This patch (as1578) adds an hrtimer event to handle the death of an
EHCI controller.  When a controller dies, it doesn't necessarily stop
running right away.  The new event polls at 1-ms intervals to see when
all activity has safely stopped.  This replaces a busy-wait polling
loop in the current code.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1577) adds hrtimer support for unlinking interrupt QHs
in ehci-hcd.  The current code relies on a fixed delay of either 2 or
55 us, which is not always adequate and in any case is totally bogus.
Thanks to internal caching, the EHCI hardware may continue to access
an interrupt QH for more than a millisecond after it has been unlinked.

In fact, the EHCI spec doesn't say how long to wait before using an
unlinked interrupt QH.  The patch sets the delay to 9 microframes
minimum, which ought to be adequate.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1576) adds hrtimer support for managing ehci-hcd's
async schedule.  Just as with the earlier change to the periodic
schedule management, two new hrtimer events take care of everything.

One event polls at 1-ms intervals to see when the Asynchronous
Schedule Status (ASS) flag matches the Asynchronous Schedule Enable
(ASE) value; the schedule's state must not be changed until it does.
The other event delays for 15 ms after the async schedule becomes
empty before turning it off.

The new events replace a busy-wait poll and a kernel timer usage.
They also replace the rather illogical method currently used for
indicating the async schedule should be turned off: attempting to
unlink the dedicated QH at the head of the async list.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1575) removes special code added for status polling of
the EHCI controller in PS3 systems.  While the controller is running,
the polling is now carried out by an hrtimer handler.  When the
controller is suspending or stopping, we use the same polling routine
as the old code -- but in neither case do we need to conclude that the
controller has died if the polling goes on for too long.

As a result the entire handshake_on_error_set_halt() routine is now
unused, so it is removed from the driver.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1574) changes the return type of multiple functions in
ehci-sched.c from int to void.  The values they return are now always
0, so there's no reason for them to return any value at all.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1573) adds hrtimer support for managing ehci-hcd's
periodic schedule.  There are two issues to deal with.

First, the schedule's state (on or off) must not be changed until the
hardware status has caught up with the current command.  This is
handled by an hrtimer event that polls at 1-ms intervals to see when
the Periodic Schedule Status (PSS) flag matches the Periodic Schedule
Enable (PSE) value.

Second, the schedule should not be turned off as soon as it becomes
empty.  Turning the schedule on and off takes time, so we want to wait
until the schedule has been empty for a suitable period before turning
it off.  This is handled by an hrtimer event that gets set to expire
10 ms after the periodic schedule becomes empty.

The existing code polls (for up to 1125 us and with interrupts
disabled!) to check the status, and doesn't implement a delay before
turning off the schedule.  Furthermore, if the polling fails then the
driver decides that the controller has died.  This has caused problems
for several people; some controllers can take 10 ms or more to turn
off their periodic schedules.

This patch fixes these issues.  It also makes the "broken_periodic"
workaround unnecessary; there is no longer any danger of turning off
the periodic schedule after it has been on for less than 1 ms.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1572) begins the conversion of ehci-hcd over to using
high-resolution timers rather than old-fashioned low-resolution kernel
timers.  This reduces overhead caused by timer roundoff on systems
where HZ is smaller than 1000.  Also, the new timer framework
introduced here is much more logical and easily extended than the
ad-hoc approach ehci-hcd currently uses for timers.

An hrtimer structure is added to ehci_hcd, along with a bitflag array
and an array of ktime_t values, to keep track of which timing events
are pending and what their expiration times are.

Only the infrastructure for the timing operations is added in this
patch.  Later patches will add routines for handling each of the
various timing events the driver needs.  In some cases the new hrtimer
handlers will replace the existing handlers for ehci-hcd's kernel
timers; as this happens the old timers will be removed.  In other
cases the new timing events will replace busy-wait loops.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1571) adds a new state for ehci-hcd's root hubs:
EHCI_RH_STOPPING.  This value is used at times when the root hub is
being stopped and we don't know whether or not the hardware has
finished all its DMA yet.

Although the purpose may not be apparent, this distinction will come
in useful later on.  Future patches will avoid actions that depend on
the root hub being operational (like turning on the async or periodic
schedules) when they see the state is EHCI_RH_STOPPING.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1570) adds a pointer for the end of ehci-hcd's
async-unlink list.  The list (which is actually a queue) is singly
linked, so having a pointer to its end makes adding new entries easier
-- there's no longer any need to scan through the whole list.

In principle it could be changed to a standard doubly-linked list.  It
turns out that doing so actually makes the code less clear, so I'm
leaving it as is.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1569) renames the ehci->reclaim list in ehci-hcd.  The
word "reclaim" is used in the EHCI specification to mean something
quite different, and "unlink_next" is more descriptive of the list's
purpose anyway.

Similarly, the "reclaim" field in the ehci_stats structure is renamed
"iaa", which is more meaningful (to experts, anyway) and is a better
match for the "lost_iaa" field.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1568) introduces symbolic constants for some of the
less-frequently used bitfields in the QH structure.  This makes the
code a little easier to read and understand.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1567) removes ehci-hcd's reference counting of QH
structures.  It's not necessary to refcount these things because they
always get deallocated at exactly one spot in ehci_endpoint_disable()
(except for two special QHs, ehci->async and ehci->dummy) and are
never used again.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1566) removes the code in ehci-hcd's resume routines
which tries to restart or cancel any transfers left active while the
root hub or controller was asleep.  This code isn't necessary, because
all URBs are terminated before the root hub is suspended.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Currently, EHCI initialization turns off the controller (in case it
was left running by the firmware) before setting up the ehci_hcd data
structure.  This patch (as1565) reverses that order.

Although it doesn't matter now, it will matter later on when future
additions to ehci_halt() will want to acquire a spinlock that gets
initialized by ehci_init().
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1564c) converts the EHCI platform drivers to use the
central ehci_setup() routine for generic controller initialization
rather than each having its own idiosyncratic approach.

The major point of difficulty lies in ehci-pci's many vendor- and
device-specific workarounds.  Some of them have to be applied before
calling ehci_setup() and some after, which necessitates a fair amount
of code motion.  The other platform drivers require much smaller
changes.

One point not addressed by the patch is whether ports should be
powered on or off following initialization.  The different drivers
appear to handle this pretty much at random.  In fact it shouldn't
matter, because the hub driver turns on power to all ports when it
binds to the root hub.  Straightening that out will be left for
another day.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1563) removes a lot of duplicated code by moving the
EHCI controller suspend/resume routines into the core driver, where
the various platform drivers can invoke them as needed.

Not only does this simplify these platform drivers, this also makes it
easier for other platform drivers to add suspend/resume support in the
future.

Note: The patch does not touch the ehci-fsl.c file, because its
approach to suspend and resume is so different from all the others.
It will have to be handled specially by its maintainer.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

'ARM: OMAP3: USB: Fix the EHCI ULPI PHY reset issue' (1fcb57d0) fixes
an issue where the ULPI PHYs were not held in reset while initializing
the EHCI controller. However, it also changes behavior in
omap-usb-host.c omap_usbhs_init by releasing reset while the
configuration in that function was done.

This change caused a regression on BB-xM where USB would not function
if 'usb start' had been run from u-boot before booting. A change was
made to release reset a little bit earlier which fixed the issue on
BB-xM and did not cause any regressions on 3430 sdp, the board for
which the fix was originally made.

This new fix, 'USB: EHCI: OMAP: Finish ehci omap phy reset cycle
before adding hcd.', (3aa2ae74) caused a regression on OMAP5.

The original fix to hold the EHCI controller in reset during
initialization was correct, however it appears that changing
omap_usbhs_init to not hold the PHYs in reset during it's
configuration was incorrect. This patch first reverts both fixes, and
then changes ehci_hcd_omap_probe in ehci-omap.c to hold the PHYs in
reset as the original patch had done. It also is sure to incorporate
the _cansleep change that has been made in the meantime.

I've tested this on Beagleboard xM, I'd really like to get an ack from
the 3430 sdp and OMAP5 guys before getting this merged.

v3 - Brown paper bag its too early in the morning actually run
     git commit amend fix
v2 - Put cansleep gpiolib call outside of spinlock
Acked-by: NMantesh Sarashetti <mantesh@ti.com>
Tested-by: NMantesh Sarashetti <mantesh@ti.com>
Acked-by: NKeshava Munegowda <keshava_mgowda@ti.com>
Tested-by: NKeshava Munegowda <keshava_mgowda@ti.com>
Signed-off-by: NRuss Dill <Russ.Dill@gmail.com>
Signed-off-by: NSamuel Ortiz <sameo@linux.intel.com>

There are a few (new) usbdevfs capabilities which an application cannot
discover in any other way then checking the kernel version. There are 3
problems with this:
1) It is just not very pretty.
2) Given the tendency of enterprise distros to backport stuff it is not
reliable.
3) As discussed in length on the mailinglist, USBDEVFS_URB_BULK_CONTINUATION
does not work as it should when combined with USBDEVFS_URB_SHORT_NOT_OK
(which is its intended use) on devices attached to an XHCI controller.
So the availability of these features can be host controller dependent,
making depending on them based on the kernel version not a good idea.

This patch besides adding the new ioctl also adds flags for the following
existing capabilities:

USBDEVFS_CAP_ZERO_PACKET,        available since 2.6.31
USBDEVFS_CAP_BULK_CONTINUATION,  available since 2.6.32, except for XHCI
USBDEVFS_CAP_NO_PACKET_SIZE_LIM, available since 3.3

Note that this patch only does not advertise the USBDEVFS_URB_BULK_CONTINUATION
cap for XHCI controllers, bulk transfers with this flag set will still be
accepted when submitted to XHCI controllers.

Returning -EINVAL for them would break existing apps, and in most cases the
troublesome scenario wrt USBDEVFS_URB_SHORT_NOT_OK urbs on XHCI controllers
will never get hit, so this would break working use cases.

The disadvantage of not returning -EINVAL is that cases were it is causing
real trouble may go undetected / the cause of the trouble may be unclear,
but this is the best we can do.
Signed-off-by: NHans de Goede <hdegoede@redhat.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Acked-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The devm_ functions allocate memory that is released when a driver
detaches. This makes the code smaller and a bit simpler.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The devm_ functions allocate memory that is released when a driver
detaches. This makes the code smaller and a bit simpler.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch adds clock gating to suspend and resume functions.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The Microsoft LifeChat 3000 USB headset was causing a very reproducible
hang whenever it was plugged in.  At first, I thought the host
controller was producing bad transfer events, because the log was filled
with errors like:

xhci_hcd 0000:00:14.0: ERROR Transfer event TRB DMA ptr not part of current TD

However, it turned out to be an xHCI driver bug in the ring expansion
patches.  The bug is triggered When there are two ring segments, and a
TD that ends just before a link TRB, like so:

 ______________                     _____________
|              |              ---> | setup TRB B |
 ______________               |     _____________
|              |              |    |  data TRB B |
 ______________               |     _____________
| setup TRB A  | <-- deq      |    |  data TRB B |
 ______________               |     _____________
| data TRB A   |              |    |             | <-- enq, deq''
 ______________               |     _____________
| status TRB A |              |    |             |
 ______________               |     _____________
|  link TRB    |---------------    |  link TRB   |
 _____________  <--- deq'           _____________

TD A (the first control transfer) stalls on the data phase.  That halts
the ring.  The xHCI driver moves the hardware dequeue pointer to the
first TRB after the stalled transfer, which happens to be the link TRB.

Once the Set TR dequeue pointer command completes, the function
update_ring_for_set_deq_completion runs.  That function is supposed to
update the xHCI driver's dequeue pointer to match the internal hardware
dequeue pointer.  On the first call this would work fine, and the
software dequeue pointer would move to deq'.

However, if the transfer immediately after that stalled (TD B in this
case), another Set TR Dequeue command would be issued.  That would move
the hardware dequeue pointer to deq''.  Once that command completed,
update_ring_for_set_deq_completion would run again.

The original code would unconditionally increment the software dequeue
pointer, which moved the pointer off the ring segment into la-la-land.
The while loop would happy increment the dequeue pointer (possibly
wrapping it) until it matched the hardware pointer value.

The while loop would also access all the memory in between the first
ring segment and the second ring segment to determine if it was a link
TRB.  This could cause general protection faults, although it was
unlikely because the ring segments came from a DMA pool, and would often
have consecutive memory addresses.

If nothing in that space looked like a link TRB, the deq_seg pointer for
the ring would remain on the first segment.  Thus, the deq_seg and the
software dequeue pointer would get out of sync.

When the next transfer event came in after the stalled transfer, the
xHCI driver code would attempt to convert the software dequeue pointer
into a DMA address in order to compare the DMA address for the completed
transfer.  Since the deq_seg and the dequeue pointer were out of sync,
xhci_trb_virt_to_dma would return NULL.

The transfer event would get ignored, the transfer would eventually
timeout, and we would mistakenly convert the finished transfer to no-op
TRBs.  Some kernel driver (maybe xHCI?) would then get stuck in an
infinite loop in interrupt context, and the whole machine would hang.

This patch should be backported to kernels as old as 3.4, that contain
the commit b008df60 "xHCI: count free
TRBs on transfer ring"
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: Andiry Xu <andiry.xu@amd.com>
Cc: stable@vger.kernel.org

The host controller port status register supports CAS (Cold Attach
Status) bit. This bit could be set when USB3.0 device is connected
when system is in Sx state. When the system wakes to S0 this port
status with CAS bit is reported and this port can't be used by any
device.

When CAS bit is set the port should be reset by warm reset. This
was not supported by xhci driver.

The issue was found when pendrive was connected to suspended
platform. The link state of "Compliance Mode" was reported together
with CAS bit. This link state was also not supported by xhci and
core/hub.c.

The CAS bit is defined only for xhci root hub port and it is
not supported on regular hubs. The link status is used to force
warm reset on port. Make the USB core issue a warm reset when port
is in ether the 'inactive' or 'compliance mode'. Change the xHCI driver
to report 'compliance mode' when the CAS is set. This force warm reset
on the root hub port.

This patch should be backported to stable kernels as old as 3.2, that
contain the commit 10d674a8 "USB: When
hot reset for USB3 fails, try warm reset."
Signed-off-by: NStanislaw Ledwon <staszek.ledwon@linux.intel.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Acked-by: NAndiry Xu <andiry.xu@amd.com>
Cc: stable@vger.kernel.org

usb_get_phy will return -ENODEV if it's not able to find the phy. Hence
fixed all the callers of usb_get_phy to check for this error condition
instead of relying on a non-zero value as success condition.
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

A recent commit, [PATCH] Fix OMAP EHCI suspend/resume failure
(i693) '354ab856' causes ehci probe to fail on omap3xxx. This
exposed bugs in the ehci_hcd_omap_probe error path causing
an oops.

On the error path, call usb_remove_hcd if usb_add_hcd has been
called, and call usb_put_hcd if usb_alloc_hcd has been called.

Tested on BB-xM.

Signed-off-by: Russ.Dill@ti.com
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This patch (as1562) cleans up the definitions of the EHCI extended
registers to be consistent with the definitions of the standard
registers.  This makes the code look a lot nicer, with no functional
change.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

The struct fhci_regs (in drivers/usb/host/fhci.h) is basically a redefinition
of the struct qe_usb_ctlr (in arch/powerpc/include/asm/immap_qe.h).

The qe_usb_ctlr struct is preferrable once it uses accurately the registers'
names found in the Freescale's QUICC Engine Block Reference Manuals (QEIWRM.pdf
Rev.4.4 Chapter 19 for MPC836xE series and MPC8323ERM.pdf Rev.2 Chapter 36 for
MPC832xE series), making easier to map the FHCI device driver to the hardware
manual. Also, as the FHCI driver uses the USB Controller registers, the name
qe_usb_ctlr is a more precise representation of the hardware than fhci_regs.
Signed-off-by: NGuilherme Maciel Ferreira <guilherme.maciel.ferreira@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Add a linked list for keeping multiple PHY instances with different
types so that we can have separate USB2 and USB3 PHYs on one single
board. _get_phy_ has been changed so that the controller gets
the transceiver by type. _remove_phy_ has been added to let the phy
be removed from the phy list.
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

_transceiver() in otg.c is replaced with _phy. usb_set_transceiver is
replaced with usb_add_phy to make it similar to other usb standard
function names like usb_add_hcd.
Signed-off-by: NKishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: NFelipe Balbi <balbi@ti.com>

The ohci-nxp was assuming the clock was enabled by the board init or
bootloader and just enabling the pll. This enables the usbd and otg
clocks this periferal also needs.
Signed-off-by: NAlexandre Pereira da Silva <aletes.xgr@gmail.com>
Acked-by: NRoland Stigge <stigge@antcom.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Correct "Enbale" -> "Enable", in the desc for USB_HCD_BCMA
and USB_HCD_SSB.
Signed-off-by: NJesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

If the platform_data is not set, pdata will be uninitialized value.
Since the driver has the following code, if the condition is true when
the pdata is uninitialized value, the driver may jump to the illegal
phy_init().

	if (pdata && pdata->phy_init)
		pdata->phy_init();

This patch also fixes the following warning:

  CC      drivers/usb/host/ehci-hcd.o
drivers/usb/host/ehci-sh.c: In function ‘ehci_hcd_sh_probe’:
drivers/usb/host/ehci-sh.c:104: warning: ‘pdata’ may be used uninitialized in this function
Signed-off-by: NYoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Its observed with some PHY, the 60Mhz clock gets
cut too soon for OMAP EHCI, leaving OMAP-EHCI in a bad state.

So on starting port suspend, make sure the 60Mhz clock to EHCI
is kept alive using an internal clock, so that EHCi can cleanly
transition its hw state machine on a port suspend.

Its not proven if this is the issue hit on USB3333,
but the symptoms look very similar.
Signed-off-by: NAnand Gadiyar <gadiyar@ti.com>
Signed-off-by: NVikram Pandita <vikram.pandita@ti.com>
Signed-off-by: NVolodymyr Mieshkov <x0182794@ti.com>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

ohci_finish_controller_resume() is intended to be used in platform specific
drivers ohci-*.c, included from ohci-hcd.c. Some of them don't actually use
ohci_finish_controller_resume(), so mark it as __maybe_unused.
Signed-off-by: NRoland Stigge <stigge@antcom.de>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This fixes the following warning:
In file included from drivers/usb/host/ehci-hcd.c:1246:0:
drivers/usb/host/ehci-xilinx-of.c:293:2: warning: initialization from incompatible pointer type [enabled by default]
drivers/usb/host/ehci-xilinx-of.c:293:2: warning: (near initialization for 'ehci_hcd_xilinx_of_driver.shutdown') [enabled by default]
Signed-off-by: NHerton Ronaldo Krzesinski <herton.krzesinski@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

After commit aaa0ef28 "PS3 EHCI QH
read work-around", Terratec Grabby (em28xx) stopped working with AMD
Geode LX 800 (USB controller AMD CS5536). Since this is a PS3 only
fix, the following patch adds a conditional block around it.
Signed-off-by: NRicardo Martins <rasm@fe.up.pt>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

When system software decides to power down the xHC with the intent of
resuming operation at a later time, it will ask xHC to save the internal
state and restore it when resume to correctly recover from a power event.
Two bits are used to enable this operation: Save State and Restore State.

xHCI spec 4.23.2 says software should "Set the Controller Save/Restore
State flag in the USBCMD register and wait for the Save/Restore State
Status flag in the USBSTS register to transition to '0'". However, it does
not define how long software should wait for the SSS/RSS bit to transition
to 0.

Currently the timeout is set to 1ms. There is bug report
(https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1002697)
indicates that the timeout is too short for ASMedia ASM1042 host controller
to save/restore the state successfully. Increase the timeout to 10ms helps to
resolve the issue.

This patch should be backported to stable kernels as old as 2.6.37, that
contain the commit 5535b1d5 "USB: xHCI:
PCI power management implementation"
Signed-off-by: NAndiry Xu <andiry.xu@gmail.com>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: Ming Lei <ming.lei@canonical.com>
Cc: stable@vger.kernel.org

This patch fixes a few issues introduced in the recent fix
[f8a9e72d: USB: fix resource leak in xhci power loss path]

- The endpoints listed in bw table are just links and each entry is an
 array member of dev->eps[].  But the commit above adds a kfree() call
 to these instances, and thus it results in memory corruption.

- It clears only the first entry of rh_bw[], but there can be multiple
  ports.

- It'd be safer to clear the list_head of ep as well, not only
  removing from the list, as it's checked in
  xhci_discover_or_reset_device().

This patch should be backported to kernels as old as 3.2, that contain
the commit 839c817c "xhci: Store
information about roothubs and TTs."
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Reviewed-by: NOliver Neukum <oneukum@suse.de>
Cc: <stable@vger.kernel.org>

xhci_free_tt_info() may access the invalid memory when it removes the
last entry but the list is not empty.  Then tt_next reaches to the
list head but it still tries to check the tt_info of that entry.

This patch fixes the bug and cleans up the messy code by rewriting
with a simple list_for_each_entry_safe().

This patch should be backported to kernels as old as 3.2, that contain
the commit 839c817c "xhci: Store
information about roothubs and TTs."
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Reviewed-by: NOliver Neukum <oneukum@suse.de>
Cc: <stable@vger.kernel.org>

This patch fixes an issue discovered by Dan Carpenter:

The patch 3b3db026: "xhci: Add infrastructure for host-specific
LPM policies." from May 9, 2012, leads to the following warning:
drivers/usb/host/xhci.c:3909 xhci_get_timeout_no_hub_lpm()
         warn: signedness bug returning '-22'

  3906          default:
  3907                  dev_warn(&udev->dev, "%s: Can't get timeout for non-U1 or U2 state.\n",
  3908                                  __func__);
  3909                  return -EINVAL;
                        ^^^^^^^^^^^^^^
This should be a u16 like USB3_LPM_DISABLED or something.

  3910          }
  3911
  3912          if (sel <= max_sel_pel && pel <= max_sel_pel)
  3913                  return USB3_LPM_DEVICE_INITIATED;
Signed-off-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>