The xHCI driver will create an xhci_hcd structure, not an ehci_hci
structure.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>

When running the Point Grey "flycap" program for their USB 3.0 camera
(which was running as a USB 2.0 device for some reason), I trigger this
oops whenever I try to open a video stream:

Dec 15 16:48:34 puck kernel: [ 1798.715559] BUG: unable to handle kernel NULL pointer dereference at           (null)
Dec 15 16:48:34 puck kernel: [ 1798.719153] IP: [<ffffffff8147841e>] free_async+0x1e/0x70
Dec 15 16:48:34 puck kernel: [ 1798.720991] PGD 6f833067 PUD 6fc56067 PMD 0
Dec 15 16:48:34 puck kernel: [ 1798.722815] Oops: 0002 [#1] SMP
Dec 15 16:48:34 puck kernel: [ 1798.724627] CPU 0
Dec 15 16:48:34 puck kernel: [ 1798.724636] Modules linked in: ecryptfs encrypted_keys sha1_generic trusted binfmt_misc sha256_generic aesni_intel cryptd aes_x86_64 aes_generic parport_pc dm_crypt ppdev joydev snd_hda_codec_hdmi snd_hda_codec_conexant arc4 iwlwifi snd_hda_intel snd_hda_codec snd_hwdep snd_pcm thinkpad_acpi mac80211 snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer btusb uvcvideo snd_seq_device bluetooth videodev psmouse snd v4l2_compat_ioctl32 serio_raw tpm_tis cfg80211 tpm tpm_bios nvram soundcore snd_page_alloc lp parport i915 xhci_hcd ahci libahci drm_kms_helper drm sdhci_pci sdhci e1000e i2c_algo_bit video
Dec 15 16:48:34 puck kernel: [ 1798.734212]
Dec 15 16:48:34 puck kernel: [ 1798.736162] Pid: 2713, comm: FlyCap2 Not tainted 3.2.0-rc5+ #28 LENOVO 4286CTO/4286CTO
Dec 15 16:48:34 puck kernel: [ 1798.738148] RIP: 0010:[<ffffffff8147841e>]  [<ffffffff8147841e>] free_async+0x1e/0x70
Dec 15 16:48:34 puck kernel: [ 1798.740134] RSP: 0018:ffff88005715fd78  EFLAGS: 00010296
Dec 15 16:48:34 puck kernel: [ 1798.742118] RAX: 00000000fffffff4 RBX: ffff88006fe8f900 RCX: 0000000000004118
Dec 15 16:48:34 puck kernel: [ 1798.744116] RDX: 0000000001000000 RSI: 0000000000016390 RDI: 0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.746087] RBP: ffff88005715fd88 R08: 0000000000000000 R09: ffffffff8146f22e
Dec 15 16:48:34 puck kernel: [ 1798.748018] R10: ffff88006e520ac0 R11: 0000000000000001 R12: ffff88005715fe28
Dec 15 16:48:34 puck kernel: [ 1798.749916] R13: ffff88005d31df00 R14: ffff88006fe8f900 R15: 00007f688c995cb8
Dec 15 16:48:34 puck kernel: [ 1798.751785] FS:  00007f68a366da40(0000) GS:ffff880100200000(0000) knlGS:0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.753659] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Dec 15 16:48:34 puck kernel: [ 1798.755509] CR2: 0000000000000000 CR3: 00000000706bb000 CR4: 00000000000406f0
Dec 15 16:48:34 puck kernel: [ 1798.757334] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.759124] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Dec 15 16:48:34 puck kernel: [ 1798.760871] Process FlyCap2 (pid: 2713, threadinfo ffff88005715e000, task ffff88006c675b80)
Dec 15 16:48:34 puck kernel: [ 1798.762605] Stack:
Dec 15 16:48:34 puck kernel: [ 1798.764297]  ffff88005715fe28 0000000000000000 ffff88005715fe08 ffffffff81479058
Dec 15 16:48:34 puck kernel: [ 1798.766020]  0000000000000000 ffffea0000004000 ffff880000004118 0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.767750]  ffff880000000001 ffff88006e520ac0 fffffff46fd81180 0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.769472] Call Trace:
Dec 15 16:48:34 puck kernel: [ 1798.771147]  [<ffffffff81479058>] proc_do_submiturb+0x778/0xa00
Dec 15 16:48:34 puck kernel: [ 1798.772798]  [<ffffffff8147a5fd>] usbdev_do_ioctl+0x24d/0x1200
Dec 15 16:48:34 puck kernel: [ 1798.774410]  [<ffffffff8147b5de>] usbdev_ioctl+0xe/0x20
Dec 15 16:48:34 puck kernel: [ 1798.775975]  [<ffffffff81189259>] do_vfs_ioctl+0x99/0x600
Dec 15 16:48:34 puck kernel: [ 1798.777534]  [<ffffffff81189851>] sys_ioctl+0x91/0xa0
Dec 15 16:48:34 puck kernel: [ 1798.779088]  [<ffffffff816247c2>] system_call_fastpath+0x16/0x1b
ec 15 16:48:34 puck kernel: [ 1798.780634] Code: 51 ff ff ff e9 29 ff ff ff 0f 1f 40 00 55 48 89 e5 53 48 83 ec 08 66 66 66 66 90 48 89 fb 48 8b 7f 18 e8 a6 ea c0 ff 4
8 8b 7b 20 <f0> ff 0f 0f 94 c0 84 c0 74 05 e8 d3 99 c1 ff 48 8b 43 40 48 8b
Dec 15 16:48:34 puck kernel: [ 1798.783970] RIP  [<ffffffff8147841e>] free_async+0x1e/0x70
Dec 15 16:48:34 puck kernel: [ 1798.785630]  RSP <ffff88005715fd78>
Dec 15 16:48:34 puck kernel: [ 1798.787274] CR2: 0000000000000000
Dec 15 16:48:34 puck kernel: [ 1798.794728] ---[ end trace 52894d3355f88d19 ]---

markup_oops.pl says the oops is in put_cred:

 ffffffff81478401:      48 89 e5                mov    %rsp,%rbp
 ffffffff81478404:      53                      push   %rbx
 ffffffff81478405:      48 83 ec 08             sub    $0x8,%rsp
 ffffffff81478409:      e8 f2 c0 1a 00          callq  ffffffff81624500 <mcount>
 ffffffff8147840e:      48 89 fb                mov    %rdi,%rbx   |  %ebx => ffff88006fe8f900
        put_pid(as->pid);
 ffffffff81478411:      48 8b 7f 18             mov    0x18(%rdi),%rdi
 ffffffff81478415:      e8 a6 ea c0 ff          callq  ffffffff81086ec0 <put_pid>
        put_cred(as->cred);
 ffffffff8147841a:      48 8b 7b 20             mov    0x20(%rbx),%rdi |  %edi => 0  %ebx = ffff88006fe8f900
  */
 static inline int atomic_dec_and_test(atomic_t *v)
 {
        unsigned char c;

        asm volatile(LOCK_PREFIX "decl %0; sete %1"
*ffffffff8147841e:      f0 ff 0f                lock decl (%rdi)   |  %edi = 0 <--- faulting instruction
 ffffffff81478421:      0f 94 c0                sete   %al
 static inline void put_cred(const struct cred *_cred)
 {
        struct cred *cred = (struct cred *) _cred;

        validate_creds(cred);
        if (atomic_dec_and_test(&(cred)->usage))
 ffffffff81478424:      84 c0                   test   %al,%al
 ffffffff81478426:      74 05                   je     ffffffff8147842d <free_async+0x2d>
                __put_cred(cred);
 ffffffff81478428:      e8 d3 99 c1 ff          callq  ffffffff81091e00 <__put_cred>
        kfree(as->urb->transfer_buffer);
 ffffffff8147842d:      48 8b 43 40             mov    0x40(%rbx),%rax
 ffffffff81478431:      48 8b 78 68             mov    0x68(%rax),%rdi
 ffffffff81478435:      e8 a6 e1 ce ff          callq  ffffffff811665e0 <kfree>
        kfree(as->urb->setup_packet);
 ffffffff8147843a:      48 8b 43 40             mov    0x40(%rbx),%rax
 ffffffff8147843e:      48 8b b8 90 00 00 00    mov    0x90(%rax),%rdi
 ffffffff81478445:      e8 96 e1 ce ff          callq  ffffffff811665e0 <kfree>
        usb_free_urb(as->urb);
 ffffffff8147844a:      48 8b 7b 40             mov    0x40(%rbx),%rdi
 ffffffff8147844e:      e8 0d 6b ff ff          callq  ffffffff8146ef60 <usb_free_urb>

This bug seems to have been introduced by commit
d178bc3a "user namespace: usb: make usb
urbs user namespace aware (v2)"

I'm not sure if this is right fix, but it does stop the oops.

Unfortunately, the Point Grey software still refuses to work, but it's a
closed source app, so I can't fix it.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Acked-by: NSerge Hallyn <serge.hallyn@canonical.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Merge branch 'for-gadget/next' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

* 'for-gadget/next' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: (24 commits)
  usb: dwc3: gadget: add support for SG lists
  usb: dwc3: gadget: don't force 'LST' always
  usb: dwc3: gadget: don't return anything on prepare trbs
  usb: dwc3: gadget: re-factor dwc3_prepare_trbs()
  usb: gadget: introduce support for sg lists
  usb: renesas: pipe: convert a long if into a XOR operation
  usb: gadget: remove useless depends on Kconfig
  usb: gadget: s3c-hsudc: remove the_controller global
  usb: gadget: s3c-hsudc: use release_mem_region instead of release_resource
  usb: gadget: s3c-hsudc: Add regulator handling
  usb: gadget: s3c-hsudc: use udc_start and udc_stop functions
  usb: gadget: s3c-hsudc: move device registration to probe
  usb: gadget: s3c-hsudc: add missing otg_put_transceiver in probe
  usb: gadget: s3c-hsudc: add __devinit to probe function
  usb: gadget: s3c-hsudc: move platform_data struct to global header
  USB: EHCI: Add Marvell Host Controller driver
  USB: OTG: add Marvell usb OTG driver support
  usb: gadget: mv_udc: drop ARCH dependency
  usb: gadget: mv_udc: fix bug in ep_dequeue
  usb: gadget: enlarge maxburst bit width.
  ...

Merge branch 'for-next/dwc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

* 'for-next/dwc3' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb:
  usb: dwc3: gadget: move us to Default State after reset

Merge branch 'for-next/musb' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

* 'for-next/musb' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb:
  usb: musb: remove extern qualifier from musb_debug.h header
  usb: musb: cleanup kconfig
  usb: musb: trivial Kconfig cleanups
  musb: omap2430: avoid pm_runtime_disable()
  usb: musb: remove a bit of indentation
  usb: musb: trivial cleanup
  usb: musb: fix pm_runtime mismatch

Merge branch 'for-next/xceiv' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

* 'for-next/xceiv' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb:
  usb: otg: trivial cleanups

add support for SG lists on dwc3 driver. With
this we can e.g. use VFS layer's SG lists on
storage gadgets so that we can start bigger
transfers and improve throughput.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

the LST bit is to be set on the last of a series
of consecutive TRBs. We had a workaround for a
problem where data would get corrupted but that
doesn't happen anymore. It's likely that it was
caused by some FPGA instability during development
phase.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

all that function does is setup a TRB to be sent
to HW later. There's no need to return anything
actually.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

In order to make it easier to add SG support,
let's split the big loop out to its own function.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Some controllers support scatter/gather transfers
and that might be very useful for some gadget drivers.

This means that we can make use of larger buffer
allocations which means we will have less completion
IRQs overtime, thus improving the perceived performance.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This is just a minor optimization for the long
if we have on the driver.

When we want to check that one input is true
and the other must be false, the bitwise XOR
operator will achieve that for us.
Tested-by: NKuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Where are inside an 'if USB_GADGET'.
Signed-off-by: NFelipe Contreras <felipe.contreras@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Instead use container_of to retrieve the s3c_hsudc from the
struct usb_gadget pointer.

[ balbi@ti.com : changed verbose container_of() into
	an already provided helper 'to_hsudc()' ]
Signed-off-by: NHeiko Stuebner <heiko@sntech.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

As the memory region is requested through request_mem_region
use the correct paired method to release it in the error path
and don't go "beneath the API".
Reported-by: NRussell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: NHeiko Stuebner <heiko@sntech.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The udc has three supplies: vdda (3.3V), vddi (1.2V) and vddosc (1.8-3.3V).
Turn these on and off on start and stop calls.
Signed-off-by: NHeiko Stuebner <heiko@sntech.de>
Reviewed-by: NMark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

udc_start and udc_stop reduce code duplication in comparison to
start and stop generalising calls done by all drivers
(i.e. bind and unbind) and moving these calls to common code.
Signed-off-by: NHeiko Stuebner <heiko@sntech.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Instead of adding and deleting the gadget device in the start and stop
invocations. Use device_register in the probe method to initialize
and add the gadget device.
Signed-off-by: NHeiko Stuebner <heiko@sntech.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The number of get and put calls should always be equal.
Signed-off-by: NHeiko Stuebner <heiko@sntech.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Fixes possible section mismatch warnings.
Signed-off-by: NHeiko Stuebner <heiko@sntech.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Gadget drivers should be compilable on all architectures.
This patch removes one dependency on architecture-specific code.
Acked-by: NKukjin Kim <kgene.kim@samsung.com>
Signed-off-by: NHeiko Stuebner <heiko@sntech.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This change removes confusing extern qualifier, which doesn't have any practical
sense there.
Signed-off-by: NVladimir Zapolskiy <vladimir.zapolskiy@nokia.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

After a bus reset, we should move our state to
Default, in order to be able to re-enumerate again.

I only managed to trigger this problem with g_ether
by removing the cable after a few transfers had been
completed.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Spaces to tabs, proper alignment, and start sentences as they should.
Signed-off-by: NFelipe Contreras <felipe.contreras@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The whole thing depends on USB_MUSB_HDRC, just add an 'if'.
Signed-off-by: NFelipe Contreras <felipe.contreras@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Shuffle the code a bit so the description is at the top.
Signed-off-by: NFelipe Contreras <felipe.contreras@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

These are handled by drivers core, and in a way that doesn't wake up the
devices.
Signed-off-by: NFelipe Contreras <felipe.contreras@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

And use dev instead of musb->controller.
Signed-off-by: NFelipe Contreras <felipe.contreras@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

enabled && driver || !enabled can be simplified to !enabled || driver.
Signed-off-by: NFelipe Contreras <felipe.contreras@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

In musb_init_controller() there's a pm_runtime_put(), but there's no
pm_runtime_get(), which creates a mismatch that causes the driver to
sleep when it shouldn't.

This was introduced in 7acc6197[1], but it wasn't triggered in my setup
until 18a26892[2] was merged to Linus' branch at point df0914[3]. IOW;
when PM is working as it was supposed to.

However, it seems most of the time this is used in a way that keeps the
counter above 0, so nobody noticed. Also, it seems to depend on the
configuration used in versions before 3.1, but not later (or in it).

I found the problem by loading isp1704_charger before any usb gadgets:
http://article.gmane.org/gmane.linux.kernel/1226122

All versions after 2.6.39 are affected.

[1] usb: musb: Idle path retention and offmode support for OMAP3
[2] OMAP2+: musb: hwmod adaptation for musb registration
[3] Merge branch 'omap-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6

Cc: stable@vger.kernel.org
Cc: Hema HK <hemahk@ti.com>
Signed-off-by: NFelipe Contreras <felipe.contreras@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch adds support for EHCI compliant HSUSB Host controller found
on Marvell Socs.

It fits both OTG and SPH controller on marvell Socs, including
PXA9xx/MMP2/MMP3/MGx.
Signed-off-by: NNeil Zhang <zhangwm@marvell.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This driver is for ChipIdea USB OTG controller on Marvell Socs.
PXA9xx/MMP2/MMP3/MGx all have this USB OTG controller.
Signed-off-by: NNeil Zhang <zhangwm@marvell.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch do the following things:
1. Change the Kconfig information.
2. Rename the driver name.
3. Don't do any type cast to io memory.
4. Add dummy stub for clk framework.
Signed-off-by: NNeil Zhang <zhangwm@marvell.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

According to ChipIdea's SPEC, we cannot touch curr_dtd_ptr in dqh
directly, use prime endpoint instead.
Signed-off-by: NNeil Zhang <zhangwm@marvell.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

For super speed bulk transfer, the max burst size
is 16, so that 4 bits of maxburst cannot store it.
Signed-off-by: NYu Xu <yuxu@marvell.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Rewrite function queue_dtd according to ChipIdea's reference manual.
Remove all unnecessary logic, it will enhance the performance.
Signed-off-by: NNeil Zhang <zhangwm@marvell.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

readl expected 'const volatile void *' as the argument.
Signed-off-by: NNeil Zhang <zhangwm@marvell.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Gcc complains about this printk:
drivers/usb/renesas_usbhs/mod_gadget.c:188:3: warning: format ‘%x’
	expects argument of type ‘unsigned int’, but argument 3 has type
	‘dma_addr_t’ [-Wformat]
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch tidyup below smatch complaint

drivers/usb/renesas_usbhs/mod_host.c +642 usbhsh_queue_done()
	 warn: variable dereferenced before check 'urb' (see line 636)

Special thanks to Dan
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NKuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Merge branch 'for-next/gadget' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

* 'for-next/gadget' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb: (50 commits)
  usb: renesas_usbhs: show error reason on usbhsh_urb_enqueu()
  usb: renesas_usbhs: add force packet remove method
  usb: renesas_usbhs: care usb_hcd_giveback_urb() status
  usb: renesas_usbhs: add usbhsh_is_running()
  usb: renesas_usbhs: disable attch irq after device attached
  usb: renesas_usbhs: care pipe sequence
  usb: renesas_usbhs: add usbhs_pipe_attach() method
  usb: renesas_usbhs: add usbhsh_endpoint_detach_all() for error case
  usb: renesas_usbhs: modify device attach method
  usb: renesas_usbhs: pop packet when urb dequeued
  usb: renesas_usbhs: add lost error value when enqueue
  usb: gadget: mv_udc: replace some debug info
  usb: gadget: mv_udc: refine suspend/resume function
  usb: gadget: mv_udc: refine the clock relative code
  usb: gadget: mv_udc: disable ISR when stopped
  usb: gadget: mv_udc: add otg relative code
  usb: gadget: Use kcalloc instead of kzalloc to allocate array
  usb: renesas_usbhs: remove the_controller_link
  usb: renesas_usbhs: add test-mode support
  usb: renesas_usbhs: call usbhsg_queue_pop() when pipe disable.
  ...