This patch add missing error check in ffs_func_bind() function, after
ffs_do_descs() function call for high speed descriptors. Without this
check it's possible that the module will try dereference incorrect
pointer.

[ balbi@ti.com : removed trailing empty line ]
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Move probe out of __init section and don't use platform_driver_probe
which cannot be used with deferred probing.

Since commit e9354576 ("gpiolib: Defer failed gpio requests by default")
this driver might return -EPROBE_DEFER if a gpio_request fails.

Cc: Eric Miao <eric.y.miao@gmail.com>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Haojian Zhuang <haojian.zhuang@gmail.com>
Cc: Felipe Balbi <balbi@ti.com>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

DWC2 databook indicates if the core sets "ErlySusp" bit, an idle state has been
detected on the USB for 3 ms. This situation can be occurred when waiting
a request from user daemon. So, we should keep the connection between udc and
gadget even though this interrupt is occurred.
Signed-off-by: NChanho Park <chanho61.park@samsung.com>
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

After driver conversion to udc_start/udc_stop infrastructure (commit
"usb:hsotg:samsung: Use new udc_start and udc_stop callbacks"
f65f0f10) the gadget unregistration function is almost always called
with 'driver' parameter being NULL, what caused that the unregistration
code has not been executed at all. This is a leftover from the earlier
verison of this function (which used simple start/stop interface), where
driver parameter was obligatory.

This patch removes the NULL check for the 'driver' pointer and removes
all dereferences of it. It also moves disabling voltage regulators out
of the atomic context, because handling regulators (which are usually
i2c devices) might require sleeping.
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Gadgets endpoint driver data is a criteria to judge that
whether the endpoints are in use or not. When gadget gets
assigned an endpoint from endpoint list, they check its
driver data if the driver data is NULL.

If the driver data is not NULL then they regard it as in use.
Therefore all of gadgets should reset their endpoints driver
data to NULL as they are disabled. Otherwise it causes a leak
of endpoint resource.
Signed-off-by: NPeter Oh <poh@broadcom.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

'eem_alloc' is local to this file. Make it static.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

'ecm_alloc' is local to this file. Make it static.
Signed-off-by: NSachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

They are only called by '__ref' function multi_bind(), and they will
call '__init' functions, so recommend to let them '__ref' too.

The related warnings:

  WARNING: drivers/usb/gadget/g_multi.o(.text+0xded6): Section mismatch in reference from the variable .LM2921 to the variable .init.text:_rndis_do_config
  The function .LM2921() references
  the variable __init _rndis_do_config.
  This is often because .LM2921 lacks a __init
  annotation or the annotation of _rndis_do_config is wrong.

  WARNING: drivers/usb/gadget/g_multi.o(.text+0xdf16): Section mismatch in reference from the variable .LM2953 to the variable .init.text:_cdc_do_config
  The function .LM2953() references
  the variable __init _cdc_do_config.
  This is often because .LM2953 lacks a __init
  annotation or the annotation of _cdc_do_config is wrong.
Signed-off-by: NChen Gang <gang.chen@asianux.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This fixes commit a38a2750
(usb: gadget: cdc2: convert to new interface of f_ecm)

The invocation of usb_get_function_instance() is in cdc_bind()
and should not be repeated in cdc_do_config().
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch fixes a NULL pointer dereference and a WARN_ON in
dummy-hcd.  These things were the result of moving to the UDC core
framework, and possibly of changes to that framework.

Now unloading a gadget driver causes the UDC to be stopped after the
gadget driver is unbound, not before.  Therefore the "driver" argument
to dummy_udc_stop() can be NULL, so we must not try to print the
driver's name without checking first.

Also, the UDC framework automatically unregisters the gadget when the
UDC is deleted.  Therefore a sysfs attribute file attached to the
gadget must be removed before the UDC is deleted, not after.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

mv_u3d_nuke() expects to be calles with ep->u3d->lock held,
because mv_u3d_done() does. But mv_u3d_ep_disable() calls it
without lock that can lead to unpleasant consequences.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

After the last architecture switched to generic hard irqs the config
options HAVE_GENERIC_HARDIRQS & GENERIC_HARDIRQS and the related code
for !CONFIG_GENERIC_HARDIRQS can be removed.
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

The gadget strings table should be null terminated.
usb_gadget_get_string() loops through the table
expecting a null at the end of the list.
Signed-off-by: NGraham Williams <gwilli@broadcom.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Use the wrapper functions for getting and setting the driver data using
platform_device instead of using dev_{get,set}_drvdata() with &pdev->dev,
so we can directly pass a struct platform_device.
Signed-off-by: NLibo Chen <libo.chen@huawei.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The "goto out" statements were wrong.  We aren't holding any locks at
that point so we should return directly.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

ffs_data_put() can sometimes free "ffs" so I have moved the call down
a line below the dereference.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The call to put_dev() releases "dev".  Hopefully, we don't need to set
the state to STATE_DEV_DISABLED anyway so I have removed those lines.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Convert all USB gadget sysfs attributes to use the _RO or _RW variants,
to make them easier to audit and ensure that the permissions are
correct.

Note, two are left using the DEVICE_ATTR() macro, as there is no
DEVICE_ATTR_WO() in Linus's tree, that will happen after 3.12-rc1 is
out, a follow-on patch will be sent then.
Reviewed-by: NFelipe Balbi <balbi@ti.com>
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

--
 drivers/usb/gadget/composite.c      |    8 +++-----
 drivers/usb/gadget/dummy_hcd.c      |    8 ++++----
 drivers/usb/gadget/f_mass_storage.c |   14 ++++++--------
 drivers/usb/gadget/net2272.c        |    4 ++--
 drivers/usb/gadget/net2280.c        |   18 +++++++++---------
 drivers/usb/gadget/storage_common.c |   25 ++++++++++++-------------
 drivers/usb/gadget/udc-core.c       |   14 +++++++-------
 7 files changed, 43 insertions(+), 48 deletions(-)

If NO_DMA=y:

drivers/built-in.o: In function `net2272_done':
drivers/usb/gadget/net2272.c:386: undefined reference to `usb_gadget_unmap_request'
drivers/built-in.o: In function `net2272_queue':
drivers/usb/gadget/net2272.c:848: undefined reference to `usb_gadget_map_request'
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

If NO_DMA=y:

drivers/built-in.o: In function `sudmac_free_channel':
drivers/usb/gadget/r8a66597-udc.c:676: undefined reference to `usb_gadget_unmap_request'
drivers/built-in.o: In function `sudmac_alloc_channel':
drivers/usb/gadget/r8a66597-udc.c:666: undefined reference to `usb_gadget_map_request'
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

If NO_DMA=y:

drivers/built-in.o: In function `fusb300_set_idma':
drivers/usb/gadget/fusb300_udc.c:946: undefined reference to `usb_gadget_map_request'
drivers/usb/gadget/fusb300_udc.c:958: undefined reference to `usb_gadget_unmap_request'
Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

If usb_add_function() fails then the currently processed function
is already not in the list in struct config_usb_cfg, and neither is it
in the list in struct usb_configuration. At the err_purge_funcs label the
purge_config_funcs() is called, which iterates over all configurations,
and in each configuration it iterates over all _successfully_ added
functions, and moves them back from the list in struct usb_configuration
to the list in struct config_usb_cfg. BUT the function which has just
failed adding and caused the unwind process is not taken care of and
is effectively lost.

This patch modifies the configfs_composite_bind() function so that if
the usb_add_function() fails, then the currently processed function
is returned to the list in struct config_usb_cfg.

It would be tempting to delay the list_del() in question after
usb_add_function() invocation, but a struct list_head (&f->list) cannot be
stored in more than one list at the same time, so the list_del() must
be called before usb_add_function(). Hence, the solution is to list_add()
after usb_add_function() in case of error.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The documentation for the USB gadget fs is actually in
Documentation/usb/gadget_configfs.txt.
Signed-off-by: NPhilippe De Swert <philippe.deswert@jollamobile.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The conversion to videobuf2 failed to check the return value of
vb2_qbuf(). Fix it.

Cc: stable@vger.kernel.org
Reported-by: NMichael Grzeschik <mgr@pengutronix.de>
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Tested-By: NMichael Grzeschik <mgr@pengutronix.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

control_selector_init() is used only in this file.
audio_bind_config() is used only in audio.c file to which
f_uac1.c is included. Thus, these functions are staticized
to fix the following warnings.

drivers/usb/gadget/f_uac1.c:698:12: warning: symbol 'control_selector_init' was not declared. Should it be static?
drivers/usb/gadget/f_uac1.c:722:12: warning: symbol 'audio_bind_config' was not declared. Should it be static?
Acked-by: NJassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Added __user annotation to fix the following sparse warning.

drivers/usb/gadget/u_uac1.c:194:52: warning: incorrect type in argument 2 (different address spaces)
drivers/usb/gadget/u_uac1.c:194:52:    expected void const [noderef] <asn:1>*buf
drivers/usb/gadget/u_uac1.c:194:52:    got void *buf
Acked-by: NJassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

rndis_init() and rndis_exit() are used only in this file.
Fix the following sparse warnings:

drivers/usb/gadget/rndis.c:1145:5: warning: symbol 'rndis_init' was not declared. Should it be static?
drivers/usb/gadget/rndis.c:1179:6: warning: symbol 'rndis_exit' was not declared. Should it be static?
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The local variables such as 'filename', 'vendor_name', and
'product_name' are pointers; thus, use NULL instead of 0 to fix
the following sparse warnings

drivers/usb/gadget/f_mass_storage.c:3046:27: warning: Using plain integer as NULL pointer
drivers/usb/gadget/f_mass_storage.c:3050:28: warning: Using plain integer as NULL pointer
drivers/usb/gadget/f_mass_storage.c:3051:29: warning: Using plain integer as NULL pointer
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

As far as prep_dma() is called with spinlock held,
we have to pass GFP_ATOMIC regardless of gfp argument.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The AT91 PMC (Power Management Controller) provides an USB clock used by
USB Full Speed host (ohci) and USB Full Speed device (udc).
The usb drivers (ohci and udc) must configure this clock to 48Mhz.
This configuration was formely done in mach-at91/clock.c, but this
implementation will be removed when moving to common clk framework.

This patch adds support for usb clock retrieval and configuration, and is
backward compatible with the current at91 clk implementation (if usb clk
is not found, it does not configure/enable it).
Signed-off-by: NBoris BREZILLON <b.brezillon@overkiz.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch adds missing clk_put on fclk and iclk in case the probe function
fails after these clocks have been retrieved.
Signed-off-by: NBoris BREZILLON <b.brezillon@overkiz.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

fusb300_rdcxf() used only in this file.
Fix the following sparse warning:

drivers/usb/gadget/fusb300_udc.c:560:6: warning: symbol 'fusb300_rdcxf' was not declared. Should it be static?
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

'req' is a pointer; thus, use NULL instead of 0
to fix the following sparse warning:

drivers/usb/gadget/goku_udc.c:775:13: warning: Using plain integer as NULL pointer
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This code doesn't serve any purpose anymore, since the aio retry
infrastructure has been removed.

This change should be safe because aio_read/write are also used for
synchronous IO, and called from do_sync_read()/do_sync_write() - and
there's no looping done in the sync case (the read and write syscalls).
Signed-off-by: NKent Overstreet <koverstreet@google.com>
Cc: Zach Brown <zab@redhat.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Asai Thambi S P <asamymuthupa@micron.com>
Cc: Selvan Mani <smani@micron.com>
Cc: Sam Bradshaw <sbradshaw@micron.com>
Cc: Jeff Moyer <jmoyer@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Benjamin LaHaise <bcrl@kvack.org>
Signed-off-by: NBenjamin LaHaise <bcrl@kvack.org>

Originally, io_event() was documented to return the io_event if
cancellation succeeded - the io_event wouldn't be delivered via the ring
buffer like it normally would.

But this isn't what the implementation was actually doing; the only
driver implementing cancellation, the usb gadget code, never returned an
io_event in its cancel function. And aio_complete() was recently changed
to no longer suppress event delivery if the kiocb had been cancelled.

This gets rid of the unused io_event argument to kiocb_cancel() and
kiocb->ki_cancel(), and changes io_cancel() to return -EINPROGRESS if
kiocb->ki_cancel() returned success.

Also tweak the refcounting in kiocb_cancel() to make more sense.
Signed-off-by: NKent Overstreet <koverstreet@google.com>
Cc: Zach Brown <zab@redhat.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Asai Thambi S P <asamymuthupa@micron.com>
Cc: Selvan Mani <smani@micron.com>
Cc: Sam Bradshaw <sbradshaw@micron.com>
Cc: Jeff Moyer <jmoyer@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Benjamin LaHaise <bcrl@kvack.org>
Signed-off-by: NBenjamin LaHaise <bcrl@kvack.org>

Use the wrapper function for retrieving the platform data instead of
accessing dev->platform_data directly.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The name of udc state attribute file under sysfs is registered as
"state", while usb_gadget_set_state take it as "status" when it's
going to update. This patch fixes the typo.
Signed-off-by: NRong Wang <Rong.Wang@csr.com>
Signed-off-by: NBarry Song <Baohua.Song@csr.com>
Cc: <stable@kernel.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The compatibility layer which the USBF_PHONET_INCLUDED was a part of
is no longer present - the USBF_PHONET_INCLUDED is not #defined by anyone
anymore, so the ifndef is always true. Removing it.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Fix to return a negative error code from the error handling
case instead of 0, as returned elsewhere in this function.

Introduced by commit 59835a (usb: gadget: multi: use
function framework for ACM.)

Make rndis_do_config() consistent with cdc_do_config() in the way it
handles returning the PTR_ERR(f_acm_*).
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Replace clk_enable/disable with clk_prepare_enable/disable_unprepare to
avoid common clk framework warnings.
Signed-off-by: NBoris BREZILLON <b.brezillon@overkiz.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>