to that typing in the terminal reproduced the characters. Signed-off-by: Uwe Bonnes <bon@elektron.ikp.physik.tu-darmstadt.de> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | | usb/isp1760: Fix bug preventing the unlinking of control urbsArvid Brodin2011-06-271-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Both control and bulk transfers use isp1760 slots of type ATL, but the driver unlink code for ATL slots only acts on urbs describing a bulk transfer, letting the code for INT slots take care of the unlink instead, which often ended up removing the interrupt transfer for root hub events instead. That's not good, and gets fixed by this patch. Signed-off-by: Arvid Brodin <arvid.brodin@enea.com> Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| * | | | | | Merge branch 'for-usb-linus' of ↵Greg Kroah-Hartman2011-06-278-13/+96
| |\ \ \ \ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git+ssh://master.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-linus * 'for-usb-linus' of git+ssh://master.kernel.org/pub/scm/linux/kernel/git/sarah/xhci: USB: Fix up URB error codes to reflect implementation. xhci: Always set urb->status to zero for isoc endpoints. xhci: Add reset on resume quirk for asrock p67 host xHCI 1.0: Incompatible Device Error xHCI 1.0: Force Stopped Event(FSE) xhci: Don't warn about zeroed bMaxBurst descriptor field. USB: Free bandwidth when usb_disable_device is called. xhci: Reject double add of active endpoints.
| | * | | | | | USB: Fix up URB error codes to reflect implementation.Sarah Sharp2011-06-171-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Documentation/usb/error-codes.txt mentions that urb->status can be set to -EXDEV, if the isochronous transfer was not fully completed. However, in practice, EHCI, UHCI, and OHCI all only set -EXDEV in the individual frame status, never in the URB status. Those host controller actually always pass in a zero status to usb_hcd_giveback_urb, and rely on the core to set the appropriate status value. The xHCI driver ran into issues with the uvcvideo driver when it tried to set -EXDEV in urb->status, because the driver refused to submit URBs, and the userspace camera application's video froze. Clean up the documentation to reflect the actual implementation. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Acked-by: Alan Stern <stern@rowland.harvard.edu>
| | * | | | | | xhci: Always set urb->status to zero for isoc endpoints.Sarah Sharp2011-06-171-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When the xHCI driver encounters a Missed Service Interval event for an isochronous endpoint ring, it means the host controller skipped over one or more isochronous TDs. For TD that is skipped, skip_isoc_td() is called. This sets the frame descriptor status to -EXDEV, and also sets the value stored in the int pointed to by status to -EXDEV. If the isochronous TD happens to be the last TD in an URB, handle_tx_event() will use the status variable to give back the URB to the USB core. That means drivers will see urb->status as -EXDEV. It turns out that EHCI, UHCI, and OHCI always set urb->status to zero for an isochronous urb, regardless of what the frame status is. See itd_complete() in ehci-sched.c: } else { /* URB was too late */ desc->status = -EXDEV; } } /* handle completion now? */ if (likely ((urb_index + 1) != urb->number_of_packets)) goto done; /* ASSERT: it's really the last itd for this urb list_for_each_entry (itd, &stream->td_list, itd_list) BUG_ON (itd->urb == urb); */ /* give urb back to the driver; completion often (re)submits */ dev = urb->dev; ehci_urb_done(ehci, urb, 0); ehci_urb_done() completes the URB with the status of the third argument, which is always zero in this case. It turns out that many USB webcam drivers, such as uvcvideo, cannot handle urb->status set to a non-zero value. They will not resubmit their isochronous URBs in that case, and userspace will see a frozen video. Change the xHCI driver to be consistent with the EHCI and UHCI driver, and always set urb->status to 0 for isochronous URBs. This patch should be backported to kernels as old as 2.6.36 Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Cc: "Xu, Andiry" <Andiry.Xu@amd.com> Cc: stable@kernel.org
| | * | | | | | xhci: Add reset on resume quirk for asrock p67 hostMaarten Lankhorst2011-06-173-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The asrock p67 xhci controller completely dies on resume, add a quirk for this, to bring the host back online after a suspend. This should be backported to stable kernels as old as 2.6.37. Signed-off-by: Maarten Lankhorst <m.b.lankhorst@gmail.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Cc: stable@kernel.org
| | * | | | | | xHCI 1.0: Incompatible Device ErrorAlex He2011-06-173-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | It is one new TRB Completion Code for the xHCI spec v1.0. Asserted if the xHC detects a problem with a device that does not allow it to be successfully accessed, e.g. due to a device compliance or compatibility problem. This error may be returned by any command or transfer, and is fatal as far as the Slot is concerned. Return -EPROTO by urb->status or frame->status of ISOC for transfer case. And return -ENODEV for configure endpoint command, evaluate context command and address device command if there is an incompatible Device Error. The error codes will be sent back to the USB core to decide how to do. It's unnecessary for other commands because after the three commands run successfully means that the device has been accepted. Signed-off-by: Alex He <alex.he@amd.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
| | * | | | | | xHCI 1.0: Force Stopped Event(FSE)Alex He2011-06-151-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | FSE shall occur on the TD natural boundary. The software ep_ring dequeue pointer exceed the hardware ep_ring dequeue pointer in these cases of Table-3. As a result, the event_trb(pointed by hardware dequeue pointer) of the FSE can't be found in the current TD(pointed by software dequeue pointer). What should we do is to figured out the FSE case and skip over it. Signed-off-by: Alex He <alex.he@amd.com> Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
| | * | | | | | xhci: Don't warn about zeroed bMaxBurst descriptor field.Sarah Sharp2011-06-151-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The USB 3.0 specification says that the bMaxBurst field in the SuperSpeed Endpoint Companion descriptor is supposed to indicate how many packets a SS device can handle before it needs to wait for an explicit handshake from the host controller. A zero value means the device can only handle one packet before it needs a handshake. Remove a warning in the xHCI driver that implies this is an invalid value. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
| | * | | | | | USB: Free bandwidth when usb_disable_device is called.Sarah Sharp2011-06-152-1/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Tanya ran into an issue when trying to switch a UAS device from the BOT configuration to the UAS configuration via the bConfigurationValue sysfs file. Before installing the UAS configuration, set_bConfigurationValue() calls usb_disable_device(). That function is supposed to remove all host controller resources associated with that device, but it leaves some state in the xHCI host controller. Commit 0791971ba8fbc44e4f476079f856335ed45e6324 usb: allow drivers to use allocated bandwidth until unbound added a call to usb_disable_device() in usb_set_configuration(), before the xHCI bandwidth functions were invoked. That commit fixed a bug, but also introduced a bug that is triggered when a configured device is switched to a new configuration. usb_disable_device() goes through all the motions of unbinding the drivers attached to active interfaces and removing the USB core structures associated with those interfaces, but it doesn't actually remove the endpoints from the internal xHCI host controller bandwidth structures. When usb_disable_device() calls usb_disable_endpoint() with reset_hardware set to true, the entries in udev->ep_out and udev->ep_in will be set to NULL. Usually, when the USB core installs a new configuration, usb_hcd_alloc_bandwidth() will drop all non-NULL endpoints in udev->ep_out and udev->ep_in before adding any new endpoints. However, when the new UAS configuration was added, all those entries were null, so none of the old endpoints in the BOT configuration were dropped. The xHCI driver blindly added the UAS configuration endpoints, and some of the endpoint addresses overlapped with the old BOT configuration endpoints. This caused the xHCI host to reject the Configure Endpoint command. Now that the xHCI driver code is cleaned up to reject a double-add of active endpoints, we need to fix the USB core to properly drop old endpoints in usb_disable_device(). If the host controller driver needs bandwidth checking support, make usb_disable_device() call usb_disable_endpoint() with reset_hardware set to false, drop the endpoints from the xHCI host controller, and then call usb_disable_endpoint() again with reset_hardware set to true. The first call to usb_disable_endpoint() will cancel any pending URBs and wait on them to be freed in usb_hcd_disable_endpoint(), but will keep the pointers in udev->ep_out and udev->ep in intact. Then usb_hcd_alloc_bandwidth() will use those pointers to know which endpoints to drop. The final call to usb_disable_endpoint() will do two things: 1. It will call usb_hcd_disable_endpoint() again, which should be harmless since the ep->urb_list should be empty after the first call to usb_disable_endpoint() returns. 2. It will set the entries in udev->ep_out and udev->ep in to NULL, and call usb_hcd_disable_endpoint(). That call will have no effect, since the xHCI driver doesn't set the endpoint_disable function pointer. Note that usb_disable_device() will now need to be called with hcd->bandwidth_mutex held. This should be backported to kernels as old as 2.6.32. Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com> Reported-by: Tanya Brokhman <tlinder@codeaurora.org> Cc: ablay@codeaurora.org Cc: Alan Stern <stern@rowland.harvard.edu> Cc: stable@kernel.org