Refactor out the code to find alternate interface settings into
usb_find_alt_setting().  Print a debugging message and return null if the
alt setting is not found.

While we're at it, correct a bug in the refactored code.  The interfaces
in the configuration's interface cache are not necessarily in numerical
order, so we can't just use the interface number as an array index.  Loop
through the interface caches, looking for the correct interface.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The xHCI driver issues a Configure Endpoint command for two reasons:
 - a new configuration or alternate interface setting is selected
 - a quirky Fresco Logic prototype requires the command after a Reset
   Endpoint command.
The xHCI driver only waits on the command in the first case.

When a configure endpoint command completes, the driver needs to know why
the command was generated.  When the driver only supported selecting an
initial configuration, the check was simple.  Unfortunately that check
doesn't work now that the driver supports alternate interfaces.  If an
endpoint must be dropped (because it's not in the new alternate setting)
and no new endpoints are added, the math involving
xhci_last_valid_endpoint() will assign -1 to an unsigned integer and cause
an out-of-bounds array access.

Move the check for the quirky hardware sooner and avoid the bad array
access.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

When a driver wants to switch to a different alternate setting for an
interface, the USB core will (soon) check whether there is enough
bandwidth.  Once the new alternate setting is installed in the xHCI
hardware, the USB core will send a USB_REQ_SET_INTERFACE control
message.  That can fail in various ways, and the USB core needs to be
able to reinstate the old alternate setting.

With the old code, reinstating the old alt setting could fail if the
there's not enough memory to allocate new endpoint rings.  Keep
around a cache of (at most 31) endpoint rings for this case.  When we
successfully switch the xHCI hardware to the new alt setting, the old
alt setting's rings will be stored in the cache.  Therefore we'll
always have enough rings to satisfy a conversion back to a previous
device setting.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Make the USB Test & Measurement driver use usb_clear_halt() instead of
usb_control_msg() to clear a stalled endpoint.  This will allow devices to
be tested under an xHCI host controller.  The endpoint stall will not be
cleared in the internal xHCI hardware state unless usb_clear_halt() is
used.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: Steve Holland <sdh4@iastate.edu>
Cc: Oliver Neukum <oliver@neukum.org>
Cc: Jouni Ryno <Jouni.Ryno@fmi.fi>
Cc: Gergely Imreh <imrehg@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add the xHCI driver files to its MAINTAINERS entry so that I'm Cc'd on
cleanup patches.  Update the email address to one I actually use for
sending patches and responding to Linux mailing list emails.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Error handling code following a kzalloc should free the allocated data.

The semantic match that finds this problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)

// <smpl>
@r exists@
local idexpression x;
statement S;
expression E;
identifier f,f1,l;
position p1,p2;
expression *ptr != NULL;
@@

x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
<... when != x
     when != if (...) { <+...x...+> }
(
x->f1 = E
|
 (x->f1 == NULL || ...)
|
 f(...,x->f1,...)
)
...>
(
 return \(0\|<+...x...+>\|ptr\);
|
 return@p2 ...;
)

@script:python@
p1 << r.p1;
p2 << r.p2;
@@

print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line)
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Error handling code following a kzalloc should free the allocated data.

The semantic match that finds this problem is as follows:
(http://www.emn.fr/x-info/coccinelle/)

// <smpl>
@r exists@
local idexpression x;
statement S;
expression E;
identifier f,f1,l;
position p1,p2;
expression *ptr != NULL;
@@

x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
...
if (x == NULL) S
<... when != x
     when != if (...) { <+...x...+> }
(
x->f1 = E
|
 (x->f1 == NULL || ...)
|
 f(...,x->f1,...)
)
...>
(
 return \(0\|<+...x...+>\|ptr\);
|
 return@p2 ...;
)

@script:python@
p1 << r.p1;
p2 << r.p2;
@@

print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line)
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Acked-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Accroding commit 0994375e, which is adding remove_id sysfs attr
for pci drivers, for management tools dynamically bind/unbind
a pci/usb devices to a specified drivers; with this patch,
the management tools can be simplied.

And the original code didn't handle the failure of
usb_create_newid_file, fixed in this patch.
Signed-off-by: NCHENG Renquan <rqcheng@smu.edu.sg>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

USB_G_MULTI uses block and net interface functions, so make it
depend on both of those.  Otherwise there are lots of build errors.

Fix USB_G_MULTI config help text typos and copy/paste error.
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch adds ZTE modem devices.
Signed-off-by: NMing Zhao <zhao.ming9@zte.com.cn>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Reported-by: NRoel Kluin <roel.kluin@gmail.com>
Signed-off-by: NDavid Vrabel <david.vrabel@csr.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Don't leak an urb in wusb_dev_alloc() if the following kmalloc() failed.
Reported-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NDavid Vrabel <david.vrabel@csr.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

When building qTDs (sTDs) from a scatter-gather list, the length of the
qTD must be a multiple of wMaxPacketSize if the transfer continues into
another qTD.

This also fixes a link failure on configurations for 32 bit processors
with 64 bit dma_addr_t (e.g., CONFIG_HIGHMEM_64G).
Signed-off-by: NDavid Vrabel <david.vrabel@csr.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1312) fixes a minor bug in usb-storage.  The
fill_inquiry() routine neglects to pre-load the inquiry data buffer
with spaces.  As a result, if the vendor name is shorter than 8
characters or the product name is shorter than 16, the remainder will
be filled with garbage.

The patch also removes some unnecessary calls to strlen().
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1311) fixes a problem in usb-storage: Some devices are
pretty broken when it comes to reporting sense data.  The information
they send back indicates that they have more than 18 bytes of sense
data available, but when the system asks for more than 18 they fail or
hang.  The symptom is that probing fails with multiple resets.

The patch adds a new BAD_SENSE flag to indicate that usb-storage
should never ask for more than 18 bytes of sense data.  The flag can
be set in an unusual_devs entry or via the "quirks=" module parameter,
and it is set automatically whenever a REQUEST SENSE command for more
than 18 bytes fails or times out.

An unusual_devs entry is added for the Agfa photo frame, which uses a
Prolific chip having this bug.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NDaniel Kukula <daniel.kuku@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1303) revises the USB Power Management infrastructure to
make it compatible with the new driver-model Runtime PM framework:

	Drivers are no longer allowed to access intf->pm_usage_cnt
	directly; the PM framework manages its own usage counters.

	usb_autopm_set_interface() is eliminated, because it directly
	sets intf->pm_usage_cnt.

	usb_autopm_enable() and usb_autopm_disable() are eliminated,
	because they call usb_autopm_set_interface().

	usb_autopm_get_interface_no_resume() and
	usb_autopm_put_interface_no_suspend() are added.  They
	correspond to pm_runtime_get_noresume() and
	pm_runtime_put_noidle() in the PM framework.

	The power/level attribute no longer accepts "suspend", only
	"on" and "auto".  The PM framework doesn't allow devices to be
	forced into a suspended mode.

The hub driver contains the only code that violates the new
guidelines.  It is updated to use the new interface routines instead.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This is not exported from the usb core, yet we rely on it to create
paths to interfaces for this device in sysfs.  Export it to make
userspace tools have an easier time to figure things out.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

For TWL family of power management ICs, USB charging works only
when USB regulators are in enabled state: 3v1, 1v5, 1v8

On a USB cable attach, twl4030_phy_resume(twl) function enables
the regulators. Enable USB charging, only after all regulators
are enabled.

Its observed that enabling USB charging before regulators are
enabled, causes USB charging to fail.

Tested on: Zoom2: omap3430: ES3.1 + TWL5030
Needs T2-MADC and T2-BCI drivers which are still not upstreamed.
Signed-off-by: NMoiz Sonasath <m-sonasath@ti.com>
Signed-off-by: NLeed Aguilar <leed.aguilar@ti.com>
Acked-by: NVikram Pandita <vikram.pandita@ti.com>
Acked-by: NAnand Gadiyar <gadiyar@ti.com>
Acked-by: NNishanth Menon <nm@ti.com>
Acked-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

usb_bulk_msg() transfers only bytes up to the maximum packet size.
It must be repeated by the usbtmc driver until all bytes of a TMC message
are transfered.

Without this patch, ETIMEDOUT is reported when writing TMC messages
larger than the maximum USB bulk size and the transfer remains incomplete.
The user will notice that the device hangs and must be reset by either closing
the application or pulling the plug.
Signed-off-by: NAndre Herms <andre.herms@tec-venture.de>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Remove the pointless 'do () while (0)' loop from musb_g_tx() -- it
makes this function symmetric to musb_g_rx()...
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Stop playing with musb->lock and abusing musb_gadget_set_halt() in
the code clearing the endpoint halt feature -- instead, manipulate
the registers directly.

While at it, get rid uf unneeded line breaks and over-indentation in
the code setting the endpoint halt feature.
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Implement the driver's set_wedge() method by adding the 'wedged' flag
to the 'struct musb_ep'.
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Commit a5073b52 (musb_gadget: fix
unhandled endpoint 0 IRQs) somehow missed its key change:

"The gadget EP0 code routinely ignores an interrupt at end of
the data phase because of musb_g_ep0_giveback() resetting the
state machine to "idle, waiting for SETUP" phase prematurely."

So, the majority of the cases of unhandled IRQs is still unfixed...
Signed-off-by: NSergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

MUSB: save hardware revision at init

This can be used later to flag workarounds for issues affecting
particular revisions. Saving this at init avoids having to
read the HWVERS register multiple times in code.

While at it, use macros to extract the version information
instead of using hardcoded values.
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Cc: Ajay Kumar Gupta <ajay.gupta@ti.com>
Acked-by: NFelipe Balbi <felipe.balbi@nokia.com>
Cc: David Brownell <dbrownell@users.sourceforge.net>
Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The debug code in the DMA ISR uses a %d for a size_t when it should be
using %zu.  Otherwise gcc whines with:

drivers/usb/musb/musbhsdma.c: In function 'dma_controller_irq':
drivers/usb/musb/musbhsdma.c:288: warning: format '%d' expects type 'int',
	but argument 7 has type 'size_t'
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Otherwise we get the link failure:
drivers/built-in.o: In function 'musb_platform_init':
drivers/usb/musb/blackfin.c:300: undefined reference to 'usb_nop_xceiv_register'
make: *** [.tmp_vmlinux1] Error 1
Signed-off-by: NCliff Cai <cliff.cai@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Since we can't work around anomaly 05000380, throw a build error up and
instruct the user to use a different mode.
Signed-off-by: NSonic Zhang <sonic.zhang@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

If we clear the interrupt pending bits at the end, we sometimes return too
fast and have the same interrupt assert itself.  There is no way in a
Blackfin system to force a sync of this state, so the hardware manual
instructs people to clear interrupt flags early in their ISR.
Signed-off-by: NCliff Cai <cliff.cai@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Update function definition to match latest MUSB framework.
Signed-off-by: NBryan Wu <cooloney@kernel.org>
Signed-off-by: NCliff Cai <cliff.cai@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Only allow USE_MODE1 when the Blackfin part is not affected by anomaly
05000456 (USB Receive Interrupt Is Not Generated in DMA Mode 1) since we
can't support the mode in that case.
Signed-off-by: NSonic Zhang <sonic.zhang@analog.com>
Signed-off-by: NCliff Cai <cliff.cai@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add some helpful notes about how the driver works around different
anomalies that exist in the on-chip host controller.
Signed-off-by: NSonic Zhang <sonic.zhang@analog.com>
Signed-off-by: NCliff Cai <cliff.cai@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Do not allow MUSB driver to be selected on derivatives that don't have the
MUSB controller on them.
Signed-off-by: NSonic Zhang <sonic.zhang@analog.com>
Signed-off-by: NBryan Wu <cooloney@kernel.org>
Signed-off-by: NCliff Cai <cliff.cai@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NBryan Wu <cooloney@kernel.org>
Signed-off-by: NCliff Cai <cliff.cai@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The Blackfin version of musb_read_target_reg_base() returns a u16 when the
common code expects a (void __iomem *), so update the Blackfin function to
return the right value.  This fixes the compile warning:

drivers/usb/musb/musb_core.c: In function 'musb_core_init':
drivers/usb/musb/musb_core.c:1448: warning: assignment makes pointer from
	integer without a cast
Signed-off-by: NBryan Wu <cooloney@kernel.org>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Otherwise gcc will whine about epnum/dma_reg being unused when building
for BF54x parts.
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NBryan Wu <cooloney@kernel.org>
Signed-off-by: NCliff Cai <cliff.cai@analog.com>
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Acked-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The xHCI 0.95 and 0.96 specification defines several transfer buffer
request completion codes that indicate a USB transaction error occurred.
When a stall, babble, transaction, or split transaction error completion code
is set, the xHCI has halted that endpoint ring.  Software must issue a
Reset Endpoint command and a Set Transfer Ring Dequeue Pointer command
to clean up the halted ring.

The USB device driver is supposed to call into usb_reset_endpoint() when
an endpoint stalls.  That calls into the xHCI driver to issue the proper
commands.  However, drivers don't call that function for the other
errors that cause the xHC to halt the endpoint ring.  If a babble,
transaction, or split transaction error occurs, check if the endpoint
context reports a halted condition, and clean up the endpoint ring if it
does.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

An xHCI host controller manufacturer can choose to implement several
vendor-specific informational completion codes.  These are all to be
treated like a successful transfer completion.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

When the xHCI hardware says a transfer completed with a split
transaction error, set the URB status to -EPROTO.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The transfer descriptor (TD) is a series of transfer request buffers
(TRBs) that describe the buffer pointer, length, and other
characteristics.  The xHCI controllers want to know an estimate of how
long the TD is, for caching reasons.  In each TRB, there is a "TD size"
field that provides a rough estimate of the remaining buffers to be
transmitted, including the buffer pointed to by that TRB.

The TD size is 5 bits long, and contains the remaining size in bytes,
right shifted by 10 bits.  So a remaining TD size less than 1024 would get
a zero in the TD size field, and a remaining size greater than 32767 would
get 31 in the field.

This patches fixes a bug in the TD_REMAINDER macro that is triggered when
the URB has a scatter gather list with a size bigger than 32767 bytes.
Not all host controllers pay attention to the TD size field, so the bug
will not appear on all USB 3.0 hosts.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The Multifunction Composite Gadget has two configurations
consisting of Ethernet (RNDIS in first and CDC Ethernet in
second configuration), CDC Serial and File-backed Storage
functions.

When connected to a Windows host, the first configuration
is chosen thus gadget provides RNDIS Ethernet, serial and
mass storage whereas when connected to Linux host, second
configuration is chosen thus providing CDC Ethernet,
serial and mass storage.

Which configurations are built can be configured via
KConfig options.
Signed-off-by: NMichal Nazarewicz <m.nazarewicz@samsung.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>