The stack assumes that SDHC controller which support SD3.0 (SDR104) do
support HS200. This is not the case for Tegra 3, which does support SD
3.0
but only supports eMMC spec 4.41.

Use SDHCI_QUIRK2_BROKEN_HS200 to indicate that the controller does not
support HS200.

Note that commit 156e14b1 ("mmc: sdhci: fix caps2 for HS200") added
the tie between SD3.0 (SDR104) and HS200. I don't think that this is
necessarly true. It is fully legitimate to support SD3.0 and not support
HS200. The quirk naming suggests something is broken in the controller,
but this is not the case: The controller simply does not support HS200.

Fixes: 7ad2ed1d ("mmc: tegra: enable UHS-I modes")
Signed-off-by: NStefan Agner <stefan@agner.ch>
Tested-by: NMarcel Ziswiler <marcel.ziswiler@toradex.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Synopsys has DWC MSHC controller on HPAS-DX platform connected using PCIe
interface with SD card slot and eMMC device slots. This patch is to
enable SD cards connected on this platform. As Clock generation logic
is implemented using MMCM module of HAPS-DX platform, we have separate
functions to control the MMCM to generate required clocks with respect
to speed mode.
Signed-off-by: NPrabu Thangamuthu <prabu.t@synopsys.com>
Acked-by: NAdrian Hunter <adrian.hunter@intel.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Adopt the SPDX license identifier headers to ease license compliance
management.
Signed-off-by: NFabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Add a driver for SDHCI OF Synopsys DesignWare Cores Mobile Storage
Signed-off-by: NJisheng Zhang <Jisheng.Zhang@synaptics.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>
Acked-by: NAdrian Hunter <adrian.hunter@intel.com>

For eMMC devices it is valid to only support 1.8V signaling. When
vqmmc is set to a fixed 1.8V regulator the stack tries to set 3.3V
initially and prints the following warning:
   mmc1: Switching to 3.3V signalling voltage failed

Clear the MMC_SIGNAL_VOLTAGE_330 flag in case 3.3V is signaling is
not available. This prevents the stack from even trying to use
3.3V signaling and avoids the above warning.
Signed-off-by: NStefan Agner <stefan@agner.ch>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

SDHCI controller in ls1043a and ls1046a generate 40-bit wide addresses
when doing DMA. Make sure that the corresponding dma mask is correctly
configured.

Context: when enabling smmu on these chips the following problem is
encountered: the smmu input address size is 48 bits so the dma mappings
for sdhci end up 48-bit wide. However, on these chips sdhci only use
40-bits of that address size when doing dma.
So you end up with a 48-bit address translation in smmu but the device
generates transactions with clipped 40-bit addresses, thus smmu context
faults are triggered. Setting up the correct dma mask fixes this
situation.
Signed-off-by: NLaurentiu Tudor <laurentiu.tudor@nxp.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

There is a error message within devm_ioremap_resource
already, so remove the dev_err call to avoid redundant
error message.
Signed-off-by: NWei Yongjun <weiyongjun1@huawei.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

In preparation to enabling -Wimplicit-fallthrough, mark switch cases
where we are expecting to fall through.

Warning level 2 was used: -Wimplicit-fallthrough=2
Signed-off-by: NGustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Just a cosmetic cleanup with no functional impact.
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

A recent commit introduced a call to mmc_of_parse() and removed the
explicit assignment of GPIOs in the pdata structure. This will leave
them set to 0, which is a valid GPIO per se, so the code that looks
at these members will try to allocate them and fail.

To fix this properly, make the following changes:

a) Refrain from allocating and assiging a pdata struct from
   pxamci_of_init(). It's a hack to do it this way anyway.
   Instead, move the only remaining member of interest in
   'struct pxamci_host' and assign the value from either
   the passed in pdata pointer or with the value read from DT.

b) Let the only user of 'detect_delay_ms' look at the member of
   'struct pxamci_host', not the pdata.

c) Make more code in pxamci_probe() dependent on the presence of
   actual pdata.

This will also ease the removal of pdata one day.
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Strip some code by letting the mmc core handle the regulators. The old
.gpio_power pdata handling is kept around for now.

This also set the voltage on the regulator and handles -EPROBE_DEFER
correctly.
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Acked-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Devicetree-enabled boards should use proper regulators to control the
power of cards, not GPIOs, so let's remove this property. The regulator
properties are supported by the MMC core and are described in the
generic MMC document:

  Documentation/devicetree/bindings/mmc/mmc.txt

Note that devicetree support for PXA platforms hasn't fully landed yet,
so this binding does not have any users at this point.
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Acked-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Call into mmc_of_parse() from pxamci_of_init(). As it needs a pointer to a
struct mmc_host, refactor the code a bit.

This allows all generic MMC properties to be set that are described in
Documentation/devicetree/bindings/mmc/mmc.txt. Reword the documentation
a bit to make that clear.

The "cd" and "wp" gpio lookups are removed as the lookup will now be
done by mmc_of_parse().
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Acked-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

pxamci_of_init() had some weird indenting.
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Acked-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

These gpio assignments don't make sense, as they are not used anywhere.
Remove the dead code.
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Acked-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

These members are no longer in use, so let's remove them.
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Acked-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

This seems to be a left-over from times before the IRQ was handled by devm
functions. Remove it.
Signed-off-by: NDaniel Mack <daniel@zonque.org>
Acked-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

The field support_vsel is currently only used in the device tree
case. Get rid of it. No change in behavior.
Signed-off-by: NStefan Agner <stefan@agner.ch>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

The uSDHC supports DDR modes for eMMC devices running at 3.3V. This
allows to run eMMC with 3.3V signaling voltage at DDR52 mode:

  # cat /sys/kernel/debug/mmc1/ios
  clock:          52000000 Hz
  vdd:            21 (3.3 ~ 3.4 V)
  bus mode:       2 (push-pull)
  chip select:    0 (don't care)
  power mode:     2 (on)
  bus width:      3 (8 bits)
  timing spec:    8 (mmc DDR52)
  signal voltage: 0 (3.30 V)
  driver type:    0 (driver type B)
Signed-off-by: NStefan Agner <stefan@agner.ch>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

The last user of mmc_power_save|restore_host() APIs is gone, hence let's
drop them. Drop also the corresponding bus_ops callback,
->power_save|restore() as those becomes redundant.

Cc: Tony Lindgren <tony@atomide.com>
Cc: Eyal Reizer <eyalreizer@gmail.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Convert to use of_match_node method to fix up eSDHC clock for
ls1046a/ls1012a/p1010. Also add eSDHC clock fixup for ls1021a
according to its datasheet. The maxmum speed for ls1021a eSDHC
high speed mode is 46.5MHz.
Signed-off-by: NYinbo Zhu <yinbo.zhu@nxp.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Some controllers immediately report SDHCI_CLOCK_INT_STABLE after
enabling the clock even when the clock is not stable. When used in
conjunction with older/slower cards, this can result in:

    mmc0: error -84 whilst initialising SD card

When the stable reporting is known to be broken, we simply wait for the
maximum stabilization period.
Signed-off-by: NHelmut Grohne <h.grohne@intenta.de>
Acked-by: NAdrian Hunter <adrian.hunter@intel.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Add PCI Ids for Intel ICP.
Signed-off-by: NAdrian Hunter <adrian.hunter@intel.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

Add support to use the new compatible string "qcom,sdhci-msm-v5".

Based on the msm variant, pick the relevant variant data and
use it for register read/write to msm specific registers.
Signed-off-by: NSayali Lokhande <sayalil@codeaurora.org>
Signed-off-by: NVijay Viswanath <vviswana@codeaurora.org>
Reviewed-by: NEvan Green <evgreen@chromium.org>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

In addition to offsets of certain registers changing, the registers in
core_mem have been shifted to HC mem as well. To access these
registers, define msm version specific functions. These functions can
be loaded into the function pointers at the time of probe based on
the msm version detected.

Also defind new data structure to hold version specific Ops and
register addresses.
Signed-off-by: NSayali Lokhande <sayalil@codeaurora.org>
Signed-off-by: NVijay Viswanath <vviswana@codeaurora.org>
Reviewed-by: NEvan Green <evgreen@chromium.org>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

For SDCC version 5.0.0, MCI registers are removed from SDCC
interface and some registers are moved to HC.
Define a new data structure where we can statically define
the address offsets for the registers in different SDCC versions.
Signed-off-by: NSayali Lokhande <sayalil@codeaurora.org>
Signed-off-by: NVijay Viswanath <vviswana@codeaurora.org>
Reviewed-by: NEvan Green <evgreen@chromium.org>
Acked-by: NAdrian Hunter <adrian.hunter@intel.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

This patch adds processing for selecting HS400 mode.
Signed-off-by: NMasaharu Hayakawa <masaharu.hayakawa.ry@renesas.com>
Signed-off-by: NSimon Horman <horms+renesas@verge.net.au>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

This patch adds processing for selecting HS400 mode.
Signed-off-by: NMasaharu Hayakawa <masaharu.hayakawa.ry@renesas.com>
Signed-off-by: NSimon Horman <horms+renesas@verge.net.au>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

This adds two new HS400 tuning operations:
* hs400_downgrade
* hs400_complete

These supplement the existing HS400 operation:
* prepare_hs400_tuning

This is motivated by a requirement of Renesas SDHI for the following:
1. Disabling SCC before selecting to HS if selection of HS400 has occurred.
   This can be done in an implementation of prepare_hs400_tuning_downgrade
2. Updating registers after switching to HS400
   This can be done in an implementation of complete_hs400_tuning

If hs400_downgrade or hs400_complete are not implemented then they are not
called. Thus means there should be no affect for existing drivers as none
implemt these ops.
Signed-off-by: NSimon Horman <horms+renesas@verge.net.au>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

dw_mci_exynos_resume_noirq() performs DWMMC register access without
ensuring that respective clocks are enabled. This might cause external
abort on some systems (observed on Exynos5433 based boards). Fix this
by forcing a PM runtime active state before register access. Using
SET_NOIRQ_SYSTEM_SLEEP_PM_OPS allows also to cleanup conditional code
a bit.
Suggested-by: NUlf Hansson <ulf.hansson@linaro.org>
Signed-off-by: NMarek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

The sdhci get_max_clock callback is set to sdhci_pltfm_clk_get_max_clock
and tegra_sdhci_get_max_clock is removed. It appears that the
shdci-tegra specific callback was originally introduced due to the
requirement that the host clock has to be twice the bus clock on DDR50
mode. As far as I can tell the only effect the removal has on DDR50 mode
is in cases where the parent clock is unable to supply the requested
clock rate, causing the DDR50 mode to run at a lower frequency.
Currently the DDR50 mode isn't enabled on any of the SoCs and would also
require configuring the SDHCI clock divider register to function
properly.

The problem with tegra_sdhci_get_max_clock is that it divides the clock
rate by two and thus artificially limits the maximum frequency of faster
signaling modes which don't have the host-bus frequency ratio requirement
of DDR50 such as SDR104 and HS200. Furthermore, the call to
clk_round_rate() may return an error which isn't handled by
tegra_sdhci_get_max_clock.
Signed-off-by: NAapo Vienamo <avienamo@nvidia.com>
Acked-by: NThierry Reding <treding@nvidia.com>
Tested-by: NThierry Reding <treding@nvidia.com>
Acked-by: NAdrian Hunter <adrian.hunter@intel.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

R1_STATUS(x) now is only used by ioctl_rpmb_card_status_poll(),
which checks all bits as possible. But according to the spec,
bit 17 and bit 18 should be ignored, as well bit 14 which is
reserved(must be set to 0) quoting from the spec and these rule
apply to all places checking the device status. So change
its checking from 0xFFFFE000 to 0xFFF9A000.

As a bonus, we reuse it for mmc_do_erase() as well as
mmc_switch_status_error().
(1) Currently mmc_switch_status_error() doesn't check bit 25, but
it means device is locked but not unlocked by CMD42 prior to any
operations which need check busy, which is also not allowed.
(2) mmc_do_erase() also forgot to to check bit 15, WP_ERASE_SKIP.
The spec says "Only partial address space was erased due to existing
write protected blocks.", which obviously means we should fail this I/O.
Otherwise, the partial erased data stored in nonvalatile flash violates
the data integrity from the view of I/O owner, which probably confuse
it when further used.

So reusing R1_STATUS for them not only improve the readability but also
slove real problems.
Signed-off-by: NShawn Lin <shawn.lin@rock-chips.com>
Signed-off-by: NUlf Hansson <ulf.hansson@linaro.org>

The offset needs to be added after reading the alarm value.

It also needs to be subtracted after the now < alarm test.
Tested-by: NJon Hunter <jonathanh@nvidia.com>
Signed-off-by: NAlexandre Belloni <alexandre.belloni@bootlin.com>

I2C clients may misunderstand recovery pulses if they can't read SDA to
bail out early. In the worst case, as a write operation. To avoid that
and if we can write SDA, try to send STOP to avoid the
misinterpretation.
Signed-off-by: NWolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: NPeter Rosin <peda@axentia.se>
Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
Cc: stable@kernel.org

Fix memory leak in the error path of mlx5_ib_create_srq() by making sure
to free the allocated srq.

Fixes: c2b37f76 ("IB/mlx5: Fix integer overflows in mlx5_ib_create_srq")
Signed-off-by: NKamal Heib <kamalheib1@gmail.com>
Acked-by: NLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>

Incremental patch to fix the unchecked dereference in acpi_nfit_ctl.
Reported by Dan Carpenter:

"acpi/nfit: fix cmd_rc for acpi_nfit_ctl to
always return a value" from Jun 28, 2018, leads to the following
Smatch complaint:

    drivers/acpi/nfit/core.c:578 acpi_nfit_ctl()
     warn: variable dereferenced before check 'cmd_rc' (see line 411)

drivers/acpi/nfit/core.c
   410
   411		*cmd_rc = -EINVAL;
                ^^^^^^^^^^^^^^^^^^
Patch adds unchecked dereference.

Fixes: c1985cef ("acpi/nfit: fix cmd_rc for acpi_nfit_ctl to always return a value")
Signed-off-by: NDave Jiang <dave.jiang@intel.com>

Currently, arch_mem_timer cpumask is set to cpu_all_mask which should be
fine. However, cpu_possible_mask is more accurate and if there are other
clockevent source in the system which are set to cpu_possible_mask, then
having cpu_all_mask may result in issue.

E.g. on a platform with arm,sp804 timer with rating 300 and
cpu_possible_mask and this arch_mem_timer timer with rating 400 and
cpu_all_mask, tick_check_preferred may choose both preferred as the
cpumasks are not equal though they must be.

This issue was root caused incorrectly initially and a fix was merged as
commit 1332a905 ("tick: Prefer a lower rating device only if it's CPU
local device").
Signed-off-by: NSudeep Holla <sudeep.holla@arm.com>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Tested-by: NKevin Hilman <khilman@baylibre.com>
Tested-by: NMartin Blumenstingl <martin.blumenstingl@googlemail.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: Marc Zyngier <marc.zyngier@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Link: https://lkml.kernel.org/r/1531151136-18297-2-git-send-email-sudeep.holla@arm.com

On Tegra30 Cardhu the PCA9546 I2C mux is not ACK'ing I2C commands on
resume from suspend (which is caused by the reset signal for the I2C
mux not being configured correctl). However, this NACK is causing the
Tegra30 to hang on resuming from suspend which is not expected as we
detect NACKs and handle them. The hang observed appears to occur when
resetting the I2C controller to recover from the NACK.

Commit 77821b46 ("i2c: tegra: proper handling of error cases") added
additional error handling for some error cases including NACK, however,
it appears that this change conflicts with an early fix by commit
f70893d0 ("i2c: tegra: Add delay before resetting the controller
after NACK"). After commit 77821b46 was made we now disable 'packet
mode' before the delay from commit f70893d0 happens. Testing shows
that moving the delay to before disabling 'packet mode' fixes the hang
observed on Tegra30. The delay was added to give the I2C controller
chance to send a stop condition and so it makes sense to move this to
before we disable packet mode. Please note that packet mode is always
enabled for Tegra.

Fixes: 77821b46 ("i2c: tegra: proper handling of error cases")
Signed-off-by: NJon Hunter <jonathanh@nvidia.com>
Acked-by: NThierry Reding <treding@nvidia.com>
Signed-off-by: NWolfram Sang <wsa@the-dreams.de>
Cc: stable@vger.kernel.org

uref->field_index, uref->usage_index, finfo.field_index and cinfo.index can be
indirectly controlled by user-space, hence leading to a potential exploitation
of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

drivers/hid/usbhid/hiddev.c:473 hiddev_ioctl_usage() warn: potential spectre issue 'report->field' (local cap)
drivers/hid/usbhid/hiddev.c:477 hiddev_ioctl_usage() warn: potential spectre issue 'field->usage' (local cap)
drivers/hid/usbhid/hiddev.c:757 hiddev_ioctl() warn: potential spectre issue 'report->field' (local cap)
drivers/hid/usbhid/hiddev.c:801 hiddev_ioctl() warn: potential spectre issue 'hid->collection' (local cap)

Fix this by sanitizing such structure fields before using them to index
report->field, field->usage and hid->collection

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Cc: stable@vger.kernel.org
Signed-off-by: NGustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>

Commit ac75a041 ("HID: i2c-hid: fix size check and type usage") started
writing messages when the ret_size is <= 2 from i2c_master_recv.  However, my
device i2c-DLL07D1 returns 2 for a short period of time (~0.5s) after I stop
moving the pointing stick or touchpad.  It varies, but you get ~50 messages
each time which spams the log hard.

[  95.925055] i2c_hid i2c-DLL07D1:01: i2c_hid_get_input: incomplete report (83/2)

This has also been observed with a i2c-ALP0017.

[ 1781.266353] i2c_hid i2c-ALP0017:00: i2c_hid_get_input: incomplete report (30/2)

Only print the message when ret_size is totally invalid and less than 2 to cut
down on the log spam.

Fixes: ac75a041 ("HID: i2c-hid: fix size check and type usage")
Reported-by: NJohn Smith <john-s-84@gmx.net>
Cc: stable@vger.kernel.org
Signed-off-by: NJason Andryuk <jandryuk@gmail.com>
Signed-off-by: NJiri Kosina <jkosina@suse.cz>