This patch (as1666) fixes a regression in the UDC core.  The core
takes care of unbinding gadget drivers, and it does the unbinding
before telling the UDC driver to turn off the controller hardware.
When the call to the udc_stop callback is made, the gadget no longer
has a driver.  The callback routine should not be invoked with a
pointer to the old driver; doing so can cause problems (such as
use-after-free accesses in net2280).

This patch should be applied, with appropriate context changes, to all
the stable kernels going back to 3.1.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

with the latest udc_start/udc_stop conversion,
too much code was deleted which ended up creating
a regression in net2272 and net2280 drivers.

To fix the regression we revert one hunk of the
original commits.
Signed-off-by: Felipe Balbi <balbi@ti.com>

musb does not use DMA buffer for ep0 but it uses the same giveback
function *musb_g_giveback* for all endpoints (*musb_g_ep0_giveback* calls
*musb_g_giveback*). So for ep0 case request.dma will be '0'
and will result in kernel OOPS if tried to *unmap_dma_buffer* for requests in
ep0. Fixed it by doing *unmap_dma_buffer* only for valid DMA addr and
checking that musb_ep->dma is valid when unmapping.
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

fix typo error introduced by commit ea0e6276 (usb: gadget: add
multiple definition guards) which causes the following build warning:

  warning: "pr_vdebug" redefined
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Commit 032ec49f (usb: musb: drop useless
board_mode usage) introduced a typo that breaks the build.
Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@gmail.com>

[ Fixed commit message ]

Cc: Mikhail Kshevetskiy <mikhail.kshevetskiy@gmail.com>
Cc: Sergei Shtylyov <sshtylyov@mvista.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Michael Riesch <michael.riesch@omicron.at>
Signed-off-by: Felipe Balbi <balbi@ti.com>

when commit 6166c246 (usb: gadget: pxa25x_udc:
convert to udc_start/udc_stop) converted
this driver to udc_start/udc_stop, it failed
to consider the fact that stop_activity()
is called from disconnect interrupt.

Fix the problem so that gadget drivers know
about proper disconnect sequences.
Signed-off-by: Felipe Balbi <balbi@ti.com>

drivers/usb/dwc3/ep0.c: In function `__dwc3_ep0_do_control_data':
drivers/usb/dwc3/ep0.c:905: error: `typeof' applied to a bit-field

Looks like a gcc-3.4.5/sparc64 bug.

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Fix the following sparse warning:

drivers/usb/musb/omap2430.c:54:33: warning: symbol '_glue' was not \
	declared. Should it be static?
Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Commit 80ab72e1 (usb: musb: omap2430: fix the readiness check
in omap_musb_mailbox) made the check incorrect, as we will lose the
glue/link status during the normal built-in probe order (twl4030_usb is
probed after musb omap2430, but before musb core is ready).

As a result, if you boot with USB cable on and load g_ether, the
connection does not work as the code thinks the cable is off and the
phy gets powered down immediately. This is a major regression in 3.9-rc1.

So the proper check should be: exit if _glue is NULL, but if it's
initialized we memorize the status, and then check if the musb core
is ready.
Signed-off-by: Aaro Koskinen <aaro.koskinen@iki.fi>
Signed-off-by: Felipe Balbi <balbi@ti.com>

When running 100 randconfig iterations, I found
the following warning:

drivers/usb/musb/musb_core.c: In function ‘musb_init_controller’:
drivers/usb/musb/musb_core.c:1981:1: warning: label ‘fail5’ defined \
	but not used [-Wunused-label]

this patch fixes it by removing the unnecessary
ifdef CONFIG_SYSFS.
Signed-off-by: Felipe Balbi <balbi@ti.com>

those are quite unnecessary, the only thing
we need to be careful about is USB_OTG_UTILS
which get properly selected by PHY drivers.

For now, MUSB will select only USB_OTG_UTILS
until we add stubs for the cases when PHY
layer isn't enabled.
Signed-off-by: Felipe Balbi <balbi@ti.com>

A few trivial fixes for composite driver:

Warning(include/linux/usb/composite.h:165): No description found for parameter
	'fs_descriptors'
Warning(include/linux/usb/composite.h:165): Excess struct/union/enum/typedef
	member 'descriptors' description in 'usb_function'
Warning(include/linux/usb/composite.h:321): No description found for parameter
	'gadget_driver'
Warning(drivers/usb/gadget/composite.c:1777): Excess function parameter 'bind'
	description in 'usb_composite_probe'

Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jiri Kosina <trivial@kernel.org>
Cc: linux-usb@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

We should return here with an error code instead of continuing.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Smatch complains that "len" could be larger than the sizeof(value)
so we could be copying garbage here.  I have changed this to match
how things are done in composite_setup().

The call tree looks like:
  composite_setup()
  --> f_audio_setup()
      --> audio_get_intf_req()

composite_setup() expects the return value to be set to
sizeof(value).
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Use the newly introduced devm_ioremap_resource() instead of
devm_request_and_ioremap() which provides more consistent error handling.

devm_ioremap_resource() provides its own error messages; so all explicit
error messages can be removed from the failure code paths.
Reviewed-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Cc: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Use the newly introduced devm_ioremap_resource() instead of
devm_request_and_ioremap() which provides more consistent error handling.

devm_ioremap_resource() provides its own error messages; so all explicit
error messages can be removed from the failure code paths.
Reviewed-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Cc: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Use the newly introduced devm_ioremap_resource() instead of
devm_request_and_ioremap() which provides more consistent error handling.

devm_ioremap_resource() provides its own error messages; so all explicit
error messages can be removed from the failure code paths.
Reviewed-by: Thierry Reding <thierry.reding@avionic-design.de>
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

In patch "5d3c28b5 usb: otg: add device tree support to otg library"
devm_usb_get_phy_by_phandle() was added. It uses try_module_get() to lock the
phy driver in memory. The corresponding module_put() is missing in that patch.

This patch adds try_module_get() to usb_get_phy() and usb_get_phy_dev().
Further the missing module_put() is added to usb_put_phy().
Tested-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
Reviewed-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Currently it is possible to have:

USB_MUSB_OMAP2PLUS=m
TWL4030_USB=y

which would result compile time error due to missing symbols.

With this change USB_MUSB_OMAP2PLUS and TWL4030_USB will be in sync.
Reported-by: Vincent Stehle <v-stehle@ti.com>
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

add missing semicolon to fix compile breakage.
Signed-off-by: Felipe Balbi <balbi@ti.com>

Whenever ->udc_start() gets called, gadget driver
has already being bound to the udc controller, which
means that gadget->dev had to be already initialized
and added to driver model.

This patch fixes imx_udc mistake.
Signed-off-by: Felipe Balbi <balbi@ti.com>

Whenever ->udc_start() gets called, gadget driver
has already being bound to the udc controller, which
means that gadget->dev had to be already initialized
and added to driver model.

This patch fixes pxa25x mistake.
Signed-off-by: Felipe Balbi <balbi@ti.com>

Whenever ->udc_start() gets called, gadget driver
has already being bound to the udc controller, which
means that gadget->dev had to be already initialized
and added to driver model.

This patch fixes s3c2410 mistake.
Signed-off-by: Felipe Balbi <balbi@ti.com>

The current ordering in makefile makes gadget
drivers be loaded before usb functions which
causes usb_get_function_instance() to fail when
gadget modules are statically linked to the
kernel binary.

Changed the ordering here so that USB functions
are loaded before gadget drivers.

Note that this is only a temporary solution and
a more robust fix is needed in the long run.
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Whenever ->udc_start() gets called, gadget driver
has already being bound to the udc controller, which
means that gadget->dev had to be already initialized
and added to driver model.

This patch fixes pxa27x mistake.
Tested-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Don't register anything non-generic under
the gadget's device as we don't really *own*
it.
Signed-off-by: Felipe Balbi <balbi@ti.com>

the params variables on dwc3_gadget_conndone_interrupt()
is only memset() to zero but never used in
that function, so we can safely drop the variable
and memset() call.
Signed-off-by: Felipe Balbi <balbi@ti.com>

remove inclusion of "core.h" from all glue
layers as they don't need to know details
about the core IP.
Signed-off-by: Felipe Balbi <balbi@ti.com>

s/matach/match

No functional changes
Signed-off-by: Felipe Balbi <balbi@ti.com>

commit 3921426b (usb: dwc3: core: move
event buffer allocation out of
dwc3_core_init()) introduced a memory leak
of the coherent memory we use as event
buffers on dwc3 driver.

If the driver is compiled as a dynamically
loadable module and use constantly loads
and unloads the driver, we will continue
to leak the coherent memory allocated during
->probe() because dwc3_free_event_buffers()
is never called during ->remove().

Cc: <stable@vger.kernel.org> # v3.7 v3.8
Signed-off-by: Felipe Balbi <balbi@ti.com>

Pull fbdev UAPI disintegration from David Howells:
 "You'll be glad to here that the end is nigh for the UAPI patches.
  Only the fbdev/framebuffer piece remains now that the SCSI stuff has
  gone in.

  Here are the UAPI disintegration bits for the fbdev drivers.  It
  appears that Florian hasn't had time to deal with my patch, but back
  in December he did say he didn't mind if I pushed it forward."

Yay.  No more uapi movement.  And hopefully no more big header file
cleanups coming up either, it just tends to be very painful.

* tag 'disintegrate-fbdev-20121220' of git://git.infradead.org/users/dhowells/linux-headers:
  UAPI: (Scripted) Disintegrate include/video

Merge tag 'stable/for-linus-3.9-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

Pull Xen bug-fixes from Konrad Rzeszutek Wilk:
 - Update the Xen ACPI memory and CPU hotplug locking mechanism.
 - Fix PAT issues wherein various applications would not start
 - Fix handling of multiple MSI as AHCI now does it.
 - Fix ARM compile failures.

* tag 'stable/for-linus-3.9-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xenbus: fix compile failure on ARM with Xen enabled
  xen/pci: We don't do multiple MSI's.
  xen/pat: Disable PAT using pat_enabled value.
  xen/acpi: xen cpu hotplug minor updates
  xen/acpi: xen memory hotplug minor updates

Pull  more VFS bits from Al Viro:
 "Unfortunately, it looks like xattr series will have to wait until the
  next cycle ;-/

  This pile contains 9p cleanups and fixes (races in v9fs_fid_add()
  etc), fixup for nommu breakage in shmem.c, several cleanups and a bit
  more file_inode() work"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  constify path_get/path_put and fs_struct.c stuff
  fix nommu breakage in shmem.c
  cache the value of file_inode() in struct file
  9p: if v9fs_fid_lookup() gets to asking server, it'd better have hashed dentry
  9p: make sure ->lookup() adds fid to the right dentry
  9p: untangle ->lookup() a bit
  9p: double iput() in ->lookup() if d_materialise_unique() fails
  9p: v9fs_fid_add() can't fail now
  v9fs: get rid of v9fs_dentry
  9p: turn fid->dlist into hlist
  9p: don't bother with private lock in ->d_fsdata; dentry->d_lock will do just fine
  more file_inode() open-coded instances
  selinux: opened file can't have NULL or negative ->f_path.dentry

(In the meantime, the hlist traversal macros have changed, so this
required a semantic conflict fixup for the newly hlistified fid->dlist)

Pull btrfs fixup from Chris Mason:
 "Geert and James both sent this one in, sorry guys"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  btrfs/raid56: Add missing #include <linux/vmalloc.h>

Pull second set of s390 patches from Martin Schwidefsky:
 "The main part of this merge are Heikos uaccess patches.  Together with
  commit 09884964 ("mm: do not grow the stack vma just because of an
  overrun on preceding vma") the user string access is hopefully fixed
  for good.

  In addition some bug fixes and two cleanup patches."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/module: fix compile warning
  qdio: remove unused parameters
  s390/uaccess: fix kernel ds access for page table walk
  s390/uaccess: fix strncpy_from_user string length check
  input: disable i8042 PC Keyboard controller for s390
  s390/dis: Fix invalid array size
  s390/uaccess: remove pointless access_ok() checks
  s390/uaccess: fix strncpy_from_user/strnlen_user zero maxlen case
  s390/uaccess: shorten strncpy_from_user/strnlen_user
  s390/dasd: fix unresponsive device after all channel paths were lost
  s390/mm: ignore change bit for vmemmap
  s390/page table dumper: add support for change-recording override bit

Merge branch 'fixes-for-3.9-latest' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux

Pull second round of PARISC updates from Helge Deller:
 "The most important fix in this branch is the switch of io_setup,
  io_getevents and io_submit syscalls to use the available compat
  syscalls when running 32bit userspace on 64bit kernel.  Other than
  that it's mostly removal of compile warnings."

* 'fixes-for-3.9-latest' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: fix redefinition of SET_PERSONALITY
  parisc: do not install modules when installing kernel
  parisc: fix compile warnings triggered by atomic_sub(sizeof(),v)
  parisc: check return value of down_interruptible() in hp_sdc_rtc.c
  parisc: avoid unitialized variable warning in pa_memcpy()
  parisc: remove unused variable 'compat_val'
  parisc: switch to compat_functions of io_setup, io_getevents and io_submit
  parisc: select ARCH_WANT_FRAME_POINTERS

Pull new ImgTec Meta architecture from James Hogan:
 "This adds core architecture support for Imagination's Meta processor
  cores, followed by some later miscellaneous arch/metag cleanups and
  fixes which I kept separate to ease review:

   - Support for basic Meta 1 (ATP) and Meta 2 (HTP) core architecture
   - A few fixes all over, particularly for symbol prefixes
   - A few privilege protection fixes
   - Several cleanups (setup.c includes, split out a lot of
     metag_ksyms.c)
   - Fix some missing exports
   - Convert hugetlb to use vm_unmapped_area()
   - Copy device tree to non-init memory
   - Provide dma_get_sgtable()"

* tag 'metag-v3.9-rc1-v4' of git://git.kernel.org/pub/scm/linux/kernel/git/jhogan/metag: (61 commits)
  metag: Provide dma_get_sgtable()
  metag: prom.h: remove declaration of metag_dt_memblock_reserve()
  metag: copy devicetree to non-init memory
  metag: cleanup metag_ksyms.c includes
  metag: move mm/init.c exports out of metag_ksyms.c
  metag: move usercopy.c exports out of metag_ksyms.c
  metag: move setup.c exports out of metag_ksyms.c
  metag: move kick.c exports out of metag_ksyms.c
  metag: move traps.c exports out of metag_ksyms.c
  metag: move irq enable out of irqflags.h on SMP
  genksyms: fix metag symbol prefix on crc symbols
  metag: hugetlb: convert to vm_unmapped_area()
  metag: export clear_page and copy_page
  metag: export metag_code_cache_flush_all
  metag: protect more non-MMU memory regions
  metag: make TXPRIVEXT bits explicit
  metag: kernel/setup.c: sort includes
  perf: Enable building perf tools for Meta
  metag: add boot time LNKGET/LNKSET check
  metag: add __init to metag_cache_probe()
  ...

Pull late ARM updates from Russell King:
 "Here is the late set of ARM updates for this merge window; in here is:

   - The ARM parts of the broadcast timer support, core parts merged
     through tglx's tree.  This was left over from the previous merge to
     allow the dependency on tglx's tree to be resolved.

   - A fix to the VFP code which shows up on Raspberry Pi's, as well as
     fixing the fallout from a previous commit in this area.

   - A number of smaller fixes scattered throughout the ARM tree"

* 'for-linus' of git://git.linaro.org/people/rmk/linux-arm:
  ARM: Fix broken commit 0cc41e4a corrupting kernel messages
  ARM: fix scheduling while atomic warning in alignment handling code
  ARM: VFP: fix emulation of second VFP instruction
  ARM: 7656/1: uImage: Error out on build of multiplatform without LOADADDR
  ARM: 7640/1: memory: tegra_ahb_enable_smmu() depends on TEGRA_IOMMU_SMMU
  ARM: 7654/1: Preserve L_PTE_VALID in pte_modify()
  ARM: 7653/2: do not scale loops_per_jiffy when using a constant delay clock
  ARM: 7651/1: remove unused smp_timer_broadcast #define

Pull char/misc patch from Greg Kroah-Hartman:
 "Here is one remaining patch for 3.9-rc1.  It is for the hyper-v
  drivers, and had to wait until some other patches went in through the
  x86 tree."
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

* tag 'char-misc-3.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  Drivers: hv: vmbus: Use the new infrastructure for delivering VMBUS interrupts