USB: Move hcd free_dev call into usb_disconnect

I found a way to oops the kernel:

1. Open a USB device through devio.
2. Remove the hcd module in the host kernel.
3. Close the devio file descriptor.

The problem is that closing the file descriptor does usb_release_dev
as it is the last reference.  usb_release_dev then tries to invoke
the hcd free_dev function (or rather dereferencing the hcd driver
struct).  This causes an oops as the hcd driver has already been
unloaded so the struct is gone.

This patch tries to fix this by bringing the free_dev call earlier
and into usb_disconnect.  I have verified that repeating the
above steps no longer crashes with this patch applied.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

When hardware is removed on a Stratus, the system may crash like this:

ACPI: PCI interrupt for device 0000:7c:00.1 disabled
Trying to free nonexistent resource <00000000a8000000-00000000afffffff>
Trying to free nonexistent resource <00000000a4800000-00000000a480ffff>
uhci_hcd 0000:7e:1d.0: remove, state 1
usb usb2: USB disconnect, address 1
usb 2-1: USB disconnect, address 2
Unable to handle kernel paging request at 0000000000100100 RIP:
 [<ffffffff88021950>] :uhci_hcd:uhci_scan_schedule+0xa2/0x89c

 #4 [ffff81011de17e50] uhci_scan_schedule at ffffffff88021918
 #5 [ffff81011de17ed0] uhci_irq at ffffffff88023cb8
 #6 [ffff81011de17f10] usb_hcd_irq at ffffffff801f1c1f
 #7 [ffff81011de17f20] handle_IRQ_event at ffffffff8001123b
 #8 [ffff81011de17f50] __do_IRQ at ffffffff800ba749

This occurs because an interrupt scans uhci->skelqh, which is
being freed. We do the right thing: disable the interrupts in the
device, and do not do any processing if the interrupt is shared
with other source, but it's possible that another CPU gets
delayed somewhere (e.g. loops) until we started freeing.

The agreed-upon solution is to wait for interrupts to play out
before proceeding. No other bareers are neceesary.

A backport of this patch was tested on a 2.6.18 based kernel.
Testing of 2.6.32-based kernels is under way, but it takes us
forever (months) to turn this around. So I think it's a good
patch and we should keep it.

Tracked in RH bz#516851
Signed-Off-By: NPete Zaitcev <zaitcev@redhat.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1329) converts the USB stack over to the PM core's
runtime PM framework.  This involves numerous changes throughout
usbcore, especially to hub.c and driver.c.  Perhaps the most notable
change is that CONFIG_USB_SUSPEND now depends on CONFIG_PM_RUNTIME
instead of CONFIG_PM.

Several fields in the usb_device and usb_interface structures are no
longer needed.  Some code which used to depend on CONFIG_USB_PM now
depends on CONFIG_USB_SUSPEND (requiring some rearrangement of header
files).

The only visible change in behavior should be that following a system
sleep (resume from RAM or resume from hibernation), autosuspended USB
devices will be resumed just like everything else.  They won't remain
suspended.  But if they aren't in use then they will naturally
autosuspend again in a few seconds.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1328) reorders the functions in drivers/usb/core/driver.c
so as to put all the routines dependent on CONFIG_PM in one place.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1327) changes the way negative autosuspend delays
prevent device from autosuspending.  The current code checks for
negative values explicitly in the autosuspend_check() routine.  The
updated code keeps things from getting that far by using
usb_autoresume_device() to increment the usage counter when a negative
delay is set, and by using usb_autosuspend_device() to decrement the
usage counter when a non-negative delay is set.

This complicates the set_autosuspend() attribute method code slightly,
but it will reduce the overall power management overhead.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1326) adds usb_enable_autosuspend() and
usb_disable_autosuspend() routines for use by drivers.  If a driver
knows that its device can handle suspends and resumes correctly, it
can enable autosuspend all by itself.  This is equivalent to the user
writing "auto" to the device's power/level attribute.

The implementation differs slightly from what it used to be.  Now
autosuspend is disabled simply by doing usb_autoresume_device() (to
increment the usage counter) and enabled by doing
usb_autosuspend_device() (to decrement the usage counter).

The set_level() attribute method is updated to use the new routines,
and the USB Power-Management documentation is updated.

The patch adds a usb_enable_autosuspend() call to the hub driver's
probe routine, allowing the special-case code for hubs in quirks.c to
be removed.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1325) changes the locking for the persist_enabled flag
in struct usb_device.  Now it is protected by the device lock, along
with all its neighboring bit flags, instead of the PM lock (which is
about to vanish anyway).
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1324) makes a small change to the code used for remote
wakeup of root hubs.  hcd_resume_work() now calls the hub driver's
remote-wakeup routine instead of implementing its own version.

The patch is complicated by the need to rename remote_wakeup() to
usb_remote_wakeup(), make it non-static, and declare it in a header
file.  There's also the additional complication required to make
everything work when CONFIG_PM isn't set; the do-nothing inline
routine had to be moved into the header file.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1323) changes the locking requirements for
usb_autosuspend_device(), usb_autoresume_device(), and
usb_try_autosuspend_device().  This isn't a very important change;
mainly it's meant to make the locking more uniform.

The most tricky part of the patch involves changes to usbdev_open().
To avoid an ABBA locking problem, it was necessary to reduce the
region protected by usbfs_mutex.  Since that mutex now protects only
against simultaneous open and remove, this posed no difficulty -- its
scope was larger than necessary.

And it turns out that usbfs_mutex is no longer needed in
usbdev_release() at all.  The list of usbfs "ps" structures is now
protected by the device lock instead of by usbfs_mutex.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1322) reverses the two outcomes of an "if" statement in
usb_probe_interface(), to avoid an unnecessary level of indentation.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

USB devices do not have to sort interfaces in their descriptors based on
the interface number, and they may choose to skip interface numbers.  The
USB bandwidth allocation code for installing a new configuration assumes
the for loop variable will match the interface number.  Make it use the
interface number (bInterfaceNumber) in the descriptor instead.
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Enable the SD-Card interface on multiple Option 3G sticks.
The unusual_devs.h entry is necessary because the device descriptor is
vendor-specific. That prevents usb-storage from binding to it as an interface
driver.
Signed-off-by: NJan Dumon <j.dumon@option.com>
Signed-off-by: NPhil Dibowitz <phil@ipom.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

trivial patch enabling g_nokia on rx51_defconfig.
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

g_nokia is the gadget driver implementing
WMCDC Wireless Handset Control Model for the N900
device.
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Randy Dunlap reported this error when compiling the xHCI driver:

linux-next-20100104/drivers/usb/host/xhci.h:1214:
sorry, unimplemented: inlining failed in call to 'xhci_get_slot_state': function body not available

The xhci_get_slot_state() function belongs in xhci-dbg.c, since it
involves debugging internal xHCI structures.  However, it is only used in
xhci-hcd.c.  Some toolchains may have issues since the inlined function
body is not in the xhci.h header file.  Remove the inline keyword to avoid
this.
Reported-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Acked-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NThiago Farina <tfransosi@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

urb_priv->tds has type struct td **, not struct td *, so the
elements of the array should have pointer type, not structure type.

Convert kzalloc to kcalloc as well.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@disable sizeof_type_expr@
type T;
T **x;
@@

  x =
  <+...sizeof(
- T
+ *x
  )...+>
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Cc: Lonnie Mendez <dignome@gmail.com>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The original code was passing a stack variable as a dma buffer, so I
made it an allocated variable.  Instead of adding a bunch of kfree()
calls, I changed all the error return paths to gotos.

Also I noticed that the error checking wasn't correct because
usb_get_descriptor() can return negative values.

While I was at it, I made an unrelated white space change by moving
the unicode_to_ascii() on to one line.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Cc: Johan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Kill string that is allocated and generated using speed and parity
settings but is never used (and never has been).
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Change data-argument type from (void *) to (u8 *) to prevent endianess
problems.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Cc: Oliver Neukum <oliver@neukum.name>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Cc: Lonnie Mendez <dignome@gmail.com>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Cc: Lonnie Mendez <dignome@gmail.com>
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

OMAP3 has three HS USB ports so it can have three different regulator
for each PHY connected to each port.

Currently these regulators are assumed to be optional and driver doesn't
fail but continue with the initialization if it doesn't get any regulators.

Regulator supply names has to be mapped in board files as 'hsusbN' where
'N' is port number and can be {0, 1 ,2}.
Signed-off-by: NAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Added missing kfree() in ehci_hcd_omap_remove().
Signed-off-by: NAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Some of the board might use external Vbus power supply on musb
interface which would require to program ULPI_BUSCONTROL register.

Adding 'extvbus' flag which can be set from such boards which will
be checked at musb driver files before programming ULPI_BUSCONTROL.
Signed-off-by: NAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Save dynamic FIFO read only information for later uses during
musb_save/restore_context functions.
Signed-off-by: NAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

MUSB's programming guide dictates how we should handle its
irqs and in which order. Follow that.
Signed-off-by: NArnaud Mandy <ext-arnaud.2.mandy@nokia.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The version applied had a few comments which are now
done.

Thanks to Sergei for pointing out.
Signed-off-by: NBryan Wu <cooloney@kernel.org>
Signed-off-by: NCliff Cai <cliff.cai@analog.com>
Signed-off-by: NMike Frysinger <vapier@gentoo.org>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch fixes the Tx abort/teardown logic. We now wait for the teardown
completion interrupt and acknowledge the same by setting the tx_complete
register to 0.

This change is needed to ensure that abort processing works on DM365 platform.
Without this change after completion of abort processing the system is
overwhelmed with continuous stream of abort interrupts.

This change has been tested on all CPPI3.x platforms (DM644x, DM646x, DM35x,
DM36x).
Signed-off-by: NSwaminathan S <swami.iyer@ti.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@nokia.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>