Added missing GUSBCFG programming in host mode, which fixes
transaction errors issue on HiKey and Altera Cyclone V boards.

These field even if was programmed in device mode (in function
dwc2_hsotg_core_init_disconnected()) will be resetting to POR values
after core soft reset applied.
So, each time when switching to host mode required to set this field
to correct value.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NMinas Harutyunyan <hminas@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

According databook in Buffer and External DMA mode
non-split periodic channels can't be halted.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NMinas Harutyunyan <hminas@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Removed unnecessary debug prints about DMA mode for host side
from dwc2_gahbcfg_init() function.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NRazmik Karapetyan <razmik@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Deleted dwc2_hcd_dump_frrem() function, because it used undefined
parameters from dwc2_hsotg structure. The function body was in #ifdef
statement and was never compiled.

Also removed that parameters from dwc2_hsotg structure, which were
used only in dwc2_hcd_dump_frrem() function.

And also delete dwc2_sample_frrem macro, because without
dwc2_hcd_dump_frrem() function it's lose its purpose.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Renamed __orr32 and __bic32 function names to more descriptive
dwc2_set_bit and dwc2_clear_bit respectively.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NRazmik Karapetyan <razmik@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Disabled only unmasked endpoints based on DAINTMSK register.
This will allow to minimize GINTSTS_GOUTNAKEFF interrupt handling.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NRazmik Karapetyan <razmik@synopsys.com>
Signed-off-by: NMinas Harutyunyan <hminas@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

In 'for' loop skipped masked and non-ISOC EPs. Also breaked 'for' loop
after setting SGOUTNAK in DCTL,when one enabled EP was detected.

This will allow to minimize incomplete ISOC OUT interrupt handling.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NRazmik Karapetyan <razmik@synopsys.com>
Signed-off-by: NMinas Harutyunyan <hminas@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Disabled only that ISOC endpoints,for which interrupt bit was set
in the DAINTMSK register. This will allow to minimize incomplete
ISOC IN interrupt handling.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NRazmik Karapetyan <razmik@synopsys.com>
Signed-off-by: NMinas Harutyunyan <hminas@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Changed AHB burst size from INCR4 to INCR by default.
With this value driver shows excellent DMA performance.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NRazmik Karapetyan <razmik@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

In dwc2_hsotg_core_init_disconnected() function used AHB burst size
parameter, instead of calculating already calculated value.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NRazmik Karapetyan <razmik@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Move dwc2_hsotg_wait_bit_set function to core.c so it can be used
anywhere in the code.

Added dwc2_hsotg_wait_bit_clear function in core.c.

Replace all the parts of register bit polling code with
dwc2_hsotg_wait_bit_set or dwc2_hsotg_wait_bit_clear functions
calls depends on code logic.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NSevak Arakelyan <sevaka@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Only check the ID portion of the GSNPSID register and don’t check
the version. This will allow the driver to work with version 4.00a
and later of the DWC_hsotg IP.
Acked-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NGevorg Sahakyan <sahakyan@synopsys.com>
Signed-off-by: NMinas Harutyunyan <hminas@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Some UDC drivers (like the DWC3) expect that the response to a setup()
request is queued from within the setup function itself so that it is
available as soon as setup() has completed.

Upon receiving a setup request the function fs driver creates an event that
is made available to userspace. And only once userspace has acknowledged
that event the response to the setup request is queued.

So it violates the requirement of those UDC drivers and random failures can
be observed. This is basically a race condition and if userspace is able to
read the event and queue the response fast enough all is good. But if it is
not, for example because other processes are currently scheduled to run,
the USB host that sent the setup request will observe an error.

To avoid this the gadget framework provides the USB_GADGET_DELAYED_STATUS
return code. If a setup() callback returns this value the UDC driver is
aware that response is not yet available and can uses the appropriate
methods to handle this case.

Since in the case of function fs the response will never be available when
the setup() function returns make sure that this status code is used.

This fixed random occasional failures that were previously observed on a
DWC3 based system under high system load.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

When using a AIO read() operation on the function FS gadget driver a URB is
submitted asynchronously and on URB completion the received data is copied
to the userspace buffer associated with the read operation.

This is done from a kernel worker thread invoking copy_to_user() (through
copy_to_iter()). And while the user space process memory is made available
to the kernel thread using use_mm(), some architecture require in addition
to this that the operation runs with USER_DS set. Otherwise the userspace
memory access will fail.

For example on ARM64 with Privileged Access Never (PAN) and User Access
Override (UAO) enabled the following crash occurs.

	Internal error: Accessing user space memory with fs=KERNEL_DS: 9600004f [#1] SMP
	Modules linked in:
	CPU: 2 PID: 1636 Comm: kworker/2:1 Not tainted 4.9.0-04081-g8ab2dfb-dirty #487
	Hardware name: ZynqMP ZCU102 Rev1.0 (DT)
	Workqueue: events ffs_user_copy_worker
	task: ffffffc87afc8080 task.stack: ffffffc87a00c000
	PC is at __arch_copy_to_user+0x190/0x220
	LR is at copy_to_iter+0x78/0x3c8
	[...]
	[<ffffff800847b790>] __arch_copy_to_user+0x190/0x220
	[<ffffff80086f25d8>] ffs_user_copy_worker+0x70/0x130
	[<ffffff80080b8c64>] process_one_work+0x1dc/0x460
	[<ffffff80080b8f38>] worker_thread+0x50/0x4b0
	[<ffffff80080bf5a0>] kthread+0xd8/0xf0
	[<ffffff8008083680>] ret_from_fork+0x10/0x50

Address this by placing a set_fs(USER_DS) before of the copy operation
and revert it again once the copy operation has finished.

This patch is analogous to commit d7ffde35 ("vhost: use USER_DS in
vhost_worker thread") which addresses the same underlying issue.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Increase max_speed of the mass_storage driver for UDCs that support
SuperSpeed Plus. The composite driver will pass this value to UDC core
to set the device speed on probe (actual speed may be different
depending on whether the USB controller supports it or other external
factors).
Signed-off-by: NThinh Nguyen <thinhn@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

When the host wants to fetch OS descriptors, it sends two requests. The
first is only for the header and the second for the full amount
specified by the header in the first request. The OS descriptor handling
code is distinguishing the header-only requests based on the wLength of
the setup packet, but the same code is executed in both cases to
construct the actual header. Simplify this by always constructing the
header and then filling out the rest of the request if the wLength is
greater than the size of the header.

Also remove the duplicate code for queueing the request to ep0 by adding
a goto label.
Signed-off-by: NChris Dickens <christopher.a.dickens@gmail.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

When handling an OS descriptor request, one of the first operations is
to zero out the request buffer using the wLength from the setup packet.
There is no bounds checking, so a wLength > 4096 would clobber memory
adjacent to the request buffer. Fix this by taking the min of wLength
and the request buffer length prior to the memset. While at it, define
the buffer length in a header file so that magic numbers don't appear
throughout the code.

When returning data to the host, the data length should be the min of
the wLength and the valid data we have to return. Currently we are
returning wLength, thus requests for a wLength greater than the amount
of data in the OS descriptor buffer would return invalid (albeit zero'd)
data following the valid descriptor data. Fix this by counting the
number of bytes when constructing the data and using this when
determining the length of the request.
Signed-off-by: NChris Dickens <christopher.a.dickens@gmail.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

The irq is available in hsotg already, so there's no need to pass it as
separate function parameter.
Signed-off-by: NVardan Mikayelyan <mvardan@synopsys.com>
Signed-off-by: NGrigor Tovmasyan <tovmasya@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

As devm_ioremap_resource() checks for valid resource,
make use of it instead of testing ourselves. As a bonus
memory region is requested.
Acked-by: NNicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: NLadislav Michl <ladis@linux-mips.org>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Pointer tv_nexus is being initialized a value and this is never read
and is later being updated with the same value. Remove the redundant
initialization so that the assignment to tv_nexus is performed later
and more local to when it is being read.

Cleans up clang warning:
drivers/usb/gadget/function/f_tcm.c:1097:25: warning: Value stored to
'tv_nexus' during its initialization is never read
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Due to a typo, the mask was destroyed by a comparison instead of a bit
shift.
Reported-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: NWolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

The local variable event is of type enum usb_phy_events. Use
the same enum value USB_EVENT_NONE instead of UX500_MUSB_NONE.

This avoids a warning when building with clang:
  drivers/usb/phy/phy-ab8500-usb.c:906:30: warning: implicit conversion from
  enumeration type 'enum ux500_musb_vbus_id_status' to different enumeration
  type 'enum usb_phy_events' [-Wenum-conversion]
        enum usb_phy_events event = UX500_MUSB_NONE;
                            ~~~~~   ^~~~~~~~~~~~~~~
Signed-off-by: NStefan Agner <stefan@agner.ch>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

mxs_charger_secondary_detection() is only used in this file, so make
it static.

This fixes the following sparse warning:

drivers/usb/phy/phy-mxs-usb.c:581:23: warning: symbol 'mxs_charger_secondary_detection' was not declared. Should it be static?
Acked-by: NJun Li <jun.li@nxp.com>
Signed-off-by: NFabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Use dma_pool_zalloc instead of dma_pool_alloc + memset
Signed-off-by: NSouptick Joarder <jrdr.linux@gmail.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

...instead of open coding file operations followed by custom ->open()
callbacks per each attribute.
Reviewed-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

...instead of open coding file operations followed by custom ->open()
callbacks per each attribute.

Cc: Daniel Mack <daniel@zonque.org>
Cc: Haojian Zhuang <haojian.zhuang@gmail.com>
Cc: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

...instead of open coding file operations followed by custom ->open()
callbacks per each attribute.

Cc: Daniel Mack <daniel@zonque.org>
Cc: Haojian Zhuang <haojian.zhuang@gmail.com>
Cc: Robert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

...instead of open coding file operations followed by custom ->open()
callbacks per each attribute.
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

...instead of open coding file operations followed by custom ->open()
callbacks per each attribute.

Cc: Kevin Cernekee <cernekee@gmail.com>
Cc: Florian Fainelli <f.fainelli@gmail.com>
Cc: bcm-kernel-feedback-list@broadcom.com
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

...instead of open coding file operations followed by custom ->open()
callbacks per each attribute.

Cc: John Youn <johnyoun@synopsys.com>
Signed-off-by: NAndy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

This reverts commit dbac5d07.

commit dbac5d07 ("usb: musb: host: don't start next rx urb if current one failed")
along with commit b5801212 ("usb: musb: host: clear rxcsr error bit if set")
try to solve the issue described in [1], but the latter alone is
sufficient, and the former causes the issue as in [2], so now revert it.

[1] https://marc.info/?l=linux-usb&m=146173995117456&w=2
[2] https://marc.info/?l=linux-usb&m=151689238420622&w=2

Cc: stable@vger.kernel.org # v4.7+
Signed-off-by: NBin Liu <b-liu@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

On dm3730 there are enumeration problems after resume.
Investigation led to the cause that the MUSB_POWER_SOFTCONN
bit is not set. If it was set before suspend (because it
was enabled via musb_pullup()), it is set in
musb_restore_context() so the pullup is enabled. But then
musb_start() is called which overwrites MUSB_POWER and
therefore disables MUSB_POWER_SOFTCONN, so no pullup is
enabled and the device is not enumerated.

So let's do a subset of what musb_start() does
in the same way as musb_suspend() does it. Platform-specific
stuff it still called as there might be some phy-related stuff
which needs to be enabled.
Also interrupts are enabled, as it was the original idea
of calling musb_start() in musb_resume() according to
Commit 6fc6f4b8 ("usb: musb: Disable interrupts on suspend,
enable them on resume")
Signed-off-by: NAndreas Kemnade <andreas@kemnade.info>
Tested-by: NTony Lindgren <tony@atomide.com>
Signed-off-by: NBin Liu <b-liu@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

ACM driver may accept data to transmit while system is not fully
resumed. In this case ACM driver buffers data and prepare URBs
on usb anchor list.
There is a little chance that two tasks put a char and initiate
acm_tty_flush_chars(). In such a case, driver will put one URB
twice on usb anchor list.
This patch also reset length of data before resue of a buffer.
This not only prevent sending rubbish, but also lower risc of race.

Without this patch we hit following kernel panic in one of our
stabilty/stress tests.

[   46.884442] *list_add double add*: new=ffff9b2ab7289330, prev=ffff9b2ab7289330, next=ffff9b2ab81e28e0.
[   46.884476] Modules linked in: hci_uart btbcm bluetooth rfkill_gpio igb_avb(O) cfg80211 snd_soc_sst_bxt_tdf8532 snd_soc_skl snd_soc_skl_ipc snd_soc_sst_ipc snd_soc_sst_dsp snd_soc_sst_acpi snd_soc_sst_match snd_hda_ext_core snd_hda_core trusty_timer trusty_wall trusty_log trusty_virtio trusty_ipc trusty_mem trusty_irq trusty virtio_ring virtio intel_ipu4_mmu_bxtB0 lib2600_mod_bxtB0 intel_ipu4_isys_mod_bxtB0 lib2600psys_mod_bxtB0 intel_ipu4_psys_mod_bxtB0 intel_ipu4_mod_bxtB0 intel_ipu4_wrapper_bxtB0 intel_ipu4_acpi videobuf2_dma_contig as3638 dw9714 lm3643 crlmodule smiapp smiapp_pll
[   46.884480] CPU: 1 PID: 33 Comm: kworker/u8:1 Tainted: G     U  W  O    4.9.56-quilt-2e5dc0ac-g618ed69ced6e-dirty #4
[   46.884489] Workqueue: events_unbound flush_to_ldisc
[   46.884494]  ffffb98ac012bb08 ffffffffad3e82e5 ffffb98ac012bb58 0000000000000000
[   46.884497]  ffffb98ac012bb48 ffffffffad0a23d1 00000024ad6374dd ffff9b2ab7289330
[   46.884500]  ffff9b2ab81e28e0 ffff9b2ab7289330 0000000000000002 0000000000000000
[   46.884501] Call Trace:
[   46.884507]  [<ffffffffad3e82e5>] dump_stack+0x67/0x92
[   46.884511]  [<ffffffffad0a23d1>] __warn+0xd1/0xf0
[   46.884513]  [<ffffffffad0a244f>] warn_slowpath_fmt+0x5f/0x80
[   46.884516]  [<ffffffffad407443>] __list_add+0xb3/0xc0
[   46.884521]  [<ffffffffad71133c>] *usb_anchor_urb*+0x4c/0xa0
[   46.884524]  [<ffffffffad782c6f>] *acm_tty_flush_chars*+0x8f/0xb0
[   46.884527]  [<ffffffffad782cd1>] *acm_tty_put_char*+0x41/0x100
[   46.884530]  [<ffffffffad4ced34>] tty_put_char+0x24/0x40
[   46.884533]  [<ffffffffad4d3bf5>] do_output_char+0xa5/0x200
[   46.884535]  [<ffffffffad4d3e98>] __process_echoes+0x148/0x290
[   46.884538]  [<ffffffffad4d654c>] n_tty_receive_buf_common+0x57c/0xb00
[   46.884541]  [<ffffffffad4d6ae4>] n_tty_receive_buf2+0x14/0x20
[   46.884543]  [<ffffffffad4d9662>] tty_ldisc_receive_buf+0x22/0x50
[   46.884545]  [<ffffffffad4d9c05>] flush_to_ldisc+0xc5/0xe0
[   46.884549]  [<ffffffffad0bcfe8>] process_one_work+0x148/0x440
[   46.884551]  [<ffffffffad0bdc19>] worker_thread+0x69/0x4a0
[   46.884554]  [<ffffffffad0bdbb0>] ? max_active_store+0x80/0x80
[   46.884556]  [<ffffffffad0c2e10>] kthread+0x110/0x130
[   46.884559]  [<ffffffffad0c2d00>] ? kthread_park+0x60/0x60
[   46.884563]  [<ffffffffadad9917>] ret_from_fork+0x27/0x40
[   46.884566] ---[ end trace 3bd599058b8a9eb3 ]---
Signed-off-by: NDominik Bozek <dominikx.bozek@intel.com>
Signed-off-by: NKuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Acked-by: NOliver Neukum <oneukum@suse.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now that USB_UHCI_BIG_ENDIAN_MMIO and USB_UHCI_BIG_ENDIAN_DESC are moved
outside of the USB_SUPPORT conditional, simply select them from
SPARC_LEON rather than by the symbol's defaults in drivers/usb/Kconfig,
similar to how it is done for USB_EHCI_BIG_ENDIAN_MMIO and
USB_EHCI_BIG_ENDIAN_DESC.
Signed-off-by: NJames Hogan <jhogan@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Corentin Labbe <clabbe.montjoie@gmail.com>
Cc: sparclinux@vger.kernel.org
Cc: linux-usb@vger.kernel.org
Acked-by: NDavid S. Miller <davem@davemloft.net>
Patchwork: https://patchwork.linux-mips.org/patch/18560/

Move the Kconfig symbols USB_UHCI_BIG_ENDIAN_MMIO and
USB_UHCI_BIG_ENDIAN_DESC out of drivers/usb/host/Kconfig, which is
conditional upon USB && USB_SUPPORT, so that it can be freely selected
by platform Kconfig symbols in architecture code.

For example once the MIPS_GENERIC platform selects are fixed in commit
2e6522c5 ("MIPS: Fix typo BIG_ENDIAN to CPU_BIG_ENDIAN"), the MIPS
32r6_defconfig warns like so:

warning: (MIPS_GENERIC) selects USB_UHCI_BIG_ENDIAN_MMIO which has unmet direct dependencies (USB_SUPPORT && USB)
warning: (MIPS_GENERIC) selects USB_UHCI_BIG_ENDIAN_DESC which has unmet direct dependencies (USB_SUPPORT && USB)

Fixes: 2e6522c5 ("MIPS: Fix typo BIG_ENDIAN to CPU_BIG_ENDIAN")
Signed-off-by: NJames Hogan <jhogan@kernel.org>
Cc: Corentin Labbe <clabbe.montjoie@gmail.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Paul Burton <paul.burton@mips.com>
Cc: linux-usb@vger.kernel.org
Cc: linux-mips@linux-mips.org
Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Patchwork: https://patchwork.linux-mips.org/patch/18559/

Following on from this patch: https://lkml.org/lkml/2017/11/3/516,
Corsair K70 RGB keyboards also require the DELAY_INIT quirk to
start correctly at boot.

Device ids found here:
usb 3-3: New USB device found, idVendor=1b1c, idProduct=1b13
usb 3-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
usb 3-3: Product: Corsair K70 RGB Gaming Keyboard
Signed-off-by: NJack Stocker <jackstocker.93@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks()

There is a race condition between finish_unlinks->finish_urb() function
and usb_kill_urb() in ohci controller case. The finish_urb calls
spin_unlock(&ohci->lock) before usb_hcd_giveback_urb() function call,
then if during this time, usb_kill_urb is called for another endpoint,
then new ed will be added to ed_rm_list at beginning for unlink, and
ed_rm_list will point to newly added.

When finish_urb() is completed in finish_unlinks() and ed->td_list
becomes empty as in below code (in finish_unlinks() function):

        if (list_empty(&ed->td_list)) {
                *last = ed->ed_next;
                ed->ed_next = NULL;
        } else if (ohci->rh_state == OHCI_RH_RUNNING) {
                *last = ed->ed_next;
                ed->ed_next = NULL;
                ed_schedule(ohci, ed);
        }

The *last = ed->ed_next will make ed_rm_list to point to ed->ed_next
and previously added ed by usb_kill_urb will be left unreferenced by
ed_rm_list. This causes usb_kill_urb() hang forever waiting for
finish_unlink to remove added ed from ed_rm_list.

The main reason for hang in this race condtion is addition and removal
of ed from ed_rm_list in the beginning during usb_kill_urb and later
last* is modified in finish_unlinks().

As suggested by Alan Stern, the solution for proper handling of
ohci->ed_rm_list is to remove ed from the ed_rm_list before finishing
any URBs. Then at the end, we can add ed back to the list if necessary.

This properly handle the updated ohci->ed_rm_list in usb_kill_urb().

Fixes: 977dcfdc ("USB: OHCI: don't lose track of EDs when a controller dies")
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: NAman Deep <aman.deep@samsung.com>
Signed-off-by: NJeffy Chen <jeffy.chen@rock-chips.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

At former code, the SETUP stage does not enable interrupt
for qtd completion, it relies on IAA watchdog to complete
interrupt, then the transcation would be considered timeout
if the flag need_io_watchdog is cleared by platform code.

In this commit, we always add enable interrupt for qtd completion,
then the qtd completion can be notified by hardware interrupt.
Signed-off-by: NPeter Chen <peter.chen@nxp.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch adds support for new CASSY devices to the ldusb driver. The
PIDs are also added to the ignore list in hid-quirks.
Signed-off-by: NKarsten Koop <kkoop@ld-didactic.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This fixes an issue that a gadget driver (usb_f_fs) is possible to
stop rx transactions after the usb-dmac is used because the following
functions missed to set/check the "running" flag.
 - usbhsf_dma_prepare_pop_with_usb_dmac()
 - usbhsf_dma_pop_done_with_usb_dmac()

So, if next transaction uses pio, the usbhsf_prepare_pop() can not
start the transaction because the "running" flag is 0.

Fixes: 8355b2b3 ("usb: renesas_usbhs: fix the behavior of some usbhs_pkt_handle")
Cc: <stable@vger.kernel.org> # v3.19+
Signed-off-by: NYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>