If for whatever reason we fall into fail path in xhci_mem_init()
before bw table gets initialized we may access the uninitialized lists
in xhci_mem_cleanup().

Check for bw table before traversing lists in cleanup routine.

This patch should be backported to kernels as old as 3.2, that contain
the commit 839c817c "xhci: Store
information about roothubs and TTs."
Reported-by: Sergey Dyasly <dserrg@gmail.com>
Tested-by: Sergey Dyasly <dserrg@gmail.com>
Signed-off-by: Vladimir Murzin <murzin.v@gmail.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org

It is possible that we fail on xhci_mem_init, just before doing
the INIT_LIST_HEAD, and calling xhci_mem_cleanup.

Problem is that, the list_for_each_entry_safe macro, assumes
list heads are initialized (not NULL), and dereferences their 'next'
pointer, causing a kernel panic if this is not yet initialized.

Let's protect from that by moving inits to the beginning.

This patch should be backported to kernels as old as 3.2, that
contain the commit 9574323c "xHCI: test
USB2 software LPM".
Signed-off-by: Sergio Aguirre <sergio.a.aguirre.rodriguez@intel.com>
Acked-by: David Cohen <david.a.cohen@intel.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org

The value of "offd" comes off the instance->rcv_buf[] and we used it as
the offset into an array.  The problem is that we check the upper bound
but not for negative values.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Here are two more devices that use FTDI USB-to-serial chips with new product ID's.

The devices are the Newport Conex-AGP and Conex-CC motor controllers.
(http://www.newport.com/CONEX-AGP-Integrated-Piezo-Motor-Rotation-Stages-/987623/1033/info.aspx)
(http://www.newport.com/CONEX-CC-DC-Servo-Controller-Actuators/934114/1033/info.aspx)

usb-devices command yields:

P:  Vendor=104d ProdID=3002 Rev=06.00
S:  Manufacturer=Newport
S:  Product=CONEX-CC

as well as

P:  Vendor=104d ProdID=3006 Rev=06.00
S:  Manufacturer=Newport
S:  Product=CONEX-AGP
Signed-off-by: Andrew Gomella <andrew.gomella@nih.gov>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

A rebranded Novatel E371 for AT&T's LTE bands.

Cc: stable <stable@vger.kernel.org>
Signed-off-by: Dan Williams <dcbw@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fix goto wrong tag in usb_hcd_nxp_probe
Signed-off-by: Libo Chen <libo.chen@huawei.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

When platform_get_resource fail, we should release_mem_region
Signed-off-by: Libo Chen <libo.chen@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

When devm_usb_get_phy fail, we should free hcd
Signed-off-by: Libo Chen <libo.chen@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

No need to grab disconnect mutex in chars_in_buffer now that no
sub-driver is or should be querying hardware buffers anymore. (They
should use wait_until_sent.)
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Use the new generic usb-serial wait_until_sent implementation to wait
for hardware buffers to drain.

This removes the need to check the hardware buffers in chars_in_buffer
and thus removes the overhead introduced by commit 2c992cd7 ("USB:
ti_usb_3410_5052: query hardware-buffer status in chars_in_buffer")
without breaking tty_wait_until_sent (used by, for example, tcdrain,
tcsendbreak and close).
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Use the new generic usb-serial wait_until_sent implementation to wait
for hardware buffers to drain.

This removes the need to check the hardware buffers in chars_in_buffer
and thus removes the overhead introduced by commit 263e1f9f ("USB:
io_ti: query hardware-buffer status in chars_in_buffer") without
breaking tty_wait_until_sent (used by, for example, tcdrain, tcsendbreak
and close).
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Use the new generic usb-serial wait_until_sent implementation to wait
for hardware buffers to drain.

This removes the need to check the hardware buffers in chars_in_buffer
and thus removes the overhead introduced by commit 6f602912 ("usb:
serial: ftdi_sio: Add missing chars_in_buffer function") without
breaking tty_wait_until_sent (used by, for example, tcdrain, tcsendbreak
and close).
Reported-by: Stas Sergeev <stsp@list.ru>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Use usb-serial port rather than tty as argument to get_modem_status.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Add generic wait_until_sent implementation which polls for empty
hardware buffers using the new port-operation tx_empty.

The generic implementation will be used for all sub-drivers that
implement tx_empty but does not define wait_until_sent.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Add wait_until_sent operation which can be used to wait for hardware
buffers to drain.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Many USB host drivers contain code such as:

if (!pdev->dev.dma_mask)
        pdev->dev.dma_mask = &tegra_ehci_dma_mask;

... where tegra_ehci_dma_mask is a global. I suspect this code originated
in commit 4a53f4e6 "USB: ehci-tegra: add probing through device tree" and
was simply copied everywhere else.

This works fine when the code is built-in, but can cause a crash when the
code is in a module. The first module load sets up the dma_mask pointer,
but if the module is removed and re-inserted, the value is now non-NULL,
and hence is not updated to point at the new location, and hence points
at a stale location within the previous module load address, which in
turn causes a crash if the pointer is de-referenced.

The simplest way of solving this seems to be to copy the code from
ehci-platform.c, which uses the coherent_dma_mask as the target for the
dma_mask pointer.
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Stephen Warren <swarren@nvidia.com>
Acked-by: Tony Prisk <linux@prisktech.co.nz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

/drivers/usb/serial/option.c: Blacklisted Cinterion's PLxx WWAN
Interface (USB Interface 4), because it will be handled by QMI WWAN
driver. Product IDs renamed.
Signed-off-by: Hans-Christoph Schemmel <hans-christoph.schemmel@gemalto.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Information from driver description files:

  diag:  VID_19D2&PID_0412&MI_00
  nmea:  VID_19D2&PID_0412&MI_01
  at:    VID_19D2&PID_0412&MI_02
  modem: VID_19D2&PID_0412&MI_03
  net:   VID_19D2&PID_0412&MI_04
Signed-off-by: Teppo Kotilainen <qubit303@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The EHCI host controller driver can be built standalone now,
without enabling any of the available bus glue drivers, so
there is not really a reason to error out here:

drivers/usb/host/ehci-hcd.c:1303:2: error:
 #error "missing bus glue for ehci-hcd"  #error "missing bus glue for ehci-hcd"

The alternative would be to change the Kconfig code to build
the ehci-hcd module only if any of the symbols below are
in fact enabled.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Werner Fink has reported problems with this hub.
Signed-off-by: Oliver Neukum <oliver@neukum.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

To fix the compile error when CONFIG_PM_RUNTIME is not enabled,
move the declaration of us out of CONFIG_REALTEK_AUTOPM macro in rts51x_chip.

drivers/usb/storage/realtek_cr.c: In function 'realtek_cr_destructor':
drivers/usb/storage/realtek_cr.c:942:11: error: 'struct rts51x_chip' has no member named 'us'
Signed-off-by: Wei WANG <wei_wang@realsil.com.cn>
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Fixes link error when USB_EHCI_HCD=m and USB_CHIPIDEA_HOST=y:

	drivers/built-in.o: In function `ci_hdrc_host_init':
	drivers/usb/chipidea/host.c:104: undefined reference to `ehci_init_driver'

as a result of commit 09f6ffde ("USB: EHCI: fix build error by making
ChipIdea host a normal EHCI driver").

Cc: stable@vger.kernel.org [v3.7+]
Signed-off-by: David Rientjes <rientjes@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Commit 84ebc102 (USB: remove
CONFIG_USB_SUSPEND option) failed to remove all of the usages of
USB_SUSPEND throughout the kernel.  This patch (as1677) removes the
remaining instances of that symbol.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The isochronous scheduling logic in ohci-hcd has a bug.  The
calculation for skipping TDs that are too late should be carried out
only in the !URB_ISO_ASAP case.  When URB_ISO_ASAP is set, the URB is
pushed back so that none of the TDs are too late, which would cause
the calculation to overflow.

The patch also fixes the calculation to avoid overflow in the case
where the frame value wraps around.

This should be applied to -stable kernels going back to 3.8.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Commits c44b2250 (UHCI: implement new
semantics for URB_ISO_ASAP) and
6a41b4d3 (OHCI: implement new
semantics for URB_ISO_ASAP) increased the latency for isochronous URBs
in uhci-hcd and ohci-hcd respectively to 2 milliseconds, in an
attempt to avoid underruns.  It turns out that not only was this
unnecessary -- 1-ms latency works okay -- it also causes problems with
certain application loads such as real-time audio.

This patch changes the latency for both drivers back to 1 ms.

This should be applied to -stable kernels going back to 3.8.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: Joe Rayhawk <jrayhawk@fairlystable.org>
CC: Clemens Ladisch <clemens@ladisch.de>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

HP's virtual UHCI host controller takes a long time to suspend
(several hundred microseconds), even when no devices are attached.
This provokes a warning message from uhci-hcd in the auto-stop case.

To prevent this from happening, this patch adds a test to avoid
performing an auto-stop when the wait_for_hp quirk flag is set.  The
controller will still suspend through the normal runtime PM mechanism.
And since that pathway includes a 1-ms delay, the slowness of the
virtual hardware won't matter.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: ZhenHua <zhen-hual@hp.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

The Kconfig settings for uhci-hcd are too permissive; they allow the
driver to be built without any bus-glue modules configured
(USB_UHCI_HCD enabled, PCI disabled, SPARC_LEON disabled, ARCH_VT8500
enabled, and USB_UHCI_PLATFORM disabled).

This patch fixes the problem by rearranging the dependencies.  Now the
platform-dependent config options don't depend on USB_UHCI_HCD;
instead it depends on them.  Furthermore, there is no user-selectable
choice as to which glue modules will be built.  If USB_UHCI_HCD is
enabled then all applicable bus glues will be built.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch shortens the logic in xhci_endpoint_init() by moving common
calculations involving max_packet and max_burst outside the switch
statement, rather than repeating the same code in multiple
case-specific statements.  It also replaces two usages of max_packet
which were clearly intended to be max_burst all along.

More importantly, it compensates for a common bug in high-speed bulk
endpoint descriptors.  In many devices there is a bulk endpoint having
a wMaxPacketSize value smaller than 512, which is forbidden by the USB
spec.  Some xHCI controllers can't handle this and refuse to accept
the endpoint.  This patch changes the max_packet value to 512, which
allows the controller to use the endpoint properly.

In practice the bogus maxpacket size doesn't matter, because none of
the transfers sent via these endpoints are longer than the maxpacket
value anyway.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: "Aurélien Leblond" <blablack@gmail.com>
CC: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge tag 'fixes-for-v3.10-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-linus

Felipe writes:

usb: fixes for v3.10-rc2

Here's the initial set of fixes for v3.10-rc series. It countains miscellaneous
fixes in numerous drivers.

Many gadget drivers and PHY drivers learned that it's not necessary to
platform_set_drvdata() twice, that's not necessary to check the resource
pointer returned by platform_get_resource() when using devm_ioremap_resource()
and they learned that we shouldn't return 0 in case of errors.

DWC3 got a build fix for cases where DWC3 is marked as 'y' while gadget API is
marked as 'm'.

There's also a NULL pointer exception fix on usb_get_phy(), mxs-phy now knows
which PHY type it is and s3c-hsotg is now passing proper arguments to
usb_gadget_unmap_request().

Other than that there are some spelling fixes and kernel-doc warnings.
Signed-of-by: Felipe Balbi <balbi@ti.com>

The mxs-phy is missing the phy.type property, why the usb_get_phy helper
function won't be able to find it. This patch adds this missing property.
Signed-off-by: Michael Grzeschik <mgr@pengutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

The Kconfig symbol USB_OTG_UTILS was removed in the v3.10 merge window,
in commit fd891498 ("usb: phy: remove CONFIG_USB_OTG_UTILS"). But that
symbol popped up again in a few places. Remove it there too.
Acked-by: Paul Zimmerman <paulz@synopsys.com>
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Felipe Balbi <balbi@ti.com>

'struct usb_request *' should be passed to usb_gadget_unmap_request(),
as the second argument; however, 'struct s3c_hsotg_req *' is used.

Fixed build warnings as below:

drivers/usb/gadget/s3c-hsotg.c: In function 's3c_hsotg_unmap_dma':
drivers/usb/gadget/s3c-hsotg.c:440:2: warning: passing argument 2 of 'usb_gadget_unmap_request' from incompatible pointer type
[enabled by default]
include/linux/usb/gadget.h:961:13: note: expected 'struct usb_request *' but argument is of type 'struct s3c_hsotg_req *'
drivers/usb/gadget/s3c-hsotg.c:434:22: warning: unused variable 'req' [-Wunused-variable]
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Upon initialisation (driver probe) a NULL pointer exception
is triggered. This is due to lack of initialisation of
device field in phy structure, which is used by phy
framework in usb_get_phy().

Fix it by initialising the device field.
Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

devm_ioremap_resource does sanity checks on the given resource. No need to
duplicate this in the driver.
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

devm_ioremap_resource does sanity checks on the given resource. No need to
duplicate this in the driver.
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

The commit:
388e5c51 usb: dwc3: remove dwc3 dependency on host AND gadget
breaks compilation when
USB=y, USB_GADGET=m, USB_DWC3=y and USB_DWC3_DUAL_ROLE=y.

drivers/built-in.o: In function `dwc3_gadget_giveback':
drivers/usb/dwc3/gadget.c:271: undefined reference to `usb_gadget_unmap_request'
drivers/built-in.o: In function `__dwc3_gadget_kick_transfer':
drivers/usb/dwc3/gadget.c:1005: undefined reference to `usb_gadget_unmap_request'
drivers/built-in.o: In function `__dwc3_gadget_ep_queue':
drivers/usb/dwc3/gadget.c:1073: undefined reference to `usb_gadget_map_request'
drivers/built-in.o: In function `dwc3_gadget_reset_interrupt':
drivers/usb/dwc3/gadget.c:2165: undefined reference to `usb_gadget_set_state'
drivers/built-in.o: In function `dwc3_gadget_init':
drivers/usb/dwc3/gadget.c:2647: undefined reference to `usb_add_gadget_udc'
drivers/built-in.o: In function `dwc3_gadget_exit':
drivers/usb/dwc3/gadget.c:2681: undefined reference to `usb_del_gadget_udc'
drivers/built-in.o: In function `__dwc3_ep0_do_control_data':
drivers/usb/dwc3/ep0.c:929: undefined reference to `usb_gadget_map_request'
drivers/usb/dwc3/ep0.c:906: undefined reference to `usb_gadget_map_request'
drivers/built-in.o: In function `dwc3_ep0_set_config':
drivers/usb/dwc3/ep0.c:575: undefined reference to `usb_gadget_set_state'
drivers/built-in.o: In function `dwc3_ep0_set_address':
drivers/usb/dwc3/ep0.c:520: undefined reference to `usb_gadget_set_state'
drivers/usb/dwc3/ep0.c:522: undefined reference to `usb_gadget_set_state'
drivers/built-in.o: In function `dwc3_ep0_set_config':
drivers/usb/dwc3/ep0.c:556: undefined reference to `usb_gadget_set_state'

Making changes similar to patch:
71a5e61b usb: chipidea: fix and improve dependencies if usb host or gadget support is built as module

Let us limit the DWC3 mode to depend on corresponding usb-subsystem
and USB_DWC3.
Signed-off-by: Vivek Gautam <gautam.vivek@samsung.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Fix to return a negative error code in the go through all configs error
handling case instead of 0(usb_add_function() will overwrite ret to 0).
Also use error code from usb_gstrings_attach() in all strings init error
case instead of -EINVAL.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Fix to return -ENOMEM in the kzalloc() error handling case instead
of 0(following platform_device_add_data() will overwrite it to 0), as
done elsewhere in this function.
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Fix to return a negative error code from the error handling
case instead of 0, as done elsewhere in this function.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Fix to return -ENOMEM in the request alloc error handling
case instead of 0, as done elsewhere in this function.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Felipe Balbi <balbi@ti.com>