This patch fixes the following NULL pointer dereference issue.

Pointer 'request' returned from call to function 'next_request'
at line 748 may be NULL and may be dereferenced at line 792.

============
Code Snippet
============

748:  request = next_request(musb_ep);
785: if (dma && (csr & MUSB_RXCSR_DMAENAB)) {
	csr &= ~(MUSB_RXCSR_AUTOCLEAR
			| MUSB_RXCSR_DMAENAB
			| MUSB_RXCSR_DMAMODE);
	musb_writew(epio, MUSB_RXCSR,
		MUSB_RXCSR_P_WZC_BITS | csr);

792:	 request->actual += musb_ep->dma->actual_len;
Signed-off-by: NMaulik Mankad <x0082077@ti.com>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Since a DMA transfer may need to be kicked off several times to complete,
the DMA start must include the length that has already been transferred.
Signed-off-by: NCliff Cai <cliff.cai@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Cc: Felipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Gadget stalling a zero-length SETUP request results in this error message:

SetupEnd came in a wrong ep0stage idle

In order to avoid it, always set the CSR0.DataEnd bit after detecting a zero-
length request.  Add the missing '\n' to the error message itself as well...
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: NAnand Gadiyar <gadiyar@ti.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Race condition exists between the cppi_interrupt handler and
davinci_interrupt handler w.r.t completing a TX IO.  Since DM646x
has seperate DMA and USB endpoint interrupts cppi_interrupt handler
needs to hold the lock while operating on the endpoint.

Update over previous patch to avoid taking the lock if already
taken.  Tested on DM644x, DM355 and DM646x platforms.
Signed-off-by: NSwaminathan S <swami.iyer@ti.com>
Acked-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

On OTG and gadget-only configurations, we need a gadget driver
in order to work properly, so avoid changing operation modes
when there's no gadget driver loaded.
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

When registering gadget driver, the state of the transceiver
must be set from undefined (no gadget) to b_idle.

Module unload sets the transceiver state to undefined state.
After the first load/unload pair, the reset irq will be lost.
Signed-off-by: NArnaud Mandy <ext-arnaud.2.mandy@nokia.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This fixes a null-pointer dereference bug.
Signed-off-by: NSwaminathan S <swami.iyer@ti.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Acked-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Acked-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The tree is now on a new address.
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Current musb gadget dma code produces the warning:
drivers/usb/musb/musb_gadget.c: In function 'txstate':
drivers/usb/musb/musb_gadget.c:312: warning: comparison of distinct
                                             pointer types lacks a cast

So switch to min_t(size_t, ...).
Signed-off-by: NCliff Cai <cliff.cai@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

probe() already was on __init, so moving remove() to __exit.
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Commit 7723de7e (USB: musb_gadget: remove
pointless loop) included uncalled for (and incorrect) optimization that
might cause a kernel oops in txstate() -- undo it.
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This is a (almost) sort-only patch to sort FTDI device
product ID definitions in new ftdi_sio_ids.h header.

Advantage is that new device ID submissions will now have a specific (sorted)
position - less future merge conflicts.

Compile-tested, based on _current_ mainline git.
Minor checkpatch.pl warnings were eliminated whereever it made sense,
very minor text changes.
Signed-off-by: NAndreas Mohr <andi@lisas.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This is a strictly move-only patch to relocate all FTDI device
product ID definitions to their own ftdi_sio_ids.h header
(following the usual *_ids.h kernel tree convention, too),
thus correcting the slightly too messy appearance
(crucial driver defines were stuck somewhere in the decaying middle swamp
of the huge existing header).

Compile-tested, based on latest mainline git.
Signed-off-by: NAndreas Mohr <andi@lisas.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix new kernel-doc warnings in usb core:

Warning(drivers/usb/core/usb.c:79): No description found for parameter 'config'
Warning(drivers/usb/core/usb.c:79): No description found for parameter 'iface_num'
Warning(drivers/usb/core/usb.c:79): No description found for parameter 'alt_num'
Warning(drivers/usb/core/hcd.c:1622): No description found for parameter 'udev'
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Hi!

$ lsusb -v
Bus 001 Device 008: ID 05ac:921c Apple, Inc. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               1.10
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0         8
  idVendor           0x05ac Apple, Inc.
  idProduct          0x921c 
  bcdDevice            1.15
  iManufacturer           1 
  iProduct                2 
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           34
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          0 
    bmAttributes         0xe0
      Self Powered
      Remote Wakeup
    MaxPower                2mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         3 Human Interface Device
      bInterfaceSubClass      0 No Subclass
      bInterfaceProtocol      0 None
      iInterface              0 
        HID Device Descriptor:
          bLength                 9
          bDescriptorType        33
          bcdHID               1.11
          bCountryCode            0 Not supported
          bNumDescriptors         1
          bDescriptorType        34 Report
          wDescriptorLength      92
         Report Descriptors: 
           ** UNAVAILABLE **
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0008  1x 8 bytes
        bInterval              16
Signed-off-by: Npancho horrillo <pancho@pancho.name>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Commit 91777826 removed __init from
ehci_wait_for_port(), but left it in place on ehci_reset_port(), which
is being called from the former function.
Signed-off-by: NJan Beulich <jbeulich@novell.com>
Acked-by: NJason Wessel <jason.wessel@windriver.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

While converting emi62 to use request_firmware(), the driver was also
changed to use the ihex helper functions.  However, this broke the loading
of the FPGA firmware because the code tries to access the addr field of
the EOF record which works with a plain array that has an empty last
record but not with the ihex helper functions where the end of the data is
signaled with a NULL record pointer, resulting in:

BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<f80d248c>] emi62_load_firmware+0x33c/0x740 [emi62]

This can be fixed by changing the loop condition to test the return value
of ihex_next_binrec() directly (like in emi26.c).
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Reported-and-tested-by: NDer Mickster <retroeffective@gmail.com>
Acked-by: NDavid Woodhouse <David.Woodhouse@intel.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NBlaise Gassend <blaise.gasend_linux@m4x.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch corrects a problem where drivers/usb/otg is linked twice
if CONFIG_USB_ULPI is selected, resulting in a build error (symbol
conflict). The files in that directory are properly linked already
as part of CONFIG_USB, and need not be indicated specifically for
CONFIG_USB_ULPI.
Signed-off-by: NBill Gatliff <bgat@billgatliff.com>
Acked-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use ERR_PTR and IS_ERR rather than mixing integers and pointers.

The semantic match that finds this problem is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression *E;
@@

* E < 0
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Acked-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1315) fixes some bugs in the USB core authorization
code:

	usb_deauthorize_device() should deallocate the device strings
	instead of leaking them, and it should invoke
	usb_destroy_configuration() (which does proper reference
	counting) instead of freeing the config information directly.

	usb_authorize_device() shouldn't change the device strings
	until it knows that the authorization will succeed, and it should
	autosuspend the device at the end (having autoresumed the
	device at the start).

	Because the device strings can be changed, the sysfs routines
	to display the strings must protect the string pointers by
	locking the device.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
CC: Inaky Perez-Gonzalez <inaky@linux.intel.com>
Acked-by: NDavid Vrabel <david.vrabel@csr.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1314) renames usb_configure_device() and
usb_configure_device_otg() in the hub driver.  Neither name is
appropriate because these routines enumerate devices, they don't
configure them.  That's handled by usb_choose_configuration() and
usb_set_configuration().
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1313) updates the documentation concerning USB power
management.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

* 'drm-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (35 commits)
  drm/radeon/kms: add definitions for v4 power tables
  drm/radeon/kms: never combine LVDS with another encoder
  drm/radeon/kms: Check module arguments to be valid V2
  drm/radeon/kms: Avoid crash when trying to cleanup uninitialized structure
  drm/radeon/kms: add cvt mode if we only have lvds w/h and no edid (v4)
  drm/radeon/kms: add 3DC compression support
  drm/radeon/kms: allow rendering while no colorbuffer is set on r300
  drm/radeon/kms: enable memory clock reading on legacy (V2)
  drm/radeon/kms: prevent parallel AtomBIOS calls
  drm/radeon/kms: set proper default tv standard
  drm/radeon/kms: fix legacy rmx
  drm/radeon/kms/atom: fill in proper defines for digital setup
  drm/kms: silencing a false positive warning.
  drm/mm: fix logic for selection of best fit block
  drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.
  drm/vmwgfx: Return -ERESTARTSYS when interrupted by a signal.
  drm/vmwgfx: Fix unlocked ioctl and add proper access control
  drm/radeon: fix build on 64-bit with some compilers.
  drivers/gpu: Use kzalloc for allocating only one thing
  DRM: Rename clamp variable
  ...

The USB serial code was a new user of the kfifo API, and it was missed
when porting things to the new kfifo API.

Please make the write_fifo in place.  Here is my patch to fix the
regression and full ported version.
Signed-off-by: NStefani Seibold <stefani@seibold.net>
Reported-and-tested-by: NRafael J. Wysocki <rjw@sisk.pl>
Cc: Greg KH <greg@kroah.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* korg/drm-radeon-next:
  drm/radeon/kms: add definitions for v4 power tables
  drm/radeon/kms: never combine LVDS with another encoder
  drm/radeon/kms: Check module arguments to be valid V2
  drm/radeon/kms: Avoid crash when trying to cleanup uninitialized structure
  drm/radeon/kms: add cvt mode if we only have lvds w/h and no edid (v4)
  drm/radeon/kms: add 3DC compression support
  drm/radeon/kms: allow rendering while no colorbuffer is set on r300
  drm/radeon/kms: enable memory clock reading on legacy (V2)
  drm/radeon/kms: prevent parallel AtomBIOS calls
  drm/radeon/kms: set proper default tv standard
  drm/radeon/kms: fix legacy rmx
  drm/radeon/kms/atom: fill in proper defines for digital setup

[airlied: just adding this for completeness to avoid drift between
public atombios.h files]
Signed-off-by: NAlex Deucher <alexdeucher@gmail.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

When linking multiple encoders to a connector, make sure
to not link LVDS with another connector.  Some bioses
have the same i2c line for LVDS and VGA.
Signed-off-by: NAlex Deucher <alexdeucher@gmail.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

This patch add a function which check module argument to be
valid. On invalid argument it prints a warning and setback
the default value.

V2: Allow 0 for vram limit & agp mode which are the default
value
Signed-off-by: NJerome Glisse <jglisse@redhat.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Add boolean to record if some part of the driver are initialized or
not this allow to avoid a crash when trying to cleanup uninitialized
structure members.
Signed-off-by: NJerome Glisse <jglisse@redhat.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

This fixes LVDS on some mac laptops without a panel edid.

v2 - Set proper mode type flags
v3 - Note that this is not neceesarily the exact panel mode,
but an approximation based on the cvt formula.  For these
systems we should ideally read the mode info out of the
registers or add a mode table, but this works and is much
simpler.
v4 - Update comments and debug message.
Signed-off-by: NAlex Deucher <alexdeucher@gmail.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

There are 2 formats:
ATI1N: 64 bits per 4x4 block, one-channel format
ATI2N: 128 bits per 4x4 block, two-channel format
Signed-off-by: NDave Airlie <airlied@redhat.com>

Because hardware cannot disable all colorbuffers directly to do depth-only
rendering, a user should:
- disable reading from a colorbuffer in blending
- disable fastfill
- set the color channel mask to 0 to prevent writing to a colorbuffer
Signed-off-by: NDave Airlie <airlied@redhat.com>

V2: detect IGP cards (which don't have own memory)
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Acked-by: NAlex Deucher <alexdeucher@gmail.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

This just adds a mutex around the atombios table execution
so we don't call it from two contexts at once.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

we were just using 1 before.

reported on irc by soreau
Signed-off-by: NAlex Deucher <alexdeucher@gmail.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

This makes 640x480 on my R100 work again, both
in aspect and centered mode.
Signed-off-by: NAlex Deucher <alexdeucher@gmail.com>
Tested-by: NDave Airlie <airlied@redhat.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Signed-off-by: NAlex Deucher <alexdeucher@gmail.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

* nouveau/for-airlied:
  drm/nouveau: fix bug causing pinned buffers to lose their NO_EVICT flag
  drm/nv50: fix suspend/resume delays without firmware present
  drm/nouveau: prevent all channel creation if accel not available
  drm/nv50: fix two potential suspend/resume oopses
  drm/nv40: implement ctxprog/state generation
  drm/nv10: Add the initial graph context and soft methods needed for LMA.
  drm/nouveau: Fix up buffer eviction, and evict them to GART, if possible.
  drm/nouveau: Add proper error handling to nouveau_card_init
  drm/nv04: Fix NV04 set_operation software method.
  drm/nouveau: Kill global state in BIOS script interpreter
  drm/nouveau: Kill global state in NvShadowBIOS
  drm/nouveau: use drm debug levels
  drm/i2c/ch7006: Fix load detection false positives right after system init.
  drm/nv04-nv40: Fix "conflicting memory types" when saving/restoring VGA fonts.

warning: 'width' may be used uninitialized in this function
drivers/gpu/drm/drm_edid.c
Signed-off-by: NMarin Mitov <mitov@issp.bas.bg>
Signed-off-by: NDave Airlie <airlied@redhat.com>