In OS descriptors handling, if ctrl->bRequestType is
USB_RECIP_DEVICE and w_index != 0x4 or (w_value >> 8)
is true, it will not assign a valid value to req->length,
but use the default value(-EOPNOTSUPP), and queue an
OS desc request with the invalid req->length. It always
happens on the platforms which use os_desc (for example:
rk3366, rk3399), and cause kernel panic as follows
(use dwc3 driver):

Unable to handle kernel paging request at virtual address ffffffc0f7e00000
Internal error: Oops: 96000146 [#1] PREEMPT SMP
PC is at __dma_clean_range+0x18/0x30
LR is at __swiotlb_map_page+0x50/0x64
Call trace:
[<ffffffc0000930f8>] __dma_clean_range+0x18/0x30
[<ffffffc00062214c>] usb_gadget_map_request+0x134/0x1b0
[<ffffffc0005c289c>] __dwc3_ep0_do_control_data+0x110/0x14c
[<ffffffc0005c2d38>] __dwc3_gadget_ep0_queue+0x198/0x1b8
[<ffffffc0005c2e18>] dwc3_gadget_ep0_queue+0xc0/0xe8
[<ffffffc00061cfec>] composite_ep0_queue.constprop.14+0x34/0x98
[<ffffffc00061dfb0>] composite_setup+0xf60/0x100c
[<ffffffc0006204dc>] android_setup+0xd8/0x138
[<ffffffc0005c29a4>] dwc3_ep0_delegate_req+0x34/0x50
[<ffffffc0005c3534>] dwc3_ep0_interrupt+0x5dc/0xb58
[<ffffffc0005c0c3c>] dwc3_thread_interrupt+0x15c/0xa24

With this patch, the gadget driver will not queue
a request and return immediately if req->length is
invalid. And the usb controller driver can handle
the unsupport request correctly.
Signed-off-by: NWilliam Wu <william.wu@rock-chips.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

If a gadget driver loaded to a Superspeed-capable
peripheral controller, using a Superspeed cable,
doesn't provide Superspeed descriptors, we will get
a NULL pointer dereference.

In order to avoid that situation, we will try to
find any valid descriptors we can. If no set of
descriptors is passed in, then we'll let that gadget
oops anyhow.
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Set the reserved fields of the SuperSpeed Plus Device Capability
descriptor to 0. Otherwise there might be stale data there which will
cause USB CV to fail.

Fixes: f228a8de ("usb: gadget: composite: Return SSP Dev Cap descriptor")
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

Access multi-byte fields of the SSP Dev Cap descriptor using the correct
endianness.

Fixes: f228a8de ("usb: gadget: composite: Return SSP Dev Cap descriptor")
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>

If gadget with HNP polling support receives GetStatus request of otg
status selector, it feedback to host with host request flag to indicate
if it wants to take host role.
Acked-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NLi Jun <jun.li@nxp.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Update the debug message reporting the speeds that a configuration
supports for SuperSpeedPlus.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Configure the usb_ep using the SuperSpeedPlus descriptors if connected
in SuperSpeedPlus.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

Enable writing of SuperSpeedPlus descriptors for any SuperSpeedPlus
capable configuration when connected in SuperSpeedPlus.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

There are a couple places in the code that get the function descriptors
based on the speed. Move this lookup into a function call and add
support to handle the SuperSpeedPlus descriptors as well.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

If enumerated in SuperSpeedPlus, count the configurations that support
it.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

When a function is added to a configuration with usb_add_function(), the
configuration speed flags are updated. These flags indicate for which
speeds the configuration is valid for.

This patch adds a flag in the configuration for SuperSpeedPlus and
also updates this based on the existence of ssp_descriptors.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

If a gadget supports SuperSpeedPlus or higher speeds, return a
SuperSpeedPlus USB Device Capability descriptor.

Currently this implementation returns a fixed descriptor with typical
values set.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

The USB 3.1 specification replaces the USB 3.0 specification and all new
devices that are running at SuperSpeed or higher speeds must report a
bcdUSB of 0x0310.

Refer to USB 3.1 Specification, Revision 1.0, Section 9.6.
Signed-off-by: NJohn Youn <johnyoun@synopsys.com>
Signed-off-by: NFelipe Balbi <balbi@kernel.org>

When handling device GET_DESCRIPTOR, composite gadget driver fills
the bcdUSB field only if the gadget supports USB 3.0. Otherwise
the field is left unfilled.

For consistency, set bcdUSB to 0x0200 for gadgets that don't
support superspeed.

It's correct to use 0x0200 for any setting that doesn't use
superspeed, since USB 2.0 devices can restrict themselves to
full speed only. It is NOT correct to use 0x0210, since BOS
descriptors are handled only if gadget_is_superspeed() is
satisfied, otherwise it results in a stall.
Signed-off-by: NIgor Kotrasinski <i.kotrasinsk@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Fix comments in code to make them up to date.

composite: claiming endpoint is now done by setting ep->claimed flag,
not ep->driver_data.

epautoconf: usb_ep_autoconfig() and usb_ep_autoconfig_ss() return
claimed endpoint with ep->claimed flag already set.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Signed-off-by: NDiego Viola <diego.viola@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.com>

Copy usb_otg_descriptor from config's descriptor if host requests
USB_DT_OTG.
Signed-off-by: NMacpaul Lin <macpaul@gmail.com>
Signed-off-by: NLi Jun <jun.li@freescale.com>
Reviewed-by: NRoger Quadros <rogerq@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch introduces 'bind_deactivated' flag in struct usb_function.
Functions which don't want to be activated automatically after bind should
set this flag, and when they start to be ready to work they should call
usb_function_activate().

When USB function sets 'bind_deactivated' flag, initial deactivation
counter is incremented automatically, so there is no need to call
usb_function_deactivate() in function bind.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Using usb_gadget_disconnect to make gadget temporarily invisible to host
doesn't provide desired result, because gadget is connected immediately
after binding regardless to previous usb_gadget_disconnect() calls.

For this reason we use usb_gadget_deactivate() instead of
usb_gadget_disconnect() to make it working as expected.
Signed-off-by: NRobert Baldyga <r.baldyga@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

I18N should be spelled as i18n because it's not
an acronym
Signed-off-by: NDiego Viola <diego.viola@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

commit f563d230 ("usb: gadget: composite: add req_match method
to usb_function") accesses cdev->config even before set config
is invoked causing a NULL pointer dereferencing error while running
Lecroy Mass Storage Compliance test.

Fix it here by accessing cdev->config only if it is non NULL.

Fixes: commit f563d230 ("usb: gadget: composite: add req_match
method to usb_function").
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch fix some spelling typo found in gadget.xml.
It is because this file is generated from comments in sources,
I had to fix comments in the source, instead of xml file itself.
Signed-off-by: NMasanari Iida <standby24x7@gmail.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Non-standard requests can encode the actual interface number in a
non-standard way. For example composite_setup() assumes
that it is w_index && 0xFF, but the printer function encodes the interface
number in a context-dependet way (either w_index or w_index >> 8).
This can lead to such requests being directed to wrong functions.

This patch adds req_match() method to usb_function. Its purpose is to
verify that a given request can be handled by a given function.
If any function within a configuration provides the method and it returns
true, then it is assumed that the right function is found.

If a function uses req_match(), it should try as hard as possible to
determine if the request is meant for it.

If no functions in a configuration provide req_match or none of them
returns true, then fall back to the usual approach.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

If a non-standard request is processed and its parameters just happen
to match those of some standard request, the logic of composite_setup()
can be fooled, so don't even try any switch cases, just go to the
proper place where unknown requests are handled.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

USB vendor type is encoded in field bmRequestType. Make test USB_TYPE_VENDOR
with bRequestType instead of bRequest.
Signed-off-by: NMario Schuknecht <mario.schuknecht@dresearch-fe.de>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

USB gadgets composed with configfs lack suspend and resume
methods. This patch uses composite_suspend()/composite_resume()
the same way e.g. composite_setup() or composite_disconnect()
are used in a configfs-based gadget.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

In case we unload a gadget driver while any of
os_desc_req or req are still pending, we need
to make sure to dequeue them.

By using our setup_pending and os_desc_pending
flags we achieve that in a way that doesn't
cause any regressions because we won't dequeue
a request which was already completed.

The original idea came from Li Jun's commit
f2267089
(usb: gadget: composite: dequeue cdev->req
before free it in composite_dev_cleanup) which,
unfortunately, caused two regressions (kfree()
being called before usb_ep_dequeue() and calling
usb_ep_dequeue() when the request was already
completed). That commit also didn't take care
of os_desc_req which can fall into the same
situation so we must care for that one too.

Note that in order to make code slightly easier
to read, we introduce composite_ep_queue() which
hides details about how to fiddle with our pending
flags.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

by doing that we will be able to match our
requests against req and os_desc_req and also
clear our pending flags from complete callback.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

According to USB 2.0 ECN Errata for Link Power
Management (USB2-LPM-Errata-final.pdf), BESL
must be enabled if LPM is enabled.

This helps with USB30CV TD 9.21 LPM L1
Suspend Resume Test.
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This reverts commit f2267089.

That commit causes more problem than fixes. Firstly, kfree()
should be called after usb_ep_dequeue() and secondly, the way
things are, we will try to dequeue a request that has already
completed much more frequently than one which is pending.

Cc: Li Jun <b47624@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>
Cc: stable <stable@vger.kernel.org> # 3.17
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This reverts commit be0a8887.

The original commit f2267089
(usb: gadget: composite: dequeue cdev->req before free it in
composite_dev_cleanup) ended up being reverted because it caused
more issues then fixed. We will also revert this counter part
commit so we start clean to properly add that idea back.

Cc: Li Jun <b47624@freescale.com>
Signed-of-by: NFelipe Balbi <balbi@ti.com>

Add reset API at usb_gadget_driver, it calls disconnect handler currently,
but may do different things in future.
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

commit f2267089(usb: gadget: composite: dequeue cdev->req before free it in
composite_dev_cleanup) fixed a bug: free the usb request(i.e. cdev->req) but
does not dequeue it beforehand. This fix is not proper enough because it
dequeues the request after free its data buffer, considering the hardware can
access the buffer's memory anytime before the request's complettion rountine
runs, and usb_ep_dequeue always call the complettion rountine before it returns,
so the best way is to dequeue the request before free its buffer.
Suggested-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NLi Jun <b47624@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch try to dequeue the cdev->req to guarantee the request is not queued
before free it.
Signed-off-by: NLi Jun <b47624@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Delete unnecessary local variable whose value is always 0 and that hides
the fact that the result is always 0.

A simplified version of the semantic patch that fixes this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@r exists@
local idexpression ret;
expression e;
position p;
@@

-ret = 0;
... when != ret = e
return
- ret
+ 0
  ;
// </smpl>
Signed-off-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There is a custom (non-USB IF) extension to the USB standard:

http://msdn.microsoft.com/library/windows/hardware/gg463182

They grant permission to use the specification - there is
"Microsoft OS Descriptor Specification License Agreement"
under the link mentioned above, and its Section 2 "Grant
of License", letter (b) reads:

"Patent license. Microsoft hereby grants to You a nonexclusive,
royalty-free, nontransferable, worldwide license under Microsoft’s
patents embodied solely within the Specification and that are owned
or licensable by Microsoft to make, use, import, offer to sell,
sell and distribute directly or indirectly to Your Licensees Your
Implementation. You may sublicense this patent license to Your
Licensees under the same terms and conditions."

The said extension is maintained by Microsoft for Microsoft.

Yet it is fairly common for various devices to use it, and a
popular proprietary operating system expects devices to provide
"OS descriptors", so Linux-based USB gadgets whishing to be able
to talk to a variety of operating systems should be able to provide
the "OS descriptors".

This patch adds optional support for gadgets whishing to expose
the so called "OS Feature Descriptors", that is "Extended Compatibility ID"
and "Extended Properties".

Hosts which do request "OS descriptors" from gadgets do so during
the enumeration phase and before the configuration is set with
SET_CONFIGURATION. What is more, those hosts never ask for configurations
at indices other than 0. Therefore, gadgets whishing to provide
"OS descriptors" must designate one configuration to be used with
this kind of hosts - this is what os_desc_config is added for in
struct usb_composite_dev. There is an additional advantage to it:
if a gadget provides "OS descriptors" and designates one configuration
to be used with such non-USB-compliant hosts it can invoke
"usb_add_config" in any order because the designated configuration
will be reported to be at index 0 anyway.

This patch also adds handling vendor-specific requests addressed
at device or interface and related to handling "OS descriptors".
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

There is a custom (non-USB IF) extension to the USB standard:

http://msdn.microsoft.com/library/windows/hardware/gg463182

They grant permission to use the specification - there is
"Microsoft OS Descriptor Specification License Agreement"
under the link mentioned above, and its Section 2 "Grant
of License", letter (b) reads:

"Patent license. Microsoft hereby grants to You a nonexclusive,
royalty-free, nontransferable, worldwide license under Microsoft’s
patents embodied solely within the Specification and that are owned
or licensable by Microsoft to make, use, import, offer to sell,
sell and distribute directly or indirectly to Your Licensees Your
Implementation. You may sublicense this patent license to Your
Licensees under the same terms and conditions."

The said extension is maintained by Microsoft for Microsoft.

Yet it is fairly common for various devices to use it, and a
popular proprietary operating system expects devices to provide
"OS descriptors", so Linux-based USB gadgets whishing to be able
to talk to a variety of operating systems should be able to provide
the "OS descriptors".

This patch adds optional support for gadgets whishing to expose
the so called "OS String" under index 0xEE of language 0.
The contents of the string is generated based on the qw_sign
array and b_vendor_code.

Interested gadgets need to set the cdev->use_os_string flag,
fill cdev->qw_sign with appropriate values and fill cdev->b_vendor_code
with a value of their choice.

This patch does not however implement responding to any vendor-specific
USB requests.
Signed-off-by: NAndrzej Pietrasiewicz <andrzej.p@samsung.com>
Acked-by: NMichal Nazarewicz <mina86@mina86.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

Set gadget device state as configurated after set configuration
has finished.
Signed-off-by: NPeter Chen <peter.chen@freescale.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

This patch fixes the following Coccinelle warning:

drivers/usb/gadget/composite.c:1142:9-16: WARNING: \
	ERR_CAST can be used with uc
Signed-off-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

From 7e827a0d300e084f74c65122baa5e3193f9a7f18 Mon Sep 17 00:00:00 2001
From: "Du, Changbin" <changbinx.du@intel.com>
Date: Mon, 16 Dec 2013 20:32:13 +0800
Subject: [PATCH] usb/gadget: should use u16 type variable to store MaxPower

The MaxPower field is of u16 type. So using u8 type variable can break
data (high byte lost).
Signed-off-by: NDu, Changbin <changbinx.du@intel.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>