USB: core: Fix misc OTG related bugs

This patch fixes the following OTG related bugs:

1. The current code does not wait for the ongoing HNP polling work to
finish upon the device disconnection which results in a crash when
accessing the udev structure in hnp polling routine.

2. bcdOTG field is added to OTG descriptor in 2.0 revision. Check OTG
descriptor size before validating bcdOTG field.  A legacy device sends
2 bytes lesser than the size of OTG descriptor specified in 2.0 spec.

3. The host is required to execute a GetStatus() with a frequency of
THOST_REQ_POLL in order to determine the state of the Host request flag.
The limits of THOST_REQ_POLL are 1 - 2 sec. Use the average value 1.5 sec
for HNP polling to pass compliance tests.

Change-Id: Ie6a6a8e915d10c1347946f979c919d04d64823b4
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
diff --git a/include/linux/usb/ch9.h b/include/linux/usb/ch9.h
index 736203b..e4ee15c 100644
--- a/include/linux/usb/ch9.h
+++ b/include/linux/usb/ch9.h
@@ -147,7 +147,7 @@
 #define USB_ENDPOINT_HALT		0	/* IN/OUT will STALL */
 
 #define OTG_STATUS_SELECTOR	0xF000
-#define THOST_REQ_POLL		2000    /* msec */
+#define THOST_REQ_POLL			1500    /* msec (1000 - 2000) */
 #define HOST_REQUEST_FLAG	0
 
 /* Bit array elements as returned by the USB_REQ_GET_STATUS request. */
@@ -617,8 +617,10 @@
 	__u8  bDescriptorType;
 
 	__u8  bmAttributes;	/* support for HNP, SRP, etc */
+	__le16 bcdOTG;
 } __attribute__ ((packed));
 
+#define USB_DT_OTG_SIZE		5
 /* from usb_otg_descriptor.bmAttributes */
 #define USB_OTG_SRP		(1 << 0)
 #define USB_OTG_HNP		(1 << 1)	/* swap host/device roles */