Add VID and PID for Telit Gobi QDL device
Signed-off-by: NDaniele Palmas <dnlplm@gmail.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1652) fixes a long-standing bug in ehci-hcd.  The driver
relies on status polls to know when to stop port-resume signalling.
It uses the root-hub status timer to schedule these status polls.  But
when the driver for the root hub is resumed, the timer is rescheduled
to go off immediately -- before the port is ready.  When this happens
the timer does not get re-enabled, which prevents the port resume from
finishing until some other event occurs.

The symptom is that when a new device is plugged in, it doesn't get
recognized or enumerated until lsusb is run or something else happens.

The solution is to re-enable the root-hub status timer after every
status poll while a port resume is in progress.

This bug hasn't surfaced before now because we never used to try to
suspend the root hub in the middle of a port resume (except by
coincidence).
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: NNorbert Preining <preining@logic.at>
Tested-by: NMing Lei <ming.lei@canonical.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1651) adds calls to the new
usb_hcd_{start,end}_port_resume() functions to uhci-hcd.  Now UHCI
root hubs won't be runtime suspended while they are sending a resume
signal to one of their ports.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1650) adds calls to the new
usb_hcd_{start,end}_port_resume() functions to ehci-hcd.  Now EHCI
root hubs won't be runtime suspended while they are sending a resume
signal to one of their ports.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NMing Lei <ming.lei@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1649) adds a mechanism for host controller drivers to
inform usbcore when they have begun or ended resume signalling on a
particular root-hub port.  The core will then make sure that the root
hub does not get runtime-suspended while the port resume is going on.

Since commit 596d789a (USB: set hub's
default autosuspend delay as 0), the system tries to suspend hubs
whenever they aren't in use.  While a root-hub port is being resumed,
the root hub does not appear to be in use.  Attempted runtime suspends
fail because of the ongoing port resume, but the PM core just keeps on
trying over and over again.  We want to prevent this wasteful effort.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NMing Lei <ming.lei@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1648) fixes a regression affecting nVidia EHCI
controllers.  Evidently they don't like to have more than one async QH
unlinked at a time.  I can't imagine how they manage to mess it up,
but at least one of them does.

The patch changes the async unlink logic in two ways:

	Each time an IAA cycle is started, only the first QH on the
	async unlink list is handled (rather than all of them).

	Async QHs do not all get unlinked as soon as they have been
	empty for long enough.  Instead, only the last one (i.e., the
	one that has been on the schedule the longest) is unlinked,
	and then only if no other unlinks are in progress at the time.

This means that when multiple QHs are empty, they won't be unlinked as
quickly as before.  That's okay; it won't affect correct operation of
the driver or add an excessive load.  Multiple unlinks tend to be
relatively rare in any case.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: NPiergiorgio Sartor <piergiorgio.sartor@nexgo.de>
Cc: stable <stable@vger.kernel.org> # 3.6
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1647) attempts to work around a problem that seems to
affect some nVidia EHCI controllers.  They sometimes take a very long
time to turn off their async or periodic schedules.  I don't know if
this is a result of other problems, but in any case it seems wise not
to depend on schedule enables or disables taking effect in any
specific length of time.

The patch removes the existing 20-ms timeout for enabling and
disabling the schedules.  The driver will now continue to poll the
schedule state at 1-ms intervals until the controller finally decides
to obey the most recent command issued by the driver.  Just in case
this hides a problem, a debugging message will be logged if the
controller takes longer than 20 polls.

I don't know if this will actually fix anything, but it can't hurt.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NPiergiorgio Sartor <piergiorgio.sartor@nexgo.de>
CC: <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Usb3.0 device defines function remote wakeup which is only for interface
recipient rather than device recipient. This is different with usb2.0 device's
remote wakeup feature which is defined for device recipient. According usb3.0
spec 9.4.5, the function remote wakeup can be modified by the SetFeature()
requests using the FUNCTION_SUSPEND feature selector. This patch is to use
correct way to disable usb3.0 device's function remote wakeup after suspend
error and resuming.

This should be backported to kernels as old as 3.4, that contain the
commit 623bef9e "USB/xhci: Enable remote
wakeup for USB3 devices."
Signed-off-by: NLan Tianyu <tianyu.lan@intel.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org

When the xHCI driver is not available, actively switch the ports to EHCI
mode since some BIOSes leave them in xHCI mode where they would
otherwise appear dead.  This was discovered on a  Dell Optiplex 7010,
but it's possible other systems could be affected.

This should be backported to kernels as old as 3.0, that contain the
commit 69e848c2 "Intel xhci: Support
EHCI/xHCI port switching."
Signed-off-by: NDavid Moore <david.moore@gmail.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org

This patch (as1640) fixes a memory leak in xhci-hcd.  The urb_priv
data structure isn't always deallocated in the handle_tx_event()
routine for non-control transfers.  The patch adds a kfree() call so
that all paths end up freeing the memory properly.

This patch should be backported to kernels as old as 2.6.36, that
contain the commit 8e51adcc "USB: xHCI:
Introduce urb_priv structure"
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-and-tested-by: NMartin Mokrejs <mmokrejs@fold.natur.cuni.cz>
CC: <stable@vger.kernel.org>

Fix incorrect bit test that originally showed up in
4ee823b8 "USB/xHCI: Support
device-initiated USB 3.0 resume."

Use '&' instead of '&&'.

This should be backported to kernels as old as 3.4.
Signed-off-by: NNickolai Zeldovich <nickolai@csail.mit.edu>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org

To calculate the TD size for a particular TRB in an isoc TD, we need
know the endpoint's max packet size.  Isochronous endpoints also encode
the number of additional service opportunities in their wMaxPacketSize
field.  The TD size calculation did not mask off those bits before using
the field.  This resulted in incorrect TD size information for
isochronous TRBs when an URB frame buffer crossed a 64KB boundary.

For example:
 - an isoc endpoint has 2 additional service opportunites and
   a max packet size of 1020 bytes
 - a frame transfer buffer contains 3060 bytes
 - one frame buffer crosses a 64KB boundary, and must be split into
   one 1276 byte TRB, and one 1784 byte TRB.

The TD size is is the number of packets that remain to be transferred
for a TD after processing all the max packet sized packets in the
current TRB and all previous TRBs.

For this TD, the number of packets to be transferred is (3060 / 1020),
or 3.  The first TRB contains 1276 bytes, which means it contains one
full packet, and a 256 byte remainder.  After processing all the max
packet-sized packets in the first TRB, the host will have 2 packets left
to transfer.

The old code would calculate the TD size for the first TRB as:

total packet count = DIV_ROUND_UP (TD length / endpoint wMaxPacketSize)
total packet count - (first TRB length / endpoint wMaxPacketSize)

The math should have been:

total packet count = DIV_ROUND_UP (3060 / 1020) = 3
3 - (1276 / 1020) = 2

Since the old code didn't mask off the additional service interval bits
from the wMaxPacketSize field, the math ended up as

total packet count = DIV_ROUND_UP (3060 / 5116) = 1
1 - (1276 / 5116) = 1

Fix this by masking off the number of additional service opportunities
in the wMaxPacketSize field.

This patch should be backported to stable kernels as old as 3.0, that
contain the commit 4da6e6f2 "xhci 1.0:
Update TD size field format."  It may not apply well to kernels older
than 3.2 because of commit 29cc8897
"USB: use usb_endpoint_maxp() instead of le16_to_cpu()".
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org

An isochronous TD is comprised of one isochronous TRB chained to zero or
more normal TRBs.  Only the isoc TRB has the TBC and TLBPC fields.  The
normal TRBs must set those fields to zeroes.  The code was setting the
TBC and TLBPC fields for both isoc and normal TRBs.  Fix this.

This should be backported to stable kernels as old as 3.0, that contain
the commit b61d378f " xhci 1.0: Set
transfer burst last packet count field."
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: stable@vger.kernel.org

The vexpress-sysreg driver does not have to be initialized
early, when the platform doesn't require this. Unfortunately
in such case it wasn't initialized correctly - master site
lookup and config bridge registration were missing. Fixed now.
Signed-off-by: NPawel Moll <pawel.moll@arm.com>

This patch (as1643b) fixes a build error in ehci-hcd when compiling for
ARM with allmodconfig:

drivers/usb/host/ehci-hcd.c:1285:0: warning: "PLATFORM_DRIVER" redefined [enabled by default]
drivers/usb/host/ehci-hcd.c:1255:0: note: this is the location of the previous definition
drivers/usb/host/ehci-mxc.c:280:31: warning: 'ehci_mxc_driver' defined but not used [-Wunused-variable]
drivers/usb/host/ehci-hcd.c:1285:0: warning: "PLATFORM_DRIVER" redefined [enabled by default]
drivers/usb/host/ehci-hcd.c:1255:0: note: this is the location of the previous definition

The fix is to convert ehci-mxc over to the new "ehci-hcd is a library"
scheme so that it can coexist peacefully with the ehci-platform
driver.  As part of the conversion the ehci_mxc_priv data structure,
which was allocated dynamically, is now placed where it belongs: in
the private area at the end of struct ehci_hcd.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NShawn Guo <shawn.guo@linaro.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This reverts commit eccf2979.

The reason is that it broke TI WiLink shared transport on Panda.
Also, callback functions should not be added to board files anymore,
so revert to implementing the power functions in the driver itself.

Additionally, changed a variable name ('status' to 'err') so that this
revert compiles properly.

Cc: stable <stable@vger.kernel.org> [3.7]
Acked-by: NTony Lindgren <tony@atomide.com>
Signed-off-by: NLuciano Coelho <coelho@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There are a number of bugs in the error paths of this driver.  Make
use of devm_ functions to simplify the cleanup on error.

Based on a patch by Russell King.
Signed-off-by: NAndrew Lunn <andrew@lunn.ch>
Signed-off-by: NJason Cooper <jason@lakedaemon.net>

the variable cpuclk and clk_name should be properly freed when error happens.
Signed-off-by: NCong Ding <dinggnu@gmail.com>
Acked-by: NJason Cooper <jason@lakedaemon.net>
Acked-by: NGregory CLEMENT <gregory.clement@free-electrons.com>
Acked-by: NMike Turquette <mturquette@linaro.org>
Signed-off-by: NJason Cooper <jason@lakedaemon.net>

The acpi core will call request_module("acpi-cpufreq") on subsystem init,
but this will fail if the module isn't available at that stage of boot.
Add some module aliases to ensure that udev can load the module on Intel
and AMD systems with the appropriate feature bits - I /think/ that this
will also work on VIA systems, but haven't verified that.

References: http://lkml.kernel.org/r/1448223.sdUJnNSRz4@vostro.rjw.lanSigned-off-by: NMatthew Garrett <matthew.garrett@nebula.com>
Tested-by: NLeonid Isaev <lisaev@umail.iu.edu>
Acked-by: NBorislav Petkov <bp@suse.de>
Cc: 3.7+ <stable@vger.kernel.org>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

This patch (as1642) adds an ehci->priv field for private use by EHCI
platform drivers.  The space was provided some time ago, but it didn't
have a name.

Until now none of the platform drivers has used this private space,
but that's about to change in the next patch of this series.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1641) fixes a minor bug in ehci-hcd left over from when
the Chipidea driver was converted to the "ehci-hcd is a library"
scheme.  The test for whether the Chipidea platform driver is active
should be IS_ENABLED(), not defined().
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Without this, platform drivers e.g. ehci-omap.c will see a
different version of struct ehci_hcd than ehci-hcd.c and
break reference to 'debug_dir' and 'priv' members when
CONFIG_USB_DEBUG is enabled.
Signed-off-by: NRoger Quadros <rogerq@ti.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1644) fixes a race that occurs during startup in
uhci-hcd.  If the IRQ line is shared with other devices, it's possible
for the handler routine to be called before the data structures are
fully initialized.

The problem is fixed by adding a check to the IRQ handler routine.  If
the initialization hasn't finished yet, the routine will return
immediately.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Reported-by: NDon Zickus <dzickus@redhat.com>
Tested-by: N"Huang, Adrian (ISS Linux TW)" <adrian.huang@hp.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The driver can also be built as a module so add MODULE_LICENSE for it. In
addition add MODULE_DESCRIPTION as well.
Signed-off-by: NMika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: NWolfram Sang <w.sang@pengutronix.de>

Commit 0bdfe0cb (i2c: omap: sanitize
exit path) changed the interrupt handler to exit early and complete
the transfer after the draining IRQ is handled. As a result, the ARDY
may not be cleared properly, and it may cause all future I2C transfers
to timeout with "timeout waiting for bus ready". This is reproducible
at least with N900 when twl4030_gpio makes a long write (> FIFO size)
during the probe (http://marc.info/?l=linux-omap&m=135818882610432&w=2).

The fix is to continue until we get ARDY interrupt that completes the
transfer. Tested with 3.8-rc4 + N900: 20 boots in a row without errors;
without the patch the problem triggers after few reboots.
Signed-off-by: NAaro Koskinen <aaro.koskinen@iki.fi>
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NWolfram Sang <w.sang@pengutronix.de>

The errata handling function acks wrong interrupt in case of "Arbitration
lost". Fix it.

Discovered during code review, the real impact of the bug is unknown.
Signed-off-by: NAaro Koskinen <aaro.koskinen@iki.fi>
Reviewed-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NWolfram Sang <w.sang@pengutronix.de>

To fix incorrect P-state frequencies which can happen on
some AMD systems f594065f
   "ACPI: Add fixups for AMD P-state figures"
introduced a quirk to obtain the correct values by reading
from AMD specific MSRs.

This did cause a regression when running a kernel using that
quirk under Xen which does (currently) not pass through MSR
reads to the HW. Instead the guest gets a 0 in return.
And this seems to cause a failure to initialize the ondemand
governour (hard to say for sure as all P-states appear to run
at the same frequency).

While this should also be fixed in the hypervisor (to allow
a guest to read that MSR), this patch is intended to work
around the issue in the meantime. In discussion it turned out
that indeed real HW/BIOSes may choose to not set the valid bit
and thus mark the P-state as invalid. So this could be considered
a fix for broken BIOSes that also works around the issue on Xen.
Signed-off-by: NStefan Bader <stefan.bader@canonical.com>
Cc: 3.7+ <stable@vger.kernel.org>
Acked-by: NBorislav Petkov <bp@suse.de>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

OPP pointers cannot be expected to be valid beyond the boundary
of rcu_read_lock and rcu_read_unlock. Unfortunately, the current
exynos4 busfreq driver does not honor the usage constraint and stores
the OPP pointer in struct busfreq_data. This could potentially
become invalid later such as: across devfreq opp change decisions,
resulting in unpredictable behavior.

To fix this, we introduce a busfreq specific busfreq_opp_info
structure which is used to handle OPP information. OPP information
is de-referenced to voltage and frequency pairs as needed into
busfreq_opp_info structure and used as needed.
Signed-off-by: NNishanth Menon <nm@ti.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

OPP pointers are protected by RCU locks, the pointer validity is
permissible only under the section of rcu_read_lock to rcu_read_unlock

Add documentation to the effect.
Signed-off-by: NNishanth Menon <nm@ti.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

OPP pointer is RCU protected, hence after finding it, de-reference
also should be protected with the same RCU context else the OPP
pointer may become invalid.
Reported-by: NJack Mitchell <jack@embed.me.uk>
Tested-by: NAlexander Holler <holler@ahsoftware.de>
Tested-by: NJack Mitchell <jack@embed.me.uk>
Acked-by: NAlexander Holler <holler@ahsoftware.de>
Signed-off-by: NNishanth Menon <nm@ti.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

OPP pointer is RCU protected, hence after finding it, de-reference
also should be protected with the same RCU context else the OPP
pointer may become invalid.
Reported-by: NAlexander Holler <holler@ahsoftware.de>
Tested-by: NAlexander Holler <holler@ahsoftware.de>
Acked-by: NAlexander Holler <holler@ahsoftware.de>
Signed-off-by: NNishanth Menon <nm@ti.com>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

sizeof when applied to a pointer typed expression gives the size of
the pointer

The semantic patch that makes this output is available
in scripts/coccinelle/misc/noderef.cocci.

More information about semantic patching is available at
http://coccinelle.lip6.fr/Signed-off-by: NLaurent Navet <laurent.navet@gmail.com>
Acked-by: NJean Delvare <khali@linux-fr.org>
Signed-off-by: NWolfram Sang <w.sang@pengutronix.de>

in probe() entry of i2c_driver, set the of node of adapter and
call of_i2c_register_devices to register all i2c_client from
dt child-nodes
Signed-off-by: NBarry Song <Baohua.Song@csr.com>
Signed-off-by: NWolfram Sang <w.sang@pengutronix.de>

cmd_err is used to handle error code, so it should not be unsigned.

This fixes the following warning when building with W=1 option:

drivers/i2c/busses/i2c-mxs.c: In function 'mxs_i2c_xfer_msg':
drivers/i2c/busses/i2c-mxs.c:331:19: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
Signed-off-by: NFabio Estevam <fabio.estevam@freescale.com>
Acked-by: NMarek Vasut <marex@denx.de>
Signed-off-by: NWolfram Sang <w.sang@pengutronix.de>
Cc: stable@kernel.org

Signed-off-by: NNestor Ovroy <novroy@riseup.net>
Signed-off-by: NMark Brown <broonie@opensource.wolfsonmicro.com>

The init_completion() call does reinit not only the variable carrying
the flag that the completion finished, but also initialized the
waitqueue associated with the completion. On the contrary, the
INIT_COMPLETION() call only reinits the flag.

In case there was anything still stuck in the waitqueue, subsequent call
to init_completion() would be able to create possible race condition. This
patch uses the proper function and moves init_completion() into .probe() call
of the driver, to be issued only once.

Note that such scenario is impossible, since two threads can never enter the
mxs_i2c_xfer_msg(), since whole this section is protected by mutex in I2C core.
This by no means allows this issue to exit though.
Signed-off-by: NMarek Vasut <marex@denx.de>
Signed-off-by: NWolfram Sang <w.sang@pengutronix.de>

if we have a move notify callback, when moving fails, we call move notify
the opposite way around, however this ends up with *mem containing the mm_node
from the bo, which means we double free it. This is a follow on to the previous
fix.
Reviewed-by: NJerome Glisse <jglisse@redhat.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

When we are using memcpy to move objects around, and we fail to memcpy
due to lack of memory to populate or failure to finish the copy, we don't
want to destroy the mm_node that has been copied into old_copy.

While working on a new kms driver that uses memcpy, if I overallocated bo's
up to the memory limits, and eviction failed, then machine would oops soon
after due to having an active bo with an already freed drm_mm embedded in it,
freeing it a second time didn't end well.
Reviewed-by: NJerome Glisse <jglisse@redhat.com>
Signed-off-by: NDave Airlie <airlied@redhat.com>

The bit width check was introduced by 15afae60 (ACPI, APEI: Fix
incorrect APEI register bit width check and usage), and a fixup
for incorrect 32-bit width memory address was given by f712c71f
(ACPI, APEI: Fixup common access width firmware bug). Now there
is a similar symptom:

[Firmware Bug]: APEI: Invalid bit width + offset in GAR [0x12345000/64/0/3/0]

Another bogus BIOS reports an incorrect 64-bit width in trigger table.
Thus, apply to a similar workaround for 64-bit width memory address.
Signed-off-by: NLans Zhang <jia.zhang@windriver.com>
Acked-by: NGary Hade <garyhade@us.ibm.com>
Acked-by: NMyron Stowe <myron.stowe@redhat.com>
Acked-by: NJean Delvare <jdelvare@suse.de>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>

acpi_processor_get_power_info() has to be called before
acpi_processor_setup_cpuidle_states() to have the latest
information available. This fixes the missing C-state information
after AC-->DC transition.
Signed-off-by: NThomas Schlichter <thomas.schlichter@web.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>