xhci_alloc_segments_for_ring() builds a list of xhci_segments and links
the tail to head at the end (forming a ring). When it bails out for OOM
reasons half-way through, it tries to destroy its half-built list with
xhci_free_segments_for_ring(), even though it is not a ring yet. This
causes a null-pointer dereference upon hitting the last element.

Furthermore, one of its callers (xhci_ring_alloc()) mistakenly believes
the output parameters to be valid upon this kind of OOM failure, and
calls xhci_ring_free() on them. Since the (incomplete) list/ring should
already be destroyed in that case, this would lead to a use after free.

This patch fixes those issues by having xhci_alloc_segments_for_ring()
destroy its half-built, non-circular list manually and destroying the
invalid struct xhci_ring in xhci_ring_alloc() with a plain kfree().

This patch should be backported to kernels as old as 2.6.31, that
contains the commit 0ebbab37 "USB: xhci:
Ring allocation and initialization."

A separate patch will need to be developed for kernels older than 3.4,
since the ring allocation code was refactored in that kernel.
Signed-off-by: Julius Werner <jwerner@chromium.org>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org

The xHCI 1.0 specification made a change to the TD Size field in TRBs.
The value is now the number of packets that remain to be sent in the TD,
not including this TRB.  The TD Size value for the last TRB in a TD must
always be zero.

The xHCI function xhci_v1_0_td_remainder() attempts to calculate this,
but it gets it wrong.  First, it erroneously reuses the old
xhci_td_remainder function, which will right shift the value by 10.  The
xHCI 1.0 spec as of June 2011 says nothing about right shifting by 10.
Second, it does not set the TD size for the last TRB in a TD to zero.

Third, it uses roundup instead of DIV_ROUND_UP.  The total packet count
is supposed to be the total number of bytes in this TD, divided by the
max packet size, rounded up.  DIV_ROUND_UP is the right function to use
in that case.

With the old code, a TD on an endpoint with max packet size 1024 would
be set up like so:
TRB 1, TRB length = 600 bytes, TD size = 0
TRB 1, TRB length = 200 bytes, TD size = 0
TRB 1, TRB length = 100 bytes, TD size = 0

With the new code, the TD would be set up like this:
TRB 1, TRB length = 600 bytes, TD size = 1
TRB 1, TRB length = 200 bytes, TD size = 1
TRB 1, TRB length = 100 bytes, TD size = 0

This commit should be backported to kernels as old as 3.0, that contain
the commit 4da6e6f2 "xhci 1.0: Update TD
size field format."
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: Chintan Mehta <chintan.mehta@sibridgetech.com>
Reported-by: Shimmer Huang <shimmering.h@gmail.com>
Tested-by: Bhavik Kothari <bhavik.kothari@sibridgetech.com>
Tested-by: Shimmer Huang <shimmering.h@gmail.com>
Cc: stable@vger.kernel.org

David reports that at drivers/usb/host/xhci.c:2257:

static bool xhci_is_sync_in_ep(unsigned int ep_type)
{
    return (ep_type == ISOC_IN_EP || ep_type != INT_IN_EP);
}

The static analyser cppcheck says

[linux-3.7-rc2/drivers/usb/host/xhci.c:2257]: (style) Redundant condition: If ep_type == 5, the comparison ep_type != 7 is always true.

Maybe the original programmer intention was something like

static bool xhci_is_sync_in_ep(unsigned int ep_type)
{
    return (ep_type == ISOC_IN_EP || ep_type == INT_IN_EP);
}

Fix this.

This patch should be backported to stable kernels as old as 3.2, that
contain the commit 2b698999 "xhci: USB
3.0 BW checking."
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: David Binderman <dcb314@hotmail.com>
Cc: stable@vger.kernel.org

Non-static xHCI driver symbols should start with the "xhci_" prefix, in
order to avoid namespace pollution.  Rename the "handshake" function to
"xhci_handshake".
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: Ben Hutchings <ben@decadent.org.uk>

This patch (as1633) changes slightly the way usbcore handled
submissions of URBs that are already active.  It will now return
-EBUSY rather than -EINVAL, and it will call WARN_ONCE to draw
people's attention to the bug.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1632b) fixes a bug in ehci-hcd.  The USB core uses
urb->hcpriv to determine whether or not an URB is active; host
controller drivers are supposed to set this pointer to a non-NULL
value when an URB is queued.  However ehci-hcd sets it to NULL for
isochronous URBs, which defeats the check in usbcore.

In itself this isn't a big deal.  But people have recently found that
certain sequences of actions will cause the snd-usb-audio driver to
reuse URBs without waiting for them to complete.  In the absence of
proper checking by usbcore, the URBs get added to their endpoint list
twice.  This leads to list corruption and a system freeze.

The patch makes ehci-hcd assign a meaningful value to urb->hcpriv for
isochronous URBs.  Improving robustness always helps.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Artem S. Tashkinov <t.artem@lycos.com>
Reported-by: Christof Meerwald <cmeerw@cmeerw.org>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1630) cleans up a few minor items resulting from the
split-up of the ehci-hcd driver:

	Remove the product_desc string from the ehci_driver_overrides
	structure.  All drivers will use the generic "EHCI Host
	Controller" string.  (This was requested by Felipe Balbi.)

	Allow drivers to pass a NULL pointer to ehci_init_driver()
	if they don't have to override any settings.

	Remove a #define symbol that is no longer used from the
	ChipIdea host driver.

	Rename overrides to pci_overrides in ehci-pci.c, for
	consistency with ehci-platform.c.

	Mark the *_overrides structures as __initdata.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1631) fixes a bug that shows up when a config change
fails for a device under an xHCI controller.  The controller needs to
be told to disable the endpoints that have been enabled for the new
config.  The existing code does this, but before storing the
information about which endpoints were enabled!  As a result, any
second attempt to install the new config is doomed to fail because
xhci-hcd will refuse to enable an endpoint that is already enabled.

The patch optimistically initializes the new endpoints' device
structures before asking the device to switch to the new config.  If
the request fails then the endpoint information is already stored, so
we can use usb_hcd_alloc_bandwidth() to disable the endpoints with no
trouble.  The rest of the error path is slightly more complex now; we
have to disable the new interfaces and call put_device() rather than
simply deallocating them.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: Matthias Schniedermeyer <ms@citd.de>
CC: Sarah Sharp <sarah.a.sharp@linux.intel.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge tag 'gadget-for-v3.8' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

USB gadget patches from Felipe:
"usb: gadget: patches for v3.8

renesas_usbhs implements ->pullup() method, switches over
to devm_request_irq(), adds support for DMA Engine and
got a few miscelaneous cleanups.

The NCM gadget got an endianness fix and the Ethernet
gadget a frame size fix.

We're finally removing the g_file_storage gadget and
sticking to g_mass_storage and the new tcm_usb_gadget
gadgets since that was a huge duplicaton of effort anyway.

While removing g_file_storage, we also had to fix a bunch
of defconfigs which were still pointing to the old gadget.

There's a big series getting us closer to being able to
introduce our configfs interface. The series converts
functions into loadable modules which will, eventually,
be registered to the configfs interface.

Other than that there's the usual typo fixes and miscelaneous
cleanups all over the place."

USB dwc3 patches from Felipe:

"usb: dwc3: patches for v3.8

We can finaly drop HAVE_CLK dependency from exynos glue layer
now that clk API provides no-op stubs when it's not linked
into the kernel.

We're also switching over event buffer allocation to devm_kzalloc()
and moving the allocation out of dwc3_core_init() so that can be
re-used when implementing PM support for v3.9.

After the introduction of PLATFORM_DEVID_AUTO, we can also drop the
homebrew platform device ID handling we had on dwc3 core and let
driver core take care of that for us.

Exynos glue layer learns about DeviceTree and drops platform_data
support completely."

USB musb merge from Felipe:

"usb: musb: patches for v3.8 merge window

We have here the usual set of cleanups for the MUSB driver; a
big set of patches converting platform_device_del() and
platform_device_put() into platform_device_unregister().

Another big set was applied converting to module_platform_driver()
macro in order to reduce some boilerplate code from all glue
layers.

Other than that, we had a series fixing one known silicon errata
where we couldn't read a few registers. In order to fix that
we're now using shadow variables for reads and only writing
to the registers which are known to break functionality when
read."

Pull USB phy patches from Felipe:

"usb: phy: patches for v3.8 merge window

Not too many patches this time. First two patches are only
cleanups where one of them switches over to module_platform_driver
macro and the second removes inclusion of <mach/iomap.h> and is
part of a bigger set of include cleanups from the Tegra folks.

The only substantial change here is the addition of a driver
for Renesas' R-Car USB Phy controller."

DT bindings normally use '-' (hyphens) instead of '_' (underscore),
driver has it the proper way, but binding documentation does not
reflect it, fix it.
Signed-off-by: Afzal Mohammed <afzal@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This reverts commit d8c3ef25.

Above mentioned change was made along with multi usb phy change and
adding DT support for nop transceiver. But other two changes did not
make it to mainline. This in effect makes dsps musb wrapper unusable
even for single instance.

Hence revert it so that at least single instance can be supported.

Cc: stable@vger.kernel.org # v3.7
Signed-off-by: Afzal Mohammed <afzal@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Convert USB descriptor's fields to CPU byte order before using locally in USB
NCM gadget driver.

Tested on MIPS32 big-endian device.
Signed-off-by: Dmytro Milinevskyy <milinevskyy@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Checking skb->len against ETH_FRAME_LEN assumes a 1514
ethernet frame size. With an 802.1Q VLAN header, ethernet
frame length can now be 1518. Validate frame length against that.
Signed-off-by: Ian Coolidge <iancoolidge@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This commit removes the /sys/devices/platform/<UDC>/udc/<UDC>/is_dualspeed
file and is_dualspeeed line from /sys/devices/platform/ci13xxx_*/udc/device
file.

The is_dualspeed file is superseded by maximum_speed in the same directory
and is_dualspeed line in device file is superseded by max_speed line in
the same file.

The maximum_speed/max_speed specifies maximum speed supported by UDC.
To check if dualspeeed is supported, check if the value is >= 3.
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Since function-line macros are to be avoided, this commit replaces
the fsg_lun_is_open() macro with a static inline function.

While at it, this commit also adds “inline” modifier to the
fsg_lun_from_dev() function.
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

storage_common.c has been used by both file_storage.c and f_mass_storage.c
which had some different requirements in a few places.  To accomodate for
that, storage_common.c provided configuratian macros which were to be
defined (or not) prior to the file #inclusion.  Because now
file_storage.c is no longer with us, we can remove support for those
macros and thus simplify the code slightly.
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Since g_file_storage has been removed, this commit removes code from
the storage_common.c file which has been used by file_storage.c only
(and not by f_mass_storage.c).
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

The File-backed Storage Gadget (g_file_storage) gadget has been replaced
with Mass Storage Gadget (g_mass_storage) which uses the composite
framework.  This commit removes g_file_storage (and most references to it).
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Felipe Balbi <balbi@ti.com>

The File-backed Storage Gadget (g_file_storage) is being removed, since
it has been replaced by Mass Storage Gadget (g_mass_storage).  This commit
changes defconfigs point to the new gadget.
Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>  (AT91)
Acked-by: Tony Lindgren <tony@atomide.com>  (OMAP1)
Acked-by: Hans-Christian Egtvedt <egtvedt@samfundet.no> (AVR32)
Signed-off-by: Felipe Balbi <balbi@ti.com>

received data will break if it was bulk pipe and large data size,
because pipe kept BUF PID even though it doesn't have enough buffer.
To avoid this issue, renesas_usbhs can use transfer counter.
Pipe PID will be NAK if it didn't have enough buffer by this patch.

renesas_usbhs has strange address mapping.
Thus, it is difficult to calculate transfer counter setting address.
This patch use fixed table for it.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

commit 380f0d28 (usb: dwc3: core: switch event
buffer allocation to devm_kzalloc()) was incomplete
leaving a trailing kfree(evt) in an error exit
path.

Fix this problem by removing the trailing kfree(evt).

Cc: Julia Lawall <julia.lawall@lip6.fr>
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This patch is based on the discussion of a previous patch to fix an issue
where the omap2430 musb driver is not working for N9/N950.

Moving all the interrupt handling to the devices. Avoids inclusion of generic
interrupt and breakage due to sometimes misleading CONFIG options. This makes
sure usb always works if on of the subdrivers is chosen. Tested on Nokia N9/N950.

Partially clean up CONFIG_SOC_OMAP3430 which is not necessary in the cases
where I removed it. Also helps with the removal work of those options that
Tony Lindgren predicted would happen at some point.
Signed-off-by: Philippe De Swert <philippe.deswert@jollamobile.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Now that DaVinci glue layer can be modular, we must export cppi_interrupt()
that it may call...

Cc: stable@vger.kernel.org # 3.0+
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

renesas_usbhs attaches pipe to endpoint when urb was queued, and it will be
detached when transfer was done.  Multi device controlling was enabled by this
behavior.

Now renesas_usbhs driver tried to wait until detaching if urb was queued to
endpoint which already has been attached to pipe, and it created strange driver
behavior.

But it can re-use this attached pipe if multi urb was queued.  This patch
implements it.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Because usbhsh_hub_status_data() will be called many times,
there are too many obstructive/useless debug informations if driver has #define DEBUG.
Thus, other important dev_dbg() information will hide.
This patch removed obstructive/useless dev_dbg().
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Correct spelling typo in debug messages within drivers/usb.
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

am335x uses nop transceiver driver and need to enable builtin phy
by writing into usb_ctrl register available in system control
module register space. This is being added at musb glue driver
layer until a separate system control module driver is available.

Proper solution is to make use of control module driver, but it is
not expected to be ready soon.

Other options available are providing control module register space
as memory resource via DT or using omap hwmod.

DT approach has been rejected by Rob Herring, while resources are
being moved from hwmod to DT. And both of the above approaches
require that control module registers be configured in wrapper
itself requring a quirk in driver as well as DT or hwmod.

Here another option is used, providing driver with control module
register physical address. Even though this a hack, there is no other
option left till control module driver is ready. As of now only
am335x is using dsps wrapper, and so driver is made aware of am335x
control module physical address.

Please note that this is a temporary arrangment till omap control
module driver is available.

[afzal@ti.com: limit quirk to dsps wrapper]
Signed-off-by: Santhapuri, Damodar <damodar.santhapuri@ti.com>
Signed-off-by: Ajay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: Ravi Babu <ravibabu@ti.com>
Signed-off-by: Afzal Mohammed <afzal@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

dsps wrapper is now dt only. This requires that resources be obtained
using index and not name, modify accordingly.
Signed-off-by: Afzal Mohammed <afzal@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Currently multiple phy's of the same type are not supported, hence
reduce musb instances to one. This helps in supporting at least one
instance of musb, rather than having none. Even without this, it was
observed that both instances were working (by luck), but this holds
good iff wrapper is part of Image. And it is not correct for both
controller's to be associated with same phy, here it was working
because phy is a nop one. And having wrapper as a module and
rmmod'ing would crash.

This can be reverted once multi phy support for same type is available
and driver is enhanced to make use of it.
Signed-off-by: Afzal Mohammed <afzal@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

dsps wrapper is dt only, it cannot execute platform callbacks.
Presence of this would cause NULL dereference, hence remove it.
Signed-off-by: Afzal Mohammed <afzal@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

We are removing plat data which was used till now to init and
exit phy. We no longer need this since dwc3-core takes care of
initializing and shutting-down the phy using usb_phy_init()
and usb_phy_shutdown().
Signed-off-by: Vivek Gautam <gautam.vivek@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This patch adds support to parse probe data for
dwc3-exynos driver using device tree.
Signed-off-by: Vivek Gautam <gautam.vivek@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This patch (as1629) fixes a build error in the ChipIdea host driver
when compiled for the ARM architecture.  The error was introduced
by commit 99f91934 (USB: EHCI: make
ehci-platform a separate driver).

The fix is simple; an additional header-file #include is needed.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Relax condition of building the reset interface stubs in
drivers/usb/early/ehci-dbgp.c from USB_EHCI_HCD to just USB, to also
cover the chipidea driver re-using code from ehci-hcd.
Reported-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1627) splits the ehci-hcd core code, which has become a
separate library module, out from the ChipIdea host driver.  Instead
of #include-ing ehci-hcd.c directly, the ChipIdea module will now use
the ehci-hcd library in a normal fashion.

This fixes a build error caused by commit
3e023203 (USB: EHCI: prepare to make
ehci-hcd a library module); I had forgotten about the unorthodox way
the ChipIdea driver uses the ehci-hcd code.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

In the former code, we have a race condition between the first interrupt
and the regs field initilization in the usb_hcd structure.
If the OHCI irq fires before hcd->regs is set, we are getting a null
pointer dereference in ohci_irq.

When calling usb_add_hcd(), it first executes the reset() callback,
then enables the ohci interrupt, and finally executes the start()
callback. So moving the ohci_init() call which actually initializes the
reg field from start() to reset() should remove the race.

Tested by enabling the external HSIC hub in the bootloader on an exynos5
machine and booting. With the former code, this triggers an early interrupt
about 50% of the boots and a subsequent kernel panic in ohci_irq when trying
to access the registers.

Cc: Olof Johansson <olofj@chromium.org>
Cc: Doug Anderson <dianders@chromium.org>
Cc: Arjun.K.V <arjun.kv@samsung.com>
Cc: Vikas Sajjan <vikas.sajjan@samsung.com>
Cc: Abhilash Kesavan <a.kesavan@samsung.com>
Signed-off-by: Vincent Palatin <vpalatin@chromium.org>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1628) fixes a build error in the ehci-platform driver
when compiled for the PowerPC architecture.  The error was introduced
by commit 99f91934 (USB: EHCI: make
ehci-platform a separate driver).

The fix is simple; a few additional header-file #includes are needed.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>