--- /dev/null
+From 33d2832ab0149a26418d360af3c444969a63fb28 Mon Sep 17 00:00:00 2001
+From: Orjan Friberg <of@flatfrog.com>
+Date: Wed, 7 Mar 2012 17:16:14 +0100
+Subject: USB: gadget: Make g_hid device class conform to spec.
+
+From: Orjan Friberg <of@flatfrog.com>
+
+commit 33d2832ab0149a26418d360af3c444969a63fb28 upstream.
+
+HID devices should specify this in their interface descriptors, not in the
+device descriptor. This fixes a "missing hardware id" bug under Windows 7 with
+a VIA VL800 (3.0) controller.
+
+Signed-off-by: Orjan Friberg <of@flatfrog.com>
+Cc: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/hid.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/usb/gadget/hid.c
++++ b/drivers/usb/gadget/hid.c
+@@ -69,9 +69,9 @@ static struct usb_device_descriptor devi
+ /* .bDeviceClass = USB_CLASS_COMM, */
+ /* .bDeviceSubClass = 0, */
+ /* .bDeviceProtocol = 0, */
+- .bDeviceClass = 0xEF,
+- .bDeviceSubClass = 2,
+- .bDeviceProtocol = 1,
++ .bDeviceClass = USB_CLASS_PER_INTERFACE,
++ .bDeviceSubClass = 0,
++ .bDeviceProtocol = 0,
+ /* .bMaxPacketSize0 = f(hardware) */
+
+ /* Vendor and product id can be overridden by module parameters. */
--- /dev/null
+From 85b4b3c8c189e0159101f7628a71411af072ff69 Mon Sep 17 00:00:00 2001
+From: Thomas Faber <thfabba@gmx.de>
+Date: Fri, 2 Mar 2012 09:41:50 +0100
+Subject: usb: gadgetfs: return number of bytes on ep0 read request
+
+From: Thomas Faber <thfabba@gmx.de>
+
+commit 85b4b3c8c189e0159101f7628a71411af072ff69 upstream.
+
+A read from GadgetFS endpoint 0 during the data stage of a control
+request would always return 0 on success (as returned by
+wait_event_interruptible) despite having written data into the user
+buffer.
+This patch makes it correctly set the return value to the number of
+bytes read.
+
+Signed-off-by: Thomas Faber <thfabba@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/gadget/inode.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/gadget/inode.c
++++ b/drivers/usb/gadget/inode.c
+@@ -1050,6 +1050,8 @@ ep0_read (struct file *fd, char __user *
+ // FIXME don't call this with the spinlock held ...
+ if (copy_to_user (buf, dev->req->buf, len))
+ retval = -EFAULT;
++ else
++ retval = len;
+ clean_req (dev->gadget->ep0, dev->req);
+ /* NOTE userspace can't yet choose to stall */
+ }
--- /dev/null
+From 39287076e46d2c19aaceaa6f0a44168ae4d257ec Mon Sep 17 00:00:00 2001
+From: Supriya Karanth <supriya.karanth@stericsson.com>
+Date: Fri, 17 Feb 2012 14:54:52 +0530
+Subject: usb: musb: Reselect index reg in interrupt context
+
+From: Supriya Karanth <supriya.karanth@stericsson.com>
+
+commit 39287076e46d2c19aaceaa6f0a44168ae4d257ec upstream.
+
+musb INDEX register is getting modified/corrupted during temporary
+un-locking in a SMP system. Set this register with proper value
+after re-acquiring the lock
+
+Scenario:
+---------
+CPU1 is handling a data transfer completion interrupt received for
+the CLASS1 EP
+CPU2 is handling a CLASS2 thread which is queuing data to musb for
+transfer
+
+Below is the error sequence:
+
+ CPU1 | CPU2
+--------------------------------------------------------------------
+Data transfer completion inter- |
+rupt recieved. |
+ |
+musb INDEX reg set to CLASS1 EP |
+ |
+musb LOCK is acquired. |
+ |
+ | CLASS2 thread queues data.
+ |
+ | CLASS2 thread tries to acquire musb
+ | LOCK but lock is already taken by
+ | CLASS1, so CLASS2 thread is
+ | spinning.
+ |
+From Interrupt Context musb |
+giveback function is called |
+ |
+The giveback function releases | CLASS2 thread now acquires LOCK
+LOCK |
+ |
+ClASS1 Request's completion cal-| ClASS2 schedules the data transfer and
+lback is called | sets the MUSB INDEX to Class2 EP number
+ |
+Interrupt handler for CLASS1 EP |
+tries to acquire LOCK and is |
+spinning |
+ |
+Interrupt for Class1 EP acquires| Class2 completes the scheduling etc and
+the MUSB LOCK | releases the musb LOCK
+ |
+Interrupt for Class1 EP schedul-|
+es the next data transfer |
+but musb INDEX register is still|
+set to CLASS2 EP |
+
+Since the MUSB INDEX register is set to a different endpoint, we
+read and modify the wrong registers. Hence data transfer will not
+happen properly. This results in unpredictable behavior
+
+So, the MUSB INDEX register is set to proper value again when
+interrupt re-acquires the lock
+
+Signed-off-by: Supriya Karanth <supriya.karanth@stericsson.com>
+Signed-off-by: Praveena Nadahally <praveen.nadahally@stericsson.com>
+Reviewed-by: srinidhi kasagar <srinidhi.kasagar@stericsson.com>
+Signed-off-by: Felipe Balbi <balbi@ti.com>
+
+---
+ drivers/usb/musb/musb_gadget.c | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+--- a/drivers/usb/musb/musb_gadget.c
++++ b/drivers/usb/musb/musb_gadget.c
+@@ -576,6 +576,15 @@ void musb_g_tx(struct musb *musb, u8 epn
+
+ if (request->actual == request->length) {
+ musb_g_giveback(musb_ep, request, 0);
++ /*
++ * In the giveback function the MUSB lock is
++ * released and acquired after sometime. During
++ * this time period the INDEX register could get
++ * changed by the gadget_queue function especially
++ * on SMP systems. Reselect the INDEX to be sure
++ * we are reading/modifying the right registers
++ */
++ musb_ep_select(mbase, epnum);
+ req = musb_ep->desc ? next_request(musb_ep) : NULL;
+ if (!req) {
+ dev_dbg(musb->controller, "%s idle now\n",
+@@ -968,6 +977,15 @@ void musb_g_rx(struct musb *musb, u8 epn
+ }
+ #endif
+ musb_g_giveback(musb_ep, request, 0);
++ /*
++ * In the giveback function the MUSB lock is
++ * released and acquired after sometime. During
++ * this time period the INDEX register could get
++ * changed by the gadget_queue function especially
++ * on SMP systems. Reselect the INDEX to be sure
++ * we are reading/modifying the right registers
++ */
++ musb_ep_select(mbase, epnum);
+
+ req = next_request(musb_ep);
+ if (!req)
projects / thirdparty / kernel / stable-queue.git / commitdiff
