Merge tag 'usb-for-v3.12-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb into usb-next

Felipe writes:

usb: patches for v3.12 merge window (part 2)

Here's a set of important fixes for v3.12 merge
window which have been pending in the mailing list
for quite some time.

We have use-after-free fixes, signedness fixes,
more of HAS_DMA dependencies, fixes for NULL pointer
deferences, build fixes and some other fixes to
the musb driver caused by recent patches.

Patches are quite small and contain valuable fixes
which will give us a much better -rc1 release.

Please consider merging
Signed-of-by: Felipe Balbi <balbi@ti.com>

Convert the usbsorage sysfs attribute to use the _RW macro to make it
easier to determine the permissions for the file.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Dan Carpenter's automatic Smatch checker found an anomaly in the ux500
MUSB driver, whereby board data was checked before use in all but one
occasion. It is believed that it needs to be checked every time.

Smatch complaint:
  drivers/usb/musb/ux500_dma.c:335 ux500_dma_controller_start()
         error: we previously assumed 'data' could be null (see line 313)

Cc: Felipe Balbi <balbi@ti.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-usb@vger.kernel.org
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

The "goto out" statements were wrong.  We aren't holding any locks at
that point so we should return directly.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

"ret" needs to be signed for the error handling to work.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

ffs_data_put() can sometimes free "ffs" so I have moved the call down
a line below the dereference.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

The call to put_dev() releases "dev".  Hopefully, we don't need to set
the state to STATE_DEV_DISABLED anyway so I have removed those lines.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Merge tag 'for-usb-next-2013-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/sarah/xhci into usb-next

Sarah writes:

xhci: Bug fixes for 3.12.

Hi Greg,

Here's three low-priority bug fixes that should be queued for 3.12.
They disable runtime PM for hosts that need the XHCI_RESET_ON_RESUME
quirk, fix USB 2.0 Link PM on hosts that don't have BESL support, and
prevent a bunch of log spam.

Please pull into usb-next for 3.12.

Sarah Sharp

otg.h header file was included twice.
Signed-off-by: Sachin Kamat <sachin.kamat@linaro.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Commit 94ae9843 (usb: phy: rename all phy drivers to phy-$name-usb.c)
renamed drivers/usb/phy/otg_fsm.h to drivers/usb/phy/phy-fsm-usb.h
but changed drivers/usb/phy/phy-fsm-usb.c to include not existing
"phy-otg-fsm.h" instead of new "phy-fsm-usb.h". This breaks building:
  ...
  drivers/usb/phy/phy-fsm-usb.c:32:25: fatal error: phy-otg-fsm.h: No such file or directory
  compilation terminated.
  make[3]: *** [drivers/usb/phy/phy-fsm-usb.o] Error 1

This commit also missed to modify drivers/usb/phy/phy-fsl-usb.h
to include new "phy-fsm-usb.h" instead of "otg_fsm.h" resulting
in another build breakage:
  ...
  In file included from drivers/usb/phy/phy-fsl-usb.c:46:0:
  drivers/usb/phy/phy-fsl-usb.h:18:21: fatal error: otg_fsm.h: No such file or directory
  compilation terminated.
  make[3]: *** [drivers/usb/phy/phy-fsl-usb.o] Error 1

Fix both issues.
Signed-off-by: Anatolij Gustschin <agust@denx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Felipe Balbi <balbi@ti.com>

Convert all USB gadget sysfs attributes to use the _RO or _RW variants,
to make them easier to audit and ensure that the permissions are
correct.

Note, two are left using the DEVICE_ATTR() macro, as there is no
DEVICE_ATTR_WO() in Linus's tree, that will happen after 3.12-rc1 is
out, a follow-on patch will be sent then.
Reviewed-by: Felipe Balbi <balbi@ti.com>
Acked-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

--
 drivers/usb/gadget/composite.c      |    8 +++-----
 drivers/usb/gadget/dummy_hcd.c      |    8 ++++----
 drivers/usb/gadget/f_mass_storage.c |   14 ++++++--------
 drivers/usb/gadget/net2272.c        |    4 ++--
 drivers/usb/gadget/net2280.c        |   18 +++++++++---------
 drivers/usb/gadget/storage_common.c |   25 ++++++++++++-------------
 drivers/usb/gadget/udc-core.c       |   14 +++++++-------
 7 files changed, 43 insertions(+), 48 deletions(-)

With enabled pm_runtime in the kernel the device won't work because it
is not "on" during the probe function. This patch enables the device via
pm_runtime on probe so it remains activated.
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

So I assumed that Beagle bone has only one USB port in host mode because
the micro USB connector had an USB-UART there. I was wrong a little. The
second port runs on host mode, but the micro USB plug is connected to an
internal HUB with two ports: one to the USB-UART and one to musb
instance one.
For that reason, this patch enables both ports: the primary in device
mode only and the second in host mode only.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This is what I observe:
On the first connect, the musb starts with DEVCTL.Session set. On
disconnect, musb_core calls try_idle. That functions removes the Session
bit signalizing that the session is over (something that only in OTG is
required). A new device, that is plugged, is no longer recognized.
I've setup a timer and checked the DEVCTL register and I haven't seen a
change in VBus and I saw the B-Device bit set. After setting the IDDIG
into A mode and forcing the device to behave like a A device, I didn't
see a change.
Neither VBUS goes to 0b11 nor does a session start request comes.
In the TI-v3.2 kernel they skip to call musb_platform_try_idle() in the
OTG_STATE_A_WAIT_BCON state while not in OTG mode.
Since the second port hast a standard A plug the patch changes the port
to run in host mode only and skips the timer which would remove
DEVCTL.Session so we can reconnect to another device later.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Quite early on init there is an vbus / drvvbus interrupt comming and the
dsps code sets is_active to one. As a result we see a lot of

|musb_bus_suspend 2459: trying to suspend as a_wait_bcon while active

until a device is plugged in with pm_runtime enabled in the kernel.
After checking davinci, am35, da8xx I noticed that dsps is actually the
only one doing this.
So remove it and we won't flooded with mesages and the idle port can be
suspended.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

This relfects the code and dts requires changes due to recent .dts
binding updates:
- use mg prefix for the Metor Graphics specific attributes
- use power in mA not in mA/2 as specifed in the USB2.0 specification
- remove the child node for USB. This is driver specific on won't be
  reflected in the device tree
- use the "mentor" prefix instead of "mg".
- use "dr_mode" istead of "mg,port-mode" for the port mode. The former
  is used by a few other drivers.

Cc: Rob Herring <rob.herring@calxeda.com>
Cc: Pawel Moll <pawel.moll@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Stephen Warren <swarren@wwwdotorg.org>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: devicetree@vger.kernel.org
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

The support for both am335x-USB instances required changes to the device
tree bindings. This patch reflects these changes in the bindings
document.

v3…v4:
- remove the child node for USB. This is driver specific on won't be
  reflected in the device tree
- use the "mentor" prefix instead of "mg".
- use "dr_mode" istead of "mg,port-mode" for the port mode. The former
  is used by a few other drivers.

v2…v3:
- use proper usb-phy nodes in evm, bone and evmsk device tree.

v1…v2:
- use mg prefix for the Metor Graphics specific attributes
- use power in mA not in mA/2 as specifed in the USB2.0 specification
- use usbX-phy instead of usbX_phy
- use dma-controller instead of dma

Cc: Rob Herring <rob.herring@calxeda.com>
Cc: Pawel Moll <pawel.moll@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Stephen Warren <swarren@wwwdotorg.org>
Cc: Ian Campbell <ian.campbell@citrix.com>
Cc: devicetree@vger.kernel.org
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

I forgot to separete the different names in the reg-names property. This
didn't cause anything to fail because the driver does not use the names
and simply relies on the order of the memory offsets in reg.
This patch fixes this in case it is used later.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

musb_shutdown() removes always USB host and device.
musb_init_controller() adds host and device depending on port_mode. If
port mode is set to HOST then the removal of UDC leads only to:
|(NULL device *): gadget not registered.
and nothing else happens. If port mode is set to DEVICE and we remove
the host then we oops in usb_remove_hcd().
This patch ensures that we only remove host in OTG/host mode and device
only in OTG/device mode to avoid any trouble.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

devm_ioremap_resource returns an ERR_PTR value, not NULL, on failure.
Furthermore, the value returned by devm_ioremap_resource should be tested.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
expression e,e1;
statement S;
@@

*e = devm_ioremap_resource(...);
if (!e1) S

// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: Felipe Balbi <balbi@ti.com>

If NO_DMA=y:

drivers/built-in.o: In function `net2272_done':
drivers/usb/gadget/net2272.c:386: undefined reference to `usb_gadget_unmap_request'
drivers/built-in.o: In function `net2272_queue':
drivers/usb/gadget/net2272.c:848: undefined reference to `usb_gadget_map_request'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

If NO_DMA=y:

drivers/built-in.o: In function `sudmac_free_channel':
drivers/usb/gadget/r8a66597-udc.c:676: undefined reference to `usb_gadget_unmap_request'
drivers/built-in.o: In function `sudmac_alloc_channel':
drivers/usb/gadget/r8a66597-udc.c:666: undefined reference to `usb_gadget_map_request'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

If NO_DMA=y:

drivers/built-in.o: In function `fusb300_set_idma':
drivers/usb/gadget/fusb300_udc.c:946: undefined reference to `usb_gadget_map_request'
drivers/usb/gadget/fusb300_udc.c:958: undefined reference to `usb_gadget_unmap_request'
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Since commit 511f3c53 (usb: gadget: udc-core: fix a regression during
gadget driver unbinding) usb_gadget_remove_driver will pass NULL for
the driver argument.
Signed-off-by: Maarten ter Huurne <maarten@treewalker.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Add the missing unlock before return from function cppi41_dma_callback()
in the error handling case.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Before Randy figures out that this does not compile with CONFIG_BUG=n
here is a fix for it.
Acked-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Randy reported this
|drivers/usb/phy/phy-am335x-control.c:45:3: error: implicit declaration
|of function '__WARN' [-Werror=implicit-function-declaration]

and left it as an excercice to figure out that this happens only with
CONFIG_BUG=n. As a fix I replace it with WARN_ON(). And there is a space
before return so fix this, too.
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

Since dma_map_single() may fail it is good to actually check the return
code to see if it succeeded.
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

If usb_add_function() fails then the currently processed function
is already not in the list in struct config_usb_cfg, and neither is it
in the list in struct usb_configuration. At the err_purge_funcs label the
purge_config_funcs() is called, which iterates over all configurations,
and in each configuration it iterates over all _successfully_ added
functions, and moves them back from the list in struct usb_configuration
to the list in struct config_usb_cfg. BUT the function which has just
failed adding and caused the unwind process is not taken care of and
is effectively lost.

This patch modifies the configfs_composite_bind() function so that if
the usb_add_function() fails, then the currently processed function
is returned to the list in struct config_usb_cfg.

It would be tempting to delay the list_del() in question after
usb_add_function() invocation, but a struct list_head (&f->list) cannot be
stored in more than one list at the same time, so the list_del() must
be called before usb_add_function(). Hence, the solution is to list_add()
after usb_add_function() in case of error.
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

When debug is not enabled and dev_dbg() will expand to nothing,
log might be flooded with "callbacks suppressed". If it was not
done on purpose, better to use dev_dbg_ratelimited() instead.
Signed-off-by: Dmitry Kasatkin <d.kasatkin@samsung.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>

Wrong capability bit was checked for best effort service latency.
bit 20 indicate port is BESL LPM capable (BLC),
bit 19 is hardware LPM capable (HLC)

This patch should be backported to kernels as old as 3.11, that
contain the commit a558ccdc "usb: xhci:
add USB2 Link power management BESL support"
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: Steve Cotton <steve@s.cotton.clara.co.uk>
Cc: stable@vger.kernel.org

If a USB controller with XHCI_RESET_ON_RESUME goes to runtime suspend,
a reset will be performed upon runtime resume. Any previously suspended
devices attached to the controller will be re-enumerated at this time.
This will cause problems, for example, if an open system call on the
device triggered the resume (the open call will fail).

Note that this change is only relevant when persist_enabled is not set
for USB devices.

This patch should be backported to kernels as old as 3.0, that
contain the commit c877b3b2 "xhci: Add
reset on resume quirk for asrock p67 host".
Signed-off-by: Shawn Nematbakhsh <shawnn@chromium.org>
Signed-off-by: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org

Clean up the DEVICE_ATTR usage in the USB serial drivers, making them
more obvious as to the permissions that the sysfs files should be.

Note: ftdi_sio.c still has a DEVICE_ATTR() used, that will have to wait
until after 3.12-rc1 comes out when DEVICE_ATTR_WO() shows up in Linus's
tree.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

In auditing the usbtmc sysfs files, a bunch of them were being created
as "read only", yet they have logic to handle writing to.  So fix them
up by setting the permissions properly.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Instead of having to audit all sysfs attributes, to ensure we get them
right, use the default macros the driver core provides us (read-only,
read-write) to make the code simpler, and to prevent any mistakes from
ever happening.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Use DRIVER_ATTR_RW() to make it easier to audit sysfs file permissions.
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

After successful initialization hub->descriptor->bNbrPorts and
hub->hdev->maxchild are equal, but using hub->hdev->maxchild is
preferred because that value is explicitly used for initialization
of hub->ports[].
Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Ignoring usb_hub_create_port_device() errors cause later NULL pointer
deference when uninitialized hub->ports[i] entries are dereferenced
after port memory allocation error.
Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

If the hub_configure() fails after setting the hdev->maxchild
the hub->ports might be NULL or point to uninitialized kzallocated
memory causing NULL pointer dereference in hub_quiesce() during cleanup.

Now after such error the hdev->maxchild is set to 0 to avoid cleanup
of uninitialized ports.
Signed-off-by: Krzysztof Mazur <krzysiek@podlesie.net>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Commit 7e8d5cd9 ("USB: Add EHCI support for MX27 and MX31 based
boards") introduced code that could potentially lead to a NULL pointer
dereference on driver removal.

Fix this by checking for the value of pdata before dereferencing it.
Signed-off-by: Daniel Mack <zonque@gmail.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable <stable@vger.kernel.org> # 2.6.33+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>