Merge tag 'for-usb-next-2014-01-08' of git://git.kernel.org/pub/scm/l…

…inux/kernel/git/sarah/xhci into usb-next

Sarah writes:

xhci: Urgent bug fixes for usb-next and 3.14.

Hi Greg,

Please queue these two patches to usb-next for 3.14.

An xHCI driver fix for USB ethernet devices that went into 3.13 and 3.12
stable is causing usb-storage to go into an infinite loop, and these two
patches fix the issue.  I would like these to get into 3.14-rc1 so we
can avoid any potential data corruption for users.

Sarah Sharp

drivers/usb/host/xhci-ring.c

@@ -3000,7 +3000,7 @@ static int prepare_ring(struct xhci_hcd *xhci, struct xhci_ring *ep_ring,
 			if (num_trbs >= TRBS_PER_SEGMENT) {
 				xhci_err(xhci, "Too many fragments %d, max %d\n",
 						num_trbs, TRBS_PER_SEGMENT - 1);
-				return -ENOMEM;
+				return -EINVAL;
 			}
 
 			nop_cmd = cpu_to_le32(TRB_TYPE(TRB_TR_NOOP) |

drivers/usb/host/xhci.c

@@ -4730,8 +4730,8 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks)
 	struct device		*dev = hcd->self.controller;
 	int			retval;
 
-	/* Accept arbitrarily long scatter-gather lists */
-	hcd->self.sg_tablesize = ~0;
+	/* Limit the block layer scatter-gather lists to half a segment. */
+	hcd->self.sg_tablesize = TRBS_PER_SEGMENT / 2;
 
 	/* support to build packet from discontinuous buffers */
 	hcd->self.no_sg_constraint = 1;

drivers/usb/host/xhci.h

@@ -1279,7 +1279,7 @@ union xhci_trb {
  * since the command ring is 64-byte aligned.
  * It must also be greater than 16.
  */
-#define TRBS_PER_SEGMENT	64
+#define TRBS_PER_SEGMENT	256
 /* Allow two commands + a link TRB, along with any reserved command TRBs */
 #define MAX_RSVD_CMD_TRBS	(TRBS_PER_SEGMENT - 3)
 #define TRB_SEGMENT_SIZE	(TRBS_PER_SEGMENT*16)