Remove redundant pointer to struct usb_endpoint_descriptor.
Signed-off-by: NIdo Shayevitz <idos@codeaurora.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Remove redundant pointer to struct usb_endpoint_descriptor.
Signed-off-by: NIdo Shayevitz <idos@codeaurora.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Remove redundant pointer to struct usb_endpoint_descriptor.
Signed-off-by: NIdo Shayevitz <idos@codeaurora.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Remove redundant pointer to struct usb_endpoint_descriptor.
Signed-off-by: NIdo Shayevitz <idos@codeaurora.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch converts the drivers in drivers/usb/gadget/* to use
module_pci_driver() macro which makes the code smaller and a bit simpler.
Signed-off-by: NAxel Lin <axel.lin@gmail.com>
Cc: Thomas Dahlmann <dahlmann.thomas@arcor.de>
Cc: Xiaochen Shen <xiaochen.shen@intel.com>
Cc: Pavankumar Kondeti <pkondeti@codeaurora.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Now that we are using irqdomains, we need to convert GPIO pins to Linux
IRQ numbers using the gpio_to_irq() function.
This call is added to request/free_irq calls.
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: NFelipe Balbi <balbi@ti.com>
Cc: linux-usb@vger.kernel.org

usb: gadget: eliminate NULL pointer dereference (bugfix)

This patch fixes a bug which causes NULL pointer dereference in
ffs_ep0_ioctl. The bug happens when the FunctionFS is not bound (either
has not been bound yet or has been bound and then unbound) and can be
reproduced with running the following commands:

$ insmod g_ffs.ko
$ mount -t functionfs func /dev/usbgadget
$ ./null

where null.c is:

#include <fcntl.h>
#include <linux/usb/functionfs.h>

int main(void)
{
	int fd = open("/dev/usbgadget/ep0", O_RDWR);
	ioctl(fd, FUNCTIONFS_CLEAR_HALT);

	return 0;
}
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Cc: stable@vger.kernel.org
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch removes the non-required spinlock acquire/release calls on
'queue->irqlock' from 'uvc_queue_next_buffer' routine.

This routine is called from 'video->encode' function (which translates to
either 'uvc_video_encode_bulk' or 'uvc_video_encode_isoc') in 'uvc_video.c'.
As, the 'video->encode' routines are called with 'queue->irqlock' already held,
so acquiring a 'queue->irqlock' again in 'uvc_queue_next_buffer' routine causes
a spin lock recursion.
Signed-off-by: NBhupesh Sharma <bhupesh.sharma@st.com>
Acked-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

It is crucial to assign each req->context value to struct rndis.

The problem happens for multi function gadget (g_multi) when multiple
functions are calling common usb_composite_dev control request.

It might happen that *_setup method from one usb function will
alter some fields of this common request issued by other USB
function.
Signed-off-by: NLukasz Majewski <l.majewski@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

During modprobe of gadget driver, pullup is called after
udc_start. In order to make the exit path symmetric when
removing a gadget driver, call pullup before ->udc_stop.

This is needed to avoid issues with PM where udc_stop
disables the module completely (put IP in reset state,
cut functional and interface clocks, and so on), which
prevents us from accessing the IP's address space,
thus creating the possibility of an abort exception
when we try to access IP's address space after clocks
are off.

Cc: stable@vger.kernel.org
Signed-off-by: NPartha Basak <p-basak2@ti.com>
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

make module init & exit __init & __exit
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

clear FFS_FL_BOUND flag on unbind (bugfix)
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NKyungmin Park <kyungmin.park@samsung.com>
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

DMA address register shouldn't be updated manually if transfer size
requires multiple packets.
Signed-off-by: NAnton Tikhomirov <av.tikhomirov@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Writing to TxFIFO relates only to Slave mode and leads to
TxFIFO corruption in DMA mode.
Signed-off-by: NAnton Tikhomirov <av.tikhomirov@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

MPS field of DOEPCTL0 is read only.
Signed-off-by: NAnton Tikhomirov <av.tikhomirov@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

According to documentation, TX FIFO_number index starts from 1.
For IN endpoint FIFO 0 we use GNPTXFSIZ register for programming
the size and memory start address.
Signed-off-by: NAnton Tikhomirov <av.tikhomirov@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

- For Control Read transfer, the ACK handshake on an IN transaction
may be corrupted, so the device may not receive the ACK for data
stage, the complete irq will not occur at this situation.
Therefore, we need to move prime status stage from complete irq
routine to the place where the data stage has just primed, or the
host will never get ACK for status stage.
The above issue has been described at USB2.0 spec chapter 8.5.3.3.

- After adding prime status stage just after prime the data stage,
there is a potential problem when the status dTD is added before the data stage
has primed by hardware. The reason is the device's dTD descriptor has NO direction bit,
if data stage (IN) prime hasn't finished, the status stage(OUT)
dTD will be added at data stage dTD's Next dTD Pointer, so when the data stage
transfer has finished, the status dTD will be primed as IN by hardware,
then the host will never receive ACK from the device side for status stage.

- Delete below code at fsl_ep_queue:
       /* Update ep0 state */
       if ((ep_index(ep) == 0))
               udc->ep0_state = DATA_STATE_XMIT;
the udc->ep0_state will be updated again after udc->driver->setup
finishes.

It is tested at i.mx51 bbg board with g_mass_storage, g_ether, g_serial.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

When we want to do device-initiated disconnect,
let's make sure we stop the UDC in order to
e.g. allow lower power states to be achieved by
turning off unnecessary clocks and/or stoping
PHYs.

When reconnecting, call ->udc_start() again to
make sure UDC is reinitialized.

Cc: stable@vger.kernel.org
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Removed unused "restart:" label, which was causing compiler warning.
Signed-off-by: NMichael BRIGHT <mjbrightfr+git-kernel@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Remove all #inclusions of asm/system.h preparatory to splitting and killing
it.  Performed with the following command:

perl -p -i -e 's!^#\s*include\s*<asm/system[.]h>.*\n!!' `grep -Irl '^#\s*include\s*<asm/system[.]h>' *`
Signed-off-by: NDavid Howells <dhowells@redhat.com>

Now skb_add_rx_frag() has a truesize parameter, we can fix f_phonet to
properly account truesize of each fragment : a full page.
Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Rémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

skb_add_rx_frag() API is misleading.

Network skbs built with this helper can use uncharged kernel memory and
eventually stress/crash machine in OOM.

Add a 'truesize' parameter and then fix drivers in followup patches.
Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
Cc: Wey-Yi Guy <wey-yi.w.guy@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

really weirdly spelled "while the list is non-empty, pick its
first element, remove it from the list and free it" kind of loop...
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

lock debugging already supports this, no need to do it explicitely.

Cc: balbi@ti.com
Cc: gregkh@linuxfoundation.org
Signed-off-by: NAndi Kleen <ak@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Allow to compile it if AT91 is enable.
Signed-off-by: NJean-Christophe PLAGNIOL-VILLARD <plagnioj@jcrosoft.com>
Acked-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

 commit 28824b18:
 |Author: Michal Nazarewicz <m.nazarewicz@samsung.com>
 |Date:   Wed May 5 12:53:13 2010 +0200
 |
 |    USB: gadget: __init and __exit tags removed
 |
 |    __init, __initdata and __exit tags have have been removed from
 |    various files to make it possible for gadgets that do not use
 |    the __init/__exit tags to use those.
 obviously missed (at least) this case leading to a section mismatch in
 g_ffs.c when compiling with CONFIG_USB_FUNCTIONFS_ETH enabled.
Signed-off-by: NLothar Waßmann <LW@KARO-electronics.de>
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NFabio Baltieri <fabio.baltieri@gmail.com>
Reviewed-by: NJesper Juhl <jj@chaosbits.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NFabio Baltieri <fabio.baltieri@gmail.com>
Reviewed-by: NJesper Juhl <jj@chaosbits.net>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

HID devices should specify this in their interface descriptors, not in the
device descriptor. This fixes a "missing hardware id" bug under Windows 7 with
a VIA VL800 (3.0) controller.
Signed-off-by: NOrjan Friberg <of@flatfrog.com>
Cc: Felipe Balbi <balbi@ti.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Checking if tty->index is in bounds is not needed. The tty has the
index set in the initial open. This is done in get_tty_driver. And it
can be only in interval <0,driver->num).

So remove the tests which check exactly this interval. Some are
left untouched as they check against the current backing device count.
(Leaving apart that the check is racy in most of the cases.)
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

All num, magic and owner are set by alloc_tty_driver. No need to
re-set them on each allocation site.

pti driver sets something different to what it passes to
alloc_tty_driver. It is not a bug, since we don't use the lines
parameter in any way. Anyway this is fixed, and now we do the right
thing.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Acked-by: NTilman Schmidt <tilman@imap.cc>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Greg's e-mail address was old. So, I resend it.

Though I've tested this patch,
http://marc.info/?l=linux-usb&m=132825305710285&w=2,
I've received the following reports.
http://kisskb.ellerman.id.au/kisskb/buildresult/5771890/
http://kisskb.ellerman.id.au/kisskb/buildresult/5771905/

So, I added header file for these symbols.
Using this patch, this compile error must be disappeared.
Reported-by: NPaul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: NTomoya MORINAGA <tomoya.rohm@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

A read from GadgetFS endpoint 0 during the data stage of a control
request would always return 0 on success (as returned by
wait_event_interruptible) despite having written data into the user
buffer.
This patch makes it correctly set the return value to the number of
bytes read.
Signed-off-by: NThomas Faber <thfabba@gmx.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

As the coverity checker puts it:

"Passing argument "sizeof (midi_function) /*8*/" to function "kcalloc"
and then casting the return value to "struct usb_descriptor_header **"
is suspicious. ... In this particular case sizeof(struct
usb_descriptor_header **) happens to be equal to sizeof(struct
usb_descriptor_header *), but this is not a portable assumption."

I believe we really do intend to use 'sizeof(*midi_function)' here, so
this patch makes that change.
Signed-off-by: NJesper Juhl <jj@chaosbits.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

"len" is unsigned so it's never less than zero.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch changes the ARCH name to "ARCH_S3C24XX" for Samsung
S3C2410, S3C2412, S3C2413, S3C2416, S3C2440, S3C2442, S3C2443,
and S3C2450 SoCs so that we can merge the mach-xxx directories
and plat-s3c24xx dir. to just one mach-s3c24xx for them.

I think this should be sent to upstream via samsung tree because
this touches many samsung stuff.

Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Richard Purdie <rpurdie@rpsys.net>
Cc: Chris Ball <cjb@laptop.org>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Grant Likely <grant.likely@secretlab.ca>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
[for the gadget part:]
Acked-by: NFelipe Balbi <balbi@ti.com>
[for the framebuffer (video) part:]
Acked-by: NFlorian Tobias Schandinat <FlorianSchandinat@gmx.de>
[For the watchdog-part:]
Acked-by: NWim Van Sebroeck <wim@iguana.be>
Cc: Sangbeom Kim <sbkim73@samsung.com>
Cc: Liam Girdwood <lrg@ti.com>
Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: NKukjin Kim <kgene.kim@samsung.com>

This replaces the remaining defines which are available in "public"
include/ directory and are re-defined by the storage gadget.
This is patch is basicaly search & replace followed by the removal of
the defines.
Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This moves the BOT data structures for CBW and CSW from drivers internal
header file to global include able file in include/.
The storage gadget is using the same name for CSW but a different for
CBW so I fix it up properly. The same goes for the ub driver and keucr
driver in staging.
Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

those routines have everything we need to map/unmap
USB requests and it's better to use them.
Signed-off-by: NFelipe Balbi <balbi@ti.com>