1 files changed, 28 insertions, 1 deletions

diff --git a/drivers/usb/host/xhci-hcd.c b/drivers/usb/host/xhci-hcd.c
index 99911e727e0b..932f99938481 100644
--- a/drivers/usb/host/xhci-hcd.c
+++ b/drivers/usb/host/xhci-hcd.c
@@ -335,6 +335,12 @@ void xhci_event_ring_work(unsigned long arg)
         spin_lock_irqsave(&xhci->lock, flags);
         temp = xhci_readl(xhci, &xhci->op_regs->status);
         xhci_dbg(xhci, "op reg status = 0x%x\n", temp);
+        if (temp == 0xffffffff) {
+                xhci_dbg(xhci, "HW died, polling stopped.\n");
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                return;
+        }
+
         temp = xhci_readl(xhci, &xhci->ir_set->irq_pending);
         xhci_dbg(xhci, "ir_set 0 pending = 0x%x\n", temp);
         xhci_dbg(xhci, "No-op commands handled = %d\n", xhci->noops_handled);
@@ -776,6 +782,7 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
 {
         unsigned long flags;
         int ret;
+        u32 temp;
         struct xhci_hcd *xhci;
         struct xhci_td *td;
         unsigned int ep_index;
@@ -788,6 +795,17 @@ int xhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
         ret = usb_hcd_check_unlink_urb(hcd, urb, status);
         if (ret || !urb->hcpriv)
                 goto done;
+        temp = xhci_readl(xhci, &xhci->op_regs->status);
+        if (temp == 0xffffffff) {
+                xhci_dbg(xhci, "HW died, freeing TD.\n");
+                td = (struct xhci_td *) urb->hcpriv;
+
+                usb_hcd_unlink_urb_from_ep(hcd, urb);
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                usb_hcd_giveback_urb(xhci_to_hcd(xhci), urb, -ESHUTDOWN);
+                kfree(td);
+                return ret;
+        }
 
         xhci_dbg(xhci, "Cancel URB %p\n", urb);
         xhci_dbg(xhci, "Event ring:\n");
@@ -877,7 +895,7 @@ int xhci_drop_endpoint(struct usb_hcd *hcd, struct usb_device *udev,
         ctrl_ctx->drop_flags |= drop_flag;
         new_drop_flags = ctrl_ctx->drop_flags;
 
-        ctrl_ctx->add_flags = ~drop_flag;
+        ctrl_ctx->add_flags &= ~drop_flag;
         new_add_flags = ctrl_ctx->add_flags;
 
         last_ctx = xhci_last_valid_endpoint(ctrl_ctx->add_flags);
@@ -1410,11 +1428,20 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
 {
         struct xhci_hcd *xhci = hcd_to_xhci(hcd);
         unsigned long flags;
+        u32 state;
 
         if (udev->slot_id == 0)
                 return;
 
         spin_lock_irqsave(&xhci->lock, flags);
+        /* Don't disable the slot if the host controller is dead. */
+        state = xhci_readl(xhci, &xhci->op_regs->status);
+        if (state == 0xffffffff) {
+                xhci_free_virt_device(xhci, udev->slot_id);
+                spin_unlock_irqrestore(&xhci->lock, flags);
+                return;
+        }
+
         if (xhci_queue_slot_control(xhci, TRB_DISABLE_SLOT, udev->slot_id)) {
                 spin_unlock_irqrestore(&xhci->lock, flags);
                 xhci_dbg(xhci, "FIXME: allocate a command ring segment\n");