Okay, I found the cause of the hang.  It is a simple bug in the USB
scatter-gather library, caused by changes added in response to the S-G
chaining modification.

This patch (as1125) fixes a bug in the USB scatter-gather library.
Early exit from the S-G initialization loop does not reset the count of
outstanding URBs.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Cc: Matthew Dharm <mdharm-usb@one-eyed-alien.net>
Cc: David Brownell <david-b@pacbell.net>
Cc: Alan Jenkins <alan-jenkins@tuffmail.co.uk>
Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

device_create() is race-prone, so use the race-free
device_create_drvdata() instead as device_create() is going away.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Why?:
There are occasions where userspace would like to access sysfs
attributes for a device but it may not know how sysfs has named the
device or the path.  For example what is the sysfs path for
/dev/disk/by-id/ata-ST3160827AS_5MT004CK?  With this change a call to
stat(2) returns the major:minor then userspace can see that
/sys/dev/block/8:32 links to /sys/block/sdc.

What are the alternatives?:
1/ Add an ioctl to return the path: Doable, but sysfs is meant to reduce
   the need to proliferate ioctl interfaces into the kernel, so this
   seems counter productive.

2/ Use udev to create these symlinks: Also doable, but it adds a
   udev dependency to utilities that might be running in a limited
   environment like an initramfs.

3/ Do a full-tree search of sysfs.

[kay.sievers@vrfy.org: fix duplicate registrations]
[kay.sievers@vrfy.org: cleanup suggestions]

Cc: Neil Brown <neilb@suse.de>
Cc: Tejun Heo <htejun@gmail.com>
Acked-by: NKay Sievers <kay.sievers@vrfy.org>
Reviewed-by: NSL Baur <steve@xemacs.org>
Acked-by: NKay Sievers <kay.sievers@vrfy.org>
Acked-by: NMark Lord <lkml@rtr.ca>
Acked-by: NH. Peter Anvin <hpa@zytor.com>
Signed-off-by: NDan Williams <dan.j.williams@intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1109b) makes USB-Persist more resilient to errors.  With
the current code, if a normal resume fails, it's an unrecoverable
error.  With the patch, if a normal resume fails (and if the device is
enabled for USB-Persist) then a reset-resume is tried.

This fixes the problem reported in Bugzilla #10977.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix pointer/int cast in USB devio code, and thus avoid a compiler warning.

A void* data argument passed to bus_find_device() and thence to match_devt()
is used to carry a 32-bit datum.  However, casting directly between a u32 and
a pointer is not permitted - there must be an intermediate cast via (unsigned)
long.

This was introduced by the following patch:

	commit 94b1c9fa060ece2c8f080583beb6cc6008e41413
	Author: Alan Stern <stern@rowland.harvard.edu>
	Date:   Tue Jun 24 14:47:12 2008 -0400

	    usbfs: simplify the lookup-by-minor routines

	    This patch (as1105) simplifies the lookup-by-minor-number code in
	    usbfs.  Instead of passing the minor number to the callback, which
	    must then reconstruct the entire dev_t value, the patch passes the
	    dev_t value directly.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1107) fixes a small bug in the usbfs registration and
unregistration code.  It avoids leaving an error value stored in the
device's usb_classdev field and it avoids trying to unregister a NULL
pointer.  (It also fixes a rather extreme overuse of whitespace.)
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1106) fixes a race between opening and unregistering
device files in usbfs.  The current code drops its reference to the
device and then reacquires it, ignoring the possibility that the
device structure might have been removed in the meantime.  It also
doesn't check whether the device is already in the NOTATTACHED state
when the file is opened.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1105) simplifies the lookup-by-minor-number code in
usbfs.  Instead of passing the minor number to the callback, which
must then reconstruct the entire dev_t value, the patch passes the
dev_t value directly.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

USB device files are accessible in two ways: as files in usbfs and as
character device nodes.  The two paths are supposed to behave
identically, but they don't.  When the underlying USB device is
unplugged, disconnect signals are sent to processes with open usbfs
files (if they requested these signals) but not to processes with open
device node files.

This patch (as1104) fixes the bug by moving the disconnect-signalling
code into a common subroutine which is called from both paths.
Putting this subroutine in devio.c removes the only out-of-file
reference to struct dev_state, and so the structure's declaration can
be moved from usb.h into devio.c.

Finally, the new subroutine performs one extra action: It kills all
the outstanding async URBs.  (I'd kill the outstanding synchronous
URBs too, if there was any way to do it.)  In the past this hasn't
mattered much, because devices were unregistered from usbfs only
when they were disconnected.  But now the unregistration can also
occur whenever devices are unbound from the usb_generic driver.  At
any rate, killing URBs when a device is unregistered from usbfs seems
like a good thing to do.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1024) takes care of a FIXME issue: Drivers that don't
have the necessary suspend, resume, reset_resume, pre_reset, or
post_reset methods will be unbound and their interface reprobed when
one of the unsupported events occurs.

This is made slightly more difficult by the fact that bind operations
won't work during a system sleep transition.  So instead the code has
to defer the operation until the transition ends.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch renames the existing usb_reset_device in hub.c to
usb_reset_and_verify_device and renames the existing
usb_reset_composite_device to usb_reset_device. Also the new
usb_reset_and_verify_device does't need to be EXPORTED .

The idea of the patch is that external interface driver
should warn the other interfaces' driver of the same
device before and after reseting the usb device. One interface
driver shoud call _old_ usb_reset_composite_device instead of
_old_ usb_reset_device since it can't assume the device contains
only one interface. The _old_ usb_reset_composite_device
is safe for single interface device also. we rename the two
functions to make the change easily.

This patch is under guideline from Alan Stern.
Signed-off-by: NMing Lei <tom.leiming@gmail.com>

It is the usb interface driver probe() methods that
can't call usb_set_configuration, not usb device driver.
Signed-off-by: NMing Lei <tom.leiming@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1103) changes the iteration in the USB scatter-gather to
use a standard SG iterator.  Otherwise the iteration will fail if it
encounters a chained SG list.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Acked-by: NJens Axboe <jens.axboe@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

From the current implementation of usb_reset_composite_device
function, the iface parameter is no longer useful. This function
doesn't do something special for the iface usb_interface,compared
with other interfaces in the usb_device. So remove the parameter
and fix the related caller.
Signed-off-by: NMing Lei <tom.leiming@gmail.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

We can't allow hubs on the 7th tier as they would allow
devices on the 8th tier.
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch removes CVS keywords that weren't updated for a long time
from comments.
Signed-off-by: NAdrian Bunk <bunk@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1091) changes the way usbcore handles interface
unbinding.  If the interface's driver supports "soft" unbinding (a new
flag in the driver structure) then in-flight URBs are not cancelled
and endpoints are not disabled.  Instead the driver is allowed to
continue communicating with the device (although of course it should
stop before its disconnect routine returns).

The purpose of this change is to allow drivers to do a clean shutdown
when they get unbound from a device that is still plugged in.  Killing
all the URBs and disabling the endpoints before calling the driver's
disconnect method doesn't give the driver any control over what
happens, and it can leave devices in indeterminate states.  For
example, when usb-storage unbinds it doesn't want to stop while in the
middle of transmitting a SCSI command.

The soft_unbind flag is added because in the past, a number of drivers
have experienced problems related to ongoing I/O after their disconnect
routine returned.  Hence "soft" unbinding is made available only to
drivers that claim to support it.

The patch also replaces "interface_to_usbdev(intf)" with "udev" in a
couple of places, a minor simplification.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1083) combines hub_quiesce() and hub_stop() into a
single routine.  There's no point keeping them separate since they are
usually called together.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1071) combines hub_activate() and hub_restart() into a
single routine.  There's no point keeping them separate, since they
are always called together.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1082) makes a small optimization to the way the hub
driver carries out port debouncing immediately after a hub is
activated (i.e., initialized, reset, or resumed).  If any port-change
statuses are observed, the code will delay for a minimal debounce
period -- thereby making a good start at debouncing all the ports at
once.

If this wasn't sufficient then khubd will debounce any port that still
requires attention.  But in most cases it should suffice; it's rare
for a device to need more than a minimal debounce delay.  (In the
cases of hub initialization or reset even that is most likely not
needed, since any devices plugged in at such times have probably been
attached for a while.)
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1073) adds to khubd a way to recover from power-session
interruption caused by transient connect-change or enable-change
events.  After the debouncing period, khubd attempts to do a
USB-Persist-style reset or reset-resume.  If it works, the connection
will remain unscathed.

The upshot is that we will be more immune to noise caused by EMI.  The
grace period is on the order of 100 ms, so this won't permit recovery
from the "accidentally knocked the USB cable out of its socket" type
of event, but it's a start.

As an added bonus, if a device was suspended when the system goes to
sleep then we no longer need to check for power-session interruptions
when the system wakes up.  Khubd will naturally see the status change
while processing the device's parent hub and will do the right thing.

The remote_wakeup() routine is changed; now it expects the caller to
acquire the device lock rather than acquiring the lock itself.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1081) straightens out the logic of the hub_restart()
routine.  Each port of the hub is scanned and the driver makes sure
that ports which are supposed to be disabled really _are_ disabled.
Any ports with a significant change in status are flagged in
hub->change_bits, so that khubd can focus on them without the need to
scan all the ports a second time -- which means the hub->activating
flag is no longer needed.

Also, it is now recognized explicitly that the only reason for
resuming a port which was not suspended is to carry out a reset-resume
operation, which happens only in a non-CONFIG_USB_SUSPEND setting.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This reverts Linus's previous patch that is in mainline to make it
easier for the USB hub.c patches that follow this to apply cleanly.  The
functionality will be added back in a followon patch in this series.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1080) makes a significant change to the way khubd
handles port connect-change and enable-change events.  Both types of
event are now debounced, and the debouncing is carried out _before_ an
existing usb_device is unregistered, instead of afterward.

This means that drivers will have to deal with longer runs of errors
when a device is unplugged, but they are supposed to be prepared for
that in any case.

The advantage is that when an enable-change occurs (caused for example
by electromagnetic interference), the debouncing period will provide
time for the cause of the problem to die away.  A simple port reset
(added in a forthcoming patch) will then allow us to recover from the
fault.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1070) creates a new subroutine to check whether a device
can be resumed.  This code is needed even when CONFIG_USB_SUSPEND
isn't set, because devices do suspend themselves when the root hub
(and hence the entire bus) is suspended, and power sessions can get
lost during a system sleep even without individual port suspends.

The patch also fixes a loose end in USB-Persist reset-resume handling.
When a low- or full-speed device is attached to an EHCI's companion
controller, the port handoff during resume will cause the companion
port's connect-status-change feature to be set.  If that flag isn't
cleared, the port-reset code will think it indicates that the device
has been unplugged and the reset-resume will fail.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The bus_id field is going away, use the dev_set_name() function
to set it properly.
Signed-off-by: NKay Sievers <kay.sievers@vrfy.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The bus_id field is going away, use the dev_name() function instead.
Signed-off-by: NKay Sievers <kay.sievers@vrfy.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This reverts Alan's previous patch so that the recent Hub changes will
apply cleanly.  The above mentioned patch was needed for 2.6.26 to work
properly.

Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Lukas Hejtmanek <xhejtman@ics.muni.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This changes usb_create_hcd() to be able to handle the fact that
pci_name() has changed to a constant string.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This reverts commit e8721549.

Andrey Borzenkov reports that it resulted in a totally hung machine for
him when loading the OHCI driver.  Extensive netconsole capture with
SysRq output shows that modprobe gets stuck in ohci_hub_status_data()
when probing and enabling the OHCI controller, see for example

	http://lkml.org/lkml/2008/7/5/236

for an analysis.

The problem appears to be an interrupt flood triggered by the commit
that gets reverted, and Andrey confirmed that the revert makes things
work for him again.
Reported-and-tested-by: NAndrey Borzenkov <arvidjaar@mail.ru>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Acked-by: NDavid Brownell <david-b@pacbell.net>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This patch (as1111) fixes a bug in the hub driver.  When a hub
resumes, disconnections that occurred while the hub was suspended are
lost.

A completely different fix for this problem has already been accepted
for 2.6.27; however the problem still needs to be handled in 2.6.26.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NLukas Hejtmanek <xhejtman@ics.muni.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

USB: fix interrupt disabling for HCDs with shared interrupt handlers

As has been discussed several times on LKML, IRQF_SHARED | IRQF_DISABLED
doesn't work reliably, i.e. a shared interrupt handler CAN'T be certain to
be called with interrupts disabled. Most USB HCD handlers use IRQF_DISABLED
and therefore havoc can break out if they share their interrupt with a
handler that doesn't use it.

On my test machine the yenta_socket interrupt handler (no IRQF_DISABLED)
was registered before ehci_hcd and one uhci_hcd instance. Therefore all
usb_hcd_irq() invocations for ehci_hcd and for one uhci_hcd instance
happened with interrupts enabled. That led to random lockups as USB core
HCD functions that acquire the same spinlock could be called twice
from interrupt handlers.

This patch updates usb_hcd_irq() to always disable/restore interrupts.
usb_add_hcd() will silently remove any IRQF_DISABLED requested from HCD code.
Signed-off-by: NStefan Becker <stefan.becker@nokia.com>
Cc: stable <stable@kernel.org>
Acked-by: NDavid Brownell <david-b@pacbell.net>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add explicit lock_kernel() calls to usbdev_open()
Signed-off-by: NJonathan Corbet <corbet@lwn.net>

usb_open() is protected by a down_read(&minor_rwsem), but I'm not sure I
trust it to protect everything including subsidiary open() functions.
Signed-off-by: NJonathan Corbet <corbet@lwn.net>

On some boxes the touchpad needs to be reinitialized after resume to make
it function again. This fixes bugzilla #10825.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NDmitry Torokhov <dtor@mail.ru>

This patch tries to identify which devices are able to accept
reset-resume handling, by checking that there is at least one
interface driver bound and that all of the drivers have a reset_resume
method defined.  If these conditions don't hold then during resume
processing, the device is logicall disconnected.

This is only a temporary fix.  Later on we will explicitly unbind
drivers that can't handle reset-resumes.
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Cc: Oliver Neukum <oliver@neukum.org>
Cc: Pavel Machek <pavel@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Like the HP53{00,70} scanner other devices of the OEM Avision require
the USB_QUIRK_STRING_FETCH_255 to correct set a configuration with
"recent" Linux kernels.
Signed-off-by: NRené Rebe <rene@exactcode.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1096) fixes an annoying problem: When a full-speed or
low-speed device is plugged into an EHCI controller, it fails to
enumerate at high speed and then is handed over to the companion
controller.  But usbcore logs a misleading and unwanted error message
when the high-speed enumeration fails.

The patch adds a new HCD method, port_handed_over, which asks whether
a port has been handed over to a companion controller.  If it has, the
error message is suppressed.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
CC: David Brownell <david-b@pacbell.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1094) changes the output of the "descriptors" binary
attribute.  Now it will contain the device descriptor followed by all
the configuration descriptors, not just the descriptor for the current
config.

Userspace libraries want to have access to the kernel's cached
descriptor information, so they can learn about device characteristics
without having to wake up suspended devices.  So far the only user of
this attribute is the new libusb-1.0 library; thus changing its
contents shouldn't cause any problems.

This should be considered for 2.6.26, if for no other reason than to
minimize the range of releases in which the attribute contains only the
current config descriptor.

Also, it doesn't hurt that the patch removes the device locking --
which was formerly needed in order to know for certain which config was
indeed current.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

There is a potential deadlock when the usb_generic driver is unbound
from a device.  The problem is that generic_disconnect() is called
with the device lock held, and it removes a bunch of device attributes
from sysfs.  If a user task happens to be running an attribute method
at the time, the removal will block until the method returns.  But at
least one of the attribute methods (the store routine for power/level)
needs to acquire the device lock!

This patch (as1093) eliminates the deadlock by moving the calls to
create and remove the sysfs attributes from the usb_generic driver
into usb_new_device() and usb_disconnect(), where they can be invoked
without holding the device lock.

Besides, the other sysfs attributes are created when the device is
registered and removed when the device is unregistered.  So it seems
only fitting for the extra attributes to be created and removed at the
same time.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>